From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id C073B138C92 for ; Mon, 24 Oct 2016 16:03:16 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id D221EE0AAA; Mon, 24 Oct 2016 16:02:34 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id A38B2E0AAA for ; Mon, 24 Oct 2016 16:02:34 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 9AAEE3413E9 for ; Mon, 24 Oct 2016 16:02:33 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 6605133D for ; Mon, 24 Oct 2016 16:02:32 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1477324652.7601edab81d7dd32ebe8270c7cd3ac17b0f28431.swift@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:swift commit in: / X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: syncthing.if syncthing.te X-VCS-Directories: / X-VCS-Committer: swift X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 7601edab81d7dd32ebe8270c7cd3ac17b0f28431 X-VCS-Branch: swift Date: Mon, 24 Oct 2016 16:02:32 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 5c31ca8c-f971-4c93-b0d8-ff1960d0223e X-Archives-Hash: 5e8db6056ac4fa555cc62bfc8a8b1b14 commit: 7601edab81d7dd32ebe8270c7cd3ac17b0f28431 Author: Chris PeBenito ieee org> AuthorDate: Sun Oct 9 11:47:09 2016 +0000 Commit: Sven Vermeulen gentoo org> CommitDate: Mon Oct 24 15:57:32 2016 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=7601edab Rearrange lines in syncthing. Signed-off-by: Sven Vermeulen siphos.be> syncthing.if | 19 +++++++++---------- syncthing.te | 20 +++++++------------- 2 files changed, 16 insertions(+), 23 deletions(-) diff --git a/syncthing.if b/syncthing.if index d71fdaa..065800a 100644 --- a/syncthing.if +++ b/syncthing.if @@ -16,17 +16,16 @@ ## # interface(`syncthing_role', ` + gen_require(` + attribute_role syncthing_roles; + type syncthing_t, syncthing_exec_t, syncthing_config_home_t; + ') - gen_require(` - attribute_role syncthing_roles; - type syncthing_t, syncthing_exec_t, syncthing_config_home_t; - ') + roleattribute $1 syncthing_roles; - roleattribute $1 syncthing_roles; + domtrans_pattern($2, syncthing_exec_t, syncthing_t) - domtrans_pattern($2, syncthing_exec_t, syncthing_t) - - allow $2 syncthing_config_home_t:file { manage_file_perms relabel_file_perms }; - allow $2 syncthing_config_home_t:dir { manage_dir_perms relabel_dir_perms }; - allow $2 syncthing_config_home_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms }; + allow $2 syncthing_config_home_t:file { manage_file_perms relabel_file_perms }; + allow $2 syncthing_config_home_t:dir { manage_dir_perms relabel_dir_perms }; + allow $2 syncthing_config_home_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms }; ') diff --git a/syncthing.te b/syncthing.te index 8144389..92d0bf5 100644 --- a/syncthing.te +++ b/syncthing.te @@ -27,23 +27,23 @@ allow syncthing_t self:tcp_socket { listen accept }; can_exec(syncthing_t, syncthing_exec_t) +manage_dirs_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) +manage_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) +manage_lnk_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) + kernel_read_kernel_sysctls(syncthing_t) kernel_read_net_sysctls(syncthing_t) kernel_read_system_state(syncthing_t) corenet_tcp_sendrecv_generic_if(syncthing_t) corenet_udp_sendrecv_generic_if(syncthing_t) - corenet_tcp_bind_generic_node(syncthing_t) corenet_tcp_sendrecv_generic_node(syncthing_t) corenet_tcp_sendrecv_all_ports(syncthing_t) - corenet_udp_bind_generic_node(syncthing_t) corenet_udp_sendrecv_generic_node(syncthing_t) corenet_udp_sendrecv_all_ports(syncthing_t) - corenet_tcp_connect_all_ports(syncthing_t) - corenet_tcp_bind_syncthing_port(syncthing_t) corenet_udp_bind_syncthing_discovery_port(syncthing_t) corenet_tcp_bind_syncthing_admin_port(syncthing_t) @@ -55,10 +55,6 @@ fs_getattr_xattr_fs(syncthing_t) auth_use_nsswitch(syncthing_t) -manage_dirs_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) -manage_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) -manage_lnk_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) - miscfiles_read_generic_certs(syncthing_t) miscfiles_read_localization(syncthing_t) @@ -66,13 +62,11 @@ userdom_manage_user_home_content_files(syncthing_t) userdom_manage_user_home_content_dirs(syncthing_t) userdom_manage_user_home_content_symlinks(syncthing_t) userdom_user_home_dir_filetrans_user_home_content(syncthing_t, dir) - +userdom_use_user_terminals(syncthing_t) # newly created files in ~/.config/syncthing/ will transition to syncthing_config_home_t userdom_user_home_content_filetrans(syncthing_t, syncthing_config_home_t, dir, "syncthing") -userdom_use_user_terminals(syncthing_t) - optional_policy(` - # temporary hack for /run/NetworkManager/resolv.conf until we make this part of sysnet_dns_name_resolve() - networkmanager_read_pid_files(syncthing_t) + # temporary hack for /run/NetworkManager/resolv.conf until we make this part of sysnet_dns_name_resolve() + networkmanager_read_pid_files(syncthing_t) ') From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 9A344138C92 for ; Mon, 24 Oct 2016 16:02:52 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 497E5E0A6C; Mon, 24 Oct 2016 16:02:24 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 189BFE0A6C for ; Mon, 24 Oct 2016 16:02:24 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id CB7F9341665 for ; Mon, 24 Oct 2016 16:02:22 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 6F62624A0 for ; Mon, 24 Oct 2016 16:02:21 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1477324652.7601edab81d7dd32ebe8270c7cd3ac17b0f28431.swift@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: / X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: syncthing.if syncthing.te X-VCS-Directories: / X-VCS-Committer: swift X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 7601edab81d7dd32ebe8270c7cd3ac17b0f28431 X-VCS-Branch: master Date: Mon, 24 Oct 2016 16:02:21 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 8651f8e0-0361-4741-acba-196f1a890506 X-Archives-Hash: 20ba8b5e5dceaa0f71a5742ceaf049b6 Message-ID: <20161024160221.3om1Cd2qM4SASIu4-vcDeeS0bMkZxVEfFjiQK16kbno@z> commit: 7601edab81d7dd32ebe8270c7cd3ac17b0f28431 Author: Chris PeBenito ieee org> AuthorDate: Sun Oct 9 11:47:09 2016 +0000 Commit: Sven Vermeulen gentoo org> CommitDate: Mon Oct 24 15:57:32 2016 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=7601edab Rearrange lines in syncthing. Signed-off-by: Sven Vermeulen siphos.be> syncthing.if | 19 +++++++++---------- syncthing.te | 20 +++++++------------- 2 files changed, 16 insertions(+), 23 deletions(-) diff --git a/syncthing.if b/syncthing.if index d71fdaa..065800a 100644 --- a/syncthing.if +++ b/syncthing.if @@ -16,17 +16,16 @@ ## # interface(`syncthing_role', ` + gen_require(` + attribute_role syncthing_roles; + type syncthing_t, syncthing_exec_t, syncthing_config_home_t; + ') - gen_require(` - attribute_role syncthing_roles; - type syncthing_t, syncthing_exec_t, syncthing_config_home_t; - ') + roleattribute $1 syncthing_roles; - roleattribute $1 syncthing_roles; + domtrans_pattern($2, syncthing_exec_t, syncthing_t) - domtrans_pattern($2, syncthing_exec_t, syncthing_t) - - allow $2 syncthing_config_home_t:file { manage_file_perms relabel_file_perms }; - allow $2 syncthing_config_home_t:dir { manage_dir_perms relabel_dir_perms }; - allow $2 syncthing_config_home_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms }; + allow $2 syncthing_config_home_t:file { manage_file_perms relabel_file_perms }; + allow $2 syncthing_config_home_t:dir { manage_dir_perms relabel_dir_perms }; + allow $2 syncthing_config_home_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms }; ') diff --git a/syncthing.te b/syncthing.te index 8144389..92d0bf5 100644 --- a/syncthing.te +++ b/syncthing.te @@ -27,23 +27,23 @@ allow syncthing_t self:tcp_socket { listen accept }; can_exec(syncthing_t, syncthing_exec_t) +manage_dirs_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) +manage_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) +manage_lnk_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) + kernel_read_kernel_sysctls(syncthing_t) kernel_read_net_sysctls(syncthing_t) kernel_read_system_state(syncthing_t) corenet_tcp_sendrecv_generic_if(syncthing_t) corenet_udp_sendrecv_generic_if(syncthing_t) - corenet_tcp_bind_generic_node(syncthing_t) corenet_tcp_sendrecv_generic_node(syncthing_t) corenet_tcp_sendrecv_all_ports(syncthing_t) - corenet_udp_bind_generic_node(syncthing_t) corenet_udp_sendrecv_generic_node(syncthing_t) corenet_udp_sendrecv_all_ports(syncthing_t) - corenet_tcp_connect_all_ports(syncthing_t) - corenet_tcp_bind_syncthing_port(syncthing_t) corenet_udp_bind_syncthing_discovery_port(syncthing_t) corenet_tcp_bind_syncthing_admin_port(syncthing_t) @@ -55,10 +55,6 @@ fs_getattr_xattr_fs(syncthing_t) auth_use_nsswitch(syncthing_t) -manage_dirs_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) -manage_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) -manage_lnk_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) - miscfiles_read_generic_certs(syncthing_t) miscfiles_read_localization(syncthing_t) @@ -66,13 +62,11 @@ userdom_manage_user_home_content_files(syncthing_t) userdom_manage_user_home_content_dirs(syncthing_t) userdom_manage_user_home_content_symlinks(syncthing_t) userdom_user_home_dir_filetrans_user_home_content(syncthing_t, dir) - +userdom_use_user_terminals(syncthing_t) # newly created files in ~/.config/syncthing/ will transition to syncthing_config_home_t userdom_user_home_content_filetrans(syncthing_t, syncthing_config_home_t, dir, "syncthing") -userdom_use_user_terminals(syncthing_t) - optional_policy(` - # temporary hack for /run/NetworkManager/resolv.conf until we make this part of sysnet_dns_name_resolve() - networkmanager_read_pid_files(syncthing_t) + # temporary hack for /run/NetworkManager/resolv.conf until we make this part of sysnet_dns_name_resolve() + networkmanager_read_pid_files(syncthing_t) ') From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 6B9D8138C92 for ; Mon, 24 Oct 2016 16:03:52 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id CC4A321C03E; Mon, 24 Oct 2016 16:03:06 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 9D63D21C03E for ; Mon, 24 Oct 2016 16:03:06 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 7CAF434168E for ; Mon, 24 Oct 2016 16:03:05 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id E735424A0 for ; Mon, 24 Oct 2016 16:03:03 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1477324652.7601edab81d7dd32ebe8270c7cd3ac17b0f28431.swift@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:next commit in: / X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: syncthing.if syncthing.te X-VCS-Directories: / X-VCS-Committer: swift X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 7601edab81d7dd32ebe8270c7cd3ac17b0f28431 X-VCS-Branch: next Date: Mon, 24 Oct 2016 16:03:03 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: c1736863-f00a-4672-9fd8-6ca7c77f6711 X-Archives-Hash: 5656a627f1522106b4736f023e45d1b7 Message-ID: <20161024160303.56Ph5CyR_lchYcr3AfDHlen7hjvzFNV8B16LJU9nMz4@z> commit: 7601edab81d7dd32ebe8270c7cd3ac17b0f28431 Author: Chris PeBenito ieee org> AuthorDate: Sun Oct 9 11:47:09 2016 +0000 Commit: Sven Vermeulen gentoo org> CommitDate: Mon Oct 24 15:57:32 2016 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=7601edab Rearrange lines in syncthing. Signed-off-by: Sven Vermeulen siphos.be> syncthing.if | 19 +++++++++---------- syncthing.te | 20 +++++++------------- 2 files changed, 16 insertions(+), 23 deletions(-) diff --git a/syncthing.if b/syncthing.if index d71fdaa..065800a 100644 --- a/syncthing.if +++ b/syncthing.if @@ -16,17 +16,16 @@ ## # interface(`syncthing_role', ` + gen_require(` + attribute_role syncthing_roles; + type syncthing_t, syncthing_exec_t, syncthing_config_home_t; + ') - gen_require(` - attribute_role syncthing_roles; - type syncthing_t, syncthing_exec_t, syncthing_config_home_t; - ') + roleattribute $1 syncthing_roles; - roleattribute $1 syncthing_roles; + domtrans_pattern($2, syncthing_exec_t, syncthing_t) - domtrans_pattern($2, syncthing_exec_t, syncthing_t) - - allow $2 syncthing_config_home_t:file { manage_file_perms relabel_file_perms }; - allow $2 syncthing_config_home_t:dir { manage_dir_perms relabel_dir_perms }; - allow $2 syncthing_config_home_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms }; + allow $2 syncthing_config_home_t:file { manage_file_perms relabel_file_perms }; + allow $2 syncthing_config_home_t:dir { manage_dir_perms relabel_dir_perms }; + allow $2 syncthing_config_home_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms }; ') diff --git a/syncthing.te b/syncthing.te index 8144389..92d0bf5 100644 --- a/syncthing.te +++ b/syncthing.te @@ -27,23 +27,23 @@ allow syncthing_t self:tcp_socket { listen accept }; can_exec(syncthing_t, syncthing_exec_t) +manage_dirs_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) +manage_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) +manage_lnk_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) + kernel_read_kernel_sysctls(syncthing_t) kernel_read_net_sysctls(syncthing_t) kernel_read_system_state(syncthing_t) corenet_tcp_sendrecv_generic_if(syncthing_t) corenet_udp_sendrecv_generic_if(syncthing_t) - corenet_tcp_bind_generic_node(syncthing_t) corenet_tcp_sendrecv_generic_node(syncthing_t) corenet_tcp_sendrecv_all_ports(syncthing_t) - corenet_udp_bind_generic_node(syncthing_t) corenet_udp_sendrecv_generic_node(syncthing_t) corenet_udp_sendrecv_all_ports(syncthing_t) - corenet_tcp_connect_all_ports(syncthing_t) - corenet_tcp_bind_syncthing_port(syncthing_t) corenet_udp_bind_syncthing_discovery_port(syncthing_t) corenet_tcp_bind_syncthing_admin_port(syncthing_t) @@ -55,10 +55,6 @@ fs_getattr_xattr_fs(syncthing_t) auth_use_nsswitch(syncthing_t) -manage_dirs_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) -manage_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) -manage_lnk_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) - miscfiles_read_generic_certs(syncthing_t) miscfiles_read_localization(syncthing_t) @@ -66,13 +62,11 @@ userdom_manage_user_home_content_files(syncthing_t) userdom_manage_user_home_content_dirs(syncthing_t) userdom_manage_user_home_content_symlinks(syncthing_t) userdom_user_home_dir_filetrans_user_home_content(syncthing_t, dir) - +userdom_use_user_terminals(syncthing_t) # newly created files in ~/.config/syncthing/ will transition to syncthing_config_home_t userdom_user_home_content_filetrans(syncthing_t, syncthing_config_home_t, dir, "syncthing") -userdom_use_user_terminals(syncthing_t) - optional_policy(` - # temporary hack for /run/NetworkManager/resolv.conf until we make this part of sysnet_dns_name_resolve() - networkmanager_read_pid_files(syncthing_t) + # temporary hack for /run/NetworkManager/resolv.conf until we make this part of sysnet_dns_name_resolve() + networkmanager_read_pid_files(syncthing_t) ')