[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/

[Sven Vermeulen]

commit:     dd062fb88bc26fdc9d657dc32bb23b269fac67df
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Sat Dec 29 15:50:11 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sat Dec 29 15:50:11 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=dd062fb8

Move majority of gentoo specifics downwards

---
 policy/modules/system/init.te |   69 ++++++++++++++++++++++++++--------------
 1 files changed, 45 insertions(+), 24 deletions(-)

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index e71d117..a37147f 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -29,7 +29,7 @@ attribute init_run_all_scripts_domain;
 # Mark process types as daemons
 attribute daemon;
 
-# Mark file as daemon run dir
+# Mark file type as a daemon run directory
 attribute daemonrundir;
 
 #
@@ -122,7 +122,6 @@ dev_filetrans(init_t, initctl_t, fifo_file)
 
 # Modify utmp.
 allow init_t initrc_var_run_t:file { rw_file_perms setattr };
-manage_dirs_pattern(initrc_t, initrc_var_run_t, initrc_var_run_t)
 
 kernel_read_system_state(init_t)
 kernel_share_state(init_t)
@@ -226,7 +225,7 @@ optional_policy(`
 #
 
 allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
-allow initrc_t self:capability ~{ sys_module };
+allow initrc_t self:capability ~{ sys_admin sys_module };
 dontaudit initrc_t self:capability sys_module; # sysctl is triggering this
 allow initrc_t self:passwd rootok;
 allow initrc_t self:key manage_key_perms;
@@ -257,7 +256,7 @@ manage_lnk_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
 manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
 
 allow initrc_t initrc_var_run_t:file manage_file_perms;
-files_pid_filetrans(initrc_t, initrc_var_run_t, { file dir })
+files_pid_filetrans(initrc_t, initrc_var_run_t, file)
 
 can_exec(initrc_t, initrc_tmp_t)
 manage_files_pattern(initrc_t, initrc_tmp_t, initrc_tmp_t)
@@ -287,7 +286,6 @@ files_create_lock_dirs(initrc_t)
 files_pid_filetrans_lock_dir(initrc_t, "lock")
 files_read_kernel_symbol_table(initrc_t)
 files_setattr_lock_dirs(initrc_t)
-files_dontaudit_write_usr_dirs(initrc_t)
 
 corecmd_exec_all_executables(initrc_t)
 
@@ -308,7 +306,6 @@ dev_write_kmsg(initrc_t)
 dev_write_rand(initrc_t)
 dev_write_urand(initrc_t)
 dev_rw_sysfs(initrc_t)
-dev_manage_sysfs_dirs(initrc_t)
 dev_list_usbfs(initrc_t)
 dev_read_framebuffer(initrc_t)
 dev_write_framebuffer(initrc_t)
@@ -348,7 +345,6 @@ files_getattr_all_files(initrc_t)
 files_getattr_all_symlinks(initrc_t)
 files_getattr_all_pipes(initrc_t)
 files_getattr_all_sockets(initrc_t)
-files_create_pid_dirs(initrc_t)
 files_purge_tmp(initrc_t)
 files_delete_all_locks(initrc_t)
 files_read_all_pids(initrc_t)
@@ -367,11 +363,8 @@ files_list_isid_type_dirs(initrc_t)
 files_mounton_isid_type_dirs(initrc_t)
 files_list_default(initrc_t)
 files_mounton_default(initrc_t)
-files_manage_generic_tmp_files(initrc_t)
-files_manage_generic_tmp_dirs(initrc_t)
 
-fs_manage_cgroup_dirs(initrc_t)
-fs_manage_cgroup_files(initrc_t)
+fs_write_cgroup_files(initrc_t)
 fs_list_inotifyfs(initrc_t)
 fs_register_binary_executable_type(initrc_t)
 # rhgb-console writes to ramfs
@@ -421,7 +414,6 @@ logging_manage_generic_logs(initrc_t)
 logging_read_all_logs(initrc_t)
 logging_append_all_logs(initrc_t)
 logging_read_audit_config(initrc_t)
-logging_delete_devlog_socket(initrc_t)
 
 miscfiles_read_localization(initrc_t)
 # slapd needs to read cert files from its initscript
@@ -503,10 +495,6 @@ ifdef(`distro_gentoo',`
 	optional_policy(`
 		dhcpd_setattr_state_files(initrc_t)
 	')
-
-	optional_policy(`
-		rpc_manage_nfs_state_data(initrc_t)
-	')
 ')
 
 ifdef(`distro_redhat',`
@@ -676,10 +664,6 @@ optional_policy(`
 ')
 
 optional_policy(`
-	fail2ban_stream_connect(initrc_t)
-')
-
-optional_policy(`
 	ftp_read_config(initrc_t)
 ')
 
@@ -766,10 +750,10 @@ optional_policy(`
 	ifdef(`distro_redhat',`
 		mysql_manage_db_dirs(initrc_t)
 	')
-	mysql_read_config(initrc_t)
-	mysql_setattr_run_dirs(initrc_t)
+
 	mysql_stream_connect(initrc_t)
 	mysql_write_log(initrc_t)
+	mysql_read_config(initrc_t)
 ')
 
 optional_policy(`
@@ -861,8 +845,7 @@ optional_policy(`
 ')
 
 optional_policy(`
-	udev_create_db_dirs(initrc_t)
-	udev_pid_filetrans_db(initrc_t, dir, "rules.d")
+	udev_rw_db(initrc_t)
 	udev_manage_pid_files(initrc_t)
 	udev_manage_pid_dirs(initrc_t)
 	udev_manage_rules_files(initrc_t)
@@ -915,7 +898,45 @@ optional_policy(`
 ')
 
 ifdef(`distro_gentoo',`
+	#####################################
+	#
+	# Local initrc_t policy
+	#
+	allow initrc_t self:capability sys_admin;
+
+	manage_dirs_pattern(initrc_t, initrc_var_run_t, initrc_var_run_t)
+	files_pid_filetrans(initrc_t, initrc_var_run_t, dir)
+
+	dev_manage_sysfs_dirs(initrc_t)
+
+	files_create_pid_dirs(initrc_t)
+	files_dontaudit_write_usr_dirs(initrc_t)
+	files_manage_generic_tmp_dirs(initrc_t)
+	files_manage_generic_tmp_files(initrc_t)
+
+	fs_manage_cgroup_dirs(initrc_t)
+	fs_manage_cgroup_files(initrc_t)
+
+	logging_delete_devlog_socket(initrc_t)
+
+	optional_policy(`
+		mysql_setattr_run_dirs(initrc_t)
+	')
+
+	optional_policy(`
+		fail2ban_stream_connect(initrc_t)
+	')
+
+	optional_policy(`
+		rpc_manage_nfs_state_data(initrc_t)
+	')
+
 	optional_policy(`
 		stunnel_read_config(initrc_t)
 	')
+
+	optional_policy(`
+		udev_create_db_dirs(initrc_t)
+		udev_pid_filetrans_db(initrc_t, dir, "rules.d")
+	')
 ')