From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <gentoo-commits+bounces-631629-garchives=archives.gentoo.org@lists.gentoo.org> Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 53FF0138202 for <garchives@archives.gentoo.org>; Mon, 30 Sep 2013 19:03:42 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id A2F29E0AC0; Mon, 30 Sep 2013 19:03:41 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id D5C70E0AC0 for <gentoo-commits@lists.gentoo.org>; Mon, 30 Sep 2013 19:03:40 +0000 (UTC) Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id C893933E2EB for <gentoo-commits@lists.gentoo.org>; Mon, 30 Sep 2013 19:03:39 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by hornbill.gentoo.org (Postfix) with ESMTP id 82A2CE5464 for <gentoo-commits@lists.gentoo.org>; Mon, 30 Sep 2013 19:03:38 +0000 (UTC) From: "Sven Vermeulen" <swift@gentoo.org> To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" <swift@gentoo.org> Message-ID: <1380567652.35a8e7e6fe55cadb8bb8d163e9beb2c69e4e534b.swift@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/apt.fc policy/modules/contrib/apt.te policy/modules/contrib/backup.if policy/modules/contrib/backup.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: swift X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 35a8e7e6fe55cadb8bb8d163e9beb2c69e4e534b X-VCS-Branch: master Date: Mon, 30 Sep 2013 19:03:38 +0000 (UTC) Precedence: bulk List-Post: <mailto:gentoo-commits@lists.gentoo.org> List-Help: <mailto:gentoo-commits+help@lists.gentoo.org> List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org> List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org> List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org> X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 714ef355-5313-47e3-a37b-5e9295fc4919 X-Archives-Hash: 4d587c2e563de1a1013017962ce06e60 commit: 35a8e7e6fe55cadb8bb8d163e9beb2c69e4e534b Author: Dominick Grift <dominick.grift <AT> gmail <DOT> com> AuthorDate: Wed Sep 25 15:44:30 2013 +0000 Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org> CommitDate: Mon Sep 30 19:00:52 2013 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=35a8e7e6 apt: As it turns out the /var/backups directory is labeled in the backup module (which i incidentally did not have installed earlier). Instead of creating this file with a file type transition to apt_var_cache_t, allow apt_t to manage backup_store files Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com> --- policy/modules/contrib/apt.fc | 2 -- policy/modules/contrib/apt.te | 6 +++++- policy/modules/contrib/backup.if | 20 ++++++++++++++++++++ policy/modules/contrib/backup.te | 2 +- 4 files changed, 26 insertions(+), 4 deletions(-) diff --git a/policy/modules/contrib/apt.fc b/policy/modules/contrib/apt.fc index edb4fd4..7b20801 100644 --- a/policy/modules/contrib/apt.fc +++ b/policy/modules/contrib/apt.fc @@ -10,8 +10,6 @@ ifndef(`distro_redhat',` /var/lib/PackageKit(/.*)? gen_context(system_u:object_r:apt_var_lib_t,s0) ') -/var/backups/dpkg.* -- gen_context(system_u:object_r:apt_var_cache_t,s0) - /var/cache/apt(/.*)? gen_context(system_u:object_r:apt_var_cache_t,s0) /var/lib/apt(/.*)? gen_context(system_u:object_r:apt_var_lib_t,s0) diff --git a/policy/modules/contrib/apt.te b/policy/modules/contrib/apt.te index 90c630d..e423967 100644 --- a/policy/modules/contrib/apt.te +++ b/policy/modules/contrib/apt.te @@ -1,4 +1,4 @@ -policy_module(apt, 1.8.0) +policy_module(apt, 1.8.1) ######################################## # @@ -121,6 +121,10 @@ sysnet_read_config(apt_t) userdom_use_user_terminals(apt_t) optional_policy(` + backup_manage_store_files(apt_t) +') + +optional_policy(` cron_system_entry(apt_t, apt_exec_t) ') diff --git a/policy/modules/contrib/backup.if b/policy/modules/contrib/backup.if index 894810e..fe3f740 100644 --- a/policy/modules/contrib/backup.if +++ b/policy/modules/contrib/backup.if @@ -45,3 +45,23 @@ interface(`backup_run',` backup_domtrans($1) roleattribute $2 backup_roles; ') + +######################################## +## <summary> +## Create, read, and write backup +## store files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`backup_manage_store_files',` + gen_require(` + type backup_store_t; + ') + + files_search_var($1) + manage_files_pattern($1, backup_store_t, backup_store_t) +') diff --git a/policy/modules/contrib/backup.te b/policy/modules/contrib/backup.te index b9f8b55..1bb1e7f 100644 --- a/policy/modules/contrib/backup.te +++ b/policy/modules/contrib/backup.te @@ -1,4 +1,4 @@ -policy_module(backup, 1.6.0) +policy_module(backup, 1.6.1) ######################################## #