Allow access to unlabeled socket and fifo files.
Just use notdevfile_class_set to pick up all non-device file classes.
Change-Id: Ib3604537ccfc25da67823f0f2b5d70b84edfaadf
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
diff --git a/domain.te b/domain.te
index f5d4bae..103d690 100644
--- a/domain.te
+++ b/domain.te
@@ -129,9 +129,8 @@
# capability, it's essentially useless. This is needed to allow an app with
# relabelto to relabel unlabeled files.
#
-allow domain unlabeled:file { create_file_perms relabelfrom };
+allow domain unlabeled:notdevfile_class_set { create_file_perms relabelfrom };
allow domain unlabeled:dir { create_dir_perms relabelfrom };
-allow domain unlabeled:lnk_file { create_file_perms };
neverallow { domain -relabeltodomain } *:dir_file_class_set relabelto;
###