[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <swift@gentoo.org>]

commit:     c2d10ed6ad80c4c442bc939a97996159b8eec3c3
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Wed Sep 25 18:04:33 2013 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Wed Sep 25 18:04:33 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=c2d10ed6

Add portage_ro_role to allow read-only access to Portage files

The portage_ro_role() can be assigned to users who are allowed to view
Portage related files but not touch them or switch to the portage
domains.

Patch initially brought forward by Luis Ressel, adapted to match coding
style & separate dontaudit into its own interface.

---
 policy/modules/contrib/portage.if | 61 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/policy/modules/contrib/portage.if b/policy/modules/contrib/portage.if
index fd1ae2a..fe656fa 100644
--- a/policy/modules/contrib/portage.if
+++ b/policy/modules/contrib/portage.if
@@ -385,6 +385,49 @@ interface(`portage_eselect_module',`
 
 ########################################
 ## <summary>
+##	Read all portage files
+## </summary>
+## <param name="role">
+##	<summary>
+##	Role allowed access
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+#
+interface(`portage_ro_role',`
+	portage_read_cache($1)
+	portage_read_config($1)
+	portage_read_db($1)
+	portage_read_ebuild($1)
+	portage_dontaudit_write_cache($1)
+')
+
+########################################
+## <summary>
+##	Read portage db files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+#
+interface(`portage_read_db',`
+	gen_require(`
+		type portage_db_t;
+	')
+
+	files_search_var($1)
+	list_dirs_pattern($1, portage_db_t, portage_db_t)
+	read_files_pattern($1, portage_db_t, portage_db_t)
+')
+
+########################################
+## <summary>
 ##	Read portage cache files
 ## </summary>
 ## <param name="domain">
@@ -446,3 +489,21 @@ interface(`portage_read_ebuild',`
 	read_lnk_files_pattern($1, portage_ebuild_t, portage_ebuild_t)
 ')
 
+########################################
+## <summary>
+##	Do not audit writing portage cache files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+#
+interface(`portage_dontaudit_write_cache',`
+	gen_require(`
+		type portage_cache_t;
+	')
+
+	dontaudit $1 portage_cache_t:dir { write };
+')
+