[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     216ba03f525ec540f16c1514ebbeffed211c526b
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Wed Nov 28 16:29:18 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Wed Nov 28 20:20:07 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=216ba03f

Changes to the various policy modules

Revert setsched, sys_nice and list_tmp

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/cups.te      |   11 +++++------
 policy/modules/contrib/fail2ban.te  |    6 +++---
 policy/modules/contrib/firewalld.te |    5 +----
 policy/modules/contrib/logwatch.te  |    7 +++----
 4 files changed, 12 insertions(+), 17 deletions(-)

diff --git a/policy/modules/contrib/cups.te b/policy/modules/contrib/cups.te
index bf41251..069141c 100644
--- a/policy/modules/contrib/cups.te
+++ b/policy/modules/contrib/cups.te
@@ -1,4 +1,4 @@
-policy_module(cups, 1.15.5)
+policy_module(cups, 1.15.6)
 
 ########################################
 #
@@ -339,9 +339,9 @@ optional_policy(`
 # Configuration daemon local policy
 #
 
-allow cupsd_config_t self:capability { chown dac_override sys_tty_config setuid setgid sys_nice };
+allow cupsd_config_t self:capability { chown dac_override sys_tty_config setuid setgid };
 dontaudit cupsd_config_t self:capability sys_tty_config;
-allow cupsd_config_t self:process { getsched setsched signal_perms };
+allow cupsd_config_t self:process { getsched signal_perms };
 allow cupsd_config_t self:fifo_file rw_fifo_file_perms;
 allow cupsd_config_t self:tcp_socket { accept listen };
 
@@ -401,7 +401,6 @@ files_read_etc_runtime_files(cupsd_config_t)
 files_read_usr_files(cupsd_config_t)
 files_read_var_symlinks(cupsd_config_t)
 files_search_all_mountpoints(cupsd_config_t)
-files_dontaudit_list_tmp(cupsd_config_t)
 
 fs_getattr_all_fs(cupsd_config_t)
 fs_search_auto_mountpoints(cupsd_config_t)
@@ -591,10 +590,10 @@ optional_policy(`
 # HPLIP local policy
 #
 
-allow hplip_t self:capability { dac_override dac_read_search net_raw sys_nice };
+allow hplip_t self:capability { dac_override dac_read_search net_raw };
 dontaudit hplip_t self:capability sys_tty_config;
 allow hplip_t self:fifo_file rw_fifo_file_perms;
-allow hplip_t self:process { setsched signal_perms };
+allow hplip_t self:process signal_perms;
 allow hplip_t self:tcp_socket { accept listen };
 allow hplip_t self:rawip_socket create_socket_perms;
 

diff --git a/policy/modules/contrib/fail2ban.te b/policy/modules/contrib/fail2ban.te
index 525f6c2..955be6e 100644
--- a/policy/modules/contrib/fail2ban.te
+++ b/policy/modules/contrib/fail2ban.te
@@ -1,4 +1,4 @@
-policy_module(fail2ban, 1.4.8)
+policy_module(fail2ban, 1.4.9)
 
 ########################################
 #
@@ -36,8 +36,8 @@ role fail2ban_client_roles types fail2ban_client_t;
 # Server Local policy
 #
 
-allow fail2ban_t self:capability { dac_read_search dac_override sys_tty_config sys_nice };
-allow fail2ban_t self:process { setsched signal };
+allow fail2ban_t self:capability { dac_read_search dac_override sys_tty_config };
+allow fail2ban_t self:process signal;
 allow fail2ban_t self:fifo_file rw_fifo_file_perms;
 allow fail2ban_t self:unix_stream_socket { accept connectto listen };
 allow fail2ban_t self:tcp_socket { accept listen };

diff --git a/policy/modules/contrib/firewalld.te b/policy/modules/contrib/firewalld.te
index edccdb3..711a2ab 100644
--- a/policy/modules/contrib/firewalld.te
+++ b/policy/modules/contrib/firewalld.te
@@ -1,4 +1,4 @@
-policy_module(firewalld, 1.0.4)
+policy_module(firewalld, 1.0.5)
 
 ########################################
 #
@@ -26,9 +26,7 @@ files_pid_file(firewalld_var_run_t)
 # Local policy
 #
 
-allow firewalld_t self:capability sys_nice;
 dontaudit firewalld_t self:capability sys_tty_config;
-allow firewalld_t self:process setsched;
 allow firewalld_t self:fifo_file rw_fifo_file_perms;
 allow firewalld_t self:unix_stream_socket { accept listen };
 allow firewalld_t self:udp_socket create_socket_perms;
@@ -55,7 +53,6 @@ dev_read_urand(firewalld_t)
 
 domain_use_interactive_fds(firewalld_t)
 
-files_list_tmp(firewalld_t)
 files_read_etc_files(firewalld_t)
 files_read_usr_files(firewalld_t)
 files_dontaudit_list_tmp(firewalld_t)

diff --git a/policy/modules/contrib/logwatch.te b/policy/modules/contrib/logwatch.te
index 6269990..077a3f3 100644
--- a/policy/modules/contrib/logwatch.te
+++ b/policy/modules/contrib/logwatch.te
@@ -1,4 +1,4 @@
-policy_module(logwatch, 1.11.4)
+policy_module(logwatch, 1.11.5)
 
 #################################
 #
@@ -29,8 +29,8 @@ role system_r types logwatch_mail_t;
 # Local policy
 #
 
-allow logwatch_t self:capability { dac_override dac_read_search setgid sys_nice };
-allow logwatch_t self:process { setsched signal };
+allow logwatch_t self:capability { dac_override dac_read_search setgid };
+allow logwatch_t self:process signal;
 allow logwatch_t self:fifo_file rw_fifo_file_perms;
 allow logwatch_t self:unix_stream_socket { accept listen };
 
@@ -68,7 +68,6 @@ files_search_all(logwatch_t)
 files_read_var_symlinks(logwatch_t)
 files_read_etc_runtime_files(logwatch_t)
 files_read_usr_files(logwatch_t)
-files_dontaudit_list_tmp(logwatch_t)
 
 fs_getattr_all_fs(logwatch_t)
 fs_dontaudit_list_auto_mountpoints(logwatch_t)