From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 1667A138334 for ; Tue, 24 Dec 2019 10:00:36 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 0B02DE0AF6; Tue, 24 Dec 2019 10:00:35 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id C8363E0B11 for ; Tue, 24 Dec 2019 10:00:34 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 3893B34DB1B for ; Tue, 24 Dec 2019 10:00:33 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id E747E2D for ; Tue, 24 Dec 2019 10:00:30 +0000 (UTC) From: "Jason Zaman" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jason Zaman" Message-ID: <1577181507.0fc88387bdc52d40b6388336d655a4374271b049.perfinion@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/services/, policy/modules/admin/, ... X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/admin/puppet.te policy/modules/apps/qemu.if policy/modules/apps/qemu.te policy/modules/contrib/at.fc policy/modules/contrib/at.te policy/modules/contrib/bitcoin.if policy/modules/contrib/bitcoin.te policy/modules/contrib/ceph.fc policy/modules/contrib/ceph.if policy/modules/contrib/ceph.te policy/modules/contrib/dirsrv.fc policy/modules/contrib/dirsrv.if policy/modules/contrib/dirsrv.te policy/modules/contrib/nginx.if policy/modules/contrib/nginx.te policy/modules/contrib/phpfpm.fc policy/modules/contrib/phpfpm.if policy/modules/contrib/phpfpm.te policy/modules/contrib/resolvconf.fc policy/modules/contrib/resolvconf.if policy/modules/contrib/resolvconf.te policy/modules/contrib/salt.fc policy/modules/contrib/salt.if policy/modules/contrib/salt.rst policy/modules/contrib/salt.te policy/modules/contrib/vde.fc policy/modules/contrib/vde.if policy/modules/contrib/vde.te policy/modules/services/apache.te policy/modules/services/clamav.te policy/modules/services /courier.te policy/modules/services/cron.fc policy/modules/services/cron.rst policy/modules/services/dbus.if policy/modules/services/fail2ban.te policy/modules/services/ldap.te policy/modules/services/munin.rst policy/modules/services/mysql.if policy/modules/services/networkmanager.fc policy/modules/services/networkmanager.te policy/modules/services/ntp.fc policy/modules/system/authlogin.te policy/modules/system/init.te policy/modules/system/lvm.te policy/modules/system/modutils.te policy/modules/system/sysnetwork.fc policy/modules/system/sysnetwork.te policy/modules/system/tmpfiles.fc policy/modules/system/tmpfiles.if policy/modules/system/tmpfiles.rst policy/modules/system/tmpfiles.te X-VCS-Directories: policy/modules/system/ policy/modules/contrib/ policy/modules/apps/ policy/modules/admin/ policy/modules/services/ X-VCS-Committer: perfinion X-VCS-Committer-Name: Jason Zaman X-VCS-Revision: 0fc88387bdc52d40b6388336d655a4374271b049 X-VCS-Branch: master Date: Tue, 24 Dec 2019 10:00:30 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: e3e09143-29f7-4cc0-8735-9689ddd164ae X-Archives-Hash: 5daa745ee5c6a6e302b71bcf7a2e6683 commit: 0fc88387bdc52d40b6388336d655a4374271b049 Author: Jason Zaman gentoo org> AuthorDate: Mon Dec 16 17:45:34 2019 +0000 Commit: Jason Zaman gentoo org> CommitDate: Tue Dec 24 09:58:27 2019 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=0fc88387 Rename gentoo-specific *_var_run_t types to *_runtime_t. Signed-off-by: Jason Zaman gentoo.org> policy/modules/admin/puppet.te | 2 +- policy/modules/apps/qemu.if | 4 +-- policy/modules/apps/qemu.te | 4 +-- policy/modules/contrib/at.fc | 4 +-- policy/modules/contrib/at.te | 10 +++--- policy/modules/contrib/bitcoin.if | 4 +-- policy/modules/contrib/bitcoin.te | 4 +-- policy/modules/contrib/ceph.fc | 10 +++--- policy/modules/contrib/ceph.if | 13 ++++---- policy/modules/contrib/ceph.te | 10 +++--- policy/modules/contrib/dirsrv.fc | 4 +-- policy/modules/contrib/dirsrv.if | 18 +++++------ policy/modules/contrib/dirsrv.te | 22 ++++++------- policy/modules/contrib/nginx.if | 4 +-- policy/modules/contrib/nginx.te | 10 +++--- policy/modules/contrib/phpfpm.fc | 4 +-- policy/modules/contrib/phpfpm.if | 8 ++--- policy/modules/contrib/phpfpm.te | 10 +++--- policy/modules/contrib/resolvconf.fc | 2 +- policy/modules/contrib/resolvconf.if | 4 +-- policy/modules/contrib/resolvconf.te | 10 +++--- policy/modules/contrib/salt.fc | 10 +++--- policy/modules/contrib/salt.if | 8 ++--- policy/modules/contrib/salt.rst | 6 ++-- policy/modules/contrib/salt.te | 52 +++++++++++++++---------------- policy/modules/contrib/vde.fc | 2 +- policy/modules/contrib/vde.if | 6 ++-- policy/modules/contrib/vde.te | 12 +++---- policy/modules/services/apache.te | 4 +-- policy/modules/services/clamav.te | 2 +- policy/modules/services/courier.te | 2 +- policy/modules/services/cron.fc | 4 +-- policy/modules/services/cron.rst | 2 +- policy/modules/services/dbus.if | 8 ++--- policy/modules/services/fail2ban.te | 4 +-- policy/modules/services/ldap.te | 2 +- policy/modules/services/munin.rst | 2 +- policy/modules/services/mysql.if | 8 ++--- policy/modules/services/networkmanager.fc | 2 +- policy/modules/services/networkmanager.te | 8 ++--- policy/modules/services/ntp.fc | 2 +- policy/modules/system/authlogin.te | 2 +- policy/modules/system/init.te | 4 +-- policy/modules/system/lvm.te | 2 +- policy/modules/system/modutils.te | 4 +-- policy/modules/system/sysnetwork.fc | 4 +-- policy/modules/system/sysnetwork.te | 10 +++--- policy/modules/system/tmpfiles.fc | 2 +- policy/modules/system/tmpfiles.if | 32 +++++++++---------- policy/modules/system/tmpfiles.rst | 2 +- policy/modules/system/tmpfiles.te | 8 ++--- 51 files changed, 188 insertions(+), 189 deletions(-) diff --git a/policy/modules/admin/puppet.te b/policy/modules/admin/puppet.te index 85c4ac40..75d03e76 100644 --- a/policy/modules/admin/puppet.te +++ b/policy/modules/admin/puppet.te @@ -355,7 +355,7 @@ ifdef(`distro_gentoo',` rw_files_pattern(puppetmaster_t, puppet_log_t, puppet_log_t) - manage_files_pattern(puppetmaster_t, puppet_var_run_t, puppet_var_run_t) + manage_files_pattern(puppetmaster_t, puppet_runtime_t, puppet_runtime_t) optional_policy(` usermanage_check_exec_passwd(puppetmaster_t) diff --git a/policy/modules/apps/qemu.if b/policy/modules/apps/qemu.if index e373c4d9..413e1347 100644 --- a/policy/modules/apps/qemu.if +++ b/policy/modules/apps/qemu.if @@ -427,8 +427,8 @@ interface(`qemu_entry_type',` # interface(`qemu_rw_pid_sock_files',` gen_require(` - type qemu_var_run_t; + type qemu_runtime_t; ') - allow $1 qemu_var_run_t:sock_file rw_sock_file_perms; + allow $1 qemu_runtime_t:sock_file rw_sock_file_perms; ') diff --git a/policy/modules/apps/qemu.te b/policy/modules/apps/qemu.te index f99f2161..6188d362 100644 --- a/policy/modules/apps/qemu.te +++ b/policy/modules/apps/qemu.te @@ -90,9 +90,9 @@ ifdef(`distro_gentoo',` allow qemu_t self:udp_socket create_socket_perms; # Network related socket - allow qemu_t qemu_var_run_t:sock_file manage_sock_file_perms; + allow qemu_t qemu_runtime_t:sock_file manage_sock_file_perms; - files_pid_filetrans(qemu_t, qemu_var_run_t, sock_file) + files_pid_filetrans(qemu_t, qemu_runtime_t, sock_file) optional_policy(` vde_connect(qemu_t) diff --git a/policy/modules/contrib/at.fc b/policy/modules/contrib/at.fc index b3cf1863..39c83a99 100644 --- a/policy/modules/contrib/at.fc +++ b/policy/modules/contrib/at.fc @@ -1,9 +1,9 @@ /etc/rc\.d/init\.d/atd -- gen_context(system_u:object_r:atd_initrc_exec_t,s0) /usr/bin/at -- gen_context(system_u:object_r:at_exec_t,s0) -/usr/sbin/atd -- gen_context(system_u:object_r:atd_exec_t,s0) +/usr/bin/atd -- gen_context(system_u:object_r:atd_exec_t,s0) -/run/atd\.pid -- gen_context(system_u:object_r:atd_var_run_t,s0) +/run/atd\.pid -- gen_context(system_u:object_r:atd_runtime_t,s0) /var/spool/at(/.*)? gen_context(system_u:object_r:at_spool_t,s0) /var/spool/at/atjobs(/.*)? gen_context(system_u:object_r:at_job_t,s0) diff --git a/policy/modules/contrib/at.te b/policy/modules/contrib/at.te index c28a9e7b..b0900cbf 100644 --- a/policy/modules/contrib/at.te +++ b/policy/modules/contrib/at.te @@ -21,8 +21,8 @@ init_daemon_domain(atd_t, atd_exec_t) type atd_initrc_exec_t; init_script_file(atd_initrc_exec_t) -type atd_var_run_t; -files_pid_file(atd_var_run_t) +type atd_runtime_t alias atd_var_run_t; +files_pid_file(atd_runtime_t) ######################################## # @@ -39,8 +39,8 @@ list_dirs_pattern(atd_t, at_spool_t, at_job_t) manage_files_pattern(atd_t, at_job_log_t, at_job_log_t) -manage_files_pattern(atd_t, atd_var_run_t, atd_var_run_t) -files_pid_filetrans(atd_t, atd_var_run_t, file) +manage_files_pattern(atd_t, atd_runtime_t, atd_runtime_t) +files_pid_filetrans(atd_t, atd_runtime_t, file) kernel_read_kernel_sysctls(atd_t) @@ -81,7 +81,7 @@ allow at_t at_spool_t:dir search_dir_perms; allow at_t atd_t:process signal; -allow at_t atd_var_run_t:file read_file_perms; +allow at_t atd_runtime_t:file read_file_perms; domain_use_interactive_fds(at_t) diff --git a/policy/modules/contrib/bitcoin.if b/policy/modules/contrib/bitcoin.if index 9c7ca8da..7e00c963 100644 --- a/policy/modules/contrib/bitcoin.if +++ b/policy/modules/contrib/bitcoin.if @@ -19,7 +19,7 @@ interface(`bitcoin_admin',` gen_require(` type bitcoin_t; type bitcoin_etc_t, bitcoin_tmp_t, bitcoin_log_t; - type bitcoin_var_lib_t, bitcoin_var_run_t; + type bitcoin_var_lib_t, bitcoin_runtime_t; type bitcoin_initrc_exec_t; ') @@ -41,5 +41,5 @@ interface(`bitcoin_admin',` admin_pattern($1, bitcoin_var_lib_t) files_list_pids($1) - admin_pattern($1, bitcoin_var_run_t) + admin_pattern($1, bitcoin_runtime_t) ') diff --git a/policy/modules/contrib/bitcoin.te b/policy/modules/contrib/bitcoin.te index 672516e9..c5667519 100644 --- a/policy/modules/contrib/bitcoin.te +++ b/policy/modules/contrib/bitcoin.te @@ -31,8 +31,8 @@ type bitcoin_var_lib_t; files_type(bitcoin_var_lib_t) init_script_readable_type(bitcoin_var_lib_t) -type bitcoin_var_run_t; -files_pid_file(bitcoin_var_run_t) +type bitcoin_runtime_t alias bitcoin_var_run_t; +files_pid_file(bitcoin_runtime_t) type bitcoin_tmp_t; files_tmp_file(bitcoin_tmp_t) diff --git a/policy/modules/contrib/ceph.fc b/policy/modules/contrib/ceph.fc index 8e2e1799..4d1db681 100644 --- a/policy/modules/contrib/ceph.fc +++ b/policy/modules/contrib/ceph.fc @@ -23,8 +23,8 @@ /var/log/ceph(/.*)? gen_context(system_u:object_r:ceph_log_t,s0) -/run/ceph -d gen_context(system_u:object_r:ceph_var_run_t,s0) -/run/ceph/ceph-osd.* gen_context(system_u:object_r:ceph_osd_var_run_t,s0) -/run/ceph/ceph-mon.* gen_context(system_u:object_r:ceph_mon_var_run_t,s0) -/run/ceph/ceph-mds.* gen_context(system_u:object_r:ceph_mds_var_run_t,s0) -/run/ceph/mds.* -- gen_context(system_u:object_r:ceph_mds_var_run_t,s0) +/run/ceph -d gen_context(system_u:object_r:ceph_runtime_t,s0) +/run/ceph/ceph-osd.* gen_context(system_u:object_r:ceph_osd_runtime_t,s0) +/run/ceph/ceph-mon.* gen_context(system_u:object_r:ceph_mon_runtime_t,s0) +/run/ceph/ceph-mds.* gen_context(system_u:object_r:ceph_mds_runtime_t,s0) +/run/ceph/mds.* -- gen_context(system_u:object_r:ceph_mds_runtime_t,s0) diff --git a/policy/modules/contrib/ceph.if b/policy/modules/contrib/ceph.if index c922531b..9ff98e6f 100644 --- a/policy/modules/contrib/ceph.if +++ b/policy/modules/contrib/ceph.if @@ -17,7 +17,7 @@ template(`ceph_domain_template',` attribute cephpidfile; attribute_role ceph_roles; - type ceph_var_run_t; + type ceph_runtime_t; ') type ceph_$1_t, cephdomain; @@ -28,8 +28,9 @@ template(`ceph_domain_template',` type ceph_$1_data_t, cephdata; files_type(ceph_$1_data_t) - type ceph_$1_var_run_t, cephpidfile; - files_pid_file(ceph_$1_var_run_t) + type ceph_$1_runtime_t, cephpidfile; + typealias ceph_$1_runtime_t alias ceph_$1_var_run_t; + files_pid_file(ceph_$1_runtime_t) ######################################## # @@ -37,12 +38,12 @@ template(`ceph_domain_template',` # # Rules which cannot be made part of the domain - allow ceph_$1_t ceph_$1_var_run_t:file manage_file_perms; - allow ceph_$1_t ceph_$1_var_run_t:sock_file manage_file_perms; + allow ceph_$1_t ceph_$1_runtime_t:file manage_file_perms; + allow ceph_$1_t ceph_$1_runtime_t:sock_file manage_file_perms; allow ceph_$1_t ceph_$1_data_t:dir manage_dir_perms; allow ceph_$1_t ceph_$1_data_t:file manage_file_perms; - filetrans_pattern(ceph_$1_t, ceph_var_run_t, ceph_$1_var_run_t, { file sock_file }) + filetrans_pattern(ceph_$1_t, ceph_runtime_t, ceph_$1_runtime_t, { file sock_file }) files_var_lib_filetrans(ceph_$1_t, ceph_$1_data_t, { file dir }) ') diff --git a/policy/modules/contrib/ceph.te b/policy/modules/contrib/ceph.te index 9704dd41..94ebe44f 100644 --- a/policy/modules/contrib/ceph.te +++ b/policy/modules/contrib/ceph.te @@ -28,8 +28,8 @@ logging_log_file(ceph_log_t) type ceph_var_lib_t; files_type(ceph_var_lib_t) -type ceph_var_run_t; -files_pid_file(ceph_var_run_t) +type ceph_runtime_t alias ceph_var_run_t; +files_pid_file(ceph_runtime_t) ######################################### # @@ -48,8 +48,8 @@ allow cephdomain ceph_log_t:file { create_file_perms rw_file_perms }; allow cephdomain ceph_var_lib_t:dir search_dir_perms; allow cephdomain self:netlink_route_socket { rw_netlink_socket_perms }; allow cephdomain self:tcp_socket { create_socket_perms listen accept }; -allow cephdomain ceph_var_run_t:file manage_file_perms; -allow cephdomain ceph_var_run_t:dir manage_dir_perms; +allow cephdomain ceph_runtime_t:file manage_file_perms; +allow cephdomain ceph_runtime_t:dir manage_dir_perms; kernel_read_system_state(cephdomain) @@ -60,7 +60,7 @@ corenet_tcp_connect_all_unreserved_ports(cephdomain) files_read_etc_files(cephdomain) files_search_pids(cephdomain) files_search_var_lib(cephdomain) -files_pid_filetrans(cephdomain, ceph_var_run_t, dir) +files_pid_filetrans(cephdomain, ceph_runtime_t, dir) fs_getattr_all_fs(cephdomain) diff --git a/policy/modules/contrib/dirsrv.fc b/policy/modules/contrib/dirsrv.fc index 88b1a6eb..3a33d632 100644 --- a/policy/modules/contrib/dirsrv.fc +++ b/policy/modules/contrib/dirsrv.fc @@ -6,7 +6,7 @@ /var/lock/dirsrv(/.*)? gen_context(system_u:object_r:dirsrv_var_lock_t,s0) /var/log/dirsrv(/.*)? gen_context(system_u:object_r:dirsrv_var_log_t,s0) /var/log/dirsrv/ldap-agent.log gen_context(system_u:object_r:dirsrv_snmp_var_log_t,s0) -/run/dirsrv(/.*)? gen_context(system_u:object_r:dirsrv_var_run_t,s0) -/run/ldap-agent.pid gen_context(system_u:object_r:dirsrv_snmp_var_run_t,s0) +/run/dirsrv(/.*)? gen_context(system_u:object_r:dirsrv_runtime_t,s0) +/run/ldap-agent.pid gen_context(system_u:object_r:dirsrv_snmp_runtime_t,s0) /etc/dirsrv(/.*)? gen_context(system_u:object_r:dirsrv_config_t,s0) diff --git a/policy/modules/contrib/dirsrv.if b/policy/modules/contrib/dirsrv.if index cbe9ecaf..8c697fc9 100644 --- a/policy/modules/contrib/dirsrv.if +++ b/policy/modules/contrib/dirsrv.if @@ -112,11 +112,11 @@ interface(`dirsrv_manage_var_lib',` # interface(`dirsrv_manage_var_run',` gen_require(` - type dirsrv_var_run_t; + type dirsrv_runtime_t; ') - allow $1 dirsrv_var_run_t:dir manage_dir_perms; - allow $1 dirsrv_var_run_t:file manage_file_perms; - allow $1 dirsrv_var_run_t:sock_file manage_file_perms; + allow $1 dirsrv_runtime_t:dir manage_dir_perms; + allow $1 dirsrv_runtime_t:file manage_file_perms; + allow $1 dirsrv_runtime_t:sock_file manage_file_perms; ') ###################################### @@ -131,10 +131,10 @@ interface(`dirsrv_manage_var_run',` # interface(`dirsrv_pid_filetrans',` gen_require(` - type dirsrv_var_run_t; + type dirsrv_runtime_t; ') # Allow creating a dir in /var/run with this type - files_pid_filetrans($1, dirsrv_var_run_t, dir) + files_pid_filetrans($1, dirsrv_runtime_t, dir) ') ####################################### @@ -149,10 +149,10 @@ interface(`dirsrv_pid_filetrans',` # interface(`dirsrv_read_var_run',` gen_require(` - type dirsrv_var_run_t; + type dirsrv_runtime_t; ') - allow $1 dirsrv_var_run_t:dir list_dir_perms; - allow $1 dirsrv_var_run_t:file read_file_perms; + allow $1 dirsrv_runtime_t:dir list_dir_perms; + allow $1 dirsrv_runtime_t:file read_file_perms; ') ######################################## diff --git a/policy/modules/contrib/dirsrv.te b/policy/modules/contrib/dirsrv.te index 1a8b77a1..e7c8d06e 100644 --- a/policy/modules/contrib/dirsrv.te +++ b/policy/modules/contrib/dirsrv.te @@ -32,12 +32,12 @@ type dirsrv_snmp_var_log_t; logging_log_file(dirsrv_snmp_var_log_t) # pid files -type dirsrv_var_run_t; -files_pid_file(dirsrv_var_run_t) +type dirsrv_runtime_t alias dirsrv_var_run_t; +files_pid_file(dirsrv_runtime_t) # snmp pid file -type dirsrv_snmp_var_run_t; -files_pid_file(dirsrv_snmp_var_run_t) +type dirsrv_snmp_runtime_t alias dirsrv_snmp_var_run_t; +files_pid_file(dirsrv_snmp_runtime_t) # lock files type dirsrv_var_lock_t; @@ -95,11 +95,11 @@ allow dirsrv_t dirsrv_var_log_t:dir { setattr }; logging_log_filetrans(dirsrv_t,dirsrv_var_log_t,{ sock_file file dir }) # pid files -manage_files_pattern(dirsrv_t, dirsrv_var_run_t, dirsrv_var_run_t) -files_pid_filetrans(dirsrv_t, dirsrv_var_run_t, { file sock_file }) +manage_files_pattern(dirsrv_t, dirsrv_runtime_t, dirsrv_runtime_t) +files_pid_filetrans(dirsrv_t, dirsrv_runtime_t, { file sock_file }) # ldapi socket -manage_sock_files_pattern(dirsrv_t, dirsrv_var_run_t, dirsrv_var_run_t) +manage_sock_files_pattern(dirsrv_t, dirsrv_runtime_t, dirsrv_runtime_t) # lock files manage_files_pattern(dirsrv_t, dirsrv_var_lock_t, dirsrv_var_lock_t) @@ -175,7 +175,7 @@ files_manage_var_files(dirsrv_snmp_t) rw_files_pattern(dirsrv_snmp_t, dirsrv_tmpfs_t, dirsrv_tmpfs_t) # stats file -read_files_pattern(dirsrv_snmp_t, dirsrv_var_run_t, dirsrv_var_run_t) +read_files_pattern(dirsrv_snmp_t, dirsrv_runtime_t, dirsrv_runtime_t) # process stuff allow dirsrv_snmp_t self:capability { dac_override dac_read_search }; @@ -184,9 +184,9 @@ allow dirsrv_snmp_t self:capability { dac_override dac_read_search }; read_files_pattern(dirsrv_snmp_t, dirsrv_config_t, dirsrv_config_t) # pid file -manage_files_pattern(dirsrv_snmp_t, dirsrv_snmp_var_run_t, dirsrv_snmp_var_run_t) -files_pid_filetrans(dirsrv_snmp_t, dirsrv_snmp_var_run_t, { file sock_file }) -search_dirs_pattern(dirsrv_snmp_t, dirsrv_var_run_t, dirsrv_var_run_t) +manage_files_pattern(dirsrv_snmp_t, dirsrv_snmp_runtime_t, dirsrv_snmp_runtime_t) +files_pid_filetrans(dirsrv_snmp_t, dirsrv_snmp_runtime_t, { file sock_file }) +search_dirs_pattern(dirsrv_snmp_t, dirsrv_runtime_t, dirsrv_runtime_t) # log file manage_files_pattern(dirsrv_snmp_t, dirsrv_var_log_t, dirsrv_snmp_var_log_t); diff --git a/policy/modules/contrib/nginx.if b/policy/modules/contrib/nginx.if index ebef6e75..dbd9bcbe 100644 --- a/policy/modules/contrib/nginx.if +++ b/policy/modules/contrib/nginx.if @@ -81,7 +81,7 @@ interface(`nginx_domtrans',` # interface(`nginx_admin',` gen_require(` - type nginx_t, nginx_conf_t, nginx_log_t, nginx_var_lib_t, nginx_var_run_t; + type nginx_t, nginx_conf_t, nginx_log_t, nginx_var_lib_t, nginx_runtime_t; type nginx_exec_t; ') @@ -100,5 +100,5 @@ interface(`nginx_admin',` admin_pattern($1, nginx_log_t) files_list_pids($1) - admin_pattern($1, nginx_var_run_t) + admin_pattern($1, nginx_runtime_t) ') diff --git a/policy/modules/contrib/nginx.te b/policy/modules/contrib/nginx.te index be59babb..1818be85 100644 --- a/policy/modules/contrib/nginx.te +++ b/policy/modules/contrib/nginx.te @@ -69,8 +69,8 @@ type nginx_var_lib_t; files_type(nginx_var_lib_t) # pid files -type nginx_var_run_t; -files_pid_file(nginx_var_run_t) +type nginx_runtime_t alias nginx_var_run_t; +files_pid_file(nginx_runtime_t) ######################################## # @@ -92,9 +92,9 @@ logging_log_filetrans(nginx_t, nginx_log_t, { file dir }) # pid file -manage_dirs_pattern(nginx_t, nginx_var_run_t, nginx_var_run_t) -manage_files_pattern(nginx_t, nginx_var_run_t, nginx_var_run_t) -files_pid_filetrans(nginx_t, nginx_var_run_t, file) +manage_dirs_pattern(nginx_t, nginx_runtime_t, nginx_runtime_t) +manage_files_pattern(nginx_t, nginx_runtime_t, nginx_runtime_t) +files_pid_filetrans(nginx_t, nginx_runtime_t, file) # tmp files manage_files_pattern(nginx_t, nginx_tmp_t, nginx_tmp_t) diff --git a/policy/modules/contrib/phpfpm.fc b/policy/modules/contrib/phpfpm.fc index f43358d7..da28e772 100644 --- a/policy/modules/contrib/phpfpm.fc +++ b/policy/modules/contrib/phpfpm.fc @@ -1,5 +1,5 @@ /usr/lib/php.*/bin/php-fpm gen_context(system_u:object_r:phpfpm_exec_t,s0) -/run/php*-fpm/*.sock gen_context(system_u:object_r:phpfpm_var_run_t,s0) +/run/php*-fpm/*.sock gen_context(system_u:object_r:phpfpm_runtime_t,s0) /var/log/php-fpm.log gen_context(system_u:object_r:phpfpm_log_t,s0) -/run/php-fpm.pid gen_context(system_u:object_r:phpfpm_var_run_t,s0) +/run/php-fpm.pid gen_context(system_u:object_r:phpfpm_runtime_t,s0) diff --git a/policy/modules/contrib/phpfpm.if b/policy/modules/contrib/phpfpm.if index fee2c174..38f7c3e7 100644 --- a/policy/modules/contrib/phpfpm.if +++ b/policy/modules/contrib/phpfpm.if @@ -13,7 +13,7 @@ interface(`phpfpm_admin',` gen_require(` type phpfpm_t; - type phpfpm_log_t, phpfpm_tmp_t, phpfpm_var_run_t; + type phpfpm_log_t, phpfpm_tmp_t, phpfpm_runtime_t; ') allow $1 phpfpm_t:process { ptrace signal_perms }; @@ -26,7 +26,7 @@ interface(`phpfpm_admin',` admin_pattern($1, phpfpm_tmp_t) files_list_pids($1) - admin_pattern($1, phpfpm_var_run_t) + admin_pattern($1, phpfpm_runtime_t) ') ######################################## @@ -42,7 +42,7 @@ interface(`phpfpm_admin',` # interface(`phpfpm_stream_connect',` gen_require(` - type phpfpm_t, phpfpm_var_run_t; + type phpfpm_t, phpfpm_runtime_t; ') - stream_connect_pattern($1, phpfpm_var_run_t, phpfpm_var_run_t, phpfpm_t) + stream_connect_pattern($1, phpfpm_runtime_t, phpfpm_runtime_t, phpfpm_t) ') diff --git a/policy/modules/contrib/phpfpm.te b/policy/modules/contrib/phpfpm.te index 826ba859..aefad850 100644 --- a/policy/modules/contrib/phpfpm.te +++ b/policy/modules/contrib/phpfpm.te @@ -19,8 +19,8 @@ init_daemon_domain(phpfpm_t, phpfpm_exec_t) type phpfpm_tmp_t; files_tmp_file(phpfpm_tmp_t) -type phpfpm_var_run_t; -files_pid_file(phpfpm_var_run_t) +type phpfpm_runtime_t alias phpfpm_var_run_t; +files_pid_file(phpfpm_runtime_t) type phpfpm_log_t; logging_log_file(phpfpm_log_t) @@ -45,10 +45,10 @@ manage_files_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t) manage_dirs_pattern(phpfpm_t, phpfpm_tmp_t, phpfpm_tmp_t) files_tmp_filetrans(phpfpm_t, phpfpm_tmp_t, {file dir}) -manage_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t) -files_pid_filetrans(phpfpm_t, phpfpm_var_run_t, { file sock_file }) +manage_files_pattern(phpfpm_t, phpfpm_runtime_t, phpfpm_runtime_t) +files_pid_filetrans(phpfpm_t, phpfpm_runtime_t, { file sock_file }) -manage_sock_files_pattern(phpfpm_t, phpfpm_var_run_t, phpfpm_var_run_t) +manage_sock_files_pattern(phpfpm_t, phpfpm_runtime_t, phpfpm_runtime_t) kernel_read_kernel_sysctls(phpfpm_t) diff --git a/policy/modules/contrib/resolvconf.fc b/policy/modules/contrib/resolvconf.fc index 651bbe0a..4e5df895 100644 --- a/policy/modules/contrib/resolvconf.fc +++ b/policy/modules/contrib/resolvconf.fc @@ -4,4 +4,4 @@ /usr/sbin/resolvconf -- gen_context(system_u:object_r:resolvconf_exec_t,s0) -/run/resolvconf(/.*)? gen_context(system_u:object_r:resolvconf_var_run_t,s0) +/run/resolvconf(/.*)? gen_context(system_u:object_r:resolvconf_runtime_t,s0) diff --git a/policy/modules/contrib/resolvconf.if b/policy/modules/contrib/resolvconf.if index 7a93eb6c..c6e53fb9 100644 --- a/policy/modules/contrib/resolvconf.if +++ b/policy/modules/contrib/resolvconf.if @@ -95,8 +95,8 @@ interface(`resolvconf_exec',` # interface(`resolvconf_generic_run_filetrans_run',` gen_require(` - type resolvconf_var_run_t; + type resolvconf_runtime_t; ') - files_pid_filetrans($1, resolvconf_var_run_t, $2, $3) + files_pid_filetrans($1, resolvconf_runtime_t, $2, $3) ') diff --git a/policy/modules/contrib/resolvconf.te b/policy/modules/contrib/resolvconf.te index 58bb165d..18738a1f 100644 --- a/policy/modules/contrib/resolvconf.te +++ b/policy/modules/contrib/resolvconf.te @@ -11,8 +11,8 @@ attribute resolvconf_client; type resolvconf_conf_t; files_config_file(resolvconf_conf_t) -type resolvconf_var_run_t; -files_pid_file(resolvconf_var_run_t) +type resolvconf_runtime_t alias resolvconf_var_run_t; +files_pid_file(resolvconf_runtime_t) ######################################### # @@ -22,13 +22,13 @@ files_pid_file(resolvconf_var_run_t) allow resolvconf_t self:fifo_file manage_fifo_file_perms; allow resolvconf_t resolvconf_conf_t:file read_file_perms; -manage_dirs_pattern(resolvconf_t, resolvconf_var_run_t, resolvconf_var_run_t) -manage_files_pattern(resolvconf_t, resolvconf_var_run_t, resolvconf_var_run_t) +manage_dirs_pattern(resolvconf_t, resolvconf_runtime_t, resolvconf_runtime_t) +manage_files_pattern(resolvconf_t, resolvconf_runtime_t, resolvconf_runtime_t) corecmd_exec_bin(resolvconf_t) corecmd_exec_shell(resolvconf_t) -files_pid_filetrans(resolvconf_t, resolvconf_var_run_t, { dir file }) +files_pid_filetrans(resolvconf_t, resolvconf_runtime_t, { dir file }) files_read_etc_files(resolvconf_t) miscfiles_read_localization(resolvconf_t) diff --git a/policy/modules/contrib/salt.fc b/policy/modules/contrib/salt.fc index ccc8028f..1dbef661 100644 --- a/policy/modules/contrib/salt.fc +++ b/policy/modules/contrib/salt.fc @@ -16,11 +16,11 @@ /var/log/salt/master -- gen_context(system_u:object_r:salt_master_log_t,s0) /var/log/salt/minion -- gen_context(system_u:object_r:salt_minion_log_t,s0) -/run/salt -d gen_context(system_u:object_r:salt_var_run_t,s0) -/run/salt/master(/.*)? gen_context(system_u:object_r:salt_master_var_run_t,s0) -/run/salt/minion(/.*)? gen_context(system_u:object_r:salt_minion_var_run_t,s0) -/run/salt-master\.pid -- gen_context(system_u:object_r:salt_master_var_run_t,s0) -/run/salt-minion\.pid -- gen_context(system_u:object_r:salt_minion_var_run_t,s0) +/run/salt -d gen_context(system_u:object_r:salt_runtime_t,s0) +/run/salt/master(/.*)? gen_context(system_u:object_r:salt_master_runtime_t,s0) +/run/salt/minion(/.*)? gen_context(system_u:object_r:salt_minion_runtime_t,s0) +/run/salt-master\.pid -- gen_context(system_u:object_r:salt_master_runtime_t,s0) +/run/salt-minion\.pid -- gen_context(system_u:object_r:salt_minion_runtime_t,s0) /var/cache/salt -d gen_context(system_u:object_r:salt_cache_t,s0) /var/cache/salt/master(/.*)? gen_context(system_u:object_r:salt_master_cache_t,s0) diff --git a/policy/modules/contrib/salt.if b/policy/modules/contrib/salt.if index 27fefaef..a26d6380 100644 --- a/policy/modules/contrib/salt.if +++ b/policy/modules/contrib/salt.if @@ -21,8 +21,8 @@ interface(`salt_admin_master',` type salt_master_initrc_exec_t; type salt_master_exec_t; type salt_etc_t; - type salt_var_run_t; - type salt_master_var_run_t; + type salt_runtime_t; + type salt_master_runtime_t; attribute_role salt_master_roles; ') @@ -40,8 +40,8 @@ interface(`salt_admin_master',` files_list_etc($1) admin_pattern($1, salt_etc_t, salt_etc_t) - allow $1 salt_var_run_t:dir search_dir_perms; - stream_connect_pattern($1, salt_master_var_run_t, salt_master_var_run_t, salt_master_t) + allow $1 salt_runtime_t:dir search_dir_perms; + stream_connect_pattern($1, salt_master_runtime_t, salt_master_runtime_t, salt_master_t) ') ######################################### diff --git a/policy/modules/contrib/salt.rst b/policy/modules/contrib/salt.rst index 0268b95f..ad4ce7d6 100644 --- a/policy/modules/contrib/salt.rst +++ b/policy/modules/contrib/salt.rst @@ -124,13 +124,13 @@ salt_master_log_t salt_minion_log_t is used for the Salt minion log file (*/var/log/salt/minion*) -salt_var_run_t +salt_runtime_t is used for the parent directory for Salt run-time files (*/var/run/salt*) -salt_master_var_run_t +salt_master_runtime_t is used for the Salt master variable run-time files (*/var/run/salt/master*) -salt_minion_var_run_t +salt_minion_runtime_t is used for the Salt minion variable run-time files (*/var/run/salt/minion*) CONFIGURATION FILES diff --git a/policy/modules/contrib/salt.te b/policy/modules/contrib/salt.te index 2eb7b7db..5741c27a 100644 --- a/policy/modules/contrib/salt.te +++ b/policy/modules/contrib/salt.te @@ -48,9 +48,9 @@ files_tmp_file(salt_master_tmp_t) type salt_master_tmpfs_t; files_tmpfs_file(salt_master_tmpfs_t) -type salt_master_var_run_t; -init_daemon_pid_file(salt_master_var_run_t, file, "salt-master.pid") -files_pid_file(salt_master_var_run_t) +type salt_master_runtime_t alias salt_master_var_run_t; +init_daemon_pid_file(salt_master_runtime_t, file, "salt-master.pid") +files_pid_file(salt_master_runtime_t) type salt_minion_t; type salt_minion_exec_t; @@ -75,9 +75,9 @@ files_tmp_file(salt_minion_tmp_t) type salt_minion_tmpfs_t; files_tmpfs_file(salt_minion_tmpfs_t) -type salt_minion_var_run_t; -init_daemon_pid_file(salt_minion_var_run_t, file, "salt-minion.pid") -files_pid_file(salt_minion_var_run_t) +type salt_minion_runtime_t alias salt_minion_var_run_t; +init_daemon_pid_file(salt_minion_runtime_t, file, "salt-minion.pid") +files_pid_file(salt_minion_runtime_t) type salt_cache_t; files_type(salt_cache_t) @@ -94,8 +94,8 @@ files_type(salt_sls_t) type salt_pki_t; files_type(salt_pki_t) -type salt_var_run_t; -files_pid_file(salt_var_run_t) +type salt_runtime_t alias salt_var_run_t; +files_pid_file(salt_runtime_t) ######################################### # @@ -150,11 +150,11 @@ can_exec(salt_master_t, salt_master_tmp_t) allow salt_master_t salt_master_tmpfs_t:file { manage_file_perms map }; fs_tmpfs_filetrans(salt_master_t, salt_master_tmpfs_t, file) -# salt_master_var_run_t -allow salt_master_t salt_master_var_run_t:file manage_file_perms; -allow salt_master_t salt_master_var_run_t:sock_file manage_sock_file_perms; -manage_dirs_pattern(salt_master_t, salt_var_run_t, salt_master_var_run_t) -filetrans_pattern(salt_master_t, salt_var_run_t, salt_master_var_run_t, dir) +# salt_master_runtime_t +allow salt_master_t salt_master_runtime_t:file manage_file_perms; +allow salt_master_t salt_master_runtime_t:sock_file manage_sock_file_perms; +manage_dirs_pattern(salt_master_t, salt_runtime_t, salt_master_runtime_t) +filetrans_pattern(salt_master_t, salt_runtime_t, salt_master_runtime_t, dir) # salt_pki_t create_dirs_pattern(salt_master_t, salt_etc_t, salt_pki_t) @@ -164,10 +164,10 @@ filetrans_pattern(salt_master_t, salt_etc_t, salt_pki_t, dir, "pki") read_files_pattern(salt_master_t, salt_sls_t, salt_sls_t) allow salt_master_t salt_sls_t:dir list_dir_perms; -# salt_var_run_t -allow salt_master_t salt_var_run_t:dir create_dir_perms; -files_pid_filetrans(salt_master_t, salt_var_run_t, dir) -files_pid_filetrans(salt_master_t, salt_master_var_run_t, file, "salt-master.pid") +# salt_runtime_t +allow salt_master_t salt_runtime_t:dir create_dir_perms; +files_pid_filetrans(salt_master_t, salt_runtime_t, dir) +files_pid_filetrans(salt_master_t, salt_master_runtime_t, file, "salt-master.pid") kernel_read_network_state(salt_master_t) kernel_read_software_raid_state(salt_master_t) @@ -269,20 +269,20 @@ can_exec(salt_minion_t, salt_minion_tmp_t) allow salt_minion_t salt_minion_tmpfs_t:file { manage_file_perms map }; fs_tmpfs_filetrans(salt_minion_t, salt_minion_tmpfs_t, file) -# salt_minion_var_run_t -allow salt_minion_t salt_minion_var_run_t:file manage_file_perms; -allow salt_minion_t salt_minion_var_run_t:sock_file manage_sock_file_perms; -manage_dirs_pattern(salt_minion_t, salt_var_run_t, salt_minion_var_run_t) -filetrans_pattern(salt_minion_t, salt_var_run_t, salt_minion_var_run_t, dir) +# salt_minion_runtime_t +allow salt_minion_t salt_minion_runtime_t:file manage_file_perms; +allow salt_minion_t salt_minion_runtime_t:sock_file manage_sock_file_perms; +manage_dirs_pattern(salt_minion_t, salt_runtime_t, salt_minion_runtime_t) +filetrans_pattern(salt_minion_t, salt_runtime_t, salt_minion_runtime_t, dir) # salt_pki_t create_dirs_pattern(salt_minion_t, salt_etc_t, salt_pki_t) filetrans_pattern(salt_minion_t, salt_etc_t, salt_pki_t, dir, "pki") -# salt_var_run_t -allow salt_minion_t salt_var_run_t:dir create_dir_perms; -files_pid_filetrans(salt_minion_t, salt_var_run_t, dir) -files_pid_filetrans(salt_minion_t, salt_minion_var_run_t, file, "salt-minion.pid") +# salt_runtime_t +allow salt_minion_t salt_runtime_t:dir create_dir_perms; +files_pid_filetrans(salt_minion_t, salt_runtime_t, dir) +files_pid_filetrans(salt_minion_t, salt_minion_runtime_t, file, "salt-minion.pid") kernel_read_network_state(salt_minion_t) kernel_read_software_raid_state(salt_minion_t) diff --git a/policy/modules/contrib/vde.fc b/policy/modules/contrib/vde.fc index fa0b6b28..bea4fd72 100644 --- a/policy/modules/contrib/vde.fc +++ b/policy/modules/contrib/vde.fc @@ -1,5 +1,5 @@ /etc/rc\.d/init\.d/vde -- gen_context(system_u:object_r:vde_initrc_exec_t,s0) /usr/bin/vde_switch -- gen_context(system_u:object_r:vde_exec_t,s0) /usr/sbin/vde_tunctl -- gen_context(system_u:object_r:vde_exec_t,s0) -/run/vde\.ctl(/.*)? gen_context(system_u:object_r:vde_var_run_t,s0) +/run/vde\.ctl(/.*)? gen_context(system_u:object_r:vde_runtime_t,s0) /tmp/vde.[0-9-]* -s gen_context(system_u:object_r:vde_tmp_t,s0) diff --git a/policy/modules/contrib/vde.if b/policy/modules/contrib/vde.if index 00b31b4c..24bc31a9 100644 --- a/policy/modules/contrib/vde.if +++ b/policy/modules/contrib/vde.if @@ -19,7 +19,7 @@ interface(`vde_role',` gen_require(` type vde_t, vde_tmp_t; - type vde_var_run_t; + type vde_runtime_t; type vde_initrc_exec_t, vde_exec_t; ') @@ -49,10 +49,10 @@ interface(`vde_role',` # interface(`vde_connect',` gen_require(` - type vde_t, vde_var_run_t, vde_tmp_t; + type vde_t, vde_runtime_t, vde_tmp_t; ') - allow $1 vde_var_run_t:sock_file write_sock_file_perms; + allow $1 vde_runtime_t:sock_file write_sock_file_perms; allow $1 vde_t:unix_stream_socket { connectto }; allow $1 vde_t:unix_dgram_socket { sendto }; allow vde_t $1:unix_dgram_socket { sendto }; diff --git a/policy/modules/contrib/vde.te b/policy/modules/contrib/vde.te index 56f668d7..8e935560 100644 --- a/policy/modules/contrib/vde.te +++ b/policy/modules/contrib/vde.te @@ -15,8 +15,8 @@ init_script_file(vde_initrc_exec_t) type vde_var_lib_t; files_type(vde_var_lib_t) -type vde_var_run_t; -files_pid_file(vde_var_run_t) +type vde_runtime_t alias vde_var_run_t; +files_pid_file(vde_runtime_t) type vde_tmp_t; files_tmp_file(vde_tmp_t) @@ -34,10 +34,10 @@ allow vde_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow vde_t self:unix_dgram_socket create_socket_perms; files_tmp_filetrans(vde_t, vde_tmp_t, sock_file) -manage_dirs_pattern(vde_t, vde_var_run_t, vde_var_run_t) -manage_files_pattern(vde_t, vde_var_run_t, vde_var_run_t) -manage_sock_files_pattern(vde_t, vde_var_run_t, vde_var_run_t) -files_pid_filetrans(vde_t, vde_var_run_t, { dir file sock_file unix_dgram_socket }) +manage_dirs_pattern(vde_t, vde_runtime_t, vde_runtime_t) +manage_files_pattern(vde_t, vde_runtime_t, vde_runtime_t) +manage_sock_files_pattern(vde_t, vde_runtime_t, vde_runtime_t) +files_pid_filetrans(vde_t, vde_runtime_t, { dir file sock_file unix_dgram_socket }) files_read_etc_files(vde_t) diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te index 715cc2d6..bda92f4a 100644 --- a/policy/modules/services/apache.te +++ b/policy/modules/services/apache.te @@ -1487,8 +1487,8 @@ ifdef(`distro_gentoo',` ## gen_tunable(hiawatha_httpd, false) -init_daemon_pid_file(httpd_var_run_t, dir, "apache_ssl_mutex") -init_daemon_pid_file(httpd_var_run_t, dir, "apache2") +init_daemon_pid_file(httpd_runtime_t, dir, "apache_ssl_mutex") +init_daemon_pid_file(httpd_runtime_t, dir, "apache2") tunable_policy(`hiawatha_httpd',` # bug 513362 diff --git a/policy/modules/services/clamav.te b/policy/modules/services/clamav.te index 6ceaf130..334ae633 100644 --- a/policy/modules/services/clamav.te +++ b/policy/modules/services/clamav.te @@ -330,5 +330,5 @@ optional_policy(` ') ifdef(`distro_gentoo',` - init_daemon_pid_file(clamd_var_run_t, dir, "clamav") + init_daemon_pid_file(clamd_runtime_t, dir, "clamav") ') diff --git a/policy/modules/services/courier.te b/policy/modules/services/courier.te index dce1451b..5a4c7ea7 100644 --- a/policy/modules/services/courier.te +++ b/policy/modules/services/courier.te @@ -201,7 +201,7 @@ ifdef(`distro_gentoo',` # # Startup of courier-imapd creates /var/run/imapd.pid.lock and imapd.lock (bug 534030) - files_pid_filetrans(courier_tcpd_t, courier_var_run_t, file) + files_pid_filetrans(courier_tcpd_t, courier_runtime_t, file) ######################################## # diff --git a/policy/modules/services/cron.fc b/policy/modules/services/cron.fc index 6fdcdb78..ee64e81e 100644 --- a/policy/modules/services/cron.fc +++ b/policy/modules/services/cron.fc @@ -5,7 +5,7 @@ /usr/bin/anacron -- gen_context(system_u:object_r:anacron_exec_t,s0) #/usr/bin/at -- gen_context(system_u:object_r:crontab_exec_t,s0) -/usr/bin/atd -- gen_context(system_u:object_r:crond_exec_t,s0) +#/usr/bin/atd -- gen_context(system_u:object_r:crond_exec_t,s0) /usr/bin/cron(d)? -- gen_context(system_u:object_r:crond_exec_t,s0) /usr/bin/fcron -- gen_context(system_u:object_r:crond_exec_t,s0) /usr/bin/fcronsighup -- gen_context(system_u:object_r:crontab_exec_t,s0) @@ -29,7 +29,6 @@ /var/log/rpmpkgs.* -- gen_context(system_u:object_r:cron_log_t,s0) /run/anacron\.pid -- gen_context(system_u:object_r:crond_runtime_t,s0) -/run/atd\.pid -- gen_context(system_u:object_r:crond_runtime_t,s0) /run/cron(d)?\.pid -- gen_context(system_u:object_r:crond_runtime_t,s0) /run/cron(d)?\.reboot -- gen_context(system_u:object_r:crond_runtime_t,s0) /run/fcron\.fifo -s gen_context(system_u:object_r:crond_runtime_t,s0) @@ -37,7 +36,6 @@ /run/.*cron.* -- gen_context(system_u:object_r:crond_runtime_t,s0) /var/spool/anacron(/.*)? gen_context(system_u:object_r:system_cron_spool_t,s0) -/var/spool/at(/.*)? gen_context(system_u:object_r:user_cron_spool_t,s0) /var/spool/cron -d gen_context(system_u:object_r:cron_spool_t,s0) #/var/spool/cron/root -- gen_context(system_u:object_r:sysadm_cron_spool_t,s0) diff --git a/policy/modules/services/cron.rst b/policy/modules/services/cron.rst index a35c26a4..773af37b 100644 --- a/policy/modules/services/cron.rst +++ b/policy/modules/services/cron.rst @@ -208,7 +208,7 @@ cron_var_lib_t crond_tmp_t is used for the temporary files created/managed by the cron daemon -crond_var_run_t +crond_runtime_t is used for the variable runtime information of the cron daemon POLICY diff --git a/policy/modules/services/dbus.if b/policy/modules/services/dbus.if index 7337fcd3..6169143e 100644 --- a/policy/modules/services/dbus.if +++ b/policy/modules/services/dbus.if @@ -607,7 +607,7 @@ interface(`dbus_unconfined',` ######################################## ## -## Create resources in /run or /var/run with the system_dbusd_var_run_t +## Create resources in /run or /var/run with the system_dbusd_runtime_t ## label. This method is deprecated in favor of the init_daemon_run_dir ## call. ## @@ -633,7 +633,7 @@ interface(`dbus_generic_pid_filetrans_system_dbusd_var_run',` ######################################## ## -## Create directories with the system_dbusd_var_run_t label +## Create directories with the system_dbusd_runtime_t label ## ## ## @@ -643,10 +643,10 @@ interface(`dbus_generic_pid_filetrans_system_dbusd_var_run',` # interface(`dbus_create_system_dbusd_var_run_dirs',` gen_require(` - type system_dbusd_var_run_t; + type system_dbusd_runtime_t; ') - create_dirs_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t) + create_dirs_pattern($1, system_dbusd_runtime_t, system_dbusd_runtime_t) ') diff --git a/policy/modules/services/fail2ban.te b/policy/modules/services/fail2ban.te index 50264730..067d5caf 100644 --- a/policy/modules/services/fail2ban.te +++ b/policy/modules/services/fail2ban.te @@ -163,9 +163,9 @@ ifdef(`distro_gentoo',` files_dontaudit_write_usr_dirs(fail2ban_t) # Fix bug 534256 - Startup fails without these - allow fail2ban_client_t fail2ban_var_run_t:dir write; + allow fail2ban_client_t fail2ban_runtime_t:dir write; - init_daemon_pid_file(fail2ban_var_run_t, dir, "fail2ban") + init_daemon_pid_file(fail2ban_runtime_t, dir, "fail2ban") init_use_script_ptys(fail2ban_client_t) ') diff --git a/policy/modules/services/ldap.te b/policy/modules/services/ldap.te index 50d7769d..31b895d7 100644 --- a/policy/modules/services/ldap.te +++ b/policy/modules/services/ldap.te @@ -154,7 +154,7 @@ optional_policy(` ') ifdef(`distro_gentoo',` - init_daemon_pid_file(slapd_var_run_t, dir, "openldap") + init_daemon_pid_file(slapd_runtime_t, dir, "openldap") ######################################## # diff --git a/policy/modules/services/munin.rst b/policy/modules/services/munin.rst index 220c75e1..207c2f19 100644 --- a/policy/modules/services/munin.rst +++ b/policy/modules/services/munin.rst @@ -71,7 +71,7 @@ munin_plugin_state_t munin_var_lib_t is used for the variable information used by munin -munin_var_run_t +munin_runtime_t is used for the variable runtime state information of munin POLICY diff --git a/policy/modules/services/mysql.if b/policy/modules/services/mysql.if index 82b5f1e2..bf5c0b70 100644 --- a/policy/modules/services/mysql.if +++ b/policy/modules/services/mysql.if @@ -449,10 +449,10 @@ interface(`mysql_admin',` # interface(`mysql_setattr_run_dirs',` gen_require(` - type mysqld_var_run_t; + type mysqld_runtime_t; ') - setattr_dirs_pattern($1, mysqld_var_run_t, mysqld_var_run_t) + setattr_dirs_pattern($1, mysqld_runtime_t, mysqld_runtime_t) ') ####################################### @@ -467,10 +467,10 @@ interface(`mysql_setattr_run_dirs',` # interface(`mysql_create_run_dirs',` gen_require(` - type mysqld_var_run_t; + type mysqld_runtime_t; ') - create_dirs_pattern($1, mysqld_var_run_t, mysqld_var_run_t) + create_dirs_pattern($1, mysqld_runtime_t, mysqld_runtime_t) ') ####################################### diff --git a/policy/modules/services/networkmanager.fc b/policy/modules/services/networkmanager.fc index d37b86de..e7c1b89e 100644 --- a/policy/modules/services/networkmanager.fc +++ b/policy/modules/services/networkmanager.fc @@ -47,4 +47,4 @@ /run/nm-dns-dnsmasq\.conf -- gen_context(system_u:object_r:NetworkManager_runtime_t,s0) /run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_runtime_t,s0) /run/wpa_supplicant-global -s gen_context(system_u:object_r:NetworkManager_runtime_t,s0) -/run/wpa_cli-.* -- gen_context(system_u:object_r:wpa_cli_var_run_t,s0) +/run/wpa_cli-.* -- gen_context(system_u:object_r:wpa_cli_runtime_t,s0) diff --git a/policy/modules/services/networkmanager.te b/policy/modules/services/networkmanager.te index 309e3363..e3af7618 100644 --- a/policy/modules/services/networkmanager.te +++ b/policy/modules/services/networkmanager.te @@ -38,8 +38,8 @@ type wpa_cli_exec_t; init_system_domain(wpa_cli_t, wpa_cli_exec_t) ifdef(`distro_gentoo',` - type wpa_cli_var_run_t; - files_pid_file(wpa_cli_var_run_t) + type wpa_cli_runtime_t alias wpa_cli_var_run_t; + files_pid_file(wpa_cli_runtime_t) ') ######################################## @@ -425,8 +425,8 @@ ifdef(`distro_gentoo',` # # wpa_cli_t policy # - manage_files_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t) - files_pid_filetrans(wpa_cli_t, wpa_cli_var_run_t, file) + manage_files_pattern(wpa_cli_t, wpa_cli_runtime_t, wpa_cli_runtime_t) + files_pid_filetrans(wpa_cli_t, wpa_cli_runtime_t, file) corecmd_exec_bin(wpa_cli_t) corecmd_exec_shell(wpa_cli_t) diff --git a/policy/modules/services/ntp.fc b/policy/modules/services/ntp.fc index 623451cf..b16c5739 100644 --- a/policy/modules/services/ntp.fc +++ b/policy/modules/services/ntp.fc @@ -39,7 +39,7 @@ /var/log/ntp.* -- gen_context(system_u:object_r:ntpd_log_t,s0) /var/log/ntpstats(/.*)? gen_context(system_u:object_r:ntpd_log_t,s0) /var/log/xntpd.* -- gen_context(system_u:object_r:ntpd_log_t,s0) -/run/ntpd\.sock -s gen_context(system_u:object_r:ntpd_var_run_t,s0) +/run/ntpd\.sock -s gen_context(system_u:object_r:ntpd_pid_t,s0) ifdef(`distro_gentoo',` /var/lib/openntpd/ntpd.drift -- gen_context(system_u:object_r:ntp_drift_t,s0) diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te index 2bf22f72..2b34a4f9 100644 --- a/policy/modules/system/authlogin.te +++ b/policy/modules/system/authlogin.te @@ -477,5 +477,5 @@ optional_policy(` ') ifdef(`distro_gentoo',` - init_daemon_pid_file(pam_var_run_t, dir, "sepermit") + init_daemon_pid_file(pam_runtime_t, dir, "sepermit") ') diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index fe9b8535..4d152ee1 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -1383,8 +1383,8 @@ ifdef(`distro_gentoo',` read_files_pattern(initrc_t, init_script_readable, init_script_readable) read_lnk_files_pattern(initrc_t, init_script_readable, init_script_readable) - manage_dirs_pattern(initrc_t, initrc_var_run_t, initrc_var_run_t) - files_pid_filetrans(initrc_t, initrc_var_run_t, dir) + manage_dirs_pattern(initrc_t, initrc_runtime_t, initrc_runtime_t) + files_pid_filetrans(initrc_t, initrc_runtime_t, dir) kernel_write_proc_files(initrc_t) diff --git a/policy/modules/system/lvm.te b/policy/modules/system/lvm.te index 857c6f23..6b705bfe 100644 --- a/policy/modules/system/lvm.te +++ b/policy/modules/system/lvm.te @@ -401,7 +401,7 @@ ifdef(`distro_gentoo',` # Bug 529430 comment 6 create_dirs_pattern(lvm_t, lvm_etc_t, lvm_etc_t) # Bug 529430 comment 8 - manage_fifo_files_pattern(lvm_t, lvm_var_run_t, lvm_var_run_t) + manage_fifo_files_pattern(lvm_t, lvm_runtime_t, lvm_runtime_t) # Bug 615300 init_read_script_pipes(lvm_t) diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te index df4193d6..33729a23 100644 --- a/policy/modules/system/modutils.te +++ b/policy/modules/system/modutils.te @@ -216,6 +216,6 @@ ifdef(`distro_gentoo',` files_manage_kernel_modules(kmod_t) # for /run/tmpfiles.d/kmod.conf - tmpfiles_create_var_run_files(kmod_t) - filetrans_add_pattern(kmod_t, tmpfiles_var_run_t, kmod_tmpfiles_conf_t, file) + tmpfiles_create_runtime_files(kmod_t) + filetrans_add_pattern(kmod_t, tmpfiles_runtime_t, kmod_tmpfiles_conf_t, file) ') diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc index 69b6ce88..1a8f7281 100644 --- a/policy/modules/system/sysnetwork.fc +++ b/policy/modules/system/sysnetwork.fc @@ -93,6 +93,6 @@ ifdef(`distro_debian',` ifdef(`distro_gentoo',` /usr/lib/dhcpcd/dhcpcd-run-hooks -- gen_context(system_u:object_r:dhcpc_script_exec_t,s0) -/run/dhcpcd\.sock -s gen_context(system_u:object_r:dhcpc_var_run_t,s0) -/run/dhcpcd\.unpriv\.sock -s gen_context(system_u:object_r:dhcpc_var_run_t,s0) +/run/dhcpcd\.sock -s gen_context(system_u:object_r:dhcpc_runtime_t,s0) +/run/dhcpcd\.unpriv\.sock -s gen_context(system_u:object_r:dhcpc_runtime_t,s0) ') diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te index bacb3794..bb54a544 100644 --- a/policy/modules/system/sysnetwork.te +++ b/policy/modules/system/sysnetwork.te @@ -434,14 +434,14 @@ ifdef(`distro_gentoo',` allow dhcpc_t self:netlink_socket client_stream_socket_perms; # Allow dhcpcd to set its control sockets - allow dhcpc_t dhcpc_var_run_t:sock_file manage_sock_file_perms; + allow dhcpc_t dhcpc_runtime_t:sock_file manage_sock_file_perms; # Allow dhcpc to set hostname (/proc/sys/kernel/hostname) allow dhcpc_t self:capability sys_admin; kernel_rw_kernel_sysctl(dhcpc_t) # Fixes bug 468878 - files_pid_filetrans(dhcpc_t, dhcpc_var_run_t, sock_file) + files_pid_filetrans(dhcpc_t, dhcpc_runtime_t, sock_file) allow dhcpc_t self:unix_stream_socket { create_stream_socket_perms connectto }; optional_policy(` @@ -479,9 +479,9 @@ ifdef(`distro_gentoo',` manage_files_pattern(dhcpc_script_t, dhcpc_script_tmp_t, dhcpc_script_tmp_t) files_tmp_filetrans(dhcpc_script_t, dhcpc_script_tmp_t, { file dir }) - manage_files_pattern(dhcpc_script_t, dhcpc_var_run_t, dhcpc_var_run_t) - create_dirs_pattern(dhcpc_script_t, dhcpc_var_run_t, dhcpc_var_run_t) - files_pid_filetrans(dhcpc_script_t, dhcpc_var_run_t, { file dir }) + manage_files_pattern(dhcpc_script_t, dhcpc_runtime_t, dhcpc_runtime_t) + create_dirs_pattern(dhcpc_script_t, dhcpc_runtime_t, dhcpc_runtime_t) + files_pid_filetrans(dhcpc_script_t, dhcpc_runtime_t, { file dir }) kernel_read_network_state(dhcpc_script_t) kernel_read_system_state(dhcpc_script_t) diff --git a/policy/modules/system/tmpfiles.fc b/policy/modules/system/tmpfiles.fc index 16d821a8..5a13949c 100644 --- a/policy/modules/system/tmpfiles.fc +++ b/policy/modules/system/tmpfiles.fc @@ -1,7 +1,7 @@ ifndef(`init_systemd',` /etc/tmpfiles.d(/.*)? gen_context(system_u:object_r:tmpfiles_conf_t,s0) -/run/tmpfiles.d(/.*)? gen_context(system_u:object_r:tmpfiles_var_run_t,s0) +/run/tmpfiles.d(/.*)? gen_context(system_u:object_r:tmpfiles_runtime_t,s0) ') /usr/bin/tmpfiles -- gen_context(system_u:object_r:tmpfiles_exec_t,s0) diff --git a/policy/modules/system/tmpfiles.if b/policy/modules/system/tmpfiles.if index 09897fc0..361dc8c4 100644 --- a/policy/modules/system/tmpfiles.if +++ b/policy/modules/system/tmpfiles.if @@ -10,14 +10,14 @@ ## ## # -interface(`tmpfiles_read_var_run',` +interface(`tmpfiles_read_runtime',` gen_require(` - type tmpfiles_var_run_t; + type tmpfiles_runtime_t; ') files_search_pids($1) - allow $1 tmpfiles_var_run_t:dir list_dir_perms; - allow $1 tmpfiles_var_run_t:file read_file_perms; + allow $1 tmpfiles_runtime_t:dir list_dir_perms; + allow $1 tmpfiles_runtime_t:file read_file_perms; ') ######################################## @@ -30,14 +30,14 @@ interface(`tmpfiles_read_var_run',` ## ## # -interface(`tmpfiles_create_var_run_files',` +interface(`tmpfiles_create_runtime_files',` gen_require(` - type tmpfiles_var_run_t; + type tmpfiles_runtime_t; ') - create_files_pattern($1, tmpfiles_var_run_t, tmpfiles_var_run_t) + create_files_pattern($1, tmpfiles_runtime_t, tmpfiles_runtime_t) - tmpfiles_read_var_run($1) + tmpfiles_read_runtime($1) ') ######################################## @@ -50,14 +50,14 @@ interface(`tmpfiles_create_var_run_files',` ## ## # -interface(`tmpfiles_write_var_run_files',` +interface(`tmpfiles_write_runtime_files',` gen_require(` - type tmpfiles_var_run_t; + type tmpfiles_runtime_t; ') - write_files_pattern($1, tmpfiles_var_run_t, tmpfiles_var_run_t) + write_files_pattern($1, tmpfiles_runtime_t, tmpfiles_runtime_t) - tmpfiles_read_var_run($1) + tmpfiles_read_runtime($1) ') ######################################## @@ -70,14 +70,14 @@ interface(`tmpfiles_write_var_run_files',` ## ## # -interface(`tmpfiles_manage_var_run_files',` +interface(`tmpfiles_manage_runtime_files',` gen_require(` - type tmpfiles_var_run_t; + type tmpfiles_runtime_t; ') - tmpfiles_read_var_run($1) + tmpfiles_read_runtime($1) - manage_files_pattern($1, tmpfiles_var_run_t, tmpfiles_var_run_t) + manage_files_pattern($1, tmpfiles_runtime_t, tmpfiles_runtime_t) ') ######################################## diff --git a/policy/modules/system/tmpfiles.rst b/policy/modules/system/tmpfiles.rst index 748032b4..a445072a 100644 --- a/policy/modules/system/tmpfiles.rst +++ b/policy/modules/system/tmpfiles.rst @@ -49,7 +49,7 @@ tmpfiles_conf_t tmpfiles_exec_t is used as entrypoint for the tmpfiles application -tmpfiles_var_run_t +tmpfiles_runtime_t is used as the variable run-time data used by the tmpfiles application POLICY diff --git a/policy/modules/system/tmpfiles.te b/policy/modules/system/tmpfiles.te index 9063ca3e..57be1edc 100644 --- a/policy/modules/system/tmpfiles.te +++ b/policy/modules/system/tmpfiles.te @@ -23,8 +23,8 @@ init_daemon_domain(tmpfiles_t, tmpfiles_exec_t) type tmpfiles_conf_t; files_config_file(tmpfiles_conf_t) -type tmpfiles_var_run_t; -files_pid_file(tmpfiles_var_run_t) +type tmpfiles_runtime_t alias tmpfiles_var_run_t; +files_pid_file(tmpfiles_runtime_t) ######################################## @@ -42,8 +42,8 @@ allow tmpfiles_t tmpfiles_exec_t:file execute_no_trans; list_dirs_pattern(tmpfiles_t, tmpfiles_conf_t, tmpfiles_conf_t) read_files_pattern(tmpfiles_t, tmpfiles_conf_t, tmpfiles_conf_t) -manage_files_pattern(tmpfiles_t, tmpfiles_var_run_t, tmpfiles_var_run_t) -manage_dirs_pattern(tmpfiles_t, tmpfiles_var_run_t, tmpfiles_var_run_t) +manage_files_pattern(tmpfiles_t, tmpfiles_runtime_t, tmpfiles_runtime_t) +manage_dirs_pattern(tmpfiles_t, tmpfiles_runtime_t, tmpfiles_runtime_t) corecmd_exec_bin(tmpfiles_t) corecmd_exec_shell(tmpfiles_t)