rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

trunk: 4 patches from dan.

This commit is contained in:
Chris PeBenito 2007-09-05 14:48:21 +00:00
parent 0a0b8078ca
commit 016e5c5cdc
8 changed files with 159 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
policy/modules/admin/bootloader.te
View File

@ -1,5 +1,5 @@
policy_module(bootloader,1.5.1)
policy_module(bootloader,1.5.2)
########################################
#
@ -185,6 +185,7 @@ optional_policy(`
optional_policy(`
hal_dontaudit_append_lib_files(bootloader_t)
hal_write_log(bootloader_t)
')
optional_policy(`

3
policy/modules/admin/vbetool.te
View File

@ -1,5 +1,5 @@
policy_module(vbetool,1.1.0)
policy_module(vbetool,1.1.1)
########################################
#
@ -32,4 +32,5 @@ miscfiles_read_localization(vbetool_t)
optional_policy(`
hal_rw_pid_files(vbetool_t)
hal_write_log(vbetool_t)
')

6
policy/modules/services/clamav.fc
View File

@ -1,6 +1,5 @@
/etc/clamav(/.*)? gen_context(system_u:object_r:clamd_etc_t,s0)
/usr/bin/clamscan -- gen_context(system_u:object_r:clamscan_exec_t,s0)
/usr/bin/clamdscan -- gen_context(system_u:object_r:clamscan_exec_t,s0)
/usr/bin/freshclam -- gen_context(system_u:object_r:freshclam_exec_t,s0)
@ -9,8 +8,13 @@
/var/run/amavis(d)?/clamd\.pid -- gen_context(system_u:object_r:clamd_var_run_t,s0)
/var/run/clamav(/.*)? gen_context(system_u:object_r:clamd_var_run_t,s0)
/var/run/clamd\..* gen_context(system_u:object_r:clamd_var_run_t,s0)
/var/run/clamav\..* gen_context(system_u:object_r:clamd_var_run_t,s0)
/var/lib/clamav(/.*)? gen_context(system_u:object_r:clamd_var_lib_t,s0)
/var/log/clamav -d gen_context(system_u:object_r:clamd_var_log_t,s0)
/var/log/clamav/clamav.* -- gen_context(system_u:object_r:clamd_var_log_t,s0)
/var/log/clamav/freshclam.* -- gen_context(system_u:object_r:freshclam_var_log_t,s0)
/var/spool/amavisd/clamd\.sock -s gen_context(system_u:object_r:clamd_var_run_t,s0)

15
policy/modules/services/clamav.te
View File

@ -1,5 +1,5 @@
policy_module(clamav,1.4.0)
policy_module(clamav,1.4.1)
########################################
#
@ -74,17 +74,19 @@ manage_dirs_pattern(clamd_t,clamd_var_lib_t,clamd_var_lib_t)
manage_files_pattern(clamd_t,clamd_var_lib_t,clamd_var_lib_t)
# log files
allow clamd_t clamd_var_log_t:dir setattr;
manage_dirs_pattern(clamd_t,clamd_var_log_t,clamd_var_log_t)
manage_files_pattern(clamd_t,clamd_var_log_t,clamd_var_log_t)
logging_log_filetrans(clamd_t,clamd_var_log_t,file)
logging_log_filetrans(clamd_t,clamd_var_log_t,{ dir file })
# pid file
manage_dirs_pattern(clamd_t,clamd_var_log_t,clamd_var_log_t)
manage_files_pattern(clamd_t,clamd_var_run_t,clamd_var_run_t)
manage_sock_files_pattern(clamd_t,clamd_var_run_t,clamd_var_run_t)
files_pid_filetrans(clamd_t,clamd_var_run_t,file)
files_pid_filetrans(clamd_t,clamd_var_run_t,{ file dir })
kernel_dontaudit_list_proc(clamd_t)
kernel_read_sysctl(clamd_t)
kernel_read_kernel_sysctls(clamd_t)
corenet_all_recvfrom_unlabeled(clamd_t)
corenet_all_recvfrom_netlabel(clamd_t)
@ -213,7 +215,7 @@ manage_files_pattern(clamscan_t,clamscan_tmp_t,clamscan_tmp_t)
files_tmp_filetrans(clamscan_t,clamscan_tmp_t,{ file dir })
# var/lib files together with clamd
read_files_pattern(clamscan_t,clamd_var_lib_t,clamd_var_lib_t)
manage_files_pattern(clamscan_t,clamd_var_lib_t,clamd_var_lib_t)
allow clamscan_t clamd_var_lib_t:dir list_dir_perms;
kernel_read_kernel_sysctls(clamscan_t)
@ -222,6 +224,9 @@ files_read_etc_files(clamscan_t)
files_read_etc_runtime_files(clamscan_t)
files_search_var_lib(clamscan_t)
init_read_utmp(clamscan_t)
init_dontaudit_write_utmp(clamscan_t)
libs_use_ld_so(clamscan_t)
libs_use_shared_libs(clamscan_t)

5
policy/modules/services/hal.fc
View File

@ -2,6 +2,8 @@
/etc/hal/device\.d/printer_remove\.hal -- gen_context(system_u:object_r:hald_exec_t,s0)
/etc/hal/capability\.d/printer_update\.hal -- gen_context(system_u:object_r:hald_exec_t,s0)
/usr/bin/hal-setup-keymap -- gen_context(system_u:object_r:hald_keymap_exec_t,s0)
/usr/libexec/hal-acl-tool -- gen_context(system_u:object_r:hald_acl_exec_t,s0)
/usr/libexec/hal-hotplug-map -- gen_context(system_u:object_r:hald_exec_t,s0)
/usr/libexec/hal-system-sonypic -- gen_context(system_u:object_r:hald_sonypic_exec_t,s0)
@ -13,4 +15,7 @@
/var/lib/hal(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0)
/var/log/pm-suspend.log gen_context(system_u:object_r:hald_log_t,s0)
/var/run/haldaemon.pid -- gen_context(system_u:object_r:hald_var_run_t,s0)
/var/run/vbestate -- gen_context(system_u:object_r:hald_var_run_t,s0)

94
policy/modules/services/hal.if
View File

@ -18,6 +18,42 @@ interface(`hal_domtrans',`
domtrans_pattern($1,hald_exec_t,hald_t)
')
########################################
## <summary>
## Allow ptrace of hal domain
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`hal_ptrace',`
gen_require(`
type hald_t;
')
allow $1 hald_t:process ptrace;
')
########################################
## <summary>
## Allow domain to use file descriptors from hal.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`hal_use_fds',`
gen_require(`
type hald_t;
')
allow $1 hald_t:fd use;
')
########################################
## <summary>
## Do not audit attempts to use file descriptors from hal.
@ -36,6 +72,25 @@ interface(`hal_dontaudit_use_fds',`
dontaudit $1 hald_t:fd use;
')
########################################
## <summary>
## Allow attempts to read and write to
## hald unnamed pipes.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`hal_rw_pipes',`
gen_require(`
type hald_t;
')
allow $1 hald_t:fifo_file rw_fifo_file_perms;
')
########################################
## <summary>
## Do not audit attempts to read and write to
@ -133,6 +188,45 @@ interface(`hal_dbus_chat',`
allow hald_t $1:dbus send_msg;
')
########################################
## <summary>
## Allow attempts to write the hal
## log files.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit
## </summary>
## </param>
#
interface(`hal_write_log',`
gen_require(`
type hald_log_t;
')
logging_search_logs($1)
allow $1 hald_log_t:file write_file_perms;
')
########################################
## <summary>
## Do not audit attempts to write the hal
## log files.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit
## </summary>
## </param>
#
interface(`hal_dontaudit_write_log',`
gen_require(`
type hald_log_t;
')
dontaudit $1 hald_log_t:file { append write };
')
########################################
## <summary>
## Read hald tmp files.

37
policy/modules/services/hal.te
View File

@ -1,5 +1,5 @@
policy_module(hal,1.7.0)
policy_module(hal,1.7.1)
########################################
#
@ -19,6 +19,12 @@ role system_r types hald_acl_t;
type hald_cache_t;
files_pid_file(hald_cache_t)
type hald_keymap_t;
type hald_keymap_exec_t;
domain_type(hald_keymap_t)
domain_entry_file(hald_keymap_t,hald_keymap_exec_t)
role system_r types hald_keymap_t;
type hald_log_t;
files_type(hald_log_t)
@ -81,6 +87,7 @@ files_pid_filetrans(hald_t,hald_var_run_t,file)
kernel_read_system_state(hald_t)
kernel_read_network_state(hald_t)
kernel_read_software_raid_state(hald_t)
kernel_rw_kernel_sysctl(hald_t)
kernel_read_fs_sysctls(hald_t)
kernel_rw_irq_sysctls(hald_t)
@ -131,6 +138,7 @@ files_read_usr_files(hald_t)
files_create_boot_flag(hald_t)
files_getattr_all_dirs(hald_t)
files_read_kernel_img(hald_t)
files_rw_lock_dirs(hald_t)
fs_getattr_all_fs(hald_t)
fs_search_all(hald_t)
@ -180,6 +188,7 @@ modutils_domtrans_insmod(hald_t)
seutil_read_config(hald_t)
seutil_read_default_contexts(hald_t)
seutil_read_file_contexts(hald_t)
sysnet_read_config(hald_t)
@ -192,6 +201,7 @@ ifdef(`targeted_policy',`
')
optional_policy(`
alsa_domtrans(hald_t)
alsa_read_rw_config(hald_t)
')
@ -301,7 +311,10 @@ files_search_var_lib(hald_acl_t)
corecmd_exec_bin(hald_acl_t)
dev_getattr_all_chr_files(hald_acl_t)
dev_getattr_generic_usb_dev(hald_acl_t)
dev_getattr_video_dev(hald_acl_t)
dev_setattr_video_dev(hald_acl_t)
dev_getattr_sound_dev(hald_acl_t)
dev_setattr_sound_dev(hald_acl_t)
dev_setattr_generic_usb_dev(hald_acl_t)
dev_setattr_usbfs_files(hald_acl_t)
@ -378,3 +391,25 @@ ifdef(`targeted_policy',`
term_dontaudit_use_console(hald_sonypic_t)
term_dontaudit_use_generic_ptys(hald_sonypic_t)
')
########################################
#
# Hal keymap local policy
#
domtrans_pattern(hald_t, hald_keymap_exec_t, hald_keymap_t)
allow hald_t hald_keymap_t:process signal;
allow hald_keymap_t hald_t:unix_stream_socket connectto;
manage_dirs_pattern(hald_keymap_t,hald_var_lib_t,hald_var_lib_t)
manage_files_pattern(hald_keymap_t,hald_var_lib_t,hald_var_lib_t)
files_search_var_lib(hald_keymap_t)
dev_rw_input_dev(hald_keymap_t)
files_read_usr_files(hald_keymap_t)
libs_use_ld_so(hald_keymap_t)
libs_use_shared_libs(hald_keymap_t)
miscfiles_read_localization(hald_keymap_t)

5
policy/support/file_patterns.spt
View File

@ -36,6 +36,11 @@ define(`del_entry_dirs_pattern',`
allow $1 $3:dir del_entry_dir_perms;
')
define(`rw_dirs_pattern',`
allow $1 $2:dir search_dir_perms;
allow $1 $3:dir { add_entry_dir_perms del_entry_dir_perms };
')
define(`create_dirs_pattern',`
allow $1 $2:dir add_entry_dir_perms;
allow $1 $3:dir create_dir_perms;