[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     4348e229ccdc8aee93f3b6f3a0f3801093dbf3f1
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Mon Dec 17 18:31:15 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Tue Dec 18 19:57:01 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=4348e229

Changes to the wdmd policy module and relevant dependencies

Executes corosync init script in initrc domain
Connects to corosync with a unix domain stream socket
Reads and writes corosync tmpfs files
Executes generic corecommand executables files and shells
Reads system state

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/corosync.if |   62 +++++++++++++++++++++++++++++++++++-
 policy/modules/contrib/corosync.te |    2 +-
 policy/modules/contrib/wdmd.te     |   13 +++++++-
 3 files changed, 74 insertions(+), 3 deletions(-)

diff --git a/policy/modules/contrib/corosync.if b/policy/modules/contrib/corosync.if
index dfdb4ae..694a037 100644
--- a/policy/modules/contrib/corosync.if
+++ b/policy/modules/contrib/corosync.if
@@ -19,6 +19,25 @@ interface(`corosync_domtrans',`
 	domtrans_pattern($1, corosync_exec_t, corosync_t)
 ')
 
+########################################
+## <summary>
+##	Execute corosync init scripts in
+##	the init script domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`corosync_initrc_domtrans',`
+	gen_require(`
+		type corosync_initrc_exec_t;
+	')
+
+	init_labeled_script_domtrans($1, corosync_initrc_exec_t)
+')
+
 ######################################
 ## <summary>
 ##	Execute corosync in the caller domain.
@@ -80,6 +99,25 @@ interface(`corosync_stream_connect',`
 
 ######################################
 ## <summary>
+##	Read and write corosync tmpfs files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`corosync_rw_tmpfs',`
+	gen_require(`
+		type corosync_tmpfs_t;
+	')
+
+	fs_search_tmpfs($1)
+	rw_files_pattern($1, corosync_tmpfs_t, corosync_tmpfs_t)
+')
+
+######################################
+## <summary>
 ##	All of the rules required to
 ##	administrate an corosync environment.
 ## </summary>
@@ -96,6 +134,28 @@ interface(`corosync_stream_connect',`
 ## <rolecap/>
 #
 interface(`corosyncd_admin',`
+	refpolicywarn(`$0($*) has been deprecated, use corosync_admin() instead.')
+	corosync_admin($1, $2)
+')
+
+######################################
+## <summary>
+##	All of the rules required to
+##	administrate an corosync environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`corosync_admin',`
 	gen_require(`
 		type corosync_t, corosync_var_lib_t, corosync_var_log_t;
 		type corosync_var_run_t, corosync_tmp_t, corosync_tmpfs_t;
@@ -105,7 +165,7 @@ interface(`corosyncd_admin',`
 	allow $1 corosync_t:process { ptrace signal_perms };
 	ps_process_pattern($1, corosync_t)
 
-	init_labeled_script_domtrans($1, corosync_initrc_exec_t)
+	corosync_initrc_domtrans($1)
 	domain_system_change_exemption($1)
 	role_transition $2 corosync_initrc_exec_t system_r;
 	allow $2 system_r;

diff --git a/policy/modules/contrib/corosync.te b/policy/modules/contrib/corosync.te
index 93a7c65..eeea48d 100644
--- a/policy/modules/contrib/corosync.te
+++ b/policy/modules/contrib/corosync.te
@@ -1,4 +1,4 @@
-policy_module(corosync, 1.0.6)
+policy_module(corosync, 1.0.7)
 
 ########################################
 #

diff --git a/policy/modules/contrib/wdmd.te b/policy/modules/contrib/wdmd.te
index d21df6f..ebbdaf6 100644
--- a/policy/modules/contrib/wdmd.te
+++ b/policy/modules/contrib/wdmd.te
@@ -1,4 +1,4 @@
-policy_module(wdmd, 1.0.2)
+policy_module(wdmd, 1.0.3)
 
 ########################################
 #
@@ -37,6 +37,11 @@ manage_dirs_pattern(wdmd_t, wdmd_tmpfs_t, wdmd_tmpfs_t)
 manage_files_pattern(wdmd_t, wdmd_tmpfs_t, wdmd_tmpfs_t)
 fs_tmpfs_filetrans(wdmd_t, wdmd_tmpfs_t, { dir file })
 
+kernel_read_system_state(wdmd_t)
+
+corecmd_exec_bin(wdmd_t)
+corecmd_exec_shell(wdmd_t)
+
 dev_read_watchdog(wdmd_t)
 dev_write_watchdog(wdmd_t)
 
@@ -47,3 +52,9 @@ auth_use_nsswitch(wdmd_t)
 logging_send_syslog_msg(wdmd_t)
 
 miscfiles_read_localization(wdmd_t)
+
+optional_policy(`
+	corosync_initrc_domtrans(wdmd_t)
+	corosync_stream_connect(wdmd_t)
+	corosync_rw_tmpfs(wdmd_t)
+')