PERFORCE change 113384 for review

[Todd Miller]

http://perforce.freebsd.org/chv.cgi?CH=113384

Change 113384 by millert at millert_macbook on 2007/01/22 19:52:24

	Allow access to /var/vm and permission to remove old swapfiles.
	
	Remove redundant set_special_port rule.

Affected files ...

.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/system/init.te#8 edit

Differences ...

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/system/init.te#8 (text+ko) ====

@@ -646,7 +646,6 @@
 # Talk to self
 init_allow_ipc(init_t)
 allow init_t self:mach_port move_recv;
-allow init_t self:mach_task set_special_port;
 allow init_t self:mi_notify_ipc notify_server_set_state;
 
 # Talk to the kernel
@@ -677,3 +676,8 @@
 
 # Allow access to security files
 darwin_allow_security_read(init_t)
+
+# Allow access to /var/vm
+allow init_t var_vm_t:dir { search getattr read remove_name };
+# Allow startup to remove old files
+allow init_t dynamic_pager_swapfile_t:file { getattr unlink };