[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     6554059451b70152a69c7d5a2e5b95fa7d6e296d
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Tue Oct 30 11:13:08 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Oct 30 18:33:14 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=65540594

Changes to the uptime policy module

Add init script file
Add uptime_admin()

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/uptime.fc |    5 +++-
 policy/modules/contrib/uptime.if |   43 +++++++++++++++++++++++++++++++++++++-
 policy/modules/contrib/uptime.te |   10 ++++----
 3 files changed, 51 insertions(+), 7 deletions(-)

diff --git a/policy/modules/contrib/uptime.fc b/policy/modules/contrib/uptime.fc
index e30d6fc..a72670a 100644
--- a/policy/modules/contrib/uptime.fc
+++ b/policy/modules/contrib/uptime.fc
@@ -1,6 +1,9 @@
-
 /etc/uptimed\.conf	--	gen_context(system_u:object_r:uptimed_etc_t,s0)
 
+/etc/rc\.d/init\.d/uptimed	--	gen_context(system_u:object_r:uptimed_initrc_exec_t,s0)
+
 /usr/sbin/uptimed	--	gen_context(system_u:object_r:uptimed_exec_t,s0)
 
+/var/run/uptimed\.pid	--	gen_context(system_u:object_r:uptimed_var_run_t,s0)
+
 /var/spool/uptimed(/.*)?	gen_context(system_u:object_r:uptimed_spool_t,s0)

diff --git a/policy/modules/contrib/uptime.if b/policy/modules/contrib/uptime.if
index 447abf7..01a3234 100644
--- a/policy/modules/contrib/uptime.if
+++ b/policy/modules/contrib/uptime.if
@@ -1 +1,42 @@
-## <summary>Uptime daemon</summary>
+## <summary>Daemon to record and keep track of system up times.</summary>
+
+########################################
+## <summary>
+##	All of the rules required to
+##	administrate an uptime environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`uptime_admin',`
+	gen_require(`
+		type uptimed_t, uptimed_initrc_exec_t. uptimed_etc_t;
+		type uptimed_spool_t, uptimed_var_run_t;
+	')
+
+	allow $1 uptimed_t:process { ptrace signal_perms };
+	ps_process_pattern($1, uptimed_t)
+
+	init_labeled_script_domtrans($1, uptimed_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 uptimed_initrc_exec_t system_r;
+	allow $2 system_r;
+
+	files_search_etc($1)
+	admin_pattern($1, uptimed_etc_t)
+
+	files_search_spool($1)
+	admin_pattern($1, uptimed_spool_t)
+
+	files_search_pids($1)
+	admin_pattern($1, uptimed_var_run_t)
+')

diff --git a/policy/modules/contrib/uptime.te b/policy/modules/contrib/uptime.te
index c2cf97e..09741f6 100644
--- a/policy/modules/contrib/uptime.te
+++ b/policy/modules/contrib/uptime.te
@@ -1,4 +1,4 @@
-policy_module(uptime, 1.4.0)
+policy_module(uptime, 1.4.1)
 
 ########################################
 #
@@ -12,6 +12,9 @@ init_daemon_domain(uptimed_t, uptimed_exec_t)
 type uptimed_etc_t alias etc_uptimed_t;
 files_config_file(uptimed_etc_t)
 
+type uptimed_initrc_exec_t;
+init_script_file(uptimed_initrc_exec_t)
+
 type uptimed_spool_t;
 files_type(uptimed_spool_t)
 
@@ -25,12 +28,9 @@ files_pid_file(uptimed_var_run_t)
 
 dontaudit uptimed_t self:capability sys_tty_config;
 allow uptimed_t self:process signal_perms;
-allow uptimed_t self:fifo_file write_file_perms;
+allow uptimed_t self:fifo_file rw_fifo_file_perms;
 
 allow uptimed_t uptimed_etc_t:file read_file_perms;
-files_search_etc(uptimed_t)
-
-allow uptimed_t uptimed_spool_t:file manage_file_perms;
 
 manage_files_pattern(uptimed_t, uptimed_var_run_t, uptimed_var_run_t)
 files_pid_filetrans(uptimed_t, uptimed_var_run_t, file)