[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/, policy/modules/system/, policy/modules/kernel/, ...

[Sven Vermeulen]

commit:     342340a822ffd74de31b81188f91250337949575
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Sat Sep 29 16:55:09 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sat Sep 29 16:55:09 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=342340a8

Introducing rtorrent policy

In bug #433084, Vincent Brillault provided a first policy for the rtorrent
application. A few changes to make this a bit more compliant with coding style
as made, and the necessary parts are now moved towards their respective files
(instead of all within a single file).

---
 policy/modules/contrib/rtorrent.fc      |    4 ++
 policy/modules/contrib/rtorrent.if      |   60 +++++++++++++++++++++
 policy/modules/contrib/rtorrent.te      |   87 +++++++++++++++++++++++++++++++
 policy/modules/kernel/corenetwork.te.in |    1 +
 policy/modules/roles/sysadm.te          |    4 ++
 policy/modules/roles/unprivuser.te      |    4 ++
 policy/modules/system/unconfined.te     |    4 ++
 7 files changed, 164 insertions(+), 0 deletions(-)

diff --git a/policy/modules/contrib/rtorrent.fc b/policy/modules/contrib/rtorrent.fc
new file mode 100644
index 0000000..66037c2
--- /dev/null
+++ b/policy/modules/contrib/rtorrent.fc
@@ -0,0 +1,4 @@
+HOME_DIR/.rtorrent.rc	--	gen_context(system_u:object_r:rtorrent_home_t,s0,s0)
+HOME_DIR/.rtsession(/.*)?	gen_context(system_u:object_r:rtorrent_session_t,s0,s0)
+
+/usr/bin/rtorrent	--	gen_context(system_u:object_r:rtorrent_exec_t,s0,s0)

diff --git a/policy/modules/contrib/rtorrent.if b/policy/modules/contrib/rtorrent.if
new file mode 100644
index 0000000..790f889
--- /dev/null
+++ b/policy/modules/contrib/rtorrent.if
@@ -0,0 +1,60 @@
+## <summary>rtorrent torrent client</summary>
+
+#######################################
+## <summary>
+## 	Role access for rtorrent
+## </summary>
+## <param name="user_role">
+##      <summary>
+##      The role associated with the user domain.
+##      </summary>
+## </param>
+## <param name="user_domain">
+##      <summary>
+##      The user domain.
+##      </summary>
+## </param>
+#
+interface(`rtorrent_role',`
+	gen_require(`
+		type rtorrent_t, rtorrent_exec_t, rtorrent_home_t, rtorrent_session_t;
+	')
+
+	role $1 types rtorrent_t;
+
+	domtrans_pattern($2, rtorrent_exec_t, rtorrent_t)
+
+	allow $2 rtorrent_t:process signal_perms;
+
+	manage_files_pattern($2, rtorrent_home_t, rtorrent_home_t)
+
+	read_files_pattern($2, rtorrent_session_t, rtorrent_session_t)
+	list_dirs_pattern($2, rtorrent_session_t, rtorrent_session_t)
+
+	ps_process_pattern($2, rtorrent_t)
+')
+
+#######################################
+## <summary>
+##      Administer the rtorrent application.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+## <param name="role">
+##      <summary>
+##      Role allowed access.
+##      </summary>
+## </param>
+#
+interface(`rtorrent_admin',`
+	gen_require(`
+		type rtorrent_t;
+	')
+
+	allow $1 rtorrent_t:process ptrace;
+
+	rtorrent_role($2, $1)
+')

diff --git a/policy/modules/contrib/rtorrent.te b/policy/modules/contrib/rtorrent.te
new file mode 100644
index 0000000..746b5f5
--- /dev/null
+++ b/policy/modules/contrib/rtorrent.te
@@ -0,0 +1,87 @@
+policy_module(rtorrent, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+## <desc>
+## <p>
+## Allow rtorrent to use dht.
+## The correspondig port must be rtorrent_udp_port_t.
+## </p>
+## </desc>
+gen_tunable(rtorrent_use_dht, true)
+
+## <desc>
+## <p>
+## Allow rtorrent to use rsync, for example in a hook.
+## </p>
+## </desc>
+gen_tunable(rtorrent_use_rsync, false)
+
+
+type rtorrent_t;
+type rtorrent_exec_t;
+userdom_user_application_domain(rtorrent_t, rtorrent_exec_t)
+
+type rtorrent_home_t;
+userdom_user_home_content(rtorrent_home_t)
+
+type rtorrent_session_t;
+userdom_user_home_content(rtorrent_session_t)
+
+########################################
+#
+# rtorrent local policy
+#
+
+allow rtorrent_t self:process signal;
+allow rtorrent_t self:netlink_route_socket r_netlink_socket_perms;
+allow rtorrent_t self:tcp_socket create_stream_socket_perms;
+
+read_files_pattern(rtorrent_t, rtorrent_home_t, rtorrent_home_t)
+
+manage_dirs_pattern(rtorrent_t, rtorrent_session_t, rtorrent_session_t)
+manage_files_pattern(rtorrent_t, rtorrent_session_t, rtorrent_session_t)
+
+corenet_tcp_bind_generic_node(rtorrent_t)
+corenet_tcp_bind_rtorrent_port(rtorrent_t)
+corenet_tcp_connect_all_ports(rtorrent_t)
+corenet_tcp_sendrecv_all_ports(rtorrent_t)
+
+domain_use_interactive_fds(rtorrent_t)
+
+files_list_home(rtorrent_t)
+files_read_etc_files(rtorrent_t)
+
+fs_getattr_xattr_fs(rtorrent_t)
+
+miscfiles_read_localization(rtorrent_t)
+
+sysnet_read_config(rtorrent_t)
+
+userdom_list_user_home_dirs(rtorrent_t)
+userdom_use_user_ptys(rtorrent_t)
+
+tunable_policy(`rtorrent_use_dht',`
+	allow rtorrent_t self:udp_socket create_stream_socket_perms;
+
+	corenet_udp_bind_generic_node(rtorrent_t)
+	corenet_udp_bind_rtorrent_port(rtorrent_t)
+')
+
+tunable_policy(`rtorrent_use_rsync',`
+	allow rtorrent_t self:unix_stream_socket { create connect write read };
+
+	corecmd_search_bin(rtorrent_t)  
+
+	corenet_sendrecv_rsync_client_packets(rtorrent_t)
+	corenet_tcp_connect_rsync_port(rtorrent_t)
+
+	rsync_exec(rtorrent_t)
+')
+
+optional_policy(`
+	xdg_manage_downloads_home(rtorrent_t)
+')

diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
index a15f0a9..72c446f 100644
--- a/policy/modules/kernel/corenetwork.te.in
+++ b/policy/modules/kernel/corenetwork.te.in
@@ -229,6 +229,7 @@ network_port(rndc, tcp,953,s0, udp,953,s0)
 network_port(router, udp,520,s0, udp,521,s0, tcp,521,s0)
 network_port(rsh, tcp,514,s0)
 network_port(rsync, tcp,873,s0, udp,873,s0)
+network_port(rtorrent, udp, 6881, s0)
 network_port(rtsp, tcp,554,s0, udp,554,s0)
 network_port(rwho, udp,513,s0)
 network_port(sap, tcp,9875,s0, udp,9875,s0)

diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index 0a2714b..07a049f 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -351,6 +351,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	rtorrent_admin(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	samba_run_net(sysadm_t, sysadm_r)
 	samba_run_winbind_helper(sysadm_t, sysadm_r)
 ')

diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
index 8029449..17a987b 100644
--- a/policy/modules/roles/unprivuser.te
+++ b/policy/modules/roles/unprivuser.te
@@ -142,6 +142,10 @@ ifndef(`distro_redhat',`
 	')
 
 	optional_policy(`
+		rtorrent_role(user_r, user_t)
+	')
+
+	optional_policy(`
 		skype_role(user_r, user_t)
 	')
 

diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
index e7ea6c4..0442922 100644
--- a/policy/modules/system/unconfined.te
+++ b/policy/modules/system/unconfined.te
@@ -187,6 +187,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	rtorrent_role(unconfined_r, unconfined_t)
+')
+
+optional_policy(`
 	samba_run_net(unconfined_t, unconfined_r)
 	samba_run_winbind_helper(unconfined_t, unconfined_r)
 ')