[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/, policy/modules/system/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     e71ecb4831f970f0755c123401096de1e07f3e2d
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Tue Aug 14 16:28:12 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Aug 14 17:31:16 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=e71ecb48

Use the newly introduced init_daemon_run_dir interface

Use the init_daemon_run_dir interface rather than the ping-pong-like game
between interfaces in order to allow initrc_t to create the run dirs of the
given daemons with the proper file transition.

---
 policy/modules/contrib/dbus.if  |    9 +++------
 policy/modules/contrib/dbus.te  |    1 +
 policy/modules/contrib/mysql.if |    9 +++------
 policy/modules/contrib/mysql.te |    1 +
 policy/modules/system/init.te   |    5 -----
 policy/modules/system/udev.if   |    9 +++------
 policy/modules/system/udev.te   |    1 +
 7 files changed, 12 insertions(+), 23 deletions(-)

diff --git a/policy/modules/contrib/dbus.if b/policy/modules/contrib/dbus.if
index f0e21ac..96ba874 100644
--- a/policy/modules/contrib/dbus.if
+++ b/policy/modules/contrib/dbus.if
@@ -394,7 +394,8 @@ interface(`dbus_send_system_bus',`
 ########################################
 ## <summary>
 ##	Create resources in /run or /var/run with the system_dbusd_var_run_t
-##	label
+##	label. This method is deprecated in favor of the init_daemon_run_dir
+##	call.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -413,11 +414,7 @@ interface(`dbus_send_system_bus',`
 ## </param>
 #
 interface(`dbus_generic_pid_filetrans_system_dbusd_var_run',`
-	gen_require(`
-		type system_dbusd_var_run_t;
-	')
-
-	files_pid_filetrans($1, system_dbusd_var_run_t, $2, $3)
+	refpolicywarn(`$0($*) has been deprecated.')
 ')
 
 ########################################

diff --git a/policy/modules/contrib/dbus.te b/policy/modules/contrib/dbus.te
index 625cb32..05f2b89 100644
--- a/policy/modules/contrib/dbus.te
+++ b/policy/modules/contrib/dbus.te
@@ -35,6 +35,7 @@ files_type(system_dbusd_var_lib_t)
 
 type system_dbusd_var_run_t;
 files_pid_file(system_dbusd_var_run_t)
+init_daemon_run_dir(system_dbusd_var_run_t, "dbus")
 
 ifdef(`enable_mcs',`
 	init_ranged_system_domain(system_dbusd_t, dbusd_exec_t, s0 - mcs_systemhigh)

diff --git a/policy/modules/contrib/mysql.if b/policy/modules/contrib/mysql.if
index da9b321..01ef7b5 100644
--- a/policy/modules/contrib/mysql.if
+++ b/policy/modules/contrib/mysql.if
@@ -350,7 +350,8 @@ interface(`mysql_create_run_dirs',`
 #######################################
 ## <summary>
 ##	Automatically use the MySQL run label for created resources in generic
-##	run locations
+##	run locations. This method is deprecated in favor of the
+##	init_daemon_run_dir call.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -370,11 +371,7 @@ interface(`mysql_create_run_dirs',`
 ## </param>
 #
 interface(`mysql_generic_run_filetrans_run',`
-	gen_require(`
-		type mysqld_var_run_t;
-	')
-
-	files_pid_filetrans($1, mysqld_var_run_t, $2, $3)
+	refpolicywarn(`$0($*) has been deprecated.')
 ')
 
 ########################################

diff --git a/policy/modules/contrib/mysql.te b/policy/modules/contrib/mysql.te
index 1cf05a3..d4206c9 100644
--- a/policy/modules/contrib/mysql.te
+++ b/policy/modules/contrib/mysql.te
@@ -22,6 +22,7 @@ init_daemon_domain(mysqld_safe_t, mysqld_safe_exec_t)
 
 type mysqld_var_run_t;
 files_pid_file(mysqld_var_run_t)
+init_daemon_run_dir(mysqld_var_run_t, "mysqld")
 
 type mysqld_db_t;
 files_type(mysqld_db_t)

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index db0f013..e0ea2db 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -647,10 +647,8 @@ optional_policy(`
 
 optional_policy(`
 	dbus_connect_system_bus(initrc_t)
-	dbus_create_system_dbusd_var_run_dirs(initrc_t)
 	dbus_system_bus_client(initrc_t)
 	dbus_read_config(initrc_t)
-	dbus_generic_pid_filetrans_system_dbusd_var_run(initrc_t, dir, "dbus")
 
 	optional_policy(`
 		consolekit_dbus_chat(initrc_t)
@@ -764,8 +762,6 @@ optional_policy(`
 	ifdef(`distro_redhat',`
 		mysql_manage_db_dirs(initrc_t)
 	')
-	mysql_create_run_dirs(initrc_t)
-	mysql_generic_run_filetrans_run(initrc_t, dir, "mysqld")
 	mysql_read_config(initrc_t)
 	mysql_setattr_run_dirs(initrc_t)
 	mysql_stream_connect(initrc_t)
@@ -862,7 +858,6 @@ optional_policy(`
 
 optional_policy(`
 	udev_create_db_dirs(initrc_t)
-	udev_generic_pid_filetrans_run_dirs(initrc_t, "udev")
 	udev_pid_filetrans_db(initrc_t, dir, "rules.d")
 	udev_manage_pid_files(initrc_t)
 	udev_manage_pid_dirs(initrc_t)

diff --git a/policy/modules/system/udev.if b/policy/modules/system/udev.if
index 7423f26..e6409d2 100644
--- a/policy/modules/system/udev.if
+++ b/policy/modules/system/udev.if
@@ -296,7 +296,8 @@ interface(`udev_pid_filetrans_db',`
 
 ########################################
 ## <summary>
-##	Write dirs in /var/run with the udev_var_run file type
+##	Write dirs in /var/run with the udev_var_run file type.
+##	This method is deprecated in favor of the init_daemon_run_dir call.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -310,11 +311,7 @@ interface(`udev_pid_filetrans_db',`
 ## </param>
 #
 interface(`udev_generic_pid_filetrans_run_dirs',`
-	gen_require(`
-		type udev_var_run_t;
-	')
-
-	files_pid_filetrans($1, udev_var_run_t, dir, $2)
+	refpolicywarn(`$0($*) has been deprecated.')
 ')
 
 ########################################

diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
index b4fbfef..a8fe208 100644
--- a/policy/modules/system/udev.te
+++ b/policy/modules/system/udev.te
@@ -25,6 +25,7 @@ files_type(udev_rules_t)
 
 type udev_var_run_t;
 files_pid_file(udev_var_run_t)
+init_daemon_run_dir(udev_var_run_t, "udev")
 
 ifdef(`enable_mcs',`
 	kernel_ranged_domtrans_to(udev_t, udev_exec_t, s0 - mcs_systemhigh)