[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     436f8b0513fceb428333b459874156aa93b02dc0
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Thu Nov  1 21:32:39 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Nov  1 21:32:39 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=436f8b05

Reshuffle gentoo specific apache changes

---
 policy/modules/contrib/apache.if |  263 ++++++++++++++++++++------------------
 policy/modules/contrib/apache.te |    7 +-
 2 files changed, 141 insertions(+), 129 deletions(-)

diff --git a/policy/modules/contrib/apache.if b/policy/modules/contrib/apache.if
index 81e541e..e89080d 100644
--- a/policy/modules/contrib/apache.if
+++ b/policy/modules/contrib/apache.if
@@ -15,9 +15,7 @@ template(`apache_content_template',`
 	gen_require(`
 		attribute httpdcontent, httpd_exec_scripts, httpd_script_exec_type;
 		attribute httpd_script_domains, httpd_htaccess_type;
-		attribute httpd_rw_content;
-		attribute httpd_ra_content;
-		type httpd_t, httpd_suexec_t, httpd_log_t;
+		type httpd_t, httpd_suexec_t;
 	')
 
 	########################################
@@ -50,11 +48,11 @@ template(`apache_content_template',`
 	corecmd_shell_entry_type(httpd_$1_script_t)
 	domain_entry_file(httpd_$1_script_t, httpd_$1_script_exec_t)
 
-	type httpd_$1_rw_content_t, httpdcontent, httpd_rw_content; # customizable
+	type httpd_$1_rw_content_t, httpdcontent; # customizable
 	typealias httpd_$1_rw_content_t alias { httpd_$1_script_rw_t httpd_$1_content_rw_t };
 	files_type(httpd_$1_rw_content_t)
 
-	type httpd_$1_ra_content_t, httpdcontent, httpd_ra_content; # customizable
+	type httpd_$1_ra_content_t, httpdcontent; # customizable
 	typealias httpd_$1_ra_content_t alias { httpd_$1_script_ra_t httpd_$1_content_ra_t };
 	files_type(httpd_$1_ra_content_t)
 
@@ -84,6 +82,17 @@ template(`apache_content_template',`
 	allow { httpd_t httpd_suexec_t } { httpd_$1_content_t httpd_$1_htaccess_t }:file read_file_perms;
 	allow { httpd_t httpd_suexec_t } httpd_$1_content_t:lnk_file read_lnk_file_perms;
 
+	ifdef(`distro_gentoo',`
+		gen_require(`
+			attribute httpd_rw_content;
+			attribute httpd_ra_content;
+			type httpd_log_t;
+		')
+
+		typeattribute httpd_$1_rw_content_t httpd_rw_content;
+		typeattribute httpd_$1_ra_content_t httpd_ra_content;
+	')
+
 	tunable_policy(`allow_httpd_$1_script_anon_write',`
 		miscfiles_manage_public_files(httpd_$1_script_t)
 	')
@@ -393,128 +402,6 @@ interface(`apache_dontaudit_rw_tcp_sockets',`
 
 ########################################
 ## <summary>
-##	Read all appendable content.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-## <rolecap/>
-#
-interface(`apache_read_all_ra_content',`
-	gen_require(`
-		attribute httpd_ra_content;
-	')
-
-	read_files_pattern($1, httpd_ra_content, httpd_ra_content)
-	read_lnk_files_pattern($1, httpd_ra_content, httpd_ra_content)
-')
-
-########################################
-## <summary>
-##	Append to all appendable web content files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-## <rolecap/>
-#
-interface(`apache_append_all_ra_content',`
-	gen_require(`
-		attribute httpd_ra_content;
-	')
-
-	apache_search_all_content($1)
-	append_files_pattern($1, httpd_ra_content, httpd_ra_content)
-')
-
-########################################
-## <summary>
-##	Read all read/write content.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-## <rolecap/>
-#
-interface(`apache_read_all_rw_content',`
-	gen_require(`
-		attribute httpd_rw_content;
-	')
-
-	read_files_pattern($1, httpd_rw_content, httpd_rw_content)
-	read_lnk_files_pattern($1, httpd_rw_content, httpd_rw_content)
-')
-
-########################################
-## <summary>
-##	Manage all read/write content.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-## <rolecap/>
-#
-interface(`apache_manage_all_rw_content',`
-	gen_require(`
-		attribute httpd_rw_content;
-	')
-
-	manage_dirs_pattern($1, httpd_rw_content, httpd_rw_content)
-	manage_files_pattern($1, httpd_rw_content, httpd_rw_content)
-	manage_lnk_files_pattern($1, httpd_rw_content, httpd_rw_content)
-')
-
-########################################
-## <summary>
-##	Read all web content.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-## <rolecap/>
-#
-interface(`apache_read_all_content',`
-	gen_require(`
-		attribute httpdcontent, httpd_script_exec_type;
-	')
-
-	read_files_pattern($1, httpdcontent, httpdcontent)
-	read_lnk_files_pattern($1, httpdcontent, httpdcontent)
-
-	read_files_pattern($1, httpd_script_exec_type, httpd_script_exec_type)
-	read_lnk_files_pattern($1, httpd_script_exec_type, httpd_script_exec_type)
-')
-
-########################################
-## <summary>
-##	Search all apache content.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`apache_search_all_content',`
-	gen_require(`
-		attribute httpdcontent;
-	')
-
-	allow $1 httpdcontent:dir search_dir_perms;
-')
-
-########################################
-## <summary>
 ##	Create, read, write, and delete
 ##	all httpd content.
 ## </summary>
@@ -1329,3 +1216,125 @@ interface(`apache_admin',`
 	apache_run_all_scripts($1, $2)
 	apache_run_helper($1, $2)
 ')
+
+########################################
+## <summary>
+##	Read all appendable content.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`apache_read_all_ra_content',`
+	gen_require(`
+		attribute httpd_ra_content;
+	')
+
+	read_files_pattern($1, httpd_ra_content, httpd_ra_content)
+	read_lnk_files_pattern($1, httpd_ra_content, httpd_ra_content)
+')
+
+########################################
+## <summary>
+##	Append to all appendable web content files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`apache_append_all_ra_content',`
+	gen_require(`
+		attribute httpd_ra_content;
+	')
+
+	apache_search_all_content($1)
+	append_files_pattern($1, httpd_ra_content, httpd_ra_content)
+')
+
+########################################
+## <summary>
+##	Read all read/write content.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`apache_read_all_rw_content',`
+	gen_require(`
+		attribute httpd_rw_content;
+	')
+
+	read_files_pattern($1, httpd_rw_content, httpd_rw_content)
+	read_lnk_files_pattern($1, httpd_rw_content, httpd_rw_content)
+')
+
+########################################
+## <summary>
+##	Manage all read/write content.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`apache_manage_all_rw_content',`
+	gen_require(`
+		attribute httpd_rw_content;
+	')
+
+	manage_dirs_pattern($1, httpd_rw_content, httpd_rw_content)
+	manage_files_pattern($1, httpd_rw_content, httpd_rw_content)
+	manage_lnk_files_pattern($1, httpd_rw_content, httpd_rw_content)
+')
+
+########################################
+## <summary>
+##	Read all web content.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`apache_read_all_content',`
+	gen_require(`
+		attribute httpdcontent, httpd_script_exec_type;
+	')
+
+	read_files_pattern($1, httpdcontent, httpdcontent)
+	read_lnk_files_pattern($1, httpdcontent, httpdcontent)
+
+	read_files_pattern($1, httpd_script_exec_type, httpd_script_exec_type)
+	read_lnk_files_pattern($1, httpd_script_exec_type, httpd_script_exec_type)
+')
+
+########################################
+## <summary>
+##	Search all apache content.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`apache_search_all_content',`
+	gen_require(`
+		attribute httpdcontent;
+	')
+
+	allow $1 httpdcontent:dir search_dir_perms;
+')

diff --git a/policy/modules/contrib/apache.te b/policy/modules/contrib/apache.te
index 7f0a224..7d7e1ba 100644
--- a/policy/modules/contrib/apache.te
+++ b/policy/modules/contrib/apache.te
@@ -252,8 +252,6 @@ gen_tunable(httpd_use_gpg, false)
 gen_tunable(httpd_use_nfs, false)
 
 attribute httpdcontent;
-attribute httpd_ra_content;
-attribute httpd_rw_content;
 attribute httpd_htaccess_type;
 
 # domains that can exec all scripts
@@ -362,6 +360,11 @@ domain_type(httpd_gpg_t)
 gpg_entry_type(httpd_gpg_t)
 role system_r types httpd_gpg_t;
 
+ifdef(`distro_gentoo',`
+	attribute httpd_ra_content;
+	attribute httpd_rw_content;
+')
+
 optional_policy(`
 	prelink_object_file(httpd_modules_t)
 ')