[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <swift@gentoo.org>]

commit:     ee154a5d02d8ee55ec048796017ec187ad888b43
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Sun Nov  3 11:16:14 2013 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Sun Nov  3 11:16:14 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=ee154a5d

Support self-update of Portage

When Portage is asked to update itself, it triggers a specific procedure
(in portage/pym/portage/package/ebuild/doebuild.py, a method called
_prepare_self_update).

In this method, it will create a temporary copy of PORTAGE_BIN_PATH and
PORTAGE_PYM_PATH (which are bin_t, lib_t and some specific Portage
types).

During this copy, it needs to set the proper labels on the files, which
is why we now allow the various relabel operations.

---
 policy/modules/contrib/portage.te | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/policy/modules/contrib/portage.te b/policy/modules/contrib/portage.te
index 533919c..5230679 100644
--- a/policy/modules/contrib/portage.te
+++ b/policy/modules/contrib/portage.te
@@ -395,12 +395,25 @@ ifdef(`distro_gentoo',`
 	#
 	allow portage_t self:capability2 block_suspend;
 
+	# Support self-update of Portage
+	allow portage_t portage_tmp_t:dir relabel_dir_perms;
+	allow portage_t portage_tmp_t:lnk_file relabel_lnk_file_perms;
+	allow portage_t portage_exec_t:file relabel_file_perms;
+	allow portage_t portage_fetch_exec_t:file relabel_file_perms;
+
 	# Portage is selinuxaware, transitions on calling ebuild, now marked as bin_t
 	corecmd_bin_entry_type(portage_t)
+	# Support self-update of Portage
+	corecmd_relabel_bin_dirs(portage_t)
+	corecmd_relabel_bin_files(portage_t)
+	corecmd_relabel_bin_lnk_files(portage_t)
 
 	auth_use_nsswitch(portage_t)
 
 	libs_generic_etc_filetrans_ld_so_cache(portage_t, file, "ld.so.cache~")
+	# Support self-update of Portage
+	libs_relabel_lib_dirs(portage_t)
+	libs_relabel_lib_files(portage_t)
 
 	##########################################
 	#