[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     8d1ff854d6943921781f6054c90545a4eecdb2d0
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Mon Oct 22 08:34:22 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Oct 22 18:11:50 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=8d1ff854

Changes to the qmail policy module

Remove unused attribute
Add child domain attribute to write common child domain policy more
efficiently
Module clean up

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/qmail.fc |   42 +++++++-----------
 policy/modules/contrib/qmail.if |   60 +++++++++++---------------
 policy/modules/contrib/qmail.te |   89 ++++++++++++++++++--------------------
 3 files changed, 84 insertions(+), 107 deletions(-)

diff --git a/policy/modules/contrib/qmail.fc b/policy/modules/contrib/qmail.fc
index 6606bad..e53fe5a 100644
--- a/policy/modules/contrib/qmail.fc
+++ b/policy/modules/contrib/qmail.fc
@@ -1,3 +1,19 @@
+/etc/qmail(/.*)?	gen_context(system_u:object_r:qmail_etc_t,s0)
+
+/usr/bin/tcp-env	--	gen_context(system_u:object_r:qmail_tcp_env_exec_t,s0)
+
+/usr/sbin/qmail-clean	--	gen_context(system_u:object_r:qmail_clean_exec_t,s0)
+/usr/sbin/qmail-getpw	--	gen_context(system_u:object_r:qmail_exec_t,s0)
+/usr/sbin/qmail-inject	--	gen_context(system_u:object_r:qmail_inject_exec_t,s0)
+/usr/sbin/qmail-local	--	gen_context(system_u:object_r:qmail_local_exec_t,s0)
+/usr/sbin/qmail-lspawn	--	gen_context(system_u:object_r:qmail_lspawn_exec_t,s0)
+/usr/sbin/qmail-queue	--	gen_context(system_u:object_r:qmail_queue_exec_t,s0)
+/usr/sbin/qmail-remote	--	gen_context(system_u:object_r:qmail_remote_exec_t,s0)
+/usr/sbin/qmail-rspawn	--	gen_context(system_u:object_r:qmail_rspawn_exec_t,s0)
+/usr/sbin/qmail-send	--	gen_context(system_u:object_r:qmail_send_exec_t,s0)
+/usr/sbin/qmail-smtpd	--	gen_context(system_u:object_r:qmail_smtpd_exec_t,s0)
+/usr/sbin/qmail-start	--	gen_context(system_u:object_r:qmail_start_exec_t,s0)
+/usr/sbin/splogger	--	gen_context(system_u:object_r:qmail_splogger_exec_t,s0)
 
 /var/qmail/alias	-d	gen_context(system_u:object_r:qmail_alias_home_t,s0)
 /var/qmail/alias(/.*)?	gen_context(system_u:object_r:qmail_alias_home_t,s0)
@@ -16,32 +32,6 @@
 /var/qmail/bin/splogger	--	gen_context(system_u:object_r:qmail_splogger_exec_t,s0)
 /var/qmail/bin/tcp-env	--	gen_context(system_u:object_r:qmail_tcp_env_exec_t,s0)
 
-/var/qmail/control(/.*)?	gen_context(system_u:object_r:qmail_etc_t,s0)
-
-/var/qmail/queue(/.*)?	gen_context(system_u:object_r:qmail_spool_t,s0)
-
-ifdef(`distro_debian',`
-/etc/qmail(/.*)?	gen_context(system_u:object_r:qmail_etc_t,s0)
-
-/usr/bin/tcp-env	--	gen_context(system_u:object_r:qmail_tcp_env_exec_t,s0)
-
-#/usr/local/bin/serialmail/.*	--	gen_context(system_u:object_r:qmail_serialmail_exec_t,s0)
-
-/usr/sbin/qmail-clean	--	gen_context(system_u:object_r:qmail_clean_exec_t,s0)
-/usr/sbin/qmail-getpw	--	gen_context(system_u:object_r:qmail_exec_t,s0)
-/usr/sbin/qmail-inject	--	gen_context(system_u:object_r:qmail_inject_exec_t,s0)
-/usr/sbin/qmail-local	--	gen_context(system_u:object_r:qmail_local_exec_t,s0)
-/usr/sbin/qmail-lspawn	--	gen_context(system_u:object_r:qmail_lspawn_exec_t,s0)
-/usr/sbin/qmail-queue	--	gen_context(system_u:object_r:qmail_queue_exec_t,s0)
-/usr/sbin/qmail-remote	--	gen_context(system_u:object_r:qmail_remote_exec_t,s0)
-/usr/sbin/qmail-rspawn	--	gen_context(system_u:object_r:qmail_rspawn_exec_t,s0)
-/usr/sbin/qmail-send	--	gen_context(system_u:object_r:qmail_send_exec_t,s0)
-/usr/sbin/qmail-smtpd	--	gen_context(system_u:object_r:qmail_smtpd_exec_t,s0)
-/usr/sbin/qmail-start	--	gen_context(system_u:object_r:qmail_start_exec_t,s0)
-/usr/sbin/splogger	--	gen_context(system_u:object_r:qmail_splogger_exec_t,s0)
-
 /var/qmail(/.*)?	gen_context(system_u:object_r:qmail_etc_t,s0)
 
 /var/spool/qmail(/.*)?	gen_context(system_u:object_r:qmail_spool_t,s0)
-')
-

diff --git a/policy/modules/contrib/qmail.if b/policy/modules/contrib/qmail.if
index a55bf44..e4f0000 100644
--- a/policy/modules/contrib/qmail.if
+++ b/policy/modules/contrib/qmail.if
@@ -1,12 +1,12 @@
-## <summary>Qmail Mail Server</summary>
+## <summary>Qmail Mail Server.</summary>
 
 ########################################
 ## <summary>
-##	Template for qmail parent/sub-domain pairs
+##	Template for qmail parent/sub-domain pairs.
 ## </summary>
 ## <param name="child_prefix">
 ##	<summary>
-##	The prefix of the child domain
+##	The prefix of the child domain.
 ##	</summary>
 ## </param>
 ## <param name="parent_domain">
@@ -16,40 +16,35 @@
 ## </param>
 #
 template(`qmail_child_domain_template',`
-	type $1_t;
-	domain_type($1_t)
-	type $1_exec_t;
-	domain_entry_file($1_t, $1_exec_t)
-	domain_auto_trans($2, $1_exec_t, $1_t)
-	role system_r types $1_t;
-
-	allow $1_t self:process signal_perms;
-
-	allow $1_t $2:fd use;
-	allow $1_t $2:fifo_file rw_file_perms;
-	allow $1_t $2:process sigchld;
-
-	allow $1_t qmail_etc_t:dir list_dir_perms;
-	allow $1_t qmail_etc_t:file read_file_perms;
-	allow $1_t qmail_etc_t:lnk_file read_lnk_file_perms;
+	gen_require(`
+		attribute qmail_child_domain;
+	')
 
-	allow $1_t qmail_start_t:fd use;
+	########################################
+	#
+	# Declarations
+	#
 
-	kernel_list_proc($2)
-	kernel_read_proc_symlinks($2)
+	type $1_t, qmail_child_domain;
+	type $1_exec_t;
+	domain_type($1_t)
+	domain_entry_file($1_t, $1_exec_t)
 
-	corecmd_search_bin($1_t)
+	role system_r types $1_t;
 
-	files_search_var($1_t)
+	########################################
+	#
+	# Policy
+	#
 
-	fs_getattr_xattr_fs($1_t)
+	domtrans_pattern($2, $1_exec_t, $1_t)
 
-	miscfiles_read_localization($1_t)
+	kernel_read_system_state($2)
 ')
 
 ########################################
 ## <summary>
-##	Transition to qmail_inject_t
+##	Transition to qmail_inject_t.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -69,13 +64,12 @@ interface(`qmail_domtrans_inject',`
 		corecmd_search_bin($1)
 	',`
 		files_search_var($1)
-		corecmd_search_bin($1)
 	')
 ')
 
 ########################################
 ## <summary>
-##	Transition to qmail_queue_t
+##	Transition to qmail_queue_t.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -95,7 +89,6 @@ interface(`qmail_domtrans_queue',`
 		corecmd_search_bin($1)
 	',`
 		files_search_var($1)
-		corecmd_search_bin($1)
 	')
 ')
 
@@ -115,21 +108,20 @@ interface(`qmail_read_config',`
 		type qmail_etc_t;
 	')
 
+	files_search_var($1)
 	allow $1 qmail_etc_t:dir list_dir_perms;
 	allow $1 qmail_etc_t:file read_file_perms;
 	allow $1 qmail_etc_t:lnk_file read_lnk_file_perms;
-	files_search_var($1)
 
 	ifdef(`distro_debian',`
-		# handle /etc/qmail
 		files_search_etc($1)
 	')
 ')
 
 ########################################
 ## <summary>
-##	Define the specified domain as a qmail-smtp service. 
-##	Needed by antivirus/antispam filters.
+##	Define the specified domain as a
+##	qmail-smtp service.
 ## </summary>
 ## <param name="domain">
 ##	<summary>

diff --git a/policy/modules/contrib/qmail.te b/policy/modules/contrib/qmail.te
index 355b2a2..1bef513 100644
--- a/policy/modules/contrib/qmail.te
+++ b/policy/modules/contrib/qmail.te
@@ -1,11 +1,11 @@
-policy_module(qmail, 1.5.0)
+policy_module(qmail, 1.5.1)
 
 ########################################
 #
 # Declarations
 #
 
-attribute qmail_user_domains;
+attribute qmail_child_domain;
 
 type qmail_alias_home_t;
 files_type(qmail_alias_home_t)
@@ -18,7 +18,7 @@ files_config_file(qmail_etc_t)
 type qmail_exec_t;
 files_type(qmail_exec_t)
 
-type qmail_inject_t, qmail_user_domains;
+type qmail_inject_t;
 type qmail_inject_exec_t;
 domain_type(qmail_inject_t)
 domain_entry_file(qmail_inject_t, qmail_inject_exec_t)
@@ -32,18 +32,14 @@ qmail_child_domain_template(qmail_lspawn, qmail_start_t)
 mta_mailserver_delivery(qmail_lspawn_t)
 
 qmail_child_domain_template(qmail_queue, qmail_inject_t)
-typeattribute qmail_queue_t qmail_user_domains;
 mta_mailserver_user_agent(qmail_queue_t)
 
 qmail_child_domain_template(qmail_remote, qmail_rspawn_t)
 mta_mailserver_sender(qmail_remote_t)
 
 qmail_child_domain_template(qmail_rspawn, qmail_start_t)
-
 qmail_child_domain_template(qmail_send, qmail_start_t)
-
 qmail_child_domain_template(qmail_smtpd, qmail_tcp_env_t)
-
 qmail_child_domain_template(qmail_splogger, qmail_start_t)
 
 type qmail_spool_t;
@@ -59,8 +55,28 @@ application_domain(qmail_tcp_env_t, qmail_tcp_env_exec_t)
 
 ########################################
 #
-# qmail-clean local policy
-#   this component cleans up the queue directory
+# Common qmail child domain local policy
+#
+
+allow qmail_child_domain self:process signal_perms;
+
+allow qmail_child_domain qmail_etc_t:dir list_dir_perms;
+allow qmail_child_domain qmail_etc_t:file read_file_perms;
+allow qmail_child_domain qmail_etc_t:lnk_file read_lnk_file_perms;
+
+allow qmail_child_domain qmail_start_t:fd use;
+
+corecmd_search_bin(qmail_child_domain)
+
+files_search_var(qmail_child_domain)
+
+fs_getattr_xattr_fs(qmail_child_domain)
+
+miscfiles_read_localization(qmail_child_domain)
+
+########################################
+#
+# Clean local policy
 #
 
 read_files_pattern(qmail_clean_t, qmail_spool_t, qmail_spool_t)
@@ -68,8 +84,7 @@ delete_files_pattern(qmail_clean_t, qmail_spool_t, qmail_spool_t)
 
 ########################################
 #
-# qmail-inject local policy
-#   this component preprocesses mail from stdin and invokes qmail-queue
+# Inject local policy
 #
 
 allow qmail_inject_t self:fifo_file write_fifo_file_perms;
@@ -87,13 +102,12 @@ qmail_read_config(qmail_inject_t)
 
 ########################################
 #
-# qmail-local local policy
-#   this component delivers a mail message
+# Local local policy
 #
 
-allow qmail_local_t self:fifo_file write_file_perms;
+allow qmail_local_t self:fifo_file write_fifo_file_perms;
 allow qmail_local_t self:process signal_perms;
-allow qmail_local_t self:unix_stream_socket create_stream_socket_perms;
+allow qmail_local_t self:unix_stream_socket { accept listen };
 
 manage_dirs_pattern(qmail_local_t, qmail_alias_home_t, qmail_alias_home_t)
 manage_files_pattern(qmail_local_t, qmail_alias_home_t, qmail_alias_home_t)
@@ -109,7 +123,6 @@ kernel_read_system_state(qmail_local_t)
 corecmd_exec_bin(qmail_local_t)
 corecmd_exec_shell(qmail_local_t)
 
-files_read_etc_files(qmail_local_t)
 files_read_etc_runtime_files(qmail_local_t)
 
 auth_use_nsswitch(qmail_local_t)
@@ -126,8 +139,7 @@ optional_policy(`
 
 ########################################
 #
-# qmail-lspawn local policy
-#   this component schedules local deliveries
+# Lspawn local policy
 #
 
 allow qmail_lspawn_t self:capability { setuid setgid };
@@ -141,16 +153,13 @@ allow qmail_lspawn_t qmail_local_exec_t:file read_file_perms;
 
 read_files_pattern(qmail_lspawn_t, qmail_spool_t, qmail_spool_t)
 
-corecmd_search_bin(qmail_lspawn_t)
-
 files_read_etc_files(qmail_lspawn_t)
 files_search_pids(qmail_lspawn_t)
 files_search_tmp(qmail_lspawn_t)
 
 ########################################
 #
-# qmail-queue local policy
-#   this component places a mail in a delivery queue, later to be processed by qmail-send
+# Queue local policy
 #
 
 allow qmail_queue_t qmail_lspawn_t:fd use;
@@ -174,35 +183,28 @@ optional_policy(`
 
 ########################################
 #
-# qmail-remote local policy
-#   this component sends mail via SMTP
+# Remote local policy
 #
 
-allow qmail_remote_t self:tcp_socket create_socket_perms;
-allow qmail_remote_t self:udp_socket create_socket_perms;
-
 rw_files_pattern(qmail_remote_t, qmail_spool_t, qmail_spool_t)
 
 corenet_all_recvfrom_unlabeled(qmail_remote_t)
 corenet_all_recvfrom_netlabel(qmail_remote_t)
 corenet_tcp_sendrecv_generic_if(qmail_remote_t)
-corenet_udp_sendrecv_generic_if(qmail_remote_t)
 corenet_tcp_sendrecv_generic_node(qmail_remote_t)
-corenet_udp_sendrecv_generic_node(qmail_remote_t)
-corenet_tcp_sendrecv_smtp_port(qmail_remote_t)
-corenet_udp_sendrecv_dns_port(qmail_remote_t)
-corenet_tcp_connect_smtp_port(qmail_remote_t)
+
 corenet_sendrecv_smtp_client_packets(qmail_remote_t)
+corenet_tcp_connect_smtp_port(qmail_remote_t)
+corenet_tcp_sendrecv_smtp_port(qmail_remote_t)
 
 dev_read_rand(qmail_remote_t)
 dev_read_urand(qmail_remote_t)
 
-sysnet_read_config(qmail_remote_t)
+sysnet_dns_name_resolve(qmail_remote_t)
 
 ########################################
 #
-# qmail-rspawn local policy
-#   this component scedules remote deliveries
+# Rspawn local policy
 #
 
 allow qmail_rspawn_t self:process signal_perms;
@@ -212,12 +214,9 @@ allow qmail_rspawn_t qmail_remote_exec_t:file read_file_perms;
 
 rw_files_pattern(qmail_rspawn_t, qmail_spool_t, qmail_spool_t)
 
-corecmd_search_bin(qmail_rspawn_t)
-
 ########################################
 #
-# qmail-send local policy
-#   this component delivers mail messages from the queue
+# Send local policy
 #
 
 allow qmail_send_t self:process signal_perms;
@@ -235,8 +234,7 @@ optional_policy(`
 
 ########################################
 #
-# qmail-smtpd local policy
-#   this component receives mails via SMTP
+# Smtpd local policy
 #
 
 allow qmail_smtpd_t self:process signal_perms;
@@ -264,8 +262,7 @@ optional_policy(`
 
 ########################################
 #
-# splogger local policy
-#   this component creates entries in syslog
+# Splogger local policy
 #
 
 allow qmail_splogger_t self:unix_dgram_socket create_socket_perms;
@@ -278,8 +275,7 @@ miscfiles_read_localization(qmail_splogger_t)
 
 ########################################
 #
-# qmail-start local policy
-#   this component starts up the mail delivery component
+# Start local policy
 #
 
 allow qmail_start_t self:capability { setgid setuid };
@@ -302,8 +298,7 @@ optional_policy(`
 
 ########################################
 #
-# tcp-env local policy
-#   this component sets up TCP-related environment variables
+# Tcp-env local policy
 #
 
 allow qmail_tcp_env_t qmail_smtpd_exec_t:file read_file_perms;