[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     16d748c5274912f194a6a22fdc08d89530b3ea4a
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Sat Sep 29 18:18:51 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sat Sep 29 18:18:51 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=16d748c5

Nginx can read all web content and manage writeable web content

As nginx works as a full web server, allow it to read all web content
(httpdcontent attribute) and manage (read/write) all read-write content
(httpd_rw_content attribute).

---
 policy/modules/contrib/nginx.te |   42 +-------------------------------------
 1 files changed, 2 insertions(+), 40 deletions(-)

diff --git a/policy/modules/contrib/nginx.te b/policy/modules/contrib/nginx.te
index 8b21d76..4af208d 100644
--- a/policy/modules/contrib/nginx.te
+++ b/policy/modules/contrib/nginx.te
@@ -1,43 +1,4 @@
 # SELinux module for the NGINX Web Server
-#
-# Project Contact Information:
-#   Stuart Cianos
-#   Email: scianos@×××××××××.com
-#
-# (C) Copyright 2009 by Stuart Cianos, d/b/a AlphaVida. All Rights Reserved.
-#
-#
-# Stuart Cianos licenses this file to You under the GNU General Public License,
-# Version 3.0 (the "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#     http://www.gnu.org/licenses/gpl.txt
-#
-# or in the COPYING file included in the original archive.
-#
-# Disclaimer of Warranty.
-#
-# THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-# APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-# HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-# OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-# PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-# IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-# ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-#
-# Limitation of Liability.
-#
-# IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-# WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-# THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-# GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-# USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-# DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-# PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-# EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-# SUCH DAMAGES.
-###############################################################################
 policy_module(nginx,1.0.10)
 
 ########################################
@@ -165,7 +126,8 @@ sysnet_dns_name_resolve(nginx_t)
 
 tunable_policy(`gentoo_nginx_enable_http_server',`
 	corenet_tcp_bind_http_port(nginx_t)
-	apache_read_sys_content(nginx_t)
+	apache_read_all_content(nginx_t)
+	apache_manage_all_rw_content(nginx_t)
 ')
 
 # We enable both binding and connecting, since nginx acts here as a reverse proxy