[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/apps/, policy/modules/services/

[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/apps/, policy/modules/services/

[Jason Zaman]

commit:     2c0357f7e69e0d75c52933bd88771b17d0c39aa6
Author:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
AuthorDate: Sun Feb 21 05:18:52 2021 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Mar 21 22:07:35 2021 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=2c0357f7

bluetooth: Add bluetooth_socket perms

- Needs bluetooth/alg_socket access
- pulse needs shutdown perms on the socket
- also needs to read udev db

Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/apps/pulseaudio.te    | 1 +
 policy/modules/services/bluetooth.if | 3 ++-
 policy/modules/services/bluetooth.te | 6 ++++++
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/policy/modules/apps/pulseaudio.te b/policy/modules/apps/pulseaudio.te
index fd2df71a..ceb954e4 100644
--- a/policy/modules/apps/pulseaudio.te
+++ b/policy/modules/apps/pulseaudio.te
@@ -54,6 +54,7 @@ allow pulseaudio_t self:process { getcap getsched setcap setrlimit setsched sign
 allow pulseaudio_t self:fifo_file rw_fifo_file_perms;
 allow pulseaudio_t self:unix_stream_socket { accept connectto listen };
 allow pulseaudio_t self:unix_dgram_socket sendto;
+allow pulseaudio_t self:bluetooth_socket shutdown;
 allow pulseaudio_t self:tcp_socket { accept listen };
 allow pulseaudio_t self:netlink_kobject_uevent_socket create_socket_perms;
 

diff --git a/policy/modules/services/bluetooth.if b/policy/modules/services/bluetooth.if
index e35e8631..3e4b0e5f 100644
--- a/policy/modules/services/bluetooth.if
+++ b/policy/modules/services/bluetooth.if
@@ -66,7 +66,8 @@ interface(`bluetooth_stream_connect',`
 	')
 
 	files_search_runtime($1)
-	allow $1 bluetooth_t:socket rw_socket_perms;
+	allow $1 bluetooth_t:fd use;
+	allow $1 bluetooth_t:socket { rw_socket_perms shutdown };
 	stream_connect_pattern($1, bluetooth_runtime_t, bluetooth_runtime_t, bluetooth_t)
 ')
 

diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te
index 69a38543..fcf0c177 100644
--- a/policy/modules/services/bluetooth.te
+++ b/policy/modules/services/bluetooth.te
@@ -60,6 +60,8 @@ allow bluetooth_t self:socket create_stream_socket_perms;
 allow bluetooth_t self:unix_stream_socket { accept connectto listen };
 allow bluetooth_t self:tcp_socket { accept listen };
 allow bluetooth_t self:netlink_kobject_uevent_socket create_socket_perms;
+allow bluetooth_t self:bluetooth_socket server_stream_socket_perms;
+allow bluetooth_t self:alg_socket create_stream_socket_perms;
 
 read_files_pattern(bluetooth_t, bluetooth_conf_t, bluetooth_conf_t)
 
@@ -156,6 +158,10 @@ optional_policy(`
 	ppp_domtrans(bluetooth_t)
 ')
 
+optional_policy(`
+	udev_read_runtime_files(bluetooth_t)
+')
+
 ########################################
 #
 # Helper local policy

[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/apps/, policy/modules/services/

[Jason Zaman]

commit:     c41bce39e4cc5a7ae57a5a305ab8e7bb1618fcf7
Author:     Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Wed Oct 13 18:42:42 2021 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Nov 20 22:58:24 2021 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=c41bce39

mpd, pulseaudio: split domtrans and client access

Split `pulseaudio_domtrans()` into two interfaces: one that grants
transition access and the other the `pulseaudio_client` attribute. This
fixes a build error because calls to `pulseaudio_domtrans()` by the role
would associate the client attribute with the user exec domain
attribute.

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/apps/pulseaudio.if | 26 ++++++++++++++++++++------
 policy/modules/services/mpd.te    |  1 +
 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/policy/modules/apps/pulseaudio.if b/policy/modules/apps/pulseaudio.if
index 5a2c2a83..1796b771 100644
--- a/policy/modules/apps/pulseaudio.if
+++ b/policy/modules/apps/pulseaudio.if
@@ -59,6 +59,25 @@ template(`pulseaudio_role',`
 	')
 ')
 
+########################################
+## <summary>
+##	Connect to pulseaudio and manage
+##	pulseaudio config data.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`pulseaudio_client_domain',`
+	gen_require(`
+		attribute pulseaudio_client;
+	')
+
+	typeattribute $1 pulseaudio_client;
+')
+
 ########################################
 ## <summary>
 ##	Execute a domain transition to run pulseaudio.
@@ -71,12 +90,9 @@ template(`pulseaudio_role',`
 #
 interface(`pulseaudio_domtrans',`
 	gen_require(`
-		attribute pulseaudio_client;
 		type pulseaudio_t, pulseaudio_exec_t;
 	')
 
-	typeattribute $1 pulseaudio_client;
-
 	corecmd_search_bin($1)
 	domtrans_pattern($1, pulseaudio_exec_t, pulseaudio_t)
 ')
@@ -100,12 +116,10 @@ interface(`pulseaudio_domtrans',`
 #
 interface(`pulseaudio_run',`
 	gen_require(`
-		attribute pulseaudio_client;
 		attribute_role pulseaudio_roles;
 	')
 
-	typeattribute $1 pulseaudio_client;
-
+	pulseaudio_client_domain($1)
 	pulseaudio_domtrans($1)
 	roleattribute $2 pulseaudio_roles;
 ')

diff --git a/policy/modules/services/mpd.te b/policy/modules/services/mpd.te
index 4a0650df..3ba4a896 100644
--- a/policy/modules/services/mpd.te
+++ b/policy/modules/services/mpd.te
@@ -182,6 +182,7 @@ optional_policy(`
 ')
 
 optional_policy(`
+	pulseaudio_client_domain(mpd_t)
 	pulseaudio_domtrans(mpd_t)
 ')