From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 1393C1381F3 for ; Mon, 23 Sep 2013 13:32:10 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 46EA0E0AFC; Mon, 23 Sep 2013 13:32:03 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id B14E8E0AF9 for ; Mon, 23 Sep 2013 13:31:47 +0000 (UTC) Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id A41B333ED90 for ; Mon, 23 Sep 2013 13:31:46 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by hornbill.gentoo.org (Postfix) with ESMTP id 55E64E5471 for ; Mon, 23 Sep 2013 13:31:44 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1379917721.1885a6b8dbea8123e438d8b17ceb6aaf80bca8f8.SwifT@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/openvpn.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: SwifT X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 1885a6b8dbea8123e438d8b17ceb6aaf80bca8f8 X-VCS-Branch: master Date: Mon, 23 Sep 2013 13:31:44 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 7cb0023f-0de1-4238-a90a-d08668756f89 X-Archives-Hash: e692b5724e85f53a74756852cb2a7251 commit: 1885a6b8dbea8123e438d8b17ceb6aaf80bca8f8 Author: Miroslav Grepl redhat com> AuthorDate: Tue Aug 20 09:09:06 2013 +0000 Commit: Sven Vermeulen siphos be> CommitDate: Mon Sep 23 06:28:41 2013 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=1885a6b8 Add openvpn_can_network_connect() boolean --- policy/modules/contrib/openvpn.te | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/policy/modules/contrib/openvpn.te b/policy/modules/contrib/openvpn.te index 1c3599a..5816817 100644 --- a/policy/modules/contrib/openvpn.te +++ b/policy/modules/contrib/openvpn.te @@ -13,6 +13,14 @@ policy_module(openvpn, 1.12.1) ## gen_tunable(openvpn_enable_homedirs, false) +## +##

+## Determine whether openvpn can +## connect to the TCP network. +##

+## +gen_tunable(openvpn_can_network_connect, false) + attribute_role openvpn_roles; type openvpn_t; @@ -149,6 +157,10 @@ tunable_policy(`openvpn_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(openvpn_t) ') +tunable_policy(`openvpn_can_network_connect',` + corenet_tcp_connect_all_ports(openvpn_t) +') + optional_policy(` daemontools_service_domain(openvpn_t, openvpn_exec_t) ') From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 383F01381F3 for ; Mon, 23 Sep 2013 06:29:51 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 13FF9E09F9; Mon, 23 Sep 2013 06:29:37 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 2F4EDE09F1 for ; Mon, 23 Sep 2013 06:29:31 +0000 (UTC) Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 3A1AF33ED5E for ; Mon, 23 Sep 2013 06:29:30 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by hornbill.gentoo.org (Postfix) with ESMTP id F13F1E5471 for ; Mon, 23 Sep 2013 06:29:27 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1379917721.1885a6b8dbea8123e438d8b17ceb6aaf80bca8f8.SwifT@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:merge commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/openvpn.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: SwifT X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 1885a6b8dbea8123e438d8b17ceb6aaf80bca8f8 X-VCS-Branch: merge Date: Mon, 23 Sep 2013 06:29:27 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 50c09bb0-4ebe-42db-8d53-43f7b5a331eb X-Archives-Hash: 814501fabdb9b6181de74c27b748f90c Message-ID: <20130923062927.w9UZKtz3uyIb1_0XrQ5YhnEbjLnFhF8AUOcClYMR9Nc@z> commit: 1885a6b8dbea8123e438d8b17ceb6aaf80bca8f8 Author: Miroslav Grepl redhat com> AuthorDate: Tue Aug 20 09:09:06 2013 +0000 Commit: Sven Vermeulen siphos be> CommitDate: Mon Sep 23 06:28:41 2013 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=1885a6b8 Add openvpn_can_network_connect() boolean --- policy/modules/contrib/openvpn.te | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/policy/modules/contrib/openvpn.te b/policy/modules/contrib/openvpn.te index 1c3599a..5816817 100644 --- a/policy/modules/contrib/openvpn.te +++ b/policy/modules/contrib/openvpn.te @@ -13,6 +13,14 @@ policy_module(openvpn, 1.12.1) ## gen_tunable(openvpn_enable_homedirs, false) +## +##

+## Determine whether openvpn can +## connect to the TCP network. +##

+## +gen_tunable(openvpn_can_network_connect, false) + attribute_role openvpn_roles; type openvpn_t; @@ -149,6 +157,10 @@ tunable_policy(`openvpn_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(openvpn_t) ') +tunable_policy(`openvpn_can_network_connect',` + corenet_tcp_connect_all_ports(openvpn_t) +') + optional_policy(` daemontools_service_domain(openvpn_t, openvpn_exec_t) ')