[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/kernel/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     582dae26c0770574e2ce819e1d193a19b89200e1
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Sun May 13 08:33:00 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sun May 13 08:33:00 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=582dae26

Introducing support for named file transitions

---
 policy/modules/kernel/devices.if     |   42 ++++++++++++--
 policy/modules/kernel/devices.te     |    2 +-
 policy/modules/kernel/files.if       |   98 +++++++++++++++++++++++++++++-----
 policy/modules/kernel/filesystem.if  |   14 ++++-
 policy/modules/kernel/filesystem.te  |    2 +-
 policy/modules/system/init.if        |    9 +++-
 policy/modules/system/logging.if     |    7 ++-
 policy/modules/system/selinuxutil.if |    2 +-
 policy/modules/system/sysnetwork.if  |   14 ++++-
 policy/modules/system/userdomain.if  |   42 ++++++++++++--
 10 files changed, 196 insertions(+), 36 deletions(-)

diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index b657ae9..5f341b0 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -932,13 +932,18 @@ interface(`dev_manage_generic_chr_files',`
 ##	the transition will occur.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`dev_filetrans',`
 	gen_require(`
 		type device_t;
 	')
 
-	filetrans_pattern($1, device_t, $2, $3)
+	filetrans_pattern($1, device_t, $2, $3, $4)
 
 	dev_associate($2)
 	files_associate_tmp($2)
@@ -962,13 +967,18 @@ interface(`dev_filetrans',`
 ##	the transition will occur.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`dev_tmpfs_filetrans_dev',`
 	gen_require(`
 		type device_t;
 	')
 
-	fs_tmpfs_filetrans($1, device_t, $2)
+	fs_tmpfs_filetrans($1, device_t, $2, $3)
 ')
 
 ########################################
@@ -1637,13 +1647,18 @@ interface(`dev_manage_cardmgr_dev',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`dev_filetrans_cardmgr',`
 	gen_require(`
 		type device_t, cardmgr_dev_t;
 	')
 
-	filetrans_pattern($1, device_t, cardmgr_dev_t, { chr_file blk_file })
+	filetrans_pattern($1, device_t, cardmgr_dev_t, { chr_file blk_file }, $2)
 ')
 
 ########################################
@@ -1893,13 +1908,18 @@ interface(`dev_manage_dri_dev',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`dev_filetrans_dri',`
 	gen_require(`
 		type device_t, dri_device_t;
 	')
 
-	filetrans_pattern($1, device_t, dri_device_t, chr_file)
+	filetrans_pattern($1, device_t, dri_device_t, chr_file, $2)
 ')
 
 ########################################
@@ -2347,13 +2367,18 @@ interface(`dev_rw_lirc',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`dev_filetrans_lirc',`
 	gen_require(`
 		type device_t, lirc_device_t;
 	')
 
-	filetrans_pattern($1, device_t, lirc_device_t, chr_file)
+	filetrans_pattern($1, device_t, lirc_device_t, chr_file, $2)
 ')
 
 ########################################
@@ -4666,13 +4691,18 @@ interface(`dev_manage_xen',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`dev_filetrans_xen',`
 	gen_require(`
 		type device_t, xen_device_t;
 	')
 
-	filetrans_pattern($1, device_t, xen_device_t, chr_file)
+	filetrans_pattern($1, device_t, xen_device_t, chr_file, $2)
 ')
 
 ########################################

diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
index 82be088..74894d7 100644
--- a/policy/modules/kernel/devices.te
+++ b/policy/modules/kernel/devices.te
@@ -1,4 +1,4 @@
-policy_module(devices, 1.13.0)
+policy_module(devices, 1.13.1)
 
 ########################################
 #

diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index 2b6dd51..1405dc6 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -1747,13 +1747,18 @@ interface(`files_dontaudit_rw_root_dir',`
 ##	The object class of the object being created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`files_root_filetrans',`
 	gen_require(`
 		type root_t;
 	')
 
-	filetrans_pattern($1, root_t, $2, $3)
+	filetrans_pattern($1, root_t, $2, $3, $4)
 ')
 
 ########################################
@@ -2033,13 +2038,18 @@ interface(`files_manage_boot_dirs',`
 ##	The object class of the object being created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`files_boot_filetrans',`
 	gen_require(`
 		type boot_t;
 	')
 
-	filetrans_pattern($1, boot_t, $2, $3)
+	filetrans_pattern($1, boot_t, $2, $3, $4)
 ')
 
 ########################################
@@ -2809,13 +2819,18 @@ interface(`files_manage_etc_symlinks',`
 ##	Object classes to be created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`files_etc_filetrans',`
 	gen_require(`
 		type etc_t;
 	')
 
-	filetrans_pattern($1, etc_t, $2, $3)
+	filetrans_pattern($1, etc_t, $2, $3, $4)
 ')
 
 ########################################
@@ -2833,6 +2848,11 @@ interface(`files_etc_filetrans',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 ## <rolecap/>
 #
 interface(`files_create_boot_flag',`
@@ -2841,7 +2861,7 @@ interface(`files_create_boot_flag',`
 	')
 
 	allow $1 etc_runtime_t:file manage_file_perms;
-	filetrans_pattern($1, root_t, etc_runtime_t, file)
+	filetrans_pattern($1, root_t, etc_runtime_t, file, $2)
 ')
 
 ########################################
@@ -3024,13 +3044,18 @@ interface(`files_manage_etc_runtime_lnk_files',`
 ##	The class of the object being created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`files_etc_filetrans_etc_runtime',`
 	gen_require(`
 		type etc_t, etc_runtime_t;
 	')
 
-	filetrans_pattern($1, etc_t, etc_runtime_t, $2)
+	filetrans_pattern($1, etc_t, etc_runtime_t, $2, $3)
 ')
 
 ########################################
@@ -3569,13 +3594,18 @@ interface(`files_relabelto_home',`
 ##	The class of the object being created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`files_home_filetrans',`
 	gen_require(`
 		type home_root_t;
 	')
 
-	filetrans_pattern($1, home_root_t, $2, $3)
+	filetrans_pattern($1, home_root_t, $2, $3, $4)
 ')
 
 ########################################
@@ -4009,13 +4039,18 @@ interface(`files_relabel_kernel_modules',`
 ##	The object class of the object being created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`files_kernel_modules_filetrans',`
 	gen_require(`
 		type modules_object_t;
 	')
 
-	filetrans_pattern($1, modules_object_t, $2, $3)
+	filetrans_pattern($1, modules_object_t, $2, $3, $4)
 ')
 
 ########################################
@@ -4523,13 +4558,18 @@ interface(`files_read_all_tmp_files',`
 ##	The object class of the object being created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`files_tmp_filetrans',`
 	gen_require(`
 		type tmp_t;
 	')
 
-	filetrans_pattern($1, tmp_t, $2, $3)
+	filetrans_pattern($1, tmp_t, $2, $3, $4)
 ')
 
 ########################################
@@ -4886,13 +4926,18 @@ interface(`files_read_usr_symlinks',`
 ##	The object class.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`files_usr_filetrans',`
 	gen_require(`
 		type usr_t;
 	')
 
-	filetrans_pattern($1, usr_t, $2, $3)
+	filetrans_pattern($1, usr_t, $2, $3, $4)
 ')
 
 ########################################
@@ -5289,13 +5334,18 @@ interface(`files_manage_var_symlinks',`
 ##	The object class.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`files_var_filetrans',`
 	gen_require(`
 		type var_t;
 	')
 
-	filetrans_pattern($1, var_t, $2, $3)
+	filetrans_pattern($1, var_t, $2, $3, $4)
 ')
 
 ########################################
@@ -5423,6 +5473,11 @@ interface(`files_rw_var_lib_dirs',`
 ##	The object class.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`files_var_lib_filetrans',`
 	gen_require(`
@@ -5430,7 +5485,7 @@ interface(`files_var_lib_filetrans',`
 	')
 
 	allow $1 var_t:dir search_dir_perms;
-	filetrans_pattern($1, var_lib_t, $2, $3)
+	filetrans_pattern($1, var_lib_t, $2, $3, $4)
 ')
 
 ########################################
@@ -5763,6 +5818,11 @@ interface(`files_manage_all_locks',`
 ##	The object class of the object being created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`files_lock_filetrans',`
 	gen_require(`
@@ -5771,7 +5831,7 @@ interface(`files_lock_filetrans',`
 
 	allow $1 var_t:dir search_dir_perms;
 	allow $1 var_lock_t:lnk_file read_lnk_file_perms;
-	filetrans_pattern($1, var_lock_t, $2, $3)
+	filetrans_pattern($1, var_lock_t, $2, $3, $4)
 ')
 
 ########################################
@@ -5957,6 +6017,11 @@ interface(`files_write_generic_pid_pipes',`
 ##	The object class of the object being created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 ## <infoflow type="write" weight="10"/>
 #
 interface(`files_pid_filetrans',`
@@ -5966,7 +6031,7 @@ interface(`files_pid_filetrans',`
 
 	allow $1 var_t:dir search_dir_perms;
 	allow $1 var_run_t:lnk_file read_lnk_file_perms;
-	filetrans_pattern($1, var_run_t, $2, $3)
+	filetrans_pattern($1, var_run_t, $2, $3, $4)
 ')
 
 ########################################
@@ -6294,6 +6359,11 @@ interface(`files_manage_generic_spool',`
 ##	the transition will occur.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`files_spool_filetrans',`
 	gen_require(`
@@ -6301,7 +6371,7 @@ interface(`files_spool_filetrans',`
 	')
 
 	allow $1 var_t:dir search_dir_perms;
-	filetrans_pattern($1, var_spool_t, $2, $3)
+	filetrans_pattern($1, var_spool_t, $2, $3, $4)
 ')
 
 ########################################

diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
index 97fcdac..7c6b791 100644
--- a/policy/modules/kernel/filesystem.if
+++ b/policy/modules/kernel/filesystem.if
@@ -2188,6 +2188,11 @@ interface(`fs_dontaudit_list_inotifyfs',`
 ##	The object class of the object being created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`fs_hugetlbfs_filetrans',`
 	gen_require(`
@@ -2195,7 +2200,7 @@ interface(`fs_hugetlbfs_filetrans',`
 	')
 
 	allow $2 hugetlbfs_t:filesystem associate;
-	filetrans_pattern($1, hugetlbfs_t, $2, $3)
+	filetrans_pattern($1, hugetlbfs_t, $2, $3, $4)
 ')
 
 ########################################
@@ -4014,6 +4019,11 @@ interface(`fs_dontaudit_write_tmpfs_dirs',`
 ##	The object class of the object being created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`fs_tmpfs_filetrans',`
 	gen_require(`
@@ -4021,7 +4031,7 @@ interface(`fs_tmpfs_filetrans',`
 	')
 
 	allow $2 tmpfs_t:filesystem associate;
-	filetrans_pattern($1, tmpfs_t, $2, $3)
+	filetrans_pattern($1, tmpfs_t, $2, $3, $4)
 ')
 
 ########################################

diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
index abd970d..f1ab8c6 100644
--- a/policy/modules/kernel/filesystem.te
+++ b/policy/modules/kernel/filesystem.te
@@ -1,4 +1,4 @@
-policy_module(filesystem, 1.15.0)
+policy_module(filesystem, 1.15.1)
 
 ########################################
 #

diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 01bad37..684ff3a 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -1579,6 +1579,11 @@ interface(`init_rw_script_tmp_files',`
 ##	The object class.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`init_script_tmp_filetrans',`
 	gen_require(`
@@ -1586,7 +1591,7 @@ interface(`init_script_tmp_filetrans',`
 	')
 
 	files_search_tmp($1)
-	filetrans_pattern($1, initrc_tmp_t, $2, $3)
+	filetrans_pattern($1, initrc_tmp_t, $2, $3, $4)
 ')
 
 ########################################
@@ -1754,7 +1759,7 @@ interface(`init_pid_filetrans_utmp',`
 		type initrc_var_run_t;
 	')
 
-	files_pid_filetrans($1, initrc_var_run_t, file)
+	files_pid_filetrans($1, initrc_var_run_t, file, "utmp")
 ')
 
 ########################################

diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
index 51dface..ee215c1 100644
--- a/policy/modules/system/logging.if
+++ b/policy/modules/system/logging.if
@@ -480,6 +480,11 @@ interface(`logging_domtrans_syslog',`
 ##	The object class of the object being created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 ## <infoflow type="write" weight="10"/>
 #
 interface(`logging_log_filetrans',`
@@ -488,7 +493,7 @@ interface(`logging_log_filetrans',`
 	')
 
 	files_search_var($1)
-	filetrans_pattern($1, var_log_t, $2, $3)
+	filetrans_pattern($1, var_log_t, $2, $3, $4)
 ')
 
 ########################################

diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if
index 5885571..3822072 100644
--- a/policy/modules/system/selinuxutil.if
+++ b/policy/modules/system/selinuxutil.if
@@ -1043,7 +1043,7 @@ interface(`seutil_manage_module_store',`
 	files_search_etc($1)
 	manage_dirs_pattern($1, selinux_config_t, semanage_store_t)
 	manage_files_pattern($1, semanage_store_t, semanage_store_t)
-	filetrans_pattern($1, selinux_config_t, semanage_store_t, dir)
+	filetrans_pattern($1, selinux_config_t, semanage_store_t, dir, "modules")
 ')
 
 #######################################

diff --git a/policy/modules/system/sysnetwork.if b/policy/modules/system/sysnetwork.if
index c7f6a4a..dd44150 100644
--- a/policy/modules/system/sysnetwork.if
+++ b/policy/modules/system/sysnetwork.if
@@ -403,13 +403,18 @@ interface(`sysnet_create_config',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`sysnet_etc_filetrans_config',`
 	gen_require(`
 		type net_conf_t;
 	')
 
-	files_etc_filetrans($1, net_conf_t, file)
+	files_etc_filetrans($1, net_conf_t, file, $2)
 ')
 
 #######################################
@@ -624,6 +629,11 @@ interface(`sysnet_search_dhcp_state',`
 ##	The object class.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`sysnet_dhcp_state_filetrans',`
 	gen_require(`
@@ -631,7 +641,7 @@ interface(`sysnet_dhcp_state_filetrans',`
 	')
 
 	files_search_var_lib($1)
-	filetrans_pattern($1, dhcp_state_t, $2, $3)
+	filetrans_pattern($1, dhcp_state_t, $2, $3, $4)
 ')
 
 ########################################

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 34a89ea..b8f49d3 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -1607,13 +1607,18 @@ interface(`userdom_relabelto_user_home_dirs',`
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`userdom_home_filetrans_user_home_dir',`
 	gen_require(`
 		type user_home_dir_t;
 	')
 
-	files_home_filetrans($1, user_home_dir_t, dir)
+	files_home_filetrans($1, user_home_dir_t, dir, $2)
 ')
 
 ########################################
@@ -2084,13 +2089,18 @@ interface(`userdom_manage_user_home_content_sockets',`
 ##	The class of the object to be created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`userdom_user_home_dir_filetrans',`
 	gen_require(`
 		type user_home_dir_t;
 	')
 
-	filetrans_pattern($1, user_home_dir_t, $2, $3)
+	filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
 	files_search_home($1)
 ')
 
@@ -2115,13 +2125,18 @@ interface(`userdom_user_home_dir_filetrans',`
 ##	The class of the object to be created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`userdom_user_home_content_filetrans',`
 	gen_require(`
 		type user_home_dir_t, user_home_t;
 	')
 
-	filetrans_pattern($1, user_home_t, $2, $3)
+	filetrans_pattern($1, user_home_t, $2, $3, $4)
 	allow $1 user_home_dir_t:dir search_dir_perms;
 	files_search_home($1)
 ')
@@ -2142,13 +2157,18 @@ interface(`userdom_user_home_content_filetrans',`
 ##	The class of the object to be created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`userdom_user_home_dir_filetrans_user_home_content',`
 	gen_require(`
 		type user_home_dir_t, user_home_t;
 	')
 
-	filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
+	filetrans_pattern($1, user_home_dir_t, user_home_t, $2, $3)
 	files_search_home($1)
 ')
 
@@ -2466,13 +2486,18 @@ interface(`userdom_manage_user_tmp_sockets',`
 ##	The class of the object to be created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`userdom_user_tmp_filetrans',`
 	gen_require(`
 		type user_tmp_t;
 	')
 
-	filetrans_pattern($1, user_tmp_t, $2, $3)
+	filetrans_pattern($1, user_tmp_t, $2, $3, $4)
 	files_search_tmp($1)
 ')
 
@@ -2492,13 +2517,18 @@ interface(`userdom_user_tmp_filetrans',`
 ##	The class of the object to be created.
 ##	</summary>
 ## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
 #
 interface(`userdom_tmp_filetrans_user_tmp',`
 	gen_require(`
 		type user_tmp_t;
 	')
 
-	files_tmp_filetrans($1, user_tmp_t, $2)
+	files_tmp_filetrans($1, user_tmp_t, $2, $3)
 ')
 
 ########################################