Gentoo Archives: gentoo-commits

From: Jason Zaman <perfinion@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/
Date: Sun, 30 Apr 2017 14:20:26
Message-Id: 1493561864.7b0509b4ca611c1723179a84d751ada6345b7a13.perfinion@gentoo
1 commit: 7b0509b4ca611c1723179a84d751ada6345b7a13
2 Author: Chris PeBenito <pebenito <AT> ieee <DOT> org>
3 AuthorDate: Fri Apr 21 00:19:13 2017 +0000
4 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
5 CommitDate: Sun Apr 30 14:17:44 2017 +0000
6 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=7b0509b4
7
8 apache: Move blocks. No rule changes.
9
10 policy/modules/contrib/apache.te | 58 +++++++++++++++++++---------------------
11 1 file changed, 28 insertions(+), 30 deletions(-)
12
13 diff --git a/policy/modules/contrib/apache.te b/policy/modules/contrib/apache.te
14 index ce6479e8..9593175b 100644
15 --- a/policy/modules/contrib/apache.te
16 +++ b/policy/modules/contrib/apache.te
17 @@ -745,14 +745,6 @@ tunable_policy(`httpd_use_fusefs && httpd_builtin_scripting',`
18 fs_exec_fusefs_files(httpd_t)
19 ')
20
21 -optional_policy(`
22 - tunable_policy(`httpd_use_nfs',`
23 - fs_list_auto_mountpoints(httpd_t)
24 - rpc_manage_nfs_rw_content(httpd_t)
25 - rpc_read_nfs_content(httpd_t)
26 - ')
27 -')
28 -
29 tunable_policy(`httpd_use_nfs && httpd_builtin_scripting',`
30 fs_exec_nfs_files(httpd_t)
31 ')
32 @@ -877,6 +869,12 @@ optional_policy(`
33
34 optional_policy(`
35 rpc_search_nfs_state_data(httpd_t)
36 +
37 + tunable_policy(`httpd_use_nfs',`
38 + fs_list_auto_mountpoints(httpd_t)
39 + rpc_manage_nfs_rw_content(httpd_t)
40 + rpc_read_nfs_content(httpd_t)
41 + ')
42 ')
43
44 optional_policy(`
45 @@ -1016,6 +1014,10 @@ tunable_policy(`httpd_enable_cgi && httpd_unified',`
46 domtrans_pattern(httpd_suexec_t, httpdcontent, httpd_sys_script_t)
47 ')
48
49 +tunable_policy(`httpd_enable_homedirs',`
50 + userdom_search_user_home_dirs(httpd_suexec_t)
51 +')
52 +
53 tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
54 fs_list_auto_mountpoints(httpd_suexec_t)
55 fs_read_cifs_files(httpd_suexec_t)
56 @@ -1040,6 +1042,10 @@ tunable_policy(`httpd_execmem',`
57 allow httpd_suexec_t self:process { execmem execstack };
58 ')
59
60 +tunable_policy(`httpd_read_user_content',`
61 + userdom_read_user_home_content_files(httpd_suexec_t)
62 +')
63 +
64 tunable_policy(`httpd_tmp_exec',`
65 can_exec(httpd_suexec_t, httpd_suexec_tmp_t)
66 ')
67 @@ -1072,14 +1078,6 @@ tunable_policy(`httpd_use_fusefs && httpd_builtin_scripting',`
68 fs_exec_fusefs_files(httpd_suexec_t)
69 ')
70
71 -optional_policy(`
72 - tunable_policy(`httpd_use_nfs',`
73 - fs_list_auto_mountpoints(httpd_suexec_t)
74 - rpc_manage_nfs_rw_content(httpd_t)
75 - rpc_read_nfs_content(httpd_t)
76 - ')
77 -')
78 -
79 tunable_policy(`httpd_use_nfs && httpd_builtin_scripting',`
80 fs_exec_nfs_files(httpd_suexec_t)
81 ')
82 @@ -1106,12 +1104,12 @@ optional_policy(`
83 ')
84 ')
85
86 -tunable_policy(`httpd_read_user_content',`
87 - userdom_read_user_home_content_files(httpd_suexec_t)
88 -')
89 -
90 -tunable_policy(`httpd_enable_homedirs',`
91 - userdom_search_user_home_dirs(httpd_suexec_t)
92 +optional_policy(`
93 + tunable_policy(`httpd_use_nfs',`
94 + fs_list_auto_mountpoints(httpd_suexec_t)
95 + rpc_manage_nfs_rw_content(httpd_t)
96 + rpc_read_nfs_content(httpd_t)
97 + ')
98 ')
99
100 ########################################
101 @@ -1311,14 +1309,6 @@ tunable_policy(`httpd_use_fusefs && httpd_builtin_scripting',`
102 fs_exec_fusefs_files(httpd_sys_script_t)
103 ')
104
105 -optional_policy(`
106 - tunable_policy(`httpd_use_nfs',`
107 - fs_list_auto_mountpoints(httpd_sys_script_t)
108 - rpc_manage_nfs_rw_content(httpd_t)
109 - rpc_read_nfs_content(httpd_t)
110 - ')
111 -')
112 -
113 tunable_policy(`httpd_use_nfs && httpd_builtin_scripting',`
114 fs_exec_nfs_files(httpd_sys_script_t)
115 ')
116 @@ -1331,6 +1321,14 @@ optional_policy(`
117 postgresql_unpriv_client(httpd_sys_script_t)
118 ')
119
120 +optional_policy(`
121 + tunable_policy(`httpd_use_nfs',`
122 + fs_list_auto_mountpoints(httpd_sys_script_t)
123 + rpc_manage_nfs_rw_content(httpd_t)
124 + rpc_read_nfs_content(httpd_t)
125 + ')
126 +')
127 +
128 ########################################
129 #
130 # Rotatelogs local policy