public inbox for gentoo-commits@lists.gentoo.org
 help / color / mirror / Atom feed
* [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/admin/, policy/modules/kernel/
@ 2017-01-01 16:36 Jason Zaman
  2017-01-01 16:37 ` [gentoo-commits] proj/hardened-refpolicy:next commit in: policy/modules/admin/, policy/modules/kernel/, policy/modules/system/ Jason Zaman
  0 siblings, 1 reply; 3+ messages in thread
From: Jason Zaman @ 2017-01-01 16:36 UTC (permalink / raw
  To: gentoo-commits

commit:     95c3bafc99092ebfe2cd865dec9a72524e398538
Author:     Chris PeBenito <pebenito <AT> ieee <DOT> org>
AuthorDate: Tue Dec 27 15:51:56 2016 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Jan  1 16:26:28 2017 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=95c3bafc

Module version bump for patches from Guido Trentalancia.

 policy/modules/admin/bootloader.te  | 2 +-
 policy/modules/kernel/devices.te    | 2 +-
 policy/modules/kernel/files.te      | 2 +-
 policy/modules/kernel/filesystem.te | 2 +-
 policy/modules/kernel/kernel.te     | 2 +-
 policy/modules/kernel/terminal.te   | 2 +-
 policy/modules/system/modutils.te   | 2 +-
 policy/modules/system/userdomain.te | 2 +-
 8 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/policy/modules/admin/bootloader.te b/policy/modules/admin/bootloader.te
index e3f2a72..ab25f9e 100644
--- a/policy/modules/admin/bootloader.te
+++ b/policy/modules/admin/bootloader.te
@@ -1,4 +1,4 @@
-policy_module(bootloader, 1.16.0)
+policy_module(bootloader, 1.16.1)
 
 ########################################
 #

diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
index 7a3c147..fd7e826 100644
--- a/policy/modules/kernel/devices.te
+++ b/policy/modules/kernel/devices.te
@@ -1,4 +1,4 @@
-policy_module(devices, 1.19.0)
+policy_module(devices, 1.19.1)
 
 ########################################
 #

diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te
index 1e58d9e..4cf374b 100644
--- a/policy/modules/kernel/files.te
+++ b/policy/modules/kernel/files.te
@@ -1,4 +1,4 @@
-policy_module(files, 1.22.1)
+policy_module(files, 1.22.2)
 
 ########################################
 #

diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
index 76f295d..a9c97ef 100644
--- a/policy/modules/kernel/filesystem.te
+++ b/policy/modules/kernel/filesystem.te
@@ -1,4 +1,4 @@
-policy_module(filesystem, 1.21.2)
+policy_module(filesystem, 1.21.3)
 
 ########################################
 #

diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index 2a6ab8e..45626b7 100644
--- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te
@@ -1,4 +1,4 @@
-policy_module(kernel, 1.21.2)
+policy_module(kernel, 1.21.3)
 
 ########################################
 #

diff --git a/policy/modules/kernel/terminal.te b/policy/modules/kernel/terminal.te
index 63f43f7..ac68855 100644
--- a/policy/modules/kernel/terminal.te
+++ b/policy/modules/kernel/terminal.te
@@ -1,4 +1,4 @@
-policy_module(terminal, 1.15.1)
+policy_module(terminal, 1.15.2)
 
 ########################################
 #

diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
index 1a138a8..379be74 100644
--- a/policy/modules/system/modutils.te
+++ b/policy/modules/system/modutils.te
@@ -1,4 +1,4 @@
-policy_module(modutils, 1.16.2)
+policy_module(modutils, 1.16.3)
 
 ########################################
 #

diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index bdd8b8b..1609f57 100644
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -1,4 +1,4 @@
-policy_module(userdomain, 4.12.3)
+policy_module(userdomain, 4.12.4)
 
 ########################################
 #


^ permalink raw reply related	[flat|nested] 3+ messages in thread
* [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/admin/, policy/modules/kernel/
@ 2017-02-21  7:11 Jason Zaman
  0 siblings, 0 replies; 3+ messages in thread
From: Jason Zaman @ 2017-02-21  7:11 UTC (permalink / raw
  To: gentoo-commits

commit:     714e9ab9df24045d661cbd2d5335a3739d4cf8a5
Author:     Chris PeBenito <pebenito <AT> ieee <DOT> org>
AuthorDate: Sun Feb 19 21:13:14 2017 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Tue Feb 21 07:03:24 2017 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=714e9ab9

dpkg: Updates from Russell Coker.

 policy/modules/admin/bootloader.te  |  8 +++-
 policy/modules/kernel/devices.if    | 20 ++++++++++
 policy/modules/kernel/devices.te    |  2 +-
 policy/modules/system/init.if       | 73 +++++++++++++++++++++++++++++++++++++
 policy/modules/system/init.te       |  8 ++--
 policy/modules/system/systemd.if    | 19 ++++++++++
 policy/modules/system/systemd.te    |  2 +-
 policy/modules/system/userdomain.if |  4 ++
 policy/modules/system/userdomain.te |  2 +-
 9 files changed, 131 insertions(+), 7 deletions(-)

diff --git a/policy/modules/admin/bootloader.te b/policy/modules/admin/bootloader.te
index 8b7c18cd..51c2266c 100644
--- a/policy/modules/admin/bootloader.te
+++ b/policy/modules/admin/bootloader.te
@@ -1,4 +1,4 @@
-policy_module(bootloader, 1.17.2)
+policy_module(bootloader, 1.17.3)
 
 ########################################
 #
@@ -149,6 +149,12 @@ ifdef(`distro_debian',`
 	fstools_relabelto_entry_files(bootloader_t)
 
 	libs_relabelto_lib_files(bootloader_t)
+
+	# for apt-cache
+	apt_read_db(bootloader_t)
+	apt_read_cache(bootloader_t)
+
+	dpkg_read_db(bootloader_t)
 ')
 
 ifdef(`distro_redhat',`

diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index 428f5a01..08e2e8af 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -3260,6 +3260,26 @@ interface(`dev_create_null_dev',`
 
 ########################################
 ## <summary>
+##     Manage services with script type null_device_t for when
+##     /lib/systemd/system/something.service is a link to /dev/null
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`dev_manage_null_service',`
+	gen_require(`
+		type null_device_t;
+		class service { status start stop reload };
+	')
+
+	allow $1 null_device_t:service { status start stop reload };
+')
+
+########################################
+## <summary>
 ##	Do not audit attempts to get the attributes
 ##	of the BIOS non-volatile RAM device.
 ## </summary>

diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
index 767da245..66bc754e 100644
--- a/policy/modules/kernel/devices.te
+++ b/policy/modules/kernel/devices.te
@@ -1,4 +1,4 @@
-policy_module(devices, 1.20.1)
+policy_module(devices, 1.20.2)
 
 ########################################
 #

diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index fdf3f034..1b26cf5e 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -809,6 +809,42 @@ interface(`init_udp_send',`
 
 ########################################
 ## <summary>
+##	start service (systemd).
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`init_start_system',`
+	gen_require(`
+		type init_t;
+	')
+
+	allow $1 init_t:system start;
+')
+
+########################################
+## <summary>
+##	stop service (systemd).
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`init_stop_system',`
+	gen_require(`
+		type init_t;
+	')
+
+	allow $1 init_t:system stop;
+')
+
+########################################
+## <summary>
 ##	Get all service status (systemd).
 ## </summary>
 ## <param name="domain">
@@ -1335,6 +1371,25 @@ interface(`init_script_file_domtrans',`
 
 ########################################
 ## <summary>
+##      Allow manage service for initrc_exec_t scripts
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Target domain
+##      </summary>
+## </param>
+#
+interface(`init_manage_script_service',`
+	gen_require(`
+		type initrc_exec_t;
+		class service { status start stop };
+	')
+
+	allow $1 initrc_exec_t:service { start stop status };
+')
+
+########################################
+## <summary>
 ##	Transition to the init script domain
 ##	on a specified labeled init script.
 ## </summary>
@@ -1475,6 +1530,24 @@ interface(`init_run_daemon',`
 
 ########################################
 ## <summary>
+##     Start and stop init_script_file_type services
+## </summary>
+## <param name="domain">
+##     <summary>
+##     domain that can start and stop the services
+##     </summary>
+## </param>
+#
+interface(`init_startstop_all_script_services',`
+	gen_require(`
+		attribute init_script_file_type;
+	')
+
+	allow $1 init_script_file_type:service { start status stop };
+')
+
+########################################
+## <summary>
 ##	Read the process state (/proc/pid) of init.
 ## </summary>
 ## <param name="domain">

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index cad90ba5..e07f7050 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -1,4 +1,4 @@
-policy_module(init, 2.2.3)
+policy_module(init, 2.2.4)
 
 gen_require(`
 	class passwd rootok;
@@ -277,8 +277,6 @@ ifdef(`init_systemd',`
 
 	term_relabel_pty_dirs(init_t)
 
-	clock_read_adjtime(init_t)
-
 	logging_manage_pid_sockets(init_t)
 	logging_send_audit_msgs(init_t)
 	logging_relabelto_devlog_sock_files(init_t)
@@ -289,6 +287,10 @@ ifdef(`init_systemd',`
 	udev_create_kobject_uevent_sockets(init_t)
 
 	optional_policy(`
+		clock_read_adjtime(init_t)
+	')
+
+	optional_policy(`
 		systemd_relabelto_kmod_files(init_t)
 		systemd_dbus_chat_logind(init_t)
 	')

diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
index 705cbaa3..b07d2c5b 100644
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
@@ -137,6 +137,25 @@ interface(`systemd_relabelto_kmod_files',`
 
 ########################################
 ## <summary>
+##     Allow systemd_logind_t to read process state for cgroup file
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain systemd_logind_t may access.
+##     </summary>
+## </param>
+#
+interface(`systemd_read_logind_state',`
+	gen_require(`
+		type systemd_logind_t;
+	')
+
+	allow systemd_logind_t $1:dir list_dir_perms;
+	allow systemd_logind_t $1:file read_file_perms;
+')
+
+########################################
+## <summary>
 ##   Get the system status information from systemd_login
 ## </summary>
 ## <param name="domain">

diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 395f62cd..7ae7ce1d 100644
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -1,4 +1,4 @@
-policy_module(systemd, 1.3.2)
+policy_module(systemd, 1.3.3)
 
 #########################################
 #

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 334759e8..45c0339f 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -696,6 +696,10 @@ template(`userdom_common_user_template',`
 	')
 
 	optional_policy(`
+		dpkg_read_db($1_t)
+	')
+
+	optional_policy(`
 		hwloc_exec_dhwd($1_t)
 		hwloc_read_runtime_files($1_t)
 	')

diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index e5c04d77..df3b9572 100644
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -1,4 +1,4 @@
-policy_module(userdomain, 4.13.0)
+policy_module(userdomain, 4.13.1)
 
 ########################################
 #


^ permalink raw reply related	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-02-21  7:12 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-01-01 16:36 [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/admin/, policy/modules/kernel/ Jason Zaman
2017-01-01 16:37 ` [gentoo-commits] proj/hardened-refpolicy:next commit in: policy/modules/admin/, policy/modules/kernel/, policy/modules/system/ Jason Zaman
  -- strict thread matches above, loose matches on Subject: below --
2017-02-21  7:11 [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/admin/, policy/modules/kernel/ Jason Zaman

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox