[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     166b68ef829e09d95f49f40665a28d587a3b54e8
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Tue Oct 30 10:21:34 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Oct 30 18:33:05 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=166b68ef

Changes to the ulogd policy module

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/ulogd.fc |    6 ++++--
 policy/modules/contrib/ulogd.if |   16 ++++++++--------
 policy/modules/contrib/ulogd.te |   31 ++++++++++++-------------------
 3 files changed, 24 insertions(+), 29 deletions(-)

diff --git a/policy/modules/contrib/ulogd.fc b/policy/modules/contrib/ulogd.fc
index 842d11e..d5f8ac0 100644
--- a/policy/modules/contrib/ulogd.fc
+++ b/policy/modules/contrib/ulogd.fc
@@ -1,7 +1,9 @@
+/etc/ulogd\.conf	--	gen_context(system_u:object_r:ulogd_etc_t,s0)
+
 /etc/rc\.d/init\.d/ulogd	--	gen_context(system_u:object_r:ulogd_initrc_exec_t,s0)
-/etc/ulogd.conf	--	gen_context(system_u:object_r:ulogd_etc_t,s0)
 
-/usr/lib/ulogd(/.*)?	gen_context(system_u:object_r:ulogd_modules_t,s0)	
+/usr/lib/ulogd(/.*)?	gen_context(system_u:object_r:ulogd_modules_t,s0)
+
 /usr/sbin/ulogd	--	gen_context(system_u:object_r:ulogd_exec_t,s0)
 
 /var/log/ulogd(/.*)?	gen_context(system_u:object_r:ulogd_var_log_t,s0)

diff --git a/policy/modules/contrib/ulogd.if b/policy/modules/contrib/ulogd.if
index d23be5c..9b95c3e 100644
--- a/policy/modules/contrib/ulogd.if
+++ b/policy/modules/contrib/ulogd.if
@@ -15,13 +15,13 @@ interface(`ulogd_domtrans',`
 		type ulogd_t, ulogd_exec_t;
 	')
 
+	corecmd_search_bin($1)
 	domtrans_pattern($1, ulogd_exec_t, ulogd_t)
 ')
 
 ########################################
 ## <summary>
-##	Allow the specified domain to read
-##	ulogd configuration files.
+##	Read ulogd configuration files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -41,7 +41,7 @@ interface(`ulogd_read_config',`
 
 ########################################
 ## <summary>
-##	Allow the specified domain to read ulogd's log files.
+##	Read ulogd log files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -62,7 +62,7 @@ interface(`ulogd_read_log',`
 
 #######################################
 ## <summary>
-##	Allow the specified domain to search ulogd's log files.
+##	Search ulogd log files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -81,7 +81,7 @@ interface(`ulogd_search_log',`
 
 ########################################
 ## <summary>
-##	Allow the specified domain to append to ulogd's log files.
+##	Append to ulogd log files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -102,8 +102,8 @@ interface(`ulogd_append_log',`
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate
-##	an ulogd environment
+##	All of the rules required to
+##	administrate an ulogd environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -112,7 +112,7 @@ interface(`ulogd_append_log',`
 ## </param>
 ## <param name="role">
 ##	<summary>
-##	The role to be allowed to manage the syslog domain.
+##	Role allowed access.
 ##	</summary>
 ## </param>
 ## <rolecap/>

diff --git a/policy/modules/contrib/ulogd.te b/policy/modules/contrib/ulogd.te
index 3b953f5..c6acbbe 100644
--- a/policy/modules/contrib/ulogd.te
+++ b/policy/modules/contrib/ulogd.te
@@ -1,4 +1,4 @@
-policy_module(ulogd, 1.2.0)
+policy_module(ulogd, 1.2.1)
 
 ########################################
 #
@@ -9,38 +9,37 @@ type ulogd_t;
 type ulogd_exec_t;
 init_daemon_domain(ulogd_t, ulogd_exec_t)
 
-# config files
 type ulogd_etc_t;
-files_type(ulogd_etc_t)
+files_config_file(ulogd_etc_t)
 
 type ulogd_initrc_exec_t;
 init_script_file(ulogd_initrc_exec_t)
 
-# /usr/lib files
 type ulogd_modules_t;
 files_type(ulogd_modules_t)
 
-# log files
 type ulogd_var_log_t;
 logging_log_file(ulogd_var_log_t)
 
 ########################################
 #
-# ulogd local policy
+# Local policy
 #
 
-allow ulogd_t self:capability net_admin;
+allow ulogd_t self:capability { net_admin sys_nice };
+allow ulogd_t self:process setsched;
 allow ulogd_t self:netlink_nflog_socket create_socket_perms;
+allow ulogd_t self:netlink_socket create_socket_perms;
+allow ulogd_t self:tcp_socket create_stream_socket_perms;
 
-# config files
 read_files_pattern(ulogd_t, ulogd_etc_t, ulogd_etc_t)
 
-# modules for ulogd
 list_dirs_pattern(ulogd_t, ulogd_modules_t, ulogd_modules_t)
 mmap_files_pattern(ulogd_t, ulogd_modules_t, ulogd_modules_t)
 
-# log files
-manage_files_pattern(ulogd_t, ulogd_var_log_t, ulogd_var_log_t)
+append_files_pattern(ulogd_t, ulogd_var_log_t, ulogd_var_log_t)
+create_files_pattern(ulogd_t, ulogd_var_log_t, ulogd_var_log_t)
+setattr_files_pattern(ulogd_t, ulogd_var_log_t, ulogd_var_log_t)
 logging_log_filetrans(ulogd_t, ulogd_var_log_t, file)
 
 files_read_etc_files(ulogd_t)
@@ -48,20 +47,14 @@ files_read_usr_files(ulogd_t)
 
 miscfiles_read_localization(ulogd_t)
 
-optional_policy(`
-	allow ulogd_t self:tcp_socket create_stream_socket_perms;
+sysnet_dns_name_resolve(ulogd_t)
 
+optional_policy(`
 	mysql_stream_connect(ulogd_t)
 	mysql_tcp_connect(ulogd_t)
-
-	sysnet_dns_name_resolve(ulogd_t)
 ')
 
 optional_policy(`
-	allow ulogd_t self:tcp_socket create_stream_socket_perms;
-
 	postgresql_stream_connect(ulogd_t)
 	postgresql_tcp_connect(ulogd_t)
-
-	sysnet_dns_name_resolve(ulogd_t)
 ')