[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     0d6afabe38f1e81cd78b78be9e8d25b1178bd979
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Tue Oct 16 09:25:13 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Oct 16 17:36:15 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=0d6afabe

Changes to the ntp policy module

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/ntp.fc |    2 +-
 policy/modules/contrib/ntp.if |   12 +++++---
 policy/modules/contrib/ntp.te |   56 +++++++++++++++++++---------------------
 3 files changed, 35 insertions(+), 35 deletions(-)

diff --git a/policy/modules/contrib/ntp.fc b/policy/modules/contrib/ntp.fc
index 74a7528..bafa560 100644
--- a/policy/modules/contrib/ntp.fc
+++ b/policy/modules/contrib/ntp.fc
@@ -1,7 +1,7 @@
 /etc/cron\.(daily|weekly)/ntp-simple	--	gen_context(system_u:object_r:ntpd_exec_t,s0)
 /etc/cron\.(daily|weekly)/ntp-server	--	gen_context(system_u:object_r:ntpd_exec_t,s0)
 
-/etc/ntpd?\.conf.*	--	gen_context(system_u:object_r:ntp_conf_t,s0)
+/etc/ntpd.*\.conf.*	--	gen_context(system_u:object_r:ntp_conf_t,s0)
 /etc/ntp/crypto(/.*)?	gen_context(system_u:object_r:ntpd_key_t,s0)
 /etc/ntp/data(/.*)?	gen_context(system_u:object_r:ntp_drift_t,s0)
 /etc/ntp/keys	--	gen_context(system_u:object_r:ntpd_key_t,s0)

diff --git a/policy/modules/contrib/ntp.if b/policy/modules/contrib/ntp.if
index e4e72b1..b59196f 100644
--- a/policy/modules/contrib/ntp.if
+++ b/policy/modules/contrib/ntp.if
@@ -1,4 +1,4 @@
-## <summary>Network time protocol daemon</summary>
+## <summary>Network time protocol daemon.</summary>
 
 ########################################
 ## <summary>
@@ -54,11 +54,11 @@ interface(`ntp_domtrans',`
 #
 interface(`ntp_run',`
 	gen_require(`
-		type ntpd_t;
+		attribute_role ntpd_roles;
 	')
 
 	ntp_domtrans($1)
-	role $2 types ntpd_t;
+	roleattribute $2 ntpd_roles;
 ')
 
 ########################################
@@ -122,8 +122,8 @@ interface(`ntp_rw_shm',`
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate
-##	an ntp environment
+##	All of the rules required to
+##	administrate an ntp environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -163,4 +163,6 @@ interface(`ntp_admin',`
 
 	files_list_pids($1)
 	admin_pattern($1, ntpd_var_run_t)
+
+	ntp_run($1, $2)
 ')

diff --git a/policy/modules/contrib/ntp.te b/policy/modules/contrib/ntp.te
index 70b3493..82a7b75 100644
--- a/policy/modules/contrib/ntp.te
+++ b/policy/modules/contrib/ntp.te
@@ -1,16 +1,19 @@
-policy_module(ntp, 1.10.1)
+policy_module(ntp, 1.10.2)
 
 ########################################
 #
 # Declarations
 #
 
+attribute_role ntpd_roles;
+
 type ntp_drift_t;
 files_type(ntp_drift_t)
 
 type ntpd_t;
 type ntpd_exec_t;
 init_daemon_domain(ntpd_t, ntpd_exec_t)
+role ntpd_roles types ntpd_t;
 
 type ntpd_initrc_exec_t;
 init_script_file(ntpd_initrc_exec_t)
@@ -41,32 +44,26 @@ init_system_domain(ntpd_t, ntpdate_exec_t)
 # Local policy
 #
 
-# sys_resource and setrlimit is for locking memory
-# ntpdate wants sys_nice
 allow ntpd_t self:capability { chown dac_override kill setgid setuid sys_time ipc_lock ipc_owner sys_chroot sys_nice sys_resource };
 dontaudit ntpd_t self:capability { net_admin sys_tty_config fsetid sys_nice };
 allow ntpd_t self:process { signal_perms getcap setcap setsched setrlimit };
 allow ntpd_t self:fifo_file rw_fifo_file_perms;
 allow ntpd_t self:shm create_shm_perms;
-allow ntpd_t self:unix_dgram_socket create_socket_perms;
-allow ntpd_t self:unix_stream_socket create_socket_perms;
-allow ntpd_t self:tcp_socket create_stream_socket_perms;
-allow ntpd_t self:udp_socket create_socket_perms;
+allow ntpd_t self:tcp_socket { accept listen };
 
 manage_files_pattern(ntpd_t, ntp_drift_t, ntp_drift_t)
 
-can_exec(ntpd_t, ntpd_exec_t)
-
 allow ntpd_t ntp_conf_t:file read_file_perms;
 
 read_files_pattern(ntpd_t, ntpd_key_t, ntpd_key_t)
 read_lnk_files_pattern(ntpd_t, ntpd_key_t, ntpd_key_t)
 
 allow ntpd_t ntpd_log_t:dir setattr_dir_perms;
-manage_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
+append_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
+create_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
+setattr_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
 logging_log_filetrans(ntpd_t, ntpd_log_t, { file dir })
 
-# for some reason it creates a file in /tmp
 manage_dirs_pattern(ntpd_t, ntpd_tmp_t, ntpd_tmp_t)
 manage_files_pattern(ntpd_t, ntpd_tmp_t, ntpd_tmp_t)
 files_tmp_filetrans(ntpd_t, ntpd_tmp_t, { file dir })
@@ -78,6 +75,8 @@ fs_tmpfs_filetrans(ntpd_t, ntpd_tmpfs_t, { dir file })
 manage_files_pattern(ntpd_t, ntpd_var_run_t, ntpd_var_run_t)
 files_pid_filetrans(ntpd_t, ntpd_var_run_t, file)
 
+can_exec(ntpd_t, ntpd_exec_t)
+
 kernel_read_kernel_sysctls(ntpd_t)
 kernel_read_system_state(ntpd_t)
 kernel_read_network_state(ntpd_t)
@@ -89,37 +88,37 @@ corenet_tcp_sendrecv_generic_if(ntpd_t)
 corenet_udp_sendrecv_generic_if(ntpd_t)
 corenet_tcp_sendrecv_generic_node(ntpd_t)
 corenet_udp_sendrecv_generic_node(ntpd_t)
-corenet_tcp_sendrecv_all_ports(ntpd_t)
-corenet_udp_sendrecv_all_ports(ntpd_t)
-corenet_tcp_bind_generic_node(ntpd_t)
 corenet_udp_bind_generic_node(ntpd_t)
-corenet_udp_bind_ntp_port(ntpd_t)
-corenet_tcp_connect_ntp_port(ntpd_t)
-corenet_sendrecv_ntp_server_packets(ntpd_t)
-corenet_sendrecv_ntp_client_packets(ntpd_t)
-
-dev_read_sysfs(ntpd_t)
-# for SSP
-dev_read_urand(ntpd_t)
 
-fs_getattr_all_fs(ntpd_t)
-fs_search_auto_mountpoints(ntpd_t)
-
-term_use_ptmx(ntpd_t)
+corenet_sendrecv_ntp_server_packets(ntpd_t)
+corenet_udp_bind_ntp_port(ntpd_t)
+corenet_udp_sendrecv_ntp_port(ntpd_t)
 
-auth_use_nsswitch(ntpd_t)
+corenet_sendrecv_ntp_client_packets(ntpd_t)
+corenet_tcp_connect_ntp_port(ntpd_t)
+corenet_tcp_sendrecv_ntp_port(ntpd_t)
 
 corecmd_exec_bin(ntpd_t)
 corecmd_exec_shell(ntpd_t)
 
+dev_read_sysfs(ntpd_t)
+dev_read_urand(ntpd_t)
+dev_rw_realtime_clock(ntpd_t)
+
 domain_use_interactive_fds(ntpd_t)
 domain_dontaudit_list_all_domains_state(ntpd_t)
 
-files_read_etc_files(ntpd_t)
 files_read_etc_runtime_files(ntpd_t)
 files_read_usr_files(ntpd_t)
 files_list_var_lib(ntpd_t)
 
+fs_getattr_all_fs(ntpd_t)
+fs_search_auto_mountpoints(ntpd_t)
+
+term_use_ptmx(ntpd_t)
+
+auth_use_nsswitch(ntpd_t)
+
 init_exec_script_files(ntpd_t)
 
 logging_send_syslog_msg(ntpd_t)
@@ -130,7 +129,6 @@ userdom_dontaudit_use_unpriv_user_fds(ntpd_t)
 userdom_list_user_home_dirs(ntpd_t)
 
 optional_policy(`
-	# for cron jobs
 	cron_system_entry(ntpd_t, ntpdate_exec_t)
 ')