[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <swift@gentoo.org>]

commit:     30f047c074b82fddea4cd78aab1e2935733d29ef
Author:     David Sugar <dsugar <AT> tresys <DOT> com>
AuthorDate: Sat Feb 24 14:52:17 2018 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Sun Mar 25 09:30:30 2018 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=30f047c0

ntp only uses UDP, remove TCP permissions

The NTP protocol states it only used UDP for network communication.  Remove currently allowed access to TCP that should not be needed.

Signed-off-by: Dave Sugar <dsugar <AT> tresys.com>

 policy/modules/contrib/ntp.te | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/policy/modules/contrib/ntp.te b/policy/modules/contrib/ntp.te
index 66c8eaa9..50d54178 100644
--- a/policy/modules/contrib/ntp.te
+++ b/policy/modules/contrib/ntp.te
@@ -59,7 +59,6 @@ allow ntpd_t self:process { signal_perms getcap setcap setsched setrlimit };
 allow ntpd_t self:fifo_file rw_fifo_file_perms;
 allow ntpd_t self:shm create_shm_perms;
 allow ntpd_t self:socket create;
-allow ntpd_t self:tcp_socket { accept listen };
 allow ntpd_t self:unix_dgram_socket sendto;
 
 allow ntpd_t ntp_conf_t:file read_file_perms;
@@ -101,20 +100,15 @@ kernel_request_load_module(ntpd_t)
 
 corenet_all_recvfrom_unlabeled(ntpd_t)
 corenet_all_recvfrom_netlabel(ntpd_t)
-corenet_tcp_sendrecv_generic_if(ntpd_t)
 corenet_udp_sendrecv_generic_if(ntpd_t)
-corenet_tcp_sendrecv_generic_node(ntpd_t)
 corenet_udp_sendrecv_generic_node(ntpd_t)
 corenet_udp_bind_generic_node(ntpd_t)
 
+corenet_sendrecv_ntp_client_packets(ntpd_t)
 corenet_sendrecv_ntp_server_packets(ntpd_t)
 corenet_udp_bind_ntp_port(ntpd_t)
 corenet_udp_sendrecv_ntp_port(ntpd_t)
 
-corenet_sendrecv_ntp_client_packets(ntpd_t)
-corenet_tcp_connect_ntp_port(ntpd_t)
-corenet_tcp_sendrecv_ntp_port(ntpd_t)
-
 corecmd_exec_bin(ntpd_t)
 corecmd_exec_shell(ntpd_t)