Changeset 2681

Timestamp:

05/12/08 15:05:32 (6 months ago)

Author:

pebenito

Message:

trunk: Patch to allow gpg agent --write-env-file option from Vaclav Ovsik.

Files:

• trunk/Changelog (modified) (1 diff)
• trunk/policy/modules/apps/gpg.if (modified) (3 diffs)
• trunk/policy/modules/apps/gpg.te (modified) (2 diffs)

trunk/Changelog

@@ +1 @@
+- Patch to allow gpg agent --write-env-file option from Vaclav Ovsik.
-- X application data class from Eamon Walsh and Ted Toth.
-- Move user roles into individual modules.

trunk/policy/modules/apps/gpg.if

@@ -208 +208 @@
-        allow $1_gpg_agent_t self:fifo_file rw_fifo_file_perms;
-
+        # Allow the gpg-agent to manage its tmp files (socket)
+        manage_dirs_pattern($1_gpg_agent_t,$1_gpg_agent_tmp_t,$1_gpg_agent_tmp_t)
+        manage_files_pattern($1_gpg_agent_t,$1_gpg_agent_tmp_t,$1_gpg_agent_tmp_t)
+        manage_sock_files_pattern($1_gpg_agent_t,$1_gpg_agent_tmp_t,$1_gpg_agent_tmp_t)
+        files_tmp_filetrans($1_gpg_agent_t, $1_gpg_agent_tmp_t, { file sock_file dir })
+
-        # read and write ~/.gnupg (gpg-agent stores secret keys in ~/.gnupg/private-keys-v1.d )
-        manage_dirs_pattern($1_gpg_agent_t,$1_gpg_secret_t,$1_gpg_secret_t)
@@ -220 +226 @@
-
-        # Allow the user shell to signal the gpg-agent program.
-
-
+
+
+
-        manage_dirs_pattern($2,$1_gpg_agent_tmp_t,$1_gpg_agent_tmp_t)
-        manage_files_pattern($2,$1_gpg_agent_tmp_t,$1_gpg_agent_tmp_t)
-        manage_sock_files_pattern($2,$1_gpg_agent_tmp_t,$1_gpg_agent_tmp_t)
-        files_tmp_filetrans($1_gpg_agent_t, $1_gpg_agent_tmp_t, { file sock_file dir })
-
-        # Transition from the user domain to the derived domain.
@@ -243 +249 @@
-        # read and write ~/.gnupg (gpg-agent stores secret keys in ~/.gnupg/private-keys-v1.d )
-        userdom_search_user_home_dirs($1,$1_gpg_agent_t)
+
+        tunable_policy(`gpg_agent_env_file',`
+                # write ~/.gpg-agent-info or a similar to the users home dir
+                # or subdir (gpg-agent --write-env-file option)
+                #
+                userdom_user_home_dir_filetrans_user_home_content($1,$1_gpg_agent_t,file)
+                userdom_manage_user_home_content_dirs($1,$1_gpg_agent_t)
+                userdom_manage_user_home_content_files($1,$1_gpg_agent_t)
+        ')
-
-        tunable_policy(`use_nfs_home_dirs',`

trunk/policy/modules/apps/gpg.te

@@ -1 +1 @@
-
-0
+1
-
-########################################
@@ -6 +6 @@
-# Declarations
-#
+
+## <desc>
+## <p>
+## Allow usage of the gpg-agent --write-env-file option.
+## This also allows gpg-agent to manage user files.
+## </p>
+## </desc>
+gen_tunable(gpg_agent_env_file, false)
-
-# Type for gpg or pgp executables.