From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id E7C8313877A for ; Wed, 6 Aug 2014 08:59:42 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id CA069E09E7; Wed, 6 Aug 2014 08:59:40 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 3E603E09E8 for ; Wed, 6 Aug 2014 08:59:40 +0000 (UTC) Received: from spoonbill.gentoo.org (spoonbill.gentoo.org [81.93.255.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 2EB09340192 for ; Wed, 6 Aug 2014 08:59:39 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by spoonbill.gentoo.org (Postfix) with ESMTP id EDEF218818 for ; Wed, 6 Aug 2014 08:59:37 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1407315358.5ab608b73df8c4d2c57522515de0f67c9a09dc9c.swift@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:testing commit in: policy/modules/kernel/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/kernel/files.if X-VCS-Directories: policy/modules/kernel/ X-VCS-Committer: swift X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 5ab608b73df8c4d2c57522515de0f67c9a09dc9c X-VCS-Branch: testing Date: Wed, 6 Aug 2014 08:59:37 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 4a6da1a4-8e3f-4b5b-8f56-ba72fed3f523 X-Archives-Hash: bb09cff1790bb43ce82a9582a15110bd commit: 5ab608b73df8c4d2c57522515de0f67c9a09dc9c Author: Sven Vermeulen siphos be> AuthorDate: Wed Aug 6 08:55:58 2014 +0000 Commit: Sven Vermeulen gentoo org> CommitDate: Wed Aug 6 08:55:58 2014 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=5ab608b7 Comment out seutil_relabelto_bin_policy We comment out the use of the seutil_relabelto_bin_policy call in the files_relabel_non_auth_files interface. This allows us to set this interface in a tunable statement, like so: seutil_relabelto_bin_policy(foo_t) tunable_policy(`foo_relabel_non_auth_files',` files_relabel_non_auth_files(foo_t) ') In larger entries, this allows us to have a minimalistic policy (a domain only allowed to manage and relabel a certain set of file types) and, through a boolean, enable it to manage and relabel a larger set of types. --- policy/modules/kernel/files.if | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if index 3f20525..ca278d5 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -1445,7 +1445,9 @@ interface(`files_relabel_non_auth_files',` relabelfrom_chr_files_pattern($1, non_auth_file_type, non_auth_file_type) # satisfy the assertions: - seutil_relabelto_bin_policy($1) + # seutil_relabelto_bin_policy($1) + # Gentoo: this is removed as we do not want to set attributes in this phase, we want + # to allow files_relabel_non_auth_files to be an optional setting (tunable). ')