From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 87DAF1387B1 for ; Mon, 11 Nov 2013 13:46:19 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 810FDE0BC6; Mon, 11 Nov 2013 13:46:13 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 056E4E0BC6 for ; Mon, 11 Nov 2013 13:46:02 +0000 (UTC) Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id ABFB533F20B for ; Mon, 11 Nov 2013 13:45:56 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by hornbill.gentoo.org (Postfix) with ESMTP id 9D2D2E54DA for ; Mon, 11 Nov 2013 13:45:54 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1384177447.153cbe093296b68012a5195b14013e3f5d3cb409.swift@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/gdomap.if policy/modules/contrib/minissdpd.if X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: swift X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 153cbe093296b68012a5195b14013e3f5d3cb409 X-VCS-Branch: master Date: Mon, 11 Nov 2013 13:45:54 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 0d82b718-f76c-486f-b3ee-7876f8aee5a5 X-Archives-Hash: 2f36f5b6533898ef8f61e167002b7c52 commit: 153cbe093296b68012a5195b14013e3f5d3cb409 Author: Dominick Grift gmail com> AuthorDate: Mon Oct 7 08:44:51 2013 +0000 Commit: Sven Vermeulen gentoo org> CommitDate: Mon Nov 11 13:44:07 2013 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=153cbe09 gdomap/minissdpd: create read_config interfaces for initrc_t these are really environment files in /etc/default, however we need to label the with a private type for confined administration ( we dont want confined admins to be able to manage generic etc_t files ) However creating private environ_t files for this seems overengineering since init script usually only need to read environ files, so by allowing this we also allow initrc_t to read other gdomap/minissdpd confgi files (which in this case arent any) Signed-off-by: Dominick Grift gmail.com> --- policy/modules/contrib/gdomap.if | 19 +++++++++++++++++++ policy/modules/contrib/minissdpd.if | 19 +++++++++++++++++++ 2 files changed, 38 insertions(+) diff --git a/policy/modules/contrib/gdomap.if b/policy/modules/contrib/gdomap.if index f2cf3ad..7d6b6b7 100644 --- a/policy/modules/contrib/gdomap.if +++ b/policy/modules/contrib/gdomap.if @@ -2,6 +2,25 @@ ######################################## ## +## Read gdomap configuration files. +## +## +## +## Domain allowed access. +## +## +# +interface(`gdomap_read_config',` + gen_require(` + type gdomap_conf_t; + ') + + files_search_etc($1) + allow $1 gdomap_conf_t:file read_file_perms; +') + +######################################## +## ## All of the rules required to ## administrate an gdomap environment. ## diff --git a/policy/modules/contrib/minissdpd.if b/policy/modules/contrib/minissdpd.if index 20de8ef..b330161 100644 --- a/policy/modules/contrib/minissdpd.if +++ b/policy/modules/contrib/minissdpd.if @@ -2,6 +2,25 @@ ######################################## ## +## Read minissdpd configuration files. +## +## +## +## Domain allowed access. +## +## +# +interface(`minissdpd_read_config',` + gen_require(` + type minissdpd_conf_t; + ') + + files_search_etc($1) + allow $1 minissdpd_conf_t:file read_file_perms; +') + +######################################## +## ## All of the rules required to ## administrate an minissdpd environment. ##