[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     173c3e3dc3581c5073a9be245f9ac79078f79573
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Mon Oct 29 09:22:42 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Oct 29 14:48:39 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=173c3e3d

Changes to the stunnel policy module

Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/stunnel.if |    4 +-
 policy/modules/contrib/stunnel.te |   83 +++++++++++++++----------------------
 2 files changed, 35 insertions(+), 52 deletions(-)

diff --git a/policy/modules/contrib/stunnel.if b/policy/modules/contrib/stunnel.if
index 6073656..47fea00 100644
--- a/policy/modules/contrib/stunnel.if
+++ b/policy/modules/contrib/stunnel.if
@@ -1,4 +1,4 @@
-## <summary>SSL Tunneling Proxy</summary>
+## <summary>SSL Tunneling Proxy.</summary>
 
 ########################################
 ## <summary>
@@ -20,6 +20,6 @@ interface(`stunnel_service_domain',`
 		type stunnel_t;
 	')
 
-	domtrans_pattern(stunnel_t,$2,$1)
+	domtrans_pattern(stunnel_t, $2, $1)
 	allow $1 stunnel_t:tcp_socket rw_socket_perms;
 ')

diff --git a/policy/modules/contrib/stunnel.te b/policy/modules/contrib/stunnel.te
index f646c66..bdfee61 100644
--- a/policy/modules/contrib/stunnel.te
+++ b/policy/modules/contrib/stunnel.te
@@ -1,4 +1,4 @@
-policy_module(stunnel, 1.10.0)
+policy_module(stunnel, 1.10.1)
 
 ########################################
 #
@@ -6,17 +6,8 @@ policy_module(stunnel, 1.10.0)
 #
 
 type stunnel_t;
-domain_type(stunnel_t)
-role system_r types stunnel_t;
-
 type stunnel_exec_t;
-domain_entry_file(stunnel_t, stunnel_exec_t)
-
-ifdef(`distro_gentoo',`
-	init_daemon_domain(stunnel_t, stunnel_exec_t)
-',`
-	inetd_tcp_service_domain(stunnel_t, stunnel_exec_t)
-')
+init_daemon_domain(stunnel_t, stunnel_exec_t)
 
 type stunnel_etc_t;
 files_config_file(stunnel_etc_t)
@@ -33,14 +24,15 @@ files_pid_file(stunnel_var_run_t)
 #
 
 allow stunnel_t self:capability { setgid setuid sys_chroot };
+dontaudit stunnel_t self:capability sys_tty_config;
 allow stunnel_t self:process signal_perms;
 allow stunnel_t self:fifo_file rw_fifo_file_perms;
-allow stunnel_t self:tcp_socket create_stream_socket_perms;
-allow stunnel_t self:udp_socket create_socket_perms;
+allow stunnel_t self:tcp_socket { accept listen };
+allow stunnel_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
 
 allow stunnel_t stunnel_etc_t:dir list_dir_perms;
 allow stunnel_t stunnel_etc_t:file read_file_perms;
-allow stunnel_t stunnel_etc_t:lnk_file { getattr read };
+allow stunnel_t stunnel_etc_t:lnk_file read_lnk_file_perms;
 
 manage_dirs_pattern(stunnel_t, stunnel_tmp_t, stunnel_tmp_t)
 manage_files_pattern(stunnel_t, stunnel_tmp_t, stunnel_tmp_t)
@@ -59,15 +51,23 @@ corecmd_exec_bin(stunnel_t)
 corenet_all_recvfrom_unlabeled(stunnel_t)
 corenet_all_recvfrom_netlabel(stunnel_t)
 corenet_tcp_sendrecv_generic_if(stunnel_t)
-corenet_udp_sendrecv_generic_if(stunnel_t)
 corenet_tcp_sendrecv_generic_node(stunnel_t)
-corenet_udp_sendrecv_generic_node(stunnel_t)
 corenet_tcp_sendrecv_all_ports(stunnel_t)
-corenet_udp_sendrecv_all_ports(stunnel_t)
 corenet_tcp_bind_generic_node(stunnel_t)
+
+corenet_sendrecv_all_client_packets(stunnel_t)
 corenet_tcp_connect_all_ports(stunnel_t)
 
+dev_read_sysfs(stunnel_t)
+dev_read_urand(stunnel_t)
+
+domain_use_interactive_fds(stunnel_t)
+
+files_read_etc_runtime_files(stunnel_t)
+files_search_home(stunnel_t)
+
 fs_getattr_all_fs(stunnel_t)
+fs_search_auto_mountpoints(stunnel_t)
 
 auth_use_nsswitch(stunnel_t)
 
@@ -75,44 +75,27 @@ logging_send_syslog_msg(stunnel_t)
 
 miscfiles_read_localization(stunnel_t)
 
-sysnet_read_config(stunnel_t)
-
-ifdef(`distro_gentoo', `
-	dontaudit stunnel_t self:capability sys_tty_config;
-	allow stunnel_t self:udp_socket create_socket_perms;
-
-	dev_read_sysfs(stunnel_t)
+userdom_dontaudit_use_unpriv_user_fds(stunnel_t)
+userdom_dontaudit_search_user_home_dirs(stunnel_t)
 
-	fs_search_auto_mountpoints(stunnel_t)
-
-	domain_use_interactive_fds(stunnel_t)
-
-	userdom_dontaudit_use_unpriv_user_fds(stunnel_t)
-	userdom_dontaudit_search_user_home_dirs(stunnel_t)
-
-	optional_policy(`
-		daemontools_service_domain(stunnel_t, stunnel_exec_t)
-	')
-
-	optional_policy(`
-		seutil_sigchld_newrole(stunnel_t)
-	')
+optional_policy(`
+	daemontools_service_domain(stunnel_t, stunnel_exec_t)
+')
 
-	optional_policy(`
-		udev_read_db(stunnel_t)
-	')
-',`
-	allow stunnel_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
+optional_policy(`
+	inetd_tcp_service_domain(stunnel_t, stunnel_exec_t)
+')
 
-	dev_read_urand(stunnel_t)
+optional_policy(`
+	kerberos_use(stunnel_t)
+')
 
-	files_read_etc_files(stunnel_t)
-	files_read_etc_runtime_files(stunnel_t)
-	files_search_home(stunnel_t)
+optional_policy(`
+	seutil_sigchld_newrole(stunnel_t)
+')
 
-	optional_policy(`
-		kerberos_use(stunnel_t)
-	')
+optional_policy(`
+	udev_read_db(stunnel_t)
 ')
 
 # hack since this port has no interfaces since it doesnt