[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     99ba63620bef6fb39efa3418b51269117dd856a9
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Thu Nov  1 21:18:40 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Nov  1 21:18:40 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=99ba6362

Introduce mplayer read or manage booleans

Try to isolate mplayer reading movies only from the xdg videos location, but
keep supporting the upstream behavior (all user content).

Also reshuffle gentoo-specifics into its own distro_gentoo structure.

---
 policy/modules/contrib/mplayer.te |   62 ++++++++++++++++++++++++++++---------
 1 files changed, 47 insertions(+), 15 deletions(-)

diff --git a/policy/modules/contrib/mplayer.te b/policy/modules/contrib/mplayer.te
index 579055f..c175411 100644
--- a/policy/modules/contrib/mplayer.te
+++ b/policy/modules/contrib/mplayer.te
@@ -13,6 +13,21 @@ policy_module(mplayer, 2.4.2)
 ## </desc>
 gen_tunable(allow_mplayer_execstack, false)
 
+## <desc>
+## <p>
+## Allow mplayer to read user content
+## </p>
+## </desc>
+gen_tunable(mplayer_read_user_content, true)
+
+## <desc>
+## <p>
+## Allow mplayer to manage user content
+## </p>
+## </desc>
+gen_tunable(mplayer_manage_user_content, false)
+
+
 attribute_role mencoder_roles;
 attribute_role mplayer_roles;
 
@@ -166,9 +181,9 @@ dev_read_realtime_clock(mplayer_t)
 dev_read_sound_mixer(mplayer_t)
 dev_read_urand(mplayer_t)
 dev_read_video_dev(mplayer_t)
-dev_rwx_zero(mplayer_t)
-dev_write_video_dev(mplayer_t)
 dev_write_sound_mixer(mplayer_t)
+dev_write_video_dev(mplayer_t)
+dev_rwx_zero(mplayer_t)
 
 domain_use_interactive_fds(mplayer_t)
 
@@ -193,19 +208,40 @@ miscfiles_read_localization(mplayer_t)
 miscfiles_read_fonts(mplayer_t)
 
 userdom_use_user_terminals(mplayer_t)
-userdom_manage_user_tmp_dirs(mplayer_t)
-userdom_manage_user_tmp_files(mplayer_t)
-userdom_manage_user_home_content_dirs(mplayer_t)
-userdom_manage_user_home_content_files(mplayer_t)
-userdom_user_home_dir_filetrans_user_home_content(mplayer_t, { dir file })
 
-ifndef(`enable_mls',`',`
+xserver_user_x_domain_template(mplayer, mplayer_t, mplayer_tmpfs_t)
+
+ifdef(`distro_gentoo',`
+	alsa_domain(mplayer_t, mplayer_tmpfs_t)
+
+	xdg_manage_videos_home(mplayer_t)
+
+	tunable_policy(`mplayer_read_user_content',`
+		userdom_read_user_home_content_files(mplayer_t)
+		userdom_read_user_home_content_symlinks(mplayer_t)
+	')
+
+	tunable_policy(`mplayer_manage_user_content',`
+		userdom_manage_user_tmp_dirs(mplayer_t)
+		userdom_manage_user_tmp_files(mplayer_t)
+		userdom_user_home_dir_filetrans_user_home_content(mplayer_t, { dir file })
+
+		userdom_manage_user_home_content_dirs(mplayer_t)
+		userdom_manage_user_home_content_files(mplayer_t)
+
+		userdom_write_user_tmp_sockets(mplayer_t)
+	')
+')
+
+ifndef(`enable_mls',`
 	fs_list_dos(mplayer_t)
 	fs_read_dos_files(mplayer_t)
-	fs_read_iso9660_files(mplayer_t)
+
+	fs_search_removable(mplayer_t)
 	fs_read_removable_files(mplayer_t)
 	fs_read_removable_symlinks(mplayer_t)
-	fs_search_removable(mplayer_t)
+
+	fs_read_iso9660_files(mplayer_t)
 ')
 
 tunable_policy(`allow_execmem',`
@@ -225,6 +261,7 @@ tunable_policy(`use_nfs_home_dirs',`
 	fs_manage_nfs_files(mplayer_t)
 	fs_manage_nfs_symlinks(mplayer_t)
 ')
+
 tunable_policy(`use_samba_home_dirs',`
 	fs_manage_cifs_dirs(mplayer_t)
 	fs_manage_cifs_files(mplayer_t)
@@ -236,7 +273,6 @@ tunable_policy(`allow_mplayer_execstack',`
 ')
 
 optional_policy(`
-	alsa_domain(mplayer_t, mplayer_tmpfs_t)
 	alsa_read_rw_config(mplayer_t)
 ')
 
@@ -245,7 +281,3 @@ optional_policy(`
 	pulseaudio_stream_connect(mplayer_t)
 	pulseaudio_signull(mplayer_t)
 ')
-
-optional_policy(`
-	xserver_user_x_domain_template(mplayer, mplayer_t, mplayer_tmpfs_t)
-')