PERFORCE change 113429 for review

[Todd Miller]

http://perforce.freebsd.org/chv.cgi?CH=113429

Change 113429 by millert at millert_macbook on 2007/01/22 20:21:42

	Allow kernel-generated packets, such as ICMP replies, to
	be sent.

Affected files ...

.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/kernel/corenetwork.te.in#4 edit

Differences ...

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/kernel/corenetwork.te.in#4 (text+ko) ====

@@ -188,6 +188,9 @@
 type netif_t, netif_type;
 sid netif gen_context(system_u:object_r:netif_t,s0 - mls_systemhigh)
 
+# Allow in-kernel transmission for ICMP replies and the like
+corenet_raw_send_all_if(netif_t)
+
 build_option(`enable_mls',`
 network_interface(lo, lo,s0 - mls_systemhigh)
 ')