[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     9b35c772697b5f3a688599bb49fa56af4e64cd86
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Fri Oct 19 09:38:45 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Fri Oct 19 12:38:53 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=9b35c772

Changes to the prelink policy module and relevant dependencies

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/gnome.if   |   32 ++++++++++++--
 policy/modules/contrib/gnome.te   |    2 +-
 policy/modules/contrib/mozilla.if |   20 +++++++++
 policy/modules/contrib/mozilla.te |    2 +-
 policy/modules/contrib/prelink.fc |    2 +-
 policy/modules/contrib/prelink.if |   29 +++++++------
 policy/modules/contrib/prelink.te |   81 ++++++++++++++++++++++++++++---------
 7 files changed, 126 insertions(+), 42 deletions(-)

diff --git a/policy/modules/contrib/gnome.if b/policy/modules/contrib/gnome.if
index dbd9eae..62241c4 100644
--- a/policy/modules/contrib/gnome.if
+++ b/policy/modules/contrib/gnome.if
@@ -157,7 +157,7 @@ interface(`gnome_exec_gconf',`
 
 ########################################
 ## <summary>
-##	Read gconf configuration files.
+##	Read gconf configuration content.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -170,15 +170,35 @@ interface(`gnome_read_gconf_config',`
 		type gconf_etc_t;
 	')
 
-	allow $1 gconf_etc_t:dir list_dir_perms;
-	read_files_pattern($1, gconf_etc_t, gconf_etc_t)
 	files_search_etc($1)
+	allow $1 gconf_etc_t:dir list_dir_perms;
+	allow $1 gconf_etc_t:file read_file_perms;
+	allow $1 gconf_etc_t:lnk_file read_lnk_file_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to read
+##	inherited gconf configuration files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`gnome_dontaudit_read_inherited_gconf_config_files',`
+	gen_require(`
+		type gconf_etc_t;
+	')
+
+	dontaudit $1 gconf_etc_t:file read;
 ')
 
 #######################################
 ## <summary>
 ##	Create, read, write, and delete
-##	gconf configuration files.
+##	gconf configuration content.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -191,8 +211,10 @@ interface(`gnome_manage_gconf_config',`
 		type gconf_etc_t;
 	')
 
-	manage_files_pattern($1, gconf_etc_t, gconf_etc_t)
 	files_search_etc($1)
+	allow $1 gconf_etc_t:dir manage_dir_perms;
+	allow $1 gconf_etc_t:file manage_file_perms;
+	allow $1 gconf_etc_t:lnk_file manage_lnk_file_perms;
 ')
 
 ########################################

diff --git a/policy/modules/contrib/gnome.te b/policy/modules/contrib/gnome.te
index b07ea85..66e0b90 100644
--- a/policy/modules/contrib/gnome.te
+++ b/policy/modules/contrib/gnome.te
@@ -1,4 +1,4 @@
-policy_module(gnome, 2.2.2)
+policy_module(gnome, 2.2.3)
 
 ##############################
 #

diff --git a/policy/modules/contrib/mozilla.if b/policy/modules/contrib/mozilla.if
index b7aca51..a29d82b 100644
--- a/policy/modules/contrib/mozilla.if
+++ b/policy/modules/contrib/mozilla.if
@@ -484,6 +484,26 @@ interface(`mozilla_rw_tcp_sockets',`
 
 ########################################
 ## <summary>
+##	Create, read, write, and delete
+##	mozilla plugin rw files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mozilla_manage_plugin_rw_files',`
+	gen_require(`
+		type mozilla_plugin_rw_t;
+	')
+
+	libs_search_lib($1)
+	manage_files_pattern($1, mozilla_plugin_rw_t, mozilla_plugin_rw_t)
+')
+
+########################################
+## <summary>
 ##	Read mozilla_plugin tmpfs files.
 ## </summary>
 ## <param name="domain">

diff --git a/policy/modules/contrib/mozilla.te b/policy/modules/contrib/mozilla.te
index 8a7dbe9..fbd06b7 100644
--- a/policy/modules/contrib/mozilla.te
+++ b/policy/modules/contrib/mozilla.te
@@ -1,4 +1,4 @@
-policy_module(mozilla, 2.6.9)
+policy_module(mozilla, 2.7.0)
 
 ########################################
 #

diff --git a/policy/modules/contrib/prelink.fc b/policy/modules/contrib/prelink.fc
index fd1257f..a90d623 100644
--- a/policy/modules/contrib/prelink.fc
+++ b/policy/modules/contrib/prelink.fc
@@ -4,7 +4,7 @@
 
 /usr/sbin/prelink(\.bin)?	--	gen_context(system_u:object_r:prelink_exec_t,s0)
 
-/var/log/prelink\.log	--	gen_context(system_u:object_r:prelink_log_t,s0)
+/var/log/prelink\.log.*	--	gen_context(system_u:object_r:prelink_log_t,s0)
 /var/log/prelink(/.*)?	gen_context(system_u:object_r:prelink_log_t,s0)
 
 /var/lib/misc/prelink.*	--	gen_context(system_u:object_r:prelink_var_lib_t,s0)

diff --git a/policy/modules/contrib/prelink.if b/policy/modules/contrib/prelink.if
index 93ec175..20d4697 100644
--- a/policy/modules/contrib/prelink.if
+++ b/policy/modules/contrib/prelink.if
@@ -2,7 +2,7 @@
 
 ########################################
 ## <summary>
-##	Execute the prelink program in the prelink domain.
+##	Execute prelink in the prelink domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -18,15 +18,15 @@ interface(`prelink_domtrans',`
 	corecmd_search_bin($1)
 	domtrans_pattern($1, prelink_exec_t, prelink_t)
 
-	ifdef(`hide_broken_symptoms', `
+	ifdef(`hide_broken_symptoms',`
 		dontaudit prelink_t $1:socket_class_set { read write };
-		dontaudit prelink_t $1:fifo_file setattr;
+		dontaudit prelink_t $1:fifo_file setattr_fifo_file_perms;
 	')
 ')
 
 ########################################
 ## <summary>
-##	Execute the prelink program in the current domain.
+##	Execute prelink in the caller domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -45,7 +45,9 @@ interface(`prelink_exec',`
 
 ########################################
 ## <summary>
-##	Execute the prelink program in the prelink domain.
+##	Execute prelink in the prelink
+##	domain, and allow the specified role
+##	the prelink domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -54,18 +56,18 @@ interface(`prelink_exec',`
 ## </param>
 ## <param name="role">
 ##	<summary>
-##	The role to allow the prelink domain.
+##	Role allowed access.
 ##	</summary>
 ## </param>
 ## <rolecap/>
 #
 interface(`prelink_run',`
 	gen_require(`
-		type prelink_t;
+		attribute_role prelink_roles;
 	')
 
 	prelink_domtrans($1)
-	role $2 types prelink_t;
+	roleattribute $2 prelink_roles;
 ')
 
 ########################################
@@ -78,7 +80,6 @@ interface(`prelink_run',`
 ##	</summary>
 ## </param>
 #
-# cjp: added for misc non-entrypoint objects
 interface(`prelink_object_file',`
 	gen_require(`
 		attribute prelink_object;
@@ -89,7 +90,7 @@ interface(`prelink_object_file',`
 
 ########################################
 ## <summary>
-##	Read the prelink cache.
+##	Read prelink cache files.
 ## </summary>
 ## <param name="file_type">
 ##	<summary>
@@ -108,7 +109,7 @@ interface(`prelink_read_cache',`
 
 ########################################
 ## <summary>
-##	Delete the prelink cache.
+##	Delete prelink cache files.
 ## </summary>
 ## <param name="file_type">
 ##	<summary>
@@ -121,8 +122,8 @@ interface(`prelink_delete_cache',`
 		type prelink_cache_t;
 	')
 
-	allow $1 prelink_cache_t:file unlink;
 	files_rw_etc_dirs($1)
+	allow $1 prelink_cache_t:file delete_file_perms;
 ')
 
 ########################################
@@ -167,7 +168,7 @@ interface(`prelink_manage_lib',`
 
 ########################################
 ## <summary>
-##	Relabel from files in the /boot directory.
+##	Relabel from prelink lib files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -186,7 +187,7 @@ interface(`prelink_relabelfrom_lib',`
 
 ########################################
 ## <summary>
-##	Relabel from files in the /boot directory.
+##	Relabel prelink lib files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>

diff --git a/policy/modules/contrib/prelink.te b/policy/modules/contrib/prelink.te
index af55369..42a105c 100644
--- a/policy/modules/contrib/prelink.te
+++ b/policy/modules/contrib/prelink.te
@@ -1,4 +1,4 @@
-policy_module(prelink, 1.10.0)
+policy_module(prelink, 1.10.1)
 
 ########################################
 #
@@ -6,10 +6,13 @@ policy_module(prelink, 1.10.0)
 
 attribute prelink_object;
 
+attribute_role prelink_roles;
+
 type prelink_t;
 type prelink_exec_t;
 init_system_domain(prelink_t, prelink_exec_t)
 domain_obj_id_change_exemption(prelink_t)
+role prelink_roles types prelink_t;
 
 type prelink_cache_t;
 files_type(prelink_cache_t)
@@ -36,23 +39,23 @@ files_type(prelink_var_lib_t)
 # Local policy
 #
 
-allow prelink_t self:capability { chown dac_override fowner fsetid sys_resource };
+allow prelink_t self:capability { chown dac_override fowner fsetid setfcap sys_resource };
 allow prelink_t self:process { execheap execmem execstack signal };
 allow prelink_t self:fifo_file rw_fifo_file_perms;
 
 allow prelink_t prelink_cache_t:file manage_file_perms;
 files_etc_filetrans(prelink_t, prelink_cache_t, file)
 
-allow prelink_t prelink_log_t:dir setattr;
+allow prelink_t prelink_log_t:dir setattr_dir_perms;
 create_files_pattern(prelink_t, prelink_log_t, prelink_log_t)
 append_files_pattern(prelink_t, prelink_log_t, prelink_log_t)
 read_lnk_files_pattern(prelink_t, prelink_log_t, prelink_log_t)
 logging_log_filetrans(prelink_t, prelink_log_t, file)
 
-allow prelink_t prelink_tmp_t:file { manage_file_perms execute relabelfrom execmod };
+allow prelink_t prelink_tmp_t:file { manage_file_perms mmap_file_perms relabel_file_perms execmod };
 files_tmp_filetrans(prelink_t, prelink_tmp_t, file)
 
-allow prelink_t prelink_tmpfs_t:file { manage_file_perms execute relabelfrom execmod };
+allow prelink_t prelink_tmpfs_t:file { manage_file_perms mmap_file_perms relabel_file_perms execmod };
 fs_tmpfs_filetrans(prelink_t, prelink_tmpfs_t, file)
 
 manage_dirs_pattern(prelink_t, prelink_var_lib_t, prelink_var_lib_t)
@@ -60,9 +63,7 @@ manage_files_pattern(prelink_t, prelink_var_lib_t, prelink_var_lib_t)
 relabel_files_pattern(prelink_t, prelink_var_lib_t, prelink_var_lib_t)
 files_var_lib_filetrans(prelink_t, prelink_var_lib_t, { dir file })
 
-# prelink misc objects that are not system
-# libraries or entrypoints
-allow prelink_t prelink_object:file { manage_file_perms execute relabelto relabelfrom };
+allow prelink_t prelink_object:file { manage_file_perms mmap_file_perms relabel_file_perms };
 
 kernel_read_system_state(prelink_t)
 kernel_read_kernel_sysctls(prelink_t)
@@ -74,20 +75,24 @@ corecmd_read_bin_symlinks(prelink_t)
 
 dev_read_urand(prelink_t)
 
-files_list_all(prelink_t)
 files_getattr_all_files(prelink_t)
-files_write_non_security_dirs(prelink_t)
-files_read_etc_files(prelink_t)
-files_read_etc_runtime_files(prelink_t)
-files_dontaudit_read_all_symlinks(prelink_t)
+files_list_all(prelink_t)
 files_manage_usr_files(prelink_t)
 files_manage_var_files(prelink_t)
+files_read_etc_files(prelink_t)
+files_read_etc_runtime_files(prelink_t)
 files_relabelfrom_usr_files(prelink_t)
+files_search_var_lib(prelink_t)
+files_write_non_security_dirs(prelink_t)
+files_dontaudit_read_all_symlinks(prelink_t)
 
-fs_getattr_xattr_fs(prelink_t)
+fs_getattr_all_fs(prelink_t)
+fs_search_auto_mountpoints(prelink_t)
 
 selinux_get_enforce_mode(prelink_t)
 
+storage_getattr_fixed_disk_dev(prelink_t)
+
 libs_exec_ld_so(prelink_t)
 libs_legacy_use_shared_libs(prelink_t)
 libs_manage_ld_so(prelink_t)
@@ -99,6 +104,29 @@ libs_delete_lib_symlinks(prelink_t)
 miscfiles_read_localization(prelink_t)
 
 userdom_use_user_terminals(prelink_t)
+userdom_manage_user_home_content_files(prelink_t)
+# pending
+# userdom_relabel_user_home_content_files(prelink_t)
+# userdom_execmod_user_home_content_files(prelink_t)
+userdom_exec_user_home_content_files(prelink_t)
+
+ifdef(`hide_broken_symptoms',`
+	miscfiles_read_man_pages(prelink_t)
+
+	optional_policy(`
+		dbus_read_config(prelink_t)
+	')
+')
+
+tunable_policy(`use_nfs_home_dirs',`
+	fs_exec_nfs_files(prelink_t)
+	fs_manage_nfs_files(prelink_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+	fs_exec_cifs_files(prelink_t)
+	fs_manage_cifs_files(prelink_t)
+')
 
 optional_policy(`
 	amanda_manage_lib(prelink_t)
@@ -109,6 +137,14 @@ optional_policy(`
 ')
 
 optional_policy(`
+	gnome_dontaudit_read_inherited_gconf_config_files(prelink_t)
+')
+
+optional_policy(`
+	mozilla_manage_plugin_rw_files(prelink_t)
+')
+
+optional_policy(`
 	rpm_manage_tmp_files(prelink_t)
 ')
 
@@ -118,17 +154,17 @@ optional_policy(`
 
 ########################################
 #
-# Prelink Cron system Policy
+# Cron system local policy
 #
 
 optional_policy(`
 	allow prelink_cron_system_t self:capability setuid;
 	allow prelink_cron_system_t self:process { setsched setfscreate signal };
 	allow prelink_cron_system_t self:fifo_file rw_fifo_file_perms;
-	allow prelink_cron_system_t self:unix_dgram_socket { write bind create setopt };
+	allow prelink_cron_system_t self:unix_dgram_socket create_socket_perms;
 
 	read_files_pattern(prelink_cron_system_t, prelink_cache_t, prelink_cache_t)
-	allow prelink_cron_system_t prelink_cache_t:file unlink;
+	allow prelink_cron_system_t prelink_cache_t:file delete_file_perms;
 
 	domtrans_pattern(prelink_cron_system_t, prelink_exec_t, prelink_t)
 	allow prelink_cron_system_t prelink_t:process noatsecure;
@@ -137,17 +173,22 @@ optional_policy(`
 
 	manage_files_pattern(prelink_cron_system_t, prelink_var_lib_t, prelink_var_lib_t)
 	files_var_lib_filetrans(prelink_cron_system_t, prelink_var_lib_t, file)
-	allow prelink_cron_system_t prelink_var_lib_t:file { relabelfrom relabelto };
+	allow prelink_cron_system_t prelink_var_lib_t:file relabel_file_perms;
 
 	kernel_read_system_state(prelink_cron_system_t)
 
 	corecmd_exec_bin(prelink_cron_system_t)
 	corecmd_exec_shell(prelink_cron_system_t)
 
+	dev_list_sysfs(prelink_cron_system_t)
+	dev_read_sysfs(prelink_cron_system_t)
+
+	files_rw_etc_dirs(prelink_cron_system_t)
 	files_dontaudit_search_all_mountpoints(prelink_cron_system_t)
-	files_read_etc_files(prelink_cron_system_t)
-	files_search_var_lib(prelink_cron_system_t)
 
+	auth_use_nsswitch(prelink_cron_system_t)
+
+	init_telinit(prelink_cron_system_t)
 	init_exec(prelink_cron_system_t)
 
 	libs_exec_ld_so(prelink_cron_system_t)