diff --git a/policy-20070501.patch b/policy-20070501.patch index 459cf8e..f35a5ab 100644 --- a/policy-20070501.patch +++ b/policy-20070501.patch @@ -1713,8 +1713,53 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.if.in serefpolicy-2.6.4/policy/modules/kernel/corenetwork.if.in --- nsaserefpolicy/policy/modules/kernel/corenetwork.if.in 2007-05-07 14:51:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/corenetwork.if.in 2007-08-07 09:42:35.000000000 -0400 -@@ -2061,3 +2061,61 @@ ++++ serefpolicy-2.6.4/policy/modules/kernel/corenetwork.if.in 2007-09-11 11:35:53.000000000 -0400 +@@ -1449,6 +1449,44 @@ + + ######################################## + ## ++## Connect TCP sockets to rpc ports. ++## ++## ++## ++## The type of the process performing this action. ++## ++## ++# ++interface(`corenet_tcp_connect_all_rpc_ports',` ++ gen_require(` ++ attribute rpc_port_type; ++ ') ++ ++ allow $1 rpc_port_type:tcp_socket name_connect; ++') ++ ++######################################## ++## ++## Do not audit attempts to connect TCP sockets ++## all rpc ports. ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`corenet_dontaudit_tcp_connect_all_rpc_ports',` ++ gen_require(` ++ attribute rpc_port_type; ++ ') ++ ++ dontaudit $1 rpc_port_type:tcp_socket name_connect; ++') ++ ++ ++######################################## ++## + ## Read and write the TUN/TAP virtual network device. + ## + ## +@@ -2061,3 +2099,61 @@ typeattribute $1 corenet_unconfined_type; ')