[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     93ce6c8c23d102a9a5b50da848779d1ffe49cb80
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Thu Sep 27 13:41:53 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Sep 27 18:02:58 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=93ce6c8c

Changes to the dcc policy module

Use role attributes for application domains
Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>
Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

---
 policy/modules/contrib/dcc.fc |   42 ++++++++---------
 policy/modules/contrib/dcc.if |   37 +++++++++-------
 policy/modules/contrib/dcc.te |   99 +++++++++-------------------------------
 3 files changed, 63 insertions(+), 115 deletions(-)

diff --git a/policy/modules/contrib/dcc.fc b/policy/modules/contrib/dcc.fc
index 29773e7..62d3c4e 100644
--- a/policy/modules/contrib/dcc.fc
+++ b/policy/modules/contrib/dcc.fc
@@ -1,30 +1,26 @@
-/etc/dcc(/.*)?				gen_context(system_u:object_r:dcc_var_t,s0)
-/etc/dcc/dccifd			-s	gen_context(system_u:object_r:dccifd_var_run_t,s0)
-/etc/dcc/map			--	gen_context(system_u:object_r:dcc_client_map_t,s0)
+/etc/dcc(/.*)?	gen_context(system_u:object_r:dcc_var_t,s0)
+/etc/dcc/dccifd	-s	gen_context(system_u:object_r:dccifd_var_run_t,s0)
+/etc/dcc/map	--	gen_context(system_u:object_r:dcc_client_map_t,s0)
 
-/usr/bin/cdcc			--	gen_context(system_u:object_r:cdcc_exec_t,s0)
-/usr/bin/dccproc		--	gen_context(system_u:object_r:dcc_client_exec_t,s0)
+/usr/bin/cdcc	--	gen_context(system_u:object_r:cdcc_exec_t,s0)
+/usr/bin/dccproc	--	gen_context(system_u:object_r:dcc_client_exec_t,s0)
 
 /usr/libexec/dcc/dbclean	--	gen_context(system_u:object_r:dcc_dbclean_exec_t,s0)
-/usr/libexec/dcc/dccd		--	gen_context(system_u:object_r:dccd_exec_t,s0)
-/usr/libexec/dcc/dccifd		--	gen_context(system_u:object_r:dccifd_exec_t,s0)
-/usr/libexec/dcc/dccm		--	gen_context(system_u:object_r:dccm_exec_t,s0)
+/usr/libexec/dcc/dccd	--	gen_context(system_u:object_r:dccd_exec_t,s0)
+/usr/libexec/dcc/dccifd	--	gen_context(system_u:object_r:dccifd_exec_t,s0)
+/usr/libexec/dcc/dccm	--	gen_context(system_u:object_r:dccm_exec_t,s0)
 
-ifdef(`distro_debian',`
-/usr/sbin/dbclean		--	gen_context(system_u:object_r:dcc_dbclean_exec_t,s0)
-/usr/sbin/dccd			--	gen_context(system_u:object_r:dccd_exec_t,s0)
-/usr/sbin/dccifd		--	gen_context(system_u:object_r:dccifd_exec_t,s0)
-/usr/sbin/dccm			--	gen_context(system_u:object_r:dccm_exec_t,s0)
-')
+/usr/sbin/dbclean	--	gen_context(system_u:object_r:dcc_dbclean_exec_t,s0)
+/usr/sbin/dccd	--	gen_context(system_u:object_r:dccd_exec_t,s0)
+/usr/sbin/dccifd	--	gen_context(system_u:object_r:dccifd_exec_t,s0)
+/usr/sbin/dccm	--	gen_context(system_u:object_r:dccm_exec_t,s0)
 
-/var/lib/dcc(/.*)?			gen_context(system_u:object_r:dcc_var_t,s0)
-/var/lib/dcc/map		--	gen_context(system_u:object_r:dcc_client_map_t,s0)
+/var/dcc(/.*)?	gen_context(system_u:object_r:dcc_var_t,s0)
+/var/dcc/map	--	gen_context(system_u:object_r:dcc_client_map_t,s0)
 
-/var/run/dcc(/.*)?			gen_context(system_u:object_r:dcc_var_run_t,s0)
-/var/run/dcc/map		--	gen_context(system_u:object_r:dcc_client_map_t,s0)
-/var/run/dcc/dccifd		-s	gen_context(system_u:object_r:dccifd_var_run_t,s0)
+/var/lib/dcc(/.*)?	gen_context(system_u:object_r:dcc_var_t,s0)
+/var/lib/dcc/map	--	gen_context(system_u:object_r:dcc_client_map_t,s0)
 
-ifdef(`distro_redhat',`
-/var/dcc(/.*)?				gen_context(system_u:object_r:dcc_var_t,s0)
-/var/dcc/map			--	gen_context(system_u:object_r:dcc_client_map_t,s0)
-')
+/var/run/dcc(/.*)?	gen_context(system_u:object_r:dcc_var_run_t,s0)
+/var/run/dcc/map	--	gen_context(system_u:object_r:dcc_client_map_t,s0)
+/var/run/dcc/dccifd	-s	gen_context(system_u:object_r:dccifd_var_run_t,s0)

diff --git a/policy/modules/contrib/dcc.if b/policy/modules/contrib/dcc.if
index 784753e..a5c21e0 100644
--- a/policy/modules/contrib/dcc.if
+++ b/policy/modules/contrib/dcc.if
@@ -1,4 +1,4 @@
-## <summary>Distributed checksum clearinghouse spam filtering</summary>
+## <summary>Distributed checksum clearinghouse spam filtering.</summary>
 
 ########################################
 ## <summary>
@@ -22,7 +22,8 @@ interface(`dcc_domtrans_cdcc',`
 ########################################
 ## <summary>
 ##	Execute cdcc in the cdcc domain, and
-##	allow the specified role the cdcc domain.
+##	allow the specified role the
+##	cdcc domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -38,16 +39,17 @@ interface(`dcc_domtrans_cdcc',`
 #
 interface(`dcc_run_cdcc',`
 	gen_require(`
-		type cdcc_t;
+		attribute_role cdcc_roles;
 	')
 
 	dcc_domtrans_cdcc($1)
-	role $2 types cdcc_t;
+	roleattribute $2 cdcc_roles;
 ')
 
 ########################################
 ## <summary>
-##	Execute dcc_client in the dcc_client domain.
+##	Execute dcc client in the dcc
+##	client domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -66,7 +68,7 @@ interface(`dcc_domtrans_client',`
 
 ########################################
 ## <summary>
-##	Send a signal to the dcc_client.
+##	Send generic signals to dcc client.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -84,8 +86,9 @@ interface(`dcc_signal_client',`
 
 ########################################
 ## <summary>
-##	Execute dcc_client in the dcc_client domain, and
-##	allow the specified role the dcc_client domain.
+##	Execute dcc client in the dcc
+##	client domain, and allow the
+##	specified role the dcc client domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -101,16 +104,16 @@ interface(`dcc_signal_client',`
 #
 interface(`dcc_run_client',`
 	gen_require(`
-		type dcc_client_t;
+		attribute_role dcc_client_roles;
 	')
 
 	dcc_domtrans_client($1)
-	role $2 types dcc_client_t;
+	roleattribute $2 dcc_client_roles;
 ')
 
 ########################################
 ## <summary>
-##	Execute dbclean in the dcc_dbclean domain.
+##	Execute dbclean in the dcc dbclean domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -129,8 +132,9 @@ interface(`dcc_domtrans_dbclean',`
 
 ########################################
 ## <summary>
-##	Execute dbclean in the dcc_dbclean domain, and
-##	allow the specified role the dcc_dbclean domain.
+##	Execute dbclean in the dcc dbclean
+##	domain, and allow the specified
+##	role the dcc dbclean domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -146,16 +150,17 @@ interface(`dcc_domtrans_dbclean',`
 #
 interface(`dcc_run_dbclean',`
 	gen_require(`
-		type dcc_dbclean_t;
+		attribute_role dcc_dbclean_roles;
 	')
 
 	dcc_domtrans_dbclean($1)
-	role $2 types dcc_dbclean_t;
+	roleattribute $2 dcc_dbclean_roles;
 ')
 
 ########################################
 ## <summary>
-##	Connect to dccifd over a unix domain stream socket.
+##	Connect to dccifd over a unix
+##	domain stream socket.
 ## </summary>
 ## <param name="domain">
 ##	<summary>

diff --git a/policy/modules/contrib/dcc.te b/policy/modules/contrib/dcc.te
index 5178337..15d908f 100644
--- a/policy/modules/contrib/dcc.te
+++ b/policy/modules/contrib/dcc.te
@@ -1,14 +1,23 @@
-policy_module(dcc, 1.11.0)
+policy_module(dcc, 1.11.1)
 
 ########################################
 #
 # Declarations
 #
 
+attribute_role cdcc_roles;
+roleattribute system_r cdcc_roles;
+
+attribute_role dcc_client_roles;
+roleattribute system_r dcc_client_roles;
+
+attribute_role dcc_dbclean_roles;
+roleattribute system_r dcc_dbclean_roles;
+
 type cdcc_t;
 type cdcc_exec_t;
 application_domain(cdcc_t, cdcc_exec_t)
-role system_r types cdcc_t;
+role cdcc_roles types cdcc_t;
 
 type cdcc_tmp_t;
 files_tmp_file(cdcc_tmp_t)
@@ -16,7 +25,7 @@ files_tmp_file(cdcc_tmp_t)
 type dcc_client_t;
 type dcc_client_exec_t;
 application_domain(dcc_client_t, dcc_client_exec_t)
-role system_r types dcc_client_t;
+role dcc_client_roles types dcc_client_t;
 
 type dcc_client_map_t;
 files_type(dcc_client_map_t)
@@ -27,7 +36,7 @@ files_tmp_file(dcc_client_tmp_t)
 type dcc_dbclean_t;
 type dcc_dbclean_exec_t;
 application_domain(dcc_dbclean_t, dcc_dbclean_exec_t)
-role system_r types dcc_dbclean_t;
+role dcc_dbclean_roles types dcc_dbclean_t;
 
 type dcc_dbclean_tmp_t;
 files_tmp_file(dcc_dbclean_tmp_t)
@@ -68,21 +77,12 @@ files_tmp_file(dccm_tmp_t)
 type dccm_var_run_t;
 files_pid_file(dccm_var_run_t)
 
-# NOTE: DCC has writeable files in /etc/dcc that should probably be in
-# /var/lib/dcc.  For now this policy supports both directories being
-# writable.
-
-# cjp: dccifd and dccm should be merged, as
-# they have the same rules.
-
 ########################################
 #
-# dcc daemon controller local policy
+# Daemon controller local policy
 #
 
 allow cdcc_t self:capability { setuid setgid };
-allow cdcc_t self:unix_dgram_socket create_socket_perms;
-allow cdcc_t self:udp_socket create_socket_perms;
 
 manage_dirs_pattern(cdcc_t, cdcc_tmp_t, cdcc_tmp_t)
 manage_files_pattern(cdcc_t, cdcc_tmp_t, cdcc_tmp_t)
@@ -90,18 +90,10 @@ files_tmp_filetrans(cdcc_t, cdcc_tmp_t, { file dir })
 
 allow cdcc_t dcc_client_map_t:file rw_file_perms;
 
-# Access files in /var/dcc. The map file can be updated
 allow cdcc_t dcc_var_t:dir list_dir_perms;
 read_files_pattern(cdcc_t, dcc_var_t, dcc_var_t)
 read_lnk_files_pattern(cdcc_t, dcc_var_t, dcc_var_t)
 
-corenet_all_recvfrom_unlabeled(cdcc_t)
-corenet_all_recvfrom_netlabel(cdcc_t)
-corenet_udp_sendrecv_generic_if(cdcc_t)
-corenet_udp_sendrecv_generic_node(cdcc_t)
-corenet_udp_sendrecv_all_ports(cdcc_t)
-
-files_read_etc_files(cdcc_t)
 files_read_etc_runtime_files(cdcc_t)
 
 auth_use_nsswitch(cdcc_t)
@@ -114,12 +106,10 @@ userdom_use_user_terminals(cdcc_t)
 
 ########################################
 #
-# dcc procmail interface local policy
+# Procmail interface local policy
 #
 
 allow dcc_client_t self:capability { setuid setgid };
-allow dcc_client_t self:unix_dgram_socket create_socket_perms;
-allow dcc_client_t self:udp_socket create_socket_perms;
 
 allow dcc_client_t dcc_client_map_t:file rw_file_perms;
 
@@ -127,21 +117,12 @@ manage_dirs_pattern(dcc_client_t, dcc_client_tmp_t, dcc_client_tmp_t)
 manage_files_pattern(dcc_client_t, dcc_client_tmp_t, dcc_client_tmp_t)
 files_tmp_filetrans(dcc_client_t, dcc_client_tmp_t, { file dir })
 
-# Access files in /var/dcc. The map file can be updated
 allow dcc_client_t dcc_var_t:dir list_dir_perms;
 manage_files_pattern(dcc_client_t, dcc_var_t, dcc_var_t)
 read_lnk_files_pattern(dcc_client_t, dcc_var_t, dcc_var_t)
 
 kernel_read_system_state(dcc_client_t)
 
-corenet_all_recvfrom_unlabeled(dcc_client_t)
-corenet_all_recvfrom_netlabel(dcc_client_t)
-corenet_udp_sendrecv_generic_if(dcc_client_t)
-corenet_udp_sendrecv_generic_node(dcc_client_t)
-corenet_udp_sendrecv_all_ports(dcc_client_t)
-corenet_udp_bind_generic_node(dcc_client_t)
-
-files_read_etc_files(dcc_client_t)
 files_read_etc_runtime_files(dcc_client_t)
 
 fs_getattr_all_fs(dcc_client_t)
@@ -164,12 +145,9 @@ optional_policy(`
 
 ########################################
 #
-# Database cleanup tool local policy
+# Database cleanup local policy
 #
 
-allow dcc_dbclean_t self:unix_dgram_socket create_socket_perms;
-allow dcc_dbclean_t self:udp_socket create_socket_perms;
-
 allow dcc_dbclean_t dcc_client_map_t:file rw_file_perms;
 
 manage_dirs_pattern(dcc_dbclean_t, dcc_dbclean_tmp_t, dcc_dbclean_tmp_t)
@@ -182,13 +160,6 @@ manage_lnk_files_pattern(dcc_dbclean_t, dcc_var_t, dcc_var_t)
 
 kernel_read_system_state(dcc_dbclean_t)
 
-corenet_all_recvfrom_unlabeled(dcc_dbclean_t)
-corenet_all_recvfrom_netlabel(dcc_dbclean_t)
-corenet_udp_sendrecv_generic_if(dcc_dbclean_t)
-corenet_udp_sendrecv_generic_node(dcc_dbclean_t)
-corenet_udp_sendrecv_all_ports(dcc_dbclean_t)
-
-files_read_etc_files(dcc_dbclean_t)
 files_read_etc_runtime_files(dcc_dbclean_t)
 
 auth_use_nsswitch(dcc_dbclean_t)
@@ -201,28 +172,21 @@ userdom_use_user_terminals(dcc_dbclean_t)
 
 ########################################
 #
-# Server daemon local policy
+# Server local policy
 #
 
 allow dccd_t self:capability net_admin;
 dontaudit dccd_t self:capability sys_tty_config;
 allow dccd_t self:process signal_perms;
-allow dccd_t self:unix_stream_socket create_socket_perms;
-allow dccd_t self:netlink_route_socket { bind create getattr nlmsg_read read write };
-allow dccd_t self:udp_socket create_socket_perms;
 
 allow dccd_t dcc_client_map_t:file rw_file_perms;
 
-# Access files in /var/dcc. The map file can be updated
 allow dccd_t dcc_var_t:dir list_dir_perms;
 read_files_pattern(dccd_t, dcc_var_t, dcc_var_t)
 read_lnk_files_pattern(dccd_t, dcc_var_t, dcc_var_t)
 
-# Runs the dbclean program
 domtrans_pattern(dccd_t, dcc_dbclean_exec_t, dcc_dbclean_t)
-corecmd_search_bin(dccd_t)
 
-# Updating dcc_db, flod, ...
 manage_dirs_pattern(dccd_t, dcc_var_t, dcc_var_t)
 manage_files_pattern(dccd_t, dcc_var_t, dcc_var_t)
 manage_lnk_files_pattern(dccd_t, dcc_var_t, dcc_var_t)
@@ -244,14 +208,16 @@ corenet_udp_sendrecv_generic_if(dccd_t)
 corenet_udp_sendrecv_generic_node(dccd_t)
 corenet_udp_sendrecv_all_ports(dccd_t)
 corenet_udp_bind_generic_node(dccd_t)
+
 corenet_udp_bind_dcc_port(dccd_t)
 corenet_sendrecv_dcc_server_packets(dccd_t)
 
+corecmd_search_bin(dccd_t)
+
 dev_read_sysfs(dccd_t)
 
 domain_use_interactive_fds(dccd_t)
 
-files_read_etc_files(dccd_t)
 files_read_etc_runtime_files(dccd_t)
 
 fs_getattr_all_fs(dccd_t)
@@ -281,13 +247,10 @@ optional_policy(`
 
 dontaudit dccifd_t self:capability sys_tty_config;
 allow dccifd_t self:process signal_perms;
-allow dccifd_t self:unix_stream_socket create_stream_socket_perms;
-allow dccifd_t self:unix_dgram_socket create_socket_perms;
-allow dccifd_t self:udp_socket create_socket_perms;
+allow dccifd_t self:unix_stream_socket { accept listen };
 
 allow dccifd_t dcc_client_map_t:file rw_file_perms;
 
-# Updating dcc_db, flod, ...
 manage_dirs_pattern(dccifd_t, dcc_var_t, dcc_var_t)
 manage_files_pattern(dccifd_t, dcc_var_t, dcc_var_t)
 manage_lnk_files_pattern(dccifd_t, dcc_var_t, dcc_var_t)
@@ -306,17 +269,10 @@ files_pid_filetrans(dccifd_t, dccifd_var_run_t, file)
 kernel_read_system_state(dccifd_t)
 kernel_read_kernel_sysctls(dccifd_t)
 
-corenet_all_recvfrom_unlabeled(dccifd_t)
-corenet_all_recvfrom_netlabel(dccifd_t)
-corenet_udp_sendrecv_generic_if(dccifd_t)
-corenet_udp_sendrecv_generic_node(dccifd_t)
-corenet_udp_sendrecv_all_ports(dccifd_t)
-
 dev_read_sysfs(dccifd_t)
 
 domain_use_interactive_fds(dccifd_t)
 
-files_read_etc_files(dccifd_t)
 files_read_etc_runtime_files(dccifd_t)
 
 fs_getattr_all_fs(dccifd_t)
@@ -341,14 +297,12 @@ optional_policy(`
 
 ########################################
 #
-# sendmail milter client local policy
+# Sendmail milter client local policy
 #
 
 dontaudit dccm_t self:capability sys_tty_config;
 allow dccm_t self:process signal_perms;
-allow dccm_t self:unix_stream_socket create_stream_socket_perms;
-allow dccm_t self:unix_dgram_socket create_socket_perms;
-allow dccm_t self:udp_socket create_socket_perms;
+allow dccm_t self:unix_stream_socket { accept listen };
 
 allow dccm_t dcc_client_map_t:file rw_file_perms;
 
@@ -370,17 +324,10 @@ files_pid_filetrans(dccm_t, dccm_var_run_t, file)
 kernel_read_system_state(dccm_t)
 kernel_read_kernel_sysctls(dccm_t)
 
-corenet_all_recvfrom_unlabeled(dccm_t)
-corenet_all_recvfrom_netlabel(dccm_t)
-corenet_udp_sendrecv_generic_if(dccm_t)
-corenet_udp_sendrecv_generic_node(dccm_t)
-corenet_udp_sendrecv_all_ports(dccm_t)
-
 dev_read_sysfs(dccm_t)
 
 domain_use_interactive_fds(dccm_t)
 
-files_read_etc_files(dccm_t)
 files_read_etc_runtime_files(dccm_t)
 
 fs_getattr_all_fs(dccm_t)