commit: 719bb6fcfab49d6630c0b893ccfe0337b9866e74
Author: Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Sat Jul 11 19:44:51 2015 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Jul 11 19:54:20 2015 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=719bb6fc
vnstatd: allow user terminals and sysfs
needs to read sysfs to enumerate the network interfaces to update
and needs to use user terminals to output.
type=AVC msg=audit(1436643487.611:833572): avc: denied { read } for
pid=13632 comm="vnstat" name="bond0" dev="sysfs" ino=18625
scontext=staff_u:sysadm_r:vnstat_t tcontext=system_u:object_r:sysfs_t
tclass=lnk_file
type=AVC msg=audit(1436643691.358:833596): avc: denied { read write }
for pid=13802 comm="vnstat" path="/dev/pts/5" dev="devpts" ino=8
scontext=staff_u:sysadm_r:vnstat_t
tcontext=staff_u:object_r:user_devpts_t tclass=chr_file
policy/modules/contrib/vnstatd.te | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/policy/modules/contrib/vnstatd.te
b/policy/modules/contrib/vnstatd.te
index 79351c4..9630fe9 100644
--- a/policy/modules/contrib/vnstatd.te
+++ b/policy/modules/contrib/vnstatd.te
@@ -84,3 +84,8 @@ miscfiles_read_localization(vnstat_t)
optional_policy(`
cron_system_entry(vnstat_t, vnstat_exec_t)
')
+
+ifdef(`distro_gentoo',`
+ dev_read_sysfs(vnstat_t)
+ userdom_use_user_terminals(vnstat_t)
+')
