[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     14ebc8703efb69f1e2c600e447767aa5db600657
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Tue Oct 30 09:35:51 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Oct 30 18:32:53 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=14ebc870

Changes to the tripwire policy module

Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/tripwire.fc |    1 -
 policy/modules/contrib/tripwire.if |   55 ++++++++++++++++-------------------
 policy/modules/contrib/tripwire.te |   47 ++++++++++++++++++------------
 3 files changed, 53 insertions(+), 50 deletions(-)

diff --git a/policy/modules/contrib/tripwire.fc b/policy/modules/contrib/tripwire.fc
index 20978f1..a27298b 100644
--- a/policy/modules/contrib/tripwire.fc
+++ b/policy/modules/contrib/tripwire.fc
@@ -1,4 +1,3 @@
-
 /etc/tripwire(/.*)?	gen_context(system_u:object_r:tripwire_etc_t,s0)
 
 /usr/sbin/siggen	--	gen_context(system_u:object_r:siggen_exec_t,s0)

diff --git a/policy/modules/contrib/tripwire.if b/policy/modules/contrib/tripwire.if
index 27abd88..a3a4d91 100644
--- a/policy/modules/contrib/tripwire.if
+++ b/policy/modules/contrib/tripwire.if
@@ -1,17 +1,4 @@
-## <summary>Tripwire file integrity checker.</summary>
-## <desc>
-##	<p>
-##	Tripwire file integrity checker.
-##	</p>
-##	<p>
-##	NOTE: Tripwire creates temp file in its current working directory.
-##	This policy does not allow write access to home directories, so
-##	users will need to either cd to a directory where they have write
-##	permission, or set the TEMPDIRECTORY variable in the tripwire config
-##	file.  The latter is preferable, as then the file_type_auto_trans
-##	rules will kick in and label the files as private to tripwire.
-##	</p>
-## </desc>
+## <summary>File integrity checker.</summary>
 
 ########################################
 ## <summary>
@@ -28,13 +15,15 @@ interface(`tripwire_domtrans_tripwire',`
 		type tripwire_t, tripwire_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, tripwire_exec_t, tripwire_t)
 ')
 
 ########################################
 ## <summary>
-##	Execute tripwire in the tripwire domain, and
-##	allow the specified role the tripwire domain.
+##	Execute tripwire in the tripwire
+##	domain, and allow the specified
+##	role the tripwire domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -50,11 +39,11 @@ interface(`tripwire_domtrans_tripwire',`
 #
 interface(`tripwire_run_tripwire',`
 	gen_require(`
-		type tripwire_t;
+		attribute_role tripwire_roles;
 	')
 
 	tripwire_domtrans_tripwire($1)
-	role $2 types tripwire_t;
+	roleattribute $2 tripwire_roles;
 ')
 
 ########################################
@@ -72,13 +61,15 @@ interface(`tripwire_domtrans_twadmin',`
 		type twadmin_t, twadmin_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, twadmin_exec_t, twadmin_t)
 ')
 
 ########################################
 ## <summary>
-##	Execute twadmin in the twadmin domain, and
-##	allow the specified role the twadmin domain.
+##	Execute twadmin in the twadmin
+##	domain, and allow the specified
+##	role the twadmin domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -94,11 +85,11 @@ interface(`tripwire_domtrans_twadmin',`
 #
 interface(`tripwire_run_twadmin',`
 	gen_require(`
-		type twadmin_t;
+		attribute_role twadmin_roles;
 	')
 
 	tripwire_domtrans_twadmin($1)
-	role $2 types twadmin_t;
+	roleattribute $2 twadmin_roles;
 ')
 
 ########################################
@@ -116,13 +107,15 @@ interface(`tripwire_domtrans_twprint',`
 		type twprint_t, twprint_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, twprint_exec_t, twprint_t)
 ')
 
 ########################################
 ## <summary>
-##	Execute twprint in the twprint domain, and
-##	allow the specified role the twprint domain.
+##	Execute twprint in the twprint
+##	domain, and allow the specified
+##	role the twprint domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -138,11 +131,11 @@ interface(`tripwire_domtrans_twprint',`
 #
 interface(`tripwire_run_twprint',`
 	gen_require(`
-		type twprint_t;
+		attribute_role twprint_roles;
 	')
 
 	tripwire_domtrans_twprint($1)
-	role $2 types twprint_t;
+	roleattribute $2 twprint_roles;
 ')
 
 ########################################
@@ -160,13 +153,15 @@ interface(`tripwire_domtrans_siggen',`
 		type siggen_t, siggen_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, siggen_exec_t, siggen_t)
 ')
 
 ########################################
 ## <summary>
-##	Execute siggen in the siggen domain, and
-##	allow the specified role the siggen domain.
+##	Execute siggen in the siggen domain,
+##	and allow the specified role
+##	the siggen domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -182,9 +177,9 @@ interface(`tripwire_domtrans_siggen',`
 #
 interface(`tripwire_run_siggen',`
 	gen_require(`
-		type siggen_t;
+		attribute_role siggen_roles;
 	')
 
 	tripwire_domtrans_siggen($1)
-	role $2 types siggen_t;
+	roleattribute $2 siggen_roles;
 ')

diff --git a/policy/modules/contrib/tripwire.te b/policy/modules/contrib/tripwire.te
index 2ae8b62..2e1110d 100644
--- a/policy/modules/contrib/tripwire.te
+++ b/policy/modules/contrib/tripwire.te
@@ -1,18 +1,24 @@
-policy_module(tripwire, 1.2.0)
+policy_module(tripwire, 1.2.1)
 
 ########################################
 #
 # Declarations
 #
 
+attribute_role siggen_roles;
+attribute_role tripwire_roles;
+attribute_role twadmin_roles;
+attribute_role twprint_roles;
+
 type siggen_t;
 type siggen_exec_t;
 application_domain(siggen_t, siggen_exec_t)
+role siggen_roles types siggen_t;
 
 type tripwire_t;
 type tripwire_exec_t;
 application_domain(tripwire_t, tripwire_exec_t)
-role system_r types tripwire_t;
+role tripwire_roles types tripwire_t;
 
 type tripwire_etc_t;
 files_config_file(tripwire_etc_t)
@@ -29,24 +35,24 @@ files_type(tripwire_var_lib_t)
 type twadmin_t;
 type twadmin_exec_t;
 application_domain(twadmin_t, twadmin_exec_t)
+role twadmin_roles types twadmin_t;
 
 type twprint_t;
 type twprint_exec_t;
 application_domain(twprint_t, twprint_exec_t)
+role twprint_roles types twprint_t;
 
 ########################################
 #
-# Tripwire local policy
+# Local policy
 #
 
 allow tripwire_t self:capability { setgid setuid dac_override };
 
 allow tripwire_t tripwire_etc_t:dir list_dir_perms;
-read_files_pattern(tripwire_t, tripwire_etc_t, tripwire_etc_t)
-read_lnk_files_pattern(tripwire_t, tripwire_etc_t, tripwire_etc_t)
-files_search_etc(tripwire_t)
+allow tripwire_t tripwire_etc_t:file read_file_perms;
+allow tripwire_t tripwire_etc_t:lnk_file read_lnk_file_perms;
 
-# Tripwire report files
 manage_dirs_pattern(tripwire_t, tripwire_report_t, tripwire_report_t)
 manage_files_pattern(tripwire_t, tripwire_report_t, tripwire_report_t)
 manage_lnk_files_pattern(tripwire_t, tripwire_report_t, tripwire_report_t)
@@ -68,8 +74,8 @@ kernel_getattr_core_if(tripwire_t)
 kernel_getattr_message_if(tripwire_t)
 kernel_read_kernel_sysctls(tripwire_t)
 
-corecmd_exec_shell(tripwire_t)
 corecmd_exec_bin(tripwire_t)
+corecmd_exec_shell(tripwire_t)
 
 domain_use_interactive_fds(tripwire_t)
 
@@ -91,12 +97,14 @@ optional_policy(`
 # Twadmin local policy
 #
 
-manage_dirs_pattern(twadmin_t, tripwire_etc_t, tripwire_etc_t)
-manage_files_pattern(twadmin_t, tripwire_etc_t, tripwire_etc_t)
-manage_lnk_files_pattern(twadmin_t, tripwire_etc_t, tripwire_etc_t)
+allow twadmin_t tripwire_etc_t:dir list_dir_perms;
+allow twadmin_t tripwire_etc_t:file read_file_perms;
+allow twadmin_t tripwire_etc_t:lnk_file read_lnk_file_perms;
 
 domain_use_interactive_fds(twadmin_t)
 
+files_search_etc(twadmin_t)
+
 logging_send_syslog_msg(twadmin_t)
 
 miscfiles_read_localization(twadmin_t)
@@ -109,20 +117,22 @@ userdom_use_user_terminals(twadmin_t)
 #
 
 allow twprint_t tripwire_etc_t:dir list_dir_perms;
-read_files_pattern(twprint_t, tripwire_etc_t, tripwire_etc_t)
-read_lnk_files_pattern(twprint_t, tripwire_etc_t, tripwire_etc_t)
+allow twprint_t tripwire_etc_t:file read_file_perms;
+allow twprint_t tripwire_etc_t:lnk_file read_lnk_file_perms;
 
 allow twprint_t tripwire_report_t:dir list_dir_perms;
-read_files_pattern(twprint_t, tripwire_report_t, tripwire_report_t)
-read_lnk_files_pattern(twprint_t, tripwire_report_t, tripwire_report_t)
+allow twprint_t tripwire_report_t:file read_file_perms;
+allow twprint_t tripwire_report_t:lnk_file read_lnk_file_perms;
 
 allow twprint_t tripwire_var_lib_t:dir list_dir_perms;
-read_files_pattern(twprint_t, tripwire_var_lib_t, tripwire_var_lib_t)
-read_lnk_files_pattern(twprint_t, tripwire_var_lib_t, tripwire_var_lib_t)
-files_search_var_lib(twprint_t)
+allow twprint_t tripwire_var_lib_t:file read_file_perms;
+allow twprint_t tripwire_var_lib_t:lnk_file read_lnk_file_perms;
 
 domain_use_interactive_fds(twprint_t)
 
+files_search_etc(twprint_t)
+files_search_var_lib(twprint_t)
+
 logging_send_syslog_msg(twprint_t)
 
 miscfiles_read_localization(twprint_t)
@@ -136,7 +146,6 @@ userdom_use_user_terminals(twprint_t)
 
 domain_use_interactive_fds(siggen_t)
 
-# Need permission to read files
 files_read_all_files(siggen_t)
 
 logging_send_syslog_msg(siggen_t)