[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/kernel/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     2e16631015dfd8b665ddf661e490e30b52ef4d6b
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Dec  7 17:08:07 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Fri Dec  7 17:08:07 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=2e166310

Dontaudit getsched on all domains

The htop utility will attempt to get the scheduling information of all
processes. This information however does not seem to be needed for its
information (no difference in output when allowed or not).

See also bug #444962

---
 policy/modules/kernel/domain.if     |   20 ++++++++++++++++++++
 policy/modules/system/userdomain.if |    4 ++++
 2 files changed, 24 insertions(+), 0 deletions(-)

diff --git a/policy/modules/kernel/domain.if b/policy/modules/kernel/domain.if
index 6a1e4d1..b900767 100644
--- a/policy/modules/kernel/domain.if
+++ b/policy/modules/kernel/domain.if
@@ -1531,3 +1531,23 @@ interface(`domain_unconfined',`
 	typeattribute $1 set_curr_context;
 	typeattribute $1 process_uncond_exempt;
 ')
+
+# Gentoo specific stuff, but I cannot use ifdef distro_gentoo in if files
+
+########################################
+## <summary>
+##	Do not audit getting the scheduler information of all domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`domain_dontaudit_getsched_all_domains',`
+	gen_require(`
+		attribute domain;
+	')
+
+	dontaudit $1 domain:process getsched;
+')

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index d8d000b..d1bc7ed 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -1061,6 +1061,10 @@ template(`userdom_unpriv_user_template', `
 	optional_policy(`
 		setroubleshoot_stream_connect($1_t)
 	')
+
+	ifdef(`distro_gentoo',`
+		domain_dontaudit_getsched_all_domains($1_t)
+	')
 ')
 
 #######################################