Changeset 2186

Timestamp:

05/27/08 10:16:47 (6 months ago)

Author:

dsugar

Message:

Updates so the ipsec test cases now run in enforcing

Files:

• trunk/test/test0119/expected.ipsec (modified) (1 diff)
• trunk/test/test0119/expected.te (modified) (3 diffs)
• trunk/test/test0119/tcp_server.flnk (modified) (1 diff)
• trunk/test/test0119/terminal.flnk (added)
• trunk/test/test0119/test.fpol (modified) (2 diffs)
• trunk/test/test0121/expected.ipsec (modified) (1 diff)
• trunk/test/test0121/expected.te (modified) (3 diffs)
• trunk/test/test0121/tcp_client.flnk (modified) (1 diff)
• trunk/test/test0121/terminal.flnk (added)
• trunk/test/test0121/test.fpol (modified) (2 diffs)

trunk/test/test0119/expected.ipsec

@@ +1 @@
+add 172.16.133.129[3490] 172.16.133.131 esp 0x6789 -m transport -ctx 1 1 "system_u:system_r:server_t:s0-s0:c0.c1023"  -E 3des-cbc "012345678901234567890123" -A hmac-md5 "0123456789012345";
-add 172.16.133.131 172.16.133.129[3490] esp 0x5678 -m transport -ctx 1 1 "system_u:system_r:client_t:s0-s0:c0.c1023"  -E 3des-cbc "012345678901234567890123" -A hmac-md5 "0123456789012345";
-add 172.16.133.129[3490] 172.16.133.131 esp 0x6789 -m transport -ctx 1 1 "system_u:system_r:server_t:s0-s0:c0.c1023"  -E 3des-cbc "012345678901234567890123" -A hmac-md5 "0123456789012345";
+add 172.16.133.131 172.16.133.129[3490] esp 0x5678 -m transport -ctx 1 1 "system_u:system_r:client_t:s0-s0:c0.c1023"  -E 3des-cbc "012345678901234567890123" -A hmac-md5 "0123456789012345";

trunk/test/test0119/expected.te

@@ -7 +7 @@
-#Framework ability: tcp_server
-allow server_t self :tcp_socket { accept append bind create getopt listen name_bind node_bind read setopt write };
+corenet_tcp_bind_all_ports(server_t)
+corenet_tcp_bind_generic_port(server_t)
+corenet_tcp_bind_inaddr_any_node(server_t)
+corenet_tcp_bind_generic_node(server_t)
-#End of Framework ability: tcp_server
-optional_policy(`
@@ -23 +27 @@
-SEFramework_entrypoint(server_exe_t)
-SEFramework_files_type(server_exe_t)
+SEFramework_ipsec_endpoint(server_t)
-# CDSFramework access (domain resource verb): server net1 readwrite
-# remote types of data coming over the wire (Labeled Networking)
-type client_t;
-SEFramework_domain(client_t)
+SEFramework_ipsec_endpoint(client_t)
-framework_ipsec_readwrite_connrw(server_t,self)
-allow server_t client_t:association { recvfrom sendto };
@@ -38 +44 @@
-        allow server_t tmp_t:dir { search };
-# CDSFramework access (domain baseresource verb): server selinux read
-seutil_read_config(server_t)
-selinux_getattr_fs(server_t)
-selinux_validate_context(server_t)
+seutil_read_config(server_t)
+# CDSFramework access (domain baseresource verb): server terminal readwrite
+term_use_all_user_ptys(server_t)
+term_use_all_terms(server_t)
+term_use_generic_ptys(server_t)
-# CDSFramework enter (domain domain entrypoint): unconfined server server_exe
-optional_policy(`

trunk/test/test0119/tcp_server.flnk

@@ -1 +1 @@
-ability tcp_server
- 
+Domain that communicates over the network as a TCP Server
-{
+        corenet_tcp_bind_all_ports($)
+        corenet_tcp_bind_generic_port($)
+        corenet_tcp_bind_inaddr_any_node($)
+        corenet_tcp_bind_generic_node($)
-        self
-        {

trunk/test/test0119/test.fpol

@@ -4 +4 @@
-baseresource selinux from "selinux.flnk";
-ability tcp_server from "tcp_server.flnk";
+baseresource terminal from "terminal.flnk";
-
-resource res1 { file };
@@ -13 +14 @@
-access server res1 write;
-access server selinux read;
+access server terminal readwrite;
-
-entrypoint server_exe;

trunk/test/test0121/expected.ipsec

@@ +1 @@
+add 172.16.133.129[3490] 172.16.133.131 esp 0x6789 -m transport -ctx 1 1 "system_u:system_r:server_t:s0-s0:c0.c1023"  -E 3des-cbc "012345678901234567890123" -A hmac-md5 "0123456789012345";
-add 172.16.133.131 172.16.133.129[3490] esp 0x5678 -m transport -ctx 1 1 "system_u:system_r:client_t:s0-s0:c0.c1023"  -E 3des-cbc "012345678901234567890123" -A hmac-md5 "0123456789012345";
-add 172.16.133.129[3490] 172.16.133.131 esp 0x6789 -m transport -ctx 1 1 "system_u:system_r:server_t:s0-s0:c0.c1023"  -E 3des-cbc "012345678901234567890123" -A hmac-md5 "0123456789012345";
+add 172.16.133.131 172.16.133.129[3490] esp 0x5678 -m transport -ctx 1 1 "system_u:system_r:client_t:s0-s0:c0.c1023"  -E 3des-cbc "012345678901234567890123" -A hmac-md5 "0123456789012345";

trunk/test/test0121/expected.te

@@ -7 +7 @@
-#Framework ability: tcp_client
-allow client_t self :tcp_socket { connect create getopt name_connect node_bind read setopt write };
+corenet_tcp_connect_all_ports(client_t)
-#End of Framework ability: tcp_client
-optional_policy(`
@@ -23 +24 @@
-SEFramework_entrypoint(client_exe_t)
-SEFramework_files_type(client_exe_t)
+SEFramework_ipsec_endpoint(client_t)
-# CDSFramework access (domain resource verb): client net1 readwrite
-# remote types of data coming over the wire (Labeled Networking)
-type server_t;
-SEFramework_domain(server_t)
+SEFramework_ipsec_endpoint(server_t)
-framework_ipsec_readwrite_connrw(client_t,self)
-allow client_t self:association { recvfrom sendto };
@@ -38 +41 @@
-        allow client_t tmp_t:dir { search };
-# CDSFramework access (domain baseresource verb): client selinux read
-seutil_read_config(client_t)
-selinux_getattr_fs(client_t)
-selinux_validate_context(client_t)
+seutil_read_config(client_t)
-# CDSFramework access (domain baseresource verb): client sysnetwork read
-sysnet_read_config(client_t)
+# CDSFramework access (domain baseresource verb): client terminal readwrite
+term_use_all_user_ptys(client_t)
+term_use_all_terms(client_t)
+term_use_generic_ptys(client_t)
-# CDSFramework enter (domain domain entrypoint): unconfined client client_exe
-optional_policy(`

trunk/test/test0121/tcp_client.flnk

@@ -2 +2 @@
-[ desc:"Domain that communicates over the network as a TCP Client " ]
-{
+        corenet_tcp_connect_all_ports($)
-        self
-        {

trunk/test/test0121/test.fpol

@@ -5 +5 @@
-baseresource sysnetwork from "sysnetwork.flnk";
-ability tcp_client from "tcp_client.flnk";
+baseresource terminal from "terminal.flnk";
-
-resource res2 { file };
@@ -15 +16 @@
-access client selinux read ;
-access client sysnetwork read;
+access client terminal readwrite;
-
-entrypoint client_exe;