[yocto] [PATCH 1/1] refpolicy: allow portmap to create portmap_t type socket

[rongqing.li at windriver.com]

From: Roy Li <rongqing.li at windriver.com>

Signed-off-by: Roy Li <rongqing.li at windriver.com>
---
 .../portmap-allow-portmap-to-create-socket.patch   |   28 ++++++++++++++++++++
 .../refpolicy/refpolicy_2.20130424.inc             |    1 +
 2 files changed, 29 insertions(+)
 create mode 100644 recipes-security/refpolicy/refpolicy-2.20130424/portmap-allow-portmap-to-create-socket.patch

diff --git a/recipes-security/refpolicy/refpolicy-2.20130424/portmap-allow-portmap-to-create-socket.patch b/recipes-security/refpolicy/refpolicy-2.20130424/portmap-allow-portmap-to-create-socket.patch
new file mode 100644
index 0000000..aa89a98
--- /dev/null
+++ b/recipes-security/refpolicy/refpolicy-2.20130424/portmap-allow-portmap-to-create-socket.patch
@@ -0,0 +1,28 @@
+portmap: allow portmap to manage portmap_t type socket
+
+Upstream-Status: Pending
+
+portmap needs to create socket to receive message
+
+Signed-off-by: Roy Li <rongqing.li at windriver.com>
+---
+ policy/modules/contrib/portmap.te |    3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/policy/modules/contrib/portmap.te b/policy/modules/contrib/portmap.te
+index 18b255e..bacf66b 100644
+--- a/policy/modules/contrib/portmap.te
++++ b/policy/modules/contrib/portmap.te
+@@ -16,6 +16,9 @@ type portmap_helper_exec_t;
+ init_system_domain(portmap_helper_t, portmap_helper_exec_t)
+ role portmap_helper_roles types portmap_helper_t;
+ 
++allow portmap_t self:tcp_socket create_socket_perms;
++allow portmap_t self:udp_socket create_socket_perms;
++
+ type portmap_initrc_exec_t;
+ init_script_file(portmap_initrc_exec_t)
+ 
+-- 
+1.7.10.4
+
diff --git a/recipes-security/refpolicy/refpolicy_2.20130424.inc b/recipes-security/refpolicy/refpolicy_2.20130424.inc
index a052a2c..5d55030 100644
--- a/recipes-security/refpolicy/refpolicy_2.20130424.inc
+++ b/recipes-security/refpolicy/refpolicy_2.20130424.inc
@@ -52,6 +52,7 @@ SRC_URI += "file://poky-policy-fix-xconsole_device_t-as-a-dev_node.patch \
             file://poky-policy-fix-dmesg-to-use-dev-kmsg.patch \
             file://hostname-do-not-audit-attempts-by-hostname-to-read-a.patch \
             file://sysnetwork-dhcpc-binds-socket-to-random-high-udp-por.patch \
+            file://portmap-allow-portmap-to-create-socket.patch \
            "
 
 # Backport from upstream
-- 
1.7.10.4