[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     912122431d7e0b53fb36ce19b56b0c31e9e75b1d
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Fri Nov  2 14:52:59 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Fri Nov  2 19:08:28 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=91212243

Changes to the zebra policy module

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/zebra.fc |    9 +++---
 policy/modules/contrib/zebra.if |   20 +++++++-------
 policy/modules/contrib/zebra.te |   55 ++++++++++++++++++++-------------------
 3 files changed, 42 insertions(+), 42 deletions(-)

diff --git a/policy/modules/contrib/zebra.fc b/policy/modules/contrib/zebra.fc
index 32661df..28ee4ca 100644
--- a/policy/modules/contrib/zebra.fc
+++ b/policy/modules/contrib/zebra.fc
@@ -1,3 +1,6 @@
+/etc/quagga(/.*)?	gen_context(system_u:object_r:zebra_conf_t,s0)
+/etc/zebra(/.*)?	gen_context(system_u:object_r:zebra_conf_t,s0)
+
 /etc/rc\.d/init\.d/bgpd	--	gen_context(system_u:object_r:zebra_initrc_exec_t,s0)
 /etc/rc\.d/init\.d/ospf6d	--	gen_context(system_u:object_r:zebra_initrc_exec_t,s0)
 /etc/rc\.d/init\.d/ospfd	--	gen_context(system_u:object_r:zebra_initrc_exec_t,s0)
@@ -6,13 +9,9 @@
 /etc/rc\.d/init\.d/zebra	--	gen_context(system_u:object_r:zebra_initrc_exec_t,s0)
 
 /usr/sbin/bgpd	--	gen_context(system_u:object_r:zebra_exec_t,s0)
-/usr/sbin/zebra	--	gen_context(system_u:object_r:zebra_exec_t,s0)
-
-/etc/quagga(/.*)?	gen_context(system_u:object_r:zebra_conf_t,s0)
-/etc/zebra(/.*)?	gen_context(system_u:object_r:zebra_conf_t,s0)
-
 /usr/sbin/ospf.*	--	gen_context(system_u:object_r:zebra_exec_t,s0)
 /usr/sbin/rip.*	--	gen_context(system_u:object_r:zebra_exec_t,s0)
+/usr/sbin/zebra	--	gen_context(system_u:object_r:zebra_exec_t,s0)
 
 /var/log/quagga(/.*)?	gen_context(system_u:object_r:zebra_log_t,s0)
 /var/log/zebra(/.*)?	gen_context(system_u:object_r:zebra_log_t,s0)

diff --git a/policy/modules/contrib/zebra.if b/policy/modules/contrib/zebra.if
index 6b87605..3416401 100644
--- a/policy/modules/contrib/zebra.if
+++ b/policy/modules/contrib/zebra.if
@@ -1,8 +1,8 @@
-## <summary>Zebra border gateway protocol network routing service</summary>
+## <summary>Zebra border gateway protocol network routing service.</summary>
 
 ########################################
 ## <summary>
-##	Read the configuration files for zebra.
+##	Read zebra configuration content.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -18,13 +18,14 @@ interface(`zebra_read_config',`
 
 	files_search_etc($1)
 	allow $1 zebra_conf_t:dir list_dir_perms;
-	read_files_pattern($1, zebra_conf_t, zebra_conf_t)
-	read_lnk_files_pattern($1, zebra_conf_t, zebra_conf_t)
+	allow $1 zebra_conf_t:file read_file_perms;
+	allow $1 zebra_conf_t:lnk_file read_lnk_file_perms;
 ')
 
 ########################################
 ## <summary>
-##	Connect to zebra over an unix stream socket.
+##	Connect to zebra with a unix
+##	domain stream socket.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -38,14 +39,13 @@ interface(`zebra_stream_connect',`
 	')
 
 	files_search_pids($1)
-	allow $1 zebra_var_run_t:sock_file write;
-	allow $1 zebra_t:unix_stream_socket connectto;
+	stream_connect_pattern($1, zebra_var_run_t, zebra_var_run_t, zebra_t)
 ')
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate
-##	an zebra environment
+##	All of the rules required to
+##	administrate an zebra environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -54,7 +54,7 @@ interface(`zebra_stream_connect',`
 ## </param>
 ## <param name="role">
 ##	<summary>
-##	The role to be allowed to manage the zebra domain.
+##	Role allowed access.
 ##	</summary>
 ## </param>
 ## <rolecap/>

diff --git a/policy/modules/contrib/zebra.te b/policy/modules/contrib/zebra.te
index ade6c2c..b0803c2 100644
--- a/policy/modules/contrib/zebra.te
+++ b/policy/modules/contrib/zebra.te
@@ -1,4 +1,4 @@
-policy_module(zebra, 1.12.0)
+policy_module(zebra, 1.12.1)
 
 ########################################
 #
@@ -6,11 +6,11 @@ policy_module(zebra, 1.12.0)
 #
 
 ## <desc>
-## <p>
-## Allow zebra daemon to write it configuration files
-## </p>
+##	<p>
+##	Determine whether zebra daemon can
+##	manage its configuration files.
+##	</p>
 ## </desc>
-#
 gen_tunable(allow_zebra_write_config, false)
 
 type zebra_t;
@@ -40,24 +40,24 @@ files_pid_file(zebra_var_run_t)
 allow zebra_t self:capability { setgid setuid net_admin net_raw };
 dontaudit zebra_t self:capability sys_tty_config;
 allow zebra_t self:process { signal_perms getcap setcap };
-allow zebra_t self:file rw_file_perms;
-allow zebra_t self:unix_dgram_socket create_socket_perms;
-allow zebra_t self:unix_stream_socket { connectto create_stream_socket_perms };
+allow zebra_t self:fifo_file rw_fifo_file_perms;
+allow zebra_t self:unix_stream_socket { accept connectto listen };
 allow zebra_t self:netlink_route_socket rw_netlink_socket_perms;
 allow zebra_t self:tcp_socket { connect connected_stream_socket_perms };
 allow zebra_t self:udp_socket create_socket_perms;
 allow zebra_t self:rawip_socket create_socket_perms;
 
 allow zebra_t zebra_conf_t:dir list_dir_perms;
-read_files_pattern(zebra_t, zebra_conf_t, zebra_conf_t)
-read_lnk_files_pattern(zebra_t, zebra_conf_t, zebra_conf_t)
+allow zebra_t zebra_conf_t:file read_file_perms;
+allow zebra_t zebra_conf_t:lnk_file read_lnk_file_perms;
 
-allow zebra_t zebra_log_t:dir setattr;
-manage_files_pattern(zebra_t, zebra_log_t, zebra_log_t)
+allow zebra_t zebra_log_t:dir setattr_dir_perms;
+append_files_pattern(zebra_t, zebra_log_t, zebra_log_t)
+create_files_pattern(zebra_t, zebra_log_t, zebra_log_t)
+setattr_files_pattern(zebra_t, zebra_log_t, zebra_log_t)
 manage_sock_files_pattern(zebra_t, zebra_log_t, zebra_log_t)
 logging_log_filetrans(zebra_t, zebra_log_t, { sock_file file dir })
 
-# /tmp/.bgpd is such a bad idea!
 allow zebra_t zebra_tmp_t:sock_file manage_sock_file_perms;
 files_tmp_filetrans(zebra_t, zebra_tmp_t, sock_file)
 
@@ -79,33 +79,38 @@ corenet_raw_sendrecv_generic_if(zebra_t)
 corenet_tcp_sendrecv_generic_node(zebra_t)
 corenet_udp_sendrecv_generic_node(zebra_t)
 corenet_raw_sendrecv_generic_node(zebra_t)
-corenet_tcp_sendrecv_all_ports(zebra_t)
-corenet_udp_sendrecv_all_ports(zebra_t)
 corenet_tcp_bind_generic_node(zebra_t)
 corenet_udp_bind_generic_node(zebra_t)
+
+corenet_sendrecv_bgp_server_packets(zebra_t)
 corenet_tcp_bind_bgp_port(zebra_t)
-corenet_tcp_bind_zebra_port(zebra_t)
-corenet_udp_bind_router_port(zebra_t)
+corenet_sendrecv_bgp_client_packets(zebra_t)
 corenet_tcp_connect_bgp_port(zebra_t)
+corenet_tcp_sendrecv_bgp_port(zebra_t)
+
 corenet_sendrecv_zebra_server_packets(zebra_t)
+corenet_tcp_bind_zebra_port(zebra_t)
+corenet_tcp_sendrecv_zebra_port(zebra_t)
+
 corenet_sendrecv_router_server_packets(zebra_t)
+corenet_udp_bind_router_port(zebra_t)
+corenet_udp_sendrecv_router_port(zebra_t)
 
 dev_associate_usbfs(zebra_var_run_t)
 dev_list_all_dev_nodes(zebra_t)
 dev_read_sysfs(zebra_t)
 dev_rw_zero(zebra_t)
 
-fs_getattr_all_fs(zebra_t)
-fs_search_auto_mountpoints(zebra_t)
-
-term_list_ptys(zebra_t)
-
 domain_use_interactive_fds(zebra_t)
 
-files_search_etc(zebra_t)
 files_read_etc_files(zebra_t)
 files_read_etc_runtime_files(zebra_t)
 
+fs_getattr_all_fs(zebra_t)
+fs_search_auto_mountpoints(zebra_t)
+
+term_list_ptys(zebra_t)
+
 logging_send_syslog_msg(zebra_t)
 
 miscfiles_read_localization(zebra_t)
@@ -134,7 +139,3 @@ optional_policy(`
 optional_policy(`
 	udev_read_db(zebra_t)
 ')
-
-optional_policy(`
-	unconfined_sigchld(zebra_t)
-')