[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     963d28045ce8acd550b2982533ffd79b737ff61c
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Fri Sep 28 10:30:26 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Fri Sep 28 17:47:36 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=963d2804

Changes to the djbdns policy module

Use type attribute to group common policy for efficiency
Module cleap up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/djbdns.fc |   12 +++----
 policy/modules/contrib/djbdns.if |   62 ++++++++++++++-----------------------
 policy/modules/contrib/djbdns.te |   61 ++++++++++++++++++++++--------------
 3 files changed, 66 insertions(+), 69 deletions(-)

diff --git a/policy/modules/contrib/djbdns.fc b/policy/modules/contrib/djbdns.fc
index fdb6652..e9b1b32 100644
--- a/policy/modules/contrib/djbdns.fc
+++ b/policy/modules/contrib/djbdns.fc
@@ -1,9 +1,7 @@
-
-/usr/bin/axfrdns		--	gen_context(system_u:object_r:djbdns_axfrdns_exec_t,s0)
+/usr/bin/axfrdns	--	gen_context(system_u:object_r:djbdns_axfrdns_exec_t,s0)
 /usr/bin/dnscache	--	gen_context(system_u:object_r:djbdns_dnscache_exec_t,s0)
-/usr/bin/tinydns		--	gen_context(system_u:object_r:djbdns_tinydns_exec_t,s0)
-
-/var/axfrdns/root(/.*)?		gen_context(system_u:object_r:djbdns_axfrdns_conf_t,s0)
-/var/dnscache/root(/.*)?		gen_context(system_u:object_r:djbdns_dnscache_conf_t,s0)
-/var/tinydns/root(/.*)?		gen_context(system_u:object_r:djbdns_tinydns_conf_t,s0)
+/usr/bin/tinydns	--	gen_context(system_u:object_r:djbdns_tinydns_exec_t,s0)
 
+/var/axfrdns/root(/.*)?	gen_context(system_u:object_r:djbdns_axfrdns_conf_t,s0)
+/var/dnscache/root(/.*)?	gen_context(system_u:object_r:djbdns_dnscache_conf_t,s0)
+/var/tinydns/root(/.*)?	gen_context(system_u:object_r:djbdns_tinydns_conf_t,s0)

diff --git a/policy/modules/contrib/djbdns.if b/policy/modules/contrib/djbdns.if
index d53902d..671d3c0 100644
--- a/policy/modules/contrib/djbdns.if
+++ b/policy/modules/contrib/djbdns.if
@@ -1,63 +1,49 @@
-## <summary>small and secure DNS daemon</summary>
+## <summary>Small and secure DNS daemon.</summary>
 
-########################################
+#######################################
 ## <summary>
-##	Create a set of derived types for djbdns
-##	components that are directly supervised by daemontools.
+##	The template to define a djbdns domain.
 ## </summary>
-## <param name="prefix">
+## <param name="domain_prefix">
 ##	<summary>
-##	The prefix to be used for deriving type names.
+##	Domain prefix to be used.
 ##	</summary>
 ## </param>
 #
 template(`djbdns_daemontools_domain_template',`
+	gen_require(`
+		attribute djbdns_domain;
+	')
 
-	type djbdns_$1_t;
-	type djbdns_$1_exec_t;
-	type djbdns_$1_conf_t;
-	files_config_file(djbdns_$1_conf_t)
+	########################################
+	#
+	# Declarations
+	#
 
+	type djbdns_$1_t, djbdns_domain;
+	type djbdns_$1_exec_t;
 	domain_type(djbdns_$1_t)
 	domain_entry_file(djbdns_$1_t, djbdns_$1_exec_t)
 	role system_r types djbdns_$1_t;
 
+	type djbdns_$1_conf_t;
+	files_config_file(djbdns_$1_conf_t)
+
+	########################################
+	#
+	# Local policy
+	#
+
 	daemontools_service_domain(djbdns_$1_t, djbdns_$1_exec_t)
 	daemontools_read_svc(djbdns_$1_t)
 
-	allow djbdns_$1_t self:capability { net_bind_service setgid setuid sys_chroot };
-	allow djbdns_$1_t self:process signal;
-	allow djbdns_$1_t self:fifo_file rw_fifo_file_perms;
-	allow djbdns_$1_t self:tcp_socket create_stream_socket_perms;
-	allow djbdns_$1_t self:udp_socket create_socket_perms;
-
 	allow djbdns_$1_t djbdns_$1_conf_t:dir list_dir_perms;
 	allow djbdns_$1_t djbdns_$1_conf_t:file read_file_perms;
-
-	corenet_all_recvfrom_unlabeled(djbdns_$1_t)
-	corenet_all_recvfrom_netlabel(djbdns_$1_t)
-	corenet_tcp_sendrecv_generic_if(djbdns_$1_t)
-	corenet_udp_sendrecv_generic_if(djbdns_$1_t)
-	corenet_tcp_sendrecv_generic_node(djbdns_$1_t)
-	corenet_udp_sendrecv_generic_node(djbdns_$1_t)
-	corenet_tcp_sendrecv_all_ports(djbdns_$1_t)
-	corenet_udp_sendrecv_all_ports(djbdns_$1_t)
-	corenet_tcp_bind_generic_node(djbdns_$1_t)
-	corenet_udp_bind_generic_node(djbdns_$1_t)
-	corenet_tcp_bind_dns_port(djbdns_$1_t)
-	corenet_tcp_connect_dns_port(djbdns_$1_t)
-	corenet_udp_bind_dns_port(djbdns_$1_t)
-	corenet_tcp_bind_generic_port(djbdns_$1_t)
-	corenet_udp_bind_generic_port(djbdns_$1_t)
-	corenet_sendrecv_dns_server_packets(djbdns_$1_t)
-	corenet_sendrecv_generic_server_packets(djbdns_$1_t)
-
-	files_search_var(djbdns_$1_t)
 ')
 
 #####################################
 ## <summary>
-##	Allow search the djbdns-tinydns key ring.
+##	Search djbdns-tinydns key ring.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -75,7 +61,7 @@ interface(`djbdns_search_tinydns_keys',`
 
 #####################################
 ## <summary>
-##	Allow link to the djbdns-tinydns key ring.
+##	Link djbdns-tinydns key ring.
 ## </summary>
 ## <param name="domain">
 ##	<summary>

diff --git a/policy/modules/contrib/djbdns.te b/policy/modules/contrib/djbdns.te
index b8933a0..a195011 100644
--- a/policy/modules/contrib/djbdns.te
+++ b/policy/modules/contrib/djbdns.te
@@ -1,51 +1,64 @@
-policy_module(djbdns, 1.5.1)
+policy_module(djbdns, 1.5.2)
 
 ########################################
 #
 # Declarations
 #
 
-type djbdns_axfrdns_t;
-type djbdns_axfrdns_exec_t;
-domain_type(djbdns_axfrdns_t)
-domain_entry_file(djbdns_axfrdns_t, djbdns_axfrdns_exec_t)
-role system_r types djbdns_axfrdns_t;
+attribute djbdns_domain;
 
-type djbdns_axfrdns_conf_t;
-files_config_file(djbdns_axfrdns_conf_t)
+djbdns_daemontools_domain_template(axfrdns)
+ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t)
 
 djbdns_daemontools_domain_template(dnscache)
-
 djbdns_daemontools_domain_template(tinydns)
 
 ########################################
 #
-# Local policy for axfrdns component
+# Common local policy
 #
 
-daemontools_ipc_domain(djbdns_axfrdns_t)
-daemontools_read_svc(djbdns_axfrdns_t)
+allow djbdns_domain self:capability { net_bind_service setgid setuid sys_chroot };
+allow djbdns_domain self:process signal;
+allow djbdns_domain self:fifo_file rw_fifo_file_perms;
+allow djbdns_domain self:tcp_socket create_stream_socket_perms;
+allow djbdns_domain self:udp_socket create_socket_perms;
+
+corenet_all_recvfrom_unlabeled(djbdns_domain)
+corenet_all_recvfrom_netlabel(djbdns_domain)
+corenet_tcp_sendrecv_generic_if(djbdns_domain)
+corenet_udp_sendrecv_generic_if(djbdns_domain)
+corenet_tcp_sendrecv_generic_node(djbdns_domain)
+corenet_udp_sendrecv_generic_node(djbdns_domain)
+corenet_tcp_sendrecv_all_ports(djbdns_domain)
+corenet_udp_sendrecv_all_ports(djbdns_domain)
+corenet_tcp_bind_generic_node(djbdns_domain)
+corenet_udp_bind_generic_node(djbdns_domain)
 
-allow djbdns_axfrdns_t self:capability { setuid setgid sys_chroot };
+corenet_sendrecv_dns_server_packets(djbdns_domain)
+corenet_tcp_bind_dns_port(djbdns_domain)
+corenet_udp_bind_dns_port(djbdns_domain)
 
-allow djbdns_axfrdns_t djbdns_axfrdns_conf_t:dir list_dir_perms;
-allow djbdns_axfrdns_t djbdns_axfrdns_conf_t:file read_file_perms;
+corenet_sendrecv_dns_client_packets(djbdns_domain)
+corenet_tcp_connect_dns_port(djbdns_domain)
 
-allow djbdns_axfrdns_t djbdns_tinydns_t:dir list_dir_perms;
-allow djbdns_axfrdns_t djbdns_tinydns_t:file read_file_perms;
+corenet_sendrecv_generic_server_packets(djbdns_domain)
+corenet_tcp_bind_generic_port(djbdns_domain)
+corenet_udp_bind_generic_port(djbdns_domain)
 
-allow djbdns_axfrdns_t djbdns_tinydns_conf_t:dir list_dir_perms;
-allow djbdns_axfrdns_t djbdns_tinydns_conf_t:file read_file_perms;
+files_search_var(djbdns_domain)
 
-files_search_var(djbdns_axfrdns_t)
+########################################
+#
+# axfrdns local policy
+#
 
-optional_policy(`
-	ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t)
-')
+allow djbdns_axfrdns_t { djbdns_tinydns_t djbdns_tinydns_conf_t }:dir list_dir_perms;
+allow djbdns_axfrdns_t { djbdns_tinydns_t djbdns_tinydns_conf_t }:file read_file_perms;
 
 ########################################
 #
-# Local policy for tinydns
+# tinydns local policy
 #
 
 init_dontaudit_use_script_fds(djbdns_tinydns_t)