[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     088a3666044ddd17b103dcb703b399acb7076834
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Thu Nov  1 21:00:57 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Nov  1 21:00:57 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=088a3666

Reshuffle gentoo specific ldap changes. Also introduce an ldap_admin interface

---
 policy/modules/contrib/ldap.if |   30 ++++++++++++++++++++++++++----
 policy/modules/contrib/ldap.te |   12 ++++++++----
 2 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/policy/modules/contrib/ldap.if b/policy/modules/contrib/ldap.if
index 1c58ff5..de2508e 100644
--- a/policy/modules/contrib/ldap.if
+++ b/policy/modules/contrib/ldap.if
@@ -117,7 +117,6 @@ interface(`ldap_admin',`
 		type slapd_lock_t, slapd_etc_t, slapd_var_run_t;
 		type slapd_initrc_exec_t, slapd_log_t, slapd_cert_t;
 		type slapd_db_t;
-		type slapd_exec_t;
 	')
 
 	allow $1 slapd_t:process { ptrace signal_perms };
@@ -128,9 +127,6 @@ interface(`ldap_admin',`
 	role_transition $2 slapd_initrc_exec_t system_r;
 	allow $2 system_r;
 
-	role $2 types slapd_t;
-	domtrans_pattern($1, slapd_exec_t, slapd_t)
-
 	files_list_etc($1)
 	admin_pattern($1, { slapd_etc_t slapd_db_t slapd_cert_t })
 
@@ -149,3 +145,29 @@ interface(`ldap_admin',`
 	files_list_pids($1)
 	admin_pattern($1, slapd_var_run_t)
 ')
+
+########################################
+## <summary>
+##	Execute slapd in the slapd domain, and
+##	allow the given role the slapd_t type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+#
+interface(`ldap_run',`
+	gen_require(`
+		type slapd_t;
+		type slapd_exec_t;
+	')
+
+	role $2 types slapd_t;
+	domtrans_pattern($1, slapd_exec_t, slapd_t)
+')

diff --git a/policy/modules/contrib/ldap.te b/policy/modules/contrib/ldap.te
index 2d57372..7968e39 100644
--- a/policy/modules/contrib/ldap.te
+++ b/policy/modules/contrib/ldap.te
@@ -46,10 +46,8 @@ files_pid_file(slapd_var_run_t)
 
 allow slapd_t self:capability { kill setgid setuid net_raw dac_override dac_read_search };
 dontaudit slapd_t self:capability sys_tty_config;
-allow slapd_t self:process { setsched signal };
+allow slapd_t self:process setsched;
 allow slapd_t self:fifo_file rw_fifo_file_perms;
-allow slapd_t self:unix_stream_socket listen;
-#slapd needs to listen and accept needed by ldapsearch (slapd needs to accept from ldapseach)
 allow slapd_t self:tcp_socket { accept listen };
 
 allow slapd_t slapd_cert_t:dir list_dir_perms;
@@ -124,7 +122,13 @@ miscfiles_read_localization(slapd_t)
 
 userdom_dontaudit_use_unpriv_user_fds(slapd_t)
 userdom_dontaudit_search_user_home_dirs(slapd_t)
-userdom_use_user_terminals(slapd_t)
+
+ifdef(`distro_gentoo',`
+	allow slapd_t self:process signal;
+	allow slapd_t self:unix_stream_socket listen;
+
+	userdom_use_user_terminals(slapd_t)
+')
 
 optional_policy(`
 	kerberos_keytab_template(slapd, slapd_t)