PERFORCE change 39838 for review

[Andrew Reisse]

http://perforce.freebsd.org/chv.cgi?CH=39838

Change 39838 by areisse at areisse_tislabs on 2003/10/17 09:49:09

	allow cvs to access home directories and run some helpers

Affected files ...

.. //depot/projects/trustedbsd/sebsd_policy/policy/macros/program/cvs_macros.te#3 edit

Differences ...

==== //depot/projects/trustedbsd/sebsd_policy/policy/macros/program/cvs_macros.te#3 (text+ko) ====

@@ -44,7 +44,7 @@
 allow $1_cvs_ro_t $1_cvsrep_t:file r_file_perms;
 
 # read/write user home directory
-allow { $1_cvs_rw_t $1_cvs_ro_t } home_root_t:dir search;
+allow { $1_cvs_rw_t $1_cvs_ro_t } home_root_t:dir { getattr search read };
 allow { $1_cvs_rw_t $1_cvs_ro_t } { $2_home_dir_t $2_home_t }:dir create_dir_perms;
 allow { $1_cvs_rw_t $1_cvs_ro_t } $2_home_t:file create_file_perms;
 
@@ -52,4 +52,7 @@
 allow { $1_cvs_rw_t $1_cvs_ro_t } $2_devpts_t:chr_file { write read getattr poll };
 allow { $1_cvs_rw_t $1_cvs_ro_t } $2_tty_device_t:chr_file { write read getattr poll };
 
+# run helpers
+allow { $1_cvs_rw_t $1_cvs_ro_t } bin_t:dir { read search getattr };
+allow { $1_cvs_rw_t $1_cvs_ro_t } bin_t:file { rx_file_perms execute_no_trans };
 ')
To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-cvs" in the body of the message