[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     a70aa3e3b948e30a7ed01a9d09b762419fa76d48
Author:     Dave Sugar <dsugar <AT> tresys <DOT> com>
AuthorDate: Mon Mar  5 14:02:58 2018 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Sun Mar 25 09:30:41 2018 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=a70aa3e3

Separate type for chronyd config file.

Separate label for /etc/chrony.conf (chronyd_conf_t) with interfaces to allow read-only or read/write access.  Needed as I have a process that alters chrony.conf but I didn't want this process to have access to write all etc_t files.

Fixed summary for chronyd_rw_config interface from previous submission.

Signed-off-by: Dave Sugar <dsugar <AT> tresys.com>

 policy/modules/contrib/chronyd.fc |  1 +
 policy/modules/contrib/chronyd.if | 38 ++++++++++++++++++++++++++++++++++++++
 policy/modules/contrib/chronyd.te |  5 +++++
 3 files changed, 44 insertions(+)

diff --git a/policy/modules/contrib/chronyd.fc b/policy/modules/contrib/chronyd.fc
index ca2747e7..445f3749 100644
--- a/policy/modules/contrib/chronyd.fc
+++ b/policy/modules/contrib/chronyd.fc
@@ -1,3 +1,4 @@
+/etc/chrony\.conf			--	gen_context(system_u:object_r:chronyd_conf_t,s0)
 /etc/chrony\.keys			--	gen_context(system_u:object_r:chronyd_keys_t,s0)
 
 /etc/rc\.d/init\.d/chronyd		--	gen_context(system_u:object_r:chronyd_initrc_exec_t,s0)

diff --git a/policy/modules/contrib/chronyd.if b/policy/modules/contrib/chronyd.if
index 3d45be4c..e0a751ac 100644
--- a/policy/modules/contrib/chronyd.if
+++ b/policy/modules/contrib/chronyd.if
@@ -76,6 +76,44 @@ interface(`chronyd_read_log',`
 	read_files_pattern($1, chronyd_var_log_t, chronyd_var_log_t)
 ')
 
+#####################################
+## <summary>
+##	Read chronyd config file.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`chronyd_read_config',`
+	gen_require(`
+		type chronyd_conf_t;
+	')
+
+	files_search_etc($1)
+	allow $1 chronyd_conf_t:file read_file_perms;
+')
+
+#####################################
+## <summary>
+##	Read and write chronyd config file.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`chronyd_rw_config',`
+	gen_require(`
+		type chronyd_conf_t;
+	')
+
+	files_search_etc($1)
+	allow $1 chronyd_conf_t:file rw_file_perms;
+')
+
 ########################################
 ## <summary>
 ##	Read and write chronyd shared memory.

diff --git a/policy/modules/contrib/chronyd.te b/policy/modules/contrib/chronyd.te
index 0de7b520..09d7f834 100644
--- a/policy/modules/contrib/chronyd.te
+++ b/policy/modules/contrib/chronyd.te
@@ -9,6 +9,9 @@ type chronyd_t;
 type chronyd_exec_t;
 init_daemon_domain(chronyd_t, chronyd_exec_t)
 
+type chronyd_conf_t;
+files_config_file(chronyd_conf_t)
+
 type chronyd_initrc_exec_t;
 init_script_file(chronyd_initrc_exec_t)
 
@@ -87,6 +90,8 @@ logging_send_syslog_msg(chronyd_t)
 
 miscfiles_read_localization(chronyd_t)
 
+chronyd_read_config(chronyd_t)
+
 optional_policy(`
 	gpsd_rw_shm(chronyd_t)
 ')