diff --git a/zabbix-proxy.te b/zabbix-proxy.te index bfb4ae2..74b53de 100644 --- a/zabbix-proxy.te +++ b/zabbix-proxy.te @@ -1,4 +1,4 @@ -module zabbix-proxy 1.3; +module zabbix-proxy 1.4; require { type var_lib_t; @@ -12,7 +12,7 @@ require { class sem { unix_read unix_write associate destroy }; class shm { unix_read unix_write associate destroy }; class tcp_socket { create getattr accept shutdown read }; - class sock_file { create write }; + class sock_file { create write unlink }; class netlink_route_socket { create bind }; class process setrlimit; class unix_stream_socket connectto; @@ -26,5 +26,5 @@ allow initrc_t unlabeled_t:shm { unix_read unix_write associate destroy }; allow unlabeled_t self:tcp_socket { create getattr accept shutdown read }; allow unlabeled_t self:netlink_route_socket { create bind }; allow zabbix_t self:process setrlimit; -allow zabbix_t zabbix_var_run_t:sock_file create; +allow zabbix_t zabbix_var_run_t:sock_file { create write unlink }; allow zabbix_t self:unix_stream_socket connectto; diff --git a/zabbix-server.te b/zabbix-server.te index 506277e..85c6d55 100644 --- a/zabbix-server.te +++ b/zabbix-server.te @@ -1,4 +1,4 @@ -module zabbix-server 1.3; +module zabbix-server 1.4; require { type devlog_t; @@ -12,7 +12,7 @@ require { class capability { sys_resource audit_write }; class file { execute read create ioctl execute_no_trans write getattr unlink open }; class netlink_audit_socket { nlmsg_relay create }; - class sock_file { create write}; + class sock_file { create write unlink }; class unix_dgram_socket { create connect sendto }; class dir { write remove_name add_name }; class key write; @@ -31,4 +31,4 @@ allow zabbix_t syslogd_t:unix_dgram_socket sendto; allow zabbix_t zabbix_var_lib_t:dir { write remove_name add_name }; allow zabbix_t zabbix_var_lib_t:file { execute read create getattr execute_no_trans write ioctl unlink open }; allow zabbix_t self:unix_stream_socket connectto; -allow zabbix_t zabbix_var_run_t:sock_file create; +allow zabbix_t zabbix_var_run_t:sock_file { create write unlink };