[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     36b9de677df390ea7ac2ef242414a7122c6e26ac
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Tue Oct 30 09:58:49 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Oct 30 18:32:58 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=36b9de67

Changes to the tvtime policy module

Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/tvtime.fc |    6 ++----
 policy/modules/contrib/tvtime.if |   26 ++++++++++++--------------
 policy/modules/contrib/tvtime.te |   20 ++++++++++----------
 3 files changed, 24 insertions(+), 28 deletions(-)

diff --git a/policy/modules/contrib/tvtime.fc b/policy/modules/contrib/tvtime.fc
index 3b0e6ce..92cb760 100644
--- a/policy/modules/contrib/tvtime.fc
+++ b/policy/modules/contrib/tvtime.fc
@@ -1,5 +1,3 @@
-#
-# /usr
-#
-/usr/bin/tvtime	--	gen_context(system_u:object_r:tvtime_exec_t,s0)
+HOME_DIR/\.tvtime(/.*)?	gen_context(system_u:object_r:tvtime_home_t,s0)
 
+/usr/bin/tvtime	--	gen_context(system_u:object_r:tvtime_exec_t,s0)

diff --git a/policy/modules/contrib/tvtime.if b/policy/modules/contrib/tvtime.if
index 8d89f21..1bb0f7c 100644
--- a/policy/modules/contrib/tvtime.if
+++ b/policy/modules/contrib/tvtime.if
@@ -1,4 +1,4 @@
-## <summary> tvtime - a high quality television application </summary>
+## <summary>High quality television application.</summary>
 
 ########################################
 ## <summary>
@@ -17,24 +17,22 @@
 #
 interface(`tvtime_role',`
 	gen_require(`
-		type tvtime_t, tvtime_exec_t;
+		attribute_role tvtime_roles;
+		type tvtime_t, tvtime_exec_t, tvtime_tmp_t;
 		type tvtime_home_t, tvtime_tmpfs_t;
 	')
 
-	role $1 types tvtime_t;
+	roleattribute $1 tvtime_roles;
 
-	# Type transition
 	domtrans_pattern($2, tvtime_exec_t, tvtime_t)
 
-	# X access, Home files
-	manage_dirs_pattern($2, tvtime_home_t, tvtime_home_t)
-	manage_files_pattern($2, tvtime_home_t, tvtime_home_t)
-	manage_lnk_files_pattern($2, tvtime_home_t, tvtime_home_t)
-	relabel_dirs_pattern($2, tvtime_home_t, tvtime_home_t)
-	relabel_files_pattern($2, tvtime_home_t, tvtime_home_t)
-	relabel_lnk_files_pattern($2, tvtime_home_t, tvtime_home_t)
-
-	# Allow the user domain to signal/ps.
 	ps_process_pattern($2, tvtime_t)
-	allow $2 tvtime_t:process signal_perms;
+	allow $2 tvtime_t:process { ptrace signal_perms };
+
+	allow $2 { tvtime_home_t tvtime_tmp_t }:dir { manage_dir_perms relabel_dir_perms };
+	allow $2 { tvtime_home_t tvtime_tmpfs_t tvtime_tmp_t }:file { manage_file_perms relabel_file_perms };
+	allow $2 { tvtime_home_t tvtime_tmpfs_t }:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
+	allow $2 tvtime_tmpfs_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
+	allow $2 tvtime_tmpfs_t:sock_file { manage_sock_file_perms relabel_sock_file_perms };
+	userdom_user_home_dir_filetrans($2, tvtime_home_t, dir, ".tvtime")
 ')

diff --git a/policy/modules/contrib/tvtime.te b/policy/modules/contrib/tvtime.te
index 531b1f1..3292fcc 100644
--- a/policy/modules/contrib/tvtime.te
+++ b/policy/modules/contrib/tvtime.te
@@ -1,15 +1,18 @@
-policy_module(tvtime, 2.2.0)
+policy_module(tvtime, 2.2.1)
 
 ########################################
 #
 # Declarations
 #
 
+attribute_role tvtime_roles;
+
 type tvtime_t;
 type tvtime_exec_t;
 typealias tvtime_t alias { user_tvtime_t staff_tvtime_t sysadm_tvtime_t };
 typealias tvtime_t alias { auditadm_tvtime_t secadm_tvtime_t };
 userdom_user_application_domain(tvtime_t, tvtime_exec_t)
+role tvtime_roles types tvtime_t;
 
 type tvtime_home_t alias tvtime_rw_t;
 typealias tvtime_home_t alias { user_tvtime_home_t staff_tvtime_home_t sysadm_tvtime_home_t };
@@ -36,7 +39,6 @@ allow tvtime_t self:process setsched;
 allow tvtime_t self:unix_dgram_socket rw_socket_perms;
 allow tvtime_t self:unix_stream_socket rw_stream_socket_perms;
 
-# X access, Home files
 manage_dirs_pattern(tvtime_t, tvtime_home_t, tvtime_home_t)
 manage_files_pattern(tvtime_t, tvtime_home_t, tvtime_home_t)
 manage_lnk_files_pattern(tvtime_t, tvtime_home_t, tvtime_home_t)
@@ -55,30 +57,28 @@ fs_tmpfs_filetrans(tvtime_t, tvtime_tmpfs_t,{ file lnk_file sock_file fifo_file
 kernel_read_all_sysctls(tvtime_t)
 kernel_get_sysvipc_info(tvtime_t)
 
-dev_read_urand(tvtime_t)
 dev_read_realtime_clock(tvtime_t)
 dev_read_sound(tvtime_t)
+dev_read_urand(tvtime_t)
 
 files_read_usr_files(tvtime_t)
-files_search_pids(tvtime_t)
-# Read /etc/tvtime
-files_read_etc_files(tvtime_t)
 
-# X access, Home files
+fs_getattr_all_fs(tvtime_t)
 fs_search_auto_mountpoints(tvtime_t)
 
-miscfiles_read_localization(tvtime_t)
+auth_use_nsswitch(tvtime_t)
+
 miscfiles_read_fonts(tvtime_t)
+miscfiles_read_localization(tvtime_t)
 
 userdom_use_user_terminals(tvtime_t)
-userdom_read_user_home_content_files(tvtime_t)
 
-# X access, Home files
 tunable_policy(`use_nfs_home_dirs',`
 	fs_manage_nfs_dirs(tvtime_t)
 	fs_manage_nfs_files(tvtime_t)
 	fs_manage_nfs_symlinks(tvtime_t)
 ')
+
 tunable_policy(`use_samba_home_dirs',`
 	fs_manage_cifs_dirs(tvtime_t)
 	fs_manage_cifs_files(tvtime_t)