[gentoo-commits] proj/hardened-refpolicy:swift commit in: policy/modules/system/

["Sven Vermeulen" <swift@gentoo.org>]

commit:     542af989565d81b90ef54fcb78d259fb7073bfba
Author:     Nicolas Iooss <nicolas.iooss <AT> m4x <DOT> org>
AuthorDate: Sat Apr 15 18:23:34 2017 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Sun May  7 15:49:16 2017 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=542af989

Synchronize file patterns for /usr/bin/mount... and /usr/sbin/mount...

mount.fc defines file contexts for /usr/bin/mount.*, /usr/bin/umount.*
and /usr/sbin/mount\.zfs. These patterns are not consistent for two
reasons:

- some distributions use /sbin/mount... for other file systems that zfs.
  For example Debian uses /sbin/mount.ntfs-3g
  (https://packages.debian.org/jessie/amd64/ntfs-3g/filelist)
- mount_exec_t type should only be applied to mount, umount, mount.$FS
  and umount.udisks2, not mountpoint.

Replace the file patterns with ones that do not match mountpoint and
match every mount and umount programs in /usr/bin and /usr/sbin.

 policy/modules/system/mount.fc | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/policy/modules/system/mount.fc b/policy/modules/system/mount.fc
index 39ea6f5c..97e2596b 100644
--- a/policy/modules/system/mount.fc
+++ b/policy/modules/system/mount.fc
@@ -1,8 +1,9 @@
 /usr/bin/fusermount		--	gen_context(system_u:object_r:mount_exec_t,s0)
-/usr/bin/mount.*		--	gen_context(system_u:object_r:mount_exec_t,s0)
-/usr/bin/umount.*		--	gen_context(system_u:object_r:mount_exec_t,s0)
+/usr/bin/mount(\.[^/]+)?	--	gen_context(system_u:object_r:mount_exec_t,s0)
+/usr/bin/umount(\.[^/]+)?	--	gen_context(system_u:object_r:mount_exec_t,s0)
 
-/usr/sbin/mount\.zfs		--	gen_context(system_u:object_r:mount_exec_t,s0)
+/usr/sbin/mount(\.[^/]+)?	--	gen_context(system_u:object_r:mount_exec_t,s0)
+/usr/sbin/umount(\.[^/]+)?	--	gen_context(system_u:object_r:mount_exec_t,s0)
 /usr/sbin/zfs			--	gen_context(system_u:object_r:mount_exec_t,s0)
 /usr/sbin/zpool			--	gen_context(system_u:object_r:mount_exec_t,s0)