[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     64429db34991a38dec86976e2c9bd3dbb6bdd3f6
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Sun Oct 28 18:41:08 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Oct 29 14:48:28 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=64429db3

Move mailscanner content to mailscanner module

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/clamav.fc      |    1 -
 policy/modules/contrib/clamav.te      |    2 +-
 policy/modules/contrib/mailscanner.fc |    2 ++
 policy/modules/contrib/mailscanner.if |   26 +++++++++++++++++++++++++-
 policy/modules/contrib/mailscanner.te |   10 ++++++++--
 5 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/policy/modules/contrib/clamav.fc b/policy/modules/contrib/clamav.fc
index 7d93529..dcaa045 100644
--- a/policy/modules/contrib/clamav.fc
+++ b/policy/modules/contrib/clamav.fc
@@ -24,4 +24,3 @@
 /var/run/clamd.*	gen_context(system_u:object_r:clamd_var_run_t,s0)
 
 /var/spool/amavisd/clamd\.sock	-s	gen_context(system_u:object_r:clamd_var_run_t,s0)
-/var/spool/MailScanner(/.*)?	gen_context(system_u:object_r:clamd_var_run_t,s0)

diff --git a/policy/modules/contrib/clamav.te b/policy/modules/contrib/clamav.te
index b5843df..5320a93 100644
--- a/policy/modules/contrib/clamav.te
+++ b/policy/modules/contrib/clamav.te
@@ -1,4 +1,4 @@
-policy_module(clamav, 1.10.4)
+policy_module(clamav, 1.10.5)
 
 ## <desc>
 ##	<p>

diff --git a/policy/modules/contrib/mailscanner.fc b/policy/modules/contrib/mailscanner.fc
index 827e22e..3698276 100644
--- a/policy/modules/contrib/mailscanner.fc
+++ b/policy/modules/contrib/mailscanner.fc
@@ -9,3 +9,5 @@
 /usr/sbin/MailScanner	--	gen_context(system_u:object_r:mscan_exec_t,s0)
 
 /var/run/MailScanner\.pid	--	gen_context(system_u:object_r:mscan_var_run_t,s0)
+
+/var/spool/MailScanner(/.*)?	gen_context(system_u:object_r:mscan_spool_t,s0)

diff --git a/policy/modules/contrib/mailscanner.if b/policy/modules/contrib/mailscanner.if
index 462209d..0293f34 100644
--- a/policy/modules/contrib/mailscanner.if
+++ b/policy/modules/contrib/mailscanner.if
@@ -2,6 +2,27 @@
 
 ########################################
 ## <summary>
+##	Create, read, write, and delete
+##	mscan spool content.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mscan_manage_spool_content',`
+	gen_require(`
+		type mscan_spool_t;
+	')
+
+	files_search_spool($1)
+	manage_dirs_pattern($1, mscan_spool_t, mscan_spool_t)
+	manage_files_pattern($1, mscan_spool_t, mscan_spool_t)
+')
+
+########################################
+## <summary>
 ##	All of the rules required to
 ##	administrate an mscan environment
 ## </summary>
@@ -20,7 +41,7 @@
 interface(`mscan_admin',`
 	gen_require(`
 		type mscan_t, mscan_etc_t, mscan_initrc_exec_t;
-		type mscan_var_run_t;
+		type mscan_var_run_t, mscan_spool_t;
 	')
 
 	allow $1 mscan_t:process { ptrace signal_perms };
@@ -36,4 +57,7 @@ interface(`mscan_admin',`
 
 	files_search_pids($1
 	admin_pattern($1, mscan_var_run_t)
+
+	files_search_spool($1)
+	admin_pattern($1, mscan_spool_t)
 ')

diff --git a/policy/modules/contrib/mailscanner.te b/policy/modules/contrib/mailscanner.te
index d5651c7..725ba32 100644
--- a/policy/modules/contrib/mailscanner.te
+++ b/policy/modules/contrib/mailscanner.te
@@ -1,4 +1,4 @@
-policy_module(mailscanner, 1.0.1)
+policy_module(mailscanner, 1.0.2)
 
 ########################################
 #
@@ -15,6 +15,9 @@ init_script_file(mscan_initrc_exec_t)
 type mscan_etc_t;
 files_config_file(mscan_etc_t)
 
+type mscan_spool_t;
+files_type(mscan_spool_t)
+
 type mscan_tmp_t;
 files_tmp_file(mscan_tmp_t)
 
@@ -35,6 +38,10 @@ read_files_pattern(mscan_t, mscan_etc_t, mscan_etc_t)
 manage_files_pattern(mscan_t, mscan_var_run_t, mscan_var_run_t)
 files_pid_filetrans(mscan_t, mscan_var_run_t, file)
 
+manage_dirs_pattern(mscan_t, mscan_spool_t, mscan_spool_t)
+manage_files_pattern(mscan_t, mscan_spool_t, mscan_spool_t)
+files_spool_filetrans(mscan_t, mscan_spool_t, dir)
+
 manage_dirs_pattern(mscan_t, mscan_tmp_t, mscan_tmp_t)
 manage_files_pattern(mscan_t, mscan_tmp_t, mscan_tmp_t)
 files_tmp_filetrans(mscan_t, mscan_tmp_t, { dir file })
@@ -78,7 +85,6 @@ miscfiles_read_localization(mscan_t)
 
 optional_policy(`
 	clamav_domtrans_clamscan(mscan_t)
-	clamav_manage_pid_content(mscan_t)
 ')
 
 optional_policy(`