[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/services/

["Jason Zaman" <perfinion@gentoo.org>]

commit:     e312e5bdbbf8d7c76b13d94b02ad56372d6d8b37
Author:     Russell Coker <russell <AT> coker <DOT> com <DOT> au>
AuthorDate: Wed Feb 16 13:07:30 2022 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Feb 27 02:13:17 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=e312e5bd

dontaudit net_admin without hide_broken_symptoms

Sending this patch again without the ifdef, I agree that the ifdef isn't very
useful nowadays.

Signed-off-by: Russell Coker <russell <AT> coker.com.au>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/services/cron.te      | 2 ++
 policy/modules/services/dbus.te      | 2 ++
 policy/modules/services/policykit.te | 2 ++
 policy/modules/services/postfix.te   | 2 ++
 4 files changed, 8 insertions(+)

diff --git a/policy/modules/services/cron.te b/policy/modules/services/cron.te
index 03268277..9ecbe4d6 100644
--- a/policy/modules/services/cron.te
+++ b/policy/modules/services/cron.te
@@ -209,6 +209,8 @@ tunable_policy(`fcron_crond',`
 # Daemon local policy
 #
 
+# for changing buffer sizes
+dontaudit crond_t self:capability net_admin;
 allow crond_t self:capability { chown dac_override dac_read_search fowner setgid setuid sys_nice };
 dontaudit crond_t self:capability { sys_resource sys_tty_config };
 

diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te
index c0b98558..9a1e6b30 100644
--- a/policy/modules/services/dbus.te
+++ b/policy/modules/services/dbus.te
@@ -67,6 +67,8 @@ ifdef(`enable_mls',`
 # Local policy
 #
 
+# for changing buffer sizes
+dontaudit system_dbusd_t self:capability net_admin;
 allow system_dbusd_t self:capability { dac_override setgid setpcap setuid sys_resource };
 dontaudit system_dbusd_t self:capability sys_tty_config;
 allow system_dbusd_t self:process { getattr getsched signal_perms setpgid getcap setcap setrlimit };

diff --git a/policy/modules/services/policykit.te b/policy/modules/services/policykit.te
index ee8f4c2d..46f5568f 100644
--- a/policy/modules/services/policykit.te
+++ b/policy/modules/services/policykit.te
@@ -68,6 +68,8 @@ miscfiles_read_localization(policykit_domain)
 # Local policy
 #
 
+# for changing buffer sizes
+dontaudit policykit_t self:capability net_admin;
 allow policykit_t self:capability { dac_override dac_read_search setgid setuid sys_nice sys_ptrace };
 allow policykit_t self:process { getsched setsched signal };
 allow policykit_t self:unix_stream_socket { accept connectto listen };

diff --git a/policy/modules/services/postfix.te b/policy/modules/services/postfix.te
index 6b97df10..6fe06887 100644
--- a/policy/modules/services/postfix.te
+++ b/policy/modules/services/postfix.te
@@ -107,6 +107,8 @@ mta_mailserver_delivery(postfix_virtual_t)
 # Common postfix domain local policy
 #
 
+# for changing buffer sizes
+dontaudit postfix_domain self:capability net_admin;
 allow postfix_domain self:capability { sys_chroot sys_nice };
 dontaudit postfix_domain self:capability sys_tty_config;
 allow postfix_domain self:process { signal_perms setpgid setsched };