[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/, policy/modules/system/

["Sven Vermeulen" <swift@gentoo.org>]

commit:     9f77e8ffa96b88b03bab2d2cee834c666de5a6b1
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Tue Dec 17 08:50:17 2013 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Tue Dec 17 08:50:17 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=9f77e8ff

Fix bug #489572 Add in daemon rundirs for automated file transitions

Various daemon init scripts use the tmpfiles feature to setup the run
directories. By default, this would create those directories with the
initrc_var_run_t type, which is incorrect.

We add in the necessary init_daemon_run_dir() statements to
automatically have the right context set.

---
 policy/modules/contrib/apache.te   | 3 +++
 policy/modules/contrib/ldap.te     | 6 ++++++
 policy/modules/contrib/mysql.te    | 4 ++++
 policy/modules/system/authlogin.te | 4 ++++
 4 files changed, 17 insertions(+)

diff --git a/policy/modules/contrib/apache.te b/policy/modules/contrib/apache.te
index 4960a8b..5608148 100644
--- a/policy/modules/contrib/apache.te
+++ b/policy/modules/contrib/apache.te
@@ -1421,4 +1421,7 @@ optional_policy(`
 ifdef(`distro_gentoo',`
 	attribute httpd_ra_content;
 	attribute httpd_rw_content;
+
+	init_daemon_run_dir(httpd_var_run_t, "apache_ssl_mutex")
+	init_daemon_run_dir(httpd_var_run_t, "apache2")
 ')

diff --git a/policy/modules/contrib/ldap.te b/policy/modules/contrib/ldap.te
index 7629d1e..d2d5e94 100644
--- a/policy/modules/contrib/ldap.te
+++ b/policy/modules/contrib/ldap.te
@@ -150,6 +150,12 @@ optional_policy(`
 ')
 
 ifdef(`distro_gentoo',`
+	init_daemon_rundir(slapd_var_run_t, "openldap")
+
+	########################################
+	#
+	# Local slapd_t policy
+	#
 	allow slapd_t self:process signal;
 	allow slapd_t self:unix_stream_socket listen;
 

diff --git a/policy/modules/contrib/mysql.te b/policy/modules/contrib/mysql.te
index 7584bbe..d425838 100644
--- a/policy/modules/contrib/mysql.te
+++ b/policy/modules/contrib/mysql.te
@@ -258,3 +258,7 @@ files_search_var_lib(mysqlmanagerd_t)
 miscfiles_read_localization(mysqlmanagerd_t)
 
 userdom_search_user_home_dirs(mysqlmanagerd_t)
+
+ifdef(`distro_gentoo',`
+	init_daemon_run_dir(mysqld_var_run_t, "mysqld")
+')

diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te
index 1e0390f..4f4116e 100644
--- a/policy/modules/system/authlogin.te
+++ b/policy/modules/system/authlogin.te
@@ -464,3 +464,7 @@ optional_policy(`
 	samba_read_var_files(nsswitch_domain)
 	samba_dontaudit_write_var_files(nsswitch_domain)
 ')
+
+ifdef(`distro_gentoo',`
+	init_daemon_rundir(pam_var_run_t, "sepermit")
+')