change dmesg and loadkeys behavior to aliasing, and enable modules

refpolicy/policy/modules.conf

@@ -175,7 +175,7 @@ quota = off
 #
 # Policy for dmesg.
 # 
-dmesg = off
+dmesg = base
 
 # Layer: admin
 # Module: logrotate
@@ -231,7 +231,7 @@ webalizer = base
 #
 # Load keyboard mappings.
 # 
-loadkeys = off
+loadkeys = base
 
 # Layer: apps
 # Module: gpg

refpolicy/policy/modules/admin/dmesg.if

@@ -9,11 +9,12 @@
 ## </param>
 #
 interface(`dmesg_domtrans',`
+	ifdef(`targeted_policy',`
+		# $0(): disabled in targeted policy as there
+		# is no dmesg domain.
+	',`
 		gen_require(`
 			type dmesg_t, dmesg_exec_t;
-		class process sigchld;
-		class fd use;
-		class fifo_file rw_file_perms;
 		')
 
 		corecmd_search_sbin($1)
@@ -24,6 +25,7 @@ interface(`dmesg_domtrans',`
 		allow dmesg_t $1:fifo_file rw_file_perms;
 		allow dmesg_t $1:process sigchld;
 	')
+')
 
 ########################################
 ## <summary>
@@ -34,6 +36,11 @@ interface(`dmesg_domtrans',`
 ## </param>
 #
 interface(`dmesg_exec',`
+	ifdef(`targeted_policy',`
+		# $0(): the dmesg program is an alias
+		# of generic bin programs.
+		corecmd_exec_bin($1)
+	',`
 		gen_require(`
 			type dmesg_exec_t;
 		')
@@ -41,4 +48,5 @@ interface(`dmesg_exec',`
 		corecmd_search_sbin($1)
 		can_exec($1,dmesg_exec_t)
 	')
+')
 

refpolicy/policy/modules/admin/dmesg.te

@@ -6,16 +6,24 @@ policy_module(dmesg, 1.0)
 # Declarations
 #
 
+ifdef(`targeted_policy',`
+	# for compatibility with strict:
+	corecmd_bin_alias(dmesg_exec_t)
+',`
 	type dmesg_t;
 	type dmesg_exec_t;
 	init_system_domain(dmesg_t,dmesg_exec_t)
 	role system_r types dmesg_t;
+')
 
 ########################################
 #
 # Local policy
 #
 
+ifdef(`targeted_policy',`
+	# dmesg domain disabled in targeted policy
+',`
 	allow dmesg_t self:capability sys_admin;
 	dontaudit dmesg_t self:capability sys_tty_config;
 
@@ -54,12 +62,6 @@ miscfiles_read_localization(dmesg_t)
 	userdom_use_sysadm_terms(dmesg_t)
 	userdom_dontaudit_use_unpriv_user_fd(dmesg_t)
 
-ifdef(`targeted_policy', `
-	term_dontaudit_use_unallocated_tty(dmesg_t)
-	term_dontaudit_use_generic_pty(dmesg_t)
-	files_dontaudit_read_root_file(dmesg_t)
-')
-
 	optional_policy(`selinuxutil.te',`
 		seutil_sigchld_newrole(dmesg_t)
 	')
@@ -73,3 +75,4 @@ optional_policy(`rhgb.te',`
 	rhgb_domain(dmesg_t)
 	')
 	') dnl endif TODO
+')

refpolicy/policy/modules/apps/loadkeys.if

@@ -9,11 +9,12 @@
 ## </param>
 #
 interface(`loadkeys_domtrans',`
+	ifdef(`targeted_policy',`
+		# $0(): disabled in targeted policy as there
+		# is no loadkeys domain.
+	',`
 		gen_require(`
 			type loadkeys_t, loadkeys_exec_t;
-		class process sigchld;
-		class fd use;
-		class fifo_file rw_file_perms;
 		')
 
 		corecmd_search_bin($1)
@@ -24,6 +25,7 @@ interface(`loadkeys_domtrans',`
 		allow loadkeys_t $1:fifo_file rw_file_perms;
 		allow loadkeys_t $1:process sigchld;
 	')
+')
 
 ########################################
 ## <summary>
@@ -40,15 +42,19 @@ interface(`loadkeys_domtrans',`
 ## </param>
 #
 interface(`loadkeys_run',`
+	ifdef(`targeted_policy',`
+		# $0(): disabled in targeted policy as there
+		# is no loadkeys domain.
+	',`
 		gen_require(`
 			type loadkeys_t;
-		class chr_file rw_term_perms;
 		')
 
 		loadkeys_domtrans($1)
 		role $2 types loadkeys_t;
 		allow loadkeys_t $3:chr_file rw_term_perms;
 	')
+')
 
 ########################################
 ## <summary>
@@ -59,9 +65,15 @@ interface(`loadkeys_run',`
 ## </param>
 #
 interface(`loadkeys_exec',`
+	ifdef(`targeted_policy',`
+		# $0(): the loadkeys program is an alias
+		# of generic bin programs.
+		corecmd_exec_bin($1)
+	',`
 		gen_require(`
 			type loadkeys_exec_t;
 		')
 
 		can_exec($1,loadkeys_exec_t)
 	')
+')

refpolicy/policy/modules/apps/loadkeys.te

@@ -6,6 +6,10 @@ policy_module(loadkeys,1.0)
 # Declarations
 #
 
+ifdef(`targeted_policy',`
+	# for compatibility with strict:
+	corecmd_bin_alias(loadkeys_exec_t)
+',`
 	# cjp: this should probably be rewritten
 	# per user domain, since it can rw
 	# all user domain ttys
@@ -15,12 +19,16 @@ domain_type(loadkeys_t)
 
 	type loadkeys_exec_t;
 	domain_entry_file(loadkeys_t,loadkeys_exec_t)
+')
 
 ########################################
 #
 # Local policy
 #
 
+ifdef(`targeted_policy',`
+	# loadkeys domain disabled in targeted policy
+',`
 	allow loadkeys_t self:capability { setuid sys_tty_config };
 	allow loadkeys_t self:fifo_file rw_file_perms;
 
@@ -37,3 +45,4 @@ libs_use_shared_libs(loadkeys_t)
 	locallogin_use_fd(loadkeys_t)
 
 	miscfiles_read_localization(loadkeys_t)
+')

refpolicy/policy/modules/system/corecommands.if

@@ -8,6 +8,21 @@
 ##	run init.
 ## </required>
 
+########################################
+## <summary>
+##	Create a aliased type to bin_t.
+## </summary>
+## <param name="domain">
+##	Alias type for bin_t.
+## </param>
+interface(`corecmd_bin_alias',`
+	gen_require(`
+		type bin_t;
+	')
+
+	typealias bin_t alias $1;
+')
+
 ########################################
 ## <summary>
 ##	Make the shell an entrypoint for the specified domain.

refpolicy/policy/modules/system/corecommands.te

@@ -13,7 +13,8 @@ type bin_t;
 files_type(bin_t)
 
 ifdef(`targeted_policy',`
-	typealias bin_t alias { procmail_exec_t dmesg_exec_t loadkeys_exec_t };
+	# cjp: temporary until procmail is added
+	typealias bin_t alias procmail_exec_t;
 ')
 
 #