[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     5b325345adf9df929f6cc37ffacbd51bda38000a
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Sun Oct 28 12:51:19 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sun Oct 28 17:58:46 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=5b325345

Changes to the smartmon policy module

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/smartmon.fc |   13 +---------
 policy/modules/contrib/smartmon.if |   15 +++++++------
 policy/modules/contrib/smartmon.te |   40 +++++++++++++++++------------------
 3 files changed, 29 insertions(+), 39 deletions(-)

diff --git a/policy/modules/contrib/smartmon.fc b/policy/modules/contrib/smartmon.fc
index 3b6ff0f..04afc18 100644
--- a/policy/modules/contrib/smartmon.fc
+++ b/policy/modules/contrib/smartmon.fc
@@ -1,16 +1,7 @@
-/etc/rc\.d/init\.d/smartd	--	gen_context(system_u:object_r:fsdaemon_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/((smartd)|(smartmontools)))	--	gen_context(system_u:object_r:fsdaemon_initrc_exec_t,s0)
 
-ifdef(`distro_debian',`
-/etc/rc\.d/init\.d/smartmontools	--	gen_context(system_u:object_r:fsdaemon_initrc_exec_t,s0)
-')
-
-#
-# /usr
-#
 /usr/sbin/smartd	--	gen_context(system_u:object_r:fsdaemon_exec_t,s0)
 
-#
-# /var
-#
 /var/run/smartd\.pid	--	gen_context(system_u:object_r:fsdaemon_var_run_t,s0)
+
 /var/lib/smartmontools(/.*)?	gen_context(system_u:object_r:fsdaemon_var_lib_t,s0)

diff --git a/policy/modules/contrib/smartmon.if b/policy/modules/contrib/smartmon.if
index fc919bc..e0644b5 100644
--- a/policy/modules/contrib/smartmon.if
+++ b/policy/modules/contrib/smartmon.if
@@ -1,8 +1,8 @@
-## <summary>Smart disk monitoring daemon policy</summary>
+## <summary>Smart disk monitoring daemon.</summary>
 
 #######################################
 ## <summary>
-##	Allow caller to read smartmon temporary files.
+##	Read smartmon temporary files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -15,13 +15,14 @@ interface(`smartmon_read_tmp_files',`
 		type fsdaemon_tmp_t;
 	')
 
+	files_search_tmp($1)
 	allow $1 fsdaemon_tmp_t:file read_file_perms;
 ')
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate 
-##	an smartmon environment
+##	All of the rules required to
+##	administrate an smartmon environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -37,11 +38,11 @@ interface(`smartmon_read_tmp_files',`
 #
 interface(`smartmon_admin',`
 	gen_require(`
-		type fsdaemon_t, fsdaemon_tmp_t, fsdaemon_var_run_t, fsdaemon_var_lib_t;
-		type fsdaemon_initrc_exec_t;
+		type fsdaemon_t, fsdaemon_tmp_t, fsdaemon_var_run_t;
+		type fsdaemon_var_lib_t, fsdaemon_initrc_exec_t;
 	')
 
-	allow $1 fsdaemon_t:process { ptrace signal_perms getattr };
+	allow $1 fsdaemon_t:process { ptrace signal_perms };
 	ps_process_pattern($1, fsdaemon_t)
 
 	init_labeled_script_domtrans($1, fsdaemon_initrc_exec_t)

diff --git a/policy/modules/contrib/smartmon.te b/policy/modules/contrib/smartmon.te
index 33be1d9..df520b3 100644
--- a/policy/modules/contrib/smartmon.te
+++ b/policy/modules/contrib/smartmon.te
@@ -1,4 +1,4 @@
-policy_module(smartmon, 1.11.1)
+policy_module(smartmon, 1.11.2)
 
 ########################################
 #
@@ -6,10 +6,10 @@ policy_module(smartmon, 1.11.1)
 #
 
 ## <desc>
-## <p>
-## Enable additional permissions needed to support
-## devices on 3ware controllers.
-## </p>
+##	<p>
+##	Determine whether smartmon can support
+##	devices on 3ware controllers.
+##	</p>
 ## </desc>
 gen_tunable(smartmon_3ware, false)
 
@@ -38,14 +38,11 @@ ifdef(`enable_mls',`
 # Local policy
 #
 
-allow fsdaemon_t self:capability { setpcap setgid sys_rawio sys_admin };
+allow fsdaemon_t self:capability { dac_override kill setpcap setgid sys_rawio sys_admin };
 dontaudit fsdaemon_t self:capability sys_tty_config;
 allow fsdaemon_t self:process { getcap setcap signal_perms };
 allow fsdaemon_t self:fifo_file rw_fifo_file_perms;
-allow fsdaemon_t self:unix_dgram_socket create_socket_perms;
-allow fsdaemon_t self:unix_stream_socket create_stream_socket_perms;
-allow fsdaemon_t self:udp_socket create_socket_perms;
-allow fsdaemon_t self:netlink_route_socket r_netlink_socket_perms;
+allow fsdaemon_t self:unix_stream_socket { accept listen };
 
 manage_dirs_pattern(fsdaemon_t, fsdaemon_tmp_t, fsdaemon_tmp_t)
 manage_files_pattern(fsdaemon_t, fsdaemon_tmp_t, fsdaemon_tmp_t)
@@ -57,40 +54,39 @@ files_pid_filetrans(fsdaemon_t, fsdaemon_var_run_t, file)
 manage_files_pattern(fsdaemon_t, fsdaemon_var_lib_t, fsdaemon_var_lib_t)
 
 kernel_read_kernel_sysctls(fsdaemon_t)
+kernel_read_network_state(fsdaemon_t)
 kernel_read_software_raid_state(fsdaemon_t)
 kernel_read_system_state(fsdaemon_t)
 
 corecmd_exec_all_executables(fsdaemon_t)
 
-corenet_all_recvfrom_unlabeled(fsdaemon_t)
-corenet_all_recvfrom_netlabel(fsdaemon_t)
-corenet_udp_sendrecv_generic_if(fsdaemon_t)
-corenet_udp_sendrecv_generic_node(fsdaemon_t)
-corenet_udp_sendrecv_all_ports(fsdaemon_t)
-
 dev_read_sysfs(fsdaemon_t)
 dev_read_urand(fsdaemon_t)
 
 domain_use_interactive_fds(fsdaemon_t)
 
 files_exec_etc_files(fsdaemon_t)
+files_read_etc_files(fsdaemon_t)
 files_read_etc_runtime_files(fsdaemon_t)
 files_read_usr_files(fsdaemon_t)
-# for config
-files_read_etc_files(fsdaemon_t)
 
 fs_getattr_all_fs(fsdaemon_t)
 fs_search_auto_mountpoints(fsdaemon_t)
 
 mls_file_read_all_levels(fsdaemon_t)
-#mls_rangetrans_target(fsdaemon_t)
 
 storage_raw_read_fixed_disk(fsdaemon_t)
 storage_raw_write_fixed_disk(fsdaemon_t)
 storage_raw_read_removable_device(fsdaemon_t)
+storage_read_scsi_generic(fsdaemon_t)
+storage_write_scsi_generic(fsdaemon_t)
 
 term_dontaudit_search_ptys(fsdaemon_t)
 
+application_signull(fsdaemon_t)
+
+init_read_utmp(fsdaemon_t)
+
 libs_exec_ld_so(fsdaemon_t)
 libs_exec_lib_files(fsdaemon_t)
 
@@ -98,8 +94,6 @@ logging_send_syslog_msg(fsdaemon_t)
 
 miscfiles_read_localization(fsdaemon_t)
 
-seutil_sigchld_newrole(fsdaemon_t)
-
 sysnet_dns_name_resolve(fsdaemon_t)
 
 userdom_dontaudit_use_unpriv_user_fds(fsdaemon_t)
@@ -122,5 +116,9 @@ optional_policy(`
 ')
 
 optional_policy(`
+	seutil_sigchld_newrole(fsdaemon_t)
+')
+
+optional_policy(`
 	udev_read_db(fsdaemon_t)
 ')