From 3aab4a8398827f3f6f9dd88f7b59674adc232670 Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Jul 07 2006 14:51:08 +0000 Subject: add audit_write and a little style cleanup. --- diff --git a/refpolicy/policy/modules/system/clock.te b/refpolicy/policy/modules/system/clock.te index fa90fde..03d9885 100644 --- a/refpolicy/policy/modules/system/clock.te +++ b/refpolicy/policy/modules/system/clock.te @@ -1,5 +1,5 @@ -policy_module(clock,1.0.0) +policy_module(clock,1.0.1) ######################################## # @@ -19,16 +19,15 @@ role system_r types hwclock_t; # Local policy # -allow hwclock_t self:process signal_perms; - # Give hwclock the capabilities it requires. dac_override is a surprise, # but hwclock does require it. -allow hwclock_t self:capability { dac_override sys_rawio sys_time sys_tty_config }; +allow hwclock_t self:capability { dac_override sys_rawio sys_time sys_tty_config audit_write }; dontaudit hwclock_t self:capability sys_tty_config; +allow hwclock_t self:process signal_perms; allow hwclock_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay }; # Allow hwclock to store & retrieve correction factors. -allow hwclock_t adjtime_t:file { setattr ioctl read getattr lock write append }; +allow hwclock_t adjtime_t:file { rw_file_perms setattr }; kernel_read_kernel_sysctls(hwclock_t) kernel_list_proc(hwclock_t)