Gentoo Archives: gentoo-commits

From: Jason Zaman <perfinion@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] proj/hardened-refpolicy:next commit in: policy/modules/contrib/
Date: Mon, 03 Oct 2016 06:27:03
Message-Id: 1475475213.fa460d674228cdbe2e16cd33b5b5d83c85e72008.perfinion@gentoo
1 commit: fa460d674228cdbe2e16cd33b5b5d83c85e72008
2 Author: Guido Trentalancia via refpolicy <refpolicy <AT> oss <DOT> tresys <DOT> com>
3 AuthorDate: Mon Sep 19 11:15:44 2016 +0000
4 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
5 CommitDate: Mon Oct 3 06:13:33 2016 +0000
6 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=fa460d67
7
8 gnome: add support for the OIL Runtime Compiler (ORC) optimized code execution
9
10 Add a new gstreamer_orcexec_t type and file context to the gnome
11 module in order to support the OIL Runtime Compiler (ORC) optimized
12 code execution (used for example by pulseaudio).
13
14 Add optional policy to the pulseaudio module to support the ORC
15 optimized code execution.
16
17 This patch has been anticipated a few weeks ago as part of a
18 larger gnome patch. It has now been split as a smaller patch,
19 as required.
20
21 Signed-off-by: Guido Trentalancia <guido <AT> trentalancia.net>
22
23 policy/modules/contrib/gnome.fc | 4 ++
24 policy/modules/contrib/gnome.if | 98 ++++++++++++++++++++++++++++++++++++
25 policy/modules/contrib/gnome.te | 3 ++
26 policy/modules/contrib/pulseaudio.te | 6 +++
27 4 files changed, 111 insertions(+)
28
29 diff --git a/policy/modules/contrib/gnome.fc b/policy/modules/contrib/gnome.fc
30 index 31d8c6c..ce12193 100644
31 --- a/policy/modules/contrib/gnome.fc
32 +++ b/policy/modules/contrib/gnome.fc
33 @@ -7,6 +7,8 @@ HOME_DIR/\.gnome2(/.*)? gen_context(system_u:object_r:gnome_home_t,s0)
34 HOME_DIR/\.gnome2/keyrings(/.*)? gen_context(system_u:object_r:gnome_keyring_home_t,s0)
35 HOME_DIR/\.gnome2_private(/.*)? gen_context(system_u:object_r:gnome_home_t,s0)
36
37 +HOME_DIR/orcexec\..* gen_context(system_u:object_r:gstreamer_orcexec_t,s0)
38 +
39 /etc/gconf(/.*)? gen_context(system_u:object_r:gconf_etc_t,s0)
40
41 /tmp/gconfd-USER/.* -- gen_context(system_u:object_r:gconf_tmp_t,s0)
42 @@ -16,6 +18,8 @@ HOME_DIR/\.gnome2_private(/.*)? gen_context(system_u:object_r:gnome_home_t,s0)
43 /usr/lib/[^/]*/gconf/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0)
44 /usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0)
45
46 +/var/run/user/[^/]*/orcexec\..* -- gen_context(system_u:object_r:gstreamer_orcexec_t,s0)
47 +/var/run/user/%{USERID}/orcexec\..* -- gen_context(system_u:object_r:gstreamer_orcexec_t,s0)
48
49 ifdef(`distro_gentoo',`
50 HOME_DIR/\.config/dconf(/.*)? gen_context(system_u:object_r:gnome_xdg_config_home_t,s0)
51
52 diff --git a/policy/modules/contrib/gnome.if b/policy/modules/contrib/gnome.if
53 index cad0e95..190fa16 100644
54 --- a/policy/modules/contrib/gnome.if
55 +++ b/policy/modules/contrib/gnome.if
56 @@ -610,6 +610,66 @@ interface(`gnome_gconf_home_filetrans',`
57
58 ########################################
59 ## <summary>
60 +## Create objects in user home
61 +## directories with the gstreamer
62 +## orcexec type.
63 +## </summary>
64 +## <param name="domain">
65 +## <summary>
66 +## Domain allowed access.
67 +## </summary>
68 +## </param>
69 +## <param name="object_class">
70 +## <summary>
71 +## Class of the object being created.
72 +## </summary>
73 +## </param>
74 +## <param name="name" optional="true">
75 +## <summary>
76 +## The name of the object being created.
77 +## </summary>
78 +## </param>
79 +#
80 +interface(`gnome_user_home_dir_filetrans_gstreamer_orcexec',`
81 + gen_require(`
82 + type gstreamer_orcexec_t;
83 + ')
84 +
85 + userdom_user_home_dir_filetrans($1, gstreamer_orcexec_t, $2, $3)
86 +')
87 +
88 +########################################
89 +## <summary>
90 +## Create objects in the user
91 +## runtime directories with the
92 +## gstreamer orcexec type.
93 +## </summary>
94 +## <param name="domain">
95 +## <summary>
96 +## Domain allowed access.
97 +## </summary>
98 +## </param>
99 +## <param name="object_class">
100 +## <summary>
101 +## Class of the object being created.
102 +## </summary>
103 +## </param>
104 +## <param name="name" optional="true">
105 +## <summary>
106 +## The name of the object being created.
107 +## </summary>
108 +## </param>
109 +#
110 +interface(`gnome_user_runtime_filetrans_gstreamer_orcexec',`
111 + gen_require(`
112 + type gstreamer_orcexec_t;
113 + ')
114 +
115 + userdom_user_runtime_filetrans($1, gstreamer_orcexec_t, $2, $3)
116 +')
117 +
118 +########################################
119 +## <summary>
120 ## Read generic gnome keyring home files.
121 ## </summary>
122 ## <param name="domain">
123 @@ -764,3 +824,41 @@ interface(`gnome_dbus_chat_gconfd',`
124 allow $1 gconfd_t:dbus send_msg;
125 allow gconfd_t $1:dbus send_msg;
126 ')
127 +
128 +########################################
129 +## <summary>
130 +## Manage gstreamer ORC optimized
131 +## code.
132 +## </summary>
133 +## <param name="domain">
134 +## <summary>
135 +## Domain allowed access.
136 +## </summary>
137 +## </param>
138 +#
139 +interface(`gnome_manage_gstreamer_orcexec',`
140 + gen_require(`
141 + type gstreamer_orcexec_t;
142 + ')
143 +
144 + allow $1 gstreamer_orcexec_t:file manage_file_perms;
145 +')
146 +
147 +########################################
148 +## <summary>
149 +## Mmap gstreamer ORC optimized
150 +## code.
151 +## </summary>
152 +## <param name="domain">
153 +## <summary>
154 +## Domain allowed access.
155 +## </summary>
156 +## </param>
157 +#
158 +interface(`gnome_mmap_gstreamer_orcexec',`
159 + gen_require(`
160 + type gstreamer_orcexec_t;
161 + ')
162 +
163 + allow $1 gstreamer_orcexec_t:file mmap_file_perms;
164 +')
165
166 diff --git a/policy/modules/contrib/gnome.te b/policy/modules/contrib/gnome.te
167 index dd6ac04..8c79849 100644
168 --- a/policy/modules/contrib/gnome.te
169 +++ b/policy/modules/contrib/gnome.te
170 @@ -46,6 +46,9 @@ userdom_user_home_content(gnome_keyring_home_t)
171 type gnome_keyring_tmp_t;
172 userdom_user_tmp_file(gnome_keyring_tmp_t)
173
174 +type gstreamer_orcexec_t;
175 +application_executable_file(gstreamer_orcexec_t)
176 +
177 ##############################
178 #
179 # Common local Policy
180
181 diff --git a/policy/modules/contrib/pulseaudio.te b/policy/modules/contrib/pulseaudio.te
182 index 214e9c6..7f30a72 100644
183 --- a/policy/modules/contrib/pulseaudio.te
184 +++ b/policy/modules/contrib/pulseaudio.te
185 @@ -193,6 +193,12 @@ optional_policy(`
186
187 optional_policy(`
188 gnome_stream_connect_gconf(pulseaudio_t)
189 +
190 + # OIL Runtime Compiler (ORC) optimized code execution
191 + gnome_manage_gstreamer_orcexec(pulseaudio_t)
192 + gnome_mmap_gstreamer_orcexec(pulseaudio_t)
193 + gnome_user_runtime_filetrans_gstreamer_orcexec(pulseaudio_t, file)
194 + gnome_user_home_dir_filetrans_gstreamer_orcexec(pulseaudio_t, file)
195 ')
196
197 optional_policy(`