[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     7f6684225f9479e6db9b4c186c31d2338eae3ce8
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Nov  2 18:52:05 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Fri Nov  2 18:52:05 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=7f668422

Reshuffle gentoo specific java code

---
 policy/modules/contrib/java.if |   72 ++++++++++++++++++++++------------------
 policy/modules/contrib/java.te |   55 +++++++++++++++++-------------
 2 files changed, 71 insertions(+), 56 deletions(-)

diff --git a/policy/modules/contrib/java.if b/policy/modules/contrib/java.if
index ab47de0..acf6a63 100644
--- a/policy/modules/contrib/java.if
+++ b/policy/modules/contrib/java.if
@@ -20,7 +20,6 @@ interface(`java_role',`
 		attribute_role java_roles;
 		type java_t, java_exec_t, java_tmp_t;
 		type java_tmpfs_t;
-		type java_home_t;
 	')
 
 	########################################
@@ -34,7 +33,7 @@ interface(`java_role',`
 	#
 	# Policy
 	#
-	
+
 	domtrans_pattern($2, java_exec_t, java_t)
 
 	allow $2 java_t:process { noatsecure siginh rlimitinh ptrace signal_perms };
@@ -51,8 +50,14 @@ interface(`java_role',`
 	allow java_t $2:unix_stream_socket { read write };
 	allow java_t $2:tcp_socket { read write };
 
-	manage_files_pattern($2, java_home_t, java_home_t)
-	manage_dirs_pattern($2, java_home_t, java_home_t)
+	ifdef(`distro_gentoo',`
+		gen_require(`
+			type java_home_t;
+		')
+	
+		manage_files_pattern($2, java_home_t, java_home_t)
+		manage_dirs_pattern($2, java_home_t, java_home_t)
+	')
 ')
 
 #######################################
@@ -148,36 +153,12 @@ template(`java_domtrans',`
 	corecmd_search_bin($1)
 	domtrans_pattern($1, java_exec_t, java_t)
 
-	# /usr/bin/java is a symlink
-	files_read_usr_symlinks($1)
-')
-
-########################################
-## <summary>
-##	Run java in javaplugin domain and
-##	do not clean the environment (atsecure)
-## </summary>
-## <desc>
-##	<p>
-##	This is needed when java is called by an application with library
-##	settings (such as is the case when invoked as a browser plugin)
-##	</p>
-## </desc>
-## <param name="domain">
-##	<summary>
-##	Domain allowed to transition.
-##	</summary>
-## </param>
-#
-template(`java_noatsecure_domtrans',`
-	gen_require(`
-		type java_t;
+	ifdef(`distro_gentoo',`
+		# /usr/bin/java is a symlink
+		files_read_usr_symlinks($1)
 	')
-
-	allow $1 java_t:process noatsecure;
-
-	java_domtrans($1)
 ')
+
 ########################################
 ## <summary>
 ##	Execute java in the java domain, and
@@ -319,3 +300,30 @@ interface(`java_home_filetrans_java_home',`
 
 	userdom_user_home_dir_filetrans($1, java_home_t, $2, $3)
 ')
+
+########################################
+## <summary>
+##	Run java in javaplugin domain and
+##	do not clean the environment (atsecure)
+## </summary>
+## <desc>
+##	<p>
+##	This is needed when java is called by an application with library
+##	settings (such as is the case when invoked as a browser plugin)
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+template(`java_noatsecure_domtrans',`
+	gen_require(`
+		type java_t;
+	')
+
+	allow $1 java_t:process noatsecure;
+
+	java_domtrans($1)
+')

diff --git a/policy/modules/contrib/java.te b/policy/modules/contrib/java.te
index 316b7c0..5828d93 100644
--- a/policy/modules/contrib/java.te
+++ b/policy/modules/contrib/java.te
@@ -51,13 +51,6 @@ role unconfined_java_roles types unconfined_java_t;
 
 allow java_domain self:process { signal_perms getsched setsched };
 allow java_domain self:fifo_file rw_fifo_file_perms;
-# For java browser plugin accessing internet resources?
-allow java_domain self:netlink_route_socket create_netlink_socket_perms; 
-allow java_domain self:sem create_sem_perms;
-
-manage_dirs_pattern(java_domain, java_home_t, java_home_t)
-manage_files_pattern(java_domain, java_home_t, java_home_t)
-userdom_user_home_dir_filetrans(java_domain, java_home_t, dir, ".icedtea")
 
 manage_dirs_pattern(java_domain, java_home_t, java_home_t)
 manage_files_pattern(java_domain, java_home_t, java_home_t)
@@ -108,7 +101,7 @@ logging_send_syslog_msg(java_domain)
 miscfiles_read_localization(java_domain)
 miscfiles_read_fonts(java_domain)
 
-userdom_use_user_terminals(java_t)
+userdom_dontaudit_use_user_terminals(java_domain)
 userdom_dontaudit_exec_user_home_content_files(java_domain)
 userdom_manage_user_home_content_dirs(java_domain)
 userdom_manage_user_home_content_files(java_domain)
@@ -119,13 +112,23 @@ userdom_user_home_dir_filetrans_user_home_content(java_domain, { file lnk_file s
 
 userdom_write_user_tmp_sockets(java_domain)
 
+ifdef(`distro_gentoo',`
+	# For java browser plugin accessing internet resources
+	allow java_domain self:netlink_route_socket create_netlink_socket_perms; 
+	allow java_domain self:sem create_sem_perms;
+
+	manage_dirs_pattern(java_domain, java_home_t, java_home_t)
+	manage_files_pattern(java_domain, java_home_t, java_home_t)
+	userdom_user_home_dir_filetrans(java_domain, java_home_t, dir, ".icedtea")
+')
+
 tunable_policy(`allow_java_execstack',`
-       allow java_domain self:process { execmem execstack };
+	allow java_domain self:process { execmem execstack };
 
-       libs_legacy_use_shared_libs(java_domain)
-       libs_legacy_use_ld_so(java_domain)
+	libs_legacy_use_shared_libs(java_domain)
+	libs_legacy_use_ld_so(java_domain)
 
-       miscfiles_legacy_read_localization(java_domain)
+	miscfiles_legacy_read_localization(java_domain)
 ')
 
 ########################################
@@ -135,19 +138,23 @@ tunable_policy(`allow_java_execstack',`
 
 auth_use_nsswitch(java_t)
 
-optional_policy(`
-	alsa_domain(java_t, java_tmpfs_t)
-	alsa_read_rw_config(java_t)
-')
-
-optional_policy(`
-	# Plugin communication
-	chromium_rw_tmp_pipes(java_t)
-')
+ifdef(`distro_gentoo',`
+	userdom_use_user_terminals(java_t)
 
-optional_policy(`
-	# Plugin communication
-	mozilla_rw_tmp_pipes(java_t)
+	optional_policy(`
+		alsa_domain(java_t, java_tmpfs_t)
+		alsa_read_rw_config(java_t)
+	')
+	
+	optional_policy(`
+		# Plugin communication
+		chromium_rw_tmp_pipes(java_t)
+	')
+	
+	optional_policy(`
+		# Plugin communication
+		mozilla_rw_tmp_pipes(java_t)
+	')
 ')
 
 optional_policy(`