[gentoo-commits] proj/hardened-refpolicy:master commit in: /

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     67f7c97fa4287aecf5e4eab532f389016359c3d0
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Mon Oct 15 16:09:25 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Oct 16 17:35:40 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=67f7c97f

Initial rngd policy module

Hardware random number generation tools.

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 rngd.fc |    3 +++
 rngd.if |   32 ++++++++++++++++++++++++++++++++
 rngd.te |   34 ++++++++++++++++++++++++++++++++++
 3 files changed, 69 insertions(+), 0 deletions(-)

diff --git a/rngd.fc b/rngd.fc
new file mode 100644
index 0000000..5dd779e
--- /dev/null
+++ b/rngd.fc
@@ -0,0 +1,3 @@
+/etc/rc\.d/init\.d/rngd	--	gen_context(system_u:object_r:rngd_initrc_exec_t,s0)
+
+/usr/sbin/rngd	--	gen_context(system_u:object_r:rngd_exec_t,s0)

diff --git a/rngd.if b/rngd.if
new file mode 100644
index 0000000..0e759a2
--- /dev/null
+++ b/rngd.if
@@ -0,0 +1,32 @@
+## <summary>Check and feed random data from hardware device to kernel random device.</summary>
+
+########################################
+## <summary>
+##	All of the rules required to
+##	administrate an rng environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`rngd_admin',`
+	gen_require(`
+		type rngd_t, rngd_initrc_exec_t;
+	')
+
+	allow $1 rngd_t:process { ptrace signal_perms };
+	ps_process_pattern($1, rngd_t)
+
+	init_labeled_script_domtrans($1, rngd_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 rngd_initrc_exec_t system_r;
+	allow $2 system_r;
+')

diff --git a/rngd.te b/rngd.te
new file mode 100644
index 0000000..c324536
--- /dev/null
+++ b/rngd.te
@@ -0,0 +1,34 @@
+policy_module(rngd, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type rngd_t;
+type rngd_exec_t;
+init_daemon_domain(rngd_t, rngd_exec_t)
+
+type rngd_initrc_exec_t;
+init_script_file(rngd_initrc_exec_t)
+
+########################################
+#
+# Local policy
+#
+
+allow rngd_t self:capability sys_admin;
+allow rngd_t self:process signal;
+allow rngd_t self:fifo_file rw_fifo_file_perms;
+allow rngd_t self:unix_stream_socket { accept listen };
+
+dev_read_rand(rngd_t)
+dev_read_urand(rngd_t)
+dev_rw_tpm(rngd_t)
+dev_write_rand(rngd_t)
+
+files_read_etc_files(rngd_t)
+
+logging_send_syslog_msg(rngd_t)
+
+miscfiles_read_localization(rngd_t)