From: dwalsh_at_redhat.com
Date: Wed, 30 May 2007 11:39:09 -0400

Additional interfaces for access to /selinux

--- nsaserefpolicy/policy/modules/kernel/selinux.if	2007-05-29 14:10:48.000000000 -0400
+++ serefpolicy-3.0.1/policy/modules/kernel/selinux.if	2007-05-30 09:25:53.000000000 -0400

@@ -51,6 +51,44 @@  

 ########################################
 ## <summary>


+##	Do not audit attempts to get the

+##	attributes of the selinuxfs filesystem

+## </summary>
+## <param name="domain">


+##	<summary>

+##	Domain to not audit.

+##	</summary>

+## </param>
+#
+interface(`selinux_dontaudit_getattr_fs',`
+	gen_require(`
+		type security_t;
+	')
+
+	dontaudit $1 security_t:filesystem getattr;
+')
+
+########################################
+## <summary>


+##	Allow domain to get the

+##	attributes of the selinuxfs filesystem

+## </summary>
+## <param name="domain">


+##	<summary>

+##	Domain to not audit.

+##	</summary>

+## </param>
+#
+interface(`selinux_getattr_fs',`
+	gen_require(`
+		type security_t;
+	')
+
+	allow $1 security_t:filesystem getattr;
+')
+
+########################################
+## <summary>
 ##	Search selinuxfs.

 ## </summary>
 ## <param name="domain">

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Received on Wed 30 May 2007 - 13:37:20 EDT