add slrnpull

refpolicy/Changelog

@@ -8,6 +8,7 @@
 	fetchmail
 	openct
 	readahead
+	slrnpull
 	smartmon
 	sysstat
 	vbetool (Dan Walsh)

refpolicy/policy/modules/admin/logrotate.te

@@ -1,5 +1,5 @@
 
-policy_module(logrotate,1.1.0)
+policy_module(logrotate,1.1.1)
 
 ########################################
 #
@@ -180,6 +180,10 @@ optional_policy(`nscd',`
 	nscd_use_socket(logrotate_t)
 ')
 
+optional_policy(`slrnpull',`
+	slrnpull_manage_spool(logrotate_t)
+')
+
 optional_policy(`squid',`
 	# cjp: why?
 	squid_domtrans(logrotate_t)

refpolicy/policy/modules/services/slrnpull.fc

@@ -0,0 +1,10 @@
+#
+# /usr
+#
+
+/usr/bin/slrnpull	--	gen_context(system_u:object_r:slrnpull_exec_t,s0)
+
+#
+# /var
+#
+/var/spool/slrnpull(/.*)?	gen_context(system_u:object_r:slrnpull_spool_t,s0)

refpolicy/policy/modules/services/slrnpull.if

@@ -0,0 +1,38 @@
+## <summary>Service for downloading news feeds the slrn newsreader.</summary>
+
+########################################
+## <summary>
+##	Allow the domain to search slrnpull spools.
+## </summary>
+## <param name="pty_type">
+##	domain allowed access
+## </param>
+#
+interface(`slrnpull_search_spool',`
+	gen_require(`
+		type slrnpull_spool_t;
+	')
+
+	files_search_spool($1)
+	allow $1 slrnpull_spool_t:dir search_dir_perms;
+')
+
+########################################
+## <summary>
+##	Allow the domain to create, read,
+##	write, and delete slrnpull spools.
+## </summary>
+## <param name="pty_type">
+##	domain allowed access
+## </param>
+#
+interface(`slrnpull_manage_spool',`
+	gen_require(`
+		type slrnpull_spool_t;
+	')
+
+	files_search_spool($1)
+	allow $1 slrnpull_spool_t:dir create_dir_perms;
+	allow $1 slrnpull_spool_t:file create_file_perms;
+	allow $1 slrnpull_spool_t:lnk_file create_lnk_perms;
+')

refpolicy/policy/modules/services/slrnpull.te

@@ -0,0 +1,87 @@
+
+policy_module(slrnpull,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type slrnpull_t;
+type slrnpull_exec_t;
+init_daemon_domain(slrnpull_t,slrnpull_exec_t)
+
+type slrnpull_var_run_t;
+files_pid_file(slrnpull_var_run_t)
+
+type slrnpull_spool_t;
+files_type(slrnpull_spool_t)
+
+type slrnpull_log_t;
+logging_log_file(slrnpull_log_t)
+
+########################################
+#
+# Local policy
+#
+
+dontaudit slrnpull_t self:capability sys_tty_config;
+allow slrnpull_t self:process signal_perms;
+
+allow slrnpull_t slrnpull_log_t:file create_file_perms;
+logging_create_log(slrnpull_t,slrnpull_log_t)
+
+allow slrnpull_t slrnpull_spool_t:dir rw_dir_perms;
+allow slrnpull_t slrnpull_spool_t:dir create_dir_perms;
+allow slrnpull_t slrnpull_spool_t:file create_file_perms;
+allow slrnpull_t slrnpull_spool_t:lnk_file create_lnk_perms;
+files_search_spool(slrnpull_t)
+
+allow slrnpull_t slrnpull_var_run_t:file create_file_perms;
+allow slrnpull_t slrnpull_var_run_t:dir rw_dir_perms;
+files_create_pid(slrnpull_t,slrnpull_var_run_t)
+
+kernel_list_proc(slrnpull_t)
+kernel_read_kernel_sysctl(slrnpull_t)
+kernel_read_proc_symlinks(slrnpull_t)
+
+dev_read_sysfs(slrnpull_t)
+
+domain_use_wide_inherit_fd(slrnpull_t)
+
+files_read_etc_files(slrnpull_t)
+
+fs_getattr_all_fs(slrnpull_t)
+fs_search_auto_mountpoints(slrnpull_t)
+
+term_dontaudit_use_console(slrnpull_t)
+
+init_use_fd(slrnpull_t)
+init_use_script_pty(slrnpull_t)
+
+libs_use_ld_so(slrnpull_t)
+libs_use_shared_libs(slrnpull_t)
+
+logging_send_syslog_msg(slrnpull_t)
+
+miscfiles_read_localization(slrnpull_t)
+
+userdom_dontaudit_use_unpriv_user_fd(slrnpull_t)
+userdom_dontaudit_search_sysadm_home_dir(slrnpull_t)
+
+ifdef(`targeted_policy',`
+	files_dontaudit_read_root_file(slrnpull_t)
+	term_dontaudit_use_unallocated_tty(slrnpull_t)
+	term_dontaudit_use_generic_pty(slrnpull_t)
+')
+
+optional_policy(`cron',`
+	cron_system_entry(slrnpull_t,slrnpull_exec_t)
+')
+
+optional_policy(`selinuxutil',`
+	seutil_sigchld_newrole(slrnpull_t)
+')
+
+optional_policy(`udev',`
+	udev_read_db(slrnpull_t)
+')

refpolicy/policy/modules/system/userdomain.if

@@ -424,6 +424,10 @@ template(`base_user_template',`
 		samba_connect_winbind($1_t)
 	')
 
+	optional_policy(`slrnpull',`
+		slrnpull_search_spool($1_t)
+	')
+
 	optional_policy(`squid',`
 		squid_use($1_t)
 	')

refpolicy/policy/modules/system/userdomain.te

@@ -1,5 +1,5 @@
 
-policy_module(userdomain,1.1.0)
+policy_module(userdomain,1.1.1)
 
 gen_require(`
 	role sysadm_r, staff_r, user_r;