From: Roy Li <rongqing...@windriver.com>
Signed-off-by: Roy Li <rongqing...@windriver.com>
---
.../portmap-allow-portmap-to-create-socket.patch | 28 ++++++++++++++++++++
.../refpolicy/refpolicy_2.20130424.inc | 1 +
2 files changed, 29 insertions(+)
create mode 100644
recipes-security/refpolicy/refpolicy-2.20130424/portmap-allow-portmap-to-create-socket.patch
diff --git
a/recipes-security/refpolicy/refpolicy-2.20130424/portmap-allow-portmap-to-create-socket.patch
b/recipes-security/refpolicy/refpolicy-2.20130424/portmap-allow-portmap-to-create-socket.patch
new file mode 100644
index 0000000..aa89a98
--- /dev/null
+++
b/recipes-security/refpolicy/refpolicy-2.20130424/portmap-allow-portmap-to-create-socket.patch
@@ -0,0 +1,28 @@
+portmap: allow portmap to manage portmap_t type socket
+
+Upstream-Status: Pending
+
+portmap needs to create socket to receive message
+
+Signed-off-by: Roy Li <rongqing...@windriver.com>
+---
+ policy/modules/contrib/portmap.te | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/policy/modules/contrib/portmap.te
b/policy/modules/contrib/portmap.te
+index 18b255e..bacf66b 100644
+--- a/policy/modules/contrib/portmap.te
++++ b/policy/modules/contrib/portmap.te
+@@ -16,6 +16,9 @@ type portmap_helper_exec_t;
+ init_system_domain(portmap_helper_t, portmap_helper_exec_t)
+ role portmap_helper_roles types portmap_helper_t;
+
++allow portmap_t self:tcp_socket create_socket_perms;
++allow portmap_t self:udp_socket create_socket_perms;
++
+ type portmap_initrc_exec_t;
+ init_script_file(portmap_initrc_exec_t)
+
+--
+1.7.10.4
+
diff --git a/recipes-security/refpolicy/refpolicy_2.20130424.inc
b/recipes-security/refpolicy/refpolicy_2.20130424.inc
index a052a2c..5d55030 100644
--- a/recipes-security/refpolicy/refpolicy_2.20130424.inc
+++ b/recipes-security/refpolicy/refpolicy_2.20130424.inc
@@ -52,6 +52,7 @@ SRC_URI +=
"file://poky-policy-fix-xconsole_device_t-as-a-dev_node.patch \
file://poky-policy-fix-dmesg-to-use-dev-kmsg.patch \
file://hostname-do-not-audit-attempts-by-hostname-to-read-a.patch \
file://sysnetwork-dhcpc-binds-socket-to-random-high-udp-por.patch \
+ file://portmap-allow-portmap-to-create-socket.patch \
"
# Backport from upstream
--
1.7.10.4
_______________________________________________
yocto mailing list
yocto@yoctoproject.org
https://lists.yoctoproject.org/listinfo/yocto
