[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     8cc79cb235e2e5cf298b7e99b4821d0059f5c60c
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Thu Apr 11 08:34:32 2013 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Wed Apr 17 17:39:52 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=8cc79cb2

Support tagfiles for consolekit

Gentoo currently still uses the pam-foreground compatibility, which causes
ConsoleKit to set tagfiles in the pam_console tag directory (/var/run/console).
As /var/run is dynamic nowadays, ConsoleKit also creates the directory.

Allow ConsoleKit to create such directory with the right file transition in
place.

Debian also has this (already in policy) so duplicate settings for Gentoo. As
the policy includes a transition, I'm less inclined to make this a global policy
change as I have no idea what the impact would be on other distributions such as
Fedora/RedHat.

Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

---
 policy/modules/contrib/consolekit.te |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/policy/modules/contrib/consolekit.te b/policy/modules/contrib/consolekit.te
index ddd17c5..03989f3 100644
--- a/policy/modules/contrib/consolekit.te
+++ b/policy/modules/contrib/consolekit.te
@@ -92,6 +92,11 @@ ifdef(`distro_debian',`
 	auth_pid_filetrans_pam_var_console(consolekit_t, dir, "console")
 ')
 
+ifdef(`distro_gentoo',`
+	auth_create_pam_console_data_dirs(consolekit_t)
+	auth_pid_filetrans_pam_var_console(consolekit_t, dir, "console")
+')
+
 optional_policy(`
 	dbus_system_domain(consolekit_t, consolekit_exec_t)