[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     1bccea5adbd272e37288bd91aef4ff6af0cd6a42
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Fri Nov  2 12:55:01 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Fri Nov  2 19:08:13 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=1bccea5a

Changes to the xguest policy module and relevant dependencies

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/gnomeclock.if |   22 ++++++++
 policy/modules/contrib/gnomeclock.te |    4 +-
 policy/modules/contrib/xguest.if     |    2 +-
 policy/modules/contrib/xguest.te     |   97 +++++++++++++++++++++++++++++----
 4 files changed, 110 insertions(+), 15 deletions(-)

diff --git a/policy/modules/contrib/gnomeclock.if b/policy/modules/contrib/gnomeclock.if
index 788ff46..3f55702 100644
--- a/policy/modules/contrib/gnomeclock.if
+++ b/policy/modules/contrib/gnomeclock.if
@@ -66,3 +66,25 @@ interface(`gnomeclock_dbus_chat',`
 	allow $1 gnomeclock_t:dbus send_msg;
 	allow gnomeclock_t $1:dbus send_msg;
 ')
+
+########################################
+## <summary>
+##	Do not audit attempts to send and
+##	receive messages from gnomeclock
+##	over dbus.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`gnomeclock_dontaudit_dbus_chat',`
+	gen_require(`
+		type gnomeclock_t;
+		class dbus send_msg;
+	')
+
+	dontaudit $1 gnomeclock_t:dbus send_msg;
+	dontaudit gnomeclock_t $1:dbus send_msg;
+')

diff --git a/policy/modules/contrib/gnomeclock.te b/policy/modules/contrib/gnomeclock.te
index 6ba981b..84e5f2f 100644
--- a/policy/modules/contrib/gnomeclock.te
+++ b/policy/modules/contrib/gnomeclock.te
@@ -1,4 +1,4 @@
-policy_module(gnomeclock, 1.0.3)
+policy_module(gnomeclock, 1.0.4)
 
 ########################################
 #
@@ -9,7 +9,7 @@ attribute_role gnomeclock_roles;
 
 type gnomeclock_t;
 type gnomeclock_exec_t;
-init_daemon_domain(gnomeclock_t, gnomeclock_exec_t)
+init_system_domain(gnomeclock_t, gnomeclock_exec_t)
 role gnomeclock_roles types gnomeclock_t;
 
 ########################################

diff --git a/policy/modules/contrib/xguest.if b/policy/modules/contrib/xguest.if
index d2234e3..4f1d07d 100644
--- a/policy/modules/contrib/xguest.if
+++ b/policy/modules/contrib/xguest.if
@@ -1,4 +1,4 @@
-## <summary>Least privledge xwindows user role</summary>
+## <summary>Least privledge xwindows user role.</summary>
 
 ########################################
 ## <summary>

diff --git a/policy/modules/contrib/xguest.te b/policy/modules/contrib/xguest.te
index b885bfc..2882821 100644
--- a/policy/modules/contrib/xguest.te
+++ b/policy/modules/contrib/xguest.te
@@ -1,4 +1,4 @@
-policy_module(xguest, 1.1.1)
+policy_module(xguest, 1.1.2)
 
 ########################################
 #
@@ -6,23 +6,26 @@ policy_module(xguest, 1.1.1)
 #
 
 ## <desc>
-## <p>
-## Allow xguest users to mount removable media
-## </p>
+##	<p>
+##	Determine whether xguest can
+##	mount removable media.
+##	</p>
 ## </desc>
 gen_tunable(xguest_mount_media, false)
 
 ## <desc>
-## <p>
-## Allow xguest to configure Network Manager
-## </p>
+##	<p>
+##	Determine whether xguest can
+##	configure network manager.
+##	</p>
 ## </desc>
 gen_tunable(xguest_connect_network, false)
 
 ## <desc>
-## <p>
-## Allow xguest to use blue tooth devices
-## </p>
+##	<p>
+##	Determine whether xguest can
+##	use blue tooth devices.
+##	</p>
 ## </desc>
 gen_tunable(xguest_use_bluetooth, false)
 
@@ -35,13 +38,14 @@ userdom_restricted_xwindows_user_template(xguest)
 # Local policy
 #
 
+kernel_dontaudit_request_load_module(xguest_t)
+
 ifndef(`enable_mls',`
 	fs_exec_noxattr(xguest_t)
 
 	tunable_policy(`user_rw_noexattrfile',`
 		fs_manage_noxattr_fs_files(xguest_t)
 		fs_manage_noxattr_fs_dirs(xguest_t)
-		# Write floppies 
 		storage_raw_read_removable_device(xguest_t)
 		storage_raw_write_removable_device(xguest_t)
 	',`
@@ -49,7 +53,6 @@ ifndef(`enable_mls',`
 	')
 ')
 
-# Allow mounting of file systems
 optional_policy(`
 	tunable_policy(`xguest_mount_media',`
 		kernel_read_fs_sysctls(xguest_t)
@@ -76,6 +79,20 @@ optional_policy(`
 ')
 
 optional_policy(`
+	tunable_policy(`xguest_use_bluetooth',`
+		blueman_dbus_chat(xguest_t)
+	')
+')
+
+optional_policy(`
+	apache_role(xguest_r, xguest_t)
+')
+
+optional_policy(`
+	gnomeclock_dontaudit_dbus_chat(xguest_t)
+')
+
+optional_policy(`
 	hal_dbus_chat(xguest_t)
 ')
 
@@ -89,10 +106,66 @@ optional_policy(`
 
 optional_policy(`
 	tunable_policy(`xguest_connect_network',`
+		kernel_read_network_state(xguest_t)
+
 		networkmanager_dbus_chat(xguest_t)
+		networkmanager_read_lib_files(xguest_t)
+
+		corenet_all_recvfrom_unlabeled(xguest_t)
+		corenet_all_recvfrom_netlabel(xguest_t)
+		corenet_tcp_sendrecv_generic_if(xguest_t)
+		corenet_raw_sendrecv_generic_if(xguest_t)
+		corenet_tcp_sendrecv_generic_node(xguest_t)
+		corenet_raw_sendrecv_generic_node(xguest_t)
+
+		corenet_sendrecv_pulseaudio_client_packets(xguest_t)
 		corenet_tcp_connect_pulseaudio_port(xguest_t)
+		corenet_tcp_sendrecv_pulseaudio_port(xguest_t)
+
+		corenet_sendrecv_http_client_packets(xguest_t)
+		corenet_tcp_connect_http_port(xguest_t)
+		corenet_tcp_sendrecv_http_port(xguest_t)
+
+		corenet_sendrecv_http_cache_client_packets(xguest_t)
+		corenet_tcp_connect_http_cache_port(xguest_t)
+		corenet_tcp_sendrecv_http_cache_port(xguest_t)
+
+		corenet_sendrecv_squid_client_packets(xguest_t)
+		corenet_tcp_connect_squid_port(xguest_t)
+		corenet_tcp_sendrecv_squid_port(xguest_t)
+
+		corenet_sendrecv_ftp_client_packets(xguest_t)
+		corenet_tcp_connect_ftp_port(xguest_t)
+		corenet_tcp_sendrecv_ftp_port(xguest_t)
+
+		corenet_sendrecv_ipp_client_packets(xguest_t)
 		corenet_tcp_connect_ipp_port(xguest_t)
+		corenet_tcp_sendrecv_ipp_port(xguest_t)
+
+		corenet_sendrecv_generic_client_packets(xguest_t)
+		corenet_tcp_connect_generic_port(xguest_t)
+		corenet_tcp_sendrecv_generic_port(xguest_t)
+
+		corenet_sendrecv_soundd_client_packets(xguest_t)
+		corenet_tcp_connect_soundd_port(xguest_t)
+		corenet_tcp_sendrecv_soundd_port(xguest_t)
+
+		corenet_sendrecv_speech_client_packets(xguest_t)
+		corenet_tcp_connect_speech_port(xguest_t)
+		corenet_tcp_sendrecv_speech_port(xguest_t)
+
+		corenet_sendrecv_transproxy_client_packets(xguest_t)
+		corenet_tcp_connect_transproxy_port(xguest_t)
+		corenet_tcp_sendrecv_transproxy_port(xguest_t)
+
+		corenet_dontaudit_tcp_sendrecv_generic_port(xguest_t)
+		corenet_dontaudit_tcp_bind_generic_port(xguest_t)
 	')
 ')
 
+optional_policy(`
+	pcscd_read_pid_files(xguest_t)
+	pcscd_stream_connect(xguest_t)
+')
+
 #gen_user(xguest_u,, xguest_r, s0, s0)