[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     73600f7dad522a0d5fca9a68d3d32e51e05b4a23
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Wed Oct 31 10:37:22 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Wed Oct 31 18:06:40 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=73600f7d

Changes to the wine policy module

Ported from Fedora with changes

Role attribute for wine_t

Cleaned up a bit but this module needs to be revisited

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/wine.fc |   31 +++++++++-------
 policy/modules/contrib/wine.if |   77 +++++++++++++++++-----------------------
 policy/modules/contrib/wine.te |   32 +++++++++++++----
 3 files changed, 75 insertions(+), 65 deletions(-)

diff --git a/policy/modules/contrib/wine.fc b/policy/modules/contrib/wine.fc
index 9d24449..786a51e 100644
--- a/policy/modules/contrib/wine.fc
+++ b/policy/modules/contrib/wine.fc
@@ -1,21 +1,24 @@
+HOME_DIR/\.wine(/.*)?	gen_context(system_u:object_r:wine_home_t,s0)
 HOME_DIR/cxoffice/bin/wine.+	--	gen_context(system_u:object_r:wine_exec_t,s0)
 
 /opt/cxoffice/bin/wine.*	--	gen_context(system_u:object_r:wine_exec_t,s0)
 
-/opt/google/picasa(/.*)?/bin/msiexec --	gen_context(system_u:object_r:wine_exec_t,s0)
-/opt/google/picasa(/.*)?/bin/notepad --	gen_context(system_u:object_r:wine_exec_t,s0)
-/opt/google/picasa(/.*)?/bin/progman --	gen_context(system_u:object_r:wine_exec_t,s0)
-/opt/google/picasa(/.*)?/bin/regsvr32 -- gen_context(system_u:object_r:wine_exec_t,s0)
-/opt/google/picasa(/.*)?/bin/regedit --	gen_context(system_u:object_r:wine_exec_t,s0)
-/opt/google/picasa(/.*)?/bin/uninstaller -- gen_context(system_u:object_r:wine_exec_t,s0)
-/opt/google/picasa(/.*)?/bin/wdi --	gen_context(system_u:object_r:wine_exec_t,s0)
-/opt/google/picasa(/.*)?/bin/wine.* --	gen_context(system_u:object_r:wine_exec_t,s0)
+/opt/google/picasa(/.*)?/Picasa3/.*exe	--	gen_context(system_u:object_r:wine_exec_t,s0)
+/opt/google/picasa(/.*)?/bin/msiexec	--	gen_context(system_u:object_r:wine_exec_t,s0)
+/opt/google/picasa(/.*)?/bin/notepad	--	gen_context(system_u:object_r:wine_exec_t,s0)
+/opt/google/picasa(/.*)?/bin/progman	--	gen_context(system_u:object_r:wine_exec_t,s0)
+/opt/google/picasa(/.*)?/bin/regsvr32	--	gen_context(system_u:object_r:wine_exec_t,s0)
+/opt/google/picasa(/.*)?/bin/regedit	--	gen_context(system_u:object_r:wine_exec_t,s0)
+/opt/google/picasa(/.*)?/bin/uninstaller	--	gen_context(system_u:object_r:wine_exec_t,s0)
+/opt/google/picasa(/.*)?/bin/wdi	--	gen_context(system_u:object_r:wine_exec_t,s0)
+/opt/google/picasa(/.*)?/bin/wine.*	--	gen_context(system_u:object_r:wine_exec_t,s0)
+/opt/teamviewer(/.*)?/bin/wine.*	--	gen_context(system_u:object_r:wine_exec_t,s0)
 
 /opt/picasa/wine/bin/wine.*	--	gen_context(system_u:object_r:wine_exec_t,s0)
 
-/usr/bin/msiexec		--	gen_context(system_u:object_r:wine_exec_t,s0)
-/usr/bin/notepad		--	gen_context(system_u:object_r:wine_exec_t,s0)
-/usr/bin/regsvr32		--	gen_context(system_u:object_r:wine_exec_t,s0)
-/usr/bin/regedit		--	gen_context(system_u:object_r:wine_exec_t,s0)
-/usr/bin/uninstaller		--	gen_context(system_u:object_r:wine_exec_t,s0)
-/usr/bin/wine.*			--	gen_context(system_u:object_r:wine_exec_t,s0)
+/usr/bin/msiexec	--	gen_context(system_u:object_r:wine_exec_t,s0)
+/usr/bin/notepad	--	gen_context(system_u:object_r:wine_exec_t,s0)
+/usr/bin/regsvr32	--	gen_context(system_u:object_r:wine_exec_t,s0)
+/usr/bin/regedit	--	gen_context(system_u:object_r:wine_exec_t,s0)
+/usr/bin/uninstaller	--	gen_context(system_u:object_r:wine_exec_t,s0)
+/usr/bin/wine.*	--	gen_context(system_u:object_r:wine_exec_t,s0)

diff --git a/policy/modules/contrib/wine.if b/policy/modules/contrib/wine.if
index f9a73d0..fd2b6cc 100644
--- a/policy/modules/contrib/wine.if
+++ b/policy/modules/contrib/wine.if
@@ -1,60 +1,46 @@
-## <summary>Wine Is Not an Emulator.  Run Windows programs in Linux.</summary>
+## <summary>Run Windows programs in Linux.</summary>
 
-#######################################
+########################################
 ## <summary>
-##	The per role template for the wine module.
+##	Role access for wine.
 ## </summary>
-## <desc>
-##	<p>
-##	This template creates a derived domains which are used
-##	for wine applications.
-##	</p>
-## </desc>
-## <param name="userdomain_prefix">
-##	<summary>
-##	The prefix of the user domain (e.g., user
-##	is the prefix for user_t).
-##	</summary>
-## </param>
-## <param name="user_domain">
+## <param name="role">
 ##	<summary>
-##	The type of the user domain.
+##	Role allowed access.
 ##	</summary>
 ## </param>
-## <param name="user_role">
+## <param name="domain">
 ##	<summary>
-##	The role associated with the user domain.
+##	User domain for the role.
 ##	</summary>
 ## </param>
 #
-template(`wine_role',`
+interface(`wine_role',`
 	gen_require(`
-		type wine_exec_t;
+		attribute_role wine_roles;
+		type wine_exec_t, wine_t, wine_tmp_t;
+		type wine_home_t;
 	')
 
-	role $1 types wine_t;
+	roleattribute $1 wine_roles;
+
+	domtrans_pattern($2, wine_exec_t, wine_t)
 
-	domain_auto_trans($2, wine_exec_t, wine_t)
-	allow wine_t $2:fd use;
-	allow wine_t $2:process { sigchld signull };
 	allow wine_t $2:unix_stream_socket connectto;
+	allow wine_t $2:process signull;
 
-	# Allow the user domain to signal/ps.
 	ps_process_pattern($2, wine_t)
-	allow $2 wine_t:process signal_perms;
+	allow $2 wine_t:process { ptrace signal_perms };
 
 	allow $2 wine_t:fd use;
 	allow $2 wine_t:shm { associate getattr };
-	allow $2 wine_t:shm { unix_read unix_write };
+	allow $2 wine_t:shm rw_shm_perms;
 	allow $2 wine_t:unix_stream_socket connectto;
 
-	# X access, Home files
-	manage_dirs_pattern($2, wine_home_t, wine_home_t)
-	manage_files_pattern($2, wine_home_t, wine_home_t)
-	manage_lnk_files_pattern($2, wine_home_t, wine_home_t)
-	relabel_dirs_pattern($2, wine_home_t, wine_home_t)
-	relabel_files_pattern($2, wine_home_t, wine_home_t)
-	relabel_lnk_files_pattern($2, wine_home_t, wine_home_t)
+	allow $2 { wine_tmp_t wine_home_t }:dir { manage_dir_perms relabel_dir_perms };
+	allow $2 { wine_tmp_t wine_home_t }:file { manage_file_perms relabel_file_perms };
+	allow $2 wine_home_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
+	userdom_user_home_dir_filetrans($2, wine_home_t, dir, ".wine")
 ')
 
 #######################################
@@ -90,15 +76,17 @@ template(`wine_role_template',`
 	')
 
 	type $1_wine_t;
-	domain_type($1_wine_t)
-	domain_entry_file($1_wine_t, wine_exec_t)
-	ubac_constrained($1_wine_t)
+	userdom_user_application_domain($1_wine_t, wine_exec_t)
 	role $2 types $1_wine_t;
 
 	allow $1_wine_t self:process { execmem execstack };
-	allow $3 $1_wine_t:process { getattr ptrace noatsecure signal_perms };
+
+	allow $3 $1_wine_t:process { ptrace noatsecure signal_perms };
+	ps_process_pattern($3, $1_wine_t)
+
 	domtrans_pattern($3, wine_exec_t, $1_wine_t)
-	corecmd_bin_domtrans($1_wine_t, $1_t)
+
+	corecmd_bin_domtrans($1_wine_t, $3)
 
 	userdom_unpriv_usertype($1, $1_wine_t)
 	userdom_manage_user_tmpfs_files($1_wine_t)
@@ -135,8 +123,9 @@ interface(`wine_domtrans',`
 
 ########################################
 ## <summary>
-##	Execute wine in the wine domain, and
-##	allow the specified role the wine domain.
+##	Execute wine in the wine domain,
+##	and allow the specified role
+##	the wine domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -151,11 +140,11 @@ interface(`wine_domtrans',`
 #
 interface(`wine_run',`
 	gen_require(`
-		type wine_t;
+		attribute_role wine_roles;
 	')
 
 	wine_domtrans($1)
-	role $2 types wine_t;
+	roleattribute $2 wine_roles;
 ')
 
 ########################################

diff --git a/policy/modules/contrib/wine.te b/policy/modules/contrib/wine.te
index 7a17516..b51923c 100644
--- a/policy/modules/contrib/wine.te
+++ b/policy/modules/contrib/wine.te
@@ -1,4 +1,4 @@
-policy_module(wine, 1.10.0)
+policy_module(wine, 1.10.1)
 
 ########################################
 #
@@ -6,16 +6,24 @@ policy_module(wine, 1.10.0)
 #
 
 ## <desc>
-## <p>
-##	Ignore wine mmap_zero errors.
-## </p>
+##	<p>
+##	Determine whether attempts by
+##	wine to mmap low regions should
+##	be silently blocked.
+##	</p>
 ## </desc>
 gen_tunable(wine_mmap_zero_ignore, false)
 
+attribute_role wine_roles;
+roleattribute system_r wine_roles;
+
 type wine_t;
 type wine_exec_t;
 userdom_user_application_domain(wine_t, wine_exec_t)
-role system_r types wine_t;
+role wine_roles types wine_t;
+
+type wine_home_t;
+userdom_user_home_content(wine_home_t)
 
 type wine_tmp_t;
 userdom_user_tmp_file(wine_tmp_t)
@@ -30,6 +38,8 @@ allow wine_t self:fifo_file manage_fifo_file_perms;
 
 can_exec(wine_t, wine_exec_t)
 
+userdom_user_home_dir_filetrans(wine_t, wine_home_t, dir, ".wine")
+
 manage_dirs_pattern(wine_t, wine_tmp_t, wine_tmp_t)
 manage_files_pattern(wine_t, wine_tmp_t, wine_tmp_t)
 files_tmp_filetrans(wine_t, wine_tmp_t, { file dir })
@@ -45,11 +55,19 @@ tunable_policy(`wine_mmap_zero_ignore',`
 ')
 
 optional_policy(`
-	hal_dbus_chat(wine_t)
+	dbus_system_bus_client(wine_t)
+
+	optional_policy(`
+		hal_dbus_chat(wine_t)
+	')
+
+	optional_policy(`
+		policykit_dbus_chat(wine_t)
+	')
 ')
 
 optional_policy(`
-	policykit_dbus_chat(wine_t)
+	rtkit_scheduled(wine_t)
 ')
 
 optional_policy(`