[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     60bb96049811ee9d37e956b1980e04122faa12c7
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Wed Oct 31 10:06:10 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Wed Oct 31 18:06:34 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=60bb9604

Changes to the webalizer policy module

Remove webalizer ability to manage all http sys content and instead
implement httpd webalizer content type for /var/www/usage and give
webalizer permission to manage that

Label webazolver with webalizer exec type and allow webalizer to exec
webalizer exec type files

Role attribute
Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/webalizer.fc |   10 +++-----
 policy/modules/contrib/webalizer.if |   12 ++++++----
 policy/modules/contrib/webalizer.te |   40 +++++++++++-----------------------
 3 files changed, 24 insertions(+), 38 deletions(-)

diff --git a/policy/modules/contrib/webalizer.fc b/policy/modules/contrib/webalizer.fc
index 2f40f21..64baf67 100644
--- a/policy/modules/contrib/webalizer.fc
+++ b/policy/modules/contrib/webalizer.fc
@@ -1,11 +1,9 @@
+/etc/webalizer\.conf	--	gen_context(system_u:object_r:webalizer_etc_t,s0)
 
-#
-# /usr
-#
 /usr/bin/awffull	--	gen_context(system_u:object_r:webalizer_exec_t,s0)
 /usr/bin/webalizer	--	gen_context(system_u:object_r:webalizer_exec_t,s0)
+/usr/bin/webazolver	--	gen_context(system_u:object_r:webalizer_exec_t,s0)
 
-#
-# /var
-#
 /var/lib/webalizer(/.*)?	gen_context(system_u:object_r:webalizer_var_lib_t,s0)
+
+/var/www/usage(/.*)?	gen_context(system_u:object_r:httpd_webalizer_content_t,s0)

diff --git a/policy/modules/contrib/webalizer.if b/policy/modules/contrib/webalizer.if
index 3c78e7c..fa28353 100644
--- a/policy/modules/contrib/webalizer.if
+++ b/policy/modules/contrib/webalizer.if
@@ -1,4 +1,4 @@
-## <summary>Web server log analysis</summary>
+## <summary>Web server log analysis.</summary>
 
 ########################################
 ## <summary>
@@ -15,13 +15,15 @@ interface(`webalizer_domtrans',`
 		type webalizer_t, webalizer_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, webalizer_exec_t, webalizer_t)
 ')
 
 ########################################
 ## <summary>
-##	Execute webalizer in the webalizer domain, and
-##	allow the specified role the webalizer domain.
+##	Execute webalizer in the webalizer
+##	domain, and allow the specified
+##	role the webalizer domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -37,9 +39,9 @@ interface(`webalizer_domtrans',`
 #
 interface(`webalizer_run',`
 	gen_require(`
-		type webalizer_t;
+		attribute_role webalizer_roles;
 	')
 
 	webalizer_domtrans($1)
-	role $2 types webalizer_t;
+	roleattribute $2 webalizer_roles;
 ')

diff --git a/policy/modules/contrib/webalizer.te b/policy/modules/contrib/webalizer.te
index 8ea7478..e66b661 100644
--- a/policy/modules/contrib/webalizer.te
+++ b/policy/modules/contrib/webalizer.te
@@ -1,14 +1,17 @@
-policy_module(webalizer, 1.12.0)
+policy_module(webalizer, 1.12.1)
 
 ########################################
 #
 # Declarations
 #
 
+attribute_role webalizer_roles;
+roleattribute system_r webalizer_roles;
+
 type webalizer_t;
 type webalizer_exec_t;
 application_domain(webalizer_t, webalizer_exec_t)
-role system_r types webalizer_t;
+role webalizer_roles types webalizer_t;
 
 type webalizer_etc_t;
 files_config_file(webalizer_etc_t)
@@ -34,18 +37,9 @@ allow webalizer_t self:capability dac_override;
 allow webalizer_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
 allow webalizer_t self:fd use;
 allow webalizer_t self:fifo_file rw_fifo_file_perms;
-allow webalizer_t self:sock_file read_sock_file_perms;
-allow webalizer_t self:shm create_shm_perms;
-allow webalizer_t self:sem create_sem_perms;
-allow webalizer_t self:msgq create_msgq_perms;
-allow webalizer_t self:msg { send receive };
-allow webalizer_t self:unix_dgram_socket create_socket_perms;
-allow webalizer_t self:unix_stream_socket create_stream_socket_perms;
 allow webalizer_t self:unix_dgram_socket sendto;
-allow webalizer_t self:unix_stream_socket connectto;
-allow webalizer_t self:tcp_socket connected_stream_socket_perms;
-allow webalizer_t self:udp_socket { connect connected_socket_perms };
-allow webalizer_t self:netlink_route_socket r_netlink_socket_perms;
+allow webalizer_t self:unix_stream_socket { accept connectto listen };
+allow webalizer_t self:tcp_socket { accept listen };
 
 allow webalizer_t webalizer_etc_t:file read_file_perms;
 
@@ -56,21 +50,18 @@ files_tmp_filetrans(webalizer_t, webalizer_tmp_t, { file dir })
 manage_files_pattern(webalizer_t, webalizer_var_lib_t, webalizer_var_lib_t)
 files_var_lib_filetrans(webalizer_t, webalizer_var_lib_t, file)
 
+can_exec(webalizer_t, webalizer_exec_t)
+
 kernel_read_kernel_sysctls(webalizer_t)
 kernel_read_system_state(webalizer_t)
 
-corenet_all_recvfrom_unlabeled(webalizer_t)
-corenet_all_recvfrom_netlabel(webalizer_t)
-corenet_tcp_sendrecv_generic_if(webalizer_t)
-corenet_tcp_sendrecv_generic_node(webalizer_t)
-corenet_tcp_sendrecv_all_ports(webalizer_t)
+files_read_etc_runtime_files(webalizer_t)
 
 fs_search_auto_mountpoints(webalizer_t)
 fs_getattr_xattr_fs(webalizer_t)
 fs_rw_anon_inodefs_files(webalizer_t)
 
-files_read_etc_files(webalizer_t)
-files_read_etc_runtime_files(webalizer_t)
+auth_use_nsswitch(webalizer_t)
 
 logging_list_logs(webalizer_t)
 logging_send_syslog_msg(webalizer_t)
@@ -78,9 +69,6 @@ logging_send_syslog_msg(webalizer_t)
 miscfiles_read_localization(webalizer_t)
 miscfiles_read_public_files(webalizer_t)
 
-sysnet_dns_name_resolve(webalizer_t)
-sysnet_read_config(webalizer_t)
-
 userdom_use_user_terminals(webalizer_t)
 userdom_use_unpriv_users_fds(webalizer_t)
 userdom_dontaudit_search_user_home_content(webalizer_t)
@@ -88,6 +76,8 @@ userdom_dontaudit_search_user_home_content(webalizer_t)
 optional_policy(`
 	apache_read_log(webalizer_t)
 	apache_manage_sys_content(webalizer_t)
+	manage_dirs_pattern(webalizer_t, httpd_webalizer_content_t, httpd_webalizer_content_t)
+	manage_files_pattern(webalizer_t, httpd_webalizer_content_t, httpd_webalizer_content_t)
 ')
 
 optional_policy(`
@@ -99,10 +89,6 @@ optional_policy(`
 ')
 
 optional_policy(`
-	nis_use_ypbind(webalizer_t)
-')
-
-optional_policy(`
 	nscd_socket_use(webalizer_t)
 ')