[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     4a815585fae5dadf09c49f99096f5c4b72a479d6
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Sat Nov 17 20:58:49 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Wed Nov 21 20:58:30 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=4a815585

Introduce dontaudit interfaces for leaked fd and unix stream sockets

The fail2ban application leaks file descriptors and unix stream sockets when it
invokes sendmail, so introduce the necessary dontaudit interfaces which will be
used in a later patch against the mta and postfix policies.

Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

---
 policy/modules/contrib/fail2ban.if |   38 ++++++++++++++++++++++++++++++++++++
 1 files changed, 38 insertions(+), 0 deletions(-)

diff --git a/policy/modules/contrib/fail2ban.if b/policy/modules/contrib/fail2ban.if
index 733a689..275fb9e 100644
--- a/policy/modules/contrib/fail2ban.if
+++ b/policy/modules/contrib/fail2ban.if
@@ -107,6 +107,44 @@ interface(`fail2ban_rw_inherited_tmp_files',`
 
 ########################################
 ## <summary>
+##	Do not audit attempts to use
+##	fail2ban file descriptors.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`fail2ban_dontaudit_use_fds',`
+	gen_require(`
+		type fail2ban_t;
+	')
+
+	dontaudit $1 fail2ban_t:fd use;
+')
+
+########################################
+## <summary>
+##	Do not audit read and write
+##	fail2ban unix stream sockets
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`fail2ban_dontaudit_rw_stream_sockets',`
+	gen_require(`
+		type fail2ban_t;
+	')
+
+	dontaudit $1 fail2ban_t:unix_stream_socket { read write };
+')
+
+########################################
+## <summary>
 ##	Read and write fail2ban unix
 ##	stream sockets.
 ## </summary>