[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/, policy/modules/kernel/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     4dedda31c2025ccde5ee8ce2500648d786f28d89
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Sun Oct 28 17:52:18 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Sun Oct 28 17:52:18 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=4dedda31

Keep file contexts local

Unlike what is used in refpolicy, I think it is much cleaner if file contexts
related to the application the module reflects are within the file context file.
This does mean that "elsewhere" defined types must be accepted in the context,
but as long as these types are part of the base install (or as a depending
module without optional_policy() statement) this should be okay.

One main advantage to this - beyond clarity - is that the contexts file on a
users' system will not contain paths for files that are of applications he
doesn't have.

Doing this for a few shorewall contexts for now, will update as these come
along.

---
 policy/modules/contrib/shorewall.fc   |    5 +++++
 policy/modules/kernel/corecommands.fc |    6 ------
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/policy/modules/contrib/shorewall.fc b/policy/modules/contrib/shorewall.fc
index 341bd25..daf852d 100644
--- a/policy/modules/contrib/shorewall.fc
+++ b/policy/modules/contrib/shorewall.fc
@@ -20,6 +20,11 @@
 
 ifdef(`distro_gentoo',`
 /usr/share/shorewall/compiler\.pl	--	gen_context(system_u:object_r:bin_t,s0)
+/usr/share/shorewall/configpath	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/share/shorewall/getparams	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/share/shorewall/wait4ifup	--	gen_context(system_u:object_r:bin_t,s0)
+/usr/share/shorewall-perl(/.*)?		gen_context(system_u:object_r:bin_t,s0)
+/usr/share/shorewall-shell(/.*)?	gen_context(system_u:object_r:bin_t,s0)
+/usr/share/shorewall-lite(/.*)?		gen_context(system_u:object_r:bin_t,s0)
+/usr/share/shorewall6-lite(/.*)?	gen_context(system_u:object_r:bin_t,s0)
 ')

diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
index 57fd2ed..de94bd0 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
@@ -309,12 +309,6 @@ ifdef(`distro_gentoo',`
 /usr/share/sectool/.*\.py	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/share/selinux/devel/policygentool -- gen_context(system_u:object_r:bin_t,s0)
 /usr/share/smolt/client(/.*)?		gen_context(system_u:object_r:bin_t,s0)
-/usr/share/shorewall/compiler\.pl --	gen_context(system_u:object_r:bin_t,s0)
-/usr/share/shorewall/configpath	--	gen_context(system_u:object_r:bin_t,s0)
-/usr/share/shorewall-perl(/.*)?		gen_context(system_u:object_r:bin_t,s0)
-/usr/share/shorewall-shell(/.*)?	gen_context(system_u:object_r:bin_t,s0)
-/usr/share/shorewall-lite(/.*)? 	gen_context(system_u:object_r:bin_t,s0)
-/usr/share/shorewall6-lite(/.*)?	gen_context(system_u:object_r:bin_t,s0)
 /usr/share/spamassassin/sa-update\.cron gen_context(system_u:object_r:bin_t,s0)
 /usr/share/texmf/web2c/mktexdir	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/share/turboprint/lib(/.*)?	--	gen_context(system_u:object_r:bin_t,s0)