[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     b88cdf0ca896b7db7e9262a76bbb6b9a6ae01ffa
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Thu Nov  1 20:54:37 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Nov  1 20:54:37 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=b88cdf0c

Reshuffle gentoo specific courier changes

---
 policy/modules/contrib/courier.if |   82 ++++++++++++++++++------------------
 policy/modules/contrib/courier.te |   34 +++++++++------
 2 files changed, 62 insertions(+), 54 deletions(-)

diff --git a/policy/modules/contrib/courier.if b/policy/modules/contrib/courier.if
index 0d8806b..0705659 100644
--- a/policy/modules/contrib/courier.if
+++ b/policy/modules/contrib/courier.if
@@ -2,7 +2,7 @@
 
 #######################################
 ## <summary>
-##	The template to define a courier domain. 
+##	The template to define a courier domain.
 ## </summary>
 ## <param name="domain_prefix">
 ##	<summary>
@@ -15,7 +15,7 @@ template(`courier_domain_template',`
 		attribute courier_domain;
 	')
 
-	#######################################
+	########################################
 	#
 	# Declarations
 	#
@@ -24,7 +24,7 @@ template(`courier_domain_template',`
 	type courier_$1_exec_t;
 	init_daemon_domain(courier_$1_t, courier_$1_exec_t)
 
-	#######################################
+	########################################
 	#
 	# Policy
 	#
@@ -74,44 +74,6 @@ interface(`courier_stream_connect_authdaemon',`
 
 ########################################
 ## <summary>
-##     Allow read/write operations on an inherited stream socket
-## </summary>
-## <param name="domain">
-##     <summary>
-##     Domain allowed access.
-##     </summary>
-## </param>
-## <rolecap/>
-#
-interface(`courier_authdaemon_rw_inherited_stream_sockets',`
-       gen_require(`
-               type courier_authdaemon_t;
-       ')
-       allow $1 courier_authdaemon_t:unix_stream_socket { read write };
-')
-
-
-########################################
-## <summary>
-##     Connect to Authdaemon using a unix domain stream socket.
-## </summary>
-## <param name="domain">
-##     <summary>
-##     Domain allowed access.
-##     </summary>
-## </param>
-## <rolecap/>
-#
-interface(`courier_authdaemon_stream_connect',`
-       gen_require(`
-               type courier_authdaemon_t, courier_var_run_t;
-       ')
-
-       stream_connect_pattern($1, courier_var_run_t, courier_var_run_t, courier_authdaemon_t)
-')
-
-########################################
-## <summary>
 ##	Execute the courier POP3 and IMAP
 ##	server with a domain transition.
 ## </summary>
@@ -226,3 +188,41 @@ interface(`courier_rw_spool_pipes',`
 	files_search_var($1)
 	allow $1 courier_spool_t:fifo_file rw_fifo_file_perms;
 ')
+
+########################################
+## <summary>
+##     Allow read/write operations on an inherited stream socket
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+## <rolecap/>
+#
+interface(`courier_authdaemon_rw_inherited_stream_sockets',`
+       gen_require(`
+               type courier_authdaemon_t;
+       ')
+       allow $1 courier_authdaemon_t:unix_stream_socket { read write };
+')
+
+
+########################################
+## <summary>
+##     Connect to Authdaemon using a unix domain stream socket.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+## <rolecap/>
+#
+interface(`courier_authdaemon_stream_connect',`
+       gen_require(`
+               type courier_authdaemon_t, courier_var_run_t;
+       ')
+
+       stream_connect_pattern($1, courier_var_run_t, courier_var_run_t, courier_authdaemon_t)
+')

diff --git a/policy/modules/contrib/courier.te b/policy/modules/contrib/courier.te
index ca5aed1..cf44dcd 100644
--- a/policy/modules/contrib/courier.te
+++ b/policy/modules/contrib/courier.te
@@ -99,8 +99,6 @@ allow courier_authdaemon_t courier_tcpd_t:fifo_file rw_fifo_file_perms;
 allow courier_authdaemon_t courier_tcpd_t:tcp_socket rw_stream_socket_perms;
 allow courier_authdaemon_t courier_tcpd_t:unix_stream_socket rw_stream_socket_perms;
 
-read_lnk_files_pattern(courier_authdaemon_t, courier_var_lib_t, courier_var_lib_t)
-
 can_exec(courier_authdaemon_t, courier_exec_t)
 
 domtrans_pattern(courier_authdaemon_t, courier_pop_exec_t, courier_pop_t)
@@ -118,6 +116,10 @@ miscfiles_read_localization(courier_authdaemon_t)
 
 userdom_dontaudit_search_user_home_dirs(courier_authdaemon_t)
 
+ifdef(`distro_gentoo',`
+	read_lnk_files_pattern(courier_authdaemon_t, courier_var_lib_t, courier_var_lib_t)
+')
+
 ########################################
 #
 # Calendar (PCP) local policy
@@ -139,19 +141,21 @@ allow courier_pop_t courier_tcpd_t:{ unix_stream_socket tcp_socket } rw_stream_s
 
 allow courier_pop_t courier_var_lib_t:file { read write };
 
-# TODO Correct this, mentioning "var_lib_t" here is not done.
-search_dirs_pattern(courier_pop_t, var_lib_t, courier_var_lib_t)
-read_lnk_files_pattern(courier_pop_t, var_lib_t, courier_var_lib_t)
-
 domtrans_pattern(courier_pop_t, courier_authdaemon_exec_t, courier_authdaemon_t)
 
 miscfiles_read_localization(courier_pop_t)
 
-courier_authdaemon_rw_inherited_stream_sockets(courier_pop_t)
-
 userdom_manage_user_home_content_files(courier_pop_t)
 userdom_manage_user_home_content_dirs(courier_pop_t)
 
+ifdef(`distro_gentoo',`
+	files_search_var_lib(courier_pop_t)
+	search_dirs_pattern(courier_pop_t, courier_var_lib_t, courier_var_lib_t)
+	read_lnk_files_pattern(courier_pop_t, courier_var_lib_t, courier_var_lib_t)
+
+	courier_authdaemon_rw_inherited_stream_sockets(courier_pop_t)
+')
+
 ########################################
 #
 # TCPd local policy
@@ -182,8 +186,10 @@ dev_read_urand(courier_tcpd_t)
 
 miscfiles_read_localization(courier_tcpd_t)
 
-courier_authdaemon_stream_connect(courier_tcpd_t)
-courier_domtrans_authdaemon(courier_tcpd_t)
+ifdef(`distro_gentoo',`
+	courier_authdaemon_stream_connect(courier_tcpd_t)
+	courier_domtrans_authdaemon(courier_tcpd_t)
+')
 
 ########################################
 #
@@ -192,10 +198,12 @@ courier_domtrans_authdaemon(courier_tcpd_t)
 
 kernel_read_kernel_sysctls(courier_sqwebmail_t)
 
-optional_policy(`
-	cron_system_entry(courier_sqwebmail_t, courier_sqwebmail_exec_t)
+ifdef(`distro_gentoo',`
+	optional_policy(`
+		mysql_stream_connect(courier_authdaemon_t)
+	')
 ')
 
 optional_policy(`
-	mysql_stream_connect(courier_authdaemon_t)
+	cron_system_entry(courier_sqwebmail_t, courier_sqwebmail_exec_t)
 ')