[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/kernel/

["Sven Vermeulen" <swift@gentoo.org>]

commit:     888b3e739f286506fbdb064b3ae7cd84c4ffb8a4
Author:     Chris PeBenito <pebenito <AT> gentoo <DOT> org>
AuthorDate: Sat Feb  8 15:49:47 2014 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Sun Feb  9 10:52:45 2014 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=888b3e73

Rename mount_read_mount_loopback() to mount_read_loopback_file().

Also make kernel block optional since the calls are to a higher layer.

---
 policy/modules/kernel/kernel.te | 8 +++++---
 policy/modules/system/mount.if  | 2 +-
 policy/modules/system/mount.te  | 2 +-
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index c47eb45..5fa2926 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -287,9 +287,6 @@ files_list_etc(kernel_t)
 files_list_home(kernel_t)
 files_read_usr_files(kernel_t)
 
-mount_use_fds(kernel_t)
-mount_read_mount_loopback(kernel_t)
-
 mcs_process_set_categories(kernel_t)
 
 mls_process_read_up(kernel_t)
@@ -320,6 +317,11 @@ optional_policy(`
 ')
 
 optional_policy(`
+	mount_use_fds(kernel_t)
+	mount_read_loopback_file(kernel_t)
+')
+
+optional_policy(`
 	nis_use_ypbind(kernel_t)
 ')
 

diff --git a/policy/modules/system/mount.if b/policy/modules/system/mount.if
index 802fd3d..cf80631 100644
--- a/policy/modules/system/mount.if
+++ b/policy/modules/system/mount.if
@@ -184,7 +184,7 @@ interface(`mount_run_unconfined',`
 ##	</summary>
 ## </param>
 #
-interface(`mount_read_mount_loopback',`
+interface(`mount_read_loopback_file',`
 	gen_require(`
 		type mount_t;
 	')

diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
index 1b9030a..bf84971 100644
--- a/policy/modules/system/mount.te
+++ b/policy/modules/system/mount.te
@@ -43,7 +43,7 @@ application_domain(unconfined_mount_t, mount_exec_t)
 # setuid/setgid needed to mount cifs
 allow mount_t self:capability { ipc_lock sys_rawio sys_admin dac_override chown sys_tty_config setuid setgid };
 
-mount_read_mount_loopback(mount_t)
+mount_read_loopback_file(mount_t)
 
 allow mount_t mount_tmp_t:file manage_file_perms;
 allow mount_t mount_tmp_t:dir manage_dir_perms;