New policy for yam

[David Hampton]

On Tue, 2005-03-15 at 09:20 -0500, Daniel J Walsh wrote:

> Why did you create a yam_crond_t?  Why not just transition to yam_t from 
> crond?

When I first started working on the policy I was trying to be as
restrictive as possible and differentiate between what peripheral files
could be opened when running yam from the command line vs. when running
from cron.  For example, the cron version requires less access to the
terminal and no access to a ssh file descriptor.  The two instances also
try reading their dot files from different directories.

I wrote this policy just after writing an exim policy that distinguished
between user, sysadm, and system invocations of the program.  Perhaps I
went overboard here.

David

P.S. I'm still tweaking the exim policy.  I'll probably post it in a
week or so.