[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     e5a6d4014b2ee79cf221b70afc6edca9c0f84c7e
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Sat Oct 13 10:10:43 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sat Oct 13 19:33:18 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=e5a6d401

Changes to the evolution policy module

Make evolution create ~/.evolution and ~/.camel_certs with a type
transitition

Allow evolution_t to create other content in user home directories with
generic user home content type (consider attachments etc)

Allow evolution to manage generic user tmp content

Fix nfs and samba fs usage

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/evolution.te |  102 +++++++++++++++--------------------
 1 files changed, 43 insertions(+), 59 deletions(-)

diff --git a/policy/modules/contrib/evolution.te b/policy/modules/contrib/evolution.te
index 8f78aae..94fb625 100644
--- a/policy/modules/contrib/evolution.te
+++ b/policy/modules/contrib/evolution.te
@@ -1,4 +1,4 @@
-policy_module(evolution, 2.3.6)
+policy_module(evolution, 2.3.7)
 
 ########################################
 #
@@ -104,6 +104,8 @@ allow evolution_t self:fifo_file rw_file_perms;
 allow evolution_t evolution_home_t:dir manage_dir_perms;
 allow evolution_t evolution_home_t:file manage_file_perms;
 allow evolution_t evolution_home_t:lnk_file manage_lnk_file_perms;
+userdom_user_home_dir_filetrans(evolution_t, evolution_home_t, dir, ".evolution")
+userdom_user_home_dir_filetrans(evolution_t, evolution_home_t, dir, ".camel_certs")
 
 allow evolution_t evolution_orbit_tmp_t:dir manage_dir_perms;
 allow evolution_t evolution_orbit_tmp_t:file manage_file_perms;
@@ -178,19 +180,33 @@ miscfiles_read_localization(evolution_t)
 
 udev_read_state(evolution_t)
 
-userdom_rw_user_tmp_files(evolution_t)
+userdom_use_user_terminals(evolution_t)
+
 userdom_manage_user_tmp_dirs(evolution_t)
-userdom_manage_user_tmp_sockets(evolution_t)
 userdom_manage_user_tmp_files(evolution_t)
-userdom_use_user_terminals(evolution_t)
-userdom_dontaudit_read_user_home_content_files(evolution_t)
-userdom_search_user_home_dirs(evolution_t)
+
+userdom_manage_user_home_content_dirs(evolution_t)
+userdom_manage_user_home_content_files(evolution_t)
+userdom_user_home_dir_filetrans_user_home_content(evolution_t, { dir file })
+
+userdom_write_user_tmp_sockets(evolution_t)
 
 mta_read_config(evolution_t)
 
 xserver_user_x_domain_template(evolution, evolution_t, evolution_tmpfs_t)
 xserver_read_xdm_tmp_files(evolution_t)
 
+ifndef(`enable_mls',`
+	fs_list_dos(evolution_t)
+	fs_read_dos_files(evolution_t)
+
+	fs_search_removable(evolution_t)
+	fs_read_removable_files(evolution_t)
+	fs_read_removable_symlinks(evolution_t)
+
+	fs_read_iso9660_files(evolution_t)
+')
+
 tunable_policy(`use_nfs_home_dirs',`
 	fs_manage_nfs_dirs(evolution_t)
 	fs_manage_nfs_files(evolution_t)
@@ -203,54 +219,6 @@ tunable_policy(`use_samba_home_dirs',`
 	fs_manage_cifs_symlinks(evolution_t)
 ')
 
-tunable_policy(`mail_read_content && use_nfs_home_dirs',`
-	fs_list_auto_mountpoints(evolution_t)
-	files_list_home(evolution_t)
-	fs_read_nfs_files(evolution_t)
-	fs_read_nfs_symlinks(evolution_t)
-
-',`
-	files_dontaudit_list_home(evolution_t)
-	fs_dontaudit_list_auto_mountpoints(evolution_t)
-	fs_dontaudit_read_nfs_files(evolution_t)
-	fs_dontaudit_list_nfs(evolution_t)
-')
-
-tunable_policy(`mail_read_content && use_samba_home_dirs',`
-	fs_list_auto_mountpoints(evolution_t)
-	files_list_home(evolution_t)
-	fs_read_cifs_files(evolution_t)
-	fs_read_cifs_symlinks(evolution_t)
-',`
-	files_dontaudit_list_home(evolution_t)
-	fs_dontaudit_list_auto_mountpoints(evolution_t)
-	fs_dontaudit_read_cifs_files(evolution_t)
-	fs_dontaudit_list_cifs(evolution_t)
-')
-
-tunable_policy(`mail_read_content',`
-	userdom_list_user_tmp(evolution_t)
-	userdom_read_user_tmp_files(evolution_t)
-	userdom_read_user_tmp_symlinks(evolution_t)
-	userdom_read_user_home_content_files(evolution_t)
-	userdom_read_user_home_content_symlinks(evolution_t)
-
-	ifndef(`enable_mls',`
-		fs_search_removable(evolution_t)
-		fs_read_removable_files(evolution_t)
-		fs_read_removable_symlinks(evolution_t)
-	')
-',`
-	files_dontaudit_list_tmp(evolution_t)
-	files_dontaudit_list_home(evolution_t)
-	fs_dontaudit_list_removable(evolution_t)
-	fs_dontaudit_read_removable_files(evolution_t)
-	userdom_dontaudit_list_user_tmp(evolution_t)
-	userdom_dontaudit_read_user_tmp_files(evolution_t)
-	userdom_dontaudit_list_user_home_dirs(evolution_t)
-	userdom_dontaudit_read_user_home_content_files(evolution_t)
-')
-
 optional_policy(`
 	automount_read_state(evolution_t)
 ')
@@ -274,7 +242,7 @@ optional_policy(`
 ')
 
 optional_policy(`
-	lpd_domtrans_lpr(evolution_t)
+	lpd_run_lpr(evolution_t, evolution_roles)
 ')
 
 optional_policy(`
@@ -309,6 +277,8 @@ fs_tmpfs_filetrans(evolution_alarm_t, evolution_alarm_tmpfs_t, { dir file lnk_fi
 allow evolution_alarm_t evolution_home_t:dir manage_dir_perms;
 allow evolution_alarm_t evolution_home_t:file manage_file_perms;
 allow evolution_alarm_t evolution_home_t:lnk_file manage_lnk_file_perms;
+userdom_user_home_dir_filetrans(evolution_alarm_t, evolution_home_t, dir, ".evolution")
+userdom_user_home_dir_filetrans(evolution_alarm_t, evolution_home_t, dir, ".camel_certs")
 
 stream_connect_pattern(evolution_alarm_t, evolution_orbit_tmp_t, evolution_orbit_tmp_t, evolution_t)
 stream_connect_pattern(evolution_alarm_t, evolution_exchange_orbit_tmp_t, evolution_exchange_orbit_tmp_t, evolution_exchange_t)
@@ -324,17 +294,20 @@ auth_use_nsswitch(evolution_alarm_t)
 
 miscfiles_read_localization(evolution_alarm_t)
 
-userdom_search_user_home_dirs(evolution_alarm_t)
 userdom_dontaudit_read_user_home_content_files(evolution_alarm_t)
 
 xserver_user_x_domain_template(evolution_alarm, evolution_alarm_t, evolution_alarm_tmpfs_t)
 
 tunable_policy(`use_nfs_home_dirs',`
+	fs_manage_nfs_dirs(evolution_alarm_t)
 	fs_manage_nfs_files(evolution_alarm_t)
+	fs_manage_nfs_symlinks(evolution_alarm_t)
 ')
 
 tunable_policy(`use_samba_home_dirs',`
+	fs_manage_cifs_dirs(evolution_alarm_t)
 	fs_manage_cifs_files(evolution_alarm_t)
+	fs_manage_cifs_symlinks(evolution_alarm_t)
 ')
 
 optional_policy(`
@@ -356,6 +329,8 @@ allow evolution_exchange_t self:fifo_file rw_fifo_file_perms;
 allow evolution_exchange_t evolution_home_t:dir manage_dir_perms;
 allow evolution_exchange_t evolution_home_t:file manage_file_perms;
 allow evolution_exchange_t evolution_home_t:lnk_file manage_lnk_file_perms;
+userdom_user_home_dir_filetrans(evolution_exchange_t, evolution_home_t, dir, ".evolution")
+userdom_user_home_dir_filetrans(evolution_exchange_t, evolution_home_t, dir, ".camel_certs")
 
 allow evolution_exchange_t evolution_exchange_tmp_t:dir manage_dir_perms;
 allow evolution_exchange_t evolution_exchange_tmp_t:file manage_file_perms;
@@ -387,18 +362,22 @@ auth_use_nsswitch(evolution_exchange_t)
 
 miscfiles_read_localization(evolution_exchange_t)
 
-userdom_write_user_tmp_sockets(evolution_exchange_t)
-userdom_search_user_home_dirs(evolution_exchange_t)
 userdom_dontaudit_read_user_home_content_files(evolution_exchange_t)
 
+userdom_write_user_tmp_sockets(evolution_exchange_t)
+
 xserver_user_x_domain_template(evolution_exchange, evolution_exchange_t, evolution_exchange_tmpfs_t)
 
 tunable_policy(`use_nfs_home_dirs',`
+	fs_manage_nfs_dirs(evolution_exchange_t)
 	fs_manage_nfs_files(evolution_exchange_t)
+	fs_manage_nfs_symlinks(evolution_exchange_t)
 ')
 
 tunable_policy(`use_samba_home_dirs',`
+	fs_manage_cifs_dirs(evolution_exchange_t)
 	fs_manage_cifs_files(evolution_exchange_t)
+	fs_manage_cifs_symlinks(evolution_exchange_t)
 ')
 
 optional_policy(`
@@ -418,6 +397,8 @@ allow evolution_server_t self:unix_stream_socket { accept connectto listen };
 allow evolution_server_t evolution_home_t:dir manage_dir_perms;
 allow evolution_server_t evolution_home_t:file manage_file_perms;
 allow evolution_server_t evolution_home_t:lnk_file manage_lnk_file_perms;
+userdom_user_home_dir_filetrans(evolution_server_t, evolution_home_t, dir, ".evolution")
+userdom_user_home_dir_filetrans(evolution_server_t, evolution_home_t, dir, ".camel_certs")
 
 stream_connect_pattern(evolution_server_t, evolution_orbit_tmp_t, evolution_orbit_tmp_t, evolution_t)
 stream_connect_pattern(evolution_server_t, evolution_exchange_orbit_tmp_t, evolution_exchange_orbit_tmp_t, evolution_exchange_t)
@@ -451,15 +432,18 @@ auth_use_nsswitch(evolution_server_t)
 miscfiles_read_localization(evolution_server_t)
 miscfiles_read_generic_certs(evolution_server_t)
 
-userdom_search_user_home_dirs(evolution_server_t)
 userdom_dontaudit_read_user_home_content_files(evolution_server_t)
 
 tunable_policy(`use_nfs_home_dirs',`
+	fs_manage_nfs_dirs(evolution_server_t)
 	fs_manage_nfs_files(evolution_server_t)
+	fs_manage_nfs_symlinks(evolution_server_t)
 ')
 
 tunable_policy(`use_samba_home_dirs',`
+	fs_manage_cifs_dirs(evolution_server_t)
 	fs_manage_cifs_files(evolution_server_t)
+	fs_manage_cifs_symlinks(evolution_server_t)
 ')
 
 optional_policy(`