trunk: Enable open permission checks policy capability.

[people/stevee/selinux-policy.git] / policy / modules / services / apache.te

diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te
index bb7d2c92572a9254ed938667ca2d0c4468815e3b..490683fbaf94f7599e71aba148bf67a5b09d45f0 100644 (file)
--- a/policy/modules/services/apache.te
+++ b/policy/modules/services/apache.te
@@ -258,7 +258,7 @@ manage_dirs_pattern(httpd_t, httpd_squirrelmail_t, httpd_squirrelmail_t)
 manage_files_pattern(httpd_t, httpd_squirrelmail_t, httpd_squirrelmail_t)
 manage_lnk_files_pattern(httpd_t, httpd_squirrelmail_t, httpd_squirrelmail_t)
 
-allow httpd_t httpd_suexec_exec_t:file { getattr read };
+allow httpd_t httpd_suexec_exec_t:file read_file_perms;
 
 allow httpd_t httpd_sys_content_t:dir list_dir_perms;
 read_files_pattern(httpd_t, httpd_sys_content_t, httpd_sys_content_t)
@@ -509,9 +509,9 @@ optional_policy(`
 
 domtrans_pattern(httpd_t, httpd_helper_exec_t, httpd_helper_t)
 
-allow httpd_helper_t httpd_config_t:file { getattr read };
+allow httpd_helper_t httpd_config_t:file read_file_perms;
 
-allow httpd_helper_t httpd_log_t:file append;
+allow httpd_helper_t httpd_log_t:file append_file_perms;
 
 libs_use_ld_so(httpd_helper_t)
 libs_use_shared_libs(httpd_helper_t)
@@ -677,7 +677,7 @@ allow httpd_sys_script_t httpd_t:tcp_socket { read write };
 
 dontaudit httpd_sys_script_t httpd_config_t:dir search;
 
-allow httpd_sys_script_t httpd_squirrelmail_t:file { append read };
+allow httpd_sys_script_t httpd_squirrelmail_t:file { append_file_perms read_file_perms };
 
 allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms;
 read_files_pattern(httpd_sys_script_t, squirrelmail_spool_t, squirrelmail_spool_t)
@@ -692,7 +692,7 @@ files_search_spool(httpd_sys_script_t)
 apache_domtrans_rotatelogs(httpd_sys_script_t)
 
 ifdef(`distro_redhat',`
-       allow httpd_sys_script_t httpd_log_t:file { getattr append };
+       allow httpd_sys_script_t httpd_log_t:file append_file_perms;
 ')
 
 tunable_policy(`httpd_enable_homedirs',`