[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     207d42276604017e964696c9e14e52b9d85dd13f
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Sun Oct 28 12:51:21 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sun Oct 28 17:58:50 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=207d4227

Changes to the smokeping policy module

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/smokeping.if |   27 +++++++++++++++++----------
 policy/modules/contrib/smokeping.te |   15 +++++++--------
 2 files changed, 24 insertions(+), 18 deletions(-)

diff --git a/policy/modules/contrib/smokeping.if b/policy/modules/contrib/smokeping.if
index 8265278..1fa51c1 100644
--- a/policy/modules/contrib/smokeping.if
+++ b/policy/modules/contrib/smokeping.if
@@ -15,12 +15,14 @@ interface(`smokeping_domtrans',`
 		type smokeping_t, smokeping_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, smokeping_exec_t, smokeping_t)
 ')
 
 ########################################
 ## <summary>
-##	Execute smokeping server in the smokeping domain.
+##	Execute smokeping init scripts in
+##	the initrc domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -38,7 +40,7 @@ interface(`smokeping_initrc_domtrans',`
 
 ########################################
 ## <summary>
-##	Read smokeping PID files.
+##	Read smokeping pid files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -57,7 +59,8 @@ interface(`smokeping_read_pid_files',`
 
 ########################################
 ## <summary>
-##	Manage smokeping PID files.
+##	Create, read, write, and delete
+##	smokeping pid files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -89,8 +92,8 @@ interface(`smokeping_getattr_lib_files',`
 		type smokeping_var_lib_t;
 	')
 
-	getattr_files_pattern($1, smokeping_var_lib_t, smokeping_var_lib_t)
 	files_search_var_lib($1)
+	getattr_files_pattern($1, smokeping_var_lib_t, smokeping_var_lib_t)
 ')
 
 ########################################
@@ -114,7 +117,8 @@ interface(`smokeping_read_lib_files',`
 
 ########################################
 ## <summary>
-##	Manage smokeping lib files.
+##	Create, read, write, and delete
+##	smokeping lib files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -133,8 +137,8 @@ interface(`smokeping_manage_lib_files',`
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate
-##	a smokeping environment
+##	All of the rules required to
+##	administrate a smokeping environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -150,7 +154,8 @@ interface(`smokeping_manage_lib_files',`
 #
 interface(`smokeping_admin',`
 	gen_require(`
-		type smokeping_t, smokeping_initrc_exec_t;
+		type smokeping_t, smokeping_initrc_exec_t, smokeping_var_lib_t;
+		type smokeping_var_run_t;
 	')
 
 	allow $1 smokeping_t:process { ptrace signal_perms };
@@ -161,7 +166,9 @@ interface(`smokeping_admin',`
 	role_transition $2 smokeping_initrc_exec_t system_r;
 	allow $2 system_r;
 
-	smokeping_manage_pid_files($1)
+	files_search_var_lib($1)
+	admin_pattern($1, smokeping_var_lib_t)
 
-	smokeping_manage_lib_files($1)
+	files_search_pids($1)
+	admin_pattern($1, smokeping_var_run_t)
 ')

diff --git a/policy/modules/contrib/smokeping.te b/policy/modules/contrib/smokeping.te
index 1b6f29d..a8b1aaf 100644
--- a/policy/modules/contrib/smokeping.te
+++ b/policy/modules/contrib/smokeping.te
@@ -1,4 +1,4 @@
-policy_module(smokeping, 1.1.1)
+policy_module(smokeping, 1.1.2)
 
 ########################################
 #
@@ -20,13 +20,12 @@ files_type(smokeping_var_lib_t)
 
 ########################################
 #
-# smokeping local policy
+# Local policy
 #
 
 dontaudit smokeping_t self:capability { dac_read_search dac_override };
 allow smokeping_t self:fifo_file rw_fifo_file_perms;
-allow smokeping_t self:udp_socket create_socket_perms;
-allow smokeping_t self:unix_stream_socket create_stream_socket_perms;
+allow smokeping_t self:unix_stream_socket { accept listen };
 
 manage_dirs_pattern(smokeping_t, smokeping_var_run_t, smokeping_var_run_t)
 manage_files_pattern(smokeping_t, smokeping_var_run_t, smokeping_var_run_t)
@@ -34,13 +33,12 @@ files_pid_filetrans(smokeping_t, smokeping_var_run_t, { file dir })
 
 manage_dirs_pattern(smokeping_t, smokeping_var_lib_t, smokeping_var_lib_t)
 manage_files_pattern(smokeping_t, smokeping_var_lib_t, smokeping_var_lib_t)
-files_var_lib_filetrans(smokeping_t, smokeping_var_lib_t, { file dir } )
+files_var_lib_filetrans(smokeping_t, smokeping_var_lib_t, { file dir })
 
-corecmd_read_bin_symlinks(smokeping_t)
+corecmd_exec_bin(smokeping_t)
 
 dev_read_urand(smokeping_t)
 
-files_read_etc_files(smokeping_t)
 files_read_usr_files(smokeping_t)
 files_search_tmp(smokeping_t)
 
@@ -57,7 +55,7 @@ netutils_domtrans_ping(smokeping_t)
 
 #######################################
 #
-# local policy for smokeping cgi scripts
+# Cgi local policy
 #
 
 optional_policy(`
@@ -68,6 +66,7 @@ optional_policy(`
 
 	getattr_files_pattern(httpd_smokeping_cgi_script_t, smokeping_var_run_t, smokeping_var_run_t)
 
+	files_read_etc_files(httpd_smokeping_cgi_script_t)
 	files_search_tmp(httpd_smokeping_cgi_script_t)
 	files_search_var_lib(httpd_smokeping_cgi_script_t)