[refpolicy] [PATCH 7/8] Allow portage to call gpg

Sven Vermeulen sven.vermeulen at siphos.be
Sat Sep 3 09:22:57 CDT 2011


We allow portage to call gpg. However, this requires that the location
where the trustdb is stored is marked as a read/write type. The default
location used within Gentoo is /etc/portage/gpg, which would lead to
portage_conf_t. However, this type should remain a read-only type.

As such, we introduce a type called portage_gpg_t for this location and
grant portage_fetch_t the necessary rights on this type.

Signed-off-by: Sven Vermeulen <sven.vermeulen at siphos.be>
---
 policy/modules/admin/portage.fc |    1 +
 policy/modules/admin/portage.te |   10 +++++++++-
 2 files changed, 10 insertions(+), 1 deletions(-)

diff --git a/policy/modules/admin/portage.fc b/policy/modules/admin/portage.fc
index d5ea7b5..af2d51f 100644
--- a/policy/modules/admin/portage.fc
+++ b/policy/modules/admin/portage.fc
@@ -1,6 +1,7 @@
 /etc/make\.conf			--	gen_context(system_u:object_r:portage_conf_t,s0)
 /etc/make\.globals		--	gen_context(system_u:object_r:portage_conf_t,s0)
 /etc/portage(/.*)?			gen_context(system_u:object_r:portage_conf_t,s0)
+/etc/portage/gpg(/.*)?			gen_context(system_u:object_r:portage_gpg_t,s0)
 
 /usr/bin/gcc-config		--	gen_context(system_u:object_r:gcc_config_exec_t,s0)
 /usr/bin/layman			--	gen_context(system_u:object_r:portage_fetch_exec_t,s0)
diff --git a/policy/modules/admin/portage.te b/policy/modules/admin/portage.te
index c309d84..429ffb0 100644
--- a/policy/modules/admin/portage.te
+++ b/policy/modules/admin/portage.te
@@ -57,6 +57,9 @@ files_type(portage_conf_t)
 type portage_cache_t;
 files_type(portage_cache_t)
 
+type portage_gpg_t;
+files_type(portage_gpg_t)
+
 type portage_log_t;
 logging_log_file(portage_log_t)
 
@@ -228,8 +231,9 @@ allow portage_fetch_t self:unix_stream_socket create_socket_perms;
 allow portage_fetch_t portage_tmp_t:dir manage_dir_perms;
 allow portage_fetch_t portage_tmp_t:file manage_file_perms;
 allow portage_fetch_t portage_conf_t:dir list_dir_perms;
+allow portage_fetch_t portage_gpg_t:dir rw_dir_perms;
+allow portage_fetch_t portage_gpg_t:file manage_file_perms;
 
-allow portage_fetch_t portage_conf_t:dir list_dir_perms;
 read_files_pattern(portage_fetch_t, portage_conf_t, portage_conf_t)
 
 manage_dirs_pattern(portage_fetch_t, portage_ebuild_t, portage_ebuild_t)
@@ -299,6 +303,10 @@ tunable_policy(`portage_use_nfs',`
 	fs_manage_nfs_symlinks(portage_fetch_t)
 ')
 
+optional_policy(`
+	gpg_exec(portage_fetch_t)
+')
+
 ##########################################
 #
 # Portage sandbox domain
-- 
1.7.3.4



More information about the refpolicy mailing list