[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     82b12f62f20f15f66de9c3ce3853b46349151992
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Tue Sep 25 13:55:55 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Sep 27 17:54:47 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=82b12f62

Changes to the cron policy module and relevant dependencies

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>
Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

---
 policy/modules/contrib/cron.te |   55 ++++++++++++++++++++++++++++-----------
 1 files changed, 39 insertions(+), 16 deletions(-)

diff --git a/policy/modules/contrib/cron.te b/policy/modules/contrib/cron.te
index c48cc70..412d5fb 100644
--- a/policy/modules/contrib/cron.te
+++ b/policy/modules/contrib/cron.te
@@ -96,12 +96,12 @@ typealias crontab_tmp_t alias { auditadm_crontab_tmp_t secadm_crontab_tmp_t };
 
 type system_cron_spool_t, cron_spool_type;
 files_type(system_cron_spool_t)
+mta_system_content(system_cron_spool_t)
 
 type system_cronjob_t alias system_crond_t;
 init_daemon_domain(system_cronjob_t, anacron_exec_t)
 corecmd_shell_entry_type(system_cronjob_t)
 domain_interactive_fd(system_cronjob_t)
-role system_r types system_cronjob_t;
 
 type system_cronjob_lock_t alias system_crond_lock_t;
 files_lock_file(system_cronjob_lock_t)
@@ -366,6 +366,27 @@ optional_policy(`
 ')
 
 optional_policy(`
+	apache_search_sys_content(crond_t)
+')
+
+optional_policy(`
+	dbus_system_bus_client(crond_t)
+
+	optional_policy(`
+		hal_dbus_chat(crond_t)
+	')
+
+	optional_policy(`
+		unconfined_dbus_send(crond_t)
+	')
+')
+
+optional_policy(`
+	djbdns_search_tinydns_keys(crond_t)
+	djbdns_link_tinydns_keys(crond_t)
+')
+
+optional_policy(`
 	locallogin_search_keys(crond_t)
 	locallogin_link_keys(crond_t)
 ')
@@ -554,6 +575,18 @@ optional_policy(`
 ')
 
 optional_policy(`
+	dbus_system_bus_client(system_cronjob_t)
+
+	optional_policy(`
+		networkmanager_dbus_chat(system_cronjob_t)
+	')
+')
+
+optional_policy(`
+	exim_read_spool_files(system_cronjob_t)
+')
+
+optional_policy(`
 	ftp_read_log(system_cronjob_t)
 ')
 
@@ -568,6 +601,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	livecd_read_tmp_files(system_cronjob_t)
+')
+
+optional_policy(`
 	lpd_list_spool(system_cronjob_t)
 ')
 
@@ -627,23 +664,9 @@ allow cronjob_t self:fifo_file rw_fifo_file_perms;
 allow cronjob_t self:unix_stream_socket create_stream_socket_perms;
 allow cronjob_t self:unix_dgram_socket create_socket_perms;
 
-# The entrypoint interface is not used as this is not
-# a regular entrypoint.  Since crontab files are
-# not directly executed, crond must ensure that
-# the crontab file has a type that is appropriate
-# for the domain of the user cron job.  It
-# performs an entrypoint permission check
-# for this purpose.
 allow cronjob_t user_cron_spool_t:file entrypoint;
 
-# Permit a transition from the crond_t domain to this domain.
-# The transition is requested explicitly by the modified crond 
-# via setexeccon.  There is no way to set up an automatic
-# transition, since crontabs are configuration files, not executables.
-allow crond_t cronjob_t:process transition;
-dontaudit crond_t cronjob_t:process { noatsecure siginh rlimitinh };
-allow crond_t cronjob_t:fd use;
-allow crond_t cronjob_t:key create;
+#allow crond_t cronjob_t:key create;
 allow cronjob_t crond_t:fd use;
 allow cronjob_t crond_t:fifo_file rw_file_perms;
 allow cronjob_t crond_t:process sigchld;