1 |
commit: 165bc8e382258a055c3ceb572106d35b4967725c |
2 |
Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be> |
3 |
AuthorDate: Sun Feb 8 18:18:12 2015 +0000 |
4 |
Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org> |
5 |
CommitDate: Sun Feb 8 18:18:12 2015 +0000 |
6 |
URL: http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=165bc8e3 |
7 |
|
8 |
squash |
9 |
|
10 |
--- |
11 |
policy/modules/contrib/gentoo.if | 201 ++++++++++++++++++++++++++++++++++++++- |
12 |
1 file changed, 200 insertions(+), 1 deletion(-) |
13 |
|
14 |
diff --git a/policy/modules/contrib/gentoo.if b/policy/modules/contrib/gentoo.if |
15 |
index 593bb2d..c6990a0 100644 |
16 |
--- a/policy/modules/contrib/gentoo.if |
17 |
+++ b/policy/modules/contrib/gentoo.if |
18 |
@@ -51,6 +51,11 @@ interface(`gentoo_secmodel_monitor_system',` |
19 |
# |
20 |
interface(`gentoo_secmodel_manage_services',` |
21 |
# These are all admin interfaces where a labeled init script is provided for |
22 |
+ # |
23 |
+ # If we would reduce the impact of manage_services to only manipulating the labeled init scripts, |
24 |
+ # we can "just" use init_all_labeled_script_domtrans( 1 ). This could be called "operate_services" but |
25 |
+ # does not need a separate interface |
26 |
+ |
27 |
optional_policy(` |
28 |
abrt_admin($1, $2) |
29 |
') |
30 |
@@ -709,7 +714,201 @@ interface(`gentoo_secmodel_manage_services',` |
31 |
') |
32 |
|
33 |
optional_policy(` |
34 |
- salt_minion_master($1, $2) |
35 |
+ salt_admin_minion($1, $2) |
36 |
+ ') |
37 |
+ |
38 |
+ optional_policy(` |
39 |
+ salt_admin_master($1, $2) |
40 |
+ ') |
41 |
+ |
42 |
+ optional_policy(` |
43 |
+ samba_admin($1, $2) |
44 |
+ ') |
45 |
+ |
46 |
+ optional_policy(` |
47 |
+ samhain_admin($1, $2) |
48 |
+ ') |
49 |
+ |
50 |
+ optional_policy(` |
51 |
+ sanlock_admin($1, $2) |
52 |
+ ') |
53 |
+ |
54 |
+ optional_policy(` |
55 |
+ sasl_admin($1, $2) |
56 |
+ ') |
57 |
+ |
58 |
+ optional_policy(` |
59 |
+ sblim_admin($1, $2) |
60 |
+ ') |
61 |
+ |
62 |
+ optional_policy(` |
63 |
+ sendmail_admin($1, $2) |
64 |
+ ') |
65 |
+ |
66 |
+ optional_policy(` |
67 |
+ sensord_admin($1, $2) |
68 |
+ ') |
69 |
+ |
70 |
+ optional_policy(` |
71 |
+ shorewall_admin($1, $2) |
72 |
+ ') |
73 |
+ |
74 |
+ optional_policy(` |
75 |
+ slpd_admin($1, $2) |
76 |
+ ') |
77 |
+ |
78 |
+ optional_policy(` |
79 |
+ smartmon_admin($1, $2) |
80 |
+ ') |
81 |
+ |
82 |
+ optional_policy(` |
83 |
+ smokeping_admin($1, $2) |
84 |
+ ') |
85 |
+ |
86 |
+ optional_policy(` |
87 |
+ smstools_admin($1, $2) |
88 |
+ ') |
89 |
+ |
90 |
+ optional_policy(` |
91 |
+ snmp_admin($1, $2) |
92 |
+ ') |
93 |
+ |
94 |
+ optional_policy(` |
95 |
+ snort_admin($1, $2) |
96 |
+ ') |
97 |
+ |
98 |
+ optional_policy(` |
99 |
+ soundserver_admin($1, $2) |
100 |
+ ') |
101 |
+ |
102 |
+ optional_policy(` |
103 |
+ spamassassin_admin($1, $2) |
104 |
+ ') |
105 |
+ |
106 |
+ optional_policy(` |
107 |
+ squid_admin($1, $2) |
108 |
+ ') |
109 |
+ |
110 |
+ optional_policy(` |
111 |
+ sssd_admin($1, $2) |
112 |
+ ') |
113 |
+ |
114 |
+ optional_policy(` |
115 |
+ svnserve_admin($1, $2) |
116 |
+ ') |
117 |
+ |
118 |
+ optional_policy(` |
119 |
+ sysstat_admin($1, $2) |
120 |
+ ') |
121 |
+ |
122 |
+ optional_policy(` |
123 |
+ stapserver_admin($1, $2) |
124 |
+ ') |
125 |
+ |
126 |
+ optional_policy(` |
127 |
+ tcsd_admin($1, $2) |
128 |
+ ') |
129 |
+ |
130 |
+ optional_policy(` |
131 |
+ tgtd_admin($1, $2) |
132 |
+ ') |
133 |
+ |
134 |
+ optional_policy(` |
135 |
+ tor_admin($1, $2) |
136 |
+ ') |
137 |
+ |
138 |
+ optional_policy(` |
139 |
+ transproxy_admin($1, $2) |
140 |
+ ') |
141 |
+ |
142 |
+ optional_policy(` |
143 |
+ tuned_admin($1, $2) |
144 |
+ ') |
145 |
+ |
146 |
+ optional_policy(` |
147 |
+ ulogd_admin($1, $2) |
148 |
+ ') |
149 |
+ |
150 |
+ optional_policy(` |
151 |
+ uptime_admin($1, $2) |
152 |
+ ') |
153 |
+ |
154 |
+ optional_policy(` |
155 |
+ uucp_admin($1, $2) |
156 |
+ ') |
157 |
+ |
158 |
+ optional_policy(` |
159 |
+ uuidd_admin($1, $2) |
160 |
+ ') |
161 |
+ |
162 |
+ optional_policy(` |
163 |
+ varnishd_admin($1, $2) |
164 |
+ ') |
165 |
+ |
166 |
+ optional_policy(` |
167 |
+ varnishd_admin_varnishlog($1, $2) |
168 |
+ ') |
169 |
+ |
170 |
+ optional_policy(` |
171 |
+ vdagent_admin($1, $2) |
172 |
+ ') |
173 |
+ |
174 |
+ optional_policy(` |
175 |
+ vhostmd_admin($1, $2) |
176 |
+ ') |
177 |
+ |
178 |
+ optional_policy(` |
179 |
+ virt_admin($1, $2) |
180 |
+ ') |
181 |
+ |
182 |
+ optional_policy(` |
183 |
+ vnstatd_admin($1, $2) |
184 |
+ ') |
185 |
+ |
186 |
+ optional_policy(` |
187 |
+ watchdog_admin($1, $2) |
188 |
+ ') |
189 |
+ |
190 |
+ optional_policy(` |
191 |
+ wdmd_admin($1, $2) |
192 |
+ ') |
193 |
+ |
194 |
+ optional_policy(` |
195 |
+ xfs_admin($1, $2) |
196 |
+ ') |
197 |
+ |
198 |
+ optional_policy(` |
199 |
+ zabbix_admin($1, $2) |
200 |
+ ') |
201 |
+ |
202 |
+ optional_policy(` |
203 |
+ zarafa_admin($1, $2) |
204 |
+ ') |
205 |
+ |
206 |
+ optional_policy(` |
207 |
+ zebra_admin($1, $2) |
208 |
+ ') |
209 |
+ |
210 |
+ optional_policy(` |
211 |
+ postgresql_admin($1, $2) |
212 |
+ ') |
213 |
+ |
214 |
+ optional_policy(` |
215 |
+ # No admin interface |
216 |
+ iptables_initrc_domtrans($1) |
217 |
+ ') |
218 |
+ |
219 |
+ optional_policy(` |
220 |
+ logging_admin_audit($1, $2) |
221 |
+ ') |
222 |
+ |
223 |
+ optional_policy(` |
224 |
+ logging_admin_syslog($1, $2) |
225 |
+ ') |
226 |
+ |
227 |
+ optional_policy(` |
228 |
+ # No admin interface |
229 |
+ setrans_initrc_domtrans($1) |
230 |
') |
231 |
') |