add comsat. clean up kerberos and nscd interfaces

refpolicy/Changelog

@@ -1,5 +1,7 @@
 - Doc tool will explicitly say a module does not have interfaces
   or templates on the module page.
+- Added policies:
+	comsat
 
 * Fri Aug 26 2005 Chris PeBenito <selinux@tresys.com> - 20050826
 - Add Makefile support for building loadable modules.

refpolicy/policy/modules/kernel/kernel.if

@@ -415,7 +415,7 @@ interface(`kernel_dontaudit_read_system_state',`
 		class file read;
 	')
 
-	allow $1 proc_t:file read;
+	dontaudit $1 proc_t:file read;
 ')
 
 #######################################

refpolicy/policy/modules/services/comsat.fc

@@ -0,0 +1,2 @@
+
+/usr/sbin/in\.comsat	--	context_template(system_u:object_r:comsat_exec_t,s0)

refpolicy/policy/modules/services/comsat.if

@@ -0,0 +1 @@
+## <summary>Comsat, a biff server.</summary>

refpolicy/policy/modules/services/comsat.te

@@ -0,0 +1,86 @@
+
+policy_module(comsat,1.0)
+
+########################################
+#
+# Declarations
+#
+type comsat_t;
+type comsat_exec_t;
+inetd_udp_service_domain(comsat_t,comsat_exec_t)
+role system_r types comsat_t;
+
+type comsat_tmp_t;
+files_tmp_file(comsat_tmp_t)
+
+type comsat_var_run_t;
+files_pid_file(comsat_var_run_t)
+
+########################################
+#
+# Local policy
+#
+
+allow comsat_t self:capability { setuid setgid };
+allow comsat_t self:process signal_perms;
+allow comsat_t self:dir search;
+allow comsat_t self:fifo_file rw_file_perms;
+allow comsat_t self:{ lnk_file file } { getattr read };
+allow comsat_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
+allow comsat_t self:tcp_socket { listen accept connected_socket_perms };
+
+allow comsat_t comsat_tmp_t:dir create_dir_perms;
+allow comsat_t comsat_tmp_t:file create_file_perms;
+files_create_tmp_files(comsat_t, comsat_tmp_t, { file dir })
+
+allow comsat_t comsat_var_run_t:file create_file_perms;
+files_create_pid(comsat_t,comsat_var_run_t)
+
+kernel_read_kernel_sysctl(comsat_t)
+kernel_read_network_state(comsat_t)
+kernel_read_system_state(comsat_t)
+
+corenet_raw_sendrecv_all_if(comsat_t)
+corenet_tcp_sendrecv_all_if(comsat_t)
+corenet_raw_sendrecv_all_nodes(comsat_t)
+corenet_tcp_sendrecv_all_nodes(comsat_t)
+corenet_tcp_sendrecv_all_ports(comsat_t)
+corenet_tcp_bind_all_nodes(comsat_t)
+
+dev_read_urand(comsat_t)
+
+fs_getattr_xattr_fs(comsat_t)
+
+files_read_etc_files(comsat_t)
+files_search_spool(comsat_t)
+files_search_home(comsat_t)
+
+init_read_script_pid(comsat_t)
+init_dontaudit_write_script_pid(comsat_t)
+
+libs_use_ld_so(comsat_t)
+libs_use_shared_libs(comsat_t)
+
+logging_send_syslog_msg(comsat_t)
+
+miscfiles_read_localization(comsat_t)
+
+sysnet_read_config(comsat_t)
+
+mta_getattr_spool(comsat_t)
+
+optional_policy(`kerberos.te',`
+	kerberos_use(comsat_t)
+')
+
+optional_policy(`nis.te',`
+	nis_use_ypbind(comsat_t)
+')
+
+optional_policy(`nscd.te',`
+	nscd_use_socket(comsat_t)
+')
+
+ifdef(`TODO',`
+dontaudit comsat_t sysadm_tty_device_t:chr_file getattr;
+')

refpolicy/policy/modules/services/kerberos.if

@@ -32,12 +32,18 @@
 interface(`kerberos_use',`
 	gen_require(`
 		type krb5_conf_t;
-		class files r_file_perms;
+		class file r_file_perms;
+		class tcp_socket create_socket_perms;
+		class udp_socket create_socket_perms;
 	')
 
+	files_search_etc($1)
+	allow $1 krb5_conf_t:file { getattr read };
+	dontaudit $1 krb5_conf_t:file write;
+
 	tunable_policy(`allow_kerberos',`
-		allow $1 self:tcp_socket { create connect ioctl read getattr write setattr append bind getopt setopt shutdown };
-		allow $1 self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown connect };
+		allow $1 self:tcp_socket create_socket_perms;
+		allow $1 self:udp_socket create_socket_perms;
 		corenet_tcp_sendrecv_all_if($1)
 		corenet_udp_sendrecv_all_if($1)
 		corenet_raw_sendrecv_all_if($1)
@@ -54,10 +60,6 @@ interface(`kerberos_use',`
 	tunable_policy(`allow_kerberos && use_dns',`
 		corenet_udp_sendrecv_dns_port($1)
 	')
-
-	files_search_etc($1)
-	allow $1 krb5_conf_t:file { getattr read };
-	dontaudit $1 krb5_conf_t:file write;
 ')
 
 ########################################

refpolicy/policy/modules/services/nis.if

@@ -22,9 +22,8 @@ interface(`nis_use_ypbind',`
 	tunable_policy(`allow_ypbind',`
 		dontaudit $1 self:capability net_bind_service;
 
-		allow $1 self:tcp_socket { listen accept };
-		allow $1 self:tcp_socket { create connect ioctl read getattr write setattr append bind getopt setopt shutdown };
-		allow $1 self:udp_socket { create ioctl read getattr write setattr append bind getopt setopt shutdown };
+		allow $1 self:tcp_socket create_stream_socket_perms;
+		allow $1 self:udp_socket create_socket_perms;
 
 		allow $1 var_yp_t:dir r_dir_perms;
 		allow $1 var_yp_t:lnk_file r_file_perms;

refpolicy/policy/modules/services/nscd.if

@@ -39,13 +39,13 @@ interface(`nscd_use_socket',`
 		type nscd_t, nscd_var_run_t;
 		class fd use;
 		class nscd { getpwd getgrp gethost shmempwd shmemgrp shmemhost };
-		class unix_stream_socket { create_stream_socket_perms connectto };
+		class unix_stream_socket { create_socket_perms connectto };
 		class dir { search getattr };
 		class sock_file rw_file_perms;
 		class file { getattr read };
 	')
 
-	allow $1 self:unix_stream_socket create_stream_socket_perms;
+	allow $1 self:unix_stream_socket create_socket_perms;
 
 	allow $1 nscd_t:unix_stream_socket connectto;
 	allow $1 nscd_t:nscd { getpwd getgrp gethost };

refpolicy/policy/modules/system/domain.if

@@ -52,8 +52,9 @@ interface(`domain_type',`
 	# read the root directory
 	files_list_root($1)
 
-	# send init a sigchld
+	# send init a sigchld and signull
 	init_sigchld($1)
+	init_signull($1)
 
 	ifdef(`targeted_policy',`
 		unconfined_use_fd($1)

refpolicy/policy/modules/system/init.if

@@ -238,8 +238,29 @@ interface(`init_dontaudit_use_initctl',`
 ')
 
 ########################################
+## <summary>
+##	Send init a null signal.
+## </summary>
+## <param name="domain">
+##	Domain allowed access.
+## </param>
 #
-# init_sigchld(domain)
+interface(`init_signull',`
+	gen_require(`
+		type init_t;
+		class process signull;
+	')
+
+	allow $1 init_t:process signull;
+')
+
+########################################
+## <summary>
+##	Send init a SIGCHLD signal.
+## </summary>
+## <param name="domain">
+##	Domain allowed access.
+## </param>
 #
 interface(`init_sigchld',`
 	gen_require(`