Changeset 2659

Timestamp:

04/04/08 12:08:34 (8 months ago)

Author:

pebenito

Message:

trunk: 7 patches from dan.

Files:

• trunk/policy/modules/apps/userhelper.if (modified) (1 diff)
• trunk/policy/modules/kernel/kernel.if (modified) (1 diff)
• trunk/policy/modules/kernel/kernel.te (modified) (3 diffs)
• trunk/policy/modules/services/fetchmail.if (modified) (1 diff)
• trunk/policy/modules/services/fetchmail.te (modified) (1 diff)
• trunk/policy/modules/services/openct.te (modified) (2 diffs)
• trunk/policy/modules/services/pegasus.te (modified) (3 diffs)
• trunk/policy/modules/services/rlogin.te (modified) (5 diffs)
• trunk/policy/modules/services/telnet.te (modified) (5 diffs)

trunk/policy/modules/apps/userhelper.if

@@ -181 +181 @@
-                nscd_socket_use($1_userhelper_t)
-        ')
-
-        ifdef(`TODO',`
-                allow $1_userhelper_t xdm_t:fd use;
-                allow $1_userhelper_t xdm_var_run_t:dir search;
-                allow $1_userhelper_t xdm_t:fifo_file { getattr read write ioctl };
-
-                optional_policy(`
-                        allow $1_userhelper_t gphdomain:fd use;
-                ')
-                optional_policy(`
-                        domtrans_pattern($1_userhelper_t, xauth_exec_t, $1_xauth_t)
-                        allow $1_userhelper_t $1_xauth_home_t:file { getattr read };
-                ')
-                optional_policy(`
-                        domtrans_pattern($1_mozilla_t, userhelper_exec_t, $1_userhelper_t)
-                ')
-                # for when the network connection is killed
-                dontaudit unpriv_userdomain $1_userhelper_t:process signal;
-        ')
-')
-

trunk/policy/modules/kernel/kernel.if

@@ -852 +852 @@
-        ')
-
-        read_files_pattern($1,proc_t,proc_afs_t)
-
-        list_dirs_pattern($1,proc_t,proc_t)
+        rw_files_pattern($1,proc_afs_t,proc_afs_t)
-')
-

trunk/policy/modules/kernel/kernel.te

@@ -1 +1 @@
-
-0
+1
-
-########################################
@@ -364 +364 @@
-allow kern_unconfined proc_type:{ dir file lnk_file } *;
-
-
+ype
-
-allow kern_unconfined kernel_t:system *;
@@ -373 +373 @@
-allow kern_unconfined unlabeled_t:packet *;
-allow kern_unconfined unlabeled_t:process ~{ transition dyntransition execmem execstack execheap };
-
-kernel_rw_all_sysctls(kern_unconfined)

trunk/policy/modules/services/fetchmail.if

@@ -1 +1 @@
-## <summary>Remote-mail retrieval and forwarding utility</summary>
+
+########################################
+## <summary>
+##      All of the rules required to administrate 
+##      an fetchmail environment
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+## <param name="role">
+##      <summary>
+##      The role to be allowed to manage the fetchmail domain.
+##      </summary>
+## </param>
+## <param name="terminal">
+##      <summary>
+##      The type of the user terminal.
+##      </summary>
+## </param>
+## <rolecap/>
+#
+interface(`fetchmail_admin',`
+        gen_require(`
+                type fetchmail_t, fetchmail_etc_t;
+                type fetchmail_uidl_cache_t, fetchmail_var_run_t;
+        ')
+
+        ps_process_pattern($1, fetchmail_t)
+
+        files_list_etc($1)
+        manage_files_pattern($1, fetchmail_etc_t, fetchmail_etc_t)
+
+        manage_files_pattern($1, fetchmail_uidl_cache_t, fetchmail_uidl_cache_t)
+
+        files_list_pids($1)
+        manage_files_pattern($1, fetchmail_var_run_t, fetchmail_var_run_t)
+')

trunk/policy/modules/services/fetchmail.te

@@ -1 +1 @@
-
-0
+1
-
-########################################

trunk/policy/modules/services/openct.te

@@ -1 +1 @@
-
-0
+1
-
-########################################
@@ -23 +23 @@
-
-manage_files_pattern(openct_t,openct_var_run_t,openct_var_run_t)
-
+
+
-
-kernel_read_kernel_sysctls(openct_t)

trunk/policy/modules/services/pegasus.te

@@ -1 +1 @@
-
-0
+1
-
-########################################
@@ -43 +43 @@
-allow pegasus_t pegasus_conf_t:lnk_file read_lnk_file_perms;
-
+manage_dirs_pattern(pegasus_t,pegasus_data_t,pegasus_data_t)
-manage_files_pattern(pegasus_t,pegasus_data_t,pegasus_data_t)
-manage_lnk_files_pattern(pegasus_t,pegasus_data_t,pegasus_data_t)
@@ -114 +115 @@
-
-logging_send_audit_msgs(pegasus_t)
+logging_send_syslog_msg(pegasus_t)
-
-miscfiles_read_localization(pegasus_t)
-
-sysnet_read_config(pegasus_t)
+sysnet_domtrans_ifconfig(pegasus_t)
-
-userdom_dontaudit_use_unpriv_user_fds(pegasus_t)
-userdom_dontaudit_search_sysadm_home_dirs(pegasus_t)
-
-optional_policy(`
-        logging_send_syslog_msg(pegasus_t)
-')
-
-optional_policy(`

trunk/policy/modules/services/rlogin.te

@@ -1 +1 @@
-
-0
+1
-
-########################################
@@ -62 +62 @@
-dev_read_urand(rlogind_t)
-
+domain_interactive_fd(rlogind_t)
+
-fs_getattr_xattr_fs(rlogind_t)
-fs_search_auto_mountpoints(rlogind_t)
@@ -83 +85 @@
-miscfiles_read_localization(rlogind_t)
-
-dontaudit_search
+read
-
-userdom_setattr_unpriv_users_ptys(rlogind_t)
@@ -90 +92 @@
-
-remotelogin_domtrans(rlogind_t)
+remotelogin_signal(rlogind_t)
-
-optional_policy(`
+        kerberos_use(rlogind_t)
-        kerberos_read_keytab(rlogind_t)
-')
@@ -98 +102 @@
-        tcpd_wrapped_domain(rlogind_t, rlogind_exec_t)
-')
-
-ifdef(`TODO',`
-# Allow krb5 rlogind to use fork and open /dev/tty for use
-allow rlogind_t userpty_type:chr_file setattr;
-')

trunk/policy/modules/services/telnet.te

@@ -1 +1 @@
-
-0
+1
-
-########################################
@@ -60 +60 @@
-dev_read_urand(telnetd_t)
-
+domain_interactive_fd(telnetd_t)
+
-fs_getattr_xattr_fs(telnetd_t)
-
@@ -67 +69 @@
-corecmd_search_bin(telnetd_t)
-
+files_read_usr_files(telnetd_t)
-files_read_etc_files(telnetd_t)
-files_read_etc_runtime_files(telnetd_t)
@@ -81 +84 @@
-miscfiles_read_localization(telnetd_t)
-
-dontaudit_search
+read
-
-remotelogin_domtrans(telnetd_t)
-
-
+
+
-optional_policy(`
-        kerberos_use(telnetd_t)
@@ -91 +95 @@
-')
-
-
-
-
+
+
-')
+
+tunable_policy(`use_samba_home_dirs',`
+        fs_search_cifs(telnetd_t)
+')