[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/kernel/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     1510262111193a4904afce6d2ce4e46b9bb04f96
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Dec  7 17:08:07 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Fri Dec  7 17:57:20 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=15102621

Dontaudit getsched on all domains

The htop utility will attempt to get the scheduling information of all
processes. This information however does not seem to be needed for its
information (no difference in output when allowed or not).

See also bug #444962

---
 policy/modules/kernel/domain.if     |   20 ++++++++++++++++++++
 policy/modules/system/userdomain.if |    4 ++++
 2 files changed, 24 insertions(+), 0 deletions(-)

diff --git a/policy/modules/kernel/domain.if b/policy/modules/kernel/domain.if
index 6a1e4d1..b900767 100644
--- a/policy/modules/kernel/domain.if
+++ b/policy/modules/kernel/domain.if
@@ -1531,3 +1531,23 @@ interface(`domain_unconfined',`
 	typeattribute $1 set_curr_context;
 	typeattribute $1 process_uncond_exempt;
 ')
+
+# Gentoo specific stuff, but I cannot use ifdef distro_gentoo in if files
+
+########################################
+## <summary>
+##	Do not audit getting the scheduler information of all domains.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`domain_dontaudit_getsched_all_domains',`
+	gen_require(`
+		attribute domain;
+	')
+
+	dontaudit $1 domain:process getsched;
+')

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index d8d000b..60e0fcc 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -733,6 +733,10 @@ template(`userdom_common_user_template',`
 	optional_policy(`
 		usernetctl_run($1_t, $1_r)
 	')
+
+	ifdef(`distro_gentoo',`
+		domain_dontaudit_getsched_all_domains($1_t)
+	')
 ')
 
 #######################################