From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <gentoo-commits+bounces-737588-garchives=archives.gentoo.org@lists.gentoo.org> Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id E5E72138247 for <garchives@archives.gentoo.org>; Sun, 12 Oct 2014 09:51:57 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id D8F3AE0EC5; Sun, 12 Oct 2014 09:51:56 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id CD619E0EC4 for <gentoo-commits@lists.gentoo.org>; Sun, 12 Oct 2014 09:51:55 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 97DE53403E8 for <gentoo-commits@lists.gentoo.org>; Sun, 12 Oct 2014 09:51:53 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 167337A3C for <gentoo-commits@lists.gentoo.org>; Sun, 12 Oct 2014 09:51:51 +0000 (UTC) From: "Jason Zaman" <gentoo@perfinion.com> To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jason Zaman" <gentoo@perfinion.com> Message-ID: <1413107485.b00d95d26533a2ee7ac99c90e26d7d4240ad9209.perfinion@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:perfinion commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/java.if policy/modules/contrib/java.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: perfinion X-VCS-Committer-Name: Jason Zaman X-VCS-Revision: b00d95d26533a2ee7ac99c90e26d7d4240ad9209 X-VCS-Branch: perfinion Date: Sun, 12 Oct 2014 09:51:51 +0000 (UTC) Precedence: bulk List-Post: <mailto:gentoo-commits@lists.gentoo.org> List-Help: <mailto:gentoo-commits+help@lists.gentoo.org> List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org> List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org> List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org> X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 50d4d40d-12d3-4481-bf70-b41a6137c956 X-Archives-Hash: abb5ac368a534897657126d1dab804f1 commit: b00d95d26533a2ee7ac99c90e26d7d4240ad9209 Author: Jason Zaman <jason <AT> perfinion <DOT> com> AuthorDate: Mon Aug 18 09:51:22 2014 +0000 Commit: Jason Zaman <gentoo <AT> perfinion <DOT> com> CommitDate: Sun Oct 12 09:51:25 2014 +0000 URL: http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=b00d95d2 Add java_domain_type interface This interface will enable another domain to use Java without having to domtrans to java_t --- policy/modules/contrib/java.if | 34 ++++++++++++++++++++++++++++++++++ policy/modules/contrib/java.te | 3 +++ 2 files changed, 37 insertions(+) diff --git a/policy/modules/contrib/java.if b/policy/modules/contrib/java.if index acf6a63..4b5e7a7 100644 --- a/policy/modules/contrib/java.if +++ b/policy/modules/contrib/java.if @@ -327,3 +327,37 @@ template(`java_noatsecure_domtrans',` java_domtrans($1) ') + +# everything after here is gentoo-specific. ifdef's are not allowed for this unfortunately + +####################################### +## <summary> +## The template for using java in a domain. +## </summary> +## <desc> +## <p> +## This template creates a derived domains which are used +## for java applications. +## </p> +## </desc> +## <param name="domain"> +## <summary> +## The type of the domain to be given java privs. +## </summary> +## </param> +# +template(`java_domain_type',` + gen_require(` + attribute java_domain; + ') + + ######################################## + # + # Policy + # + + typeattribute $1 java_domain; + + # cannot be called on the attribute, so do it now + auth_use_nsswitch($1) +') diff --git a/policy/modules/contrib/java.te b/policy/modules/contrib/java.te index 11e996d..67af775 100644 --- a/policy/modules/contrib/java.te +++ b/policy/modules/contrib/java.te @@ -120,6 +120,9 @@ ifdef(`distro_gentoo',` manage_dirs_pattern(java_domain, java_home_t, java_home_t) manage_files_pattern(java_domain, java_home_t, java_home_t) userdom_user_home_dir_filetrans(java_domain, java_home_t, dir, ".icedtea") + + manage_lnk_files_pattern(java_domain, java_tmp_t, java_tmp_t) + files_tmp_filetrans(java_domain, java_tmp_t, lnk_file) ') tunable_policy(`allow_java_execstack',` From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <gentoo-commits+bounces-740743-garchives=archives.gentoo.org@lists.gentoo.org> Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 10C911388C0 for <garchives@archives.gentoo.org>; Sat, 25 Oct 2014 19:21:31 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 5509FE0957; Sat, 25 Oct 2014 19:21:30 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id DE5D8E0954 for <gentoo-commits@lists.gentoo.org>; Sat, 25 Oct 2014 19:21:29 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 7E8763403B9 for <gentoo-commits@lists.gentoo.org>; Sat, 25 Oct 2014 19:21:28 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 2B7A48BA7 for <gentoo-commits@lists.gentoo.org>; Sat, 25 Oct 2014 19:21:27 +0000 (UTC) From: "Jason Zaman" <gentoo@perfinion.com> To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jason Zaman" <gentoo@perfinion.com> Message-ID: <1413107485.b00d95d26533a2ee7ac99c90e26d7d4240ad9209.perfinion@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/java.if policy/modules/contrib/java.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: perfinion X-VCS-Committer-Name: Jason Zaman X-VCS-Revision: b00d95d26533a2ee7ac99c90e26d7d4240ad9209 X-VCS-Branch: master Date: Sat, 25 Oct 2014 19:21:27 +0000 (UTC) Precedence: bulk List-Post: <mailto:gentoo-commits@lists.gentoo.org> List-Help: <mailto:gentoo-commits+help@lists.gentoo.org> List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org> List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org> List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org> X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 5bd71eb8-f910-4701-a81c-cbf94cbca306 X-Archives-Hash: 9244e510df81039bc086969c6afd4ca3 Message-ID: <20141025192127.c1vtHipabYWq2P3PYoaUKNjjNh9uXq_vPs6q78E1Ei8@z> commit: b00d95d26533a2ee7ac99c90e26d7d4240ad9209 Author: Jason Zaman <jason <AT> perfinion <DOT> com> AuthorDate: Mon Aug 18 09:51:22 2014 +0000 Commit: Jason Zaman <gentoo <AT> perfinion <DOT> com> CommitDate: Sun Oct 12 09:51:25 2014 +0000 URL: http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=b00d95d2 Add java_domain_type interface This interface will enable another domain to use Java without having to domtrans to java_t --- policy/modules/contrib/java.if | 34 ++++++++++++++++++++++++++++++++++ policy/modules/contrib/java.te | 3 +++ 2 files changed, 37 insertions(+) diff --git a/policy/modules/contrib/java.if b/policy/modules/contrib/java.if index acf6a63..4b5e7a7 100644 --- a/policy/modules/contrib/java.if +++ b/policy/modules/contrib/java.if @@ -327,3 +327,37 @@ template(`java_noatsecure_domtrans',` java_domtrans($1) ') + +# everything after here is gentoo-specific. ifdef's are not allowed for this unfortunately + +####################################### +## <summary> +## The template for using java in a domain. +## </summary> +## <desc> +## <p> +## This template creates a derived domains which are used +## for java applications. +## </p> +## </desc> +## <param name="domain"> +## <summary> +## The type of the domain to be given java privs. +## </summary> +## </param> +# +template(`java_domain_type',` + gen_require(` + attribute java_domain; + ') + + ######################################## + # + # Policy + # + + typeattribute $1 java_domain; + + # cannot be called on the attribute, so do it now + auth_use_nsswitch($1) +') diff --git a/policy/modules/contrib/java.te b/policy/modules/contrib/java.te index 11e996d..67af775 100644 --- a/policy/modules/contrib/java.te +++ b/policy/modules/contrib/java.te @@ -120,6 +120,9 @@ ifdef(`distro_gentoo',` manage_dirs_pattern(java_domain, java_home_t, java_home_t) manage_files_pattern(java_domain, java_home_t, java_home_t) userdom_user_home_dir_filetrans(java_domain, java_home_t, dir, ".icedtea") + + manage_lnk_files_pattern(java_domain, java_tmp_t, java_tmp_t) + files_tmp_filetrans(java_domain, java_tmp_t, lnk_file) ') tunable_policy(`allow_java_execstack',`