[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/

[Sven Vermeulen]

commit:     57ed0a43a214867626046638fd5826626e0b6814
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Tue Sep 24 13:39:11 2013 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Fri Sep 27 13:22:54 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=57ed0a43

Unconfined domains have unconfined access to all of dbus rather than only system bus

unconfined: unconfined_t is real-time scheduled by rtkit

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/system/unconfined.if |  3 +--
 policy/modules/system/unconfined.te | 49 ++++++-------------------------------
 2 files changed, 9 insertions(+), 43 deletions(-)

diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if
index db7aabb..5ca20a9 100644
--- a/policy/modules/system/unconfined.if
+++ b/policy/modules/system/unconfined.if
@@ -67,8 +67,7 @@ interface(`unconfined_domain_noaudit',`
 	')
 
 	optional_policy(`
-		# Communicate via dbusd.
-		dbus_system_bus_unconfined($1)
+		dbus_unconfined($1)
 	')
 
 	optional_policy(`

diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
index 0442922..77018f2 100644
--- a/policy/modules/system/unconfined.te
+++ b/policy/modules/system/unconfined.te
@@ -80,40 +80,6 @@ optional_policy(`
 ')
 
 optional_policy(`
-	init_dbus_chat_script(unconfined_t)
-
-	dbus_stub(unconfined_t)
-
-	optional_policy(`
-		avahi_dbus_chat(unconfined_t)
-	')
-
-	optional_policy(`
-		bluetooth_dbus_chat(unconfined_t)
-	')
-
-	optional_policy(`
-		consolekit_dbus_chat(unconfined_t)
-	')
-
-	optional_policy(`
-		cups_dbus_chat_config(unconfined_t)
-	')
-
-	optional_policy(`
-		hal_dbus_chat(unconfined_t)
-	')
-
-	optional_policy(`
-		networkmanager_dbus_chat(unconfined_t)
-	')
-
-	optional_policy(`
-		oddjob_dbus_chat(unconfined_t)
-	')
-')
-
-optional_policy(`
 	firstboot_run(unconfined_t, unconfined_r)
 ')
 
@@ -183,6 +149,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	rtkit_scheduled(unconfined_t)
+')
+
+optional_policy(`
 	rpm_run(unconfined_t, unconfined_r)
 ')
 
@@ -209,6 +179,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	unconfined_dbus_chat(unconfined_t)
+')
+
+optional_policy(`
 	usermanage_run_admin_passwd(unconfined_t, unconfined_r)
 ')
 
@@ -237,12 +211,5 @@ allow unconfined_execmem_t self:process { execstack execmem };
 unconfined_domain_noaudit(unconfined_execmem_t)
 
 optional_policy(`
-	dbus_stub(unconfined_execmem_t)
-
-	init_dbus_chat_script(unconfined_execmem_t)
 	unconfined_dbus_chat(unconfined_execmem_t)
-
-	optional_policy(`
-		hal_dbus_chat(unconfined_execmem_t)
-	')
 ')