于 14-2-10 下午3:58, rongqing...@windriver.com 写道:
From: Roy Li <rongqing...@windriver.com>Signed-off-by: Roy Li <rongqing...@windriver.com> --- .../portmap-allow-portmap-to-create-socket.patch | 28 ++++++++++++++++++++ .../refpolicy/refpolicy_2.20130424.inc | 1 + 2 files changed, 29 insertions(+) create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/portmap-allow-portmap-to-create-socket.patch diff --git a/recipes-security/refpolicy/refpolicy-2.20130424/portmap-allow-portmap-to-create-socket.patch b/recipes-security/refpolicy/refpolicy-2.20130424/portmap-allow-portmap-to-create-socket.patch new file mode 100644 index 0000000..aa89a98 --- /dev/null +++ b/recipes-security/refpolicy/refpolicy-2.20130424/portmap-allow-portmap-to-create-socket.patch @@ -0,0 +1,28 @@ +portmap: allow portmap to manage portmap_t type socket + +Upstream-Status: Pending + +portmap needs to create socket to receive message + +Signed-off-by: Roy Li <rongqing...@windriver.com> +--- + policy/modules/contrib/portmap.te | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/policy/modules/contrib/portmap.te b/policy/modules/contrib/portmap.te +index 18b255e..bacf66b 100644 +--- a/policy/modules/contrib/portmap.te ++++ b/policy/modules/contrib/portmap.te +@@ -16,6 +16,9 @@ type portmap_helper_exec_t; + init_system_domain(portmap_helper_t, portmap_helper_exec_t) + role portmap_helper_roles types portmap_helper_t; + ++allow portmap_t self:tcp_socket create_socket_perms; ++allow portmap_t self:udp_socket create_socket_perms; ++ + type portmap_initrc_exec_t; + init_script_file(portmap_initrc_exec_t) + +-- +1.7.10.4 + diff --git a/recipes-security/refpolicy/refpolicy_2.20130424.inc b/recipes-security/refpolicy/refpolicy_2.20130424.inc index a052a2c..5d55030 100644 --- a/recipes-security/refpolicy/refpolicy_2.20130424.inc +++ b/recipes-security/refpolicy/refpolicy_2.20130424.inc @@ -52,6 +52,7 @@ SRC_URI += "file://poky-policy-fix-xconsole_device_t-as-a-dev_node.patch \ file://poky-policy-fix-dmesg-to-use-dev-kmsg.patch \ file://hostname-do-not-audit-attempts-by-hostname-to-read-a.patch \ file://sysnetwork-dhcpc-binds-socket-to-random-high-udp-por.patch \ + file://portmap-allow-portmap-to-create-socket.patch \ " # Backport from upstream
Ack. These rules are in old versions, and droped in 12d4d8. https://github.com/xinpascal/selinux-refpolicy-contrib/commit/12d4d86602452c9b6fd6f74fc47ce29d5ae55ba9 It is better if you have time to dig. Any way, I agree to merge this. Thanks, Roy. :) -- - Pascal _______________________________________________ yocto mailing list yocto@yoctoproject.org https://lists.yoctoproject.org/listinfo/yocto
