| 1 |
commit: 0575eea1a7dfe550051c45678d2b1d98b3b91805 |
| 2 |
Author: cgzones <cgzones <AT> googlemail <DOT> com> |
| 3 |
AuthorDate: Tue Mar 14 14:14:05 2017 +0000 |
| 4 |
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> |
| 5 |
CommitDate: Thu Mar 30 14:00:10 2017 +0000 |
| 6 |
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=0575eea1 |
| 7 |
|
| 8 |
remove /var/run file context lefovers, add dbus exception |
| 9 |
|
| 10 |
policy/modules/contrib/dbus.fc | 17 ++++++++++------- |
| 11 |
policy/modules/contrib/iodine.fc | 4 ++-- |
| 12 |
policy/modules/contrib/mon.fc | 12 ++++++------ |
| 13 |
policy/modules/contrib/qemu.fc | 6 +++--- |
| 14 |
4 files changed, 21 insertions(+), 18 deletions(-) |
| 15 |
|
| 16 |
diff --git a/policy/modules/contrib/dbus.fc b/policy/modules/contrib/dbus.fc |
| 17 |
index c7baa6ba..725276de 100644 |
| 18 |
--- a/policy/modules/contrib/dbus.fc |
| 19 |
+++ b/policy/modules/contrib/dbus.fc |
| 20 |
@@ -1,8 +1,11 @@ |
| 21 |
-HOME_DIR/\.dbus(/.*)? gen_context(system_u:object_r:session_dbusd_home_t,s0) |
| 22 |
+HOME_DIR/\.dbus(/.*)? gen_context(system_u:object_r:session_dbusd_home_t,s0) |
| 23 |
|
| 24 |
-/etc/dbus-.*(/.*)? gen_context(system_u:object_r:dbusd_etc_t,s0) |
| 25 |
+/etc/dbus-.*(/.*)? gen_context(system_u:object_r:dbusd_etc_t,s0) |
| 26 |
|
| 27 |
-/usr/bin/dbus-daemon(-1)? -- gen_context(system_u:object_r:dbusd_exec_t,s0) |
| 28 |
+/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0) |
| 29 |
+/run/messagebus\.pid -- gen_context(system_u:object_r:system_dbusd_var_run_t,s0) |
| 30 |
+ |
| 31 |
+/usr/bin/dbus-daemon(-1)? -- gen_context(system_u:object_r:dbusd_exec_t,s0) |
| 32 |
|
| 33 |
/usr/lib/dbus-.*/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0) |
| 34 |
|
| 35 |
@@ -11,9 +14,9 @@ HOME_DIR/\.dbus(/.*)? gen_context(system_u:object_r:session_dbusd_home_t,s0) |
| 36 |
|
| 37 |
/usr/libexec/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0) |
| 38 |
|
| 39 |
-/var/lib/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_lib_t,s0) |
| 40 |
+/var/lib/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_lib_t,s0) |
| 41 |
|
| 42 |
-/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0) |
| 43 |
-/run/messagebus\.pid -- gen_context(system_u:object_r:system_dbusd_var_run_t,s0) |
| 44 |
+/var/named/chroot/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0) |
| 45 |
|
| 46 |
-/var/named/chroot/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0) |
| 47 |
+# /var/run prefix exception; https://dbus.freedesktop.org/doc/dbus-specification.html#idm2461 |
| 48 |
+/var/run/dbus/system_bus_socket gen_context(system_u:object_r:system_dbusd_var_run_t,s0) |
| 49 |
|
| 50 |
diff --git a/policy/modules/contrib/iodine.fc b/policy/modules/contrib/iodine.fc |
| 51 |
index 42a24aaf..53b6a139 100644 |
| 52 |
--- a/policy/modules/contrib/iodine.fc |
| 53 |
+++ b/policy/modules/contrib/iodine.fc |
| 54 |
@@ -1,5 +1,5 @@ |
| 55 |
/etc/rc\.d/init\.d/((iodined)|(iodine-server)) -- gen_context(system_u:object_r:iodined_initrc_exec_t,s0) |
| 56 |
|
| 57 |
-/usr/sbin/iodined -- gen_context(system_u:object_r:iodined_exec_t,s0) |
| 58 |
+/run/iodine(/.*)? gen_context(system_u:object_r:iodined_var_run_t,s0) |
| 59 |
|
| 60 |
-/var/run/iodine(/.*)? gen_context(system_u:object_r:iodined_var_run_t,s0) |
| 61 |
+/usr/sbin/iodined -- gen_context(system_u:object_r:iodined_exec_t,s0) |
| 62 |
|
| 63 |
diff --git a/policy/modules/contrib/mon.fc b/policy/modules/contrib/mon.fc |
| 64 |
index fa179dd8..c92575b4 100644 |
| 65 |
--- a/policy/modules/contrib/mon.fc |
| 66 |
+++ b/policy/modules/contrib/mon.fc |
| 67 |
@@ -1,11 +1,11 @@ |
| 68 |
-/usr/lib/mon/mon.d/.* -- gen_context(system_u:object_r:mon_net_test_exec_t,s0) |
| 69 |
-/usr/lib/mon/mon-local.d/.* -- gen_context(system_u:object_r:mon_local_test_exec_t,s0) |
| 70 |
-/usr/lib/mon-contrib/mon.d/.* -- gen_context(system_u:object_r:mon_net_test_exec_t,s0) |
| 71 |
-/usr/lib/mon-contrib/mon-local.d/.* -- gen_context(system_u:object_r:mon_local_test_exec_t,s0) |
| 72 |
+/run/mon(/.*)? gen_context(system_u:object_r:mon_var_run_t,s0) |
| 73 |
|
| 74 |
-/usr/sbin/mon -- gen_context(system_u:object_r:mon_exec_t,s0) |
| 75 |
+/usr/lib/mon/mon.d/.* -- gen_context(system_u:object_r:mon_net_test_exec_t,s0) |
| 76 |
+/usr/lib/mon/mon-local.d/.* -- gen_context(system_u:object_r:mon_local_test_exec_t,s0) |
| 77 |
+/usr/lib/mon-contrib/mon.d/.* -- gen_context(system_u:object_r:mon_net_test_exec_t,s0) |
| 78 |
+/usr/lib/mon-contrib/mon-local.d/.* -- gen_context(system_u:object_r:mon_local_test_exec_t,s0) |
| 79 |
|
| 80 |
-/var/run/mon(/.*)? gen_context(system_u:object_r:mon_var_run_t,s0) |
| 81 |
+/usr/sbin/mon -- gen_context(system_u:object_r:mon_exec_t,s0) |
| 82 |
|
| 83 |
/var/lib/mon(/.*)? gen_context(system_u:object_r:mon_var_lib_t,s0) |
| 84 |
/var/log/mon(/.*)? gen_context(system_u:object_r:mon_var_log_t,s0) |
| 85 |
|
| 86 |
diff --git a/policy/modules/contrib/qemu.fc b/policy/modules/contrib/qemu.fc |
| 87 |
index 122ca70f..1fc79800 100644 |
| 88 |
--- a/policy/modules/contrib/qemu.fc |
| 89 |
+++ b/policy/modules/contrib/qemu.fc |
| 90 |
@@ -1,4 +1,6 @@ |
| 91 |
-/usr/bin/qemu -- gen_context(system_u:object_r:qemu_exec_t,s0) |
| 92 |
+/run/xen/qmp.* -- gen_context(system_u:object_r:qemu_var_run_t,s0) |
| 93 |
+ |
| 94 |
+/usr/bin/qemu -- gen_context(system_u:object_r:qemu_exec_t,s0) |
| 95 |
/usr/bin/qemu-system-.* -- gen_context(system_u:object_r:qemu_exec_t,s0) |
| 96 |
/usr/bin/qemu-kvm -- gen_context(system_u:object_r:qemu_exec_t,s0) |
| 97 |
/usr/bin/kvm -- gen_context(system_u:object_r:qemu_exec_t,s0) |
| 98 |
@@ -7,8 +9,6 @@ |
| 99 |
|
| 100 |
/usr/libexec/qemu.* -- gen_context(system_u:object_r:qemu_exec_t,s0) |
| 101 |
|
| 102 |
-/var/run/xen/qmp.* -- gen_context(system_u:object_r:qemu_var_run_t,s0) |
| 103 |
- |
| 104 |
ifdef(`distro_gentoo',` |
| 105 |
/usr/bin/qemu-ga -- gen_context(system_u:object_r:qemu_ga_exec_t,s0) |
Archives