Changeset 1817

Timestamp:

05/16/06 13:36:25 (3 years ago)

Author:

cpebenito

Message:

move old strict, targeted, and mls policies to archive

Files:

• archive (added)
• archive/mls (moved) (moved from trunk/mls)
• archive/strict (moved) (moved from trunk/strict)
• archive/targeted (moved) (moved from trunk/targeted)
• trunk/docs/macro_conversion_guide (modified) (16 diffs)
• trunk/tools/buildtest.sh (modified) (5 diffs)
• trunk/tools/quicktest.sh (modified) (5 diffs)

trunk/docs/macro_conversion_guide

@@ -32 +32 @@
-#
-optional_policy(`nscd',`
-use_socket
+socket_use
-')
-
@@ -44 +44 @@
-#
-# handled by appropriate interfaces
+
+#
+# exec_type: complete
+#
+corecmd_executable_file($1)
-
-#
@@ -120 +125 @@
-        ')
-')
-cron',`
+
-        cron_sigchld($1)
-        cron_read_system_job_tmp_files($1)
-')
-logrotate',`
+
-        logrotate_read_tmp_files($1)
-')
@@ -131 +136 @@
-# nscd_client_domain: complete
-#
-nscd',`
-use_socket
+
+socket_use
-')
-
@@ -143 +148 @@
-# privlog: complete
-#
-
-
-
+
-
-#
@@ -368 +371 @@
-# can_exec_any(): complete
-#
-
-
-
+
-files_exec_etc_files($1)
-libs_use_ld_so($1)
@@ -644 +645 @@
-allow $1 $2:{ file lnk_file } { read getattr };
-allow $1 $2:process getattr;
-# We need to suppress this denial because procps tries to access
-# /proc/pid/environ and this now triggers a ptrace check in recent kernels
-# (2.4 and 2.6).  Might want to change procps to not do this, or only if
-# running in a privileged domain.
-dontaudit $1 $2:process ptrace;
-
-#
@@ -788 +784 @@
-kernel_read_kernel_sysctls($1_t)
-dev_read_sysfs($1_t)
+domain_use_interactive_fds($1_t)
-fs_search_auto_mountpoints($1_t)
-term_dontaudit_use_console($1_t)
-domain_use_interactive_fds($1_t)
-init_use_fds($1_t)
-
+s
-libs_use_ld_so($1_t)
-libs_use_shared_libs($1_t)
@@ -798 +794 @@
-userdom_dontaudit_use_unpriv_user_fds($1_t)
-ifdef(`targeted_policy',`
-
-
+s
+s
-        files_dontaudit_read_root_files($1_t)
-')
-selinuxutil',`
+
-        seutil_sigchld_newrole($1_t)
-')
-udev',`
+
-        udev_read_db($1_t)
-')
@@ -821 +817 @@
-allow $1_t $1_var_run_t:file create_file_perms;
-allow $1_t $1_var_run_t:dir rw_dir_perms;
-
+,file
-kernel_read_kernel_sysctls($1_t)
-kernel_list_proc($1_t)
-kernel_read_proc_symlinks($1_t)
-dev_read_sysfs($1_t)
+domain_use_interactive_fds($1_t)
-fs_getattr_all_fs($1_t)
-fs_search_auto_mountpoints($1_t)
-term_dontaudit_use_console($1_t)
-domain_use_interactive_fds($1_t)
-init_use_fds($1_t)
-
+s
-libs_use_ld_so($1_t)
-libs_use_shared_libs($1_t)
@@ -838 +834 @@
-userdom_dontaudit_use_unpriv_user_fds($1_t)
-userdom_dontaudit_search_sysadm_home_dirs($1_t)
- 
-
-
+
+s
+s
-        files_dontaudit_read_root_files($1_t)
-')
-selinuxutil',`
+
-        seutil_sigchld_newrole($1_t)
-')
-udev',`
+
-        udev_read_db($1_t)
-')
@@ -1045 +1041 @@
-')
-optional_policy(`nscd',`
-use_socket
+socket_use
-')
-
@@ -1061 +1057 @@
-files_lock_file($1_lock_t)
-allow $1_t $1_lock_t:file create_file_perms;
-
+,file
-
-#
@@ -1069 +1065 @@
-logging_log_file($1_log_t)
-allow $1_t $1_log_t:file create_file_perms;
-
+,file
-
-#
@@ -1231 +1227 @@
-allow $1_t $1_var_lib_t:file create_file_perms;
-allow $1_t $1_var_lib_t:dir rw_dir_perms;
-
+,file
-
-#
@@ -1240 +1236 @@
-allow $1_t $1_var_run_t:file create_file_perms;
-allow $1_t $1_var_run_t:dir rw_dir_perms;
-
+,file
-
-#

trunk/tools/buildtest.sh

@@ -5 +5 @@
-POLVER="`checkpolicy -V |cut -f 1 -d ' '`"
-SETFILES="/usr/sbin/setfiles"
-
+time -p 
-
-die() {
@@ -15 +15 @@
-}
-
-
-
+
+
+
+
+
-        make MONOLITHIC=n bare
-}
@@ -23 +26 @@
-        local OPTS=""
-
-        trap cleanup SIGINT SIGQUIT
-
-        for i in $TYPES; do
-                # Monolithic tests
+                trap cleanup_mon SIGINT SIGQUIT
-                OPTS="TYPE=$i MONOLITHIC=y QUIET=y DIRECT_INITRC=y"
-                [ ! -z "$1" ] && OPTS="$OPTS DISTRO=$1"
@@ -35 +37 @@
-                make $OPTS file_contexts || die "$?" "$OPTS"
-                $SETFILES -q -c policy.$POLVER file_contexts || die "$?" "$OPTS"
-make $OPTS bare || die "$?" "$OPTS"
+cleanup_mon
-
-                # Loadable module tests
+                trap cleanup_mod SIGINT SIGQUIT
-                OPTS="TYPE=$i MONOLITHIC=n QUIET=y DIRECT_INITRC=y"
-                [ ! -z "$1" ] && OPTS="$OPTS DISTRO=$1"
@@ -49 +52 @@
-                rm dmesg.pp
-                $SE_LINK tmp/base.pp *.pp || die "$?" "$OPTS"
-make $OPTS bare || die "$?" "$OPTS"
+cleanup_mod
-        done
-}
-
-
+
+
-do_test
-
+for i in $DISTROS; do
+        do_test $i
+done
+
-echo "Completed successfully."

trunk/tools/quicktest.sh

@@ -4 +4 @@
-POLVER="`checkpolicy -V |cut -f 1 -d ' '`"
-SETFILES="/usr/sbin/setfiles"
-
+time -p 
-
-die() {
@@ -14 +14 @@
-}
-
-
-
+
+
+
+
+
-        make MONOLITHIC=n bare
-}
@@ -22 +25 @@
-        local OPTS=""
-
-        trap cleanup SIGINT SIGQUIT
-
-        for i in $TYPES; do
-                # Monolithic tests
+                trap cleanup_mon SIGINT SIGQUIT
-                OPTS="TYPE=$i MONOLITHIC=y QUIET=y DIRECT_INITRC=y"
-                [ ! -z "$1" ] && OPTS="$OPTS DISTRO=$1"
@@ -34 +36 @@
-                make $OPTS file_contexts || die "$?" "$OPTS"
-                $SETFILES -q -c policy.$POLVER file_contexts || die "$?" "$OPTS"
-make $OPTS bare || die "$?" "$OPTS"
+cleanup_mon
-
-                # Loadable module tests
+                trap cleanup_mod SIGINT SIGQUIT
-                OPTS="TYPE=$i MONOLITHIC=n QUIET=y DIRECT_INITRC=y"
-                [ ! -z "$1" ] && OPTS="$OPTS DISTRO=$1"
@@ -48 +51 @@
-                rm dmesg.pp
-                $SE_LINK tmp/base.pp *.pp || die "$?" "$OPTS"
-make $OPTS bare || die "$?" "$OPTS"
+cleanup_mod
-        done
-}
-
-
+
+
-do_test
-