diff --git a/policy/modules/services/rpc.te b/policy/modules/services/rpc.te index 808154d..5b8581a 100644 --- a/policy/modules/services/rpc.te +++ b/policy/modules/services/rpc.te @@ -1,5 +1,5 @@ -policy_module(rpc, 1.10.4) +policy_module(rpc, 1.10.5) ######################################## # @@ -23,7 +23,7 @@ gen_tunable(allow_gssd_read_tmp, true) gen_tunable(allow_nfsd_anon_write, false) type exports_t; -files_type(exports_t) +files_config_file(exports_t) rpc_domain_template(gssd) @@ -69,15 +69,21 @@ kernel_read_network_state(rpcd_t) kernel_read_sysctl(rpcd_t) kernel_rw_fs_sysctls(rpcd_t) kernel_dontaudit_getattr_core_if(rpcd_t) +kernel_signal(rpcd_t) corecmd_exec_bin(rpcd_t) files_manage_mounttab(rpcd_t) +files_getattr_all_dirs(rpcd_t) fs_list_rpc(rpcd_t) fs_read_rpc_files(rpcd_t) fs_read_rpc_symlinks(rpcd_t) fs_rw_rpc_sockets(rpcd_t) +fs_get_all_fs_quotas(rpcd_t) +fs_getattr_all_fs(rpcd_t) + +storage_getattr_fixed_disk_dev(rpcd_t) selinux_dontaudit_read_fs(rpcd_t) @@ -86,6 +92,10 @@ miscfiles_read_certs(rpcd_t) seutil_dontaudit_search_config(rpcd_t) optional_policy(` + automount_signal(rpcd_t) +') + +optional_policy(` nis_read_ypserv_config(rpcd_t) ') @@ -116,7 +126,7 @@ files_search_pids(nfsd_t) # for exportfs and rpc.mountd files_getattr_tmp_dirs(nfsd_t) # cjp: this should really have its own type -files_manage_mounttab(rpcd_t) +files_manage_mounttab(nfsd_t) fs_mount_nfsd_fs(nfsd_t) fs_search_nfsd_fs(nfsd_t) @@ -183,9 +193,12 @@ files_list_tmp(gssd_t) files_read_usr_symlinks(gssd_t) auth_use_nsswitch(gssd_t) +auth_manage_cache(gssd_t) miscfiles_read_certs(gssd_t) +mount_signal(gssd_t) + tunable_policy(`allow_gssd_read_tmp',` userdom_list_user_tmp(gssd_t) userdom_read_user_tmp_files(gssd_t) @@ -193,6 +206,10 @@ tunable_policy(`allow_gssd_read_tmp',` ') optional_policy(` + automount_signal(gssd_t) +') + +optional_policy(` kerberos_keytab_template(gssd, gssd_t) ')