diff options
| author |   Guido Trentalancia <guido@trentalancia.net> | 2017-05-25 21:27:17 +0200 |
|---|---|---|
| committer |   Jason Zaman <jason@perfinion.com> | 2017-06-06 01:16:18 +0800 |
| commit | 194609ea0eabce3979dcfa3775c86aa86cce4d78 (patch) | |
| tree | 19e4e33f1c0b03712f10330417d059fd8205e7d1 | |
| parent | zabbix: Grant zabbix_agent_t to call setrlimit on self (diff) | |
| download | hardened-refpolicy-194609ea.tar.gz hardened-refpolicy-194609ea.tar.bz2 hardened-refpolicy-194609ea.zip | |
ntp: fix the drift file context and transition
Fix the ntp module by adding a new file context for the default
location of the drift file (frequency of the local clock oscillator)
and by adding the appropriate file transition interface call.
Otherwise, the drift file cannot be created and the following error
message is generated:
frequency file /etc/ntp.drift.TEMP: Permission denied
Signed-off-by: Guido Trentalancia <guido at trentalancia.com>
| -rw-r--r-- | policy/modules/contrib/ntp.fc | 1 | ||||
| -rw-r--r-- | policy/modules/contrib/ntp.te | 1 |
2 files changed, 2 insertions, 0 deletions
diff --git a/policy/modules/contrib/ntp.fc b/policy/modules/contrib/ntp.fc index 9c8c35c9a..38436f38a 100644 --- a/policy/modules/contrib/ntp.fc +++ b/policy/modules/contrib/ntp.fc @@ -3,6 +3,7 @@ /etc/cron\.(daily|weekly)/ntp-server -- gen_context(system_u:object_r:ntpd_exec_t,s0) /etc/ntp\.conf -- gen_context(system_u:object_r:ntp_conf_t,s0) +/etc/ntp\.drift -- gen_context(system_u:object_r:ntp_drift_t,s0) /etc/ntpd.*\.conf.* -- gen_context(system_u:object_r:ntp_conf_t,s0) /etc/ntp/crypto(/.*)? gen_context(system_u:object_r:ntpd_key_t,s0) /etc/ntp/data(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0) diff --git a/policy/modules/contrib/ntp.te b/policy/modules/contrib/ntp.te index cbd5fd187..30071e2db 100644 --- a/policy/modules/contrib/ntp.te +++ b/policy/modules/contrib/ntp.te @@ -66,6 +66,7 @@ allow ntpd_t ntp_conf_t:file read_file_perms; manage_dirs_pattern(ntpd_t, ntp_drift_t, ntp_drift_t) manage_files_pattern(ntpd_t, ntp_drift_t, ntp_drift_t) +files_etc_filetrans(ntpd_t, ntp_drift_t, file) files_var_filetrans(ntpd_t, ntp_drift_t, file) read_files_pattern(ntpd_t, ntpd_key_t, ntpd_key_t) |