[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     f7841ba8bc8cc2ba32a7ae7c1bdf38af3f5ae3f3
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Nov  2 19:00:35 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Fri Nov  2 19:00:35 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=f7841ba8

Reshuffle gentoo specific puppet code

---
 policy/modules/contrib/puppet.te |   31 +++++++++++++++++--------------
 1 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/policy/modules/contrib/puppet.te b/policy/modules/contrib/puppet.te
index fe4f5a1..d9de41f 100644
--- a/policy/modules/contrib/puppet.te
+++ b/policy/modules/contrib/puppet.te
@@ -58,7 +58,7 @@ files_tmp_file(puppetmaster_tmp_t)
 # Local policy
 #
 
-allow puppet_t self:capability { fowner fsetid setuid setgid dac_override sys_nice sys_tty_config chown };
+allow puppet_t self:capability { fowner fsetid setuid setgid dac_override sys_nice sys_tty_config };
 allow puppet_t self:process { signal signull getsched setsched };
 allow puppet_t self:fifo_file rw_fifo_file_perms;
 allow puppet_t self:netlink_route_socket nlmsg_write;
@@ -86,8 +86,7 @@ manage_files_pattern(puppet_t, puppet_tmp_t, puppet_tmp_t)
 files_tmp_filetrans(puppet_t, puppet_tmp_t, { file dir })
 
 kernel_dontaudit_search_sysctl(puppet_t)
-kernel_read_kernel_sysctls(puppet_t)
-kernel_read_network_state(puppet_t)
+kernel_dontaudit_search_kernel_sysctl(puppet_t)
 kernel_read_system_state(puppet_t)
 kernel_read_crypto_sysctls(puppet_t)
 kernel_read_kernel_sysctls(puppet_t)
@@ -145,9 +144,22 @@ seutil_domtrans_setfiles(puppet_t)
 seutil_domtrans_semanage(puppet_t)
 
 sysnet_run_ifconfig(puppet_t, system_r)
-sysnet_use_ldap(puppet_t)
 
-usermanage_domtrans_passwd(puppet_t)
+ifdef(`distro_gentoo',`
+	allow puppet_t self:capability chown;
+
+	kernel_read_kernel_sysctls(puppet_t)
+	kernel_read_network_state(puppet_t)
+
+	sysnet_use_ldap(puppet_t)
+
+	usermanage_domtrans_passwd(puppet_t)
+
+	optional_policy(`
+		init_exec_rc(puppet_t)
+		portage_run(puppet_t, system_r)
+	')
+')
 
 tunable_policy(`puppet_manage_all_files',`
 	files_manage_non_auth_files(puppet_t)
@@ -203,15 +215,6 @@ optional_policy(`
 ')
 
 optional_policy(`
-	mta_send_mail(puppet_t)
-')
-
-optional_policy(`
-	init_exec_rc(puppet_t)
-	portage_run(puppet_t, system_r)
-')
-
-optional_policy(`
 	files_rw_var_files(puppet_t)
 
 	rpm_domtrans(puppet_t)