commit: a2a70a8441dcf2d226c6f35ee8549acc420b0be1
Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Sat May 16 11:08:49 2015 +0000
Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Sat May 16 11:08:49 2015 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=a2a70a84
Fix bug #549640 - Add dontaudit getattr on chr and blk devices for sudo domain
policy/modules/admin/sudo.if | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/policy/modules/admin/sudo.if b/policy/modules/admin/sudo.if
index 56ce11c..8bd1963 100644
--- a/policy/modules/admin/sudo.if
+++ b/policy/modules/admin/sudo.if
@@ -160,6 +160,12 @@ template(`sudo_role_template',`
optional_policy(`
fprintd_dbus_chat($1_sudo_t)
')
+
+ ifdef(`distro_gentoo',`
+ # Fix bug 549640 - Add dontaudit getattr on chr and blk devices
as is done with regular user domains too
+ dev_dontaudit_getattr_all_blk_files($1_sudo_t)
+ dev_dontaudit_getattr_all_chr_files($1_sudo_t)
+ ')
')
########################################
