[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     9ebf08b74f90b4ed3f5b8503fb945720ce75eeb4
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Thu Oct 11 10:57:03 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Oct 11 16:03:58 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=9ebf08b7

Changes to the milter policy module and relevant dependencies

Ported from Fedora with changes

Port 2501/tcp kismet in refpolicy and rtsclient in Fedora

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/dkim.fc   |    3 +-
 policy/modules/contrib/dkim.te   |    6 +--
 policy/modules/contrib/milter.fc |    6 +-
 policy/modules/contrib/milter.if |   53 ++++++++++-------------
 policy/modules/contrib/milter.te |   84 +++++++++++++++++++-------------------
 5 files changed, 72 insertions(+), 80 deletions(-)

diff --git a/policy/modules/contrib/dkim.fc b/policy/modules/contrib/dkim.fc
index eebcf5d..5818418 100644
--- a/policy/modules/contrib/dkim.fc
+++ b/policy/modules/contrib/dkim.fc
@@ -1,4 +1,3 @@
-/etc/mail/dkim-milter/keys(/.*)?	gen_context(system_u:object_r:dkim_milter_private_key_t,s0)
 /etc/opendkim/keys(/.*)?	gen_context(system_u:object_r:dkim_milter_private_key_t,s0)
 
 /etc/rc\.d/init\.d/((opendkim)|(dkim-milter))	--	gen_context(system_u:object_r:dkim_milter_initrc_exec_t,s0)
@@ -8,6 +7,8 @@
 
 /var/db/dkim(/.*)?	gen_context(system_u:object_r:dkim_milter_private_key_t,s0)
 
+/var/lib/dkim-milter(/.*)?	gen_context(system_u:object_r:dkim_milter_data_t,s0)
+
 /var/run/dkim-filter(/.*)?	gen_context(system_u:object_r:dkim_milter_data_t,s0)
 /var/run/dkim-milter(/.*)?	gen_context(system_u:object_r:dkim_milter_data_t,s0)
 /var/run/dkim-milter\.pid	--	gen_context(system_u:object_r:dkim_milter_data_t,s0)

diff --git a/policy/modules/contrib/dkim.te b/policy/modules/contrib/dkim.te
index 30f4578..e1319b2 100644
--- a/policy/modules/contrib/dkim.te
+++ b/policy/modules/contrib/dkim.te
@@ -1,4 +1,4 @@
-policy_module(dkim, 1.1.1)
+policy_module(dkim, 1.1.2)
 
 ########################################
 #
@@ -20,6 +20,7 @@ files_type(dkim_milter_private_key_t)
 
 allow dkim_milter_t self:capability { setgid setuid };
 allow dkim_milter_t self:process signal;
+allow dkim_milter_t self:unix_stream_socket create_stream_socket_perms;
 
 read_files_pattern(dkim_milter_t, dkim_milter_private_key_t, dkim_milter_private_key_t)
 
@@ -27,9 +28,6 @@ kernel_read_kernel_sysctls(dkim_milter_t)
 
 dev_read_urand(dkim_milter_t)
 
-files_read_etc_files(dkim_milter_t)
 files_search_spool(dkim_milter_t)
 
-sysnet_dns_name_resolve(dkim_milter_t)
-
 mta_read_config(dkim_milter_t)

diff --git a/policy/modules/contrib/milter.fc b/policy/modules/contrib/milter.fc
index b644224..89409eb 100644
--- a/policy/modules/contrib/milter.fc
+++ b/policy/modules/contrib/milter.fc
@@ -1,18 +1,18 @@
 /usr/sbin/milter-greylist	--	gen_context(system_u:object_r:greylist_milter_exec_t,s0)
+/usr/sbin/sqlgrey	--	gen_context(system_u:object_r:greylist_milter_exec_t,s0)
 /usr/sbin/milter-regex	--	gen_context(system_u:object_r:regex_milter_exec_t,s0)
 /usr/sbin/spamass-milter	--	gen_context(system_u:object_r:spamass_milter_exec_t,s0)
-/usr/sbin/sqlgrey	--	gen_context(system_u:object_r:greylist_milter_exec_t,s0)
 
 /var/lib/milter-greylist(/.*)?	gen_context(system_u:object_r:greylist_milter_data_t,s0)
-/var/lib/spamass-milter(/.*)?	gen_context(system_u:object_r:spamass_milter_state_t,s0)
 /var/lib/sqlgrey(/.*)?	gen_context(system_u:object_r:greylist_milter_data_t,s0)
+/var/lib/spamass-milter(/.*)?	gen_context(system_u:object_r:spamass_milter_state_t,s0)
 
 /var/run/milter-greylist(/.*)?	gen_context(system_u:object_r:greylist_milter_data_t,s0)
 /var/run/milter-greylist\.pid	--	gen_context(system_u:object_r:greylist_milter_data_t,s0)
 /var/run/spamass(/.*)?	gen_context(system_u:object_r:spamass_milter_data_t,s0)
+/var/run/sqlgrey\.pid	--	gen_context(system_u:object_r:greylist_milter_data_t,s0)
 /var/run/spamass-milter(/.*)?	gen_context(system_u:object_r:spamass_milter_data_t,s0)
 /var/run/spamass-milter\.pid	--	gen_context(system_u:object_r:spamass_milter_data_t,s0)
-/var/run/sqlgrey\.pid	--	gen_context(system_u:object_r:greylist_milter_data_t,s0)
 
 /var/spool/milter-regex(/.*)?	gen_context(system_u:object_r:regex_milter_data_t,s0)
 /var/spool/postfix/spamass(/.*)?	gen_context(system_u:object_r:spamass_milter_data_t,s0)

diff --git a/policy/modules/contrib/milter.if b/policy/modules/contrib/milter.if
index ee72cbe..cba62db 100644
--- a/policy/modules/contrib/milter.if
+++ b/policy/modules/contrib/milter.if
@@ -1,54 +1,47 @@
-## <summary>Milter mail filters</summary>
+## <summary>Milter mail filters.</summary>
 
-########################################
+#######################################
 ## <summary>
-##	Create a set of derived types for various
-##	mail filter applications using the milter interface.
+##	The template to define a milter domain.
 ## </summary>
-## <param name="milter_name">
+## <param name="domain_prefix">
 ##	<summary>
-##	The name to be used for deriving type names.
+##	Domain prefix to be used.
 ##	</summary>
 ## </param>
 #
 template(`milter_template',`
-	# attributes common to all milters
 	gen_require(`
 		attribute milter_data_type, milter_domains;
 	')
 
+	########################################
+	#
+	# Declarations
+	#
+
 	type $1_milter_t, milter_domains;
 	type $1_milter_exec_t;
 	init_daemon_domain($1_milter_t, $1_milter_exec_t)
-	role system_r types $1_milter_t;
 
-	# Type for the milter data (e.g. the socket used to communicate with the MTA)
 	type $1_milter_data_t, milter_data_type;
-	files_type($1_milter_data_t)
+	files_pid_file($1_milter_data_t)
 
-	allow $1_milter_t self:fifo_file rw_fifo_file_perms;
-	# Allow communication with MTA over a TCP socket
-	allow $1_milter_t self:tcp_socket create_stream_socket_perms;
-
-	# Allow communication with MTA over a unix-domain socket
-	manage_sock_files_pattern($1_milter_t, $1_milter_data_t, $1_milter_data_t)
+	########################################
+	#
+	# Policy
+	#
 
-	# Create other data files and directories in the data directory
 	manage_files_pattern($1_milter_t, $1_milter_data_t, $1_milter_data_t)
+	manage_sock_files_pattern($1_milter_t, $1_milter_data_t, $1_milter_data_t)
 
-	corenet_tcp_bind_generic_node($1_milter_t)
-	corenet_tcp_bind_milter_port($1_milter_t)
-
-	files_read_etc_files($1_milter_t)
-
-	miscfiles_read_localization($1_milter_t)
-
-	logging_send_syslog_msg($1_milter_t)
+	auth_use_nsswitch($1_milter_t)
 ')
 
 ########################################
 ## <summary>
-##	MTA communication with milter sockets
+##	connect to all milter domains using
+##	a unix domain stream socket.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -61,13 +54,13 @@ interface(`milter_stream_connect_all',`
 		attribute milter_data_type, milter_domains;
 	')
 
-	getattr_dirs_pattern($1, milter_data_type, milter_data_type)
+	files_search_pids($1)
 	stream_connect_pattern($1, milter_data_type, milter_data_type, milter_domains)
 ')
 
 ########################################
 ## <summary>
-##	Allow getattr of milter sockets
+##	Get attributes of all  milter sock files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -80,13 +73,13 @@ interface(`milter_getattr_all_sockets',`
 		attribute milter_data_type;
 	')
 
-	getattr_dirs_pattern($1, milter_data_type, milter_data_type)
 	getattr_sock_files_pattern($1, milter_data_type, milter_data_type)
 ')
 
 ########################################
 ## <summary>
-##	Manage spamassassin milter state
+##	Create, read, write, and delete
+##	spamassissin milter data content.
 ## </summary>
 ## <param name="domain">
 ##	<summary>

diff --git a/policy/modules/contrib/milter.te b/policy/modules/contrib/milter.te
index 26b5de5..92508b2 100644
--- a/policy/modules/contrib/milter.te
+++ b/policy/modules/contrib/milter.te
@@ -5,104 +5,104 @@ policy_module(milter, 1.4.2)
 # Declarations
 #
 
-# attributes common to all milters
 attribute milter_domains;
 attribute milter_data_type;
 
-# currently-supported milters are milter-greylist, milter-regex and spamass-milter
 milter_template(greylist)
 milter_template(regex)
 milter_template(spamass)
 
-# Type for the spamass-milter home directory, under which spamassassin will
-# store system-wide preferences, bayes databases etc. if not configured to
-# use per-user configuration
 type spamass_milter_state_t;
 files_type(spamass_milter_state_t)
 
+#######################################
+#
+# Common local policy
+#
+
+allow milter_domains self:fifo_file rw_fifo_file_perms;
+allow milter_domains self:tcp_socket { accept listen };
+
+kernel_dontaudit_read_system_state(milter_domains)
+
+corenet_all_recvfrom_unlabeled(milter_domains)
+corenet_all_recvfrom_netlabel(milter_domains)
+corenet_tcp_sendrecv_generic_if(milter_domains)
+corenet_tcp_sendrecv_generic_node(milter_domains)
+corenet_tcp_bind_generic_node(milter_domains)
+
+corenet_tcp_bind_milter_port(milter_domains)
+corenet_tcp_sendrecv_all_ports(milter_domains)
+
+miscfiles_read_localization(milter_domains)
+
+logging_send_syslog_msg(milter_domains)
+
 ########################################
 #
-# milter-greylist local policy
-#   ensure smtp clients retry mail like real MTAs and not spamware
-#   http://hcpnet.free.fr/milter-greylist/
+# greylist local policy
 #
 
-# It removes any existing socket (not owned by root) whilst running as root,
-# fixes permissions, renices itself and then calls setgid() and setuid() to
-# drop privileges
 allow greylist_milter_t self:capability { chown dac_override setgid setuid sys_nice };
 allow greylist_milter_t self:process { setsched getsched };
 
-# It creates a pid file /var/run/milter-greylist.pid
 files_pid_filetrans(greylist_milter_t, greylist_milter_data_t, file)
 
 kernel_read_kernel_sysctls(greylist_milter_t)
 
+corenet_sendrecv_movaz_ssc_server_packets(greylist_milter_t)
+corenet_tcp_bind_movaz_ssc_port(greylist_milter_t)
+corenet_sendrecv_movaz_ssc_client_packets(greylist_milter_t)
+corenet_tcp_connect_movaz_ssc_port(greylist_milter_t)
+corenet_tcp_sendrecv_movaz_ssc_port(greylist_milter_t)
+
+corenet_sendrecv_kismet_server_packets(greylist_milter_t)
+corenet_tcp_bind_kismet_port(greylist_milter_t)
+corenet_tcp_sendrecv_kismet_port(greylist_milter_t)
+
+corecmd_exec_bin(greylist_milter_t)
+corecmd_exec_shell(greylist_milter_t)
+
 dev_read_rand(greylist_milter_t)
 dev_read_urand(greylist_milter_t)
 
-files_read_etc_files(greylist_milter_t)
-# Allow the milter to read a GeoIP database in /usr/share
 files_read_usr_files(greylist_milter_t)
-# The milter runs from /var/lib/milter-greylist and maintains files there
 files_search_var_lib(greylist_milter_t)
 
-# Look up username for dropping privs
-auth_use_nsswitch(greylist_milter_t)
+mta_read_config(greylist_milter_t)
 
 miscfiles_read_localization(greylist_milter_t)
 
-sysnet_read_config(greylist_milter_t)
-
-# Config is in /etc/mail/greylist.conf
-mta_read_config(greylist_milter_t)
-
 optional_policy(`
 	mysql_stream_connect(greylist_milter_t)
 ')
 
 ########################################
 #
-# milter-regex local policy
-#   filter emails using regular expressions
-#   http://www.benzedrine.cx/milter-regex.html
+# regex local policy
 #
 
-# It removes any existing socket (not owned by root) whilst running as root
-# and then calls setgid() and setuid() to drop privileges
 allow regex_milter_t self:capability { setuid setgid dac_override };
 
-# The milter's socket directory lives under /var/spool
 files_search_spool(regex_milter_t)
 
-# Look up username for dropping privs
-auth_use_nsswitch(regex_milter_t)
-
-# Config is in /etc/mail/milter-regex.conf
 mta_read_config(regex_milter_t)
 
 ########################################
 #
-# spamass-milter local policy
-#   pipe emails through SpamAssassin
-#   http://savannah.nongnu.org/projects/spamass-milt/
+# spamass local policy
 #
 
-# The milter runs from /var/lib/spamass-milter
 allow spamass_milter_t spamass_milter_state_t:dir search_dir_perms;
-files_search_var_lib(spamass_milter_t)
 
 kernel_read_system_state(spamass_milter_t)
 
-# When used with -b or -B options, the milter invokes sendmail to send mail
-# to a spamtrap address, using popen()
 corecmd_exec_shell(spamass_milter_t)
-corecmd_read_bin_symlinks(spamass_milter_t)
-corecmd_search_bin(spamass_milter_t)
+
+files_search_var_lib(spamass_milter_t)
 
 mta_send_mail(spamass_milter_t)
 
-# The main job of the milter is to pipe spam through spamc and act on the result
 optional_policy(`
 	spamassassin_domtrans_client(spamass_milter_t)
 ')