[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     230f3c1f0daf0682377820e7e50cc25c1178fbca
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Sat Sep 29 09:43:30 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Oct  2 18:04:12 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=230f3c1f

Changes to the dpkg policy module

Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/dpkg.fc |   11 +++-----
 policy/modules/contrib/dpkg.if |   31 ++++++++++++-----------
 policy/modules/contrib/dpkg.te |   53 +++++++++++++---------------------------
 3 files changed, 37 insertions(+), 58 deletions(-)

diff --git a/policy/modules/contrib/dpkg.fc b/policy/modules/contrib/dpkg.fc
index 6d0f9ee..751c251 100644
--- a/policy/modules/contrib/dpkg.fc
+++ b/policy/modules/contrib/dpkg.fc
@@ -1,11 +1,8 @@
-# Debian package manager
-/usr/bin/debsums		--	gen_context(system_u:object_r:dpkg_exec_t,s0)
-/usr/bin/dpkg			--	gen_context(system_u:object_r:dpkg_exec_t,s0)
-# not sure if dselect should be in apt instead?
-/usr/bin/dselect		--	gen_context(system_u:object_r:dpkg_exec_t,s0)
+/usr/bin/debsums	--	gen_context(system_u:object_r:dpkg_exec_t,s0)
+/usr/bin/dpkg	--	gen_context(system_u:object_r:dpkg_exec_t,s0)
+/usr/bin/dselect	--	gen_context(system_u:object_r:dpkg_exec_t,s0)
 
-/var/lib/dpkg(/.*)?			gen_context(system_u:object_r:dpkg_var_lib_t,s0)
-# lockfile is treated specially, since used by apt, too
+/var/lib/dpkg(/.*)?	gen_context(system_u:object_r:dpkg_var_lib_t,s0)
 /var/lib/dpkg/(meth)?lock	--	gen_context(system_u:object_r:dpkg_lock_t,s0)
 
 /usr/sbin/dpkg-preconfigure	--	gen_context(system_u:object_r:dpkg_exec_t,s0)

diff --git a/policy/modules/contrib/dpkg.if b/policy/modules/contrib/dpkg.if
index 4d32b42..9aa68a6 100644
--- a/policy/modules/contrib/dpkg.if
+++ b/policy/modules/contrib/dpkg.if
@@ -1,6 +1,4 @@
-## <summary>Policy for the Debian package manager.</summary>
-# TODO: need debconf policy
-# TODO: need install-menu policy
+## <summary>Debian package manager.</summary>
 
 ########################################
 ## <summary>
@@ -17,14 +15,14 @@ interface(`dpkg_domtrans',`
 		type dpkg_t, dpkg_exec_t;
 	')
 
-	files_search_usr($1)
 	corecmd_search_bin($1)
 	domtrans_pattern($1, dpkg_exec_t, dpkg_t)
 ')
 
 ########################################
 ## <summary>
-##	Execute dpkg_script programs in the dpkg_script domain.
+##	Execute dpkg_script programs in
+##	the dpkg_script domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -37,7 +35,6 @@ interface(`dpkg_domtrans_script',`
 		type dpkg_script_t;
 	')
 
-	# transition to dpkg script:
 	corecmd_shell_domtrans($1, dpkg_script_t)
 	allow dpkg_script_t $1:fd use;
 	allow dpkg_script_t $1:fifo_file rw_file_perms;
@@ -55,7 +52,7 @@ interface(`dpkg_domtrans_script',`
 ## </param>
 ## <param name="role">
 ##	<summary>
-##	The role to allow the dpkg domain.
+##	Role allowed access.
 ##	</summary>
 ## </param>
 ## <rolecap/>
@@ -89,7 +86,7 @@ interface(`dpkg_use_fds',`
 
 ########################################
 ## <summary>
-##	Read from an unnamed dpkg pipe.
+##	Read from unnamed dpkg pipes.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -107,7 +104,7 @@ interface(`dpkg_read_pipes',`
 
 ########################################
 ## <summary>
-##	Read and write an unnamed dpkg pipe.
+##	Read and write unnamed dpkg pipes.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -125,7 +122,8 @@ interface(`dpkg_rw_pipes',`
 
 ########################################
 ## <summary>
-##	Inherit and use file descriptors from dpkg scripts.
+##	Inherit and use file descriptors
+##	from dpkg scripts.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -143,7 +141,7 @@ interface(`dpkg_use_script_fds',`
 
 ########################################
 ## <summary>
-##	Read the dpkg package database.
+##	Read dpkg package database content.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -164,7 +162,8 @@ interface(`dpkg_read_db',`
 
 ########################################
 ## <summary>
-##	Create, read, write, and delete the dpkg package database.
+##	Create, read, write, and delete
+##	dpkg package database content.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -184,8 +183,9 @@ interface(`dpkg_manage_db',`
 
 ########################################
 ## <summary>
-##	Do not audit attempts to create, read, 
-##	write, and delete the dpkg package database.
+##	Do not audit attempts to create,
+##	read, write, and delete dpkg
+##	package database content.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -205,7 +205,8 @@ interface(`dpkg_dontaudit_manage_db',`
 
 ########################################
 ## <summary>
-##	Lock the dpkg package database.
+##	Create, read, write, and delete
+##	dpkg lock files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>

diff --git a/policy/modules/contrib/dpkg.te b/policy/modules/contrib/dpkg.te
index 52725c4..998d765 100644
--- a/policy/modules/contrib/dpkg.te
+++ b/policy/modules/contrib/dpkg.te
@@ -10,18 +10,15 @@ roleattribute system_r dpkg_roles;
 
 type dpkg_t;
 type dpkg_exec_t;
-# dpkg can start/stop services
 init_system_domain(dpkg_t, dpkg_exec_t)
-# dpkg can change file labels, roles, IO
 domain_obj_id_change_exemption(dpkg_t)
 domain_role_change_exemption(dpkg_t)
 domain_system_change_exemption(dpkg_t)
 domain_interactive_fd(dpkg_t)
 role dpkg_roles types dpkg_t;
 
-# lockfile
 type dpkg_lock_t;
-files_type(dpkg_lock_t)
+files_lock_file(dpkg_lock_t)
 
 type dpkg_tmp_t;
 files_tmp_file(dpkg_tmp_t)
@@ -29,11 +26,9 @@ files_tmp_file(dpkg_tmp_t)
 type dpkg_tmpfs_t;
 files_tmpfs_file(dpkg_tmpfs_t)
 
-# status files
 type dpkg_var_lib_t alias var_lib_dpkg_t;
 files_type(dpkg_var_lib_t)
 
-# package scripts
 type dpkg_script_t;
 domain_type(dpkg_script_t)
 domain_entry_file(dpkg_t, dpkg_var_lib_t)
@@ -51,7 +46,7 @@ files_tmpfs_file(dpkg_script_tmpfs_t)
 
 ########################################
 #
-# dpkg Local policy
+# Local policy
 #
 
 allow dpkg_t self:capability { chown dac_override fowner fsetid setgid setuid kill sys_tty_config sys_nice sys_resource mknod linux_immutable };
@@ -82,7 +77,7 @@ manage_sock_files_pattern(dpkg_t, dpkg_tmpfs_t, dpkg_tmpfs_t)
 manage_fifo_files_pattern(dpkg_t, dpkg_tmpfs_t, dpkg_tmpfs_t)
 fs_tmpfs_filetrans(dpkg_t, dpkg_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 
-# Access /var/lib/dpkg files
+allow dpkg_t dpkg_var_lib_t:file mmap_file_perms;
 manage_files_pattern(dpkg_t, dpkg_var_lib_t, dpkg_var_lib_t)
 files_var_lib_filetrans(dpkg_t, dpkg_var_lib_t, dir)
 
@@ -91,24 +86,18 @@ kernel_read_kernel_sysctls(dpkg_t)
 
 corecmd_exec_all_executables(dpkg_t)
 
-# TODO: do we really need all networking?
 corenet_all_recvfrom_unlabeled(dpkg_t)
 corenet_all_recvfrom_netlabel(dpkg_t)
 corenet_tcp_sendrecv_generic_if(dpkg_t)
-corenet_raw_sendrecv_generic_if(dpkg_t)
-corenet_udp_sendrecv_generic_if(dpkg_t)
 corenet_tcp_sendrecv_generic_node(dpkg_t)
-corenet_raw_sendrecv_generic_node(dpkg_t)
-corenet_udp_sendrecv_generic_node(dpkg_t)
 corenet_tcp_sendrecv_all_ports(dpkg_t)
-corenet_udp_sendrecv_all_ports(dpkg_t)
-corenet_tcp_connect_all_ports(dpkg_t)
+
 corenet_sendrecv_all_client_packets(dpkg_t)
+corenet_tcp_connect_all_ports(dpkg_t)
 
 dev_list_sysfs(dpkg_t)
 dev_list_usbfs(dpkg_t)
 dev_read_urand(dpkg_t)
-#devices_manage_all_device_types(dpkg_t)
 
 domain_read_all_domains_state(dpkg_t)
 domain_getattr_all_domains(dpkg_t)
@@ -122,6 +111,10 @@ domain_dontaudit_getattr_all_raw_sockets(dpkg_t)
 domain_dontaudit_getattr_all_stream_sockets(dpkg_t)
 domain_dontaudit_getattr_all_dgram_sockets(dpkg_t)
 
+files_exec_etc_files(dpkg_t)
+files_relabel_non_auth_files(dpkg_t)
+files_manage_non_auth_files(dpkg_t)
+
 fs_manage_nfs_dirs(dpkg_t)
 fs_manage_nfs_files(dpkg_t)
 fs_manage_nfs_symlinks(dpkg_t)
@@ -140,15 +133,10 @@ selinux_compute_relabel_context(dpkg_t)
 selinux_compute_user_contexts(dpkg_t)
 
 storage_raw_write_fixed_disk(dpkg_t)
-# for installing kernel packages
 storage_raw_read_fixed_disk(dpkg_t)
 
-files_relabel_non_auth_files(dpkg_t)
-files_manage_non_auth_files(dpkg_t)
 auth_dontaudit_read_shadow(dpkg_t)
 
-files_exec_etc_files(dpkg_t)
-
 init_domtrans_script(dpkg_t)
 init_use_script_ptys(dpkg_t)
 
@@ -158,7 +146,6 @@ libs_run_ldconfig(dpkg_t, dpkg_roles)
 
 logging_send_syslog_msg(dpkg_t)
 
-# allow compiling and loading new policy
 seutil_manage_src_policy(dpkg_t)
 seutil_manage_bin_policy(dpkg_t)
 
@@ -167,19 +154,15 @@ sysnet_read_config(dpkg_t)
 userdom_use_user_terminals(dpkg_t)
 userdom_use_unpriv_users_fds(dpkg_t)
 
-# transition to dpkg script:
 dpkg_domtrans_script(dpkg_t)
-# since the scripts aren't labeled correctly yet...
-allow dpkg_t dpkg_var_lib_t:file mmap_file_perms;
 
 optional_policy(`
 	apt_use_ptys(dpkg_t)
 ')
 
-# TODO: allow?
-#optional_policy(`
-#	cron_system_entry(dpkg_t,dpkg_exec_t)
-#')
+optional_policy(`
+	cron_system_entry(dpkg_t, dpkg_exec_t)
+')
 
 optional_policy(`
 	nis_use_ypbind(dpkg_t)
@@ -201,6 +184,7 @@ modutils_run_insmod(dpkg_t, dpkg_roles)
 seutil_run_loadpolicy(dpkg_t, dpkg_roles)
 seutil_run_setfiles(dpkg_t, dpkg_roles)
 userdom_use_all_users_fds(dpkg_t)
+
 optional_policy(`
 	mta_send_mail(dpkg_t)
 ')
@@ -211,9 +195,8 @@ optional_policy(`
 
 ########################################
 #
-# dpkg-script Local policy
+# Script Local policy
 #
-# TODO: actually use dpkg_script_t
 
 allow dpkg_script_t self:capability { chown dac_override dac_read_search fowner fsetid setgid setuid ipc_lock sys_chroot sys_nice mknod kill };
 allow dpkg_script_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
@@ -247,9 +230,9 @@ kernel_read_system_state(dpkg_script_t)
 corecmd_exec_all_executables(dpkg_script_t)
 
 dev_list_sysfs(dpkg_script_t)
-# ideally we would not need this
-dev_manage_generic_blk_files(dpkg_script_t)
-dev_manage_generic_chr_files(dpkg_script_t)
+# Use named file transition to fix this
+# dev_manage_generic_blk_files(dpkg_script_t)
+# dev_manage_generic_chr_files(dpkg_script_t)
 dev_manage_all_blk_files(dpkg_script_t)
 dev_manage_all_chr_files(dpkg_script_t)
 
@@ -266,7 +249,6 @@ files_exec_usr_files(dpkg_script_t)
 
 fs_manage_nfs_files(dpkg_script_t)
 fs_getattr_nfs(dpkg_script_t)
-# why is this not using mount?
 fs_getattr_xattr_fs(dpkg_script_t)
 fs_mount_xattr_fs(dpkg_script_t)
 fs_unmount_xattr_fs(dpkg_script_t)
@@ -288,7 +270,6 @@ storage_raw_write_fixed_disk(dpkg_script_t)
 term_use_all_terms(dpkg_script_t)
 
 auth_dontaudit_getattr_shadow(dpkg_script_t)
-# ideally we would not need this
 files_manage_non_auth_files(dpkg_script_t)
 
 init_domtrans_script(dpkg_script_t)