[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     d0485bb717fad9fa3530aca580647ae773ad5199
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Tue Oct  2 11:11:54 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Oct  2 18:08:11 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=d0485bb7

Changes to the glance policy module

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/glance.fc |   15 +++++------
 policy/modules/contrib/glance.if |   44 +++++++++++++++++-----------------
 policy/modules/contrib/glance.te |   48 +++++++++++++++++++++++++------------
 3 files changed, 61 insertions(+), 46 deletions(-)

diff --git a/policy/modules/contrib/glance.fc b/policy/modules/contrib/glance.fc
index ed3528d..c21a528 100644
--- a/policy/modules/contrib/glance.fc
+++ b/policy/modules/contrib/glance.fc
@@ -1,12 +1,11 @@
-/etc/rc\.d/init\.d/openstack-glance-api --	gen_context(system_u:object_r:glance_api_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/openstack-glance-api	--	gen_context(system_u:object_r:glance_api_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/openstack-glance-registry	--	gen_context(system_u:object_r:glance_registry_initrc_exec_t,s0)
 
-/etc/rc\.d/init\.d/openstack-glance-registry --	gen_context(system_u:object_r:glance_registry_initrc_exec_t,s0)
+/usr/bin/glance-api	--	gen_context(system_u:object_r:glance_api_exec_t,s0)
+/usr/bin/glance-registry	--	gen_context(system_u:object_r:glance_registry_exec_t,s0)
 
-/usr/bin/glance-api			--	gen_context(system_u:object_r:glance_api_exec_t,s0)
-/usr/bin/glance-registry		--	gen_context(system_u:object_r:glance_registry_exec_t,s0)
+/var/lib/glance(/.*)?	gen_context(system_u:object_r:glance_var_lib_t,s0)
 
-/var/lib/glance(/.*)?				gen_context(system_u:object_r:glance_var_lib_t,s0)
+/var/log/glance(/.*)?	gen_context(system_u:object_r:glance_log_t,s0)
 
-/var/log/glance(/.*)?				gen_context(system_u:object_r:glance_log_t,s0)
-
-/var/run/glance(/.*)?				gen_context(system_u:object_r:glance_var_run_t,s0)
+/var/run/glance(/.*)?	gen_context(system_u:object_r:glance_var_run_t,s0)

diff --git a/policy/modules/contrib/glance.if b/policy/modules/contrib/glance.if
index 7ff9d6d..9eacb2c 100644
--- a/policy/modules/contrib/glance.if
+++ b/policy/modules/contrib/glance.if
@@ -1,8 +1,9 @@
-## <summary>policy for glance</summary>
+## <summary>OpenStack image registry and delivery service.</summary>
 
 ########################################
 ## <summary>
-##	Transition to glance registry.
+##	Execute a domain transition to
+##	run glance registry.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -21,7 +22,8 @@ interface(`glance_domtrans_registry',`
 
 ########################################
 ## <summary>
-##	Transition to glance api.
+##	Execute a domain transition to
+##	run glance api.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -40,7 +42,7 @@ interface(`glance_domtrans_api',`
 
 ########################################
 ## <summary>
-##	Read glance's log files.
+##	Read glance log files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -60,7 +62,7 @@ interface(`glance_read_log',`
 
 ########################################
 ## <summary>
-##	Append to glance log files.
+##	Append glance log files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -79,7 +81,8 @@ interface(`glance_append_log',`
 
 ########################################
 ## <summary>
-##	Manage glance log files
+##	Create, read, write, and delete
+##	glance log files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -138,7 +141,8 @@ interface(`glance_read_lib_files',`
 
 ########################################
 ## <summary>
-##	Manage glance lib files.
+##	Create, read, write, and delete
+##	glance lib files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -157,7 +161,8 @@ interface(`glance_manage_lib_files',`
 
 ########################################
 ## <summary>
-##	Manage glance lib directories.
+##	Create, read, write, and delete
+##	glance lib directories.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -176,7 +181,7 @@ interface(`glance_manage_lib_dirs',`
 
 ########################################
 ## <summary>
-##	Read glance PID files.
+##	Read glance pid files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -195,7 +200,8 @@ interface(`glance_read_pid_files',`
 
 ########################################
 ## <summary>
-##	Manage glance PID files.
+##	Create, read, write, and delete
+##	glance pid files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -214,8 +220,8 @@ interface(`glance_manage_pid_files',`
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate
-##	an glance environment
+##	All of the rules required to
+##	administrate an glance environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -236,20 +242,14 @@ interface(`glance_admin',`
 		type glance_registry_initrc_exec_t, glance_api_initrc_exec_t;
 	')
 
-	allow $1 glance_registry_t:process signal_perms;
-	ps_process_pattern($1, glance_registry_t)
+	allow $1 { glance_api_t glance_registry_t }:process signal_perms;
+	ps_process_pattern($1, { glance_api_t glance_registry_t })
 
-	allow $1 glance_api_t:process signal_perms;
-	ps_process_pattern($1, glance_api_t)
-
-	init_labeled_script_domtrans($1, glance_registry_initrc_exec_t)
+	init_labeled_script_domtrans($1, { glance_api_initrc_exec_t glance_registry_initrc_exec_t })
 	domain_system_change_exemption($1)
-	role_transition $2 glance_registry_initrc_exec_t system_r;
+	role_transition $2 { glance_api_initrc_exec_t glance_registry_initrc_exec_t } system_r;
 	allow $2 system_r;
 
-	init_labeled_script_domtrans($1, glance_api_initrc_exec_t)
-	role_transition $2 glance_api_initrc_exec_t system_r;
-
 	logging_search_logs($1)
 	admin_pattern($1, glance_log_t)
 

diff --git a/policy/modules/contrib/glance.te b/policy/modules/contrib/glance.te
index 4afb81f..80ec70f 100644
--- a/policy/modules/contrib/glance.te
+++ b/policy/modules/contrib/glance.te
@@ -1,4 +1,4 @@
-policy_module(glance, 1.0.0)
+policy_module(glance, 1.0.1)
 
 ########################################
 #
@@ -38,7 +38,7 @@ files_pid_file(glance_var_run_t)
 
 #######################################
 #
-# glance general domain local policy
+# Common local policy
 #
 
 allow glance_domain self:fifo_file rw_fifo_file_perms;
@@ -46,7 +46,9 @@ allow glance_domain self:unix_stream_socket create_stream_socket_perms;
 allow glance_domain self:tcp_socket create_stream_socket_perms;
 
 manage_dirs_pattern(glance_domain, glance_log_t, glance_log_t)
-manage_files_pattern(glance_domain, glance_log_t, glance_log_t)
+append_files_pattern(glance_domain, glance_log_t, glance_log_t)
+create_files_pattern(glance_domain, glance_log_t, glance_log_t)
+setattr_files_pattern(glance_domain, glance_log_t, glance_log_t)
 
 manage_dirs_pattern(glance_domain, glance_var_lib_t, glance_var_lib_t)
 manage_files_pattern(glance_domain, glance_var_lib_t, glance_var_lib_t)
@@ -56,34 +58,49 @@ manage_files_pattern(glance_domain, glance_var_run_t, glance_var_run_t)
 
 kernel_read_system_state(glance_domain)
 
+corenet_all_recvfrom_unlabeled(glance_domain)
+corenet_all_recvfrom_netlabel(glance_domain)
+corenet_tcp_sendrecv_generic_if(glance_domain)
+corenet_tcp_sendrecv_generic_node(glance_domain)
+corenet_tcp_sendrecv_all_ports(glance_domain)
+corenet_tcp_bind_generic_node(glance_domain)
+
 corecmd_exec_bin(glance_domain)
+corecmd_exec_shell(glance_domain)
 
 dev_read_urand(glance_domain)
 
 files_read_etc_files(glance_domain)
 files_read_usr_files(glance_domain)
 
+libs_exec_ldconfig(glance_domain)
+
 miscfiles_read_localization(glance_domain)
 
-optional_policy(`
-	sysnet_dns_name_resolve(glance_domain)
-')
+sysnet_dns_name_resolve(glance_domain)
 
 ########################################
 #
-# glance-registry local policy
+# Registry local policy
 #
 
 manage_dirs_pattern(glance_registry_t, glance_registry_tmp_t, glance_registry_tmp_t)
 manage_files_pattern(glance_registry_t, glance_registry_tmp_t, glance_registry_tmp_t)
-files_tmp_filetrans(glance_registry_t, glance_registry_tmp_t, { file dir })
+files_tmp_filetrans(glance_registry_t, glance_registry_tmp_t, { dir file })
 
-corenet_tcp_bind_generic_node(glance_registry_t)
+corenet_sendrecv_glance_registry_server_packets(glance_registry_t)
 corenet_tcp_bind_glance_registry_port(glance_registry_t)
 
+logging_send_syslog_msg(glance_registry_t)
+
+optional_policy(`
+	mysql_stream_connect(glance_registry_t)
+	mysql_tcp_connect(glance_registry_t)
+')
+
 ########################################
 #
-# glance-api local policy
+# Api local policy
 #
 
 manage_dirs_pattern(glance_api_t, glance_tmp_t, glance_tmp_t)
@@ -91,14 +108,13 @@ manage_files_pattern(glance_api_t, glance_tmp_t, glance_tmp_t)
 files_tmp_filetrans(glance_api_t, glance_tmp_t, { dir file })
 can_exec(glance_api_t, glance_tmp_t)
 
-corecmd_exec_shell(glance_api_t)
+corenet_sendrecv_armtechdaemon_server_packets(glance_api_t)
+corenet_tcp_bind_armtechdaemon_port(glance_api_t)
 
-corenet_tcp_bind_generic_node(glance_api_t)
+corenet_sendrecv_hplip_server_packets(glance_api_t)
 corenet_tcp_bind_hplip_port(glance_api_t)
-corenet_tcp_connect_glance_registry_port(glance_api_t)
 
-dev_read_urand(glance_api_t)
+corenet_sendrecv_glance_registry_client_packets(glance_api_t)
+corenet_tcp_connect_glance_registry_port(glance_api_t)
 
 fs_getattr_xattr_fs(glance_api_t)
-
-libs_exec_ldconfig(glance_api_t)