Add openl2tpd to l2tpd policy

diff --git a/policy/modules/services/l2tpd.fc b/policy/modules/services/l2tpd.fc
index 5e6d4727348c9a5fb6bfebd630a48fb97f7bac68..76d879e1e000fb0ee755b79f9c94f40a66b2ff25 100644 (file)
--- a/policy/modules/services/l2tpd.fc
+++ b/policy/modules/services/l2tpd.fc
@@ -1,7 +1,9 @@
 
 /etc/rc\.d/init\.d/xl2tpd      --      gen_context(system_u:object_r:l2tpd_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/openl2tpd   --      gen_context(system_u:object_r:l2tpd_initrc_exec_t,s0)
 
 /usr/sbin/xl2tpd               --      gen_context(system_u:object_r:l2tpd_exec_t,s0)
+/usr/sbin/openl2tpd            --      gen_context(system_u:object_r:l2tpd_exec_t,s0)
 
 /var/run/xl2tpd(/.*)?                  gen_context(system_u:object_r:l2tpd_var_run_t,s0)
 

diff --git a/policy/modules/services/l2tpd.te b/policy/modules/services/l2tpd.te
index b9637a3c3bfe2e3bbb160e2b0bb3b043ef97972c..02359ec213cc5d1050b14cce4e803088b48c9766 100644 (file)
--- a/policy/modules/services/l2tpd.te
+++ b/policy/modules/services/l2tpd.te
@@ -14,6 +14,9 @@ permissive l2tpd_t;
 type l2tpd_initrc_exec_t;
 init_script_file(l2tpd_initrc_exec_t)
 
+type l2tpd_tmp_t;
+files_tmp_file(l2tpd_tmp_t)
+
 type l2tpd_var_run_t;
 files_pid_file(l2tpd_var_run_t)
 
@@ -21,19 +24,28 @@ files_pid_file(l2tpd_var_run_t)
 #
 # l2tpd local policy
 #
-allow l2tpd_t self:capability { kill };
-allow l2tpd_t self:process { fork signal };
+allow l2tpd_t self:capability net_bind_service;
+allow l2tpd_t self:process signal;
 
 allow l2tpd_t self:fifo_file rw_fifo_file_perms;
 allow l2tpd_t self:unix_stream_socket create_stream_socket_perms;
+allow l2tpd_t self:tcp_socket create_stream_socket_perms;
+
+manage_sock_files_pattern(l2tpd_t, l2tpd_tmp_t, l2tpd_tmp_t)
+files_tmp_filetrans(l2tpd_t, l2tpd_tmp_t, sock_file)
 
 manage_dirs_pattern(l2tpd_t, l2tpd_var_run_t, l2tpd_var_run_t)
 manage_files_pattern(l2tpd_t, l2tpd_var_run_t, l2tpd_var_run_t)
+manage_sock_files_pattern(l2tpd_t, l2tpd_var_run_t, l2tpd_var_run_t)
 manage_fifo_files_pattern(l2tpd_t, l2tpd_var_run_t, l2tpd_var_run_t)
-files_pid_filetrans(l2tpd_t, l2tpd_var_run_t, { dir file })
+files_pid_filetrans(l2tpd_t, l2tpd_var_run_t, { dir file sock_file fifo_file })
 
+corenet_tcp_bind_generic_node(l2tpd_t)
 corenet_udp_bind_generic_node(l2tpd_t)
 corenet_udp_bind_generic_port(l2tpd_t)
+corenet_tcp_bind_all_rpc_ports(l2tpd_t)
+
+dev_read_urand(l2tpd_t)
 
 domain_use_interactive_fds(l2tpd_t)