[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/kernel/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     d0b7ac0dd1f6dd606f3f988c2e875bc56ccceba9
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Mon May 28 06:43:46 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon May 28 06:43:46 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=d0b7ac0d

Allow initrc_t to create /run/* directories

See bug #417857

---
 policy/modules/kernel/files.if |   64 ++++++++++++++++++++++++++++++++++++++++
 policy/modules/system/init.te  |    4 ++
 2 files changed, 68 insertions(+), 0 deletions(-)

diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index 1405dc6..36dd117 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -5648,6 +5648,27 @@ interface(`files_rw_lock_dirs',`
 
 ########################################
 ## <summary>
+##	Create lock directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`files_create_lock_dirs',`
+	gen_require(`
+		type var_t, var_lock_t;
+	')
+
+	allow $1 var_t:dir search_dir_perms;
+	allow $1 var_lock_t:lnk_file read_lnk_file_perms;
+	create_dirs_pattern($1, var_lock_t, var_lock_t)
+')
+
+
+########################################
+## <summary>
 ##	Relabel to and from all lock directory types.
 ## </summary>
 ## <param name="domain">
@@ -5691,6 +5712,24 @@ interface(`files_getattr_generic_locks',`
 
 ########################################
 ## <summary>
+##	Set the attributes of generic lock directories
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`files_setattr_generic_dirs',`
+	gen_require(`
+		type var_t, var_lock_t;
+	')
+
+	setattr_dirs_pattern($1, var_t, var_lock_t)
+')
+
+########################################
+## <summary>
 ##	Delete generic lock files.
 ## </summary>
 ## <param name="domain">
@@ -5971,6 +6010,31 @@ interface(`files_write_generic_pid_pipes',`
 	allow $1 var_run_t:lnk_file read_lnk_file_perms;
 	allow $1 var_run_t:fifo_file write;
 ')
+########################################
+## <summary>
+##	Write files in /var/run with the lock file type
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	Name of the directory that the file transition will work on
+##	</summary>
+## </param>
+#
+interface(`files_pid_filetrans_generic_lock_dirs',`
+	gen_require(`
+		type var_t, var_run_t;
+	')
+
+	allow $1 var_t:dir search_dir_perms;
+	allow $1 var_run_t:lnk_file read_lnk_file_perms;
+	files_pid_filetrans($1, var_lock_t, dir, $2)
+')
+
 
 ########################################
 ## <summary>

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 820c072..c8452f3 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -276,7 +276,11 @@ kernel_rw_all_sysctls(initrc_t)
 # for lsof which is used by alsa shutdown:
 kernel_dontaudit_getattr_message_if(initrc_t)
 
+files_create_lock_dirs(initrc_t)
+files_pid_filetrans(initrc_t, initrc_state_t, dir, "openrc")
+files_pid_filetrans_generic_lock_dirs(initrc_t, "lock")
 files_read_kernel_symbol_table(initrc_t)
+files_setattr_generic_dirs(initrc_t)
 files_dontaudit_write_usr_dirs(initrc_t)
 
 corecmd_exec_all_executables(initrc_t)