add missing interface

diff --git a/refpolicy/policy/modules/services/apache.te b/refpolicy/policy/modules/services/apache.te
index 0e4c00738de685883b4313b22cf75a2259e22293..0f5b1d66bc8ad35d8d8cec4887bd88c40055c5b7 100644 (file)
--- a/refpolicy/policy/modules/services/apache.te
+++ b/refpolicy/policy/modules/services/apache.te
@@ -360,6 +360,7 @@ optional_policy(`mta.te',`
 
 optional_policy(`mysql.te',`
        mysql_stream_connect(httpd_t)
+       mysql_rw_db_socket(httpd_t)
 ')
 
 optional_policy(`nis.te',`
@@ -389,16 +390,6 @@ allow httpd_t home_root_t:dir getattr;
 dontaudit httpd_t sysadm_home_dir_t:dir getattr;
 allow httpd_sys_script_t var_spool_t:dir getattr;
 
-optional_policy(`mysql.te',`
-       allow httpd_t mysqld_db_t:dir search;
-       allow httpd_t mysqld_db_t:sock_file rw_file_perms;
-')
-
-optional_policy(`mysql.te',`
-       allow httpd_sys_script_t mysqld_db_t:dir search;
-       allow httpd_sys_script_t mysqld_db_t:sock_file rw_file_perms;
-')
-
 ifdef(`targeted_policy',`
        if (httpd_enable_homedirs) {
                allow httpd_t user_home_dir_t:dir { getattr search };
@@ -615,6 +606,7 @@ ifdef(`distro_redhat',`
 
 optional_policy(`mysql.te',`
        mysql_stream_connect(httpd_sys_script_t)
+       mysql_rw_db_socket(httpd_sys_script_t)
 ')
 
 ########################################

diff --git a/refpolicy/policy/modules/services/mysql.if b/refpolicy/policy/modules/services/mysql.if
index fd6e75d5c2119d14ea70a26f3fef681cb5813b80..cbda7b41f1da36fc418d9aeae4514b235b8c669b 100644 (file)
--- a/refpolicy/policy/modules/services/mysql.if
+++ b/refpolicy/policy/modules/services/mysql.if
@@ -11,7 +11,6 @@
 interface(`mysql_signal',`
        gen_require(`
                type mysqld_t;
-               class process signal;
        ')
 
        allow $1 mysqld_t:process signal;
@@ -28,9 +27,6 @@ interface(`mysql_signal',`
 interface(`mysql_stream_connect',`
        gen_require(`
                type mysqld_t, mysqld_var_run_t;
-               class unix_stream_socket connectto;
-               class dir search;
-               class sock_file write;
        ')
 
        allow $1 mysqld_var_run_t:dir search;
@@ -49,9 +45,6 @@ interface(`mysql_stream_connect',`
 interface(`mysql_read_config',`
        gen_require(`
                type mysqld_etc_t;
-               class dir { getattr read search };
-               class file { read getattr };
-               class lnk_file { getattr read };
        ')
 
        allow $1 mysqld_etc_t:dir { getattr read search };
@@ -73,7 +66,6 @@ interface(`mysql_read_config',`
 interface(`mysql_search_db_dir',`
        gen_require(`
                type mysqld_db_t;
-               class dir search;
        ')
 
        files_search_var_lib($1)
@@ -91,7 +83,6 @@ interface(`mysql_search_db_dir',`
 interface(`mysql_rw_db_dir',`
        gen_require(`
                type mysqld_db_t;
-               class rw_dir_perms;
        ')
 
        files_search_var_lib($1)
@@ -109,13 +100,31 @@ interface(`mysql_rw_db_dir',`
 interface(`mysql_manage_db_dir',`
        gen_require(`
                type mysql_db_t;
-               class create_dir_perms;
        ')
 
        files_search_var_lib($1)
        allow $1 mysqld_db_t:dir create_dir_perms;
 ')
 
+########################################
+## <summary>
+##     Read and write to the MySQL database
+##     named socket.
+## </summary>
+## <param name="domain">
+##     Domain allowed access.
+## </param>
+#
+interface(`mysql_rw_db_socket',`
+       gen_require(`
+               type mysqld_db_t;
+       ')
+
+       files_search_var_lib($1)
+       allow $1 mysqld_db_t:dir search;
+       allow $1 mysqld_db_t:sock_file rw_file_perms;
+')
+
 ########################################
 ## <summary>
 ##     Write to the MySQL log.
@@ -127,7 +136,6 @@ interface(`mysql_manage_db_dir',`
 interface(`mysql_write_log',`
        gen_require(`
                type mysqld_log_t;
-               class file { write append setattr ioctl };
        ')
 
        logging_search_logs($1)