[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     066a3a15354a32da9c52345cfa2a0b6a5d4026e7
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Sun Oct 28 12:51:30 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sun Oct 28 17:59:04 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=066a3a15

Changes to the soundserver policy module

Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/soundserver.fc |    3 ++-
 policy/modules/contrib/soundserver.if |   18 ++++++++++++------
 policy/modules/contrib/soundserver.te |   19 +++++++------------
 3 files changed, 21 insertions(+), 19 deletions(-)

diff --git a/policy/modules/contrib/soundserver.fc b/policy/modules/contrib/soundserver.fc
index 76d0f37..02c23b3 100644
--- a/policy/modules/contrib/soundserver.fc
+++ b/policy/modules/contrib/soundserver.fc
@@ -1,7 +1,8 @@
 /etc/nas(/.*)?	gen_context(system_u:object_r:soundd_etc_t,s0)
-/etc/rc\.d/init\.d/nasd	--	gen_context(system_u:object_r:soundd_initrc_exec_t,s0)
 /etc/yiff(/.*)?	gen_context(system_u:object_r:soundd_etc_t,s0)
 
+/etc/rc\.d/init\.d/nasd	--	gen_context(system_u:object_r:soundd_initrc_exec_t,s0)
+
 /usr/bin/nasd	--	gen_context(system_u:object_r:soundd_exec_t,s0)
 /usr/bin/gpe-soundserver	--	gen_context(system_u:object_r:soundd_exec_t,s0)
 

diff --git a/policy/modules/contrib/soundserver.if b/policy/modules/contrib/soundserver.if
index 93fe7bf..a5abc5a 100644
--- a/policy/modules/contrib/soundserver.if
+++ b/policy/modules/contrib/soundserver.if
@@ -16,8 +16,8 @@ interface(`soundserver_tcp_connect',`
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate 
-##	an soundd environment
+##	All of the rules required to
+##	administrate an soundd environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -26,16 +26,16 @@ interface(`soundserver_tcp_connect',`
 ## </param>
 ## <param name="role">
 ##	<summary>
-##	The role to be allowed to manage the soundd domain.
+##	Role allowed access.
 ##	</summary>
 ## </param>
 ## <rolecap/>
 #
 interface(`soundserver_admin',`
 	gen_require(`
-		type soundd_t, soundd_etc_t;
-		type soundd_tmp_t, soundd_var_run_t;
-		type soundd_initrc_exec_t;
+		type soundd_t, soundd_etc_t, soundd_initrc_exec_t;
+		type soundd_tmp_t, soundd_var_run_t, soundd_tmpfs_t;
+		type soundd_state_t;
 	')
 
 	allow $1 soundd_t:process { ptrace signal_perms };
@@ -52,6 +52,12 @@ interface(`soundserver_admin',`
 	files_list_tmp($1)
 	admin_pattern($1, soundd_tmp_t)
 
+	fs_list_tmpfs($1)
+	admin_pattern($1, soundd_tmpfs_t)
+
+	files_list_var($1)
+	admin_pattern($1, soundd_state_t)
+
 	files_list_pids($1)
 	admin_pattern($1, soundd_var_run_t)
 ')

diff --git a/policy/modules/contrib/soundserver.te b/policy/modules/contrib/soundserver.te
index 3217605..db1bc6f 100644
--- a/policy/modules/contrib/soundserver.te
+++ b/policy/modules/contrib/soundserver.te
@@ -1,4 +1,4 @@
-policy_module(soundserver, 1.8.0)
+policy_module(soundserver, 1.8.1)
 
 ########################################
 #
@@ -21,7 +21,6 @@ files_type(soundd_state_t)
 type soundd_tmp_t;
 files_tmp_file(soundd_tmp_t)
 
-# for yiff - probably need some rules for the client support too
 type soundd_tmpfs_t;
 files_tmpfs_file(soundd_tmpfs_t)
 
@@ -36,12 +35,10 @@ files_pid_file(soundd_var_run_t)
 allow soundd_t self:capability dac_override;
 dontaudit soundd_t self:capability sys_tty_config;
 allow soundd_t self:process { setpgid signal_perms };
+allow soundd_t self:shm create_shm_perms;
 allow soundd_t self:tcp_socket create_stream_socket_perms;
 allow soundd_t self:udp_socket create_socket_perms;
-allow soundd_t self:unix_stream_socket { connectto create_stream_socket_perms };
-
-# for yiff
-allow soundd_t self:shm create_shm_perms;
+allow soundd_t self:unix_stream_socket { accept connectto listen };
 
 read_files_pattern(soundd_t, soundd_etc_t, soundd_etc_t)
 read_lnk_files_pattern(soundd_t, soundd_etc_t, soundd_etc_t)
@@ -59,9 +56,9 @@ manage_fifo_files_pattern(soundd_t, soundd_tmpfs_t, soundd_tmpfs_t)
 manage_sock_files_pattern(soundd_t, soundd_tmpfs_t, soundd_tmpfs_t)
 fs_tmpfs_filetrans(soundd_t, soundd_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 
-manage_sock_files_pattern(soundd_t, soundd_var_run_t, soundd_var_run_t)
 manage_files_pattern(soundd_t, soundd_var_run_t, soundd_var_run_t)
 manage_dirs_pattern(soundd_t, soundd_var_run_t, soundd_var_run_t)
+manage_sock_files_pattern(soundd_t, soundd_var_run_t, soundd_var_run_t)
 files_pid_filetrans(soundd_t, soundd_var_run_t, { file dir })
 
 kernel_read_kernel_sysctls(soundd_t)
@@ -71,14 +68,12 @@ kernel_read_proc_symlinks(soundd_t)
 corenet_all_recvfrom_unlabeled(soundd_t)
 corenet_all_recvfrom_netlabel(soundd_t)
 corenet_tcp_sendrecv_generic_if(soundd_t)
-corenet_udp_sendrecv_generic_if(soundd_t)
 corenet_tcp_sendrecv_generic_node(soundd_t)
-corenet_udp_sendrecv_generic_node(soundd_t)
-corenet_tcp_sendrecv_all_ports(soundd_t)
-corenet_udp_sendrecv_all_ports(soundd_t)
 corenet_tcp_bind_generic_node(soundd_t)
-corenet_tcp_bind_soundd_port(soundd_t)
+
 corenet_sendrecv_soundd_server_packets(soundd_t)
+corenet_tcp_bind_soundd_port(soundd_t)
+corenet_tcp_sendrecv_soundd_port(soundd_t)
 
 dev_read_sysfs(soundd_t)
 dev_read_sound(soundd_t)