[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     f4fe0ad50474a788016bffa6dfc9afee4a080c8c
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Thu Sep 26 06:34:23 2013 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Mon Sep 30 19:00:56 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=f4fe0ad5

mandb: /etc/cron.daily/man-db executes dpkg, reads dpkg db on Debian

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/dpkg.if  | 19 +++++++++++++++++++
 policy/modules/contrib/mandb.te |  7 ++++++-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/policy/modules/contrib/dpkg.if b/policy/modules/contrib/dpkg.if
index 9aa68a6..fdc06d6 100644
--- a/policy/modules/contrib/dpkg.if
+++ b/policy/modules/contrib/dpkg.if
@@ -21,6 +21,25 @@ interface(`dpkg_domtrans',`
 
 ########################################
 ## <summary>
+##	Execute the dkpg in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dpkg_exec',`
+	gen_require(`
+		type dpkg_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, dpkg_exec_t)
+')
+
+########################################
+## <summary>
 ##	Execute dpkg_script programs in
 ##	the dpkg_script domain.
 ## </summary>

diff --git a/policy/modules/contrib/mandb.te b/policy/modules/contrib/mandb.te
index 0fb1897..1465f27 100644
--- a/policy/modules/contrib/mandb.te
+++ b/policy/modules/contrib/mandb.te
@@ -1,4 +1,4 @@
-policy_module(mandb, 1.1.0)
+policy_module(mandb, 1.1.1)
 
 ########################################
 #
@@ -47,3 +47,8 @@ optional_policy(`
 optional_policy(`
 	cron_system_entry(mandb_t, mandb_exec_t)
 ')
+
+optional_policy(`
+	dpkg_exec(mandb_t)
+	dpkg_read_db(mandb_t)
+')
\ No newline at end of file