[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     2e3ce947e381b99fbaf7c7fd15ea90b12ef01155
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Wed Oct 31 21:18:28 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Fri Nov  2 19:07:58 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=2e3ce947

Support initial creation of mysql database files

The first thing a MySQL administrator has to do is to create the database
(files) themselves. This is done through the mysql_install_db command. However,
this command invokes mysqld to properly setup the environment.

This allow the calling domain of the administrator to execute (without
transitioning) the mysqld_exec_t resources (such as mysqld).

Without this, the installation fails with:

  FATAL ERROR: Could not find /usr/sbin/mysqld

Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

---
 policy/modules/contrib/mysql.if |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/policy/modules/contrib/mysql.if b/policy/modules/contrib/mysql.if
index 66a1dca..0ebcdf1 100644
--- a/policy/modules/contrib/mysql.if
+++ b/policy/modules/contrib/mysql.if
@@ -416,7 +416,7 @@ interface(`mysql_search_pid_files',`
 #
 interface(`mysql_admin',`
 	gen_require(`
-		type mysqld_t, mysqld_var_run_t, mysqld_etc_t;
+		type mysqld_t, mysqld_var_run_t, mysqld_etc_t, mysqld_exec_t;
 		type mysqld_tmp_t, mysqld_db_t, mysqld_log_t;
 		type mysqld_safe_t, mysqlmanagerd_t, mysqlmanagerd_var_run_t;
 		type mysqld_initrc_exec_t, mysqlmanagerd_initrc_exec_t;
@@ -430,6 +430,8 @@ interface(`mysql_admin',`
 	role_transition $2 { mysqlmanagerd_initrc_exec_t mysqld_initrc_exec_t } system_r;
 	allow $2 system_r;
 
+	can_exec($1, mysqld_exec_t)
+
 	files_search_pids($1)
 	admin_pattern($1, { mysqlmanagerd_var_run_t mysqld_var_run_t })