public inbox for gentoo-commits@lists.gentoo.org
 help / color / mirror / Atom feed
* [gentoo-commits] proj/hardened-refpolicy:userroles commit in: policy/modules/roles/
@ 2014-12-02 14:19 Jason Zaman
  0 siblings, 0 replies; 7+ messages in thread
From: Jason Zaman @ 2014-12-02 14:19 UTC (permalink / raw
  To: gentoo-commits

commit:     d47a85f8cabba8dbde87875d61a500a55bbd663e
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Tue Dec  2 11:14:38 2014 +0000
Commit:     Jason Zaman <gentoo <AT> perfinion <DOT> com>
CommitDate: Tue Dec  2 14:16:55 2014 +0000
URL:        http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=d47a85f8

Add missing roles interfaces

Some interfaces were missing from staff_r and user_r, this adds them in

---
 policy/modules/roles/staff.te      | 16 ++++++++++++++++
 policy/modules/roles/unprivuser.te | 16 ++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index 1d4b3e0..1a867f0 100644
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -188,6 +188,14 @@ ifndef(`distro_redhat',`
 ifdef(`distro_gentoo',`
 
 	optional_policy(`
+		android_role(staff_r, staff_t)
+	')
+
+	optional_policy(`
+		at_role(staff_r, staff_t)
+	')
+
+	optional_policy(`
 		chromium_role(staff_r, staff_t)
 	')
 
@@ -230,4 +238,12 @@ ifdef(`distro_gentoo',`
 	optional_policy(`
 		skype_role(staff_r, staff_t)
 	')
+
+	optional_policy(`
+		wine_role(staff_r, staff_t)
+	')
+
+	optional_policy(`
+		xscreensaver_role(staff_r, staff_t)
+	')
 ')

diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
index c171833..e349a03 100644
--- a/policy/modules/roles/unprivuser.te
+++ b/policy/modules/roles/unprivuser.te
@@ -173,6 +173,14 @@ ifndef(`distro_redhat',`
 ifdef(`distro_gentoo',`
 
 	optional_policy(`
+		android_role(user_r, user_t)
+	')
+
+	optional_policy(`
+		at_role(user_r, user_t)
+	')
+
+	optional_policy(`
 		chromium_role(user_r, user_t)
 	')
 
@@ -211,4 +219,12 @@ ifdef(`distro_gentoo',`
 	optional_policy(`
 		skype_role(user_r, user_t)
 	')
+
+	optional_policy(`
+		wine_role(user_r, user_t)
+	')
+
+	optional_policy(`
+		xscreensaver_role(user_r, user_t)
+	')
 ')


^ permalink raw reply related	[flat|nested] 7+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:adminroles commit in: policy/modules/roles/
@ 2014-12-03 12:56 Jason Zaman
  2014-12-03 12:56 ` [gentoo-commits] proj/hardened-refpolicy:userroles " Jason Zaman
  0 siblings, 1 reply; 7+ messages in thread
From: Jason Zaman @ 2014-12-03 12:56 UTC (permalink / raw
  To: gentoo-commits

commit:     5572b308499e54999df84759d522779d8e4cfd0a
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Tue Dec  2 11:14:38 2014 +0000
Commit:     Jason Zaman <gentoo <AT> perfinion <DOT> com>
CommitDate: Wed Dec  3 09:30:09 2014 +0000
URL:        http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=5572b308

Add missing roles interfaces

Some interfaces were missing from staff_r and user_r, this adds them in

---
 policy/modules/roles/staff.te      | 16 ++++++++++++++++
 policy/modules/roles/unprivuser.te | 16 ++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index 1d4b3e0..1a867f0 100644
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -188,6 +188,14 @@ ifndef(`distro_redhat',`
 ifdef(`distro_gentoo',`
 
 	optional_policy(`
+		android_role(staff_r, staff_t)
+	')
+
+	optional_policy(`
+		at_role(staff_r, staff_t)
+	')
+
+	optional_policy(`
 		chromium_role(staff_r, staff_t)
 	')
 
@@ -230,4 +238,12 @@ ifdef(`distro_gentoo',`
 	optional_policy(`
 		skype_role(staff_r, staff_t)
 	')
+
+	optional_policy(`
+		wine_role(staff_r, staff_t)
+	')
+
+	optional_policy(`
+		xscreensaver_role(staff_r, staff_t)
+	')
 ')

diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
index c171833..e349a03 100644
--- a/policy/modules/roles/unprivuser.te
+++ b/policy/modules/roles/unprivuser.te
@@ -173,6 +173,14 @@ ifndef(`distro_redhat',`
 ifdef(`distro_gentoo',`
 
 	optional_policy(`
+		android_role(user_r, user_t)
+	')
+
+	optional_policy(`
+		at_role(user_r, user_t)
+	')
+
+	optional_policy(`
 		chromium_role(user_r, user_t)
 	')
 
@@ -211,4 +219,12 @@ ifdef(`distro_gentoo',`
 	optional_policy(`
 		skype_role(user_r, user_t)
 	')
+
+	optional_policy(`
+		wine_role(user_r, user_t)
+	')
+
+	optional_policy(`
+		xscreensaver_role(user_r, user_t)
+	')
 ')


^ permalink raw reply related	[flat|nested] 7+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:adminroles commit in: policy/modules/roles/
@ 2014-12-03 12:56 Jason Zaman
  2014-12-03 12:56 ` [gentoo-commits] proj/hardened-refpolicy:userroles " Jason Zaman
  0 siblings, 1 reply; 7+ messages in thread
From: Jason Zaman @ 2014-12-03 12:56 UTC (permalink / raw
  To: gentoo-commits

commit:     f774e2c1acf6fab64fad40f8e5234755c8bf39c3
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Tue Dec  2 08:15:17 2014 +0000
Commit:     Jason Zaman <gentoo <AT> perfinion <DOT> com>
CommitDate: Wed Dec  3 09:30:09 2014 +0000
URL:        http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=f774e2c1

Unify staff and user roles

user_r had a few things added which were not in staff_r. This adds them
to staff too so they are the same (apart from allowing staff to change
roles).

---
 policy/modules/roles/staff.te | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index 14706de..1d4b3e0 100644
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -192,6 +192,10 @@ ifdef(`distro_gentoo',`
 	')
 
 	optional_policy(`
+		dropbox_role(staff_r, staff_t)
+	')
+
+	optional_policy(`
 		googletalk_run_plugin(staff_t, staff_r)
 	')
 
@@ -200,6 +204,10 @@ ifdef(`distro_gentoo',`
 	')
 
 	optional_policy(`
+		hadoop_role(staff_r, staff_t)
+	')
+
+	optional_policy(`
 		links_role(staff_r, staff_t)
 	')
 
@@ -216,6 +224,10 @@ ifdef(`distro_gentoo',`
 	')
 
 	optional_policy(`
+		rtorrent_role(staff_r, staff_t)
+	')
+
+	optional_policy(`
 		skype_role(staff_r, staff_t)
 	')
 ')


^ permalink raw reply related	[flat|nested] 7+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:userroles commit in: policy/modules/roles/
@ 2014-12-03 12:56 Jason Zaman
  0 siblings, 0 replies; 7+ messages in thread
From: Jason Zaman @ 2014-12-03 12:56 UTC (permalink / raw
  To: gentoo-commits

commit:     9e584181277f9f01f7aecb928aa090895af51505
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Tue Dec  2 12:00:05 2014 +0000
Commit:     Jason Zaman <gentoo <AT> perfinion <DOT> com>
CommitDate: Wed Dec  3 09:30:09 2014 +0000
URL:        http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=9e584181

Allow users to talk to devicekit

Needed to read battery status and disk info.

type=USER_AVC msg=audit(1417367573.060:234): pid=3121 uid=101
auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t
msg='avc:  denied  { send_msg } for msgtype=signal
interface=org.freedesktop.UPower member=DeviceChanged
dest=org.freedesktop.DBus spid=3606 tpid=3858
scontext=system_u:system_r:devicekit_power_t
tcontext=staff_u:staff_r:staff_t tclass=dbus  exe="/usr/bin/dbus-daemon"
sauid=101 hostname=? addr=? terminal=?'

type=USER_AVC msg=audit(1417363447.011:103525): pid=3339 uid=101
auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t
msg='avc:  denied  { send_msg } for msgtype=signal
interface=org.freedesktop.DBus.Properties member=PropertiesChanged
dest=org.freedesktop.DBus spid=4094 tpid=4090
scontext=system_u:system_r:devicekit_disk_t
tcontext=staff_u:staff_r:staff_t tclass=dbus  exe="/usr/bin/dbus-daemon"
sauid=101 hostname=? addr=? terminal=?'

---
 policy/modules/roles/staff.te      | 5 +++++
 policy/modules/roles/unprivuser.te | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index 1a867f0..0c15bb5 100644
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -200,6 +200,11 @@ ifdef(`distro_gentoo',`
 	')
 
 	optional_policy(`
+		devicekit_dbus_chat_disk(staff_t)
+		devicekit_dbus_chat_power(staff_t)
+	')
+
+	optional_policy(`
 		dropbox_role(staff_r, staff_t)
 	')
 

diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
index e349a03..63dced4 100644
--- a/policy/modules/roles/unprivuser.te
+++ b/policy/modules/roles/unprivuser.te
@@ -185,6 +185,11 @@ ifdef(`distro_gentoo',`
 	')
 
 	optional_policy(`
+		devicekit_dbus_chat_disk(user_t)
+		devicekit_dbus_chat_power(user_t)
+	')
+
+	optional_policy(`
 		dropbox_role(user_r, user_t)
 	')
 


^ permalink raw reply related	[flat|nested] 7+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:userroles commit in: policy/modules/roles/
@ 2014-12-02 14:19 Jason Zaman
  0 siblings, 0 replies; 7+ messages in thread
From: Jason Zaman @ 2014-12-02 14:19 UTC (permalink / raw
  To: gentoo-commits

commit:     f846de6171a14ec10605f90388c102cb5fe088ae
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Tue Dec  2 08:15:17 2014 +0000
Commit:     Jason Zaman <gentoo <AT> perfinion <DOT> com>
CommitDate: Tue Dec  2 13:53:36 2014 +0000
URL:        http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=f846de61

Unify staff and user roles

user_r had a few things added which were not in staff_r. This adds them
to staff too so they are the same (apart from allowing staff to change
roles).

---
 policy/modules/roles/staff.te | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index 14706de..1d4b3e0 100644
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -192,6 +192,10 @@ ifdef(`distro_gentoo',`
 	')
 
 	optional_policy(`
+		dropbox_role(staff_r, staff_t)
+	')
+
+	optional_policy(`
 		googletalk_run_plugin(staff_t, staff_r)
 	')
 
@@ -200,6 +204,10 @@ ifdef(`distro_gentoo',`
 	')
 
 	optional_policy(`
+		hadoop_role(staff_r, staff_t)
+	')
+
+	optional_policy(`
 		links_role(staff_r, staff_t)
 	')
 
@@ -216,6 +224,10 @@ ifdef(`distro_gentoo',`
 	')
 
 	optional_policy(`
+		rtorrent_role(staff_r, staff_t)
+	')
+
+	optional_policy(`
 		skype_role(staff_r, staff_t)
 	')
 ')


^ permalink raw reply related	[flat|nested] 7+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:userroles commit in: policy/modules/roles/
@ 2014-12-02 14:19 Jason Zaman
  0 siblings, 0 replies; 7+ messages in thread
From: Jason Zaman @ 2014-12-02 14:19 UTC (permalink / raw
  To: gentoo-commits

commit:     3677ba127d40a22289d282c32d28323604c5e4c1
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Tue Dec  2 12:00:05 2014 +0000
Commit:     Jason Zaman <gentoo <AT> perfinion <DOT> com>
CommitDate: Tue Dec  2 14:17:11 2014 +0000
URL:        http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=3677ba12

Allow users to talk to devicekit

Needed to read battery status and disk info.

type=USER_AVC msg=audit(1417367573.060:234): pid=3121 uid=101
auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t
msg='avc:  denied  { send_msg } for msgtype=signal
interface=org.freedesktop.UPower member=DeviceChanged
dest=org.freedesktop.DBus spid=3606 tpid=3858
scontext=system_u:system_r:devicekit_power_t
tcontext=staff_u:staff_r:staff_t tclass=dbus  exe="/usr/bin/dbus-daemon"
sauid=101 hostname=? addr=? terminal=?'

type=USER_AVC msg=audit(1417363447.011:103525): pid=3339 uid=101
auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t
msg='avc:  denied  { send_msg } for msgtype=signal
interface=org.freedesktop.DBus.Properties member=PropertiesChanged
dest=org.freedesktop.DBus spid=4094 tpid=4090
scontext=system_u:system_r:devicekit_disk_t
tcontext=staff_u:staff_r:staff_t tclass=dbus  exe="/usr/bin/dbus-daemon"
sauid=101 hostname=? addr=? terminal=?'

---
 policy/modules/roles/staff.te      | 5 +++++
 policy/modules/roles/unprivuser.te | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index 1a867f0..0c15bb5 100644
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -200,6 +200,11 @@ ifdef(`distro_gentoo',`
 	')
 
 	optional_policy(`
+		devicekit_dbus_chat_disk(staff_t)
+		devicekit_dbus_chat_power(staff_t)
+	')
+
+	optional_policy(`
 		dropbox_role(staff_r, staff_t)
 	')
 

diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
index e349a03..63dced4 100644
--- a/policy/modules/roles/unprivuser.te
+++ b/policy/modules/roles/unprivuser.te
@@ -185,6 +185,11 @@ ifdef(`distro_gentoo',`
 	')
 
 	optional_policy(`
+		devicekit_dbus_chat_disk(user_t)
+		devicekit_dbus_chat_power(user_t)
+	')
+
+	optional_policy(`
 		dropbox_role(user_r, user_t)
 	')
 


^ permalink raw reply related	[flat|nested] 7+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:userroles commit in: policy/modules/roles/
@ 2014-12-02 13:38 Jason Zaman
  0 siblings, 0 replies; 7+ messages in thread
From: Jason Zaman @ 2014-12-02 13:38 UTC (permalink / raw
  To: gentoo-commits

commit:     59a3260e881ac62c74ff0882ea9945843614bfcf
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Tue Dec  2 12:00:05 2014 +0000
Commit:     Jason Zaman <gentoo <AT> perfinion <DOT> com>
CommitDate: Tue Dec  2 13:35:06 2014 +0000
URL:        http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=59a3260e

Allow users to talk to devicekit

Needed to read battery status and disk info.

type=USER_AVC msg=audit(1417367573.060:234): pid=3121 uid=101
auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t
msg='avc:  denied  { send_msg } for msgtype=signal
interface=org.freedesktop.UPower member=DeviceChanged
dest=org.freedesktop.DBus spid=3606 tpid=3858
scontext=system_u:system_r:devicekit_power_t
tcontext=staff_u:staff_r:staff_t tclass=dbus  exe="/usr/bin/dbus-daemon"
sauid=101 hostname=? addr=? terminal=?'

type=USER_AVC msg=audit(1417363447.011:103525): pid=3339 uid=101
auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t
msg='avc:  denied  { send_msg } for msgtype=signal
interface=org.freedesktop.DBus.Properties member=PropertiesChanged
dest=org.freedesktop.DBus spid=4094 tpid=4090
scontext=system_u:system_r:devicekit_disk_t
tcontext=staff_u:staff_r:staff_t tclass=dbus  exe="/usr/bin/dbus-daemon"
sauid=101 hostname=? addr=? terminal=?'

---
 policy/modules/roles/staff.te      | 5 +++++
 policy/modules/roles/unprivuser.te | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index 70e5a75..ae8469c 100644
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -200,6 +200,11 @@ ifdef(`distro_gentoo',`
 	')
 
 	optional_policy(`
+		devicekit_dbus_chat_disk(staff_t)
+		devicekit_dbus_chat_power(staff_t)
+	')
+
+	optional_policy(`
 		dropbox_role(staff_t, staff_r)
 	')
 

diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
index b07fef1..255ceae 100644
--- a/policy/modules/roles/unprivuser.te
+++ b/policy/modules/roles/unprivuser.te
@@ -185,6 +185,11 @@ ifdef(`distro_gentoo',`
 	')
 
 	optional_policy(`
+		devicekit_dbus_chat_disk(user_t)
+		devicekit_dbus_chat_power(user_t)
+	')
+
+	optional_policy(`
 		dropbox_role(user_r, user_t)
 	')
 


^ permalink raw reply related	[flat|nested] 7+ messages in thread
end of thread, other threads:[~2014-12-03 12:56 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-12-02 14:19 [gentoo-commits] proj/hardened-refpolicy:userroles commit in: policy/modules/roles/ Jason Zaman
  -- strict thread matches above, loose matches on Subject: below --
2014-12-03 12:56 [gentoo-commits] proj/hardened-refpolicy:adminroles " Jason Zaman
2014-12-03 12:56 ` [gentoo-commits] proj/hardened-refpolicy:userroles " Jason Zaman
2014-12-03 12:56 [gentoo-commits] proj/hardened-refpolicy:adminroles " Jason Zaman
2014-12-03 12:56 ` [gentoo-commits] proj/hardened-refpolicy:userroles " Jason Zaman
2014-12-03 12:56 Jason Zaman
2014-12-02 14:19 Jason Zaman
2014-12-02 14:19 Jason Zaman
2014-12-02 13:38 Jason Zaman

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox