[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/, policy/modules/system/

[Sven Vermeulen]

commit:     2e34d4ed1a88947b99dc82d88f1e5e0b0f026211
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Mon Dec 31 17:24:39 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Dec 31 17:24:39 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=2e34d4ed

Create filetransition for ld.so.cache~

When portage calls ldconfig (which runs in the portage domain, so no transition
occurs), ldconfig creates the ld.so.cache~ file (which later gets renamed to
ld.so.cache). As this file would then be labeled as etc_t, this results in a
wrongly labeled ld.so.cache file.

Introduce a file transition for ld.so.cache~ so that this comes through
correctly.

---
 policy/modules/contrib/portage.te  |    7 +++++++
 policy/modules/system/libraries.if |   33 +++++++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 0 deletions(-)

diff --git a/policy/modules/contrib/portage.te b/policy/modules/contrib/portage.te
index 5a1e463..dd5c0d0 100644
--- a/policy/modules/contrib/portage.te
+++ b/policy/modules/contrib/portage.te
@@ -383,6 +383,13 @@ ifdef(`distro_gentoo',`
 
 	##########################################
 	#
+	# Portage local policy
+	#
+
+	libs_generic_etc_filetrans_ld_so_cache(portage_t, file, "ld.so.cache~")
+
+	##########################################
+	#
 	# Portage sandbox local policy
 	#
 

diff --git a/policy/modules/system/libraries.if b/policy/modules/system/libraries.if
index 808ba93..41a44f3 100644
--- a/policy/modules/system/libraries.if
+++ b/policy/modules/system/libraries.if
@@ -534,3 +534,36 @@ interface(`lib_filetrans_shared_lib',`
 interface(`files_lib_filetrans_shared_lib',`
 	refpolicywarn(`$0($*) has been deprecated.')
 ')
+
+# This is gentoo specific but cannot use ifdef distro_gentoo here
+
+########################################
+## <summary>
+##	Create an object in etc with a type transition to
+##	the ld_so_cache_t type
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+## <param name="class">
+##	<summary>
+##	Class of the resource for which a type transition occurs.
+##	This is usually file as ld_so_cache is currently not used
+##	for any other resources.
+##	</summary>
+## </param>
+## <param name="filename" optional="true">
+##	<summary>
+##	Name of the resource created for which a type transition occurs
+##	</summary>
+## </param>
+#
+interface(`libs_generic_etc_filetrans_ld_so_cache',`
+	gen_require(`
+		type ld_so_cache_t;
+	')
+
+	files_etc_filetrans($1, ld_so_cache_t, $2, $3)
+')