[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     cf4135ed179e1864d9251c9eb8a8c6e6c172b894
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Fri Sep 28 08:23:59 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Fri Sep 28 17:41:12 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=cf4135ed

Changes to the denyhosts policy module

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/denyhosts.fc |    8 +++++---
 policy/modules/contrib/denyhosts.if |   24 +++++++++---------------
 policy/modules/contrib/denyhosts.te |   24 ++++++++++++------------
 3 files changed, 26 insertions(+), 30 deletions(-)

diff --git a/policy/modules/contrib/denyhosts.fc b/policy/modules/contrib/denyhosts.fc
index 257fef6..89b0b77 100644
--- a/policy/modules/contrib/denyhosts.fc
+++ b/policy/modules/contrib/denyhosts.fc
@@ -1,7 +1,9 @@
 /etc/rc\.d/init\.d/denyhosts	--	gen_context(system_u:object_r:denyhosts_initrc_exec_t,s0)
 
-/usr/bin/denyhosts\.py		--	gen_context(system_u:object_r:denyhosts_exec_t,s0)
+/usr/bin/denyhosts\.py	--	gen_context(system_u:object_r:denyhosts_exec_t,s0)
+
+/var/lib/denyhosts(/.*)?	gen_context(system_u:object_r:denyhosts_var_lib_t,s0)
 
-/var/lib/denyhosts(/.*)?		gen_context(system_u:object_r:denyhosts_var_lib_t,s0)
 /var/lock/subsys/denyhosts	--	gen_context(system_u:object_r:denyhosts_var_lock_t,s0)
-/var/log/denyhosts(/.*)?		gen_context(system_u:object_r:denyhosts_var_log_t,s0)
+
+/var/log/denyhosts(/.*)?	gen_context(system_u:object_r:denyhosts_var_log_t,s0)

diff --git a/policy/modules/contrib/denyhosts.if b/policy/modules/contrib/denyhosts.if
index 567865f..a7326da 100644
--- a/policy/modules/contrib/denyhosts.if
+++ b/policy/modules/contrib/denyhosts.if
@@ -1,12 +1,4 @@
-## <summary>DenyHosts SSH dictionary attack mitigation</summary>
-## <desc>
-##	<p>
-##	DenyHosts is a script intended to be run by Linux
-##	system administrators to help thwart SSH server attacks
-##	(also known as dictionary based attacks and brute force
-##	attacks).
-##	</p>
-## </desc>
+## <summary>SSH dictionary attack mitigation.</summary>
 
 ########################################
 ## <summary>
@@ -18,17 +10,19 @@
 ## </summary>
 ## </param>
 #
-interface(`denyhosts_domtrans', `
+interface(`denyhosts_domtrans',`
 	gen_require(`
 		type denyhosts_t, denyhosts_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, denyhosts_exec_t, denyhosts_t)
 ')
 
 ########################################
 ## <summary>
-##	Execute denyhost server in the denyhost domain.
+##	Execute denyhost server in the
+##	denyhost domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -36,7 +30,7 @@ interface(`denyhosts_domtrans', `
 ##	</summary>
 ## </param>
 #
-interface(`denyhosts_initrc_domtrans', `
+interface(`denyhosts_initrc_domtrans',`
 	gen_require(`
 		type denyhosts_initrc_exec_t;
 	')
@@ -46,8 +40,8 @@ interface(`denyhosts_initrc_domtrans', `
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate
-##	an denyhosts environment.
+##	All of the rules required to
+##	administrate an denyhosts environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -60,7 +54,7 @@ interface(`denyhosts_initrc_domtrans', `
 ##	</summary>
 ## </param>
 #
-interface(`denyhosts_admin', `
+interface(`denyhosts_admin',`
 	gen_require(`
 		type denyhosts_t, denyhosts_var_lib_t, denyhosts_var_lock_t;
 		type denyhosts_var_log_t, denyhosts_initrc_exec_t;

diff --git a/policy/modules/contrib/denyhosts.te b/policy/modules/contrib/denyhosts.te
index 8ba9425..2c544f5 100644
--- a/policy/modules/contrib/denyhosts.te
+++ b/policy/modules/contrib/denyhosts.te
@@ -1,8 +1,8 @@
-policy_module(denyhosts, 1.0.0)
+policy_module(denyhosts, 1.0.1)
 
 ########################################
 #
-# DenyHosts personal declarations.
+# Declarations
 #
 
 type denyhosts_t;
@@ -23,15 +23,14 @@ logging_log_file(denyhosts_var_log_t)
 
 ########################################
 #
-# DenyHosts personal policy.
+# Local policy
 #
 
-allow denyhosts_t self:netlink_route_socket create_netlink_socket_perms;
-allow denyhosts_t self:tcp_socket create_socket_perms;
-allow denyhosts_t self:udp_socket create_socket_perms;
+allow denyhosts_t self:capability sys_tty_config;
+allow denyhosts_t self:fifo_file rw_fifo_file_perms;
+allow denyhosts_t self:netlink_route_socket nlmsg_write;
 
 manage_files_pattern(denyhosts_t, denyhosts_var_lib_t, denyhosts_var_lib_t)
-files_var_lib_filetrans(denyhosts_t, denyhosts_var_lib_t, file)
 
 manage_dirs_pattern(denyhosts_t, denyhosts_var_lock_t, denyhosts_var_lock_t)
 manage_files_pattern(denyhosts_t, denyhosts_var_lock_t, denyhosts_var_lock_t)
@@ -43,24 +42,25 @@ read_files_pattern(denyhosts_t, denyhosts_var_log_t, denyhosts_var_log_t)
 setattr_files_pattern(denyhosts_t, denyhosts_var_log_t, denyhosts_var_log_t)
 logging_log_filetrans(denyhosts_t, denyhosts_var_log_t, file)
 
+kernel_read_network_state(denyhosts_t)
 kernel_read_system_state(denyhosts_t)
 
 corecmd_exec_bin(denyhosts_t)
+corecmd_exec_shell(denyhosts_t)
 
 corenet_all_recvfrom_unlabeled(denyhosts_t)
 corenet_all_recvfrom_netlabel(denyhosts_t)
 corenet_tcp_sendrecv_generic_if(denyhosts_t)
 corenet_tcp_sendrecv_generic_node(denyhosts_t)
-corenet_tcp_bind_generic_node(denyhosts_t)
-corenet_tcp_connect_smtp_port(denyhosts_t)
+
 corenet_sendrecv_smtp_client_packets(denyhosts_t)
+corenet_tcp_connect_smtp_port(denyhosts_t)
+corenet_tcp_sendrecv_smtp_port(denyhosts_t)
 
 dev_read_urand(denyhosts_t)
 
-files_read_etc_files(denyhosts_t)
-
-# /var/log/secure
 logging_read_generic_logs(denyhosts_t)
+logging_send_syslog_msg(denyhosts_t)
 
 miscfiles_read_localization(denyhosts_t)