commit: e52d67f09e996710fb8f6a8c9e37843788269b46
Author: Luis Ressel <aranea <AT> aixah <DOT> de>
AuthorDate: Tue Dec 6 22:49:02 2016 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Thu Dec 8 04:45:02 2016 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=e52d67f0
kernel.if: Allow listing /proc/sys/net/unix
The kernel_read_unix_sysctls() and kernel_rw_unix_sysctls() currenly
don't allow listing the /proc/sys/net/unix directory, contrary to the
other sysctl interfaces.
policy/modules/kernel/kernel.if | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index 5af202c..29709df 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -1758,7 +1758,7 @@ interface(`kernel_read_unix_sysctls',`
read_files_pattern($1, { proc_t sysctl_t sysctl_net_t },
sysctl_net_unix_t)
- list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
+ list_dirs_pattern($1, { proc_t sysctl_t }, { sysctl_net_t
sysctl_net_unix_t })
')
########################################
@@ -1780,7 +1780,7 @@ interface(`kernel_rw_unix_sysctls',`
rw_files_pattern($1, { proc_t sysctl_t sysctl_net_t },
sysctl_net_unix_t)
- list_dirs_pattern($1, { proc_t sysctl_t }, sysctl_net_t)
+ list_dirs_pattern($1, { proc_t sysctl_t }, { sysctl_net_t
sysctl_net_unix_t })
')
########################################
