Closed zpytela closed 4 years ago
To recap: the current state is
allow certmonger_t cert_type:dir { add_name getattr ioctl lock open read remove_name search write };
allow certmonger_t cert_type:file { append create getattr ioctl link lock open read rename setattr unlink write };
There is a request for dir create
and, based on the filename, there will be a rename requested later, too. The only existing superset is the manage interface.
A new PR to modify existing an existing interface reflecting the current state: https://github.com/fedora-selinux/selinux-policy/pull/468
Closing this PR in favor of https://github.com/fedora-selinux/selinux-policy-contrib/pull/356
Expanding on my comment in #348, how about just extending
miscfiles_manage_all_certs()
with thecreate
permission fordir
s? (And removing the two newmiscfiles_*_generic_cert_dirs()
interfaces?)