[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     1d2680217915270bbf33c024eae6c519fd40be98
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Mon Oct 29 08:58:21 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Oct 29 14:48:34 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=1d268021

Changes to the squid policy module

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/squid.fc |    9 ++-
 policy/modules/contrib/squid.if |   36 ++++++----
 policy/modules/contrib/squid.te |  140 +++++++++++++++++++++++----------------
 3 files changed, 114 insertions(+), 71 deletions(-)

diff --git a/policy/modules/contrib/squid.fc b/policy/modules/contrib/squid.fc
index fe232c8..0a8b0f7 100644
--- a/policy/modules/contrib/squid.fc
+++ b/policy/modules/contrib/squid.fc
@@ -1,13 +1,20 @@
-/etc/rc\.d/init\.d/squid	--	gen_context(system_u:object_r:squid_initrc_exec_t,s0)
 /etc/squid(/.*)?	gen_context(system_u:object_r:squid_conf_t,s0)
 
+/etc/rc\.d/init\.d/squid	--	gen_context(system_u:object_r:squid_initrc_exec_t,s0)
+
 /usr/lib/squid/cachemgr\.cgi	--	gen_context(system_u:object_r:httpd_squid_script_exec_t,s0)
+
 /usr/sbin/squid	--	gen_context(system_u:object_r:squid_exec_t,s0)
+
 /usr/share/squid(/.*)?	gen_context(system_u:object_r:squid_conf_t,s0)
 
 /var/cache/squid(/.*)?	gen_context(system_u:object_r:squid_cache_t,s0)
+
 /var/log/squid(/.*)?	gen_context(system_u:object_r:squid_log_t,s0)
 /var/log/squidGuard(/.*)?	gen_context(system_u:object_r:squid_log_t,s0)
+
 /var/run/squid\.pid	--	gen_context(system_u:object_r:squid_var_run_t,s0)
+
 /var/spool/squid(/.*)?	gen_context(system_u:object_r:squid_cache_t,s0)
+
 /var/squidGuard(/.*)?	gen_context(system_u:object_r:squid_cache_t,s0)

diff --git a/policy/modules/contrib/squid.if b/policy/modules/contrib/squid.if
index d2496bd..5e1f053 100644
--- a/policy/modules/contrib/squid.if
+++ b/policy/modules/contrib/squid.if
@@ -1,4 +1,4 @@
-## <summary>Squid caching http proxy server</summary>
+## <summary>Squid caching http proxy server.</summary>
 
 ########################################
 ## <summary>
@@ -21,7 +21,7 @@ interface(`squid_domtrans',`
 
 ########################################
 ## <summary>
-##	Execute squid 
+##	Execute squid in the caller domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -34,6 +34,7 @@ interface(`squid_exec',`
 		type squid_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	can_exec($1, squid_exec_t)
 ')
 
@@ -57,8 +58,8 @@ interface(`squid_signal',`
 
 ########################################
 ## <summary>
-##	Allow read and write squid
-##	unix domain stream sockets.
+##	Read and write squid unix
+##	domain stream sockets.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -76,7 +77,8 @@ interface(`squid_rw_stream_sockets',`
 
 ########################################
 ## <summary>
-##	Do not audit attempts to search squid cache dirs
+##	Do not audit attempts to search
+##	squid cache directories.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -95,7 +97,7 @@ interface(`squid_dontaudit_search_cache',`
 
 ########################################
 ## <summary>
-##	Read squid configuration file.
+##	Read squid configuration files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -115,7 +117,7 @@ interface(`squid_read_config',`
 
 ########################################
 ## <summary>
-##	Append squid logs.
+##	Read squid log files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -135,7 +137,7 @@ interface(`squid_read_log',`
 
 ########################################
 ## <summary>
-##	Append squid logs.
+##	Append squid log files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -155,7 +157,7 @@ interface(`squid_append_log',`
 ########################################
 ## <summary>
 ##	Create, read, write, and delete
-##	squid logs.
+##	squid log files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -189,8 +191,8 @@ interface(`squid_use',`
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate 
-##	an squid environment
+##	All of the rules required to
+##	administrate an squid environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -199,7 +201,7 @@ interface(`squid_use',`
 ## </param>
 ## <param name="role">
 ##	<summary>
-##	The role to be allowed to manage the squid domain.
+##	Role allowed access.
 ##	</summary>
 ## </param>
 ## <rolecap/>
@@ -207,8 +209,8 @@ interface(`squid_use',`
 interface(`squid_admin',`
 	gen_require(`
 		type squid_t, squid_cache_t, squid_conf_t;
-		type squid_log_t, squid_var_run_t;
-		type squid_initrc_exec_t;
+		type squid_log_t, squid_var_run_t, squid_tmpfs_t;
+		type squid_initrc_exec_t, squid_tmp_t;
 	')
 
 	allow $1 squid_t:process { ptrace signal_perms };
@@ -230,4 +232,10 @@ interface(`squid_admin',`
 
 	files_list_pids($1)
 	admin_pattern($1, squid_var_run_t)
+
+	fs_list_tmpfs($1)
+	admin_pattern($1, squid_tmpfs_t)
+
+	files_list_tmp($1)
+	admin_pattern($1, squid_tmp_t)
 ')

diff --git a/policy/modules/contrib/squid.te b/policy/modules/contrib/squid.te
index c38de7a..da2ffc9 100644
--- a/policy/modules/contrib/squid.te
+++ b/policy/modules/contrib/squid.te
@@ -1,4 +1,4 @@
-policy_module(squid, 1.11.0)
+policy_module(squid, 1.11.1)
 
 ########################################
 #
@@ -6,17 +6,18 @@ policy_module(squid, 1.11.0)
 #
 
 ## <desc>
-## <p>
-## Allow squid to connect to all ports, not just
-## HTTP, FTP, and Gopher ports.
-## </p>
+##	<p>
+##	Determine whether squid can
+##	connect to all TCP ports.
+##	</p>
 ## </desc>
 gen_tunable(squid_connect_any, false)
 
 ## <desc>
-## <p>
-## Allow squid to run as a transparent proxy (TPROXY)
-## </p>
+##	<p>
+##	Determine whether squid can run
+##	as a transparent proxy.
+##	</p>
 ## </desc>
 gen_tunable(squid_use_tproxy, false)
 
@@ -24,7 +25,6 @@ type squid_t;
 type squid_exec_t;
 init_daemon_domain(squid_t, squid_exec_t)
 
-# type for /var/cache/squid
 type squid_cache_t;
 files_type(squid_cache_t)
 
@@ -37,6 +37,9 @@ init_script_file(squid_initrc_exec_t)
 type squid_log_t;
 logging_log_file(squid_log_t)
 
+type squid_tmp_t;
+files_tmp_file(squid_tmp_t)
+
 type squid_tmpfs_t;
 files_tmpfs_file(squid_tmpfs_t)
 
@@ -52,46 +55,46 @@ allow squid_t self:capability { setgid kill setuid dac_override sys_resource };
 dontaudit squid_t self:capability sys_tty_config;
 allow squid_t self:process ~{ ptrace setcurrent setexec setfscreate execmem execstack execheap };
 allow squid_t self:fifo_file rw_fifo_file_perms;
-allow squid_t self:sock_file read_sock_file_perms;
 allow squid_t self:fd use;
 allow squid_t self:shm create_shm_perms;
 allow squid_t self:sem create_sem_perms;
 allow squid_t self:msgq create_msgq_perms;
 allow squid_t self:msg { send receive };
-allow squid_t self:unix_stream_socket create_stream_socket_perms;
-allow squid_t self:unix_dgram_socket create_socket_perms;
 allow squid_t self:unix_dgram_socket sendto;
-allow squid_t self:unix_stream_socket connectto;
-allow squid_t self:tcp_socket create_stream_socket_perms;
-allow squid_t self:udp_socket create_socket_perms;
+allow squid_t self:unix_stream_socket { accept connectto listen };
+allow squid_t self:tcp_socket { accept listen };
 
-# Grant permissions to create, access, and delete cache files.
 manage_dirs_pattern(squid_t, squid_cache_t, squid_cache_t)
 manage_files_pattern(squid_t, squid_cache_t, squid_cache_t)
 manage_lnk_files_pattern(squid_t, squid_cache_t, squid_cache_t)
+files_var_filetrans(squid_t, squid_cache_t, dir, "squid")
 
 allow squid_t squid_conf_t:dir list_dir_perms;
-read_files_pattern(squid_t, squid_conf_t, squid_conf_t)
-read_lnk_files_pattern(squid_t, squid_conf_t, squid_conf_t)
-
-can_exec(squid_t, squid_exec_t)
+allow squid_t squid_conf_t:file read_file_perms;
+allow squid_t squid_conf_t:lnk_file read_lnk_file_perms;
 
 manage_dirs_pattern(squid_t, squid_log_t, squid_log_t)
-manage_files_pattern(squid_t, squid_log_t, squid_log_t)
+append_files_pattern(squid_t, squid_log_t, squid_log_t)
+create_files_pattern(squid_t, squid_log_t, squid_log_t)
+setattr_files_pattern(squid_t, squid_log_t, squid_log_t)
 manage_lnk_files_pattern(squid_t, squid_log_t, squid_log_t)
 logging_log_filetrans(squid_t, squid_log_t, { file dir })
 
-#squid requires the following when run in diskd mode, the recommended setting
+manage_dirs_pattern(squid_t, squid_tmp_t, squid_tmp_t)
+manage_files_pattern(squid_t, squid_tmp_t, squid_tmp_t)
+files_tmp_filetrans(squid_t, squid_tmp_t, { file dir })
+
 manage_files_pattern(squid_t, squid_tmpfs_t, squid_tmpfs_t)
 fs_tmpfs_filetrans(squid_t, squid_tmpfs_t, file)
 
 manage_files_pattern(squid_t, squid_var_run_t, squid_var_run_t)
 files_pid_filetrans(squid_t, squid_var_run_t, file)
 
+can_exec(squid_t, squid_exec_t)
+
 kernel_read_kernel_sysctls(squid_t)
 kernel_read_system_state(squid_t)
-
-files_dontaudit_getattr_boot_dirs(squid_t)
+kernel_read_network_state(squid_t)
 
 corenet_all_recvfrom_unlabeled(squid_t)
 corenet_all_recvfrom_netlabel(squid_t)
@@ -99,63 +102,77 @@ corenet_tcp_sendrecv_generic_if(squid_t)
 corenet_udp_sendrecv_generic_if(squid_t)
 corenet_tcp_sendrecv_generic_node(squid_t)
 corenet_udp_sendrecv_generic_node(squid_t)
-corenet_tcp_sendrecv_all_ports(squid_t)
-corenet_udp_sendrecv_all_ports(squid_t)
 corenet_tcp_bind_generic_node(squid_t)
 corenet_udp_bind_generic_node(squid_t)
+
+corenet_sendrecv_http_client_packets(squid_t)
+corenet_tcp_connect_http_port(squid_t)
+corenet_sendrecv_http_server_packets(squid_t)
 corenet_tcp_bind_http_port(squid_t)
+corenet_tcp_sendrecv_http_port(squid_t)
+
+corenet_sendrecv_http_cache_client_packets(squid_t)
+corenet_tcp_connect_http_cache_port(squid_t)
+corenet_sendrecv_http_cache_server_packets(squid_t)
 corenet_tcp_bind_http_cache_port(squid_t)
 corenet_udp_bind_http_cache_port(squid_t)
+corenet_tcp_sendrecv_http_cache_port(squid_t)
+corenet_udp_sendrecv_http_cache_port(squid_t)
+
+corenet_sendrecv_ftp_client_packets(squid_t)
+corenet_tcp_connect_ftp_port(squid_t)
+corenet_sendrecv_ftp_server_packets(squid_t)
 corenet_tcp_bind_ftp_port(squid_t)
+corenet_tcp_sendrecv_ftp_port(squid_t)
+
+corenet_sendrecv_gopher_client_packets(squid_t)
+corenet_tcp_connect_gopher_port(squid_t)
+corenet_sendrecv_gopher_server_packets(squid_t)
 corenet_tcp_bind_gopher_port(squid_t)
 corenet_udp_bind_gopher_port(squid_t)
+corenet_tcp_sendrecv_gopher_port(squid_t)
+corenet_udp_sendrecv_gopher_port(squid_t)
+
+corenet_sendrecv_squid_server_packets(squid_t)
 corenet_tcp_bind_squid_port(squid_t)
 corenet_udp_bind_squid_port(squid_t)
-corenet_udp_bind_wccp_port(squid_t)
-corenet_tcp_connect_ftp_port(squid_t)
-corenet_tcp_connect_gopher_port(squid_t)
-corenet_tcp_connect_http_port(squid_t)
-corenet_tcp_connect_http_cache_port(squid_t)
-corenet_tcp_connect_pgpkeyserver_port(squid_t)
-corenet_sendrecv_ftp_client_packets(squid_t)
-corenet_sendrecv_gopher_client_packets(squid_t)
-corenet_sendrecv_http_client_packets(squid_t)
-corenet_sendrecv_http_server_packets(squid_t)
-corenet_sendrecv_http_cache_server_packets(squid_t)
-corenet_sendrecv_http_cache_client_packets(squid_t)
-corenet_sendrecv_pgpkeyserver_client_packets(squid_t)
-corenet_sendrecv_squid_client_packets(squid_t)
-corenet_sendrecv_squid_server_packets(squid_t)
-corenet_sendrecv_wccp_server_packets(squid_t)
+corenet_tcp_sendrecv_squid_port(squid_t)
+corenet_udp_sendrecv_squid_port(squid_t)
 
-dev_read_sysfs(squid_t)
-dev_read_urand(squid_t)
-
-fs_getattr_all_fs(squid_t)
-fs_search_auto_mountpoints(squid_t)
-fs_list_inotifyfs(squid_t)
-
-selinux_dontaudit_getattr_dir(squid_t)
+corenet_sendrecv_wccp_server_packets(squid_t)
+corenet_udp_bind_wccp_port(squid_t)
+corenet_udp_sendrecv_wccp_port(squid_t)
 
-term_dontaudit_getattr_pty_dirs(squid_t)
+corenet_sendrecv_pgpkeyserver_client_packets(squid_t)
+corenet_tcp_connect_pgpkeyserver_port(squid_t)
+corenet_tcp_sendrecv_pgpkeyserver_port(squid_t)
 
-# to allow running programs from /usr/lib/squid (IE unlinkd)
 corecmd_exec_bin(squid_t)
 corecmd_exec_shell(squid_t)
 
+dev_read_sysfs(squid_t)
+dev_read_urand(squid_t)
+
 domain_use_interactive_fds(squid_t)
 
-files_read_etc_files(squid_t)
 files_read_etc_runtime_files(squid_t)
 files_read_usr_files(squid_t)
 files_search_spool(squid_t)
 files_dontaudit_getattr_tmp_dirs(squid_t)
 files_getattr_home_dir(squid_t)
+files_dontaudit_getattr_boot_dirs(squid_t)
+
+fs_getattr_all_fs(squid_t)
+fs_search_auto_mountpoints(squid_t)
+fs_list_inotifyfs(squid_t)
+
+selinux_dontaudit_getattr_dir(squid_t)
+
+term_dontaudit_getattr_pty_dirs(squid_t)
 
 auth_use_nsswitch(squid_t)
 auth_domtrans_chk_passwd(squid_t)
 
-# to allow running programs from /usr/lib/squid (IE unlinkd)
 libs_exec_lib_files(squid_t)
 
 logging_send_syslog_msg(squid_t)
@@ -170,21 +187,27 @@ tunable_policy(`squid_connect_any',`
 	corenet_tcp_connect_all_ports(squid_t)
 	corenet_tcp_bind_all_ports(squid_t)
 	corenet_sendrecv_all_packets(squid_t)
+	corenet_tcp_sendrecv_all_ports(squid_t)
 ')
 
 tunable_policy(`squid_use_tproxy',`
 	allow squid_t self:capability net_admin;
+	corenet_sendrecv_netport_server_packets(squid_t)
 	corenet_tcp_bind_netport_port(squid_t)
+	corenet_tcp_sendrecv_netport_port(squid_t)
 ')
 
 optional_policy(`
 	apache_content_template(squid)
 
-	allow httpd_squid_script_t self:tcp_socket create_socket_perms;
-
 	corenet_all_recvfrom_unlabeled(httpd_squid_script_t)
 	corenet_all_recvfrom_netlabel(httpd_squid_script_t)
+	corenet_tcp_sendrecv_generic_if(httpd_squid_script_t)
+	corenet_tcp_sendrecv_generic_node(httpd_squid_script_t)
+
+	corenet_sendrecv_http_cache_client_packets(httpd_squid_script_t)
 	corenet_tcp_connect_http_cache_port(httpd_squid_script_t)
+	corenet_tcp_sendrecv_http_cache_port(httpd_squid_script_t)
 
 	sysnet_dns_name_resolve(httpd_squid_script_t)
 
@@ -196,6 +219,11 @@ optional_policy(`
 ')
 
 optional_policy(`
+	kerberos_manage_host_rcache(squid_t)
+	kerberos_tmp_filetrans_host_rcache(squid_t, file, "host_0")
+')
+
+optional_policy(`
 	samba_domtrans_winbind_helper(squid_t)
 ')