commit: 45581b7ac1b5fafd180b6bc43c1ea329c416b1ec
Author: Sugar, David <dsugar <AT> tresys <DOT> com>
AuthorDate: Mon Feb 25 23:37:47 2019 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Mon Mar 25 10:05:25 2019 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=45581b7a
Allow AIDE to mmap files
AIDE has a compile time option WITH_MMAP which allows AIDE to
map files during scanning. RHEL7 has set this option in the
aide rpm they distribute.
Changes made to add a tunable to enable permissions allowing
aide to map files that it needs. I have set the default to
false as this seems perfered (in my mind).
Signed-off-by: Dave Sugar <dsugar <AT> tresys.com>
Signed-off-by: Jason Zaman <jason <AT> perfinion.com>
policy/modules/admin/aide.te | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/policy/modules/admin/aide.te b/policy/modules/admin/aide.te
index f58ba850..fe52a280 100644
--- a/policy/modules/admin/aide.te
+++ b/policy/modules/admin/aide.te
@@ -5,6 +5,15 @@ policy_module(aide, 1.8.0)
# Declarations
#
+## <desc>
+## <p>
+## Control if AIDE can mmap files.
+## AIDE can be compiled with the option 'with-mmap' in which case it will
+## attempt to mmap files while running.
+## </p>
+## </desc>
+gen_tunable(aide_mmap_files, false)
+
attribute_role aide_roles;
type aide_t;
@@ -43,6 +52,10 @@ logging_send_syslog_msg(aide_t)
userdom_use_user_terminals(aide_t)
+tunable_policy(`aide_mmap_files',`
+ files_map_non_auth_files(aide_t)
+')
+
optional_policy(`
seutil_use_newrole_fds(aide_t)
')
