[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/

[Kenton Groombridge]

commit:     2804c33404d9a21cbe3fdcf1ed36df2ca76a5d09
Author:     George Zenner <zen <AT> pyl <DOT> onl>
AuthorDate: Fri Feb 10 21:45:09 2023 +0000
Commit:     Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Mon Feb 13 15:26:25 2023 +0000
URL:        
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=2804c334

Signed-off-by: George Zenner <zen <AT> pyl.onl>

        modified:   policy/modules/system/sysnetwork.if

Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>

 policy/modules/system/sysnetwork.if | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/policy/modules/system/sysnetwork.if 
b/policy/modules/system/sysnetwork.if
index 5bf1a6f8c..99291eefe 100644
--- a/policy/modules/system/sysnetwork.if
+++ b/policy/modules/system/sysnetwork.if
@@ -83,6 +83,25 @@ interface(`sysnet_dontaudit_use_dhcpc_fds',`
        dontaudit $1 dhcpc_t:fd use;
 ')
 
+########################################
+## <summary>
+##      Do not audit attempts to read/write to the
+##      dhcp unix datagram socket descriptors.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain to not audit.
+##      </summary>
+## </param>
+#
+interface(`sysnet_dontaudit_rw_dhcpc_unix_dgram_sockets',`
+        gen_require(`
+                type dhcpc_t;
+        ')
+
+        dontaudit $1 dhcpc_t:unix_dgram_socket { read write };
+')
+
 ########################################
 ## <summary>
 ##     Do not audit attempts to read/write to the