[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/services/

[Jason Zaman]

commit:     d953a2fbae3db9cea8136566782294d6206a717a
Author:     Russell Coker <russell <AT> coker <DOT> com <DOT> au>
AuthorDate: Thu Mar 24 14:34:49 2022 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Thu Mar 31 02:40:53 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=d953a2fb

certbot V3

Same as the last one but with the directory names for the auto trans rules
removed.  I think it's ready for merging.

Signed-off-by: Russell Coker <russell <AT> coker.com.au>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/services/apache.if  | 36 ++++++++++++++++++++++++++++++++++++
 policy/modules/services/certbot.te | 22 +++++++++++++++++++---
 2 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/policy/modules/services/apache.if b/policy/modules/services/apache.if
index 11a7120e..dd86c618 100644
--- a/policy/modules/services/apache.if
+++ b/policy/modules/services/apache.if
@@ -236,6 +236,24 @@ interface(`apache_domtrans',`
 	domtrans_pattern($1, httpd_exec_t, httpd_t)
 ')
 
+########################################
+## <summary>
+##	Execute httpd
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to execute it.
+##	</summary>
+## </param>
+#
+interface(`apache_exec',`
+	gen_require(`
+		type httpd_t, httpd_exec_t;
+	')
+
+	can_exec($1, httpd_exec_t)
+')
+
 ########################################
 ## <summary>
 ##	Execute httpd server in the httpd domain.
@@ -1430,3 +1448,21 @@ interface(`apache_admin',`
 	apache_run_all_scripts($1, $2)
 	apache_run_helper($1, $2)
 ')
+
+########################################
+## <summary>
+##	rw httpd_runtime_t files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`apache_rw_runtime_files',`
+	gen_require(`
+		type httpd_runtime_t;
+	')
+
+	allow $1 httpd_runtime_t:file rw_file_perms;
+')

diff --git a/policy/modules/services/certbot.te b/policy/modules/services/certbot.te
index fc979c5f..ac609795 100644
--- a/policy/modules/services/certbot.te
+++ b/policy/modules/services/certbot.te
@@ -43,7 +43,7 @@ allow certbot_t self:udp_socket all_udp_socket_perms;
 allow certbot_t self:tcp_socket all_tcp_socket_perms;
 allow certbot_t self:netlink_route_socket create_netlink_socket_perms;
 
-files_search_var_lib(certbot_t)
+files_var_lib_filetrans(certbot_t, certbot_lib_t, dir)
 manage_dirs_pattern(certbot_t, certbot_lib_t, certbot_lib_t)
 manage_files_pattern(certbot_t, certbot_lib_t, certbot_lib_t)
 
@@ -62,7 +62,7 @@ allow certbot_t certbot_tmp_t:file mmap_exec_file_perms;
 allow certbot_t certbot_tmpfs_t:file mmap_exec_file_perms;
 allow certbot_t certbot_runtime_t:file mmap_exec_file_perms;
 
-logging_search_logs(certbot_t)
+logging_log_filetrans(certbot_t, certbot_log_t, dir)
 allow certbot_t certbot_log_t:dir manage_dir_perms;
 allow certbot_t certbot_log_t:file manage_file_perms;
 
@@ -80,11 +80,15 @@ corenet_tcp_connect_dns_port(certbot_t)
 # bind to http port for standalone mode
 corenet_tcp_bind_http_port(certbot_t)
 
+dev_read_urand(certbot_t)
+
 domain_use_interactive_fds(certbot_t)
 
 files_read_etc_files(certbot_t)
 files_read_usr_files(certbot_t)
 
+# dontaudit for attempts to write python cache files
+libs_dontaudit_write_lib_dirs(certbot_t)
 libs_exec_ldconfig(certbot_t)
 # for /usr/lib/gcc/x86_64-linux-gnu/8/collect2
 libs_exec_lib_files(certbot_t)
@@ -110,5 +114,17 @@ optional_policy(`
 	# for writing to webroot
 	apache_manage_sys_content(certbot_t)
 
-	apache_search_config(certbot_t)
+	apache_append_log(certbot_t)
+	apache_exec(certbot_t)
+	apache_exec_modules(certbot_t)
+
+	# for certbot to create nginx config
+	apache_manage_config(certbot_t)
+
+	apache_rw_runtime_files(certbot_t)
+	apache_signal(certbot_t)
+')
+
+optional_policy(`
+	xdg_search_config_dirs(certbot_t)
 ')