[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     1dfbff2d6056d16daa6033ffca02668b2699686f
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Mon Oct  1 08:09:05 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Oct  2 18:06:02 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=1dfbff2d

Changes to the fingerd policy module

Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/finger.fc |   21 +++++------------
 policy/modules/contrib/finger.if |    3 +-
 policy/modules/contrib/finger.te |   45 +++++++++++--------------------------
 3 files changed, 22 insertions(+), 47 deletions(-)

diff --git a/policy/modules/contrib/finger.fc b/policy/modules/contrib/finger.fc
index c861192..843940b 100644
--- a/policy/modules/contrib/finger.fc
+++ b/policy/modules/contrib/finger.fc
@@ -1,19 +1,10 @@
-# fingerd
+/etc/cfingerd(/.*)?	gen_context(system_u:object_r:fingerd_etc_t,s0)
 
-#
-# /etc
-#
-/etc/cfingerd(/.*)?		gen_context(system_u:object_r:fingerd_etc_t,s0)
+/etc/cron\.weekly/(c)?fingerd	--	gen_context(system_u:object_r:fingerd_exec_t,s0)
 
-/etc/cron\.weekly/(c)?fingerd -- gen_context(system_u:object_r:fingerd_exec_t,s0)
-
-#
-# /usr
-#
-/usr/sbin/in\.fingerd	--	gen_context(system_u:object_r:fingerd_exec_t,s0)
+/usr/sbin/in\.(x)?fingerd	--	gen_context(system_u:object_r:fingerd_exec_t,s0)
 /usr/sbin/[cef]fingerd	--	gen_context(system_u:object_r:fingerd_exec_t,s0)
 
-#
-# /var
-#
-/var/log/cfingerd\.log.* --	gen_context(system_u:object_r:fingerd_log_t,s0)
+/var/log/cfingerd\.log.*	--	gen_context(system_u:object_r:fingerd_log_t,s0)
+
+/var/run/*.fingerd\.pid	--	gen_context(system_u:object_r:fingerd_var_run_t,s0)

diff --git a/policy/modules/contrib/finger.if b/policy/modules/contrib/finger.if
index b5dd671..2656d2b 100644
--- a/policy/modules/contrib/finger.if
+++ b/policy/modules/contrib/finger.if
@@ -15,12 +15,13 @@ interface(`finger_domtrans',`
 		type fingerd_t, fingerd_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, fingerd_exec_t, fingerd_t)
 ')
 
 ########################################
 ## <summary>
-##	Allow the specified domain to connect to fingerd with a tcp socket.  (Deprecated)
+##	Connect to fingerd with a tcp socket.  (Deprecated)
 ## </summary>
 ## <param name="domain">
 ##	<summary>

diff --git a/policy/modules/contrib/finger.te b/policy/modules/contrib/finger.te
index f60af2d..93f5d25 100644
--- a/policy/modules/contrib/finger.te
+++ b/policy/modules/contrib/finger.te
@@ -1,4 +1,4 @@
-policy_module(finger, 1.9.0)
+policy_module(finger, 1.9.1)
 
 ########################################
 #
@@ -28,9 +28,6 @@ dontaudit fingerd_t self:capability { sys_tty_config fsetid };
 allow fingerd_t self:process signal_perms;
 allow fingerd_t self:fifo_file rw_fifo_file_perms;
 allow fingerd_t self:tcp_socket connected_stream_socket_perms;
-allow fingerd_t self:udp_socket create_socket_perms;
-allow fingerd_t self:unix_dgram_socket create_socket_perms;
-allow fingerd_t self:unix_stream_socket create_socket_perms;
 
 manage_files_pattern(fingerd_t, fingerd_var_run_t, fingerd_var_run_t)
 files_pid_filetrans(fingerd_t, fingerd_var_run_t, file)
@@ -39,7 +36,9 @@ allow fingerd_t fingerd_etc_t:dir list_dir_perms;
 read_files_pattern(fingerd_t, fingerd_etc_t, fingerd_etc_t)
 read_lnk_files_pattern(fingerd_t, fingerd_etc_t, fingerd_etc_t)
 
-allow fingerd_t fingerd_log_t:file manage_file_perms;
+allow fingerd_t fingerd_log_t:file append_file_perms;
+allow fingerd_t fingerd_log_t:file create_file_perms;
+allow fingerd_t fingerd_log_t:file setattr_file_perms;
 logging_log_filetrans(fingerd_t, fingerd_log_t, file)
 
 kernel_read_kernel_sysctls(fingerd_t)
@@ -48,16 +47,22 @@ kernel_read_system_state(fingerd_t)
 corenet_all_recvfrom_unlabeled(fingerd_t)
 corenet_all_recvfrom_netlabel(fingerd_t)
 corenet_tcp_sendrecv_generic_if(fingerd_t)
-corenet_udp_sendrecv_generic_if(fingerd_t)
 corenet_tcp_sendrecv_generic_node(fingerd_t)
-corenet_udp_sendrecv_generic_node(fingerd_t)
-corenet_tcp_sendrecv_all_ports(fingerd_t)
-corenet_udp_sendrecv_all_ports(fingerd_t)
 corenet_tcp_bind_generic_node(fingerd_t)
+
+corenet_sendrecv_fingerd_server_packets(fingerd_t)
 corenet_tcp_bind_fingerd_port(fingerd_t)
+corenet_tcp_sendrecv_fingerd_port(fingerd_t)
+
+corecmd_exec_bin(fingerd_t)
+corecmd_exec_shell(fingerd_t)
 
 dev_read_sysfs(fingerd_t)
 
+domain_use_interactive_fds(fingerd_t)
+
+files_read_etc_runtime_files(fingerd_t)
+
 fs_getattr_all_fs(fingerd_t)
 fs_search_auto_mountpoints(fingerd_t)
 
@@ -66,15 +71,6 @@ term_getattr_all_ptys(fingerd_t)
 
 auth_read_lastlog(fingerd_t)
 
-corecmd_exec_bin(fingerd_t)
-corecmd_exec_shell(fingerd_t)
-
-domain_use_interactive_fds(fingerd_t)
-
-files_search_home(fingerd_t)
-files_read_etc_files(fingerd_t)
-files_read_etc_runtime_files(fingerd_t)
-
 init_read_utmp(fingerd_t)
 init_dontaudit_write_utmp(fingerd_t)
 
@@ -82,13 +78,8 @@ logging_send_syslog_msg(fingerd_t)
 
 mta_getattr_spool(fingerd_t)
 
-sysnet_read_config(fingerd_t)
-
 miscfiles_read_localization(fingerd_t)
 
-# stop it accessing sub-directories, prevents checking a Maildir for new mail,
-# have to change this when we create a type for Maildir
-userdom_read_user_home_content_files(fingerd_t)
 userdom_dontaudit_use_unpriv_user_fds(fingerd_t)
 
 optional_policy(`
@@ -104,14 +95,6 @@ optional_policy(`
 ')
 
 optional_policy(`
-	nis_use_ypbind(fingerd_t)
-')
-
-optional_policy(`
-	nscd_socket_use(fingerd_t)
-')
-
-optional_policy(`
 	seutil_sigchld_newrole(fingerd_t)
 ')