[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     a547b35b07da63caeae77d4210e0e4c0fac3b475
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Tue Oct  2 09:33:25 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Oct  2 18:07:40 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=a547b35b

Changes to the gatekeeper policy module

Module clean up
Add init script file type
Add gatekeeper_admin()

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/gatekeeper.fc |   11 +++++---
 policy/modules/contrib/gatekeeper.if |   46 +++++++++++++++++++++++++++++++++-
 policy/modules/contrib/gatekeeper.te |   21 +++++++++------
 3 files changed, 65 insertions(+), 13 deletions(-)

diff --git a/policy/modules/contrib/gatekeeper.fc b/policy/modules/contrib/gatekeeper.fc
index d6ef025..9f44fb6 100644
--- a/policy/modules/contrib/gatekeeper.fc
+++ b/policy/modules/contrib/gatekeeper.fc
@@ -1,8 +1,11 @@
 /etc/gatekeeper\.ini	--	gen_context(system_u:object_r:gatekeeper_etc_t,s0)
 
-/usr/sbin/gk		--	gen_context(system_u:object_r:gatekeeper_exec_t,s0)
-/usr/sbin/gnugk		--	gen_context(system_u:object_r:gatekeeper_exec_t,s0)
+/etc/rc\.d/init\.d/gnugk	--	gen_context(system_u:object_r:gatekeeper_initrc_exec_t,s0)
+
+/usr/sbin/gk	--	gen_context(system_u:object_r:gatekeeper_exec_t,s0)
+/usr/sbin/gnugk	--	gen_context(system_u:object_r:gatekeeper_exec_t,s0)
+
+/var/log/gnugk(/.*)?	gen_context(system_u:object_r:gatekeeper_log_t,s0)
 
-/var/log/gnugk(/.*)?		gen_context(system_u:object_r:gatekeeper_log_t,s0)
 /var/run/gk\.pid	--	gen_context(system_u:object_r:gatekeeper_var_run_t,s0)
-/var/run/gnugk(/.*)?		gen_context(system_u:object_r:gatekeeper_var_run_t,s0)
+/var/run/gnugk(/.*)?	gen_context(system_u:object_r:gatekeeper_var_run_t,s0)

diff --git a/policy/modules/contrib/gatekeeper.if b/policy/modules/contrib/gatekeeper.if
index 311cb06..159cd16 100644
--- a/policy/modules/contrib/gatekeeper.if
+++ b/policy/modules/contrib/gatekeeper.if
@@ -1 +1,45 @@
-## <summary>OpenH.323 Voice-Over-IP Gatekeeper</summary>
+## <summary>OpenH.323 Voice-Over-IP Gatekeeper.</summary>
+
+########################################
+## <summary>
+##	All of the rules required to
+##	administrate an gatekeeper environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`gatekeeper_admin',`
+	gen_require(`
+		type gatekeeper_t, gatekeeper_etc_t, gatekeeper_log_t;
+		type gatekeeper_var_run_t, gatekeeper_tmp_t, gatekeeper_initrc_exec_t;
+	')
+
+	allow $1 gatekeeper_t:process { ptrace signal_perms };
+	ps_process_pattern($1, gatekeeper_t)
+
+	init_labeled_script_domtrans($1, gatekeeper_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 gatekeeper_initrc_exec_t system_r;
+	allow $2 system_r;
+
+	files_search_etc($1)
+	admin_pattern($1, gatekeeper_etc_t)
+
+	logging_search_logs($1)
+	admin_pattern($1, gatekeeper_log_t)
+
+	files_search_tmp($1)
+	admin_pattern($1, gatekeeper_tmp_t)
+
+	files_search_var_lib($1)
+	admin_pattern($1, gatekeeper_var_run_t)
+')
\ No newline at end of file

diff --git a/policy/modules/contrib/gatekeeper.te b/policy/modules/contrib/gatekeeper.te
index 99a94de..fc3b036 100644
--- a/policy/modules/contrib/gatekeeper.te
+++ b/policy/modules/contrib/gatekeeper.te
@@ -1,4 +1,4 @@
-policy_module(gatekeeper, 1.7.0)
+policy_module(gatekeeper, 1.7.1)
 
 ########################################
 #
@@ -9,13 +9,15 @@ type gatekeeper_t;
 type gatekeeper_exec_t;
 init_daemon_domain(gatekeeper_t, gatekeeper_exec_t)
 
+type gatekeeper_initrc_exec_t;
+init_script_file(gatekeeper_initrc_exec_t)
+
 type gatekeeper_etc_t;
 files_config_file(gatekeeper_etc_t)
 
 type gatekeeper_log_t;
 logging_log_file(gatekeeper_log_t)
 
-# for stupid symlinks
 type gatekeeper_tmp_t;
 files_tmp_file(gatekeeper_tmp_t)
 
@@ -33,19 +35,22 @@ allow gatekeeper_t self:fifo_file rw_fifo_file_perms;
 allow gatekeeper_t self:tcp_socket create_stream_socket_perms;
 allow gatekeeper_t self:udp_socket create_socket_perms;
 
-allow gatekeeper_t gatekeeper_etc_t:lnk_file { getattr read };
+allow gatekeeper_t gatekeeper_etc_t:lnk_file read_lnk_file_perms;
 allow gatekeeper_t gatekeeper_etc_t:file read_file_perms;
-files_search_etc(gatekeeper_t)
 
-manage_files_pattern(gatekeeper_t, gatekeeper_log_t, gatekeeper_log_t)
+manage_dirs_pattern(gatekeeper_t, gatekeeper_log_t, gatekeeper_log_t)
+append_files_pattern(gatekeeper_t, gatekeeper_log_t, gatekeeper_log_t)
+create_files_pattern(gatekeeper_t, gatekeeper_log_t, gatekeeper_log_t)
+setattr_files_pattern(gatekeeper_t, gatekeeper_log_t, gatekeeper_log_t)
 logging_log_filetrans(gatekeeper_t, gatekeeper_log_t, { file dir })
 
 manage_dirs_pattern(gatekeeper_t, gatekeeper_tmp_t, gatekeeper_tmp_t)
 manage_files_pattern(gatekeeper_t, gatekeeper_tmp_t, gatekeeper_tmp_t)
 files_tmp_filetrans(gatekeeper_t, gatekeeper_tmp_t, { file dir })
 
+manage_dirs_pattern(gatekeeper_t, gatekeeper_var_run_t, gatekeeper_var_run_t)
 manage_files_pattern(gatekeeper_t, gatekeeper_var_run_t, gatekeeper_var_run_t)
-files_pid_filetrans(gatekeeper_t, gatekeeper_var_run_t, file)
+files_pid_filetrans(gatekeeper_t, gatekeeper_var_run_t, { dir file })
 
 kernel_read_system_state(gatekeeper_t)
 kernel_read_kernel_sysctls(gatekeeper_t)
@@ -62,12 +67,12 @@ corenet_tcp_sendrecv_all_ports(gatekeeper_t)
 corenet_udp_sendrecv_all_ports(gatekeeper_t)
 corenet_tcp_bind_generic_node(gatekeeper_t)
 corenet_udp_bind_generic_node(gatekeeper_t)
+
+corenet_sendrecv_gatekeeper_server_packets(gatekeeper_t)
 corenet_tcp_bind_gatekeeper_port(gatekeeper_t)
 corenet_udp_bind_gatekeeper_port(gatekeeper_t)
-corenet_sendrecv_gatekeeper_server_packets(gatekeeper_t)
 
 dev_read_sysfs(gatekeeper_t)
-# for SSP
 dev_read_urand(gatekeeper_t)
 
 domain_use_interactive_fds(gatekeeper_t)