[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     3dbe6163a8b3ab83434e60fdd2e5a3994db39c30
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Mon Oct 29 12:33:59 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Oct 29 14:51:35 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=3dbe6163

Changes to the thunderbird policy module

Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/thunderbird.fc |    7 +-
 policy/modules/contrib/thunderbird.if |   44 +++++------
 policy/modules/contrib/thunderbird.te |  130 +++++++++++---------------------
 3 files changed, 67 insertions(+), 114 deletions(-)

diff --git a/policy/modules/contrib/thunderbird.fc b/policy/modules/contrib/thunderbird.fc
index 26c381c..c01805a 100644
--- a/policy/modules/contrib/thunderbird.fc
+++ b/policy/modules/contrib/thunderbird.fc
@@ -1,6 +1,3 @@
-#
-# /usr
-#
-/usr/bin/thunderbird.*	--	gen_context(system_u:object_r:thunderbird_exec_t,s0)
-
 HOME_DIR/\.thunderbird(/.*)?	gen_context(system_u:object_r:thunderbird_home_t,s0)
+
+/usr/bin/thunderbird.*	--	gen_context(system_u:object_r:thunderbird_exec_t,s0)

diff --git a/policy/modules/contrib/thunderbird.if b/policy/modules/contrib/thunderbird.if
index a76e9f9..9c5f0b9 100644
--- a/policy/modules/contrib/thunderbird.if
+++ b/policy/modules/contrib/thunderbird.if
@@ -1,52 +1,47 @@
-## <summary>Thunderbird email client</summary>
+## <summary>Thunderbird email client.</summary>
 
 ########################################
 ## <summary>
-##	Role access for thunderbird
+##	Role access for thunderbird.
 ## </summary>
 ## <param name="role">
 ##	<summary>
-##	Role allowed access
+##	Role allowed access.
 ##	</summary>
 ## </param>
 ## <param name="domain">
 ##	<summary>
-##	User domain for the role
+##	User domain for the role.
 ##	</summary>
 ## </param>
 #
 interface(`thunderbird_role',`
 	gen_require(`
-		type thunderbird_t, thunderbird_exec_t;
-		type thunderbird_home_t, thunderbird_tmpfs_t;
+		attribute_role thunderbird_roles;
+		type thunderbird_t, thunderbird_exec_t, thunderbird_home_t;
+		type thunderbird_tmpfs_t;
 	')
 
-	role $1 types thunderbird_t;
+	roleattribute $1 thunderbird_roles;
+
+	domtrans_pattern($2, thunderbird_exec_t, thunderbird_t)
+
+	stream_connect_pattern($2, thunderbird_tmpfs_t, thunderbird_tmpfs_t, thunderbird_t)
 
-	domain_auto_trans($2, thunderbird_exec_t, thunderbird_t)
-	allow $2 thunderbird_t:fd use;
-	allow $2 thunderbird_t:shm { associate getattr };
-	allow $2 thunderbird_t:unix_stream_socket connectto;
-	allow thunderbird_t $2:fd use;
-	allow thunderbird_t $2:process sigchld;
 	allow thunderbird_t $2:unix_stream_socket connectto;
 
-	# allow ps to show thunderbird and allow the user to kill it 
+	allow $2 thunderbird_t:process { ptrace signal_perms };
 	ps_process_pattern($2, thunderbird_t)
-	allow $2 thunderbird_t:process signal;
-
-	# Access ~/.thunderbird
-	manage_dirs_pattern($2, thunderbird_home_t, thunderbird_home_t)
-	manage_files_pattern($2, thunderbird_home_t, thunderbird_home_t)
-	manage_lnk_files_pattern($2, thunderbird_home_t, thunderbird_home_t)
-	relabel_dirs_pattern($2, thunderbird_home_t, thunderbird_home_t)
-	relabel_files_pattern($2, thunderbird_home_t, thunderbird_home_t)
-	relabel_lnk_files_pattern($2, thunderbird_home_t, thunderbird_home_t)
+
+	allow $2 thunderbird_home_t:dir { manage_dir_perms relabel_dir_perms };
+	allow $2 thunderbird_home_t:file { manage_file_perms relabel_file_perms };
+	allow $2 thunderbird_home_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
+	userdom_user_home_dir_filetrans($2, thunderbird_home_t, dir, ".thunderbird")
 ')
 
 ########################################
 ## <summary>
-##	Run thunderbird in the user thunderbird domain.
+##	Execute thunderbird in the thunderbird domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -59,5 +54,6 @@ interface(`thunderbird_domtrans',`
 		type thunderbird_t, thunderbird_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, thunderbird_exec_t, thunderbird_t)
 ')

diff --git a/policy/modules/contrib/thunderbird.te b/policy/modules/contrib/thunderbird.te
index 1b9daf7..4257ede 100644
--- a/policy/modules/contrib/thunderbird.te
+++ b/policy/modules/contrib/thunderbird.te
@@ -1,15 +1,18 @@
-policy_module(thunderbird, 2.3.3)
+policy_module(thunderbird, 2.3.4)
 
 ########################################
 #
 # Declarations
 #
 
+attribute_role thunderbird_roles;
+
 type thunderbird_t;
 type thunderbird_exec_t;
 typealias thunderbird_t alias { user_thunderbird_t staff_thunderbird_t sysadm_thunderbird_t };
 typealias thunderbird_t alias { auditadm_thunderbird_t secadm_thunderbird_t };
 userdom_user_application_domain(thunderbird_t, thunderbird_exec_t)
+role thunderbird_roles types thunderbird_t;
 
 type thunderbird_home_t;
 typealias thunderbird_home_t alias { user_thunderbird_home_t staff_thunderbird_home_t sysadm_thunderbird_home_t };
@@ -28,17 +31,15 @@ userdom_user_tmpfs_file(thunderbird_tmpfs_t)
 
 allow thunderbird_t self:capability sys_nice;
 allow thunderbird_t self:process { signal_perms setsched getsched execheap execmem execstack };
-allow thunderbird_t self:fifo_file { ioctl read write getattr };
-allow thunderbird_t self:unix_dgram_socket { create connect };
-allow thunderbird_t self:unix_stream_socket { create accept connect write getattr read listen bind };
-allow thunderbird_t self:tcp_socket create_socket_perms;
-allow thunderbird_t self:shm { read write create destroy unix_read unix_write };
+allow thunderbird_t self:fifo_file rw_fifo_file_perms;
+allow thunderbird_t self:unix_dgram_socket create_socket_perms;
+allow thunderbird_t self:unix_stream_socket create_stream_socket_perms;
+allow thunderbird_t self:shm create_shm_perms;
 
-# Access ~/.thunderbird
 manage_dirs_pattern(thunderbird_t, thunderbird_home_t, thunderbird_home_t)
 manage_files_pattern(thunderbird_t, thunderbird_home_t, thunderbird_home_t)
 manage_lnk_files_pattern(thunderbird_t, thunderbird_home_t, thunderbird_home_t)
-userdom_search_user_home_dirs(thunderbird_t)
+userdom_user_home_dir_filetrans(thunderbird_t, thunderbird_home_t, dir, ".thunderbird")
 
 manage_files_pattern(thunderbird_t, thunderbird_tmpfs_t, thunderbird_tmpfs_t)
 manage_lnk_files_pattern(thunderbird_t, thunderbird_tmpfs_t, thunderbird_tmpfs_t)
@@ -46,43 +47,42 @@ manage_fifo_files_pattern(thunderbird_t, thunderbird_tmpfs_t, thunderbird_tmpfs_
 manage_sock_files_pattern(thunderbird_t, thunderbird_tmpfs_t, thunderbird_tmpfs_t)
 fs_tmpfs_filetrans(thunderbird_t, thunderbird_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
 
-# Allow netstat
 kernel_read_network_state(thunderbird_t)
 kernel_read_net_sysctls(thunderbird_t)
 kernel_read_system_state(thunderbird_t)
 
-# Startup shellscript
 corecmd_exec_shell(thunderbird_t)
 
 corenet_all_recvfrom_unlabeled(thunderbird_t)
 corenet_all_recvfrom_netlabel(thunderbird_t)
 corenet_tcp_sendrecv_generic_if(thunderbird_t)
 corenet_tcp_sendrecv_generic_node(thunderbird_t)
-corenet_tcp_sendrecv_ipp_port(thunderbird_t)
-corenet_tcp_sendrecv_ldap_port(thunderbird_t)
-corenet_tcp_sendrecv_innd_port(thunderbird_t)
-corenet_tcp_sendrecv_smtp_port(thunderbird_t)
-corenet_tcp_sendrecv_pop_port(thunderbird_t)
-corenet_tcp_sendrecv_http_port(thunderbird_t)
-corenet_tcp_connect_ipp_port(thunderbird_t)
-corenet_tcp_connect_ldap_port(thunderbird_t)
-corenet_tcp_connect_innd_port(thunderbird_t)
-corenet_tcp_connect_smtp_port(thunderbird_t)
-corenet_tcp_connect_pop_port(thunderbird_t)
-corenet_tcp_connect_http_port(thunderbird_t)
+
 corenet_sendrecv_ipp_client_packets(thunderbird_t)
-corenet_sendrecv_ldap_client_packets(thunderbird_t)
+corenet_tcp_connect_ipp_port(thunderbird_t)
+corenet_tcp_sendrecv_ipp_port(thunderbird_t)
+
 corenet_sendrecv_innd_client_packets(thunderbird_t)
+corenet_tcp_connect_innd_port(thunderbird_t)
+corenet_tcp_sendrecv_innd_port(thunderbird_t)
+
 corenet_sendrecv_smtp_client_packets(thunderbird_t)
+corenet_tcp_connect_smtp_port(thunderbird_t)
+corenet_tcp_sendrecv_smtp_port(thunderbird_t)
+
 corenet_sendrecv_pop_client_packets(thunderbird_t)
+corenet_tcp_connect_pop_port(thunderbird_t)
+corenet_tcp_sendrecv_pop_port(thunderbird_t)
+
 corenet_sendrecv_http_client_packets(thunderbird_t)
+corenet_tcp_connect_http_port(thunderbird_t)
+corenet_tcp_sendrecv_http_port(thunderbird_t)
 
 dev_read_urand(thunderbird_t)
 dev_dontaudit_search_sysfs(thunderbird_t)
 
 files_list_tmp(thunderbird_t)
 files_read_usr_files(thunderbird_t)
-files_read_etc_files(thunderbird_t)
 files_read_etc_runtime_files(thunderbird_t)
 files_read_var_files(thunderbird_t)
 files_read_var_symlinks(thunderbird_t)
@@ -91,9 +91,8 @@ files_dontaudit_getattr_boot_dirs(thunderbird_t)
 files_dontaudit_getattr_lost_found_dirs(thunderbird_t)
 files_dontaudit_search_mnt(thunderbird_t)
 
-fs_getattr_xattr_fs(thunderbird_t)
+fs_getattr_all_fs(thunderbird_t)
 fs_list_inotifyfs(thunderbird_t)
-# Access ~/.thunderbird
 fs_search_auto_mountpoints(thunderbird_t)
 
 auth_use_nsswitch(thunderbird_t)
@@ -101,17 +100,19 @@ auth_use_nsswitch(thunderbird_t)
 miscfiles_read_fonts(thunderbird_t)
 miscfiles_read_localization(thunderbird_t)
 
+userdom_write_user_tmp_sockets(thunderbird_t)
+
 userdom_manage_user_tmp_dirs(thunderbird_t)
-userdom_read_user_tmp_files(thunderbird_t)
-userdom_manage_user_tmp_sockets(thunderbird_t)
-# .kde/....gtkrc
-userdom_read_user_home_content_files(thunderbird_t)
+userdom_manage_user_tmp_files(thunderbird_t)
+
+userdom_manage_user_home_content_dirs(thunderbird_t)
+userdom_manage_user_home_content_files(thunderbird_t)
+userdom_user_home_dir_filetrans_user_home_content(thunderbird_t, { dir file })
 
 xserver_user_x_domain_template(thunderbird, thunderbird_t, thunderbird_tmpfs_t)
 xserver_read_xdm_tmp_files(thunderbird_t)
 xserver_dontaudit_getattr_xdm_tmp_sockets(thunderbird_t)
 
-# Access ~/.thunderbird
 tunable_policy(`use_nfs_home_dirs',`
 	fs_manage_nfs_dirs(thunderbird_t)
 	fs_manage_nfs_files(thunderbird_t)
@@ -124,67 +125,27 @@ tunable_policy(`use_samba_home_dirs',`
 	fs_manage_cifs_symlinks(thunderbird_t)
 ')
 
-tunable_policy(`mail_read_content && use_nfs_home_dirs',`
-	files_list_home(thunderbird_t)
-
-	fs_list_auto_mountpoints(thunderbird_t)
-	fs_read_nfs_files(thunderbird_t)
-	fs_read_nfs_symlinks(thunderbird_t)
-',`
-	files_dontaudit_list_home(thunderbird_t)
-
-	fs_dontaudit_list_auto_mountpoints(thunderbird_t)
-	fs_dontaudit_list_nfs(thunderbird_t)
-	fs_dontaudit_read_nfs_files(thunderbird_t)
-')
-
-tunable_policy(`mail_read_content && use_samba_home_dirs',`
-	files_list_home(thunderbird_t)
-
-	fs_list_auto_mountpoints(thunderbird_t)
-	fs_read_cifs_files(thunderbird_t)
-	fs_read_cifs_symlinks(thunderbird_t)
-',`
-	files_dontaudit_list_home(thunderbird_t)
-
-	fs_dontaudit_list_auto_mountpoints(thunderbird_t)
-	fs_dontaudit_read_cifs_files(thunderbird_t)
-	fs_dontaudit_list_cifs(thunderbird_t)
-')
-
-tunable_policy(`mail_read_content',`
-	userdom_list_user_tmp(thunderbird_t)
-	userdom_read_user_tmp_files(thunderbird_t)
-	userdom_read_user_tmp_symlinks(thunderbird_t)
-	userdom_search_user_home_dirs(thunderbird_t)
-	userdom_read_user_home_content_files(thunderbird_t)
-
-	ifndef(`enable_mls',`
-		fs_search_removable(thunderbird_t)
-		fs_read_removable_files(thunderbird_t)
-		fs_read_removable_symlinks(thunderbird_t)
-	')
-',`
-	files_dontaudit_list_tmp(thunderbird_t)
-	files_dontaudit_list_home(thunderbird_t)
-
-	fs_dontaudit_list_removable(thunderbird_t)
-	fs_dontaudit_read_removable_files(thunderbird_t)
-
-	userdom_dontaudit_list_user_tmp(thunderbird_t)
-	userdom_dontaudit_read_user_tmp_files(thunderbird_t)
-	userdom_dontaudit_list_user_home_dirs(thunderbird_t)
-	userdom_dontaudit_read_user_home_content_files(thunderbird_t)
+ifndef(`enable_mls',`
+	fs_search_removable(thunderbird_t)
+	fs_read_removable_files(thunderbird_t)
+	fs_read_removable_symlinks(thunderbird_t)
 ')
 
 optional_policy(`
 	dbus_system_bus_client(thunderbird_t)
 	dbus_all_session_bus_client(thunderbird_t)
+
+	optional_policy(`
+		cups_dbus_chat(thunderbird_t)
+	')
+
+	optional_policy(`
+		mozilla_dbus_chat(thunderbird_t)
+	')
 ')
 
 optional_policy(`
 	cups_read_rw_config(thunderbird_t)
-	cups_dbus_chat(thunderbird_t)
 ')
 
 optional_policy(`
@@ -198,11 +159,10 @@ optional_policy(`
 ')
 
 optional_policy(`
-	lpd_domtrans_lpr(thunderbird_t)
+	lpd_run_lpr(thunderbird_t, thunderbird_roles)
 ')
 
 optional_policy(`
 	mozilla_read_user_home_files(thunderbird_t)
 	mozilla_domtrans(thunderbird_t)
-	mozilla_dbus_chat(thunderbird_t)
 ')