diff --git a/refpolicy/policy/modules/services/bind.fc b/refpolicy/policy/modules/services/bind.fc index 4014974..7c64ed7 100644 --- a/refpolicy/policy/modules/services/bind.fc +++ b/refpolicy/policy/modules/services/bind.fc @@ -1,12 +1,12 @@ /etc/rndc.* -- gen_context(system_u:object_r:named_conf_t,s0) /etc/rndc\.key -- gen_context(system_u:object_r:dnssec_t,s0) -/usr/sbin/lwresd -- gen_context(system_u:object_r:named_exec_t,s0) +/usr/sbin/lwresd -- gen_context(system_u:object_r:named_exec_t,s0) /usr/sbin/named -- gen_context(system_u:object_r:named_exec_t,s0) /usr/sbin/named-checkconf -- gen_context(system_u:object_r:named_checkconf_exec_t,s0) /usr/sbin/r?ndc -- gen_context(system_u:object_r:ndc_exec_t,s0) -/var/log/named.* -- gen_context(system_u:object_r:named_log_t,s0) +/var/log/named.* -- gen_context(system_u:object_r:named_log_t,s0) /var/run/ndc -s gen_context(system_u:object_r:named_var_run_t,s0) /var/run/bind(/.*)? gen_context(system_u:object_r:named_var_run_t,s0) @@ -28,8 +28,8 @@ ifdef(`distro_gentoo',` ') ifdef(`distro_redhat',` -/etc/named\.conf -- gen_context(system_u:object_r:named_conf_t,s0) -/var/named(/.*)? gen_context(system_u:object_r:named_zone_t,s0) +/etc/named\.conf -- gen_context(system_u:object_r:named_conf_t,s0) +/var/named(/.*)? gen_context(system_u:object_r:named_zone_t,s0) /var/named/slaves(/.*)? gen_context(system_u:object_r:named_cache_t,s0) /var/named/data(/.*)? gen_context(system_u:object_r:named_cache_t,s0) /var/named/named\.ca -- gen_context(system_u:object_r:named_conf_t,s0) diff --git a/refpolicy/policy/modules/system/userdomain.if b/refpolicy/policy/modules/system/userdomain.if index ada44f4..6b51898 100644 --- a/refpolicy/policy/modules/system/userdomain.if +++ b/refpolicy/policy/modules/system/userdomain.if @@ -1712,7 +1712,7 @@ template(`userdom_read_user_tmp_files',` ') files_search_tmp($2) - allow $2 $1_tmp_t:dir rw_dir_perms; + allow $2 $1_tmp_t:dir r_dir_perms; allow $2 $1_tmp_t:file r_file_perms; ') @@ -1776,7 +1776,7 @@ template(`userdom_read_user_tmp_symlinks',` ') files_search_tmp($2) - allow $2 $1_tmp_t:dir rw_dir_perms; + allow $2 $1_tmp_t:dir r_dir_perms; allow $2 $1_tmp_t:lnk_file r_file_perms; ')