[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     5699bcbafb5cd98151592c881e49b653fa640352
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Fri Nov  2 15:31:04 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Fri Nov  2 19:08:30 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=5699bcba

Changes to the mysql policy module

Adda  mysql_run_mysqld for mysql_admin() so that caller can run script
to create initial database.

Script runs mysqld and mysqld needs setuid
Script also checks for write on root_t needs to be
dontaudited/audit_access in dbadm policy module

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/mysql.if |   31 ++++++++++++++++++++++++++++---
 policy/modules/contrib/mysql.te |    6 +++++-
 2 files changed, 33 insertions(+), 4 deletions(-)

diff --git a/policy/modules/contrib/mysql.if b/policy/modules/contrib/mysql.if
index c55d58c..590748a 100644
--- a/policy/modules/contrib/mysql.if
+++ b/policy/modules/contrib/mysql.if
@@ -40,6 +40,31 @@ interface(`mysql_domtrans',`
 
 ########################################
 ## <summary>
+##	Execute mysqld in the mysqld domain, and
+##	allow the specified role the mysqld domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+#
+interface(`mysql_run_mysqld',`
+	gen_require(`
+		attribute_role mysqld_roles;
+	')
+
+	mysql_domtrans($1)
+	roleattribute $2 mysqld_roles;
+')
+
+########################################
+## <summary>
 ##	Send generic signals to mysqld.
 ## </summary>
 ## <param name="domain">
@@ -416,7 +441,7 @@ interface(`mysql_search_pid_files',`
 #
 interface(`mysql_admin',`
 	gen_require(`
-		type mysqld_t, mysqld_var_run_t, mysqld_etc_t, mysqld_exec_t;
+		type mysqld_t, mysqld_var_run_t, mysqld_etc_t;
 		type mysqld_tmp_t, mysqld_db_t, mysqld_log_t;
 		type mysqld_safe_t, mysqlmanagerd_t, mysqlmanagerd_var_run_t;
 		type mysqld_initrc_exec_t, mysqlmanagerd_initrc_exec_t, mysqld_home_t;
@@ -430,8 +455,6 @@ interface(`mysql_admin',`
 	role_transition $2 { mysqlmanagerd_initrc_exec_t mysqld_initrc_exec_t } system_r;
 	allow $2 system_r;
 
-	can_exec($1, mysqld_exec_t)
-
 	files_search_pids($1)
 	admin_pattern($1, { mysqlmanagerd_var_run_t mysqld_var_run_t })
 
@@ -446,6 +469,8 @@ interface(`mysql_admin',`
 
 	files_search_tmp($1)
 	admin_pattern($1, mysqld_tmp_t)
+
+	mysql_run_mysqld($1, $2)
 ')
 
 #######################################

diff --git a/policy/modules/contrib/mysql.te b/policy/modules/contrib/mysql.te
index da6f8c5..b1880c6 100644
--- a/policy/modules/contrib/mysql.te
+++ b/policy/modules/contrib/mysql.te
@@ -1,4 +1,4 @@
-policy_module(mysql, 1.13.3)
+policy_module(mysql, 1.13.4)
 
 ########################################
 #
@@ -13,9 +13,13 @@ policy_module(mysql, 1.13.3)
 ## </desc>
 gen_tunable(mysql_connect_any, false)
 
+attribute_role mysqld_roles;
+
 type mysqld_t;
 type mysqld_exec_t;
 init_daemon_domain(mysqld_t, mysqld_exec_t)
+application_domain(mysqld_t, mysqld_exec_t)
+role mysqld_roles types mysqld_t;
 
 type mysqld_safe_t;
 type mysqld_safe_exec_t;