[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/kernel/

[Sven Vermeulen]

commit:     e316570abbb74fb6aba0d62157b9842d9a910fc7
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Tue Jul 10 17:20:47 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Jul 10 17:20:47 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=e316570a

Adding auth_nss_domain patch

---
 policy/modules/kernel/files.fc     |    2 +
 policy/modules/system/authlogin.if |   49 ++------------------------
 policy/modules/system/authlogin.te |   68 ++++++++++++++++++++++++++++++++++++
 3 files changed, 73 insertions(+), 46 deletions(-)

diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
index 75ceae3..90a8226 100644
--- a/policy/modules/kernel/files.fc
+++ b/policy/modules/kernel/files.fc
@@ -54,6 +54,8 @@ ifdef(`distro_suse',`
 /etc/killpower		--	gen_context(system_u:object_r:etc_runtime_t,s0)
 /etc/localtime		-l	gen_context(system_u:object_r:etc_t,s0)
 /etc/mtab		--	gen_context(system_u:object_r:etc_runtime_t,s0)
+/etc/mtab~[0-9]*	--	gen_context(system_u:object_r:etc_runtime_t,s0)
+/etc/mtab\.tmp		--	gen_context(system_u:object_r:etc_runtime_t,s0)
 /etc/mtab\.fuselock	--	gen_context(system_u:object_r:etc_runtime_t,s0)
 /etc/nohotplug		--	gen_context(system_u:object_r:etc_runtime_t,s0)
 /etc/nologin.*		--	gen_context(system_u:object_r:etc_runtime_t,s0)

diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
index 6ce867a..8989233 100644
--- a/policy/modules/system/authlogin.if
+++ b/policy/modules/system/authlogin.if
@@ -1717,54 +1717,11 @@ interface(`auth_relabel_login_records',`
 ## <infoflow type="both" weight="10"/>
 #
 interface(`auth_use_nsswitch',`
-
-	files_list_var_lib($1)
-
-	# read /etc/nsswitch.conf
-	files_read_etc_files($1)
-
-	miscfiles_read_generic_certs($1)
-
-	sysnet_dns_name_resolve($1)
-	sysnet_use_ldap($1)
-
-	optional_policy(`
-		avahi_stream_connect($1)
-	')
-
-	optional_policy(`
-		ldap_stream_connect($1)
-	')
-
- 	optional_policy(`
-		likewise_stream_connect_lsassd($1)
-	')
-
-	optional_policy(`
-		kerberos_use($1)
-	')
-
-	optional_policy(`
-		nis_use_ypbind($1)
-	')
-
-	optional_policy(`
-		nscd_socket_use($1)
-	')
-
-	optional_policy(`
-		nslcd_stream_connect($1)
-	')
-
-	optional_policy(`
-		sssd_stream_connect($1)
+	gen_require(`
+		attribute nsswitch_domain;
 	')
 
-	optional_policy(`
-		samba_stream_connect_winbind($1)
-		samba_read_var_files($1)
-		samba_dontaudit_write_var_files($1)
-	')
+	typeattribute $1 nsswitch_domain;
 ')
 
 ########################################

diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te
index 6a96393..312da5d 100644
--- a/policy/modules/system/authlogin.te
+++ b/policy/modules/system/authlogin.te
@@ -5,9 +5,18 @@ policy_module(authlogin, 2.3.0)
 # Declarations
 #
 
+## <desc>
+## <p>
+## Allow users to resolve user passwd entries directly from ldap rather
+## than using an sssd server
+## </p>
+## </desc>
+gen_tunable(authlogin_nsswitch_use_ldap, false)
+
 attribute can_read_shadow_passwords;
 attribute can_write_shadow_passwords;
 attribute can_relabelto_shadow_passwords;
+attribute nsswitch_domain;
 
 type auth_cache_t;
 logging_log_file(auth_cache_t)
@@ -395,3 +404,62 @@ optional_policy(`
 	xserver_use_xdm_fds(utempter_t)
 	xserver_rw_xdm_pipes(utempter_t)
 ')
+
+#########################################
+#
+# nsswitch_domain local policy
+#
+
+files_list_var_lib(nsswitch_domain)
+
+# read /etc/nsswitch.conf
+files_read_etc_files(nsswitch_domain)
+
+sysnet_dns_name_resolve(nsswitch_domain)
+
+tunable_policy(`authlogin_nsswitch_use_ldap',`
+	files_list_var_lib(nsswitch_domain)
+
+	miscfiles_read_generic_certs(nsswitch_domain)
+	sysnet_use_ldap(nsswitch_domain)
+')
+
+optional_policy(`
+	tunable_policy(`authlogin_nsswitch_use_ldap',`
+		 ldap_stream_connect(nsswitch_domain)
+	')
+')
+
+optional_policy(`
+	avahi_stream_connect(nsswitch_domain)
+')
+
+optional_policy(`
+	likewise_stream_connect_lsassd(nsswitch_domain)
+')
+
+optional_policy(`
+	kerberos_use(nsswitch_domain)
+')
+
+optional_policy(`
+	nis_use_ypbind(nsswitch_domain)
+')
+
+optional_policy(`
+	nscd_socket_use(nsswitch_domain)
+')
+
+optional_policy(`
+	nslcd_stream_connect(nsswitch_domain)
+')
+
+optional_policy(`
+	sssd_stream_connect(nsswitch_domain)
+')
+
+optional_policy(`
+	samba_stream_connect_winbind(nsswitch_domain)
+	samba_read_var_files(nsswitch_domain)
+	samba_dontaudit_write_var_files(nsswitch_domain)
+')