[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Jason Zaman" <perfinion@gentoo.org>]

commit:     04ebf78c2f42dbdbb4cc5c79c10af95878a1438a
Author:     Luis Ressel <aranea <AT> aixah <DOT> de>
AuthorDate: Mon Mar  7 15:33:02 2016 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Fri Mar 11 17:16:17 2016 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=04ebf78c

New policy for tboot utilities

tboot is an OSS project for using the features of Intel TXT. Some of its
included utilities (might) need special permissions. For now, there's
only a policy for txt-stat (it needs access to /dev/mem).

 policy/modules/contrib/tboot.fc |  1 +
 policy/modules/contrib/tboot.if | 46 +++++++++++++++++++++++++++++++++++++++++
 policy/modules/contrib/tboot.te | 24 +++++++++++++++++++++
 3 files changed, 71 insertions(+)

diff --git a/policy/modules/contrib/tboot.fc b/policy/modules/contrib/tboot.fc
new file mode 100644
index 0000000..437e1d5
--- /dev/null
+++ b/policy/modules/contrib/tboot.fc
@@ -0,0 +1 @@
+/usr/sbin/txt-stat		--	gen_context(system_u:object_r:txtstat_exec_t,s0)

diff --git a/policy/modules/contrib/tboot.if b/policy/modules/contrib/tboot.if
new file mode 100644
index 0000000..0ffe6d8
--- /dev/null
+++ b/policy/modules/contrib/tboot.if
@@ -0,0 +1,46 @@
+## <summary>Utilities for the tboot TXT module.</summary>
+
+########################################
+## <summary>
+##	Execute txt-stat in the txtstat domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`tboot_domtrans_txtstat',`
+	gen_require(`
+		type txtstat_t, txtstat_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, txtstat_exec_t, txtstat_t)
+')
+
+########################################
+## <summary>
+##	Execute txt-stat in the txtstat domain, and
+##	allow the specified role the txtstat domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed the txtstat domain.
+##	</summary>
+## </param>
+#
+interface(`tboot_run_txtstat',`
+	gen_require(`
+		type txtstat_t;
+		attribute_role txtstat_roles;
+	')
+
+	tboot_domtrans_txtstat($1)
+	roleattribute $2 txtstat_roles;
+')

diff --git a/policy/modules/contrib/tboot.te b/policy/modules/contrib/tboot.te
new file mode 100644
index 0000000..4961a36
--- /dev/null
+++ b/policy/modules/contrib/tboot.te
@@ -0,0 +1,24 @@
+policy_module(tboot, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+attribute_role txtstat_roles;
+roleattribute system_r txtstat_roles;
+
+type txtstat_t;
+type txtstat_exec_t;
+application_domain(txtstat_t, txtstat_exec_t)
+role txtstat_roles types txtstat_t;
+
+########################################
+#
+# Local policy
+#
+
+dev_read_raw_memory(txtstat_t)
+
+domain_use_interactive_fds(txtstat_t)
+userdom_use_user_terminals(txtstat_t)