Gentoo diffs

* Gentoo diffs
@ 2005-12-04 10:32 Petre Rodan
  0 siblings, 0 replies; 5+ messages in thread
From: Petre Rodan @ 2005-12-04 10:32 UTC (permalink / raw)
  To: SE Linux


[-- Attachment #1.1: Type: text/plain, Size: 592 bytes --]


Hi,

Attached you'll find the latest diffs between the sample policy and the current Gentoo policy.

ChangeLog

daemontools.te: added support to supervise ftpd, openvpn
ftpd.fc: added support for PureFTPd
openvpn.te openvpn.fc: added log_domain and var_lib_domain
publicfile.te: minor fix
saslauthd.fc: added gentoo path
slapd.te slapd.fc: added gentoo paths and support for openldap-2.2.28
spamd.te spamd.fc: added var_lib_domain and new capabilities needed by spamassassin 3.1.0

cheers,
peter

-- 
petre rodan
<kaiowas@gentoo.org>
Developer,
Hardened Gentoo Linux 

[-- Attachment #1.2: daemontools.te.diff --]
[-- Type: text/plain, Size: 1017 bytes --]

--- /root/public_html/policy/nsa/domains/program/unused/daemontools.te	2005-05-25 13:04:36.000000000 +0300
+++ /etc/security/selinux/src/policy/domains/program/daemontools.te	2005-11-26 19:49:40.000000000 +0200
@@ -150,17 +150,27 @@
 ')
 
 ifdef(`clockspeed.te', `
-domain_auto_trans( svc_run_t, clockspeed_exec_t, clockspeed_t)
+domain_auto_trans(svc_run_t, clockspeed_exec_t, clockspeed_t)
 svc_ipc_domain(clockspeed_t)
 r_dir_file(svc_run_t, clockspeed_var_lib_t)
 allow svc_run_t clockspeed_var_lib_t:fifo_file { rw_file_perms setattr };
 ')
 
 ifdef(`dante.te', `
-domain_auto_trans( svc_run_t, dante_exec_t, dante_t);
+domain_auto_trans(svc_run_t, dante_exec_t, dante_t);
 svc_ipc_domain(dante_t)
 ')
 
+ifdef(`ftpd.te', `
+domain_auto_trans(svc_run_t, ftpd_exec_t, ftpd_t);
+svc_ipc_domain(ftpd_t)
+')
+
+ifdef(`openvpn.te', `
+domain_auto_trans(svc_run_t, openvpn_exec_t, openvpn_t);
+svc_ipc_domain(openvpn_t)
+')
+
 ifdef(`publicfile.te', `
 svc_ipc_domain(publicfile_t)
 ')

[-- Attachment #1.3: ftpd.fc.diff --]
[-- Type: text/plain, Size: 626 bytes --]

--- /root/public_html/policy/nsa/file_contexts/program/ftpd.fc	2005-11-18 13:29:41.000000000 +0200
+++ /etc/security/selinux/src/policy/file_contexts/program/ftpd.fc	2005-11-18 15:41:55.000000000 +0200
@@ -5,6 +5,7 @@
 /usr/sbin/ftpwho	--	system_u:object_r:ftpd_exec_t
 /usr/kerberos/sbin/ftpd	--	system_u:object_r:ftpd_exec_t
 /usr/sbin/vsftpd	--	system_u:object_r:ftpd_exec_t
+/usr/sbin/pure-ftpd	--	system_u:object_r:ftpd_exec_t
 /etc/proftpd\.conf	--	system_u:object_r:ftpd_etc_t
 /var/run/proftpd/proftpd-inetd -- system_u:object_r:ftpd_var_run_t
 /var/run/proftpd/proftpd\.scoreboard -- system_u:object_r:ftpd_var_run_t

[-- Attachment #1.4: openvpn.fc.diff --]
[-- Type: text/plain, Size: 472 bytes --]

--- /root/public_html/policy/nsa/file_contexts/program/openvpn.fc	2005-04-17 00:36:17.000000000 +0300
+++ /etc/security/selinux/src/policy/file_contexts/program/openvpn.fc	2005-06-18 10:40:06.000000000 +0300
@@ -2,3 +2,6 @@
 
 /etc/openvpn/.*	--	system_u:object_r:openvpn_etc_t
 /usr/sbin/openvpn	--	system_u:object_r:openvpn_exec_t
+/var/log/openvpn-status\.log    -- system_u:object_r:openvpn_log_t
+/var/lib/openvpn(/.*)?	system_u:object_r:openvpn_var_lib_t
+

[-- Attachment #1.5: openvpn.te.diff --]
[-- Type: text/plain, Size: 752 bytes --]

--- /root/public_html/policy/nsa/domains/program/unused/openvpn.te	2005-07-06 22:58:17.000000000 +0300
+++ /etc/security/selinux/src/policy/domains/program/openvpn.te	2005-06-18 10:40:15.000000000 +0300
@@ -7,6 +7,10 @@
 
 daemon_domain(openvpn)
 etcdir_domain(openvpn)
+log_domain(openvpn)
+var_lib_domain(openvpn)
 
 allow openvpn_t { etc_t etc_runtime_t }:{ file lnk_file } r_file_perms;
 
@@ -14,6 +18,7 @@
 allow openvpn_t devpts_t:dir { search getattr };
 allow openvpn_t tun_tap_device_t:chr_file rw_file_perms;
 allow openvpn_t proc_t:file { getattr read };
+r_dir_file(openvpn_t, proc_net_t)
 
 allow openvpn_t self:unix_dgram_socket create_socket_perms;
 allow openvpn_t self:unix_stream_socket create_stream_socket_perms;

[-- Attachment #1.6: publicfile.te.diff --]
[-- Type: text/plain, Size: 738 bytes --]

--- /root/public_html/policy/nsa/domains/program/unused/publicfile.te	2005-04-21 15:53:02.000000000 +0300
+++ /etc/security/selinux/src/policy/domains/program/publicfile.te	2005-11-24 11:42:33.000000000 +0200
@@ -6,13 +6,24 @@
 # this policy depends on ucspi-tcp
 #
 
 daemon_domain(publicfile)
 type publicfile_content_t, file_type, sysadmfile;
 domain_auto_trans(initrc_t, publicfile_exec_t, publicfile_t)
 
 ifdef(`ucspi-tcp.te', `
 domain_auto_trans(utcpserver_t, publicfile_exec_t, publicfile_t)
-allow publicfile_t utcpserver_t:tcp_socket { read write };
+allow publicfile_t utcpserver_t:tcp_socket { read write shutdown };
 allow utcpserver_t { ftp_data_port_t ftp_port_t http_port_t }:tcp_socket name_bind;
 ')
 

[-- Attachment #1.7: saslauth.fc.diff --]
[-- Type: text/plain, Size: 442 bytes --]

--- /root/public_html/policy/nsa/file_contexts/program/saslauthd.fc	2004-09-23 05:08:21.000000000 +0300
+++ /etc/security/selinux/src/policy/file_contexts/program/saslauthd.fc	2005-02-27 19:25:37.000000000 +0200
@@ -1,3 +1,6 @@
 # saslauthd 
 /usr/sbin/saslauthd		--	system_u:object_r:saslauthd_exec_t
 /var/run/saslauthd(/.*)?		system_u:object_r:saslauthd_var_run_t
+
+/var/lib/sasl2(/.*)?			system_u:object_r:saslauthd_var_run_t
+

[-- Attachment #1.8: slapd.fc.diff --]
[-- Type: text/plain, Size: 883 bytes --]

--- /root/public_html/policy/nsa/file_contexts/program/slapd.fc	2005-11-18 13:29:41.000000000 +0200
+++ /etc/security/selinux/src/policy/file_contexts/program/slapd.fc	2005-11-18 15:50:29.000000000 +0200
@@ -17,3 +17,14 @@
 /opt/(fedora|redhat)-ds/slapd-[^/]+/stop-slapd system_u:object_r:initrc_exec_t
 /opt/(fedora|redhat)-ds/alias(/.*)? system_u:object_r:slapd_cert_t
 /opt/(fedora|redhat)-ds/alias/[^/]+so.* system_u:object_r:shlib_t
+
+# gentoo file locations
+/usr/lib/openldap/slapd --	system_u:object_r:slapd_exec_t
+/etc/openldap/slapd\.conf -- system_u:object_r:slapd_etc_t
+/etc/openldap/ssl/.*		-- system_u:object_r:slapd_cert_t
+/var/run/openldap(/.*)?		system_u:object_r:slapd_var_run_t
+/var/lib/openldap-data(/.*)?	system_u:object_r:slapd_db_t
+/var/lib/openldap-ldbm(/.*)?	system_u:object_r:slapd_db_t
+/var/lib/openldap-slurp(/.*)?	system_u:object_r:slapd_db_t
+
+

[-- Attachment #1.9: slapd.te.diff --]
[-- Type: text/plain, Size: 513 bytes --]

--- /root/public_html/policy/nsa/domains/program/unused/slapd.te	2005-11-18 13:29:41.000000000 +0200
+++ /etc/security/selinux/src/policy/domains/program/slapd.te	2005-11-18 15:48:27.000000000 +0200
@@ -61,18 +62,22 @@
 allow slapd_t self:netlink_route_socket r_netlink_socket_perms;
 r_dir_file(slapd_t, cert_t)
 
+# gentoo related
+#allow slapd_t slapd_t:capability dac_override;
+allow slapd_t slapd_t:unix_stream_socket listen;
+allow slapd_t slapd_var_run_t:sock_file { create setattr unlink };
 

[-- Attachment #1.10: spamd.fc.diff --]
[-- Type: text/plain, Size: 506 bytes --]

--- /root/public_html/policy/nsa/file_contexts/program/spamd.fc	2004-02-02 18:58:19.000000000 +0200
+++ /etc/security/selinux/src/policy/file_contexts/program/spamd.fc	2005-05-02 11:01:38.000000000 +0300
@@ -1,3 +1,7 @@
 /usr/sbin/spamd		--	system_u:object_r:spamd_exec_t
 /usr/bin/spamd		--	system_u:object_r:spamd_exec_t
 /usr/bin/sa-learn	--	system_u:object_r:spamd_exec_t
+
+/var/run/spamd(/.*)?	system_u:object_r:spamd_var_run_t		
+/var/lib/spamd(/.*)?	system_u:object_r:spamd_var_lib_t		
+

[-- Attachment #1.11: spamd.te.diff --]
[-- Type: text/plain, Size: 1040 bytes --]

--- /root/public_html/policy/nsa/domains/program/unused/spamd.te	2005-11-18 13:29:41.000000000 +0200
+++ /etc/security/selinux/src/policy/domains/program/spamd.te	2005-11-24 11:43:54.000000000 +0200
@@ -9,9 +9,14 @@
 
 tmp_domain(spamd)
 
 general_domain_access(spamd_t)
 uses_shlib(spamd_t)
 read_sysctl(spamd_t)
+var_lib_domain(spamd)
 
 # Various Perl bits
 allow spamd_t lib_t:file rx_file_perms;
@@ -32,10 +37,12 @@
 # Spamassassin, when run as root and using per-user config files,
 # setuids to the user running spamc.  Comment this if you are not
 # using this ability.
-allow spamd_t self:capability { setuid setgid dac_override sys_tty_config };
+allow spamd_t self:capability { setuid setgid chown fowner dac_override kill sys_tty_config };
 
 allow spamd_t { bin_t sbin_t }:dir { getattr search };
 can_exec(spamd_t, bin_t)
+allow spamd_t bin_t:lnk_file read;
+allow spamd_t spamd_var_run_t:sock_file create_file_perms;
 
 ifdef(`sendmail.te', `
 allow spamd_t etc_mail_t:dir { getattr read search };

[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]

^ permalink raw reply	[flat|nested] 5+ messages in thread