[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     35a8e7e6fe55cadb8bb8d163e9beb2c69e4e534b
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Wed Sep 25 15:44:30 2013 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Mon Sep 30 19:00:52 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=35a8e7e6

apt: As it turns out the /var/backups directory is labeled in the backup module (which i incidentally did not have installed earlier). Instead of creating this file with a file type transition to apt_var_cache_t, allow apt_t to manage backup_store files

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/apt.fc    |  2 --
 policy/modules/contrib/apt.te    |  6 +++++-
 policy/modules/contrib/backup.if | 20 ++++++++++++++++++++
 policy/modules/contrib/backup.te |  2 +-
 4 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/policy/modules/contrib/apt.fc b/policy/modules/contrib/apt.fc
index edb4fd4..7b20801 100644
--- a/policy/modules/contrib/apt.fc
+++ b/policy/modules/contrib/apt.fc
@@ -10,8 +10,6 @@ ifndef(`distro_redhat',`
 /var/lib/PackageKit(/.*)?	gen_context(system_u:object_r:apt_var_lib_t,s0)
 ')
 
-/var/backups/dpkg.*	--	gen_context(system_u:object_r:apt_var_cache_t,s0)
-
 /var/cache/apt(/.*)?	gen_context(system_u:object_r:apt_var_cache_t,s0)
 
 /var/lib/apt(/.*)?	gen_context(system_u:object_r:apt_var_lib_t,s0)

diff --git a/policy/modules/contrib/apt.te b/policy/modules/contrib/apt.te
index 90c630d..e423967 100644
--- a/policy/modules/contrib/apt.te
+++ b/policy/modules/contrib/apt.te
@@ -1,4 +1,4 @@
-policy_module(apt, 1.8.0)
+policy_module(apt, 1.8.1)
 
 ########################################
 #
@@ -121,6 +121,10 @@ sysnet_read_config(apt_t)
 userdom_use_user_terminals(apt_t)
 
 optional_policy(`
+	backup_manage_store_files(apt_t)
+')
+
+optional_policy(`
 	cron_system_entry(apt_t, apt_exec_t)
 ')
 

diff --git a/policy/modules/contrib/backup.if b/policy/modules/contrib/backup.if
index 894810e..fe3f740 100644
--- a/policy/modules/contrib/backup.if
+++ b/policy/modules/contrib/backup.if
@@ -45,3 +45,23 @@ interface(`backup_run',`
 	backup_domtrans($1)
 	roleattribute $2 backup_roles;
 ')
+
+########################################
+## <summary>
+##	Create, read, and write backup
+##	store files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`backup_manage_store_files',`
+	gen_require(`
+		type backup_store_t;
+	')
+
+	files_search_var($1)
+	manage_files_pattern($1, backup_store_t, backup_store_t)
+')

diff --git a/policy/modules/contrib/backup.te b/policy/modules/contrib/backup.te
index b9f8b55..1bb1e7f 100644
--- a/policy/modules/contrib/backup.te
+++ b/policy/modules/contrib/backup.te
@@ -1,4 +1,4 @@
-policy_module(backup, 1.6.0)
+policy_module(backup, 1.6.1)
 
 ########################################
 #