diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index 50f2774..6381618 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -1,5 +1,5 @@ -policy_module(corenetwork, 1.13.10) +policy_module(corenetwork, 1.13.11) ######################################## # @@ -131,6 +131,7 @@ network_port(kismet, tcp,2501,s0) network_port(kprop, tcp,754,s0) network_port(ktalkd, udp,517,s0, udp,518,s0) network_port(ldap, tcp,389,s0, udp,389,s0, tcp,636,s0, udp,636,s0, tcp,3268,s0) +network_port(lirc, tcp,8765,s0) network_port(lmtp, tcp,24,s0, udp,24,s0) type lrrd_port_t, port_type; dnl network_port(lrrd_port_t) # no defined portcon network_port(mail, tcp,2000,s0, tcp,3905,s0) diff --git a/policy/modules/services/lircd.te b/policy/modules/services/lircd.te index 0c469d1..a5f72ad 100644 --- a/policy/modules/services/lircd.te +++ b/policy/modules/services/lircd.te @@ -1,5 +1,5 @@ -policy_module(lircd, 1.0.1) +policy_module(lircd, 1.0.2) ######################################## # @@ -24,8 +24,10 @@ files_pid_file(lircd_var_run_t) # lircd local policy # -allow lircd_t self:process signal; +allow lircd_t self:capability { chown kill sys_admin }; +allow lircd_t self:fifo_file rw_fifo_file_perms; allow lircd_t self:unix_dgram_socket create_socket_perms; +allow lircd_t self:tcp_socket create_stream_socket_perms; # etc file read_files_pattern(lircd_t, lircd_etc_t, lircd_etc_t) @@ -37,7 +39,14 @@ files_pid_filetrans(lircd_t, lircd_var_run_t, { dir file }) # /dev/lircd socket dev_filetrans(lircd_t, lircd_var_run_t, sock_file) +corenet_tcp_sendrecv_generic_if(lircd_t) +corenet_tcp_bind_generic_node(lircd_t) +corenet_tcp_bind_lirc_port(lircd_t) +corenet_tcp_sendrecv_all_ports(lircd_t) +corenet_tcp_connect_lirc_port(lircd_t) + dev_read_generic_usb_dev(lircd_t) +dev_read_mouse(lircd_t) dev_filetrans_lirc(lircd_t) dev_rw_lirc(lircd_t) dev_rw_input_dev(lircd_t) @@ -52,3 +61,5 @@ term_use_ptmx(lircd_t) logging_send_syslog_msg(lircd_t) miscfiles_read_localization(lircd_t) + +sysnet_dns_name_resolve(lircd_t)