aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSugar, David <dsugar@tresys.com>2019-03-20 00:20:33 +0000
committerJason Zaman <jason@perfinion.com>2019-03-25 18:05:25 +0800
commitfc9d8ff11e412d7bf6d8a126c5ec3a0733020d1e (patch)
tree01e560edda4d3b4fb3cb232cc1e0edaabeebf31e
parentsysadm, udev: Module version bump. (diff)
downloadhardened-refpolicy-fc9d8ff11e412d7bf6d8a126c5ec3a0733020d1e.tar.gz
hardened-refpolicy-fc9d8ff11e412d7bf6d8a126c5ec3a0733020d1e.tar.bz2
hardened-refpolicy-fc9d8ff11e412d7bf6d8a126c5ec3a0733020d1e.zip
Add interface ntp_dbus_chat
type=USER_AVC msg=audit(1553013821.622:9900): pid=7377 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.timedate1 member=SetTimezone dest=org.freedesktop.timedate1 spid=16280 tpid=16281 scontext=sysadm_u:sysadm_r:settings_t:s0-s0:c0.c1023 tcontext=system_u:system_r:ntpd_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' type=USER_AVC msg=audit(1553013821.625:9911): pid=7377 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.258 spid=16281 tpid=16280 scontext=system_u:system_r:ntpd_t:s0 tcontext=sysadm_u:sysadm_r:settings_t:s0-s0:c0.c1023 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' Signed-off-by: Dave Sugar <dsugar@tresys.com> Signed-off-by: Jason Zaman <jason@perfinion.com>
-rw-r--r--policy/modules/services/ntp.if21
1 files changed, 21 insertions, 0 deletions
diff --git a/policy/modules/services/ntp.if b/policy/modules/services/ntp.if
index ff85b74b..d64dd86b 100644
--- a/policy/modules/services/ntp.if
+++ b/policy/modules/services/ntp.if
@@ -81,6 +81,27 @@ interface(`ntp_run',`
########################################
## <summary>
+## Send and receive messages from
+## ntpd over dbus.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`ntp_dbus_chat',`
+ gen_require(`
+ type ntpd_t;
+ class dbus send_msg;
+ ')
+
+ allow $1 ntpd_t:dbus send_msg;
+ allow ntpd_t $1:dbus send_msg;
+')
+
+########################################
+## <summary>
## Execute ntpdate server in the ntpd domain.
## </summary>
## <param name="domain">