[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     6e964d7e0dd29423a0a4dc95dd0d338b4094fcc4
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Wed Sep 26 10:25:40 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Sep 27 17:55:05 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=6e964d7e

Changes to the cyphesis policy module

Ported from Fedora with changes
Add init script file
Add cyphesis_admin()
Remove tmp rules because non-working due to inconsistency
Make /usr/bin/cyphesis application executable file so that confined
users can at least run it in the calling user domain
Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>
Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

---
 policy/modules/contrib/cyphesis.fc |    6 +++-
 policy/modules/contrib/cyphesis.if |   44 +++++++++++++++++++++++++++++++++++-
 policy/modules/contrib/cyphesis.te |   34 ++++++++++++++-------------
 3 files changed, 65 insertions(+), 19 deletions(-)

diff --git a/policy/modules/contrib/cyphesis.fc b/policy/modules/contrib/cyphesis.fc
index c47a772..1813506 100644
--- a/policy/modules/contrib/cyphesis.fc
+++ b/policy/modules/contrib/cyphesis.fc
@@ -1,5 +1,7 @@
+/etc/rc\.d/init\.d/cyphesis	--	gen_context(system_u:object_r:cyphesis_initrc_exec_t,s0)
+
 /usr/bin/cyphesis	--	gen_context(system_u:object_r:cyphesis_exec_t,s0)
 
-/var/log/cyphesis(/.*)?		gen_context(system_u:object_r:cyphesis_log_t,s0)
+/var/log/cyphesis(/.*)?	gen_context(system_u:object_r:cyphesis_log_t,s0)
 
-/var/run/cyphesis(/.*)?		gen_context(system_u:object_r:cyphesis_var_run_t,s0)
+/var/run/cyphesis(/.*)?	gen_context(system_u:object_r:cyphesis_var_run_t,s0)

diff --git a/policy/modules/contrib/cyphesis.if b/policy/modules/contrib/cyphesis.if
index 9d44538..df8aa4a 100644
--- a/policy/modules/contrib/cyphesis.if
+++ b/policy/modules/contrib/cyphesis.if
@@ -1,4 +1,4 @@
-## <summary>Cyphesis WorldForge game server</summary>
+## <summary>Cyphesis WorldForge game server.</summary>
 
 ########################################
 ## <summary>
@@ -15,5 +15,47 @@ interface(`cyphesis_domtrans',`
 		type cyphesis_t, cyphesis_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, cyphesis_exec_t, cyphesis_t)
 ')
+
+########################################
+## <summary>
+##	All of the rules required to
+##	administrate an cyphesis environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`cyphesis_admin',`
+	gen_require(`
+		type cyphesis_t, cyphesis_initrc_exec_t, cyphesis_log_t;
+		type cyphesis_var_run_t, cyphesis_tmp_t;
+	')
+
+	allow $1 cyphesis_t:process { ptrace signal_perms };
+	ps_process_pattern($1, cyphesis_t)
+
+	init_labeled_script_domtrans($1, cyphesis_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 cyphesis_initrc_exec_t system_r;
+	allow $2 system_r;
+
+	logging_search_logs($1)
+	admin_pattern($1, cyphesis_log_t)
+
+	files_search_pids($1)
+	admin_pattern($1, cyphesis_var_run_t)
+
+	files_search_tmp($1)
+	admin_pattern($1, cyphesis_tmp_t)
+')

diff --git a/policy/modules/contrib/cyphesis.te b/policy/modules/contrib/cyphesis.te
index 25897c9..12feb5b 100644
--- a/policy/modules/contrib/cyphesis.te
+++ b/policy/modules/contrib/cyphesis.te
@@ -1,4 +1,4 @@
-policy_module(cyphesis, 1.2.0)
+policy_module(cyphesis, 1.2.1)
 
 ########################################
 #
@@ -8,6 +8,10 @@ policy_module(cyphesis, 1.2.0)
 type cyphesis_t;
 type cyphesis_exec_t;
 init_daemon_domain(cyphesis_t, cyphesis_exec_t)
+application_executable_file(cyphesis_exec_t)
+
+type cyphesis_initrc_exec_t;
+init_script_file(cyphesis_initrc_exec_t)
 
 type cyphesis_log_t;
 logging_log_file(cyphesis_log_t)
@@ -20,45 +24,41 @@ files_pid_file(cyphesis_var_run_t)
 
 ########################################
 #
-# cyphesis local policy
+# Local policy
 #
 
 allow cyphesis_t self:process { setfscreate setsched signal };
 allow cyphesis_t self:fifo_file rw_fifo_file_perms;
 allow cyphesis_t self:tcp_socket create_stream_socket_perms;
-allow cyphesis_t self:unix_stream_socket create_stream_socket_perms;
-allow cyphesis_t self:unix_dgram_socket create_socket_perms;
+allow cyphesis_t self:unix_stream_socket { accept listen };
 
-manage_files_pattern(cyphesis_t, cyphesis_log_t, cyphesis_log_t)
+append_files_pattern(cyphesis_t, cyphesis_log_t, cyphesis_log_t)
+create_files_pattern(cyphesis_t, cyphesis_log_t, cyphesis_log_t)
+setattr_files_pattern(cyphesis_t, cyphesis_log_t, cyphesis_log_t)
 logging_log_filetrans(cyphesis_t, cyphesis_log_t, file)
 
-# DAN > Does cyphesis really create a sock_file in /tmp? Why?
-allow cyphesis_t cyphesis_tmp_t:sock_file manage_sock_file_perms;
-files_tmp_filetrans(cyphesis_t, cyphesis_tmp_t, file)
-
 manage_dirs_pattern(cyphesis_t, cyphesis_var_run_t, cyphesis_var_run_t)
 manage_files_pattern(cyphesis_t, cyphesis_var_run_t, cyphesis_var_run_t)
 manage_sock_files_pattern(cyphesis_t, cyphesis_var_run_t, cyphesis_var_run_t)
-files_pid_filetrans(cyphesis_t, cyphesis_var_run_t, { dir file sock_file })
+files_pid_filetrans(cyphesis_t, cyphesis_var_run_t, dir)
 
 kernel_read_system_state(cyphesis_t)
 kernel_read_kernel_sysctls(cyphesis_t)
 
-# DAN> What is cyphesis looking for in /bin?
 corecmd_search_bin(cyphesis_t)
 corecmd_getattr_bin_files(cyphesis_t)
 
 corenet_all_recvfrom_unlabeled(cyphesis_t)
 corenet_tcp_sendrecv_generic_if(cyphesis_t)
 corenet_tcp_sendrecv_generic_node(cyphesis_t)
-corenet_tcp_sendrecv_all_ports(cyphesis_t)
 corenet_tcp_bind_generic_node(cyphesis_t)
-corenet_tcp_bind_cyphesis_port(cyphesis_t)
+
 corenet_sendrecv_cyphesis_server_packets(cyphesis_t)
+corenet_tcp_bind_cyphesis_port(cyphesis_t)
+corenet_tcp_sendrecv_cyphesis_port(cyphesis_t)
 
 dev_read_urand(cyphesis_t)
 
-# Init script handling
 domain_use_interactive_fds(cyphesis_t)
 
 files_read_etc_files(cyphesis_t)
@@ -70,10 +70,12 @@ miscfiles_read_localization(cyphesis_t)
 
 sysnet_dns_name_resolve(cyphesis_t)
 
-# cyphesis wants to talk to avahi via dbus
 optional_policy(`
-	avahi_dbus_chat(cyphesis_t)
 	dbus_system_bus_client(cyphesis_t)
+
+	optional_policy(`
+		avahi_dbus_chat(cyphesis_t)
+	')
 ')
 
 optional_policy(`