Merge branch 'master' of ssh://git.fedorahosted.org/git/selinux-policy

policy/modules/apps/passenger.fc

@@ -0,0 +1,6 @@
+
+/usr/lib(64)?/ruby/gems/.*/passenger-.*/ext/apache2/ApplicationPoolServerExecutable -- gen_context(system_u:object_r:passenger_exec_t,s0)
+
+/var/lib/passenger(/.*)?           gen_context(system_u:object_r:passenger_var_lib_t,s0)
+
+/var/run/passenger(/.*)?           gen_context(system_u:object_r:passenger_state_t,s0)

policy/modules/apps/passenger.if

@@ -0,0 +1,68 @@
+## <summary>Passenger policy</summary>
+
+######################################
+## <summary>
+##      Execute passenger in the passenger domain.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      The type of the process performing this action.
+##      </summary>
+## </param>
+#
+interface(`passenger_domtrans',`
+        gen_require(`
+                type passenger_t;
+        ')
+
+	allow $1 self:capability { fowner fsetid };
+
+	allow $1 passenger_t:process signal;
+
+	domtrans_pattern($1, passenger_exec_t, passenger_t)
+	allow $1 passenger_t:unix_stream_socket { read write shutdown };
+	allow passenger_t $1:unix_stream_socket { read write };
+')
+
+######################################
+## <summary>
+##      Manage passenger state content.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`passenger_manage_state_content',`
+        gen_require(`
+                type passenger_state_t;
+        ')
+
+        files_search_pids($1)
+	manage_dirs_pattern($1, passenger_state_t, passenger_state_t)
+        manage_files_pattern($1, passenger_state_t, passenger_state_t)
+	manage_fifo_files_pattern($1, passenger_state_t, passenger_state_t)
+	manage_sock_files_pattern($1, passenger_state_t, passenger_state_t)
+')
+
+########################################
+## <summary>
+##      Read passenger lib files
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain to not audit.
+##      </summary>
+## </param>
+#
+interface(`passenger_read_lib_files',`
+        gen_require(`
+                type passenger_var_lib_t;
+        ')
+
+	files_search_var_lib($1)
+        read_files_pattern($1, passenger_var_lib_t, passenger_var_lib_t)
+        read_lnk_files_pattern($1, passenger_var_lib_t, passenger_var_lib_t)
+')
+

policy/modules/apps/passenger.te

@@ -0,0 +1,67 @@
+
+policy_module(passanger,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type passenger_t;
+type passenger_exec_t;
+domain_type(passenger_t)
+domain_entry_file(passenger_t, passenger_exec_t)
+role system_r types passenger_t;
+
+type passenger_tmp_t;
+files_tmp_file(passenger_tmp_t)
+
+type passenger_var_lib_t;
+files_type(passenger_var_lib_t)
+
+type passenger_state_t;
+files_pid_file(passenger_state_t)
+
+permissive passenger_t;
+
+########################################
+#
+# passanger local policy
+#
+
+allow passenger_t self:capability { dac_override fsetid fowner chown setuid setgid };
+allow passenger_t self:process signal;
+
+allow passenger_t self:fifo_file rw_fifo_file_perms;
+allow passenger_t self:unix_stream_socket { create_stream_socket_perms connectto };
+
+manage_dirs_pattern(passenger_t, passenger_state_t, passenger_state_t)
+manage_files_pattern(passenger_t, passenger_state_t, passenger_state_t)
+manage_fifo_files_pattern(passenger_t, passenger_state_t, passenger_state_t)
+manage_sock_files_pattern(passenger_t, passenger_state_t, passenger_state_t)
+
+files_search_var_lib(passenger_t)
+manage_dirs_pattern(passenger_t, passenger_var_lib_t, passenger_var_lib_t)
+manage_files_pattern(passenger_t, passenger_var_lib_t, passenger_var_lib_t)
+
+kernel_read_system_state(passenger_t)
+kernel_read_kernel_sysctls(passenger_t)
+
+corenet_tcp_connect_http_port(passenger_t)
+
+corecmd_exec_bin(passenger_t)
+corecmd_exec_shell(passenger_t)
+
+dev_read_urand(passenger_t)
+
+files_read_etc_files(passenger_t)
+
+auth_use_nsswitch(passenger_t)
+
+miscfiles_read_localization(passenger_t)
+
+userdom_dontaudit_use_user_terminals(passenger_t)
+
+optional_policy(`
+	apache_append_log(passenger_t)
+	apache_read_sys_content(passenger_t)
+')

policy/modules/services/apache.te

@@ -722,6 +722,12 @@ optional_policy(`
 	openca_kill(httpd_t)
 ')
 
+optional_policy(`
+        passenger_domtrans(httpd_t)
+        passenger_manage_state_content(httpd_t)
+        passenger_read_lib_files(httpd_t)
+')
+
 optional_policy(`
 	rpc_search_nfs_state_data(httpd_t)
 ')

policy/modules/services/dovecot.te

@@ -26,6 +26,9 @@ domain_type(dovecot_deliver_t)
 domain_entry_file(dovecot_deliver_t, dovecot_deliver_exec_t)
 role system_r types dovecot_deliver_t;
 
+type dovecot_deliver_tmp_t;
+files_tmp_file(dovecot_deliver_tmp_t)
+
 type dovecot_etc_t;
 files_config_file(dovecot_etc_t)
 
@@ -268,6 +271,10 @@ allow dovecot_deliver_t dovecot_cert_t:dir search_dir_perms;
 
 append_files_pattern(dovecot_deliver_t, dovecot_var_log_t, dovecot_var_log_t)
 
+manage_dirs_pattern(dovecot_deliver_t, dovecot_deliver_tmp_t, dovecot_deliver_tmp_t)
+manage_files_pattern(dovecot_deliver_t, dovecot_deliver_tmp_t, dovecot_deliver_tmp_t)
+files_tmp_filetrans(dovecot_deliver_t, dovecot_deliver_tmp_t, { file dir })
+
 can_exec(dovecot_deliver_t, dovecot_deliver_exec_t)
 
 kernel_read_all_sysctls(dovecot_deliver_t)

policy/modules/services/tor.te

@@ -42,6 +42,8 @@ files_pid_file(tor_var_run_t)
 #
 
 allow tor_t self:capability { setgid setuid sys_tty_config };
+allow tor_t self:process signal;
+
 allow tor_t self:fifo_file rw_fifo_file_perms;
 allow tor_t self:unix_stream_socket create_stream_socket_perms;
 allow tor_t self:netlink_route_socket r_netlink_socket_perms;