[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/

[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/

[Jason Zaman]

commit:     5b8d41a56f311e6238010a2b2d42480f904eefb6
Author:     Chris PeBenito <cpebenito <AT> tresys <DOT> com>
AuthorDate: Tue Jan 27 22:25:36 2015 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Feb 15 17:36:25 2015 +0000
URL:        http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=5b8d41a5

Add always_check_network policy capability.

Disabled by default, as most systems don't want/need this.

---
 policy/policy_capabilities | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/policy/policy_capabilities b/policy/policy_capabilities
index db3cbca..70a4311 100644
--- a/policy/policy_capabilities
+++ b/policy/policy_capabilities
@@ -31,3 +31,13 @@ policycap network_peer_controls;
 # blk_file: open
 #
 policycap open_perms;
+
+# Always enforce network access controls, even
+# if labeling is not configured for them.
+# Available in kernel 3.13+
+#
+# Checks enabled:
+# packet: send recv
+# peer: recv
+#
+# policycap always_check_network;

[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/

[Sven Vermeulen]

commit:     17d82600898b99b225b7ac938eb59215ce351013
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Wed Mar  4 17:14:12 2015 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Wed Mar  4 17:14:12 2015 +0000
URL:        http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=17d82600

Mark storage as base module

All modules within the base should not depend on anything that is
modular. However recently we had to allow kernel_t certain privileges
which are covered not only by an interface of the storage module (which
is not an issue) but also by an attribute that is managed by that
module.

As a result, base fails to build:

$ make base
Compiling mcs base module
/usr/bin/checkmodule:  loading policy configuration from base.conf
policy/modules/kernel/kernel.te:433:ERROR 'attribute fixed_disk_raw_read
is not declared' at token ';' on line 23210:
        typeattribute kernel_t fixed_disk_raw_read;
\#line 433
/usr/bin/checkmodule:  error(s) encountered while parsing configuration
Rules.modular:98: recipe for target 'tmp/base.mod' failed
make: *** [tmp/base.mod] Error 1

Moving storage as a base module.

X-Gentoo-Bug: 535992
X-Gentoo-Bug-URL: https://bugs.gentoo.org/show_bug.cgi?id=535992

 policy/modules.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/policy/modules.conf b/policy/modules.conf
index b9b41d9..5d9eee7 100644
--- a/policy/modules.conf
+++ b/policy/modules.conf
@@ -2306,7 +2306,7 @@ zosremote = module
 #
 # Policy controlling access to storage devices
 # 
-storage = module
+storage = base
 
 # Layer: roles
 # Module: auditadm

[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/

[Jason Zaman]

commit:     8a2e330d69d5161cb8c8c501c4c431bc984f1a01
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Fri Feb 10 16:26:10 2017 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Fri Feb 17 08:46:50 2017 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=8a2e330d

mls mcs: Add constraints for key class

Taken from fedoras policy
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mls
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mcs

 policy/mcs | 3 +++
 policy/mls | 8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/policy/mcs b/policy/mcs
index 4d030112..94319570 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -123,6 +123,9 @@ mlsconstrain process { signal }
 mlsconstrain { tcp_socket udp_socket rawip_socket } node_bind
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
+mlsconstrain key { create link read search setattr view write }
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
 #
 # MCS policy for SELinux-enabled databases
 #

diff --git a/policy/mls b/policy/mls
index 69ca7263..c9be3125 100644
--- a/policy/mls
+++ b/policy/mls
@@ -281,6 +281,14 @@ mlsconstrain msg send
 # { ipc sem msgq shm } associate
 
 
+#
+# MLS policy for the key class
+#
+
+mlsconstrain key { create link read search setattr view write }
+	(( l1 eq l2 ) or
+	 (( t1 == mlsprocwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
+	 ( t1 == mlsprocwrite ));
 
 
 #

[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/

[Jason Zaman]

commit:     3f03475592f2fe3501c18f32086e79a305accbaa
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Fri Feb 10 16:26:10 2017 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Feb 25 14:54:49 2017 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=3f034755

mls mcs: Add constraints for key class

Taken from fedoras policy
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mls
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mcs

 policy/mcs | 3 +++
 policy/mls | 8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/policy/mcs b/policy/mcs
index 4d030112..94319570 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -123,6 +123,9 @@ mlsconstrain process { signal }
 mlsconstrain { tcp_socket udp_socket rawip_socket } node_bind
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
+mlsconstrain key { create link read search setattr view write }
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
 #
 # MCS policy for SELinux-enabled databases
 #

diff --git a/policy/mls b/policy/mls
index 69ca7263..c9be3125 100644
--- a/policy/mls
+++ b/policy/mls
@@ -281,6 +281,14 @@ mlsconstrain msg send
 # { ipc sem msgq shm } associate
 
 
+#
+# MLS policy for the key class
+#
+
+mlsconstrain key { create link read search setattr view write }
+	(( l1 eq l2 ) or
+	 (( t1 == mlsprocwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
+	 ( t1 == mlsprocwrite ));
 
 
 #

[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/

[Jason Zaman]

commit:     b2830743fd86192c5dc9d186ff0ae1ff8922d455
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Fri Feb 10 16:26:10 2017 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Feb 25 16:57:29 2017 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=b2830743

mls mcs: Add constraints for key class

Taken from fedoras policy
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mls
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mcs

 policy/mcs | 3 +++
 policy/mls | 8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/policy/mcs b/policy/mcs
index 4d030112..94319570 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -123,6 +123,9 @@ mlsconstrain process { signal }
 mlsconstrain { tcp_socket udp_socket rawip_socket } node_bind
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
+mlsconstrain key { create link read search setattr view write }
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
 #
 # MCS policy for SELinux-enabled databases
 #

diff --git a/policy/mls b/policy/mls
index 69ca7263..c9be3125 100644
--- a/policy/mls
+++ b/policy/mls
@@ -281,6 +281,14 @@ mlsconstrain msg send
 # { ipc sem msgq shm } associate
 
 
+#
+# MLS policy for the key class
+#
+
+mlsconstrain key { create link read search setattr view write }
+	(( l1 eq l2 ) or
+	 (( t1 == mlsprocwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
+	 ( t1 == mlsprocwrite ));
 
 
 #

[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/

[Jason Zaman]

commit:     deaf780119c0ddf2fd11107cbefeeb2112e6b65f
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Fri Feb 10 16:26:10 2017 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Mon Feb 27 11:32:41 2017 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=deaf7801

mls mcs: Add constraints for key class

Taken from fedoras policy
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mls
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mcs

 policy/mcs | 3 +++
 policy/mls | 8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/policy/mcs b/policy/mcs
index 4d030112..94319570 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -123,6 +123,9 @@ mlsconstrain process { signal }
 mlsconstrain { tcp_socket udp_socket rawip_socket } node_bind
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
+mlsconstrain key { create link read search setattr view write }
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
 #
 # MCS policy for SELinux-enabled databases
 #

diff --git a/policy/mls b/policy/mls
index 69ca7263..c9be3125 100644
--- a/policy/mls
+++ b/policy/mls
@@ -281,6 +281,14 @@ mlsconstrain msg send
 # { ipc sem msgq shm } associate
 
 
+#
+# MLS policy for the key class
+#
+
+mlsconstrain key { create link read search setattr view write }
+	(( l1 eq l2 ) or
+	 (( t1 == mlsprocwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
+	 ( t1 == mlsprocwrite ));
 
 
 #

[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/

[Jason Zaman]

commit:     fc01a74a4d318e4a2a4f42ce6deada98652ab5de
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Fri Feb 10 16:26:10 2017 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Thu Mar 30 16:50:39 2017 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=fc01a74a

mls mcs: Add constraints for key class

Taken from fedoras policy
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mls
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mcs

 policy/mcs | 3 +++
 policy/mls | 8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/policy/mcs b/policy/mcs
index 4d030112..94319570 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -123,6 +123,9 @@ mlsconstrain process { signal }
 mlsconstrain { tcp_socket udp_socket rawip_socket } node_bind
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
+mlsconstrain key { create link read search setattr view write }
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
 #
 # MCS policy for SELinux-enabled databases
 #

diff --git a/policy/mls b/policy/mls
index 69ca7263..c9be3125 100644
--- a/policy/mls
+++ b/policy/mls
@@ -281,6 +281,14 @@ mlsconstrain msg send
 # { ipc sem msgq shm } associate
 
 
+#
+# MLS policy for the key class
+#
+
+mlsconstrain key { create link read search setattr view write }
+	(( l1 eq l2 ) or
+	 (( t1 == mlsprocwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
+	 ( t1 == mlsprocwrite ));
 
 
 #

[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/

[Jason Zaman]

commit:     9733991e631440e74b8536e9ecc9d397cd1cdfb5
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Fri Feb 10 16:26:10 2017 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Apr 30 09:31:51 2017 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=9733991e

mls mcs: Add constraints for key class

Taken from fedoras policy
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mls
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mcs

 policy/mcs | 3 +++
 policy/mls | 8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/policy/mcs b/policy/mcs
index 4d030112..94319570 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -123,6 +123,9 @@ mlsconstrain process { signal }
 mlsconstrain { tcp_socket udp_socket rawip_socket } node_bind
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
+mlsconstrain key { create link read search setattr view write }
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
 #
 # MCS policy for SELinux-enabled databases
 #

diff --git a/policy/mls b/policy/mls
index 69ca7263..c9be3125 100644
--- a/policy/mls
+++ b/policy/mls
@@ -281,6 +281,14 @@ mlsconstrain msg send
 # { ipc sem msgq shm } associate
 
 
+#
+# MLS policy for the key class
+#
+
+mlsconstrain key { create link read search setattr view write }
+	(( l1 eq l2 ) or
+	 (( t1 == mlsprocwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
+	 ( t1 == mlsprocwrite ));
 
 
 #

[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/

[Jason Zaman]

commit:     fcac712fc021f879207385feb4f55aea5c8bd3b8
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Fri Feb 10 16:26:10 2017 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun May  7 17:40:30 2017 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=fcac712f

mls mcs: Add constraints for key class

Taken from fedoras policy
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mls
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mcs

 policy/mcs | 3 +++
 policy/mls | 8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/policy/mcs b/policy/mcs
index 4d030112..94319570 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -123,6 +123,9 @@ mlsconstrain process { signal }
 mlsconstrain { tcp_socket udp_socket rawip_socket } node_bind
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
+mlsconstrain key { create link read search setattr view write }
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
 #
 # MCS policy for SELinux-enabled databases
 #

diff --git a/policy/mls b/policy/mls
index 69ca7263..c9be3125 100644
--- a/policy/mls
+++ b/policy/mls
@@ -281,6 +281,14 @@ mlsconstrain msg send
 # { ipc sem msgq shm } associate
 
 
+#
+# MLS policy for the key class
+#
+
+mlsconstrain key { create link read search setattr view write }
+	(( l1 eq l2 ) or
+	 (( t1 == mlsprocwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
+	 ( t1 == mlsprocwrite ));
 
 
 #

[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/

[Jason Zaman]

commit:     36b1b31086d836e12cabe57f32314354e07b610c
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Fri Feb 10 16:26:10 2017 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Thu May 25 17:03:59 2017 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=36b1b310

mls mcs: Add constraints for key class

Taken from fedoras policy
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mls
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mcs

 policy/mcs | 3 +++
 policy/mls | 8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/policy/mcs b/policy/mcs
index 4d030112..94319570 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -123,6 +123,9 @@ mlsconstrain process { signal }
 mlsconstrain { tcp_socket udp_socket rawip_socket } node_bind
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
+mlsconstrain key { create link read search setattr view write }
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
 #
 # MCS policy for SELinux-enabled databases
 #

diff --git a/policy/mls b/policy/mls
index 69ca7263..c9be3125 100644
--- a/policy/mls
+++ b/policy/mls
@@ -281,6 +281,14 @@ mlsconstrain msg send
 # { ipc sem msgq shm } associate
 
 
+#
+# MLS policy for the key class
+#
+
+mlsconstrain key { create link read search setattr view write }
+	(( l1 eq l2 ) or
+	 (( t1 == mlsprocwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
+	 ( t1 == mlsprocwrite ));
 
 
 #

[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/

[Jason Zaman]

commit:     409546eda11ca6d9d54367516c725b3ba5d890c2
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Fri Feb 10 16:26:10 2017 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Sep 10 13:53:30 2017 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=409546ed

mls mcs: Add constraints for key class

Taken from fedoras policy
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mls
https://github.com/fedora-selinux/selinux-policy/blob/rawhide-base/policy/mcs

 policy/mcs | 3 +++
 policy/mls | 8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/policy/mcs b/policy/mcs
index 4d030112..94319570 100644
--- a/policy/mcs
+++ b/policy/mcs
@@ -123,6 +123,9 @@ mlsconstrain process { signal }
 mlsconstrain { tcp_socket udp_socket rawip_socket } node_bind
 	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
 
+mlsconstrain key { create link read search setattr view write }
+	(( h1 dom h2 ) or ( t1 != mcs_constrained_type ));
+
 #
 # MCS policy for SELinux-enabled databases
 #

diff --git a/policy/mls b/policy/mls
index 69ca7263..c9be3125 100644
--- a/policy/mls
+++ b/policy/mls
@@ -281,6 +281,14 @@ mlsconstrain msg send
 # { ipc sem msgq shm } associate
 
 
+#
+# MLS policy for the key class
+#
+
+mlsconstrain key { create link read search setattr view write }
+	(( l1 eq l2 ) or
+	 (( t1 == mlsprocwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
+	 ( t1 == mlsprocwrite ));
 
 
 #