[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/kernel/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     f73af58302e0a58ce615f51a71b9676bd26633cc
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Fri Aug 23 08:06:20 2013 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Fri Aug 23 08:06:20 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=f73af583

Automatic filetrans to modules_object_t for /lib/modules

As per bug #428322, if /lib/modules does not exist, then "make modules_install"
will fail as it creates a directory (/lib/modules) with the wrong type (lib_t
instead of modules_object_t).

Add in a file transition when a directory named "modules" is created in a lib_t
location, transitioning to modules_object_t.

Had to add in the libs_lib_filetrans (from lib_t)
Had to add in the files_lib_filetrans_kernel_modules (to modules_object_t)

---
 policy/modules/kernel/files.if     | 30 ++++++++++++++++++++++++++++++
 policy/modules/system/libraries.if | 36 ++++++++++++++++++++++++++++++++++++
 policy/modules/system/modutils.te  |  1 +
 3 files changed, 67 insertions(+)

diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index a544f27..56c83f6 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -6661,3 +6661,33 @@ interface(`files_read_src_files',`
 
 	read_files_pattern($1, src_t, src_t)
 ')
+
+##########################################
+## <summary>
+##	Create a resource in the generic lib location
+##	with an automatic type transition towards the kernel modules
+##	type
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+## <param name="class">
+##	<summary>
+##	Class of the created resource for which a type transition should occur
+##	</summary>
+## </param>
+## <param name="filename" optional="true">
+##	<summary>
+##	Optional name of the resource
+##	</summary>
+## </param>
+#
+interface(`files_lib_filetrans_kernel_modules',`
+	gen_require(`
+		type modules_object_t;
+	')
+
+	libs_lib_filetrans($1, modules_object_t, $2, $3)
+')

diff --git a/policy/modules/system/libraries.if b/policy/modules/system/libraries.if
index 41a44f3..a83933f 100644
--- a/policy/modules/system/libraries.if
+++ b/policy/modules/system/libraries.if
@@ -567,3 +567,39 @@ interface(`libs_generic_etc_filetrans_ld_so_cache',`
 
 	files_etc_filetrans($1, ld_so_cache_t, $2, $3)
 ')
+
+##########################################
+## <summary>
+##	Create an object in the generic lib location with a type transition
+##	to the provided type
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+## <param name="target">
+##	<summary>
+##	Target domain towards which a type transition should occur
+##	</summary>
+## </param>
+## <param name="class">
+##	<summary>
+##	Class of the resource for which a type transition occurs.
+##	</summary>
+## </param>
+## <param name="filetrans" optional="true">
+##	<summary>
+##	Name of the resource created for which a type transition should occur
+##	</summary>
+## </param>
+#
+interface(`libs_lib_filetrans',`
+	gen_require(`
+		type lib_t;
+	')
+
+	filetrans_pattern($1, lib_t, $2, $3, $4)
+
+	libs_search_lib($1)
+')

diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
index b7d820c..4c0f286 100644
--- a/policy/modules/system/modutils.te
+++ b/policy/modules/system/modutils.te
@@ -338,4 +338,5 @@ ifdef(`distro_gentoo',`
 
 	files_read_src_files(insmod_t)
 	files_manage_kernel_modules(insmod_t)
+	files_lib_filetrans_kernel_modules(insmod_t, dir, "modules")
 ')