review of admin interfaces

refpolicy/policy/modules/admin/consoletype.if

@@ -4,8 +4,14 @@
 # consoletype_domtrans(domain)
 #
 define(`consoletype_domtrans',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type consoletype_t, consoletype_exec_t;
+		class process sigchld;
+		class fd use;
+		class fifo_file rw_file_perms;
+	')
 
+	corecmd_search_sbin($1)
 	domain_auto_trans($1,consoletype_exec_t,consoletype_t)
 
 	allow $1 consoletype_t:fd use;
@@ -14,28 +20,15 @@ define(`consoletype_domtrans',`
 	allow consoletype_t $1:process sigchld;
 ')
 
-define(`consoletype_domtrans_depend',`
-	type consoletype_t, consoletype_exec_t;
-
-	class file rx_file_perms;
-	class process { transition noatsecure siginh rlimitinh sigchld };
-	class fd use;
-	class fifo_file rw_file_perms;
-')
-
 #######################################
 #
 # consoletype_exec(domain)
 #
 define(`consoletype_exec',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type consoletype_exec_t;
+	')
 
+	corecmd_search_sbin($1)
 	can_exec($1,consoletype_exec_t)
-
-')
-
-define(`consoletype_exec_depend',`
-	type consoletype_exec_t;
-
-	class file { getattr read execute execute_no_trans };
 ')

refpolicy/policy/modules/admin/dmesg.if

@@ -12,12 +12,15 @@
 ## </interface>
 #
 define(`dmesg_domtrans',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type dmesg_t, dmesg_exec_t;
+		class process sigchld;
+		class fd use;
+		class fifo_file rw_file_perms;
+	')
 
-	allow $1 dmesg_exec_t:file rx_file_perms;
+	corecmd_search_sbin($1)
-	allow $1 dmesg_t:process transition;
+	domain_auto_trans($1,dmesg_exec_t,dmesg_t)
-	type_transition $1 dmesg_exec_t:process dmesg_t;
-	dontaudit $1 dmesg_t:process { noatsecure siginh rlimitinh };
 
 	allow $1 dmesg_t:fd use;
 	allow dmesg_t $1:fd use;
@@ -25,15 +28,6 @@ define(`dmesg_domtrans',`
 	allow dmesg_t $1:process sigchld;
 ')
 
-define(`dmesg_domtrans_depend',`
-	type dmesg_t, dmesg_exec_t;
-
-	class file rx_file_perms;
-	class process { transition noatsecure siginh rlimitinh sigchld };
-	class fd use;
-	class fifo_file rw_file_perms;
-')
-
 ########################################
 ## <interface name="dmesg_exec">
 ##	<description>
@@ -45,16 +39,12 @@ define(`dmesg_domtrans_depend',`
 ## </interface>
 #
 define(`dmesg_exec',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type dmesg_exec_t;
+	')
 
+	corecmd_search_sbin($1)
 	can_exec($1,dmesg_exec_t)
-
-')
-
-define(`dmesg_exec_depend',`
-	type dmesg_exec_t;
-
-	class file { getattr read execute execute_no_trans };
 ')
 
 ## </module>

refpolicy/policy/modules/admin/netutils.if

@@ -4,12 +4,14 @@
 # netutils_domtrans(domain)
 #
 define(`netutils_domtrans',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type netutils_t, netutils_exec_t;
+		class process sigchld;
+		class fd use;
+		class fifo_file rw_file_perms;
+	')
 
-	allow $1 netutils_exec_t:file rx_file_perms;
+	domain_auto_trans($1,netutils_exec_t,netutils_t)
-	allow $1 netutils_t:process transition;
-	type_transition $1 netutils_exec_t:process netutils_t;
-	dontaudit $1 netutils_t:process { noatsecure siginh rlimitinh };
 
 	allow $1 netutils_t:fd use;
 	allow netutils_t $1:fd use;
@@ -17,28 +19,14 @@ define(`netutils_domtrans',`
 	allow netutils_t $1:process sigchld;
 ')
 
-define(`netutils_domtrans_depend',`
-	type netutils_t, netutils_exec_t;
-
-	class file rx_file_perms;
-	class process { transition noatsecure siginh rlimitinh sigchld };
-	class fd use;
-	class fifo_file rw_file_perms;
-')
-
 #######################################
 #
 # netutils_exec(domain)
 #
 define(`netutils_exec',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type netutils_exec_t;
+	')
 
 	can_exec($1,netutils_exec_t)
-
-')
-
-define(`netutils_exec_depend',`
-	type netutils_exec_t;
-
-	class file { getattr read execute execute_no_trans };
 ')

refpolicy/policy/modules/admin/rpm.if

@@ -12,12 +12,16 @@
 ## </interface>
 #
 define(`rpm_domtrans',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type rpm_t, rpm_exec_t;
+		class process sigchld;
+		class fd use;
+		class fifo_file rw_file_perms;
+	')
 
-	allow $1 rpm_exec_t:file rx_file_perms;
+	files_search_usr($1)
-	allow $1 rpm_t:process transition;
+	corecmd_search_bin($1)
-	type_transition $1 rpm_exec_t:process rpm_t;
+	domain_auto_trans($1,rpm_exec_t,rpm_t)
-	dontaudit $1 rpm_t:process { noatsecure siginh rlimitinh };
 
 	allow $1 rpm_t:fd use;
 	allow rpm_t $1:fd use;
@@ -25,15 +29,6 @@ define(`rpm_domtrans',`
 	allow rpm_t $1:process sigchld;
 ')
 
-define(`rpm_domtrans_depend',`
-	type rpm_t, rpm_exec_t;
-
-	class file rx_file_perms;
-	class process { transition noatsecure siginh rlimitinh sigchld };
-	class fd use;
-	class fifo_file rw_file_perms;
-')
-
 ########################################
 ## <interface name="rpm_run">
 ##	<description>
@@ -51,18 +46,15 @@ define(`rpm_domtrans_depend',`
 ## </interface>
 #
 define(`rpm_run',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type rpm_t, rpm_script_t;
+		class chr_file rw_term_perms;
+	')
 
 	rpm_domtrans($1)
 	role $2 types rpm_t;
 	role $2 types rpm_script_t;
-	allow rpm_t $3:chr_file { getattr read write ioctl };
+	allow rpm_t $3:chr_file rw_term_perms;
-')
-
-define(`rpm_run_depend',`
-	type rpm_t, rpm_script_t;
-
-	class chr_file { getattr read write ioctl };
 ')
 
 ########################################
@@ -76,17 +68,14 @@ define(`rpm_run_depend',`
 ## </interface>
 #
 define(`rpm_use_fd',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type rpm_t;
+		class fd use;
+	')
 
 	allow $1 rpm_t:fd use;
 ')
 
-define(`rpm_use_fd_depend',`
-	type rpm_t;
-
-	class fd use;
-')
-
 ########################################
 ## <interface name="rpm_read_pipe">
 ##	<description>
@@ -98,17 +87,14 @@ define(`rpm_use_fd_depend',`
 ## </interface>
 #
 define(`rpm_read_pipe',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type rpm_t;
+		class fifo_file r_file_perms;
+	')
 
 	allow $1 rpm_t:fifo_file r_file_perms;
 ')
 
-define(`rpm_read_pipe_depend',`
-	type rpm_t;
-
-	class fifo_file r_file_perms;
-')
-
 ########################################
 ## <interface name="rpm_read_db">
 ##	<description>
@@ -120,39 +106,33 @@ define(`rpm_read_pipe_depend',`
 ## </interface>
 #
 define(`rpm_read_db',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type rpm_var_lib_t_t;
+		class dir r_dir_perms;
+		class lnk_file r_file_perms;
+		class file r_file_perms;
+	')
 
 	allow $1 rpm_var_lib_t:dir r_dir_perms;
 	allow $1 rpm_var_lib_t:file r_file_perms;
 	allow $1 rpm_var_lib_t:lnk_file r_file_perms;
 ')
 
-define(`rpm_read_db_depend',`
-	type rpm_var_lib_t_t;
-
-	class dir r_dir_perms;
-	class lnk_file r_file_perms;
-	class file r_file_perms;
-')
-
 ########################################
 #
 # rpm_manage_db(domain)
 #
 define(`rpm_manage_db',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type rpm_var_lib_t_t;
+		class dir rw_dir_perms;
+		class lnk_file { getattr read write unlink };
+		class file { getattr create read write append unlink };
+	')
 
 	allow $1 rpm_var_lib_t:dir rw_dir_perms;
 	allow $1 rpm_var_lib_t:file { getattr create read write append unlink };
 	allow $1 rpm_var_lib_t:lnk_file { getattr read write unlink };
 ')
 
-define(`rpm_manage_db_depend',`
-	type rpm_var_lib_t_t;
-
-	class dir rw_dir_perms;
-	class lnk_file { getattr read write unlink };
-	class file { getattr create read write append unlink };
-')
-
 ## </module>

refpolicy/policy/modules/admin/usermanage.if

@@ -12,12 +12,16 @@
 ## </interface>
 #
 define(`usermanage_domtrans_chfn',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type chfn_t, chfn_exec_t;
+		class process sigchld;
+		class fd use;
+		class fifo_file rw_file_perms;
+	')
 
-	allow $1 chfn_exec_t:file rx_file_perms;
+	files_search_usr($1)
-	allow $1 chfn_t:process transition;
+	corecmd_search_bin($1)
-	type_transition $1 chfn_exec_t:process chfn_t;
+	domain_auto_trans($1,chfn_exec_t,chfn_t)
-	dontaudit $1 chfn_t:process { noatsecure siginh rlimitinh };
 
 	allow $1 chfn_t:fd use;
 	allow chfn_t $1:fd use;
@@ -25,15 +29,6 @@ define(`usermanage_domtrans_chfn',`
 	allow chfn_t $1:process sigchld;
 ')
 
-define(`usermanage_domtrans_chfn_depend',`
-	type chfn_t, chfn_exec_t;
-
-	class file rx_file_perms;
-	class process { transition noatsecure siginh rlimitinh sigchld };
-	class fd use;
-	class fifo_file rw_file_perms;
-')
-
 ########################################
 ## <interface name="usermanage_run_chfn">
 ##	<description>
@@ -52,17 +47,14 @@ define(`usermanage_domtrans_chfn_depend',`
 ## </interface>
 #
 define(`usermanage_run_chfn',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type chfn_t;
+		class chr_file rw_term_perms;
+	')
 
 	usermanage_domtrans_chfn($1)
 	role $2 types chfn_t;
-	allow chfn_t $3:chr_file { getattr read write ioctl };
+	allow chfn_t $3:chr_file rw_term_perms;
-')
-
-define(`usermanage_run_chfn_depend',`
-	type chfn_t;
-
-	class chr_file { getattr read write ioctl };
 ')
 
 ########################################
@@ -76,8 +68,15 @@ define(`usermanage_run_chfn_depend',`
 ## </interface>
 #
 define(`usermanage_domtrans_groupadd',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type groupadd_t, groupadd_exec_t;
+		class process sigchld;
+		class fd use;
+		class fifo_file rw_file_perms;
+	')
 
+	files_search_usr($1)
+	corecmd_search_sbin($1)
 	domain_auto_trans($1,groupadd_exec_t,groupadd_t)
 
 	allow $1 groupadd_t:fd use;
@@ -86,15 +85,6 @@ define(`usermanage_domtrans_groupadd',`
 	allow groupadd_t $1:process sigchld;
 ')
 
-define(`usermanage_domtrans_groupadd_depend',`
-	type groupadd_t, groupadd_exec_t;
-
-	class file rx_file_perms;
-	class process { transition noatsecure siginh rlimitinh sigchld };
-	class fd use;
-	class fifo_file rw_file_perms;
-')
-
 ########################################
 ## <interface name="usermanage_run_groupadd">
 ##	<description>
@@ -113,17 +103,14 @@ define(`usermanage_domtrans_groupadd_depend',`
 ## </interface>
 #
 define(`usermanage_run_groupadd',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type groupadd_t;
+		class chr_file rw_term_perms;
+	')
 
 	usermanage_domtrans_groupadd($1)
 	role $2 types groupadd_t;
-	allow groupadd_t $3:chr_file { getattr read write ioctl };
+	allow groupadd_t $3:chr_file rw_term_perms;
-')
-
-define(`usermanage_run_groupadd_depend',`
-	type groupadd_t;
-
-	class chr_file { getattr read write ioctl };
 ')
 
 ########################################
@@ -137,12 +124,16 @@ define(`usermanage_run_groupadd_depend',`
 ## </interface>
 #
 define(`usermanage_domtrans_passwd',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type passwd_t, passwd_exec_t;
+		class process sigchld;
+		class fd use;
+		class fifo_file rw_file_perms;
+	')
 
-	allow $1 passwd_exec_t:file rx_file_perms;
+	files_search_usr($1)
-	allow $1 passwd_t:process transition;
+	corecmd_search_bin($1)
-	type_transition $1 passwd_exec_t:process passwd_t;
+	domain_auto_trans($1,passwd_exec_t,passwd_t)
-	dontaudit $1 passwd_t:process { noatsecure siginh rlimitinh };
 
 	allow $1 passwd_t:fd use;
 	allow passwd_t $1:fd use;
@@ -150,15 +141,6 @@ define(`usermanage_domtrans_passwd',`
 	allow passwd_t $1:process sigchld;
 ')
 
-define(`usermanage_domtrans_passwd_depend',`
-	type passwd_t, passwd_exec_t;
-
-	class file rx_file_perms;
-	class process { transition noatsecure siginh rlimitinh sigchld };
-	class fd use;
-	class fifo_file rw_file_perms;
-')
-
 ########################################
 ## <interface name="usermanage_run_passwd">
 ##	<description>
@@ -177,17 +159,14 @@ define(`usermanage_domtrans_passwd_depend',`
 ## </interface>
 #
 define(`usermanage_run_passwd',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type passwd_t;
+		class chr_file rw_term_perms;
+	')
 
 	usermanage_domtrans_passwd($1)
 	role $2 types passwd_t;
-	allow passwd_t $3:chr_file { getattr read write ioctl };
+	allow passwd_t $3:chr_file rw_term_perms;
-')
-
-define(`usermanage_run_passwd_depend',`
-	type passwd_t;
-
-	class chr_file { getattr read write ioctl };
 ')
 
 ########################################
@@ -201,12 +180,16 @@ define(`usermanage_run_passwd_depend',`
 ## </interface>
 #
 define(`usermanage_domtrans_useradd',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type useradd_t, useradd_exec_t;
+		class process sigchld;
+		class fd use;
+		class fifo_file rw_file_perms;
+	')
 
-	allow $1 useradd_exec_t:file rx_file_perms;
+	files_search_usr($1)
-	allow $1 useradd_t:process transition;
+	corecmd_search_sbin($1)
-	type_transition $1 useradd_exec_t:process useradd_t;
+	domain_auto_trans($1,useradd_exec_t,useradd_t)
-	dontaudit $1 useradd_t:process { noatsecure siginh rlimitinh };
 
 	allow $1 useradd_t:fd use;
 	allow useradd_t $1:fd use;
@@ -214,15 +197,6 @@ define(`usermanage_domtrans_useradd',`
 	allow useradd_t $1:process sigchld;
 ')
 
-define(`usermanage_domtrans_useradd_depend',`
-	type useradd_t, useradd_exec_t;
-
-	class file rx_file_perms;
-	class process { transition noatsecure siginh rlimitinh sigchld };
-	class fd use;
-	class fifo_file rw_file_perms;
-')
-
 ########################################
 ## <interface name="usermanage_run_useradd">
 ##	<description>
@@ -241,17 +215,14 @@ define(`usermanage_domtrans_useradd_depend',`
 ## </interface>
 #
 define(`usermanage_run_useradd',`
-	gen_require(`$0'_depend)
+	gen_require(`
+		type useradd_t;
+		class chr_file rw_term_perms;
+	')
 
 	usermanage_domtrans_useradd($1)
 	role $2 types useradd_t;
-	allow useradd_t $3:chr_file { getattr read write ioctl };
+	allow useradd_t $3:chr_file rw_term_perms;
-')
-
-define(`usermanage_run_useradd_depend',`
-	type useradd_t;
-
-	class chr_file { getattr read write ioctl };
 ')
 
 ## </module>