[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     f4987b54cef36875edf75bacadf04a5907c35a3f
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Sat Oct 27 09:31:34 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sat Oct 27 11:42:49 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=f4987b54

Changes to the sendmail policy module and relevant dependencies

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/cfengine.if |   19 ++++++
 policy/modules/contrib/cfengine.te |    2 +-
 policy/modules/contrib/dovecot.if  |   18 +++++
 policy/modules/contrib/dovecot.te  |    2 +-
 policy/modules/contrib/mta.te      |    4 +-
 policy/modules/contrib/sendmail.fc |    1 +
 policy/modules/contrib/sendmail.if |  122 +++++++++++++++++++++++++++++-------
 policy/modules/contrib/sendmail.te |   82 ++++++++++++++----------
 8 files changed, 190 insertions(+), 60 deletions(-)

diff --git a/policy/modules/contrib/cfengine.if b/policy/modules/contrib/cfengine.if
index e3af574..a731122 100644
--- a/policy/modules/contrib/cfengine.if
+++ b/policy/modules/contrib/cfengine.if
@@ -52,6 +52,25 @@ interface(`cfengine_read_lib_files',`
 	read_files_pattern($1, cfengine_var_lib_t, cfengine_var_lib_t)
 ')
 
+####################################
+## <summary>
+##	Do not audit attempts to write
+##	cfengine log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`cfengine_dontaudit_write_log_files',`
+	gen_require(`
+		type cfengine_var_log_t;
+	')
+
+	dontaudit $1 cfengine_var_log_t:file write_file_perms;
+')
+
 ########################################
 ## <summary>
 ##	All of the rules required to

diff --git a/policy/modules/contrib/cfengine.te b/policy/modules/contrib/cfengine.te
index 3e77042..8af5bbe 100644
--- a/policy/modules/contrib/cfengine.te
+++ b/policy/modules/contrib/cfengine.te
@@ -1,4 +1,4 @@
-policy_module(cfengine, 1.0.1)
+policy_module(cfengine, 1.0.2)
 
 ########################################
 #

diff --git a/policy/modules/contrib/dovecot.if b/policy/modules/contrib/dovecot.if
index a061404..dbcac59 100644
--- a/policy/modules/contrib/dovecot.if
+++ b/policy/modules/contrib/dovecot.if
@@ -102,6 +102,24 @@ interface(`dovecot_dontaudit_unlink_lib_files',`
 	dontaudit $1 dovecot_var_lib_t:file delete_file_perms;
 ')
 
+######################################
+## <summary>
+##	Write inherited dovecot tmp files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`dovecot_write_inherited_tmp_files',`
+	gen_require(`
+		type dovecot_tmp_t;
+	')
+
+	allow $1 dovecot_tmp_t:file write;
+')
+
 ########################################
 ## <summary>
 ##	All of the rules required to

diff --git a/policy/modules/contrib/dovecot.te b/policy/modules/contrib/dovecot.te
index 5f4bc14..2017ffc 100644
--- a/policy/modules/contrib/dovecot.te
+++ b/policy/modules/contrib/dovecot.te
@@ -1,4 +1,4 @@
-policy_module(dovecot, 1.15.0)
+policy_module(dovecot, 1.15.1)
 
 ########################################
 #

diff --git a/policy/modules/contrib/mta.te b/policy/modules/contrib/mta.te
index 753900a..5805ec5 100644
--- a/policy/modules/contrib/mta.te
+++ b/policy/modules/contrib/mta.te
@@ -1,4 +1,4 @@
-policy_module(mta, 2.5.9)
+policy_module(mta, 2.6.0)
 
 ########################################
 #
@@ -156,7 +156,7 @@ optional_policy(`
 
 optional_policy(`
 	sendmail_manage_log(user_mail_domain)
-	sendmail_create_log(user_mail_domain)
+	sendmail_log_filetrans_sendmail_log(user_mail_domain, file)
 ')
 
 optional_policy(`

diff --git a/policy/modules/contrib/sendmail.fc b/policy/modules/contrib/sendmail.fc
index b90995b..7dee512 100644
--- a/policy/modules/contrib/sendmail.fc
+++ b/policy/modules/contrib/sendmail.fc
@@ -1,3 +1,4 @@
+/etc/rc\.d/init\.d/sendmail	--	gen_context(system_u:object_r:sendmail_initrc_exec_t,s0)
 
 /var/log/sendmail\.st	--	gen_context(system_u:object_r:sendmail_log_t,s0)
 /var/log/mail(/.*)?	gen_context(system_u:object_r:sendmail_log_t,s0)

diff --git a/policy/modules/contrib/sendmail.if b/policy/modules/contrib/sendmail.if
index 03bc4fe..88e753f 100644
--- a/policy/modules/contrib/sendmail.if
+++ b/policy/modules/contrib/sendmail.if
@@ -1,4 +1,4 @@
-## <summary>Policy for sendmail.</summary>
+## <summary>Internetwork email routing facility.</summary>
 
 ########################################
 ## <summary>
@@ -18,8 +18,7 @@ interface(`sendmail_stub',`
 
 ########################################
 ## <summary>
-##	Allow attempts to read and write to
-##	sendmail unnamed pipes.
+##	Read and write sendmail unnamed pipes.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -37,7 +36,7 @@ interface(`sendmail_rw_pipes',`
 
 ########################################
 ## <summary>
-##	Domain transition to sendmail.
+##	Execute a domain transition to run sendmail.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -50,16 +49,19 @@ interface(`sendmail_domtrans',`
 		type sendmail_t;
 	')
 
+	corecmd_search_bin($1)
 	mta_sendmail_domtrans($1, sendmail_t)
 
 	allow sendmail_t $1:fd use;
-	allow sendmail_t $1:fifo_file rw_file_perms;
+	allow sendmail_t $1:fifo_file rw_fifo_file_perms;
 	allow sendmail_t $1:process sigchld;
 ')
 
 ########################################
 ## <summary>
-##	Execute the sendmail program in the sendmail domain.
+##	Execute the sendmail program in the
+##	sendmail domain, and allow the
+##	specified role the sendmail domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -68,18 +70,18 @@ interface(`sendmail_domtrans',`
 ## </param>
 ## <param name="role">
 ##	<summary>
-##	The role to allow the sendmail domain.
+##	Role allowed access.
 ##	</summary>
 ## </param>
 ## <rolecap/>
 #
 interface(`sendmail_run',`
 	gen_require(`
-		type sendmail_t;
+		attribute_role sendmail_roles;
 	')
 
 	sendmail_domtrans($1)
-	role $2 types sendmail_t;
+	roleattribute $2 sendmail_roles;
 ')
 
 ########################################
@@ -139,7 +141,8 @@ interface(`sendmail_dontaudit_rw_tcp_sockets',`
 
 ########################################
 ## <summary>
-##	Read and write sendmail unix_stream_sockets.
+##	Read and write sendmail unix
+##	domain stream sockets.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -152,7 +155,7 @@ interface(`sendmail_rw_unix_stream_sockets',`
 		type sendmail_t;
 	')
 
-	allow $1 sendmail_t:unix_stream_socket { getattr read write ioctl };
+	allow $1 sendmail_t:unix_stream_socket rw_socket_perms;
 ')
 
 ########################################
@@ -171,12 +174,12 @@ interface(`sendmail_dontaudit_rw_unix_stream_sockets',`
 		type sendmail_t;
 	')
 
-	dontaudit $1 sendmail_t:unix_stream_socket { getattr read write ioctl };
+	dontaudit $1 sendmail_t:unix_stream_socket rw_socket_perms;
 ')
 
 ########################################
 ## <summary>
-##	Read sendmail logs.
+##	Read sendmail log files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -196,7 +199,8 @@ interface(`sendmail_read_log',`
 
 ########################################
 ## <summary>
-##	Create, read, write, and delete sendmail logs.
+##	Create, read, write, and delete
+##	sendmail log files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -216,7 +220,8 @@ interface(`sendmail_manage_log',`
 
 ########################################
 ## <summary>
-##	Create sendmail logs with the correct type.
+##	Create specified objects in generic
+##	log directories sendmail log file type.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -225,16 +230,43 @@ interface(`sendmail_manage_log',`
 ## </param>
 #
 interface(`sendmail_create_log',`
+	refpolicywarn(`$0($*) has been deprecated, use sendmail_log_filetrans_sendmail_log() instead.')
+	sendmail_log_filetrans_sendmail_log($1, $2, $3)
+')
+
+########################################
+## <summary>
+##	Create specified objects in generic
+##	log directories sendmail log file type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	Class of the object being created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`sendmail_log_filetrans_sendmail_log',`
 	gen_require(`
 		type sendmail_log_t;
 	')
 
-	logging_log_filetrans($1, sendmail_log_t, file)
+	logging_log_filetrans($1, sendmail_log_t, $2, $3)
 ')
 
 ########################################
 ## <summary>
-##	Manage sendmail tmp files.
+##	Create, read, write, and delete
+##	sendmail tmp files.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -269,15 +301,16 @@ interface(`sendmail_domtrans_unconfined',`
 	mta_sendmail_domtrans($1, unconfined_sendmail_t)
 
 	allow unconfined_sendmail_t $1:fd use;
-	allow unconfined_sendmail_t $1:fifo_file rw_file_perms;
+	allow unconfined_sendmail_t $1:fifo_file rw_fifo_file_perms;
 	allow unconfined_sendmail_t $1:process sigchld;
 ')
 
 ########################################
 ## <summary>
-##	Execute sendmail in the unconfined sendmail domain, and
-##	allow the specified role the unconfined sendmail domain,
-##	and use the caller's terminal.
+##	Execute sendmail in the unconfined
+##	sendmail domain, and allow the
+##	specified role the unconfined
+##	sendmail domain.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -293,9 +326,52 @@ interface(`sendmail_domtrans_unconfined',`
 #
 interface(`sendmail_run_unconfined',`
 	gen_require(`
-		type unconfined_sendmail_t;
+		attribute_role sendmail_unconfined_roles;
 	')
 
 	sendmail_domtrans_unconfined($1)
-	role $2 types unconfined_sendmail_t;
+	roleattribute $2 sendmail_unconfined_roles;
+')
+
+########################################
+## <summary>
+##	All of the rules required to
+##	administrate an sendmail environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`sendmail_admin',`
+	gen_require(`
+		type sendmail_t, sendmail_initrc_exec_t, sendmail_log_t;
+		type sendmail_tmp_t, sendmail_var_run_t, unconfined_sendmail_t;
+	')
+
+	allow $1 { unconfined_sendmail_t sendmail_t }:process { ptrace signal_perms };
+	ps_process_pattern($1, { unconfined_sendmail_t sendmail_t })
+
+	init_labeled_script_domtrans($1, sendmail_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 sendmail_initrc_exec_t system_r;
+
+	logging_list_logs($1)
+	admin_pattern($1, sendmail_log_t)
+
+	files_list_tmp($1)
+	admin_pattern($1, sendmail_tmp_t)
+
+	files_list_pids($1)
+	admin_pattern($1, sendmail_var_run_t)
+
+	sendmail_run($1, $2)
+	sendmail_run_unconfined($1, $2)
 ')

diff --git a/policy/modules/contrib/sendmail.te b/policy/modules/contrib/sendmail.te
index 6aeb742..d71368b 100644
--- a/policy/modules/contrib/sendmail.te
+++ b/policy/modules/contrib/sendmail.te
@@ -1,10 +1,18 @@
-policy_module(sendmail, 1.11.1)
+policy_module(sendmail, 1.11.2)
 
 ########################################
 #
 # Declarations
 #
 
+attribute_role sendmail_roles;
+
+attribute_role sendmail_unconfined_roles;
+roleattribute system_r sendmail_unconfined_roles;
+
+type sendmail_initrc_exec_t;
+init_script_file(sendmail_initrc_exec_t)
+
 type sendmail_log_t;
 logging_log_file(sendmail_log_t)
 
@@ -18,26 +26,27 @@ type sendmail_t;
 mta_sendmail_mailserver(sendmail_t)
 mta_mailserver_delivery(sendmail_t)
 mta_mailserver_sender(sendmail_t)
+role sendmail_roles types sendmail_t;
 
 type unconfined_sendmail_t;
 application_domain(unconfined_sendmail_t, sendmail_exec_t)
-role system_r types unconfined_sendmail_t;
+role sendmail_unconfined_roles types unconfined_sendmail_t;
 
 ########################################
 #
-# Sendmail local policy
+# Local policy
 #
 
 allow sendmail_t self:capability { dac_override setuid setgid net_bind_service sys_nice chown sys_tty_config };
 allow sendmail_t self:process { setsched setpgid setrlimit signal signull };
 allow sendmail_t self:fifo_file rw_fifo_file_perms;
-allow sendmail_t self:unix_stream_socket create_stream_socket_perms;
-allow sendmail_t self:unix_dgram_socket create_socket_perms;
-allow sendmail_t self:tcp_socket create_stream_socket_perms;
-allow sendmail_t self:udp_socket create_socket_perms;
+allow sendmail_t self:unix_stream_socket { accept listen };
+allow sendmail_t self:tcp_socket { accept listen };
 
-allow sendmail_t sendmail_log_t:dir setattr;
-manage_files_pattern(sendmail_t, sendmail_log_t, sendmail_log_t)
+allow sendmail_t sendmail_log_t:dir setattr_dir_perms;
+append_files_pattern(sendmail_t, sendmail_log_t, sendmail_log_t)
+create_files_pattern(sendmail_t, sendmail_log_t, sendmail_log_t)
+setattr_files_pattern(sendmail_t, sendmail_log_t, sendmail_log_t)
 logging_log_filetrans(sendmail_t, sendmail_log_t, { file dir })
 
 manage_dirs_pattern(sendmail_t, sendmail_tmp_t, sendmail_tmp_t)
@@ -49,7 +58,6 @@ files_pid_filetrans(sendmail_t, sendmail_var_run_t, file)
 
 kernel_read_network_state(sendmail_t)
 kernel_read_kernel_sysctls(sendmail_t)
-# for piping mail to a command
 kernel_read_system_state(sendmail_t)
 
 corenet_all_recvfrom_unlabeled(sendmail_t)
@@ -58,13 +66,25 @@ corenet_tcp_sendrecv_generic_if(sendmail_t)
 corenet_tcp_sendrecv_generic_node(sendmail_t)
 corenet_tcp_sendrecv_all_ports(sendmail_t)
 corenet_tcp_bind_generic_node(sendmail_t)
+
+corenet_sendrecv_smtp_server_packets(sendmail_t)
 corenet_tcp_bind_smtp_port(sendmail_t)
+
+corenet_sendrecv_all_client_packets(sendmail_t)
 corenet_tcp_connect_all_ports(sendmail_t)
-corenet_sendrecv_smtp_server_packets(sendmail_t)
-corenet_sendrecv_smtp_client_packets(sendmail_t)
 
-dev_read_urand(sendmail_t)
+corecmd_exec_bin(sendmail_t)
+corecmd_exec_shell(sendmail_t)
+
 dev_read_sysfs(sendmail_t)
+dev_read_urand(sendmail_t)
+
+domain_use_interactive_fds(sendmail_t)
+
+files_read_all_tmp_files(sendmail_t)
+files_read_etc_runtime_files(sendmail_t)
+files_read_usr_files(sendmail_t)
+files_search_spool(sendmail_t)
 
 fs_getattr_all_fs(sendmail_t)
 fs_search_auto_mountpoints(sendmail_t)
@@ -73,27 +93,14 @@ fs_rw_anon_inodefs_files(sendmail_t)
 term_dontaudit_use_console(sendmail_t)
 term_dontaudit_use_generic_ptys(sendmail_t)
 
-# for piping mail to a command
-corecmd_exec_shell(sendmail_t)
-corecmd_exec_bin(sendmail_t)
-
-domain_use_interactive_fds(sendmail_t)
-
-files_read_etc_files(sendmail_t)
-files_read_usr_files(sendmail_t)
-files_search_spool(sendmail_t)
-# for piping mail to a command
-files_read_etc_runtime_files(sendmail_t)
-
 init_use_fds(sendmail_t)
 init_use_script_ptys(sendmail_t)
-# sendmail wants to read /var/run/utmp if the controlling tty is /dev/console
 init_read_utmp(sendmail_t)
 init_dontaudit_write_utmp(sendmail_t)
+init_rw_script_tmp_files(sendmail_t)
 
 auth_use_nsswitch(sendmail_t)
 
-# Read /usr/lib/sasl2/.*
 libs_read_lib_files(sendmail_t)
 
 logging_send_syslog_msg(sendmail_t)
@@ -103,18 +110,19 @@ miscfiles_read_generic_certs(sendmail_t)
 miscfiles_read_localization(sendmail_t)
 
 userdom_dontaudit_use_unpriv_user_fds(sendmail_t)
-userdom_dontaudit_search_user_home_dirs(sendmail_t)
 
-mta_read_config(sendmail_t)
 mta_etc_filetrans_aliases(sendmail_t, file)
-# Write to /etc/aliases and /etc/mail.
 mta_manage_aliases(sendmail_t)
-# Write to /var/spool/mail and /var/spool/mqueue.
 mta_manage_queue(sendmail_t)
 mta_manage_spool(sendmail_t)
+mta_read_config(sendmail_t)
 mta_sendmail_exec(sendmail_t)
 
 optional_policy(`
+	cfengine_dontaudit_write_log_files(sendmail_t)
+')
+
+optional_policy(`
 	cron_read_pipes(sendmail_t)
 ')
 
@@ -128,7 +136,14 @@ optional_policy(`
 ')
 
 optional_policy(`
+	dovecot_write_inherited_tmp_files(sendmail_t)
+')
+
+optional_policy(`
 	exim_domtrans(sendmail_t)
+	exim_manage_spool_files(sendmail_t)
+	exim_manage_spool_dirs(sendmail_t)
+	exim_read_log(sendmail_t)
 ')
 
 optional_policy(`
@@ -149,7 +164,9 @@ optional_policy(`
 ')
 
 optional_policy(`
+	postfix_domtrans_postdrop(sendmail_t)
 	postfix_domtrans_master(sendmail_t)
+	postfix_domtrans_postqueue(sendmail_t)
 	postfix_read_config(sendmail_t)
 	postfix_search_spool(sendmail_t)
 ')
@@ -177,8 +194,7 @@ optional_policy(`
 
 ########################################
 #
-# Unconfined sendmail local policy
-# Allow unconfined domain to run newalias and have transitions work
+# Unconfined local policy
 #
 
 optional_policy(`