[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/admin/, policy/modules/apps/

[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/admin/, policy/modules/apps/

[Jason Zaman]

commit:     758c98fc22b0795287736330c416d9f3e03fdf00
Author:     Russell Coker <russell <AT> coker <DOT> com <DOT> au>
AuthorDate: Tue Feb  2 14:55:38 2021 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Feb  6 21:15:09 2021 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=758c98fc

misc apps and admin patches

Send again without the section Dominick didn't like.  I think it's ready for inclusion.

Signed-off-by: Russell Coker <russell <AT> coker.com.au>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/admin/apt.fc        |  4 +++-
 policy/modules/admin/apt.te        |  8 ++++++++
 policy/modules/admin/bootloader.te |  3 +++
 policy/modules/admin/logrotate.te  |  2 ++
 policy/modules/apps/games.te       | 14 ++++++++++++++
 policy/modules/apps/mplayer.if     |  2 +-
 policy/modules/apps/mplayer.te     |  7 ++++++-
 7 files changed, 37 insertions(+), 3 deletions(-)

diff --git a/policy/modules/admin/apt.fc b/policy/modules/admin/apt.fc
index 8a539f06..66fec023 100644
--- a/policy/modules/admin/apt.fc
+++ b/policy/modules/admin/apt.fc
@@ -5,6 +5,8 @@
 /usr/bin/apt-shell	--	gen_context(system_u:object_r:apt_exec_t,s0)
 /usr/bin/aptitude	--	gen_context(system_u:object_r:apt_exec_t,s0)
 /usr/sbin/update-apt-xapian-index -- gen_context(system_u:object_r:apt_exec_t,s0)
+/usr/share/unattended-upgrades/unattended-upgrade-shutdown -- gen_context(system_u:object_r:apt_exec_t,s0)
+/usr/bin/unattended-upgrade -- gen_context(system_u:object_r:apt_exec_t,s0)
 
 ifndef(`distro_redhat',`
 /usr/sbin/synaptic	--	gen_context(system_u:object_r:apt_exec_t,s0)
@@ -23,5 +25,5 @@ ifndef(`distro_redhat',`
 /var/lock/aptitude	gen_context(system_u:object_r:apt_lock_t,s0)
 
 /var/log/aptitude.*	gen_context(system_u:object_r:apt_var_log_t,s0)
-
+/var/log/unattended-upgrades(/.*)	gen_context(system_u:object_r:apt_var_log_t,s0)
 /var/log/apt(/.*)?	gen_context(system_u:object_r:apt_var_log_t,s0)

diff --git a/policy/modules/admin/apt.te b/policy/modules/admin/apt.te
index 841b8c4f..8e5f72b7 100644
--- a/policy/modules/admin/apt.te
+++ b/policy/modules/admin/apt.te
@@ -154,6 +154,10 @@ optional_policy(`
 	dpkg_lock_db(apt_t)
 ')
 
+optional_policy(`
+	networkmanager_dbus_chat(apt_t)
+')
+
 optional_policy(`
 	nis_use_ypbind(apt_t)
 ')
@@ -168,6 +172,10 @@ optional_policy(`
 	rpm_domtrans(apt_t)
 ')
 
+optional_policy(`
+	systemd_dbus_chat_logind(apt_t)
+')
+
 optional_policy(`
 	unconfined_domain(apt_t)
 ')

diff --git a/policy/modules/admin/bootloader.te b/policy/modules/admin/bootloader.te
index 172e5157..78b34125 100644
--- a/policy/modules/admin/bootloader.te
+++ b/policy/modules/admin/bootloader.te
@@ -186,6 +186,9 @@ ifdef(`distro_debian',`
 
 	dpkg_read_db(bootloader_t)
 	dpkg_rw_pipes(bootloader_t)
+
+	apt_use_fds(bootloader_t)
+	apt_use_ptys(bootloader_t)
 ')
 
 ifdef(`distro_redhat',`

diff --git a/policy/modules/admin/logrotate.te b/policy/modules/admin/logrotate.te
index 7169d260..c13f0a73 100644
--- a/policy/modules/admin/logrotate.te
+++ b/policy/modules/admin/logrotate.te
@@ -121,6 +121,7 @@ logging_send_syslog_msg(logrotate_t)
 logging_send_audit_msgs(logrotate_t)
 logging_exec_all_logs(logrotate_t)
 
+miscfiles_read_generic_certs(logrotate_t)
 miscfiles_read_localization(logrotate_t)
 
 seutil_dontaudit_read_config(logrotate_t)
@@ -242,6 +243,7 @@ optional_policy(`
 ')
 
 optional_policy(`
+	samba_domtrans_smbcontrol(logrotate_t)
 	samba_exec_log(logrotate_t)
 ')
 

diff --git a/policy/modules/apps/games.te b/policy/modules/apps/games.te
index 1de63166..c66b382b 100644
--- a/policy/modules/apps/games.te
+++ b/policy/modules/apps/games.te
@@ -111,9 +111,11 @@ fs_tmpfs_filetrans(games_t, games_tmpfs_t, { file lnk_file sock_file fifo_file }
 
 can_exec(games_t, games_exec_t)
 
+kernel_read_kernel_sysctls(games_t)
 kernel_read_system_state(games_t)
 
 corecmd_exec_bin(games_t)
+corecmd_exec_shell(games_t)
 
 corenet_all_recvfrom_netlabel(games_t)
 corenet_tcp_sendrecv_generic_if(games_t)
@@ -146,6 +148,7 @@ init_dontaudit_rw_utmp(games_t)
 
 logging_dontaudit_search_logs(games_t)
 
+miscfiles_read_generic_certs(games_t)
 miscfiles_read_man_pages(games_t)
 miscfiles_read_localization(games_t)
 
@@ -161,9 +164,15 @@ tunable_policy(`allow_execmem',`
 	allow games_t self:process execmem;
 ')
 
+optional_policy(`
+	alsa_read_config(games_t)
+')
+
 optional_policy(`
 	dbus_all_session_bus_client(games_t)
 	dbus_connect_all_session_bus(games_t)
+	dbus_read_lib_files(games_t)
+	dbus_system_bus_client(games_t)
 ')
 
 optional_policy(`
@@ -174,6 +183,11 @@ optional_policy(`
 	pulseaudio_run(games_t, games_roles)
 ')
 
+optional_policy(`
+	xdg_read_config_files(games_t)
+	xdg_read_data_files(games_t)
+')
+
 optional_policy(`
 	xserver_user_x_domain_template(games, games_t, games_tmpfs_t)
 	xserver_create_xdm_tmp_sockets(games_t)

diff --git a/policy/modules/apps/mplayer.if b/policy/modules/apps/mplayer.if
index 861d5e97..62643bcf 100644
--- a/policy/modules/apps/mplayer.if
+++ b/policy/modules/apps/mplayer.if
@@ -38,7 +38,7 @@ interface(`mplayer_role',`
 	domtrans_pattern($2, mencoder_exec_t, mencoder_t)
 	domtrans_pattern($2, mplayer_exec_t, mplayer_t)
 
-	allow $2 { mplayer_t mencoder_t }:process { ptrace signal_perms };
+	allow $2 { mplayer_t mencoder_t }:process { getsched ptrace signal_perms };
 	ps_process_pattern($2, { mplayer_t mencoder_t })
 
 	allow $2 mplayer_home_t:dir { manage_dir_perms relabel_dir_perms };

diff --git a/policy/modules/apps/mplayer.te b/policy/modules/apps/mplayer.te
index b00c55b0..d885b0b8 100644
--- a/policy/modules/apps/mplayer.te
+++ b/policy/modules/apps/mplayer.te
@@ -119,12 +119,16 @@ tunable_policy(`use_samba_home_dirs',`
 	fs_manage_cifs_symlinks(mencoder_t)
 ')
 
+tunable_policy(`xserver_allow_dri',`
+	dev_rw_dri(mplayer_t)
+')
+
 ########################################
 #
 # Mplayer local policy
 #
 
-allow mplayer_t self:process { signal_perms getsched };
+allow mplayer_t self:process { signal_perms getsched setsched };
 allow mplayer_t self:fifo_file rw_fifo_file_perms;
 allow mplayer_t self:sem create_sem_perms;
 allow mplayer_t self:udp_socket create_socket_perms;
@@ -147,6 +151,7 @@ fs_tmpfs_filetrans(mplayer_t, mplayer_tmpfs_t,{ dir file lnk_file sock_file fifo
 kernel_dontaudit_list_unlabeled(mplayer_t)
 kernel_dontaudit_getattr_unlabeled_files(mplayer_t)
 kernel_dontaudit_read_unlabeled_files(mplayer_t)
+kernel_read_crypto_sysctls(mplayer_t)
 kernel_read_system_state(mplayer_t)
 kernel_read_kernel_sysctls(mplayer_t)