From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 09646139694 for ; Sun, 7 May 2017 17:47:22 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 6174121C094; Sun, 7 May 2017 17:47:16 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 429EB21C094 for ; Sun, 7 May 2017 17:47:16 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 7A1393416D3 for ; Sun, 7 May 2017 17:47:15 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 3FD3C7455 for ; Sun, 7 May 2017 17:47:13 +0000 (UTC) From: "Jason Zaman" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jason Zaman" Message-ID: <1494178829.83244b1264056d64fe3c979671a68ec3a80cd7dd.perfinion@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:next commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/chromium.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: perfinion X-VCS-Committer-Name: Jason Zaman X-VCS-Revision: 83244b1264056d64fe3c979671a68ec3a80cd7dd X-VCS-Branch: next Date: Sun, 7 May 2017 17:47:13 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 338e06b0-8f17-4cc5-957b-075120028186 X-Archives-Hash: 63398d5e0b3d6968246c250e88be65d3 commit: 83244b1264056d64fe3c979671a68ec3a80cd7dd Author: Jason Zaman perfinion com> AuthorDate: Sun May 7 03:39:18 2017 +0000 Commit: Jason Zaman gentoo org> CommitDate: Sun May 7 17:40:29 2017 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=83244b12 chromium: allow cap_userns for the sandbox https://patchwork.kernel.org/patch/8785151/ policy/modules/contrib/chromium.te | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/policy/modules/contrib/chromium.te b/policy/modules/contrib/chromium.te index cd1e1116..a4fba97c 100644 --- a/policy/modules/contrib/chromium.te +++ b/policy/modules/contrib/chromium.te @@ -89,10 +89,12 @@ xdg_cache_home_content(chromium_xdg_cache_t) # # execmem for load in plugins -allow chromium_t self:process { execmem getsched setcap setrlimit setsched sigkill signal }; -allow chromium_t self:fifo_file rw_fifo_file_perms;; +allow chromium_t self:process { execmem getsched getcap setcap setrlimit setsched sigkill signal }; +allow chromium_t self:fifo_file rw_fifo_file_perms; allow chromium_t self:sem create_sem_perms; allow chromium_t self:netlink_kobject_uevent_socket client_stream_socket_perms; +# cap_userns sys_admin for the sandbox +allow chromium_t self:cap_userns { sys_admin sys_chroot sys_ptrace }; allow chromium_t chromium_exec_t:file execute_no_trans; @@ -135,6 +137,7 @@ domtrans_pattern(chromium_t, chromium_sandbox_exec_t, chromium_sandbox_t) domtrans_pattern(chromium_t, chromium_naclhelper_exec_t, chromium_naclhelper_t) kernel_list_proc(chromium_t) +kernel_read_net_sysctls(chromium_t) corecmd_exec_bin(chromium_t) # Look for /etc/gentoo-release through a shell invocation running find From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id F3CAA139695 for ; Sun, 7 May 2017 17:41:19 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 1572BE0CCE; Sun, 7 May 2017 17:41:19 +0000 (UTC) Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id E7B78E0CCE for ; Sun, 7 May 2017 17:41:18 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 9D00C340DF9 for ; Sun, 7 May 2017 17:41:17 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 0191F744D for ; Sun, 7 May 2017 17:41:16 +0000 (UTC) From: "Jason Zaman" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jason Zaman" Message-ID: <1494178829.83244b1264056d64fe3c979671a68ec3a80cd7dd.perfinion@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/chromium.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: perfinion X-VCS-Committer-Name: Jason Zaman X-VCS-Revision: 83244b1264056d64fe3c979671a68ec3a80cd7dd X-VCS-Branch: master Date: Sun, 7 May 2017 17:41:16 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 4fdf4f67-4e1a-4589-92f5-a6281005f332 X-Archives-Hash: f04fa4f5b2a33a539b378bc0de38a02d Message-ID: <20170507174116.cPTNJMQXnXGYZqD7Q6umy7uc1SUjFBk7vxCrreNdM4A@z> commit: 83244b1264056d64fe3c979671a68ec3a80cd7dd Author: Jason Zaman perfinion com> AuthorDate: Sun May 7 03:39:18 2017 +0000 Commit: Jason Zaman gentoo org> CommitDate: Sun May 7 17:40:29 2017 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=83244b12 chromium: allow cap_userns for the sandbox https://patchwork.kernel.org/patch/8785151/ policy/modules/contrib/chromium.te | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/policy/modules/contrib/chromium.te b/policy/modules/contrib/chromium.te index cd1e1116..a4fba97c 100644 --- a/policy/modules/contrib/chromium.te +++ b/policy/modules/contrib/chromium.te @@ -89,10 +89,12 @@ xdg_cache_home_content(chromium_xdg_cache_t) # # execmem for load in plugins -allow chromium_t self:process { execmem getsched setcap setrlimit setsched sigkill signal }; -allow chromium_t self:fifo_file rw_fifo_file_perms;; +allow chromium_t self:process { execmem getsched getcap setcap setrlimit setsched sigkill signal }; +allow chromium_t self:fifo_file rw_fifo_file_perms; allow chromium_t self:sem create_sem_perms; allow chromium_t self:netlink_kobject_uevent_socket client_stream_socket_perms; +# cap_userns sys_admin for the sandbox +allow chromium_t self:cap_userns { sys_admin sys_chroot sys_ptrace }; allow chromium_t chromium_exec_t:file execute_no_trans; @@ -135,6 +137,7 @@ domtrans_pattern(chromium_t, chromium_sandbox_exec_t, chromium_sandbox_t) domtrans_pattern(chromium_t, chromium_naclhelper_exec_t, chromium_naclhelper_t) kernel_list_proc(chromium_t) +kernel_read_net_sysctls(chromium_t) corecmd_exec_bin(chromium_t) # Look for /etc/gentoo-release through a shell invocation running find