| 1 |
commit: a43e66289e81dcc53f4069387a15929f67db476f |
| 2 |
Author: David Sugar <dsugar <AT> tresys <DOT> com> |
| 3 |
AuthorDate: Wed Aug 30 16:07:07 2017 +0000 |
| 4 |
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> |
| 5 |
CommitDate: Fri Sep 8 22:48:51 2017 +0000 |
| 6 |
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=a43e6628 |
| 7 |
|
| 8 |
cron: optional_policy for mta_* interfaces |
| 9 |
|
| 10 |
Patch to allow turning off of the mta module and still have cron module available. |
| 11 |
This version consolidates all mta_* interface uses into single optional block. |
| 12 |
|
| 13 |
policy/modules/contrib/cron.te | 26 +++++++++++++++++--------- |
| 14 |
1 file changed, 17 insertions(+), 9 deletions(-) |
| 15 |
|
| 16 |
diff --git a/policy/modules/contrib/cron.te b/policy/modules/contrib/cron.te |
| 17 |
index 27467232..a8818d56 100644 |
| 18 |
--- a/policy/modules/contrib/cron.te |
| 19 |
+++ b/policy/modules/contrib/cron.te |
| 20 |
@@ -43,7 +43,6 @@ application_executable_file(anacron_exec_t) |
| 21 |
|
| 22 |
type cron_spool_t; |
| 23 |
files_type(cron_spool_t) |
| 24 |
-mta_system_content(cron_spool_t) |
| 25 |
|
| 26 |
type cron_var_lib_t; |
| 27 |
files_type(cron_var_lib_t) |
| 28 |
@@ -74,14 +73,12 @@ init_script_file(crond_initrc_exec_t) |
| 29 |
type crond_tmp_t; |
| 30 |
files_tmp_file(crond_tmp_t) |
| 31 |
files_poly_parent(crond_tmp_t) |
| 32 |
-mta_system_content(crond_tmp_t) |
| 33 |
|
| 34 |
type crond_unit_t; |
| 35 |
init_unit_file(crond_unit_t) |
| 36 |
|
| 37 |
type crond_var_run_t; |
| 38 |
files_pid_file(crond_var_run_t) |
| 39 |
-mta_system_content(crond_var_run_t) |
| 40 |
|
| 41 |
type crontab_exec_t; |
| 42 |
application_executable_file(crontab_exec_t) |
| 43 |
@@ -98,7 +95,6 @@ typealias crontab_tmp_t alias { auditadm_crontab_tmp_t secadm_crontab_tmp_t }; |
| 44 |
|
| 45 |
type system_cron_spool_t, cron_spool_type; |
| 46 |
files_type(system_cron_spool_t) |
| 47 |
-mta_system_content(system_cron_spool_t) |
| 48 |
|
| 49 |
type system_cronjob_t alias system_crond_t; |
| 50 |
init_daemon_domain(system_cronjob_t, anacron_exec_t) |
| 51 |
@@ -122,7 +118,23 @@ typealias user_cron_spool_t alias { staff_cron_spool_t sysadm_cron_spool_t uncon |
| 52 |
typealias user_cron_spool_t alias { auditadm_cron_spool_t secadm_cron_spool_t }; |
| 53 |
files_type(user_cron_spool_t) |
| 54 |
ubac_constrained(user_cron_spool_t) |
| 55 |
-mta_system_content(user_cron_spool_t) |
| 56 |
+ |
| 57 |
+type user_cron_spool_log_t; |
| 58 |
+logging_log_file(user_cron_spool_log_t) |
| 59 |
+ubac_constrained(user_cron_spool_log_t) |
| 60 |
+ |
| 61 |
+ifdef(`enable_mcs',` |
| 62 |
+ init_ranged_daemon_domain(crond_t, crond_exec_t, s0 - mcs_systemhigh) |
| 63 |
+') |
| 64 |
+ |
| 65 |
+optional_policy(` |
| 66 |
+ mta_system_content(cron_spool_t) |
| 67 |
+ mta_system_content(crond_tmp_t) |
| 68 |
+ mta_system_content(crond_var_run_t) |
| 69 |
+ mta_system_content(system_cron_spool_t) |
| 70 |
+ mta_system_content(user_cron_spool_t) |
| 71 |
+ mta_system_content(user_cron_spool_log_t) |
| 72 |
+') |
| 73 |
|
| 74 |
ifdef(`distro_gentoo',` |
| 75 |
# Logging for atd jobs |
| 76 |
@@ -132,10 +144,6 @@ ifdef(`distro_gentoo',` |
| 77 |
logging_syslog_managed_log_file(cron_log_t, "cron.log") |
| 78 |
') |
| 79 |
|
| 80 |
-ifdef(`enable_mcs',` |
| 81 |
- init_ranged_daemon_domain(crond_t, crond_exec_t, s0 - mcs_systemhigh) |
| 82 |
-') |
| 83 |
- |
| 84 |
############################## |
| 85 |
# |
| 86 |
# Common crontab local policy |
Archives