Re: [patch] tighten fetchmail policy

[James Carter <jwcart2@xxxxxxxxxxxxxx>]

Merged, except for this little bit.
Better to use r_file_perms and allow the lock permission, unless there
is a good reason not to allow lock.

On Tue, 2005-03-29 at 19:46 -0600, Greg Norris wrote:
>  
>  # file access
> -allow fetchmail_t etc_t:file r_file_perms;
> -allow fetchmail_t fetchmail_etc_t:file r_file_perms;
> +allow fetchmail_t etc_t:file { read getattr ioctl };
> +allow fetchmail_t fetchmail_etc_t:file { read getattr ioctl };
>  allow fetchmail_t mail_spool_t:dir search;
>  file_type_auto_trans(fetchmail_t, mail_spool_t,
> fetchmail_uidl_cache_t, file)
> 
> 
-- 
James Carter <jwcart2@xxxxxxxxxxxxxx>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.