[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     2828363665ab635a1b6f909e3a7dd99fe9a4c60c
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Mon Oct 29 09:42:58 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Oct 29 14:48:44 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=28283636

Changes to the sysstat policy module

Ported from Fedora with changes
Add init script file
Add sysstat_admin()

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/sysstat.fc |    3 ++
 policy/modules/contrib/sysstat.if |   39 +++++++++++++++++++++++++++++++++++-
 policy/modules/contrib/sysstat.te |   31 ++++++++++++++---------------
 3 files changed, 55 insertions(+), 18 deletions(-)

diff --git a/policy/modules/contrib/sysstat.fc b/policy/modules/contrib/sysstat.fc
index b1b97d4..b660cfc 100644
--- a/policy/modules/contrib/sysstat.fc
+++ b/policy/modules/contrib/sysstat.fc
@@ -1,3 +1,6 @@
+/etc/rc\.d/init\.d/sysstat	--	gen_context(system_u:object_r:sysstat_initrc_exec_t,s0)
+
+/opt/sartest(/.*)?	gen_context(system_u:object_r:sysstat_log_t,s0)
 
 /usr/lib/atsar/atsa.*	--	gen_context(system_u:object_r:sysstat_exec_t,s0)
 /usr/lib/sa/sa.*	--	gen_context(system_u:object_r:sysstat_exec_t,s0)

diff --git a/policy/modules/contrib/sysstat.if b/policy/modules/contrib/sysstat.if
index 7a23b3b..14ae3f2 100644
--- a/policy/modules/contrib/sysstat.if
+++ b/policy/modules/contrib/sysstat.if
@@ -1,8 +1,9 @@
-## <summary>Policy for sysstat. Reports on various system states</summary>
+## <summary>Reports on various system states.</summary>
 
 ########################################
 ## <summary>
-##	Manage sysstat logs.
+##	Create, read, write, and delete
+##	sysstat log files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -19,3 +20,37 @@ interface(`sysstat_manage_log',`
 	logging_search_logs($1)
 	manage_files_pattern($1, sysstat_log_t, sysstat_log_t)
 ')
+
+########################################
+## <summary>
+##	All of the rules required to
+##	administrate an sysstat environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`sysstat_admin',`
+	gen_require(`
+		type sysstat_t, sysstat_initrc_exec_t, sysstat_log_t;
+	')
+
+	allow $1 sysstat_t:process { ptrace signal_perms };
+	ps_process_pattern($1, sysstat_t)
+
+	init_labeled_script_domtrans($1, sysstat_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 sysstat_initrc_exec_t system_r;
+	allow $2 system_r;
+
+	logging_search_logs($1)
+	admin_pattern($1, sysstat_log_t)
+')

diff --git a/policy/modules/contrib/sysstat.te b/policy/modules/contrib/sysstat.te
index 0ecd8a7..c8b80b2 100644
--- a/policy/modules/contrib/sysstat.te
+++ b/policy/modules/contrib/sysstat.te
@@ -1,4 +1,4 @@
-policy_module(sysstat, 1.7.0)
+policy_module(sysstat, 1.7.1)
 
 ########################################
 #
@@ -8,7 +8,9 @@ policy_module(sysstat, 1.7.0)
 type sysstat_t;
 type sysstat_exec_t;
 init_system_domain(sysstat_t, sysstat_exec_t)
-role system_r types sysstat_t;
+
+type sysstat_initrc_exec_t;
+init_script_file(sysstat_initrc_exec_t)
 
 type sysstat_log_t;
 logging_log_file(sysstat_log_t)
@@ -18,18 +20,18 @@ logging_log_file(sysstat_log_t)
 # Local policy
 #
 
-allow sysstat_t self:capability { dac_override sys_resource sys_tty_config };
-dontaudit sysstat_t self:capability sys_admin;
+allow sysstat_t self:capability { dac_override sys_admin sys_resource sys_tty_config };
 allow sysstat_t self:fifo_file rw_fifo_file_perms;
 
-can_exec(sysstat_t, sysstat_exec_t)
-
 manage_dirs_pattern(sysstat_t,sysstat_log_t,sysstat_log_t)
-manage_files_pattern(sysstat_t, sysstat_log_t, sysstat_log_t)
+append_files_pattern(sysstat_t, sysstat_log_t, sysstat_log_t)
+create_files_pattern(sysstat_t, sysstat_log_t, sysstat_log_t)
+setattr_files_pattern(sysstat_t, sysstat_log_t, sysstat_log_t)
 manage_lnk_files_pattern(sysstat_t,sysstat_log_t,sysstat_log_t)
 logging_log_filetrans(sysstat_t, sysstat_log_t, { file dir })
 
-# get info from /proc
+can_exec(sysstat_t, sysstat_exec_t)
+
 kernel_read_system_state(sysstat_t)
 kernel_read_network_state(sysstat_t)
 kernel_read_kernel_sysctls(sysstat_t)
@@ -38,14 +40,11 @@ kernel_read_rpc_sysctls(sysstat_t)
 
 corecmd_exec_bin(sysstat_t)
 
-dev_read_urand(sysstat_t)
 dev_read_sysfs(sysstat_t)
+dev_read_urand(sysstat_t)
 
 files_search_var(sysstat_t)
-# for mtab
 files_read_etc_runtime_files(sysstat_t)
-#for fstab
-files_read_etc_files(sysstat_t)
 
 fs_getattr_xattr_fs(sysstat_t)
 fs_list_inotifyfs(sysstat_t)
@@ -53,10 +52,14 @@ fs_list_inotifyfs(sysstat_t)
 term_use_console(sysstat_t)
 term_use_all_terms(sysstat_t)
 
+auth_use_nsswitch(sysstat_t)
+
 init_use_fds(sysstat_t)
 
 locallogin_use_fds(sysstat_t)
 
+logging_send_syslog_msg(sysstat_t)
+
 miscfiles_read_localization(sysstat_t)
 
 userdom_dontaudit_list_user_home_dirs(sysstat_t)
@@ -64,7 +67,3 @@ userdom_dontaudit_list_user_home_dirs(sysstat_t)
 optional_policy(`
 	cron_system_entry(sysstat_t, sysstat_exec_t)
 ')
-
-optional_policy(`
-	logging_send_syslog_msg(sysstat_t)
-')