[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     9caabe581b7b6991b61229fd89880d66c813856b
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Fri Nov  2 12:28:33 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Fri Nov  2 19:08:11 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=9caabe58

Changes to the xfs policy module

Add init script file
Add xfs_admin()
Modules clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/xfs.fc |    3 ++
 policy/modules/contrib/xfs.if |   50 ++++++++++++++++++++++++++++++++++++-----
 policy/modules/contrib/xfs.te |   27 ++++++++++-----------
 3 files changed, 60 insertions(+), 20 deletions(-)

diff --git a/policy/modules/contrib/xfs.fc b/policy/modules/contrib/xfs.fc
index b98d9ed..85b9c0f 100644
--- a/policy/modules/contrib/xfs.fc
+++ b/policy/modules/contrib/xfs.fc
@@ -1,3 +1,4 @@
+/etc/rc\.d/init\.d/xfs	--	gen_context(system_u:object_r:xfs_initrc_exec_t,s0)
 
 /tmp/\.font-unix(/.*)?	gen_context(system_u:object_r:xfs_tmp_t,s0)
 
@@ -6,3 +7,5 @@
 
 /usr/X11R6/bin/xfs	--	gen_context(system_u:object_r:xfs_exec_t,s0)
 /usr/X11R6/bin/xfs-xtt	--	gen_context(system_u:object_r:xfs_exec_t,s0)
+
+/var/run/xfs.*	--	gen_context(system_u:object_r:xfs_var_run_t,s0)

diff --git a/policy/modules/contrib/xfs.if b/policy/modules/contrib/xfs.if
index aa6e5a8..4570b86 100644
--- a/policy/modules/contrib/xfs.if
+++ b/policy/modules/contrib/xfs.if
@@ -1,8 +1,8 @@
-## <summary>X Windows Font Server </summary>
+## <summary>X Windows Font Server.</summary>
 
 ########################################
 ## <summary>
-##	Read a X font server named socket.
+##	Read xfs temporary sock files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -21,8 +21,8 @@ interface(`xfs_read_sockets',`
 
 ########################################
 ## <summary>
-##	Connect to a X font server over
-##	a unix domain stream socket.
+##	Connect to xfs with a unix
+##	domain stream socket.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -41,8 +41,7 @@ interface(`xfs_stream_connect',`
 
 ########################################
 ## <summary>
-##	Allow the specified domain to execute xfs
-##	in the caller domain.
+##	Execute xfs in the caller domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -55,5 +54,44 @@ interface(`xfs_exec',`
 		type xfs_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	can_exec($1, xfs_exec_t)
 ')
+
+########################################
+## <summary>
+##	All of the rules required to
+##	administrate an xfs environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`xfs_admin',`
+	gen_require(`
+		type xfs_t, xfs_initrc_exec_t, xfs_var_run_t;
+		type xfs_tmp_t;
+	')
+
+	allow $1 xfs_t:process { ptrace signal_perms };
+	ps_process_pattern($1, xfs_t)
+
+	init_labeled_script_domtrans($1, xfs_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 xfs_initrc_exec_t system_r;
+	allow $2 system_r;
+
+	files_search_pids($1)
+	admin_pattern($1, xfs_var_run_t)
+
+	files_search_tmp($1)
+	admin_pattern($1, xfs_tmp_t)
+')

diff --git a/policy/modules/contrib/xfs.te b/policy/modules/contrib/xfs.te
index 11c1b12..0cea2cd 100644
--- a/policy/modules/contrib/xfs.te
+++ b/policy/modules/contrib/xfs.te
@@ -1,4 +1,4 @@
-policy_module(xfs, 1.6.0)
+policy_module(xfs, 1.6.1)
 
 ########################################
 #
@@ -9,6 +9,9 @@ type xfs_t;
 type xfs_exec_t;
 init_daemon_domain(xfs_t, xfs_exec_t)
 
+type xfs_initrc_exec_t;
+init_script_file(xfs_initrc_exec_t)
+
 type xfs_tmp_t;
 files_tmp_file(xfs_tmp_t)
 
@@ -23,9 +26,8 @@ files_pid_file(xfs_var_run_t)
 allow xfs_t self:capability { dac_override setgid setuid };
 dontaudit xfs_t self:capability sys_tty_config;
 allow xfs_t self:process { signal_perms setpgid };
-allow xfs_t self:unix_stream_socket create_stream_socket_perms;
-allow xfs_t self:unix_dgram_socket create_socket_perms;
-allow xfs_t self:tcp_socket create_stream_socket_perms;
+allow xfs_t self:unix_stream_socket { accept listen };
+allow xfs_t self:tcp_socket { accept listen };
 
 manage_dirs_pattern(xfs_t, xfs_tmp_t, xfs_tmp_t)
 manage_sock_files_pattern(xfs_t, xfs_tmp_t, xfs_tmp_t)
@@ -34,6 +36,8 @@ files_tmp_filetrans(xfs_t, xfs_tmp_t, { sock_file dir })
 manage_files_pattern(xfs_t, xfs_var_run_t, xfs_var_run_t)
 files_pid_filetrans(xfs_t, xfs_var_run_t, file)
 
+can_exec(xfs_t, xfs_exec_t)
+
 kernel_read_kernel_sysctls(xfs_t)
 kernel_read_system_state(xfs_t)
 
@@ -41,10 +45,11 @@ corenet_all_recvfrom_unlabeled(xfs_t)
 corenet_all_recvfrom_netlabel(xfs_t)
 corenet_tcp_sendrecv_generic_if(xfs_t)
 corenet_tcp_sendrecv_generic_node(xfs_t)
-corenet_tcp_sendrecv_all_ports(xfs_t)
 corenet_tcp_bind_generic_node(xfs_t)
-corenet_tcp_bind_xfs_port(xfs_t)
+
 corenet_sendrecv_xfs_server_packets(xfs_t)
+corenet_tcp_bind_xfs_port(xfs_t)
+corenet_tcp_sendrecv_xfs_port(xfs_t)
 
 corecmd_list_bin(xfs_t)
 
@@ -57,12 +62,13 @@ fs_search_auto_mountpoints(xfs_t)
 
 domain_use_interactive_fds(xfs_t)
 
-files_read_etc_files(xfs_t)
 files_read_etc_runtime_files(xfs_t)
 files_read_usr_files(xfs_t)
 
 auth_use_nsswitch(xfs_t)
 
+init_script_tmp_filetrans(xfs_t, xfs_tmp_t, sock_file, "fs7100")
+
 logging_send_syslog_msg(xfs_t)
 
 miscfiles_read_localization(xfs_t)
@@ -71,13 +77,6 @@ miscfiles_read_fonts(xfs_t)
 userdom_dontaudit_use_unpriv_user_fds(xfs_t)
 userdom_dontaudit_search_user_home_dirs(xfs_t)
 
-xfs_exec(xfs_t)
-
-ifdef(`distro_debian',`
-	# for /tmp/.font-unix/fs7100
-	init_script_tmp_filetrans(xfs_t, xfs_tmp_t, sock_file)
-')
-
 optional_policy(`
 	seutil_sigchld_newrole(xfs_t)
 ')