[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     2d4b142e3ed58a18d2a7bb9301bbc35aab2982a1
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Wed Oct 31 09:23:34 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Wed Oct 31 18:04:28 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=2d4b142e

Changes to the vpnc policy module

Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/vpn.fc |    6 -----
 policy/modules/contrib/vpn.if |   18 +++++++++-------
 policy/modules/contrib/vpn.te |   44 +++++++++++++++++++++++-----------------
 3 files changed, 35 insertions(+), 33 deletions(-)

diff --git a/policy/modules/contrib/vpn.fc b/policy/modules/contrib/vpn.fc
index 5e3cc6e..524ac2f 100644
--- a/policy/modules/contrib/vpn.fc
+++ b/policy/modules/contrib/vpn.fc
@@ -1,11 +1,5 @@
-#
-# sbin
-#
 /sbin/vpnc	--	gen_context(system_u:object_r:vpnc_exec_t,s0)
 
-#
-# /usr
-#
 /usr/bin/openconnect	--	gen_context(system_u:object_r:vpnc_exec_t,s0)
 
 /usr/sbin/vpnc	--	gen_context(system_u:object_r:vpnc_exec_t,s0)

diff --git a/policy/modules/contrib/vpn.if b/policy/modules/contrib/vpn.if
index 7b93e07..7a7f342 100644
--- a/policy/modules/contrib/vpn.if
+++ b/policy/modules/contrib/vpn.if
@@ -1,8 +1,8 @@
-## <summary>Virtual Private Networking client</summary>
+## <summary>Virtual Private Networking client.</summary>
 
 ########################################
 ## <summary>
-##	Execute VPN clients in the vpnc domain.
+##	Execute vpn clients in the vpnc domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -15,13 +15,15 @@ interface(`vpn_domtrans',`
 		type vpnc_t, vpnc_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, vpnc_exec_t, vpnc_t)
 ')
 
 ########################################
 ## <summary>
-##	Execute VPN clients in the vpnc domain, and
-##	allow the specified role the vpnc domain.
+##	Execute vpn clients in the vpnc
+##	domain, and allow the specified
+##	role the vpnc domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -46,7 +48,7 @@ interface(`vpn_run',`
 
 ########################################
 ## <summary>
-##	Send VPN clients the kill signal.
+##	Send kill signals to vpnc.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -64,7 +66,7 @@ interface(`vpn_kill',`
 
 ########################################
 ## <summary>
-##	Send generic signals to VPN clients.
+##	Send generic signals to vpnc.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -82,7 +84,7 @@ interface(`vpn_signal',`
 
 ########################################
 ## <summary>
-##	Send signull to VPN clients.
+##	Send null signals to vpnc.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -101,7 +103,7 @@ interface(`vpn_signull',`
 ########################################
 ## <summary>
 ##	Send and receive messages from
-##	Vpnc over dbus.
+##	vpnc over dbus.
 ## </summary>
 ## <param name="domain">
 ##	<summary>

diff --git a/policy/modules/contrib/vpn.te b/policy/modules/contrib/vpn.te
index 83a80ba..9329eae 100644
--- a/policy/modules/contrib/vpn.te
+++ b/policy/modules/contrib/vpn.te
@@ -1,4 +1,4 @@
-policy_module(vpn, 1.15.0)
+policy_module(vpn, 1.15.1)
 
 ########################################
 #
@@ -6,10 +6,10 @@ policy_module(vpn, 1.15.0)
 #
 
 attribute_role vpnc_roles;
-roleattribute system_r vpnc_roles;
 
 type vpnc_t;
 type vpnc_exec_t;
+init_system_domain(vpnc_t, vpnc_exec_t)
 application_domain(vpnc_t, vpnc_exec_t)
 role vpnc_roles types vpnc_t;
 
@@ -24,17 +24,13 @@ files_pid_file(vpnc_var_run_t)
 # Local policy
 #
 
-allow vpnc_t self:capability { dac_read_search dac_override net_admin ipc_lock net_raw };
+allow vpnc_t self:capability { dac_read_search dac_override net_admin ipc_lock net_raw setuid };
 allow vpnc_t self:process { getsched signal };
 allow vpnc_t self:fifo_file rw_fifo_file_perms;
 allow vpnc_t self:netlink_route_socket rw_netlink_socket_perms;
-allow vpnc_t self:tcp_socket create_stream_socket_perms;
-allow vpnc_t self:udp_socket create_socket_perms;
+allow vpnc_t self:tcp_socket { accept listen };
 allow vpnc_t self:rawip_socket create_socket_perms;
-allow vpnc_t self:unix_dgram_socket create_socket_perms;
-allow vpnc_t self:unix_stream_socket create_socket_perms;
 allow vpnc_t self:tun_socket { create_socket_perms relabelfrom };
-# cjp: this needs to be fixed
 allow vpnc_t self:socket create_socket_perms;
 
 manage_dirs_pattern(vpnc_t, vpnc_tmp_t, vpnc_tmp_t)
@@ -62,36 +58,43 @@ corenet_raw_sendrecv_generic_node(vpnc_t)
 corenet_tcp_sendrecv_all_ports(vpnc_t)
 corenet_udp_sendrecv_all_ports(vpnc_t)
 corenet_udp_bind_generic_node(vpnc_t)
+
+corenet_sendrecv_all_server_packets(vpnc_t)
 corenet_udp_bind_generic_port(vpnc_t)
+
+corenet_sendrecv_isakmp_server_packets(vpnc_t)
 corenet_udp_bind_isakmp_port(vpnc_t)
+
+corenet_sendrecv_generic_server_packets(vpnc_t)
 corenet_udp_bind_ipsecnat_port(vpnc_t)
-corenet_tcp_connect_all_ports(vpnc_t)
+
 corenet_sendrecv_all_client_packets(vpnc_t)
-corenet_sendrecv_isakmp_server_packets(vpnc_t)
-corenet_sendrecv_generic_server_packets(vpnc_t)
+corenet_tcp_connect_all_ports(vpnc_t)
+
 corenet_rw_tun_tap_dev(vpnc_t)
 
+corecmd_exec_all_executables(vpnc_t)
+
 dev_read_rand(vpnc_t)
 dev_read_urand(vpnc_t)
 dev_read_sysfs(vpnc_t)
 
 domain_use_interactive_fds(vpnc_t)
 
+files_exec_etc_files(vpnc_t)
+files_read_etc_runtime_files(vpnc_t)
+files_dontaudit_search_home(vpnc_t)
+
 fs_getattr_xattr_fs(vpnc_t)
 fs_getattr_tmpfs(vpnc_t)
 
 term_use_all_ptys(vpnc_t)
 term_use_all_ttys(vpnc_t)
 
-corecmd_exec_all_executables(vpnc_t)
-
-files_exec_etc_files(vpnc_t)
-files_read_etc_runtime_files(vpnc_t)
-files_read_etc_files(vpnc_t)
-files_dontaudit_search_home(vpnc_t)
-
 auth_use_nsswitch(vpnc_t)
 
+init_dontaudit_use_fds(vpnc_t)
+
 libs_exec_ld_so(vpnc_t)
 libs_exec_lib_files(vpnc_t)
 
@@ -103,7 +106,6 @@ logging_dontaudit_search_logs(vpnc_t)
 miscfiles_read_localization(vpnc_t)
 
 seutil_dontaudit_search_config(vpnc_t)
-seutil_use_newrole_fds(vpnc_t)
 
 sysnet_run_ifconfig(vpnc_t, vpnc_roles)
 sysnet_etc_filetrans_config(vpnc_t)
@@ -123,3 +125,7 @@ optional_policy(`
 optional_policy(`
 	networkmanager_attach_tun_iface(vpnc_t)
 ')
+
+optional_policy(`
+	seutil_use_newrole_fds(vpnc_t)
+')