Changeset 2780

Timestamp:

08/14/08 09:19:50 (3 months ago)

Author:

cpebenito

Message:

trunk: 6 patches from the fedora policy, cherry picked by david hardeman.

Files:

• trunk/policy/modules/admin/bootloader.if (modified) (1 diff)
• trunk/policy/modules/admin/bootloader.te (modified) (2 diffs)
• trunk/policy/modules/admin/kudzu.te (modified) (2 diffs)
• trunk/policy/modules/services/courier.fc (modified) (1 diff)
• trunk/policy/modules/services/courier.if (modified) (1 diff)
• trunk/policy/modules/services/courier.te (modified) (2 diffs)
• trunk/policy/modules/services/rdisc.te (modified) (2 diffs)
• trunk/policy/modules/services/rpc.te (modified) (7 diffs)
• trunk/policy/modules/system/getty.fc (modified) (1 diff)
• trunk/policy/modules/system/getty.te (modified) (2 diffs)

trunk/policy/modules/admin/bootloader.if

@@ -50 +50 @@
-        role $2 types bootloader_t;
-        allow bootloader_t $3:chr_file rw_term_perms;
+
+        ifdef(`distro_redhat',`
+                # for mke2fs
+                mount_run(bootloader_t, $2, $3)
+        ')
-')
-

trunk/policy/modules/admin/bootloader.te

@@ -1 +1 @@
-
-0
+1
-
-########################################
@@ -173 +173 @@
-        # for mke2fs
-        mount_domtrans(bootloader_t)
+
+        optional_policy(`
+                unconfined_domain(bootloader_t)
+        ')
-')
-

trunk/policy/modules/admin/kudzu.te

@@ -1 +1 @@
-
-0
+1
-
-########################################
@@ -144 +144 @@
-
-optional_policy(`
-
-
-
-
-
+
-        unconfined_domain(kudzu_t)
-')
-
-ifdef(`TODO',`
-allow kudzu_t modules_conf_t:file unlink;
-optional_policy(`
-        allow kudzu_t printconf_t:file { getattr read };
-')
-optional_policy(`
-        allow kudzu_t xserver_exec_t:file getattr;
-')
-optional_policy(`
-        allow kudzu_t rhgb_t:unix_stream_socket connectto;
-')
-optional_policy(`
-        role system_r types sysadm_userhelper_t;
-        domain_auto_trans(kudzu_t, userhelper_exec_t, sysadm_userhelper_t)
-')
-allow kudzu_t cupsd_rw_etc_t:dir list_dir_perms;
-')

trunk/policy/modules/services/courier.fc

@@ -20 +20 @@
-
-/var/run/courier(/.*)?                  --      gen_context(system_u:object_r:courier_var_run_t,s0)
+
+/var/spool/courier(/.*)?                        gen_context(system_u:object_r:courier_spool_t,s0)

trunk/policy/modules/services/courier.if

@@ -124 +124 @@
-        domtrans_pattern($1, courier_pop_exec_t, courier_pop_t)
-')
+
+########################################
+## <summary>
+##      Read courier config files
+## </summary>
+## <param name="prefix">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`courier_read_config',`
+        gen_require(`
+                type courier_etc_t;
+        ')
+
+        read_files_pattern($1, courier_etc_t, courier_etc_t)
+')
+
+########################################
+## <summary>
+##      Create, read, write, and delete courier
+##      spool directories.
+## </summary>
+## <param name="prefix">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`courier_manage_spool_dirs',`
+        gen_require(`
+                type courier_spool_t;
+        ')
+
+        manage_dirs_pattern($1, courier_spool_t, courier_spool_t)
+')
+
+########################################
+## <summary>
+##      Create, read, write, and delete courier
+##      spool files.
+## </summary>
+## <param name="prefix">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`courier_manage_spool_files',`
+        gen_require(`
+                type courier_spool_t;
+        ')
+
+        manage_files_pattern($1, courier_spool_t, courier_spool_t)
+')
+
+########################################
+## <summary>
+##      Read and write to courier spool pipes.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain to not audit.
+##      </summary>
+## </param>
+#
+interface(`courier_rw_spool_pipes',`
+        gen_require(`
+                type courier_spool_t;
+        ')
+
+        allow $1 courier_spool_t:fifo_file rw_fifo_file_perms;
+')

trunk/policy/modules/services/courier.te

@@ -1 +1 @@
-
-0
+1
-
-########################################
@@ -10 +10 @@
-
-type courier_etc_t;
-typ
+config_fil
-
-courier_domain_template(pcp)
-
-courier_domain_template(pop)
+
+type courier_spool_t;
+files_type(courier_spool_t)
-
-courier_domain_template(tcpd)

trunk/policy/modules/services/rdisc.te

@@ -1 +1 @@
-
-0
+1
-
-########################################
@@ -48 +48 @@
-logging_send_syslog_msg(rdisc_t)
-
+miscfiles_read_localization(rdisc_t)
+
-sysnet_read_config(rdisc_t)
-

trunk/policy/modules/services/rpc.te

@@ -1 +1 @@
-
-0
+1
-
-########################################
@@ -63 +63 @@
-# rpc.statd executes sm-notify
-can_exec(rpcd_t, rpcd_exec_t)
-corecmd_search_bin(rpcd_t)
-
-kernel_read_system_state(rpcd_t) 
-search_network_state(rpcd_t) 
+read_network_state(rpcd_t)
-# for rpc.rquotad
-kernel_read_sysctl(rpcd_t)  
-kernel_rw_fs_sysctls(rpcd_t)
+
+corecmd_exec_bin(rpcd_t)
+
+files_manage_mounttab(rpcd_t)
-
-fs_list_rpc(rpcd_t)
@@ -75 +78 @@
-fs_read_rpc_symlinks(rpcd_t)
-fs_read_rpc_sockets(rpcd_t) 
-term_use_controlling_term(rpcd_t)
-
-
-
+
-
-miscfiles_read_certs(rpcd_t)
@@ -105 +106 @@
-corenet_udp_bind_all_rpc_ports(nfsd_t)
-
-
-
-
-
-
-
+
+
+
-
-# does not really need this, but it is easier to just allow it
@@ -118 +116 @@
-# cjp: this should really have its own type
-files_manage_mounttab(rpcd_t)
+
+fs_mount_nfsd_fs(nfsd_t) 
+fs_search_nfsd_fs(nfsd_t) 
+fs_getattr_all_fs(nfsd_t) 
+fs_getattr_all_dirs(nfsd_t)
+fs_rw_nfsd_fs(nfsd_t) 
+
+storage_dontaudit_read_fixed_disk(nfsd_t)
-
-# Read access to public_content_t and public_content_rw_t
@@ -150 +156 @@
-files_tmp_filetrans(gssd_t, gssd_tmp_t, { file dir })
-
+kernel_read_system_state(gssd_t)
-kernel_read_network_state(gssd_t)
-kernel_read_network_state_symlinks(gssd_t)      
@@ -162 +169 @@
-files_list_tmp(gssd_t) 
-files_read_usr_symlinks(gssd_t) 
+
+auth_use_nsswitch(gssd_t)
-
-miscfiles_read_certs(gssd_t)

trunk/policy/modules/system/getty.fc

@@ -9 +9 @@
-/var/run/mgetty\.pid.*  --      gen_context(system_u:object_r:getty_var_run_t,s0)
-
-         --
-       --
+(/.*)?   
+(/.*)? 

trunk/policy/modules/system/getty.te

@@ -1 +1 @@
-
-1.6.0
+ 1.6.1
-
-########################################
@@ -10 +10 @@
-type getty_exec_t;
-init_domain(getty_t,getty_exec_t)
+init_system_domain(getty_t, getty_exec_t)
-domain_interactive_fd(getty_t)
-