[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     0777ed9ea6f659963889174698ec9193131518ff
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Tue Oct 30 11:03:42 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Oct 30 18:33:13 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=0777ed9e

Changes to the updfstab policy module

Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/updfstab.fc |    1 -
 policy/modules/contrib/updfstab.if |    3 +--
 policy/modules/contrib/updfstab.te |   34 +++++++++++++++++-----------------
 3 files changed, 18 insertions(+), 20 deletions(-)

diff --git a/policy/modules/contrib/updfstab.fc b/policy/modules/contrib/updfstab.fc
index e534c88..b62ab19 100644
--- a/policy/modules/contrib/updfstab.fc
+++ b/policy/modules/contrib/updfstab.fc
@@ -1,3 +1,2 @@
-
 /usr/sbin/fstab-sync	--	gen_context(system_u:object_r:updfstab_exec_t,s0)
 /usr/sbin/updfstab	--	gen_context(system_u:object_r:updfstab_exec_t,s0)

diff --git a/policy/modules/contrib/updfstab.if b/policy/modules/contrib/updfstab.if
index 4d4b60e..ec0800b 100644
--- a/policy/modules/contrib/updfstab.if
+++ b/policy/modules/contrib/updfstab.if
@@ -1,4 +1,4 @@
-## <summary>Red Hat utility to change /etc/fstab.</summary>
+## <summary>Red Hat utility to change fstab.</summary>
 
 ########################################
 ## <summary>
@@ -15,7 +15,6 @@ interface(`updfstab_domtrans',`
 		type updfstab_t, updfstab_exec_t;
 	')
 
-	files_search_usr($1)
 	corecmd_search_bin($1)
 	domtrans_pattern($1, updfstab_exec_t, updfstab_t)
 ')

diff --git a/policy/modules/contrib/updfstab.te b/policy/modules/contrib/updfstab.te
index ef12ed5..d6bc9bb 100644
--- a/policy/modules/contrib/updfstab.te
+++ b/policy/modules/contrib/updfstab.te
@@ -22,14 +22,23 @@ allow updfstab_t self:fifo_file rw_fifo_file_perms;
 kernel_use_fds(updfstab_t)
 kernel_read_kernel_sysctls(updfstab_t)
 kernel_dontaudit_write_kernel_sysctl(updfstab_t)
-# for /proc/partitions
 kernel_read_system_state(updfstab_t)
-# cjp: why is this required
 kernel_change_ring_buffer_level(updfstab_t)
 
+corecmd_exec_bin(updfstab_t)
+
 dev_read_sysfs(updfstab_t)
 dev_manage_generic_symlinks(updfstab_t)
 
+domain_use_interactive_fds(updfstab_t)
+
+files_manage_mnt_files(updfstab_t)
+files_manage_mnt_dirs(updfstab_t)
+files_manage_mnt_symlinks(updfstab_t)
+files_manage_etc_files(updfstab_t)
+files_dontaudit_search_home(updfstab_t)
+files_read_etc_runtime_files(updfstab_t)
+
 fs_getattr_xattr_fs(updfstab_t)
 fs_getattr_tmpfs(updfstab_t)
 fs_getattr_tmpfs_dirs(updfstab_t)
@@ -51,23 +60,11 @@ storage_write_scsi_generic(updfstab_t)
 
 term_dontaudit_use_console(updfstab_t)
 
-corecmd_exec_bin(updfstab_t)
-
-domain_use_interactive_fds(updfstab_t)
-
-files_manage_mnt_files(updfstab_t)
-files_manage_mnt_dirs(updfstab_t)
-files_manage_mnt_symlinks(updfstab_t)
-files_manage_etc_files(updfstab_t)
-files_dontaudit_search_home(updfstab_t)
-# for /etc/mtab
-files_read_etc_runtime_files(updfstab_t)
-
 init_use_fds(updfstab_t)
 init_use_script_ptys(updfstab_t)
 
-logging_send_syslog_msg(updfstab_t)
 logging_search_logs(updfstab_t)
+logging_send_syslog_msg(updfstab_t)
 
 miscfiles_read_localization(updfstab_t)
 
@@ -83,9 +80,13 @@ optional_policy(`
 ')
 
 optional_policy(`
+	dbus_system_bus_client(updfstab_t)
+
 	init_dbus_chat_script(updfstab_t)
 
-	dbus_system_bus_client(updfstab_t)
+	optional_policy(`
+		hal_dbus_chat(updfstab_t)
+	')
 ')
 
 optional_policy(`
@@ -94,7 +95,6 @@ optional_policy(`
 
 optional_policy(`
 	hal_stream_connect(updfstab_t)
-	hal_dbus_chat(updfstab_t)
 ')
 
 optional_policy(`