commit: fc9d8ff11e412d7bf6d8a126c5ec3a0733020d1e
Author: Sugar, David <dsugar <AT> tresys <DOT> com>
AuthorDate: Wed Mar 20 00:20:33 2019 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Mon Mar 25 10:05:25 2019 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=fc9d8ff1
Add interface ntp_dbus_chat
type=USER_AVC msg=audit(1553013821.622:9900): pid=7377 uid=81 auid=4294967295
ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:
denied { send_msg } for msgtype=method_call
interface=org.freedesktop.timedate1 member=SetTimezone
dest=org.freedesktop.timedate1 spid=16280 tpid=16281
scontext=sysadm_u:sysadm_r:settings_t:s0-s0:c0.c1023
tcontext=system_u:system_r:ntpd_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon"
sauid=81 hostname=? addr=? terminal=?'
type=USER_AVC msg=audit(1553013821.625:9911): pid=7377 uid=81 auid=4294967295
ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:
denied { send_msg } for msgtype=method_return dest=:1.258 spid=16281
tpid=16280 scontext=system_u:system_r:ntpd_t:s0
tcontext=sysadm_u:sysadm_r:settings_t:s0-s0:c0.c1023 tclass=dbus
exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
Signed-off-by: Dave Sugar <dsugar <AT> tresys.com>
Signed-off-by: Jason Zaman <jason <AT> perfinion.com>
policy/modules/services/ntp.if | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/policy/modules/services/ntp.if b/policy/modules/services/ntp.if
index ff85b74b..d64dd86b 100644
--- a/policy/modules/services/ntp.if
+++ b/policy/modules/services/ntp.if
@@ -79,6 +79,27 @@ interface(`ntp_run',`
roleattribute $2 ntpd_roles;
')
+########################################
+## <summary>
+## Send and receive messages from
+## ntpd over dbus.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`ntp_dbus_chat',`
+ gen_require(`
+ type ntpd_t;
+ class dbus send_msg;
+ ')
+
+ allow $1 ntpd_t:dbus send_msg;
+ allow ntpd_t $1:dbus send_msg;
+')
+
########################################
## <summary>
## Execute ntpdate server in the ntpd domain.
