[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     dba2b6538375d00774b18c841338016c17075ff3
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Thu Nov  1 20:47:19 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Nov  1 20:47:19 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=dba2b653

Reshuffle and merge

Apparently some changes in dbus upstream weren't properly merged within our
tree. Merge is now done, and the Gentoo-specific bits have been moved into their
own distro_gentoo set (allows for easier patching).

Also, the Gentoo-specific interfaces have been moved to the end of the file.

---
 policy/modules/contrib/dbus.if |  107 ++++++++++++++++++++++------------------
 policy/modules/contrib/dbus.te |   21 +++++---
 2 files changed, 71 insertions(+), 57 deletions(-)

diff --git a/policy/modules/contrib/dbus.if b/policy/modules/contrib/dbus.if
index 0c247ec..c8b109f 100644
--- a/policy/modules/contrib/dbus.if
+++ b/policy/modules/contrib/dbus.if
@@ -66,7 +66,7 @@ template(`dbus_role_template',`
 	allow $3 $1_dbusd_t:unix_stream_socket connectto;
 	allow $3 $1_dbusd_t:dbus { send_msg acquire_svc };
 	allow $3 $1_dbusd_t:fd use;
-
+	
 	allow $3 system_dbusd_t:dbus { send_msg acquire_svc };
 
 	allow $3 { session_dbusd_home_t session_dbusd_tmp_t }:dir { manage_dir_perms relabel_dir_perms };
@@ -89,8 +89,10 @@ template(`dbus_role_template',`
 		dontaudit $3 $1_dbusd_t:netlink_selinux_socket { read write };
 	')
 
-	optional_policy(`
-		xdg_read_generic_data_home_files($1_dbusd_t)
+	ifdef(`distro_gentoo',`
+		optional_policy(`
+			xdg_read_generic_data_home_files($1_dbusd_t)
+		')
 	')
 ')
 
@@ -224,6 +226,8 @@ interface(`dbus_all_session_bus_client',`
 	typeattribute $1 dbusd_session_bus_client;
 
 	allow $1 { session_bus_type self }:dbus send_msg;
+	allow session_bus_type $1:dbus send_msg;
+	
 	allow $1 session_bus_type:unix_stream_socket connectto;
 	allow $1 session_bus_type:fd use;
 ')
@@ -255,6 +259,8 @@ interface(`dbus_spec_session_bus_client',`
 	typeattribute $2 dbusd_session_bus_client;
 
 	allow $2 { $1_dbusd_t self }:dbus send_msg;
+	allow $1_dbusd_t $2:dbus send_msg;
+
 	allow $2 $1_dbusd_t:unix_stream_socket connectto;
 	allow $2 $1_dbusd_t:fd use;
 ')
@@ -356,7 +362,10 @@ interface(`dbus_read_lib_files',`
 
 	files_search_var_lib($1)
 	read_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
-	read_lnk_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
+
+	ifdef(`distro_gentoo',`
+		read_lnk_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
+	')
 ')
 
 ########################################
@@ -509,50 +518,6 @@ interface(`dbus_send_system_bus',`
 
 ########################################
 ## <summary>
-##	Create resources in /run or /var/run with the system_dbusd_var_run_t
-##	label. This method is deprecated in favor of the init_daemon_run_dir
-##	call.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access
-##	</summary>
-## </param>
-## <param name="class">
-##	<summary>
-##	Classes supported for the created resources
-##	</summary>
-## </param>
-## <param name="filename" optional="true">
-##	<summary>
-##	Optional file name used for the resource
-##	</summary>
-## </param>
-#
-interface(`dbus_generic_pid_filetrans_system_dbusd_var_run',`
-	refpolicywarn(`$0($*) has been deprecated.')
-')
-
-########################################
-## <summary>
-##	Create directories with the system_dbusd_var_run_t label
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access
-##	</summary>
-## </param>
-#
-interface(`dbus_create_system_dbusd_var_run_dirs',`
-	gen_require(`
-		type system_dbusd_var_run_t;
-	')
-
-	create_dirs_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t)
-')
-
-########################################
-## <summary>
 ##	Unconfined access to DBUS system bus.
 ## </summary>
 ## <param name="domain">
@@ -666,3 +631,49 @@ interface(`dbus_unconfined',`
 
 	typeattribute $1 dbusd_unconfined;
 ')
+
+########################################
+## <summary>
+##	Create resources in /run or /var/run with the system_dbusd_var_run_t
+##	label. This method is deprecated in favor of the init_daemon_run_dir
+##	call.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+## <param name="class">
+##	<summary>
+##	Classes supported for the created resources
+##	</summary>
+## </param>
+## <param name="filename" optional="true">
+##	<summary>
+##	Optional file name used for the resource
+##	</summary>
+## </param>
+#
+interface(`dbus_generic_pid_filetrans_system_dbusd_var_run',`
+	refpolicywarn(`$0($*) has been deprecated.')
+')
+
+########################################
+## <summary>
+##	Create directories with the system_dbusd_var_run_t label
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+#
+interface(`dbus_create_system_dbusd_var_run_dirs',`
+	gen_require(`
+		type system_dbusd_var_run_t;
+	')
+
+	create_dirs_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t)
+')
+
+

diff --git a/policy/modules/contrib/dbus.te b/policy/modules/contrib/dbus.te
index 7a4c124..4dfae34 100644
--- a/policy/modules/contrib/dbus.te
+++ b/policy/modules/contrib/dbus.te
@@ -4,7 +4,7 @@ gen_require(`
 	class dbus all_dbus_perms;
 ')
 
-##############################
+########################################
 #
 # Declarations
 #
@@ -51,7 +51,7 @@ ifdef(`enable_mls',`
 	init_ranged_system_domain(system_dbusd_t, dbusd_exec_t, s0 - mls_systemhigh)
 ')
 
-######################################
+########################################
 #
 # Local policy
 #
@@ -142,17 +142,18 @@ seutil_read_default_contexts(system_dbusd_t)
 userdom_dontaudit_use_unpriv_user_fds(system_dbusd_t)
 userdom_dontaudit_search_user_home_dirs(system_dbusd_t)
 
-optional_policy(`
-	bluetooth_stream_connect(system_dbusd_t)
+ifdef(`distro_gentoo',`
+	optional_policy(`
+		cpufreqselector_dbus_chat(system_dbusd_t)
+	')
 ')
 
 optional_policy(`
-	cpufreqselector_dbus_chat(system_dbusd_t)
+	bluetooth_stream_connect(system_dbusd_t)
 ')
 
 optional_policy(`
-	policykit_dbus_chat(system_dbusd_t)
-	policykit_search_lib(system_dbusd_t)
+	policykit_read_lib(system_dbusd_t)
 ')
 
 optional_policy(`
@@ -243,8 +244,10 @@ seutil_read_default_contexts(session_bus_type)
 
 term_use_all_terms(session_bus_type)
 
-optional_policy(`
-	hal_dbus_chat(session_bus_type)
+ifdef(`distro_gentoo',`
+	optional_policy(`
+		hal_dbus_chat(session_bus_type)
+	')
 ')
 
 optional_policy(`