[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/, policy/modules/system/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     8c1ff02f727be2bb89983948b4fc64e2aedff870
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Tue Jul 24 09:23:50 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Jul 24 09:23:50 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=8c1ff02f

Adding run support from init to mysql dir

---
 policy/modules/contrib/mysql.if |   48 +++++++++++++++++++++++++++++++++++++++
 policy/modules/system/init.te   |    5 ++-
 2 files changed, 51 insertions(+), 2 deletions(-)

diff --git a/policy/modules/contrib/mysql.if b/policy/modules/contrib/mysql.if
index e9c0982..19ea188 100644
--- a/policy/modules/contrib/mysql.if
+++ b/policy/modules/contrib/mysql.if
@@ -311,6 +311,54 @@ interface(`mysql_search_pid_files',`
 	search_dirs_pattern($1, mysqld_var_run_t, mysqld_var_run_t)
 ')
 
+#######################################
+## <summary>
+##	Create MySQL run directories
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+#
+interface(`mysql_create_run_dirs',`
+	gen_require(`
+		type mysqld_var_run_t;
+	')
+
+	create_dirs_pattern($1, mysqld_var_run_t, mysqld_var_run_t)
+')
+
+#######################################
+## <summary>
+##	Automatically use the MySQL run label for created resources in generic
+##	run locations
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+## <param name="class">
+## 	<summary>
+##	Type of the resource created for which the automatic file transition
+##	should occur
+##	</summary>
+## </param>
+## <param name="filename" optional="true">
+## 	<summary>
+##	The name of the resource being created
+##	</summary>
+## </param>
+#
+interface(`mysql_generic_run_filetrans_run',`
+	gen_require(`
+		type mysqld_var_run_t;
+	')
+
+	files_pid_filetrans($1, mysqld_var_run_t, $2, $3)
+')
+
 ########################################
 ## <summary>
 ##	All of the rules required to administrate an mysql environment

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index bb6e95e..6b56b57 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -758,10 +758,11 @@ optional_policy(`
 	ifdef(`distro_redhat',`
 		mysql_manage_db_dirs(initrc_t)
 	')
-
+	mysql_create_run_dirs(initrc_t)
+	mysql_generic_run_filetrans_run(initrc_t, dir, "mysqld")
+	mysql_read_config(initrc_t)
 	mysql_stream_connect(initrc_t)
 	mysql_write_log(initrc_t)
-	mysql_read_config(initrc_t)
 ')
 
 optional_policy(`