diff --git a/policy/modules/services/cgroup.fc b/policy/modules/services/cgroup.fc index abde2f2..4b353d4 100644 --- a/policy/modules/services/cgroup.fc +++ b/policy/modules/services/cgroup.fc @@ -1,10 +1,10 @@ -/etc/cgconfig.conf -- gen_context(system_u:object_r:cgconfig_etc_t,s0) -/etc/cgrules.conf -- gen_context(system_u:object_r:cgrules_etc_t,s0) +/etc/cgconfig.conf -- gen_context(system_u:object_r:cgconfig_etc_t,s0) +/etc/cgrules.conf -- gen_context(system_u:object_r:cgrules_etc_t,s0) /etc/rc\.d/init\.d/cgconfig -- gen_context(system_u:object_r:cgconfig_initrc_exec_t,s0) /etc/rc\.d/init\.d/cgred -- gen_context(system_u:object_r:cgred_initrc_exec_t,s0) /sbin/cgconfigparser -- gen_context(system_u:object_r:cgconfigparser_exec_t,s0) -/sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t,s0) +/sbin/cgrulesengd -- gen_context(system_u:object_r:cgred_exec_t,s0) -/var/run/cgred.* gen_context(system_u:object_r:cgred_var_run_t,s0) +/var/run/cgred.* gen_context(system_u:object_r:cgred_var_run_t,s0) diff --git a/policy/modules/services/cgroup.if b/policy/modules/services/cgroup.if index 4b3fb8d..5770206 100644 --- a/policy/modules/services/cgroup.if +++ b/policy/modules/services/cgroup.if @@ -102,7 +102,7 @@ interface(`cgroup_stream_connect', ` ######################################## ## -## All of the rules required to administrate +## All of the rules required to administrate ## an cgroup environment. ## ## @@ -121,7 +121,7 @@ interface(`cgroup_admin',` gen_require(` type cgred_t, cgconfigparser_t, cgred_var_run_t; type cgconfig_etc_t, cgconfig_initrc_exec_t, cgred_initrc_exec_t; - type cgred_etc_t, cgroup_t; + type cgred_etc_t, cgroup_t; ') allow $1 cgconfigparser_t:process { ptrace signal_perms getattr }; diff --git a/policy/modules/services/cgroup.te b/policy/modules/services/cgroup.te index 32baa99..438df21 100644 --- a/policy/modules/services/cgroup.te +++ b/policy/modules/services/cgroup.te @@ -56,7 +56,6 @@ files_getattr_all_files(cgred_t) files_getattr_all_sockets(cgred_t) files_read_all_symlinks(cgred_t) files_search_all(cgred_t) - files_read_etc_files(cgred_t) fs_write_cgroup_files(cgred_t) diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index 62c1c0d..1b670e1 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -47,7 +47,7 @@ type init_var_run_t; files_pid_file(init_var_run_t) # -# initctl_t is the type of the named pipe created +# initctl_t is the type of the named pipe created # by init during initialization. This pipe is used # to communicate with init. # @@ -89,7 +89,7 @@ ifdef(`enable_mls',` # Use capabilities. old rule: allow init_t self:capability ~sys_module; -# is ~sys_module really needed? observed: +# is ~sys_module really needed? observed: # sys_boot # sys_tty_config # kill: now provided by domain_kill_all_domains() @@ -344,7 +344,7 @@ files_list_default(initrc_t) files_mounton_default(initrc_t) fs_delete_cgroup_dirs(initrc_t) -fs_list_cgroup_dirs(initrc_t) +fs_list_cgroup_dirs(initrc_t) fs_rw_cgroup_files(initrc_t) fs_list_inotifyfs(initrc_t) fs_register_binary_executable_type(initrc_t)