[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     72408360d594d0ce2600219c514a3d5ccc6675a2
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Nov  2 18:56:51 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Fri Nov  2 18:56:51 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=72408360

Reshuffle gentoo specific java code

---
 policy/modules/contrib/portage.te |   58 ++++++++++++++++++++++--------------
 1 files changed, 35 insertions(+), 23 deletions(-)

diff --git a/policy/modules/contrib/portage.te b/policy/modules/contrib/portage.te
index 1e0e1e1..5e5cb70 100644
--- a/policy/modules/contrib/portage.te
+++ b/policy/modules/contrib/portage.te
@@ -8,7 +8,7 @@ policy_module(portage, 1.13.4)
 ## <desc>
 ##	<p>
 ##	Determine whether portage can
-##	use nfs filesystems
+##	use nfs filesystems.
 ##	</p>
 ## </desc>
 gen_tunable(portage_use_nfs, false)
@@ -17,17 +17,11 @@ attribute_role gcc_config_roles;
 attribute_role portage_roles;
 attribute_role portage_fetch_roles;
 
-# Assigned to domains that are managed by eselect
-attribute portage_eselect_domain;
-
 type gcc_config_t;
 type gcc_config_exec_t;
 application_domain(gcc_config_t, gcc_config_exec_t)
 role gcc_config_roles types gcc_config_t;
 
-type gcc_config_tmp_t;
-files_tmp_file(gcc_config_tmp_t)
-
 # constraining type
 type portage_t;
 type portage_exec_t;
@@ -86,6 +80,14 @@ files_tmp_file(portage_tmp_t)
 type portage_tmpfs_t;
 files_tmpfs_file(portage_tmpfs_t)
 
+ifdef(`distro_gentoo',`
+	type gcc_config_tmp_t;
+	files_tmp_file(gcc_config_tmp_t)
+
+	# Assigned to domains that are managed by eselect
+	attribute portage_eselect_domain;
+')
+
 ########################################
 #
 # gcc-config policy
@@ -94,9 +96,6 @@ files_tmpfs_file(portage_tmpfs_t)
 allow gcc_config_t self:capability { chown fsetid };
 allow gcc_config_t self:fifo_file rw_fifo_file_perms;
 
-allow gcc_config_t gcc_config_tmp_t:file manage_file_perms;
-files_tmp_filetrans(gcc_config_t, gcc_config_tmp_t, file)
-
 manage_files_pattern(gcc_config_t, portage_cache_t, portage_cache_t)
 
 read_files_pattern(gcc_config_t, portage_conf_t, portage_conf_t)
@@ -116,8 +115,7 @@ corecmd_manage_bin_files(gcc_config_t)
 domain_use_interactive_fds(gcc_config_t)
 
 files_manage_etc_files(gcc_config_t)
-files_manage_etc_runtime_files(gcc_config_t)
-files_manage_etc_runtime_lnk_files(gcc_config_t)
+files_rw_etc_runtime_files(gcc_config_t)
 files_read_usr_files(gcc_config_t)
 files_search_var_lib(gcc_config_t)
 files_search_pids(gcc_config_t)
@@ -143,7 +141,13 @@ userdom_use_user_terminals(gcc_config_t)
 consoletype_exec(gcc_config_t)
 
 ifdef(`distro_gentoo',`
+	allow gcc_config_t gcc_config_tmp_t:file manage_file_perms;
+	files_tmp_filetrans(gcc_config_t, gcc_config_tmp_t, file)
+
 	init_exec_rc(gcc_config_t)
+
+	files_manage_etc_runtime_files(gcc_config_t)
+	files_manage_etc_runtime_lnk_files(gcc_config_t)
 ')
 
 tunable_policy(`portage_use_nfs',`
@@ -165,7 +169,6 @@ allow portage_t self:process { setfscreate setexec };
 # - kill for mysql merging, at least
 allow portage_t self:capability { sys_nice kill setfcap };
 dontaudit portage_t self:capability { dac_read_search };
-allow portage_t self:capability2 block_suspend;
 dontaudit portage_t self:netlink_route_socket rw_netlink_socket_perms;
 
 # user post-sync scripts
@@ -221,6 +224,10 @@ portage_run_gcc_config(portage_t, portage_roles)
 # if sesandbox is disabled, compiling is performed in this domain
 portage_compile_domain(portage_t)
 
+ifdef(`distro_gentoo',`
+	allow portage_t self:capability2 block_suspend;
+')
+
 optional_policy(`
 	bootloader_run(portage_t, portage_roles)
 ')
@@ -312,9 +319,6 @@ files_read_usr_files(portage_fetch_t)
 files_dontaudit_search_pids(portage_fetch_t)
 
 fs_search_auto_mountpoints(portage_fetch_t)
-dev_rw_autofs(portage_fetch_t)
-
-fs_search_auto_mountpoints(portage_fetch_t)
 
 logging_list_logs(portage_fetch_t)
 logging_dontaudit_search_logs(portage_fetch_t)
@@ -330,6 +334,12 @@ userdom_dontaudit_read_user_home_content_files(portage_fetch_t)
 
 rsync_exec(portage_fetch_t)
 
+ifdef(`distro_gentoo',`
+	dev_rw_autofs(portage_fetch_t)
+
+	fs_search_auto_mountpoints(portage_fetch_t)
+')
+
 ifdef(`hide_broken_symptoms',`
 	dontaudit portage_fetch_t portage_cache_t:file read;
 ')
@@ -361,13 +371,15 @@ ifdef(`hide_broken_symptoms',`
 	dontaudit portage_sandbox_t portage_cache_t:file { setattr_file_perms write };
 ')
 
-##########################################
-#
-# Portage eselect module domain
-#
+ifdef(`distro_gentoo',`
+	##########################################
+	#
+	# Portage eselect module domain
+	#
 
-allow portage_eselect_domain self:fifo_file { read write };
+	allow portage_eselect_domain self:fifo_file { read write };
 
-corecmd_exec_shell(portage_eselect_domain)
+	corecmd_exec_shell(portage_eselect_domain)
 
-files_manage_etc_runtime_files(portage_eselect_domain)
+	files_manage_etc_runtime_files(portage_eselect_domain)
+')