[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     aec7fe65c4b3c63438570f4e00109787fc3a1a0f
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Mon Oct 29 12:06:45 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Oct 29 14:51:32 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=aec7fe65

Changes to the tgtd policy module

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/tgtd.fc |    4 ++
 policy/modules/contrib/tgtd.if |   78 ++++++++++++++++++++++++++++++++++------
 policy/modules/contrib/tgtd.te |   33 +++++++++++++----
 3 files changed, 96 insertions(+), 19 deletions(-)

diff --git a/policy/modules/contrib/tgtd.fc b/policy/modules/contrib/tgtd.fc
index 0ce7e61..38389e6 100644
--- a/policy/modules/contrib/tgtd.fc
+++ b/policy/modules/contrib/tgtd.fc
@@ -1,3 +1,7 @@
 /etc/rc\.d/init\.d/tgtd	--	gen_context(system_u:object_r:tgtd_initrc_exec_t,s0)
+
 /usr/sbin/tgtd	--	gen_context(system_u:object_r:tgtd_exec_t,s0)
+
 /var/lib/tgtd(/.*)?	gen_context(system_u:object_r:tgtd_var_lib_t,s0)
+
+/var/run/tgtd.*	-s	gen_context(system_u:object_r:tgtd_var_run_t,s0)

diff --git a/policy/modules/contrib/tgtd.if b/policy/modules/contrib/tgtd.if
index c2ed23a..5406b6e 100644
--- a/policy/modules/contrib/tgtd.if
+++ b/policy/modules/contrib/tgtd.if
@@ -1,17 +1,8 @@
 ## <summary>Linux Target Framework Daemon.</summary>
-## <desc>
-##	<p>
-##	Linux target framework (tgt) aims to simplify various
-##	SCSI target driver (iSCSI, Fibre Channel, SRP, etc) creation
-##	and maintenance. Our key goals are the clean integration into
-##	the scsi-mid layer and implementing a great portion of tgt
-##	in user space.
-##	</p>
-## </desc>
 
 #####################################
 ## <summary>
-##	Allow read and write access to tgtd semaphores.
+##	Read and write tgtd semaphores.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -29,7 +20,8 @@ interface(`tgtd_rw_semaphores',`
 
 ######################################
 ## <summary>
-##	Manage tgtd sempaphores.
+##	Create, read, write, and delete
+##	tgtd sempaphores.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -44,3 +36,67 @@ interface(`tgtd_manage_semaphores',`
 
 	allow $1 tgtd_t:sem create_sem_perms;
 ')
+
+######################################
+## <summary>
+##	Connect to tgtd with a unix
+##	domain stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`tgtd_stream_connect',`
+	gen_require(`
+		type tgtd_t, tgtd_var_run_t;
+	')
+
+	files_search_pids($1)
+	stream_connect_pattern($1, tgtd_var_run_t, tgtd_var_run_t, tgtd_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to
+##	administrate an tgtd environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`tgtd_admin',`
+	gen_require(`
+		type tgtd_t, tgtd_initrc_exec_t, tgtd_var_lib_t;
+		type tgtd_var_run_t, tgtd_tmp_t, tgtd_tmpfs_t;
+	')
+
+	allow $1 tgtd_t:process { ptrace signal_perms };
+	ps_process_pattern($1, tgtd_t)
+
+	init_labeled_script_domtrans($1, tgtd_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 tgtd_initrc_exec_t system_r;
+	allow $2 system_r;
+
+	files_search_var_lib($1)
+	admin_pattern($1, tgtd_var_lib_t)
+
+	files_search_pids($1)
+	admin_pattern($1, tgtd_var_run_t)
+
+	files_search_tmp($1)
+	admin_pattern($1, tgtd_tmp_t)
+
+	files_search_tmpfs($1)
+	admin_pattern($1, tgtd_tmpfs_t)
+')

diff --git a/policy/modules/contrib/tgtd.te b/policy/modules/contrib/tgtd.te
index 80fe75c..dc22f11 100644
--- a/policy/modules/contrib/tgtd.te
+++ b/policy/modules/contrib/tgtd.te
@@ -1,8 +1,8 @@
-policy_module(tgtd, 1.2.0)
+policy_module(tgtd, 1.2.2)
 
 ########################################
 #
-# TGTD personal declarations.
+# Declarations
 #
 
 type tgtd_t;
@@ -21,23 +21,25 @@ files_tmpfs_file(tgtd_tmpfs_t)
 type tgtd_var_lib_t;
 files_type(tgtd_var_lib_t)
 
+type tgtd_var_run_t;
+files_pid_file(tgtd_var_run_t)
+
 ########################################
 #
-# TGTD personal policy.
+# Local policy
 #
 
 allow tgtd_t self:capability sys_resource;
 allow tgtd_t self:process { setrlimit signal };
 allow tgtd_t self:fifo_file rw_fifo_file_perms;
-allow tgtd_t self:netlink_route_socket { create_socket_perms nlmsg_read };
+allow tgtd_t self:netlink_route_socket r_netlink_socket_perms;
 allow tgtd_t self:shm create_shm_perms;
 allow tgtd_t self:sem create_sem_perms;
 allow tgtd_t self:tcp_socket create_stream_socket_perms;
 allow tgtd_t self:udp_socket create_socket_perms;
-allow tgtd_t self:unix_dgram_socket create_socket_perms;
 
 manage_sock_files_pattern(tgtd_t, tgtd_tmp_t, tgtd_tmp_t)
-files_tmp_filetrans(tgtd_t, tgtd_tmp_t, { sock_file })
+files_tmp_filetrans(tgtd_t, tgtd_tmp_t, sock_file)
 
 manage_files_pattern(tgtd_t, tgtd_tmpfs_t, tgtd_tmpfs_t)
 fs_tmpfs_filetrans(tgtd_t, tgtd_tmpfs_t, file)
@@ -46,21 +48,36 @@ manage_dirs_pattern(tgtd_t, tgtd_var_lib_t, tgtd_var_lib_t)
 manage_files_pattern(tgtd_t, tgtd_var_lib_t, tgtd_var_lib_t)
 files_var_lib_filetrans(tgtd_t, tgtd_var_lib_t, { dir file })
 
+manage_dirs_pattern(tgtd_t, tgtd_var_run_t,tgtd_var_run_t)
+manage_files_pattern(tgtd_t, tgtd_var_run_t,tgtd_var_run_t)
+manage_sock_files_pattern(tgtd_t, tgtd_var_run_t,tgtd_var_run_t)
+files_pid_filetrans(tgtd_t,tgtd_var_run_t, { file sock_file })
+
+kernel_read_system_state(tgtd_t)
 kernel_read_fs_sysctls(tgtd_t)
 
 corenet_all_recvfrom_netlabel(tgtd_t)
 corenet_all_recvfrom_unlabeled(tgtd_t)
 corenet_tcp_sendrecv_generic_if(tgtd_t)
 corenet_tcp_sendrecv_generic_node(tgtd_t)
-corenet_tcp_sendrecv_iscsi_port(tgtd_t)
 corenet_tcp_bind_generic_node(tgtd_t)
-corenet_tcp_bind_iscsi_port(tgtd_t)
+
 corenet_sendrecv_iscsi_server_packets(tgtd_t)
+corenet_tcp_bind_iscsi_port(tgtd_t)
+corenet_tcp_sendrecv_iscsi_port(tgtd_t)
+
+dev_read_sysfs(tgtd_t)
 
 files_read_etc_files(tgtd_t)
 
+fs_read_anon_inodefs_files(tgtd_t)
+
 storage_manage_fixed_disk(tgtd_t)
 
 logging_send_syslog_msg(tgtd_t)
 
 miscfiles_read_localization(tgtd_t)
+
+optional_policy(`
+	iscsi_manage_semaphores(tgtd_t)
+')