[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     69ad7c3bc5fc98a33968fe6b615e1b93ee66ccd7
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Fri Sep 28 10:59:44 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Fri Sep 28 17:48:13 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=69ad7c3b

Changes to the dmidecode policy module

Add a file context specification for biosdecode
Use role attributes
Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/dmidecode.fc |    2 +-
 policy/modules/contrib/dmidecode.if |   17 +++++++----------
 policy/modules/contrib/dmidecode.te |    8 +++++---
 3 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/policy/modules/contrib/dmidecode.fc b/policy/modules/contrib/dmidecode.fc
index 016e6b8..c394e45 100644
--- a/policy/modules/contrib/dmidecode.fc
+++ b/policy/modules/contrib/dmidecode.fc
@@ -1,4 +1,4 @@
-
+/usr/sbin/biosdecode	--	gen_context(system_u:object_r:dmidecode_exec_t,s0)
 /usr/sbin/dmidecode	--	gen_context(system_u:object_r:dmidecode_exec_t,s0)
 /usr/sbin/ownership	--	gen_context(system_u:object_r:dmidecode_exec_t,s0)
 /usr/sbin/vpddecode	--	gen_context(system_u:object_r:dmidecode_exec_t,s0)

diff --git a/policy/modules/contrib/dmidecode.if b/policy/modules/contrib/dmidecode.if
index 4bf435c..41c3f67 100644
--- a/policy/modules/contrib/dmidecode.if
+++ b/policy/modules/contrib/dmidecode.if
@@ -15,18 +15,15 @@ interface(`dmidecode_domtrans',`
 		type dmidecode_t, dmidecode_exec_t;
 	')
 
-	domain_auto_trans($1, dmidecode_exec_t, dmidecode_t)
-
-	allow $1 dmidecode_t:fd use;
-	allow dmidecode_t $1:fd use;
-	allow dmidecode_t $1:fifo_file rw_file_perms;
-	allow dmidecode_t $1:process sigchld;
+	corecmd_search_bin($1)
+	domtrans_pattern($1, dmidecode_exec_t, dmidecode_t)
 ')
 
 ########################################
 ## <summary>
-##	Execute dmidecode in the dmidecode domain, and
-##	allow the specified role the dmidecode domain.
+##	Execute dmidecode in the dmidecode
+##	domain, and allow the specified
+##	role the dmidecode domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -42,9 +39,9 @@ interface(`dmidecode_domtrans',`
 #
 interface(`dmidecode_run',`
 	gen_require(`
-		type dmidecode_t;
+		attribute_role dmidecode_roles;
 	')
 
 	dmidecode_domtrans($1)
-	role $2 types dmidecode_t;
+	roleattribute $2 dmidecode_roles;
 ')

diff --git a/policy/modules/contrib/dmidecode.te b/policy/modules/contrib/dmidecode.te
index d6356b5..c947c2c 100644
--- a/policy/modules/contrib/dmidecode.te
+++ b/policy/modules/contrib/dmidecode.te
@@ -1,14 +1,17 @@
-policy_module(dmidecode, 1.4.0)
+policy_module(dmidecode, 1.4.1)
 
 ########################################
 #
 # Declarations
 #
 
+attribute_role dmidecode_roles;
+roleattribute system_r dmidecode_roles;
+
 type dmidecode_t;
 type dmidecode_exec_t;
 application_domain(dmidecode_t, dmidecode_exec_t)
-role system_r types dmidecode_t;
+role dmidecode_roles types dmidecode_t;
 
 ########################################
 #
@@ -18,7 +21,6 @@ role system_r types dmidecode_t;
 allow dmidecode_t self:capability sys_rawio;
 
 dev_read_sysfs(dmidecode_t)
-# Allow dmidecode to read /dev/mem
 dev_read_raw_memory(dmidecode_t)
 
 mls_file_read_all_levels(dmidecode_t)