Tweaks on pulseaudio 1868383, ksmtuned d279dd6, and smokeping f3c346c.

policy/modules/apps/pulseaudio.fc

@@ -1,9 +1,7 @@
 HOME_DIR/\.pulse-cookie		gen_context(system_u:object_r:pulseaudio_home_t,s0)
 HOME_DIR/\.pulse(/.*)?		gen_context(system_u:object_r:pulseaudio_home_t,s0)
 
-/var/lib/pulse(/.*)?		gen_context(system_u:object_r:pulseaudio_var_lib_t,s0)
-
-/var/run/pulse(/.*)?		gen_context(system_u:object_r:pulseaudio_var_run_t,s0)
-
 /usr/bin/pulseaudio	--	gen_context(system_u:object_r:pulseaudio_exec_t,s0)
 
+/var/lib/pulse(/.*)?		gen_context(system_u:object_r:pulseaudio_var_lib_t,s0)
+/var/run/pulse(/.*)?		gen_context(system_u:object_r:pulseaudio_var_run_t,s0)

policy/modules/apps/pulseaudio.if

@@ -58,7 +58,7 @@ interface(`pulseaudio_domtrans',`
 		type pulseaudio_t, pulseaudio_exec_t;
 	')
 
-	domtrans_pattern($1,pulseaudio_exec_t,pulseaudio_t)
+	domtrans_pattern($1, pulseaudio_exec_t, pulseaudio_t)
 ')
 
 ########################################
@@ -88,7 +88,7 @@ interface(`pulseaudio_run',`
 
 ########################################
 ## <summary>
-##	Execute a pulseaudio in the current domain
+##	Execute a pulseaudio in the current domain.
 ## </summary>
 ## <param name="domain">
 ## <summary>
@@ -101,7 +101,29 @@ interface(`pulseaudio_exec',`
 		type pulseaudio_exec_t;
 	')
 
-	can_exec($1,pulseaudio_exec_t)
+	can_exec($1, pulseaudio_exec_t)
+')
+
+#####################################
+## <summary>
+##	Connect to pulseaudio over a unix domain
+##	stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`pulseaudio_stream_connect',`
+	gen_require(`
+		type pulseaudio_t, pulseaudio_var_run_t;
+	')
+
+	files_search_pids($1)
+	allow $1 pulseaudio_t:process signull;
+	allow pulseaudio_t $1:process signull;
+	stream_connect_pattern($1, pulseaudio_var_run_t, pulseaudio_var_run_t, pulseaudio_t)
 ')
 
 ########################################
@@ -127,7 +149,25 @@ interface(`pulseaudio_dbus_chat',`
 
 ########################################
 ## <summary>
-##	Read pulseaudio homedir files 
+##	Set the attributes of the pulseaudio homedir.
+## </summary>
+## <param name="user_domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`pulseaudio_setattr_home_dir',`
+	gen_require(`
+		type pulseaudio_home_t;
+	')
+
+	allow $1 pulseaudio_home_t:dir setattr;
+')
+
+########################################
+## <summary>
+##	Read pulseaudio homedir files.
 ## </summary>
 ## <param name="user_domain">
 ##	<summary>
@@ -146,7 +186,8 @@ interface(`pulseaudio_read_home_files',`
 
 ########################################
 ## <summary>
-##	Manage pulseaudio homedir files
+##	Create, read, write, and delete pulseaudio
+##	home directory files.
 ## </summary>
 ## <param name="user_domain">
 ##	<summary>
@@ -162,43 +203,3 @@ interface(`pulseaudio_manage_home_files',`
 	userdom_search_user_home_dirs($1)
 	manage_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t)
 ')
-
-########################################
-## <summary>
-##	Allow domain to setattr on pulseaudio homedir
-## </summary>
-## <param name="user_domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`pulseaudio_setattr_home_dir',`
-	gen_require(`
-		type pulseaudio_home_t;
-	')
-
-	allow $1 pulseaudio_home_t:dir setattr;
-')
-
-#####################################
-## <summary>
-##	Connect to pulseaudio over a unix domain
-##	stream socket.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`pulseaudio_stream_connect',`
-	gen_require(`
-		type pulseaudio_t, pulseaudio_var_run_t;
-	')
-
-	files_search_pids($1)
-	allow $1 pulseaudio_t:process signull;
-	allow pulseaudio_t $1:process signull;
-	stream_connect_pattern($1, pulseaudio_var_run_t, pulseaudio_var_run_t, pulseaudio_t)
-')

policy/modules/apps/pulseaudio.te

@@ -28,6 +28,7 @@ files_pid_file(pulseaudio_var_run_t)
 #
 # pulseaudio local policy
 #
+
 allow pulseaudio_t self:capability { fowner fsetid chown setgid setuid sys_nice sys_resource sys_tty_config };
 allow pulseaudio_t self:process { getcap setcap setrlimit setsched getsched signal signull };
 allow pulseaudio_t self:fifo_file rw_file_perms;
@@ -37,9 +38,9 @@ allow pulseaudio_t self:tcp_socket create_stream_socket_perms;
 allow pulseaudio_t self:udp_socket create_socket_perms;
 allow pulseaudio_t self:netlink_kobject_uevent_socket create_socket_perms;
 
-userdom_search_user_home_dirs(pulseaudio_t)
 manage_dirs_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t)
 manage_files_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t)
+userdom_search_user_home_dirs(pulseaudio_t)
 
 manage_dirs_pattern(pulseaudio_t, pulseaudio_var_lib_t, pulseaudio_var_lib_t)
 manage_files_pattern(pulseaudio_t, pulseaudio_var_lib_t, pulseaudio_var_lib_t)

policy/modules/services/ksmtuned.if

@@ -1,5 +1,4 @@
-
+## <summary>Kernel Samepage Merging (KSM) Tuning Daemon</summary>
-## <summary>policy for Kernel Samepage Merging (KSM) Tuning Daemon</summary>
 
 ########################################
 ## <summary>
@@ -19,7 +18,6 @@ interface(`ksmtuned_domtrans',`
 	domtrans_pattern($1, ksmtuned_exec_t, ksmtuned_t)
 ')
 
-
 ########################################
 ## <summary>
 ##	Execute ksmtuned server in the ksmtuned domain.

policy/modules/services/ksmtuned.te

@@ -1,4 +1,5 @@
-policy_module(ksmtuned,1.0.0)
+
+policy_module(ksmtuned, 1.0.0)
 
 ########################################
 #
@@ -19,14 +20,9 @@ files_pid_file(ksmtuned_var_run_t)
 #
 # ksmtuned local policy
 #
+
 allow ksmtuned_t self:capability { sys_ptrace sys_tty_config };
-
-# Init script handling
-domain_use_interactive_fds(ksmtuned_t)
-
-# internal communication is often done using fifo and unix sockets.
 allow ksmtuned_t self:fifo_file rw_file_perms;
-allow ksmtuned_t self:unix_stream_socket create_stream_socket_perms;
 
 manage_files_pattern(ksmtuned_t, ksmtuned_var_run_t, ksmtuned_var_run_t)
 files_pid_filetrans(ksmtuned_t, ksmtuned_var_run_t, file)

policy/modules/services/smokeping.fc

@@ -7,5 +7,3 @@
 /var/lib/smokeping(/.*)?		gen_context(system_u:object_r:smokeping_var_lib_t,s0)
 
 /var/run/smokeping(/.*)?		gen_context(system_u:object_r:smokeping_var_run_t,s0)
-
-

policy/modules/services/smokeping.if

@@ -1,5 +1,4 @@
-
+## <summary>Smokeping network latency measurement.</summary>
-## <summary>policy for smokeping</summary>
 
 ########################################
 ## <summary>

policy/modules/services/smokeping.te

@@ -1,5 +1,5 @@
 
-policy_module(smokeping,1.0.0)
+policy_module(smokeping, 1.0.0)
 
 ########################################
 #