[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     7c191c42c9c20586e7cf70ea3a6a627aee08d44a
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Wed Oct 31 09:12:33 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Wed Oct 31 18:04:26 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=7c191c42

Changes to the vnstatd policy module

Add init script file
Add role attribute for client

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/vnstatd.fc |    4 ++-
 policy/modules/contrib/vnstatd.if |   50 +++++++++++++++++++++++++++++++++---
 policy/modules/contrib/vnstatd.te |   24 +++++++++++------
 3 files changed, 63 insertions(+), 15 deletions(-)

diff --git a/policy/modules/contrib/vnstatd.fc b/policy/modules/contrib/vnstatd.fc
index db1a018..24228b6 100644
--- a/policy/modules/contrib/vnstatd.fc
+++ b/policy/modules/contrib/vnstatd.fc
@@ -1,7 +1,9 @@
+/etc/rc\.d/init\.d/vnstat	--	gen_context(system_u:object_r:vnstatd_initrc_exec_t,s0)
+
 /usr/bin/vnstat	--	gen_context(system_u:object_r:vnstat_exec_t,s0)
 
 /usr/sbin/vnstatd	--	gen_context(system_u:object_r:vnstatd_exec_t,s0)
 
 /var/lib/vnstat(/.*)?	gen_context(system_u:object_r:vnstatd_var_lib_t,s0)
 
-/var/run/vnstat\.pid	gen_context(system_u:object_r:vnstatd_var_run_t,s0)
+/var/run/vnstat.*	gen_context(system_u:object_r:vnstatd_var_run_t,s0)

diff --git a/policy/modules/contrib/vnstatd.if b/policy/modules/contrib/vnstatd.if
index 727fe95..137ac44 100644
--- a/policy/modules/contrib/vnstatd.if
+++ b/policy/modules/contrib/vnstatd.if
@@ -15,11 +15,38 @@ interface(`vnstatd_domtrans_vnstat',`
 		type vnstat_t, vnstat_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, vnstat_exec_t, vnstat_t)
 ')
 
 ########################################
 ## <summary>
+##	Execute vnstat in the vnstat domain,
+##	and allow the specified role
+##	the vnstat domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+#
+interface(`vnstatd_run_vnstat',`
+	gen_require(`
+		attribute_role vnstat_roles;
+	')
+
+	vnstatd_domtrans_vnstat($1)
+	roleattribute $2 vnstat_roles;
+')
+
+########################################
+## <summary>
 ##	Execute a domain transition to run vnstatd.
 ## </summary>
 ## <param name="domain">
@@ -33,6 +60,7 @@ interface(`vnstatd_domtrans',`
 		type vnstatd_t, vnstatd_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, vnstatd_exec_t, vnstatd_t)
 ')
 
@@ -51,13 +79,14 @@ interface(`vnstatd_search_lib',`
 		type vnstatd_var_lib_t;
 	')
 
-	allow $1 vnstatd_var_lib_t:dir search_dir_perms;
 	files_search_var_lib($1)
+	allow $1 vnstatd_var_lib_t:dir search_dir_perms;
 ')
 
 ########################################
 ## <summary>
-##	Manage vnstatd lib dirs.
+##	Create, read, write, and delete
+##	vnstatd lib directories.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -115,8 +144,8 @@ interface(`vnstatd_manage_lib_files',`
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate
-##	an vnstatd environment
+##	All of the rules required to
+##	administrate an vnstatd environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -132,12 +161,23 @@ interface(`vnstatd_manage_lib_files',`
 #
 interface(`vnstatd_admin',`
 	gen_require(`
-		type vnstatd_t, vnstatd_var_lib_t;
+		type vnstatd_t, vnstatd_var_lib_t, vnstatd_initrc_exec_t;
+		type vnstatd_var_run_t;
 	')
 
 	allow $1 vnstatd_t:process { ptrace signal_perms };
 	ps_process_pattern($1, vnstatd_t)
 
+	init_labeled_script_domtrans($1, vnstatd_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 vnstatd_initrc_exec_t system_r;
+	allow $2 system_r;
+
+	files_search_pids($1)
+	admin_pattern($1, vnstatd_var_run_t)
+
 	files_list_var_lib($1)
 	admin_pattern($1, vnstatd_var_lib_t)
+
+	vnstatd_run_vnstat($1, $2)
 ')

diff --git a/policy/modules/contrib/vnstatd.te b/policy/modules/contrib/vnstatd.te
index 8121937..febc3e5 100644
--- a/policy/modules/contrib/vnstatd.te
+++ b/policy/modules/contrib/vnstatd.te
@@ -1,18 +1,24 @@
-policy_module(vnstatd, 1.0.0)
+policy_module(vnstatd, 1.0.1)
 
 ########################################
 #
 # Declarations
 #
 
+attribute_role vnstat_roles;
+
 type vnstat_t;
 type vnstat_exec_t;
 application_domain(vnstat_t, vnstat_exec_t)
+role vnstat_roles types vnstat_t;
 
 type vnstatd_t;
 type vnstatd_exec_t;
 init_daemon_domain(vnstatd_t, vnstatd_exec_t)
 
+type vnstatd_initrc_exec_t;
+init_script_file(vnstatd_initrc_exec_t)
+
 type vnstatd_var_lib_t;
 files_type(vnstatd_var_lib_t)
 
@@ -21,12 +27,12 @@ files_pid_file(vnstatd_var_run_t)
 
 ########################################
 #
-# vnstatd local policy
+# Daemon local policy
 #
 
 allow vnstatd_t self:process signal;
 allow vnstatd_t self:fifo_file rw_fifo_file_perms;
-allow vnstatd_t self:unix_stream_socket create_stream_socket_perms;
+allow vnstatd_t self:unix_stream_socket { accept listen };
 
 manage_dirs_pattern(vnstatd_t, vnstatd_var_lib_t, vnstatd_var_lib_t)
 manage_files_pattern(vnstatd_t, vnstatd_var_lib_t, vnstatd_var_lib_t)
@@ -49,18 +55,14 @@ logging_send_syslog_msg(vnstatd_t)
 
 miscfiles_read_localization(vnstatd_t)
 
-optional_policy(`
-	cron_system_entry(vnstat_t, vnstat_exec_t)
-')
-
 ########################################
 #
-# vnstat local policy
+# Client local policy
 #
 
 allow vnstat_t self:process signal;
 allow vnstat_t self:fifo_file rw_fifo_file_perms;
-allow vnstat_t self:unix_stream_socket create_stream_socket_perms;
+allow vnstat_t self:unix_stream_socket { accept listen };
 
 manage_dirs_pattern(vnstat_t, vnstatd_var_lib_t, vnstatd_var_lib_t)
 manage_files_pattern(vnstat_t, vnstatd_var_lib_t, vnstatd_var_lib_t)
@@ -78,3 +80,7 @@ fs_getattr_xattr_fs(vnstat_t)
 logging_send_syslog_msg(vnstat_t)
 
 miscfiles_read_localization(vnstat_t)
+
+optional_policy(`
+	cron_system_entry(vnstat_t, vnstat_exec_t)
+')