[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     dda4d354bc1839e0e0a3e7b65c5768857ce62511
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Mon Oct 29 11:52:45 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Oct 29 14:51:29 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=dda4d354

Changes to the tftp policy module

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/tftp.if |   19 ++++++++++---------
 policy/modules/contrib/tftp.te |   36 +++++++++++++++++-------------------
 2 files changed, 27 insertions(+), 28 deletions(-)

diff --git a/policy/modules/contrib/tftp.if b/policy/modules/contrib/tftp.if
index d899263..f7c6ea3 100644
--- a/policy/modules/contrib/tftp.if
+++ b/policy/modules/contrib/tftp.if
@@ -1,8 +1,8 @@
-## <summary>Trivial file transfer protocol daemon</summary>
+## <summary>Trivial file transfer protocol daemon.</summary>
 
 ########################################
 ## <summary>
-##	Read tftp content
+##	Read tftp content files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -15,12 +15,14 @@ interface(`tftp_read_content',`
 		type tftpdir_t;
 	')
 
+	files_search_var_lib($1)
 	read_files_pattern($1, tftpdir_t, tftpdir_t)
 ')
 
 ########################################
 ## <summary>
-##	Manage tftp /var/lib files.
+##	Create, read, write, and delete
+##	tftp rw content.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -143,8 +145,8 @@ interface(`tftp_filetrans_tftpdir',`
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate
-##	an tftp environment
+##	All of the rules required to
+##	administrate an tftp environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -159,15 +161,14 @@ interface(`tftp_admin',`
 		type tftpd_conf_t;
 	')
 
-	allow $1 tftpd_t:process { ptrace signal_perms getattr };
+	allow $1 tftpd_t:process { ptrace signal_perms };
 	ps_process_pattern($1, tftpd_t)
 
 	files_search_etc($1)
 	admin_pattern($1, tftpd_conf_t)
 
-	admin_pattern($1, tftpdir_rw_t)
-
-	admin_pattern($1, tftpdir_t)
+	files_search_var_lib($1)
+	admin_pattern($1, { tftpdir_t tftpdir_rw_t })
 
 	files_list_pids($1)
 	admin_pattern($1, tftpd_var_run_t)

diff --git a/policy/modules/contrib/tftp.te b/policy/modules/contrib/tftp.te
index b7c94be..0cebfd0 100644
--- a/policy/modules/contrib/tftp.te
+++ b/policy/modules/contrib/tftp.te
@@ -6,10 +6,12 @@ policy_module(tftp, 1.12.3)
 #
 
 ## <desc>
-## <p>
-## Allow tftp to modify public files
-## used for public file transfer services.
-## </p>
+##	<p>
+##	Determine whether tftp can modify
+##	public files used for public file
+##	transfer services. Directories/Files must
+##	be labeled public_content_rw_t.
+##	</p>
 ## </desc>
 gen_tunable(tftp_anon_write, false)
 
@@ -43,15 +45,15 @@ files_type(tftpdir_rw_t)
 #
 
 allow tftpd_t self:capability { setgid setuid sys_chroot };
-allow tftpd_t self:tcp_socket create_stream_socket_perms;
-allow tftpd_t self:udp_socket create_socket_perms;
-allow tftpd_t self:unix_dgram_socket create_socket_perms;
-allow tftpd_t self:unix_stream_socket create_stream_socket_perms;
 dontaudit tftpd_t self:capability sys_tty_config;
+allow tftpd_t self:tcp_socket { accept listen };
+allow tftpd_t self:unix_stream_socket { accept listen };
+
+allow tftpd_t tftpd_conf_t:file read_file_perms;
 
 allow tftpd_t tftpdir_t:dir list_dir_perms;
 allow tftpd_t tftpdir_t:file read_file_perms;
-allow tftpd_t tftpdir_t:lnk_file { getattr read };
+allow tftpd_t tftpdir_t:lnk_file read_lnk_file_perms;
 
 manage_dirs_pattern(tftpd_t, tftpdir_rw_t, tftpdir_rw_t)
 manage_files_pattern(tftpd_t, tftpdir_rw_t, tftpdir_rw_t)
@@ -65,30 +67,26 @@ kernel_read_kernel_sysctls(tftpd_t)
 
 corenet_all_recvfrom_unlabeled(tftpd_t)
 corenet_all_recvfrom_netlabel(tftpd_t)
-corenet_tcp_sendrecv_generic_if(tftpd_t)
 corenet_udp_sendrecv_generic_if(tftpd_t)
-corenet_tcp_sendrecv_generic_node(tftpd_t)
 corenet_udp_sendrecv_generic_node(tftpd_t)
-corenet_tcp_sendrecv_all_ports(tftpd_t)
-corenet_udp_sendrecv_all_ports(tftpd_t)
-corenet_tcp_bind_generic_node(tftpd_t)
 corenet_udp_bind_generic_node(tftpd_t)
-corenet_udp_bind_tftp_port(tftpd_t)
+
 corenet_sendrecv_tftp_server_packets(tftpd_t)
+corenet_udp_bind_tftp_port(tftpd_t)
+corenet_udp_sendrecv_tftp_port(tftpd_t)
 
 dev_read_sysfs(tftpd_t)
 
-fs_getattr_all_fs(tftpd_t)
-fs_search_auto_mountpoints(tftpd_t)
-
 domain_use_interactive_fds(tftpd_t)
 
-files_read_etc_files(tftpd_t)
 files_read_etc_runtime_files(tftpd_t)
 files_read_var_files(tftpd_t)
 files_read_var_symlinks(tftpd_t)
 files_search_var(tftpd_t)
 
+fs_getattr_all_fs(tftpd_t)
+fs_search_auto_mountpoints(tftpd_t)
+
 auth_use_nsswitch(tftpd_t)
 
 logging_send_syslog_msg(tftpd_t)