[gentoo-commits] proj/hardened-refpolicy:testing commit in: policy/modules/kernel/

["Sven Vermeulen" <swift@gentoo.org>]

commit:     5fd609058ca8eec44bac6baf0a510511a79c6bce
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Thu Aug  7 12:28:11 2014 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Thu Aug  7 12:28:11 2014 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=5fd60905

Introduce files_relabel_all_pids

The files_relabel_all_pids allows for relabelfrom/relabelto privileges
on files, symbolic links and directories (for now) of the types
associated with the pidfile attribute, which basically is *_var_run_t
and var_run_t.

---
 policy/modules/kernel/files.if | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index 5d53aa4..609de1f 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -6752,3 +6752,24 @@ interface(`files_manage_non_security_file_type',`
 	manage_sock_files_pattern($1, non_security_file_type, non_security_file_type)
 ')
 
+########################################
+## <summary>
+##	Relabel all pidfile resources.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`files_relabel_all_pids',`
+	gen_require(`
+		attribute pidfile;
+	')
+
+	allow $1 pidfile:dir list_dir_perms;
+	relabel_dirs_pattern($1, pidfile, pidfile)
+	relabel_files_pattern($1, pidfile, pidfile)
+	relabel_lnk_files_pattern($1, pidfile, pidfile)
+')