[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     40ed5e840cead0e4a47ea29d16133a505fc043d8
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Tue Oct 30 08:52:45 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Oct 30 18:32:45 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=40ed5e84

Changes to the tmpreaper policy module and relevant dependencies

We need a user_home_type attribute to be able to allow tmpreaper to
delete any and all user home content

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/apache.if    |   18 ++++++++++++++++++
 policy/modules/contrib/apache.te    |    2 +-
 policy/modules/contrib/tmpreaper.fc |    2 --
 policy/modules/contrib/tmpreaper.if |    3 +--
 policy/modules/contrib/tmpreaper.te |   31 +++++++++++++++++--------------
 5 files changed, 37 insertions(+), 19 deletions(-)

diff --git a/policy/modules/contrib/apache.if b/policy/modules/contrib/apache.if
index a3d2d09..81e541e 100644
--- a/policy/modules/contrib/apache.if
+++ b/policy/modules/contrib/apache.if
@@ -595,6 +595,24 @@ interface(`apache_rw_cache_files',`
 
 ########################################
 ## <summary>
+##	Delete httpd cache directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`apache_delete_cache_dirs',`
+	gen_require(`
+		type httpd_cache_t;
+	')
+
+	delete_dirs_pattern($1, httpd_cache_t, httpd_cache_t)
+')
+
+########################################
+## <summary>
 ##	Delete httpd cache files.
 ## </summary>
 ## <param name="domain">

diff --git a/policy/modules/contrib/apache.te b/policy/modules/contrib/apache.te
index 00fee74..5ce752a 100644
--- a/policy/modules/contrib/apache.te
+++ b/policy/modules/contrib/apache.te
@@ -1,4 +1,4 @@
-policy_module(apache, 2.6.1)
+policy_module(apache, 2.6.2)
 
 ########################################
 #

diff --git a/policy/modules/contrib/tmpreaper.fc b/policy/modules/contrib/tmpreaper.fc
index f081b72..ed08c94 100644
--- a/policy/modules/contrib/tmpreaper.fc
+++ b/policy/modules/contrib/tmpreaper.fc
@@ -1,7 +1,5 @@
-ifdef(`distro_debian',`
 /etc/rc\.d/init\.d/mountall-bootclean.sh	--	gen_context(system_u:object_r:tmpreaper_exec_t,s0)
 /etc/rc\.d/init\.d/mountnfs-bootclean.sh	--	gen_context(system_u:object_r:tmpreaper_exec_t,s0)
-')
 
 /usr/sbin/tmpreaper	--	gen_context(system_u:object_r:tmpreaper_exec_t,s0)
 /usr/sbin/tmpwatch	--	gen_context(system_u:object_r:tmpreaper_exec_t,s0)

diff --git a/policy/modules/contrib/tmpreaper.if b/policy/modules/contrib/tmpreaper.if
index 8dfbd80..f621a27 100644
--- a/policy/modules/contrib/tmpreaper.if
+++ b/policy/modules/contrib/tmpreaper.if
@@ -1,4 +1,4 @@
-## <summary>Manage temporary directory sizes and file ages</summary>
+## <summary>Manage temporary directory sizes and file ages.</summary>
 
 ########################################
 ## <summary>
@@ -15,7 +15,6 @@ interface(`tmpreaper_exec',`
 		type tmpreaper_exec_t;
 	')
 
-	files_search_usr($1)
 	corecmd_search_bin($1)
 	can_exec($1, tmpreaper_exec_t)
 ')

diff --git a/policy/modules/contrib/tmpreaper.te b/policy/modules/contrib/tmpreaper.te
index e4eadc0..ee33085 100644
--- a/policy/modules/contrib/tmpreaper.te
+++ b/policy/modules/contrib/tmpreaper.te
@@ -1,4 +1,4 @@
-policy_module(tmpreaper, 1.6.1)
+policy_module(tmpreaper, 1.6.2)
 
 ########################################
 #
@@ -7,39 +7,41 @@ policy_module(tmpreaper, 1.6.1)
 
 type tmpreaper_t;
 type tmpreaper_exec_t;
-application_domain(tmpreaper_t, tmpreaper_exec_t)
-role system_r types tmpreaper_t;
+init_system_domain(tmpreaper_t, tmpreaper_exec_t)
 
 ########################################
 #
 # Local Policy
 #
 
-allow tmpreaper_t self:process { fork sigchld };
 allow tmpreaper_t self:capability { dac_override dac_read_search fowner };
 
+kernel_list_unlabeled(tmpreaper_t)
+kernel_read_system_state(tmpreaper_t)
+
 dev_read_urand(tmpreaper_t)
 
 fs_getattr_xattr_fs(tmpreaper_t)
+fs_list_all(tmpreaper_t)
 
-files_read_etc_files(tmpreaper_t)
+files_getattr_all_dirs(tmpreaper_t)
+files_getattr_all_files(tmpreaper_t)
 files_read_var_lib_files(tmpreaper_t)
 files_purge_tmp(tmpreaper_t)
-# why does it need setattr?
 files_setattr_all_tmp_dirs(tmpreaper_t)
-files_getattr_all_dirs(tmpreaper_t)
-files_getattr_all_files(tmpreaper_t)
 
+mcs_file_read_all(tmpreaper_t)
+mcs_file_write_all(tmpreaper_t)
 mls_file_read_all_levels(tmpreaper_t)
 mls_file_write_all_levels(tmpreaper_t)
 
+auth_use_nsswitch(tmpreaper_t)
+
 logging_send_syslog_msg(tmpreaper_t)
 
 miscfiles_read_localization(tmpreaper_t)
 miscfiles_delete_man_pages(tmpreaper_t)
 
-cron_system_entry(tmpreaper_t, tmpreaper_exec_t)
-
 ifdef(`distro_redhat',`
 	userdom_list_user_home_content(tmpreaper_t)
 	userdom_delete_user_home_content_dirs(tmpreaper_t)
@@ -53,22 +55,23 @@ optional_policy(`
 
 optional_policy(`
 	apache_list_cache(tmpreaper_t)
+	apache_delete_cache_dirs(tmpreaper_t)
 	apache_delete_cache_files(tmpreaper_t)
 	apache_setattr_cache_dirs(tmpreaper_t)
 ')
 
 optional_policy(`
-	kismet_manage_log(tmpreaper_t)
+	cron_system_entry(tmpreaper_t, tmpreaper_exec_t)
 ')
 
 optional_policy(`
-	lpd_manage_spool(tmpreaper_t)
+	kismet_manage_log(tmpreaper_t)
 ')
 
 optional_policy(`
-	rpm_manage_cache(tmpreaper_t)
+	lpd_manage_spool(tmpreaper_t)
 ')
 
 optional_policy(`
-	unconfined_domain(tmpreaper_t)
+	rpm_manage_cache(tmpreaper_t)
 ')