PERFORCE change 113425 for review

[Todd Miller]

http://perforce.freebsd.org/chv.cgi?CH=113425

Change 113425 by millert at millert_macbook on 2007/01/22 20:17:39

	configd needs to be able to getattr not just read
	modules_object_t:file Children spawned by configd need to
	be able to check /var/run pid files.

Affected files ...

.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/darwin/configd.te#17 edit

Differences ...

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/darwin/configd.te#17 (text+ko) ====

@@ -125,7 +125,7 @@
 
 # Allow configd to load kexts
 allow configd_t modules_object_t:dir { read search };
-allow configd_t modules_object_t:file read;
+allow configd_t modules_object_t:file { read getattr };
 
 # Allow configd to run ifconfig
 allow configd_t ifconfig_exec_t:file { execute_no_trans getattr read };
@@ -172,6 +172,9 @@
 # Not sure why it wants to search this dir, it should know what it wants
 allow configd_t var_log_t:dir search;
 
+# Configd child processes needs access to pid files
+allow configd_t init_var_run_t:file { getattr read };
+
 # Search /var/vm
 files_search_vm(securityd_t)