[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     7e6b051d2a11b10ebaac74a40fdb03346d3d11c7
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Tue Oct 30 11:26:15 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Oct 30 18:33:17 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=7e6b051d

Changes to the usbmuxd policy module

Role attribute
Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/usbmuxd.fc |    2 +-
 policy/modules/contrib/usbmuxd.if |    7 ++++---
 policy/modules/contrib/usbmuxd.te |   15 ++++++++-------
 3 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/policy/modules/contrib/usbmuxd.fc b/policy/modules/contrib/usbmuxd.fc
index 40b8b8d..220f6ad 100644
--- a/policy/modules/contrib/usbmuxd.fc
+++ b/policy/modules/contrib/usbmuxd.fc
@@ -1,3 +1,3 @@
 /usr/sbin/usbmuxd	--	gen_context(system_u:object_r:usbmuxd_exec_t,s0)
 
-/var/run/usbmuxd.*	 	gen_context(system_u:object_r:usbmuxd_var_run_t,s0)
+/var/run/usbmuxd.*	gen_context(system_u:object_r:usbmuxd_var_run_t,s0)

diff --git a/policy/modules/contrib/usbmuxd.if b/policy/modules/contrib/usbmuxd.if
index 53792d3..1ec5e99 100644
--- a/policy/modules/contrib/usbmuxd.if
+++ b/policy/modules/contrib/usbmuxd.if
@@ -1,4 +1,4 @@
-## <summary>USB multiplexing daemon for communicating with Apple iPod Touch and iPhone</summary>
+## <summary>USB multiplexing daemon for communicating with Apple iPod Touch and iPhone.</summary>
 
 ########################################
 ## <summary>
@@ -15,13 +15,14 @@ interface(`usbmuxd_domtrans',`
 		type usbmuxd_t, usbmuxd_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, usbmuxd_exec_t, usbmuxd_t)
 ')
 
 #####################################
 ## <summary>
-##	Connect to usbmuxd over a unix domain
-##	stream socket.
+##	Connect to usbmuxd with a unix
+##	domain stream socket.
 ## </summary>
 ## <param name="domain">
 ##	<summary>

diff --git a/policy/modules/contrib/usbmuxd.te b/policy/modules/contrib/usbmuxd.te
index 4440aa6..8840be6 100644
--- a/policy/modules/contrib/usbmuxd.te
+++ b/policy/modules/contrib/usbmuxd.te
@@ -1,25 +1,28 @@
-policy_module(usbmuxd, 1.1.0)
+policy_module(usbmuxd, 1.1.1)
 
 ########################################
 #
 # Declarations
 #
 
+attribute_role usbmuxd_roles;
+roleattribute system_r usbmuxd_roles;
+
 type usbmuxd_t;
 type usbmuxd_exec_t;
 application_domain(usbmuxd_t, usbmuxd_exec_t)
-role system_r types usbmuxd_t;
+role usbmuxd_roles types usbmuxd_t;
 
 type usbmuxd_var_run_t;
 files_pid_file(usbmuxd_var_run_t)
 
 ########################################
 #
-# usbmuxd local policy
+# Local policy
 #
 
 allow usbmuxd_t self:capability { kill setgid setuid };
-allow usbmuxd_t self:process { fork signal signull };
+allow usbmuxd_t self:process { signal signull };
 allow usbmuxd_t self:fifo_file rw_fifo_file_perms;
 
 manage_dirs_pattern(usbmuxd_t, usbmuxd_var_run_t, usbmuxd_var_run_t)
@@ -33,10 +36,8 @@ kernel_read_system_state(usbmuxd_t)
 dev_read_sysfs(usbmuxd_t)
 dev_rw_generic_usb_dev(usbmuxd_t)
 
-files_read_etc_files(usbmuxd_t)
+auth_use_nsswitch(usbmuxd_t)
 
 miscfiles_read_localization(usbmuxd_t)
 
-auth_use_nsswitch(usbmuxd_t)
-
 logging_send_syslog_msg(usbmuxd_t)