public inbox for gentoo-commits@lists.gentoo.org
 help / color / mirror / Atom feed
From: "Sven Vermeulen" <sven.vermeulen@siphos.be>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: /
Date: Sat, 27 Oct 2012 11:06:23 +0000 (UTC)	[thread overview]
Message-ID: <1351335792.7f0063b12afb951c707a12b9b64f5590ec331158.SwifT@gentoo> (raw)

commit:     7f0063b12afb951c707a12b9b64f5590ec331158
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Fri Oct 26 09:27:57 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sat Oct 27 11:03:12 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=7f0063b1

Initial firewallgui policy module

Graphical firewall management tool

Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 firewallgui.fc |    1 +
 firewallgui.if |   41 ++++++++++++++++++++++++++++++++
 firewallgui.te |   70 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 112 insertions(+), 0 deletions(-)

diff --git a/firewallgui.fc b/firewallgui.fc
new file mode 100644
index 0000000..ef1f43d
--- /dev/null
+++ b/firewallgui.fc
@@ -0,0 +1 @@
+/usr/share/system-config-firewall/system-config-firewall-mechanism.py	--	gen_context(system_u:object_r:firewallgui_exec_t,s0)

diff --git a/firewallgui.if b/firewallgui.if
new file mode 100644
index 0000000..e6866d1
--- /dev/null
+++ b/firewallgui.if
@@ -0,0 +1,41 @@
+## <summary>system-config-firewall dbus system service.</summary>
+
+########################################
+## <summary>
+##	Send and receive messages from
+##	firewallgui over dbus.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`firewallgui_dbus_chat',`
+	gen_require(`
+		type firewallgui_t;
+		class dbus send_msg;
+	')
+
+	allow $1 firewallgui_t:dbus send_msg;
+	allow firewallgui_t $1:dbus send_msg;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to read and
+##	write firewallgui unnamed pipes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`firewallgui_dontaudit_rw_pipes',`
+	gen_require(`
+		type firewallgui_t;
+	')
+
+	dontaudit $1 firewallgui_t:fifo_file rw_fifo_file_perms;
+')

diff --git a/firewallgui.te b/firewallgui.te
new file mode 100644
index 0000000..40dc5f9
--- /dev/null
+++ b/firewallgui.te
@@ -0,0 +1,70 @@
+policy_module(firewallgui, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type firewallgui_t;
+type firewallgui_exec_t;
+dbus_system_domain(firewallgui_t, firewallgui_exec_t)
+init_daemon_domain(firewallgui_t, firewallgui_exec_t)
+
+type firewallgui_tmp_t;
+files_tmp_file(firewallgui_tmp_t)
+
+########################################
+#
+# Local policy
+#
+
+allow firewallgui_t self:capability { net_admin sys_rawio } ;
+allow firewallgui_t self:fifo_file rw_fifo_file_perms;
+
+manage_files_pattern(firewallgui_t,firewallgui_tmp_t,firewallgui_tmp_t)
+manage_dirs_pattern(firewallgui_t,firewallgui_tmp_t,firewallgui_tmp_t)
+files_tmp_filetrans(firewallgui_t,firewallgui_tmp_t, { file dir })
+
+kernel_read_system_state(firewallgui_t)
+kernel_read_network_state(firewallgui_t)
+kernel_rw_net_sysctls(firewallgui_t)
+kernel_rw_kernel_sysctl(firewallgui_t)
+kernel_rw_vm_sysctls(firewallgui_t)
+
+corecmd_exec_bin(firewallgui_t)
+corecmd_exec_shell(firewallgui_t)
+
+dev_read_sysfs(firewallgui_t)
+dev_read_urand(firewallgui_t)
+
+files_list_kernel_modules(firewallgui_t)
+files_read_usr_files(firewallgui_t)
+
+auth_use_nsswitch(firewallgui_t)
+
+miscfiles_read_localization(firewallgui_t)
+
+seutil_read_config(firewallgui_t)
+
+userdom_dontaudit_search_user_home_dirs(firewallgui_t)
+
+optional_policy(`
+	consoletype_exec(firewallgui_t)
+')
+
+optional_policy(`
+	gnome_read_generic_gconf_home_content(firewallgui_t)
+')
+
+optional_policy(`
+	iptables_domtrans(firewallgui_t)
+	iptables_initrc_domtrans(firewallgui_t)
+')
+
+optional_policy(`
+	modutils_getattr_module_deps(firewallgui_t)
+')
+
+optional_policy(`
+	policykit_dbus_chat(firewallgui_t)
+')


             reply	other threads:[~2012-10-27 11:09 UTC|newest]

Thread overview: 104+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-10-27 11:06 Sven Vermeulen [this message]
  -- strict thread matches above, loose matches on Subject: below --
2025-07-15  7:54 [gentoo-commits] proj/hardened-refpolicy:master commit in: / Jason Zaman
2025-03-08 23:55 Jason Zaman
2025-03-08 23:55 Jason Zaman
2024-09-22  0:03 Jason Zaman
2024-09-22  0:03 Jason Zaman
2024-03-01 19:56 Kenton Groombridge
2024-03-01 19:56 Kenton Groombridge
2024-03-01 19:56 Kenton Groombridge
2024-03-01 19:56 Kenton Groombridge
2024-03-01 19:56 Kenton Groombridge
2023-02-10 20:30 Kenton Groombridge
2022-03-31  3:31 Jason Zaman
2022-03-31  3:31 Jason Zaman
2022-03-31  3:31 Jason Zaman
2022-03-31  3:31 Jason Zaman
2021-11-11 21:27 Jason Zaman
2021-04-03  3:10 Jason Zaman
2021-02-07  3:21 Jason Zaman
2021-02-07  3:20 Jason Zaman
2021-02-07  3:20 Jason Zaman
2021-02-07  3:20 Jason Zaman
2021-02-07  3:20 Jason Zaman
2021-02-07  3:20 Jason Zaman
2021-02-07  3:20 Jason Zaman
2021-02-07  3:20 Jason Zaman
2021-01-11  1:27 Jason Zaman
2020-10-13  3:02 Jason Zaman
2019-12-16 17:48 Jason Zaman
2019-07-13  7:01 Jason Zaman
2019-07-13  7:01 Jason Zaman
2019-02-10  4:14 Jason Zaman
2018-07-08 11:47 Jason Zaman
2018-06-24  8:46 Jason Zaman
2018-03-25 10:29 Sven Vermeulen
2018-01-18 16:37 Sven Vermeulen
2017-06-13  8:25 Jason Zaman
2017-04-10 16:59 Sven Vermeulen
2017-03-30 17:06 Jason Zaman
2017-03-30 17:06 Jason Zaman
2017-03-02 10:17 Sven Vermeulen
2017-02-27 10:50 Jason Zaman
2017-02-25 16:58 Jason Zaman
2017-02-21  7:11 Jason Zaman
2017-02-21  7:11 Jason Zaman
2017-02-05  6:29 Jason Zaman
2017-01-23 15:44 Jason Zaman
2017-01-23 15:44 Jason Zaman
2017-01-23 15:44 Jason Zaman
2017-01-13 18:43 Sven Vermeulen
2017-01-13 18:43 Sven Vermeulen
2017-01-13 18:43 Sven Vermeulen
2016-12-06 13:39 Jason Zaman
2016-10-24 16:02 [gentoo-commits] proj/hardened-refpolicy:swift " Sven Vermeulen
2016-10-24 16:02 ` [gentoo-commits] proj/hardened-refpolicy:master " Sven Vermeulen
2016-10-24 16:02 [gentoo-commits] proj/hardened-refpolicy:swift " Sven Vermeulen
2016-10-24 16:02 ` [gentoo-commits] proj/hardened-refpolicy:master " Sven Vermeulen
2016-10-24 16:02 Sven Vermeulen
2016-08-31 16:38 Jason Zaman
2016-08-31 16:38 Jason Zaman
2016-05-13  5:37 Jason Zaman
2016-05-13  5:37 Jason Zaman
2015-12-17 16:10 Jason Zaman
2015-10-26  5:36 [gentoo-commits] proj/hardened-refpolicy:next " Jason Zaman
2015-10-26  5:48 ` [gentoo-commits] proj/hardened-refpolicy:master " Jason Zaman
2015-03-29  9:59 Jason Zaman
2015-02-15 17:39 Sven Vermeulen
2014-12-04  1:46 Jason Zaman
2014-11-27  8:31 Jason Zaman
2014-11-22 16:25 Sven Vermeulen
2014-09-21 14:08 [gentoo-commits] proj/hardened-refpolicy:mailinfra " Sven Vermeulen
2014-09-13  9:38 ` [gentoo-commits] proj/hardened-refpolicy:master " Sven Vermeulen
2014-06-25 19:06 Sven Vermeulen
2014-03-17  8:24 Sven Vermeulen
2014-03-17  8:24 Sven Vermeulen
2014-03-17  8:24 Sven Vermeulen
2014-03-06 15:20 Sven Vermeulen
2014-01-19 19:01 Sven Vermeulen
2013-09-30 19:03 Sven Vermeulen
2013-09-30 19:03 Sven Vermeulen
2013-09-26 13:19 Sven Vermeulen
2013-09-23 13:31 Sven Vermeulen
2013-09-23  6:29 [gentoo-commits] proj/hardened-refpolicy:merge " Sven Vermeulen
2013-09-23 13:31 ` [gentoo-commits] proj/hardened-refpolicy:master " Sven Vermeulen
2013-09-23  6:29 [gentoo-commits] proj/hardened-refpolicy:merge " Sven Vermeulen
2013-09-23 13:31 ` [gentoo-commits] proj/hardened-refpolicy:master " Sven Vermeulen
2013-05-01 18:23 Sven Vermeulen
2013-05-01 18:23 Sven Vermeulen
2013-01-16 19:48 Sven Vermeulen
2012-12-08 12:41 Sven Vermeulen
2012-12-03 21:03 Sven Vermeulen
2012-12-03  9:35 Sven Vermeulen
2012-11-06 20:21 Sven Vermeulen
2012-10-22 18:15 Sven Vermeulen
2012-10-17 17:41 Sven Vermeulen
2012-10-16 17:39 Sven Vermeulen
2012-10-16 17:39 Sven Vermeulen
2012-10-16 17:39 Sven Vermeulen
2012-10-06 17:14 Sven Vermeulen
2012-10-06 17:05 Sven Vermeulen
2012-10-06 17:05 Sven Vermeulen
2012-10-06 15:56 Sven Vermeulen
2012-10-06 15:56 Sven Vermeulen
2012-10-04 17:36 Sven Vermeulen
2012-10-04 17:36 Sven Vermeulen
2012-10-04 17:36 Sven Vermeulen
2012-10-02 18:11 Sven Vermeulen
2012-10-02 18:11 Sven Vermeulen
2012-09-27 18:05 Sven Vermeulen
2012-09-27 18:05 Sven Vermeulen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1351335792.7f0063b12afb951c707a12b9b64f5590ec331158.SwifT@gentoo \
    --to=sven.vermeulen@siphos.be \
    --cc=gentoo-commits@lists.gentoo.org \
    --cc=gentoo-dev@lists.gentoo.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox