[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/modules/contrib/

["Jason Zaman" <perfinion@gentoo.org>]

commit:     8d39472678948b838904f31d1b3467b1fa427668
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Mon Jul 13 19:47:28 2015 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Mon Jul 13 20:59:50 2015 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=8d394726

Add portage_enable_test boolean for FEATURES=test

 policy/modules/contrib/portage.te | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/policy/modules/contrib/portage.te b/policy/modules/contrib/portage.te
index 2e8ab9e..2f62eb6 100644
--- a/policy/modules/contrib/portage.te
+++ b/policy/modules/contrib/portage.te
@@ -375,6 +375,13 @@ ifdef(`distro_gentoo',`
 ## </desc>
 gen_tunable(portage_mount_fs, false)
 
+## <desc>
+##	<p>
+##	Extra rules which are sometimes needed when FEATURES=test is enabled
+##	</p>
+## </desc>
+gen_tunable(portage_enable_test, false)
+
 
 	##########################################
 	#
@@ -388,7 +395,7 @@ gen_tunable(portage_mount_fs, false)
 	attribute portage_eselect_domain;
 
 	##########################################
-	# 
+	#
 	# Portage fetch local policy
 	#
 
@@ -476,6 +483,13 @@ gen_tunable(portage_mount_fs, false)
 	# install-xattr does listxattr() which throws a lot of this
 	dontaudit portage_sandbox_t self:capability sys_admin;
 
+	tunable_policy(`portage_enable_test',`
+		# lots of tests connect over loopback
+		corenet_tcp_bind_generic_node(portage_sandbox_t)
+		corenet_tcp_bind_all_unreserved_ports(portage_sandbox_t)
+		corenet_tcp_connect_all_unreserved_ports(portage_sandbox_t)
+	')
+
 	##########################################
 	#
 	# Portage eselect module domain