rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

hddtemp fixes.

Browse Source 
Clean up network control section.
Implement hddtemp_etc_t for /etc/sysconfig/hddtemp. The advantages are:
- hddtemp_t no longer needs access to read all generic etc_t files.
- allows us to implement a meaningful hddtemp_admin()

Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
This commit is contained in:
Dominick Grift 2010-06-23 12:00:27 +02:00 committed by Chris PeBenito
parent 0cec649be7
commit a00fc1c317
3 changed files with 63 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
policy/modules/services/hddtemp.fc
View File

@ -1,3 +1,5 @@
/etc/rc\.d/init\.d/hddtemp -- gen_context(system_u:object_r:hddtemp_initrc_exec_t,s0)
/usr/sbin/hddtemp -- gen_context(system_u:object_r:hddtemp_exec_t,s0)
/etc/sysconfig/hddtemp -- gen_context(system_u:object_r:hddtemp_etc_t,s0)
/usr/sbin/hddtemp -- gen_context(system_u:object_r:hddtemp_exec_t,s0)

50
policy/modules/services/hddtemp.if
View File

@ -1,12 +1,13 @@
## <summary>hddtemp hard disk temperature tool running as a daemon</summary>
## <summary>hddtemp hard disk temperature tool running as a daemon.</summary>
#######################################
## <summary>
## Execute hddtemp in the hddtemp domain.
## Execute a domain transition to run
## hddtemp.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## Domain allowed to transition.
## </summary>
## </param>
#
@ -15,13 +16,13 @@ interface(`hddtemp_domtrans',`
type hddtemp_t, hddtemp_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, hddtemp_exec_t, hddtemp_t)
corecmd_search_bin($1)
')
######################################
## <summary>
## Execute hddtemp
## Execute hddtemp.
## </summary>
## <param name="domain">
## <summary>
@ -35,4 +36,43 @@ interface(`hddtemp_exec',`
')
can_exec($1, hddtemp_exec_t)
corecmd_search_bin($1)
')
########################################
## <summary>
## All of the rules required to
## administrate an hddtemp environment.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`hddtemp_admin',`
gen_require(`
type hddtemp_t, hddtemp_etc_t, hddtemp_initrc_exec_t;
')
allow $1 hddtemp_t:process { ptrace signal_perms };
ps_process_pattern($1, hddtemp_t)
init_labeled_script_domtrans($1, hddtemp_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 hddtemp_initrc_exec_t system_r;
allow $2 system_r;
admin_pattern($1, hddtemp_etc_t)
files_search_etc($1)
allow $1 hddtemp_t:dir list_dir_perms;
read_lnk_files_pattern($1, hddtemp_t, hddtemp_t)
kernel_search_proc($1)
')

18
policy/modules/services/hddtemp.te
View File

@ -12,6 +12,9 @@ init_daemon_domain(hddtemp_t, hddtemp_exec_t)
type hddtemp_initrc_exec_t;
init_script_file(hddtemp_initrc_exec_t)
type hddtemp_etc_t;
files_config_file(hddtemp_etc_t)
########################################
#
# hddtemp local policy
@ -23,10 +26,19 @@ allow hddtemp_t self:netlink_route_socket r_netlink_socket_perms;
allow hddtemp_t self:tcp_socket create_stream_socket_perms;
allow hddtemp_t self:udp_socket create_socket_perms;
corenet_tcp_bind_all_nodes(hddtemp_t)
corenet_tcp_bind_hddtemp_port(hddtemp_t)
allow hddtemp_t hddtemp_etc_t:file read_file_perms;
# read hddtemp db file
corenet_all_recvfrom_unlabeled(hddtemp_t)
corenet_all_recvfrom_netlabel(hddtemp_t)
corenet_tcp_sendrecv_generic_if(hddtemp_t)
corenet_tcp_sendrecv_generic_node(hddtemp_t)
corenet_tcp_bind_generic_node(hddtemp_t)
corenet_tcp_sendrecv_all_ports(hddtemp_t)
corenet_tcp_bind_hddtemp_port(hddtemp_t)
corenet_sendrecv_hddtemp_server_packets(hddtemp_t)
corenet_tcp_sendrecv_hddtemp_port(hddtemp_t)
files_search_etc(hddtemp_t)
files_read_usr_files(hddtemp_t)
storage_raw_read_fixed_disk(hddtemp_t)