From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 832991382DE for ; Sun, 3 Jul 2016 11:34:34 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id BEC9E141B8; Sun, 3 Jul 2016 11:34:22 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 1F364141B8 for ; Sun, 3 Jul 2016 11:34:22 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 606A4340E21 for ; Sun, 3 Jul 2016 11:34:19 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id A15762456 for ; Sun, 3 Jul 2016 11:34:15 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1467545637.96442be2ecad875034508d025067058ac7df61eb.swift@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:swift commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/portage.if X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: swift X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 96442be2ecad875034508d025067058ac7df61eb X-VCS-Branch: swift Date: Sun, 3 Jul 2016 11:34:15 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: a5cdc524-2586-4051-a661-c15594c8c39a X-Archives-Hash: a934fee33454cc582fcbb242063cf291 commit: 96442be2ecad875034508d025067058ac7df61eb Author: Sven Vermeulen gentoo org> AuthorDate: Wed Dec 2 15:45:35 2015 +0000 Commit: Sven Vermeulen gentoo org> CommitDate: Sun Jul 3 11:33:57 2016 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=96442be2 REWRITEME Add portage admin interface policy/modules/contrib/portage.if | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/policy/modules/contrib/portage.if b/policy/modules/contrib/portage.if index 14c4fb6..38a31cd 100644 --- a/policy/modules/contrib/portage.if +++ b/policy/modules/contrib/portage.if @@ -556,3 +556,33 @@ interface(`portage_dontaudit_write_cache',` dontaudit $1 portage_cache_t:dir { setattr write }; ') + +######################################## +## +## Portage (and thus the system software) administration role +## +## +## +## Role allowed access +## +## +## +## +## Domain allowed access +## +## +# +interface(`portage_admin',` + gen_require(` + type portage_cache_t, portage_conf_t, portage_db_t, portage_ebuild_t, portage_srcrepo_t, portage_log_t; + ') + + admin_pattern($1, portage_cache_t) + admin_pattern($1, portage_conf_t) + admin_pattern($1, portage_db_t) + admin_pattern($1, portage_ebuild_t) + admin_pattern($1, portage_srcrepo_t) + admin_pattern($1, portage_log_t) +') + +