PERFORCE change 113412 for review

[Todd Miller]

http://perforce.freebsd.org/chv.cgi?CH=113412

Change 113412 by millert at millert_macbook on 2007/01/22 20:06:27

	Deal with unconfined_t.

Affected files ...

.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/system/darwin.te#6 edit

Differences ...

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/system/darwin.te#6 (text+ko) ====

@@ -25,3 +25,27 @@
 fs_associate(darwin_keychain_t)
 fs_associate(darwin_global_pref_t)
 fs_associate(darwin_private_t)
+
+# Temporary rules for unconfined_t
+mach_allow_message(unconfined_t, unconfined_t)
+mach_allow_message(unconfined_t, kernel_t)
+mach_allow_message(unconfined_t, init_t)
+mach_allow_message(unconfined_t, securityd_t)
+
+allow unconfined_t init_t:mi_bootstrap { bootstrap_look_up bootstrap_subset };
+allow unconfined_t init_t:mi_notify_ipc { notify_server_register_check notify_server_get_state notify_server_register_plain };
+allow unconfined_t { darwin_system_t framework_t darwin_private_t darwin_CoreServices_t darwin_global_pref_t darwin_system_t darwin_host_pref_t var_vm_t }:dir { search getattr };
+allow unconfined_t { darwin_CoreServices_t darwin_global_pref_t darwin_host_pref_t }:file read;
+allow unconfined_t framework_t:{file dir lnk_file} read;
+allow unconfined_t framework_t:file getattr;
+
+# Allow communication with unconfined
+mach_allow_ipc(configd_t, unconfined_t)
+mach_allow_ipc(coreservicesd_t, unconfined_t)
+mach_allow_ipc(diskarbitrationd_t, unconfined_t)
+mach_allow_ipc(init_t, unconfined_t)
+mach_allow_ipc(kextd_t, unconfined_t)
+mach_allow_ipc(loginwindow_t, unconfined_t)
+mach_allow_ipc(memberd_t, unconfined_t)
+mach_allow_ipc(notifyd_t, unconfined_t)
+mach_allow_ipc(securityd_t, unconfined_t)