From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id D85201381F3 for ; Mon, 23 Sep 2013 06:29:52 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 13932E09F8; Mon, 23 Sep 2013 06:29:37 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 3D9B7E09F9 for ; Mon, 23 Sep 2013 06:29:31 +0000 (UTC) Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 1539333ED52 for ; Mon, 23 Sep 2013 06:29:30 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by hornbill.gentoo.org (Postfix) with ESMTP id D2BD0E5459 for ; Mon, 23 Sep 2013 06:29:27 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1379917719.1e570633210d20c462a98fdfa0c3a23e9a2652ec.SwifT@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:merge commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/redis.fc policy/modules/contrib/redis.if policy/modules/contrib/redis.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: SwifT X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 1e570633210d20c462a98fdfa0c3a23e9a2652ec X-VCS-Branch: merge Date: Mon, 23 Sep 2013 06:29:27 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 0302c318-9819-4004-93fe-b9ffd0c832f0 X-Archives-Hash: b75ba89afe0e8c9fd0f70eac44d66fa0 commit: 1e570633210d20c462a98fdfa0c3a23e9a2652ec Author: Dominick Grift gmail com> AuthorDate: Fri Sep 20 07:28:45 2013 +0000 Commit: Sven Vermeulen siphos be> CommitDate: Mon Sep 23 06:28:39 2013 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=1e570633 Clean up initial redis policy module Need a redis port type Signed-off-by: Dominick Grift gmail.com> --- policy/modules/contrib/redis.fc | 10 +- policy/modules/contrib/redis.if | 243 ++-------------------------------------- policy/modules/contrib/redis.te | 15 ++- 3 files changed, 20 insertions(+), 248 deletions(-) diff --git a/policy/modules/contrib/redis.fc b/policy/modules/contrib/redis.fc index 638d6b4..e240ac9 100644 --- a/policy/modules/contrib/redis.fc +++ b/policy/modules/contrib/redis.fc @@ -1,11 +1,9 @@ /etc/rc\.d/init\.d/redis -- gen_context(system_u:object_r:redis_initrc_exec_t,s0) -/usr/lib/systemd/system/redis.* -- gen_context(system_u:object_r:redis_unit_file_t,s0) +/usr/sbin/redis-server -- gen_context(system_u:object_r:redis_exec_t,s0) -/usr/sbin/redis-server -- gen_context(system_u:object_r:redis_exec_t,s0) +/var/lib/redis(/.*)? gen_context(system_u:object_r:redis_var_lib_t,s0) -/var/lib/redis(/.*)? gen_context(system_u:object_r:redis_var_lib_t,s0) +/var/log/redis(/.*)? gen_context(system_u:object_r:redis_log_t,s0) -/var/log/redis(/.*)? gen_context(system_u:object_r:redis_log_t,s0) - -/var/run/redis(/.*)? gen_context(system_u:object_r:redis_var_run_t,s0) +/var/run/redis(/.*)? gen_context(system_u:object_r:redis_var_run_t,s0) diff --git a/policy/modules/contrib/redis.if b/policy/modules/contrib/redis.if index e3efff0..16c8ecb 100644 --- a/policy/modules/contrib/redis.if +++ b/policy/modules/contrib/redis.if @@ -1,226 +1,9 @@ - -## policy for redis - -######################################## -## -## Execute TEMPLATE in the redis domin. -## -## -## -## Domain allowed to transition. -## -## -# -interface(`redis_domtrans',` - gen_require(` - type redis_t, redis_exec_t; - ') - - corecmd_search_bin($1) - domtrans_pattern($1, redis_exec_t, redis_t) -') - -######################################## -## -## Execute redis server in the redis domain. -## -## -## -## Domain allowed access. -## -## -# -interface(`redis_initrc_domtrans',` - gen_require(` - type redis_initrc_exec_t; - ') - - init_labeled_script_domtrans($1, redis_initrc_exec_t) -') -######################################## -## -## Read redis's log files. -## -## -## -## Domain allowed access. -## -## -## -# -interface(`redis_read_log',` - gen_require(` - type redis_log_t; - ') - - logging_search_logs($1) - read_files_pattern($1, redis_log_t, redis_log_t) -') - -######################################## -## -## Append to redis log files. -## -## -## -## Domain allowed access. -## -## -# -interface(`redis_append_log',` - gen_require(` - type redis_log_t; - ') - - logging_search_logs($1) - append_files_pattern($1, redis_log_t, redis_log_t) -') - -######################################## -## -## Manage redis log files -## -## -## -## Domain allowed access. -## -## -# -interface(`redis_manage_log',` - gen_require(` - type redis_log_t; - ') - - logging_search_logs($1) - manage_dirs_pattern($1, redis_log_t, redis_log_t) - manage_files_pattern($1, redis_log_t, redis_log_t) - manage_lnk_files_pattern($1, redis_log_t, redis_log_t) -') - -######################################## -## -## Search redis lib directories. -## -## -## -## Domain allowed access. -## -## -# -interface(`redis_search_lib',` - gen_require(` - type redis_var_lib_t; - ') - - allow $1 redis_var_lib_t:dir search_dir_perms; - files_search_var_lib($1) -') - -######################################## -## -## Read redis lib files. -## -## -## -## Domain allowed access. -## -## -# -interface(`redis_read_lib_files',` - gen_require(` - type redis_var_lib_t; - ') - - files_search_var_lib($1) - read_files_pattern($1, redis_var_lib_t, redis_var_lib_t) -') - -######################################## -## -## Manage redis lib files. -## -## -## -## Domain allowed access. -## -## -# -interface(`redis_manage_lib_files',` - gen_require(` - type redis_var_lib_t; - ') - - files_search_var_lib($1) - manage_files_pattern($1, redis_var_lib_t, redis_var_lib_t) -') - -######################################## -## -## Manage redis lib directories. -## -## -## -## Domain allowed access. -## -## -# -interface(`redis_manage_lib_dirs',` - gen_require(` - type redis_var_lib_t; - ') - - files_search_var_lib($1) - manage_dirs_pattern($1, redis_var_lib_t, redis_var_lib_t) -') - -######################################## -## -## Read redis PID files. -## -## -## -## Domain allowed access. -## -## -# -interface(`redis_read_pid_files',` - gen_require(` - type redis_var_run_t; - ') - - files_search_pids($1) - read_files_pattern($1, redis_var_run_t, redis_var_run_t) -') +## Advanced key-value store. ######################################## ## -## Execute redis server in the redis domain. -## -## -## -## Domain allowed to transition. -## -## -# -interface(`redis_systemctl',` - gen_require(` - type redis_t; - type redis_unit_file_t; - ') - - systemd_exec_systemctl($1) - systemd_read_fifo_file_password_run($1) - allow $1 redis_unit_file_t:file read_file_perms; - allow $1 redis_unit_file_t:service manage_service_perms; - - ps_process_pattern($1, redis_t) -') - - -######################################## -## -## All of the rules required to administrate -## an redis environment +## All of the rules required to +## administrate an redis environment. ## ## ## @@ -236,36 +19,24 @@ interface(`redis_systemctl',` # interface(`redis_admin',` gen_require(` - type redis_t; - type redis_initrc_exec_t; - type redis_log_t; - type redis_var_lib_t; - type redis_var_run_t; - type redis_unit_file_t; + type redis_t, redis_initrc_exec_t, redis_var_lib_t; + type redis_log_t, redis_var_run_t; ') allow $1 redis_t:process { ptrace signal_perms }; ps_process_pattern($1, redis_t) - redis_initrc_domtrans($1) + init_labeled_script_domtrans($1, redis_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 redis_initrc_exec_t system_r; allow $2 system_r; logging_search_logs($1) - admin_pattern($1, redis_log_t) + admin_pattern($!, redis_log_t) files_search_var_lib($1) admin_pattern($1, redis_var_lib_t) files_search_pids($1) admin_pattern($1, redis_var_run_t) - - redis_systemctl($1) - admin_pattern($1, redis_unit_file_t) - allow $1 redis_unit_file_t:service all_service_perms; - optional_policy(` - systemd_passwd_agent_exec($1) - systemd_read_fifo_file_passwd_run($1) - ') ') diff --git a/policy/modules/contrib/redis.te b/policy/modules/contrib/redis.te index e5e9cf7..f98e40e 100644 --- a/policy/modules/contrib/redis.te +++ b/policy/modules/contrib/redis.te @@ -21,12 +21,9 @@ files_type(redis_var_lib_t) type redis_var_run_t; files_pid_file(redis_var_run_t) -type redis_unit_file_t; -systemd_unit_file(redis_unit_file_t) - ######################################## # -# redis local policy +# Local policy # allow redis_t self:process { setrlimit signal_perms }; @@ -48,8 +45,15 @@ manage_lnk_files_pattern(redis_t, redis_var_run_t, redis_var_run_t) kernel_read_system_state(redis_t) +corenet_all_recvfrom_unlabeled(redis_t) +corenet_all_recvfrom_netlabel(redis_t) +corenet_tcp_sendrecv_generic_if(redis_t) +corenet_tcp_sendrecv_generic_node(redis_t) corenet_tcp_bind_generic_node(redis_t) -corenet_tcp_bind_redis_port(redis_t) + +# corenet_sendrecv_redis_server_packets(redis_t) +# corenet_tcp_bind_redis_port(redis_t) +# corenet_tcp_sendrecv_redis_port(redis_t) dev_read_sysfs(redis_t) dev_read_urand(redis_t) @@ -59,4 +63,3 @@ logging_send_syslog_msg(redis_t) miscfiles_read_localization(redis_t) sysnet_dns_name_resolve(redis_t) - From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 343031381F3 for ; Mon, 23 Sep 2013 13:32:13 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 5A0BFE0AF2; Mon, 23 Sep 2013 13:31:58 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id CF102E0AF2 for ; Mon, 23 Sep 2013 13:31:52 +0000 (UTC) Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id A433933ED93 for ; Mon, 23 Sep 2013 13:31:46 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by hornbill.gentoo.org (Postfix) with ESMTP id 34C3AE5470 for ; Mon, 23 Sep 2013 13:31:44 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1379917719.1e570633210d20c462a98fdfa0c3a23e9a2652ec.SwifT@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/redis.fc policy/modules/contrib/redis.if policy/modules/contrib/redis.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: SwifT X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 1e570633210d20c462a98fdfa0c3a23e9a2652ec X-VCS-Branch: master Date: Mon, 23 Sep 2013 13:31:44 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 288b196e-3009-48ea-bc8e-52d3594d5aab X-Archives-Hash: 23fd99f6c789533c01e1e71f507cd747 Message-ID: <20130923133144.D2knUutvwT_pd_WJxNJhqzVabF9Ahzmp7sm3ZIbsBZk@z> commit: 1e570633210d20c462a98fdfa0c3a23e9a2652ec Author: Dominick Grift gmail com> AuthorDate: Fri Sep 20 07:28:45 2013 +0000 Commit: Sven Vermeulen siphos be> CommitDate: Mon Sep 23 06:28:39 2013 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=1e570633 Clean up initial redis policy module Need a redis port type Signed-off-by: Dominick Grift gmail.com> --- policy/modules/contrib/redis.fc | 10 +- policy/modules/contrib/redis.if | 243 ++-------------------------------------- policy/modules/contrib/redis.te | 15 ++- 3 files changed, 20 insertions(+), 248 deletions(-) diff --git a/policy/modules/contrib/redis.fc b/policy/modules/contrib/redis.fc index 638d6b4..e240ac9 100644 --- a/policy/modules/contrib/redis.fc +++ b/policy/modules/contrib/redis.fc @@ -1,11 +1,9 @@ /etc/rc\.d/init\.d/redis -- gen_context(system_u:object_r:redis_initrc_exec_t,s0) -/usr/lib/systemd/system/redis.* -- gen_context(system_u:object_r:redis_unit_file_t,s0) +/usr/sbin/redis-server -- gen_context(system_u:object_r:redis_exec_t,s0) -/usr/sbin/redis-server -- gen_context(system_u:object_r:redis_exec_t,s0) +/var/lib/redis(/.*)? gen_context(system_u:object_r:redis_var_lib_t,s0) -/var/lib/redis(/.*)? gen_context(system_u:object_r:redis_var_lib_t,s0) +/var/log/redis(/.*)? gen_context(system_u:object_r:redis_log_t,s0) -/var/log/redis(/.*)? gen_context(system_u:object_r:redis_log_t,s0) - -/var/run/redis(/.*)? gen_context(system_u:object_r:redis_var_run_t,s0) +/var/run/redis(/.*)? gen_context(system_u:object_r:redis_var_run_t,s0) diff --git a/policy/modules/contrib/redis.if b/policy/modules/contrib/redis.if index e3efff0..16c8ecb 100644 --- a/policy/modules/contrib/redis.if +++ b/policy/modules/contrib/redis.if @@ -1,226 +1,9 @@ - -## policy for redis - -######################################## -## -## Execute TEMPLATE in the redis domin. -## -## -## -## Domain allowed to transition. -## -## -# -interface(`redis_domtrans',` - gen_require(` - type redis_t, redis_exec_t; - ') - - corecmd_search_bin($1) - domtrans_pattern($1, redis_exec_t, redis_t) -') - -######################################## -## -## Execute redis server in the redis domain. -## -## -## -## Domain allowed access. -## -## -# -interface(`redis_initrc_domtrans',` - gen_require(` - type redis_initrc_exec_t; - ') - - init_labeled_script_domtrans($1, redis_initrc_exec_t) -') -######################################## -## -## Read redis's log files. -## -## -## -## Domain allowed access. -## -## -## -# -interface(`redis_read_log',` - gen_require(` - type redis_log_t; - ') - - logging_search_logs($1) - read_files_pattern($1, redis_log_t, redis_log_t) -') - -######################################## -## -## Append to redis log files. -## -## -## -## Domain allowed access. -## -## -# -interface(`redis_append_log',` - gen_require(` - type redis_log_t; - ') - - logging_search_logs($1) - append_files_pattern($1, redis_log_t, redis_log_t) -') - -######################################## -## -## Manage redis log files -## -## -## -## Domain allowed access. -## -## -# -interface(`redis_manage_log',` - gen_require(` - type redis_log_t; - ') - - logging_search_logs($1) - manage_dirs_pattern($1, redis_log_t, redis_log_t) - manage_files_pattern($1, redis_log_t, redis_log_t) - manage_lnk_files_pattern($1, redis_log_t, redis_log_t) -') - -######################################## -## -## Search redis lib directories. -## -## -## -## Domain allowed access. -## -## -# -interface(`redis_search_lib',` - gen_require(` - type redis_var_lib_t; - ') - - allow $1 redis_var_lib_t:dir search_dir_perms; - files_search_var_lib($1) -') - -######################################## -## -## Read redis lib files. -## -## -## -## Domain allowed access. -## -## -# -interface(`redis_read_lib_files',` - gen_require(` - type redis_var_lib_t; - ') - - files_search_var_lib($1) - read_files_pattern($1, redis_var_lib_t, redis_var_lib_t) -') - -######################################## -## -## Manage redis lib files. -## -## -## -## Domain allowed access. -## -## -# -interface(`redis_manage_lib_files',` - gen_require(` - type redis_var_lib_t; - ') - - files_search_var_lib($1) - manage_files_pattern($1, redis_var_lib_t, redis_var_lib_t) -') - -######################################## -## -## Manage redis lib directories. -## -## -## -## Domain allowed access. -## -## -# -interface(`redis_manage_lib_dirs',` - gen_require(` - type redis_var_lib_t; - ') - - files_search_var_lib($1) - manage_dirs_pattern($1, redis_var_lib_t, redis_var_lib_t) -') - -######################################## -## -## Read redis PID files. -## -## -## -## Domain allowed access. -## -## -# -interface(`redis_read_pid_files',` - gen_require(` - type redis_var_run_t; - ') - - files_search_pids($1) - read_files_pattern($1, redis_var_run_t, redis_var_run_t) -') +## Advanced key-value store. ######################################## ## -## Execute redis server in the redis domain. -## -## -## -## Domain allowed to transition. -## -## -# -interface(`redis_systemctl',` - gen_require(` - type redis_t; - type redis_unit_file_t; - ') - - systemd_exec_systemctl($1) - systemd_read_fifo_file_password_run($1) - allow $1 redis_unit_file_t:file read_file_perms; - allow $1 redis_unit_file_t:service manage_service_perms; - - ps_process_pattern($1, redis_t) -') - - -######################################## -## -## All of the rules required to administrate -## an redis environment +## All of the rules required to +## administrate an redis environment. ## ## ## @@ -236,36 +19,24 @@ interface(`redis_systemctl',` # interface(`redis_admin',` gen_require(` - type redis_t; - type redis_initrc_exec_t; - type redis_log_t; - type redis_var_lib_t; - type redis_var_run_t; - type redis_unit_file_t; + type redis_t, redis_initrc_exec_t, redis_var_lib_t; + type redis_log_t, redis_var_run_t; ') allow $1 redis_t:process { ptrace signal_perms }; ps_process_pattern($1, redis_t) - redis_initrc_domtrans($1) + init_labeled_script_domtrans($1, redis_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 redis_initrc_exec_t system_r; allow $2 system_r; logging_search_logs($1) - admin_pattern($1, redis_log_t) + admin_pattern($!, redis_log_t) files_search_var_lib($1) admin_pattern($1, redis_var_lib_t) files_search_pids($1) admin_pattern($1, redis_var_run_t) - - redis_systemctl($1) - admin_pattern($1, redis_unit_file_t) - allow $1 redis_unit_file_t:service all_service_perms; - optional_policy(` - systemd_passwd_agent_exec($1) - systemd_read_fifo_file_passwd_run($1) - ') ') diff --git a/policy/modules/contrib/redis.te b/policy/modules/contrib/redis.te index e5e9cf7..f98e40e 100644 --- a/policy/modules/contrib/redis.te +++ b/policy/modules/contrib/redis.te @@ -21,12 +21,9 @@ files_type(redis_var_lib_t) type redis_var_run_t; files_pid_file(redis_var_run_t) -type redis_unit_file_t; -systemd_unit_file(redis_unit_file_t) - ######################################## # -# redis local policy +# Local policy # allow redis_t self:process { setrlimit signal_perms }; @@ -48,8 +45,15 @@ manage_lnk_files_pattern(redis_t, redis_var_run_t, redis_var_run_t) kernel_read_system_state(redis_t) +corenet_all_recvfrom_unlabeled(redis_t) +corenet_all_recvfrom_netlabel(redis_t) +corenet_tcp_sendrecv_generic_if(redis_t) +corenet_tcp_sendrecv_generic_node(redis_t) corenet_tcp_bind_generic_node(redis_t) -corenet_tcp_bind_redis_port(redis_t) + +# corenet_sendrecv_redis_server_packets(redis_t) +# corenet_tcp_bind_redis_port(redis_t) +# corenet_tcp_sendrecv_redis_port(redis_t) dev_read_sysfs(redis_t) dev_read_urand(redis_t) @@ -59,4 +63,3 @@ logging_send_syslog_msg(redis_t) miscfiles_read_localization(redis_t) sysnet_dns_name_resolve(redis_t) -