[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     f32d2da8b2f3a4cbaf11f9eb0a1c27d1678ce4d5
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Fri Sep 20 07:12:29 2013 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Sep 23 06:28:03 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=f32d2da8

Clean up hypervkvp policy module (seems incomplete)

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/hypervkvp.fc |  4 ++--
 policy/modules/contrib/hypervkvp.if | 31 +++++++++++++++++++++----------
 policy/modules/contrib/hypervkvp.te | 24 +++++++++++-------------
 3 files changed, 34 insertions(+), 25 deletions(-)

diff --git a/policy/modules/contrib/hypervkvp.fc b/policy/modules/contrib/hypervkvp.fc
index 2a69ee4..b46130e 100644
--- a/policy/modules/contrib/hypervkvp.fc
+++ b/policy/modules/contrib/hypervkvp.fc
@@ -1,3 +1,3 @@
-/etc/rc\.d/init\.d/hypervkvpd	--	gen_context(system_u:object_r:hypervkvp_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/hypervkvpd	--	gen_context(system_u:object_r:hypervkvpd_initrc_exec_t,s0)
 
-/usr/sbin/hv_kvp_daemon		--	gen_context(system_u:object_r:hypervkvp_exec_t,s0)
+/usr/sbin/hv_kvp_daemon	--	gen_context(system_u:object_r:hypervkvpd_exec_t,s0)

diff --git a/policy/modules/contrib/hypervkvp.if b/policy/modules/contrib/hypervkvp.if
index 7743be5..6517fad 100644
--- a/policy/modules/contrib/hypervkvp.if
+++ b/policy/modules/contrib/hypervkvp.if
@@ -1,21 +1,32 @@
-
-## <summary>policy for hypervkvp</summary>
+## <summary>HyperV key value pair (KVP).</summary>
 
 ########################################
 ## <summary>
-##	Execute TEMPLATE in the hypervkvp domin.
+##	All of the rules required to
+##	administrate an hypervkvp environment.
 ## </summary>
 ## <param name="domain">
-## <summary>
-##	Domain allowed to transition.
-## </summary>
+##	<summary>
+##	Domain allowed access.
+##	</summary>
 ## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
 #
-interface(`hypervkvp_domtrans',`
+interface(`hypervkvp_admin',`
 	gen_require(`
-		type hypervkvp_t, hypervkvp_exec_t;
+		type hypervkvpd_t, hypervkvpd_initrc_exec_t;
 	')
 
-	corecmd_search_bin($1)
-	domtrans_pattern($1, hypervkvp_exec_t, hypervkvp_t)
+	allow $1 hypervkvpd_t:process { ptrace signal_perms };
+	ps_process_pattern($1, hypervkvpd_t)
+
+	init_labeled_script_domtrans($1, hypervkvpd_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 hypervkvpd_initrc_exec_t system_r;
+	allow $2 system_r;
 ')

diff --git a/policy/modules/contrib/hypervkvp.te b/policy/modules/contrib/hypervkvp.te
index 631ed79..4eb7041 100644
--- a/policy/modules/contrib/hypervkvp.te
+++ b/policy/modules/contrib/hypervkvp.te
@@ -5,26 +5,24 @@ policy_module(hypervkvp, 1.0.0)
 # Declarations
 #
 
-type hypervkvp_t;
-type hypervkvp_exec_t;
-init_daemon_domain(hypervkvp_t, hypervkvp_exec_t)
-
-type hypervkvp_initrc_exec_t;
-init_script_file(hypervkvp_initrc_exec_t)
+type hypervkvpd_t;
+type hypervkvpd_exec_t;
+init_daemon_domain(hypervkvpd_t, hypervkvpd_exec_t)
 
+type hypervkvpd_initrc_exec_t;
+init_script_file(hypervkvpd_initrc_exec_t)
 
 ########################################
 #
-# hypervkvp local policy
+# Local policy
 #
 #
-allow hypervkvp_t self:fifo_file rw_fifo_file_perms;
-allow hypervkvp_t self:unix_stream_socket create_stream_socket_perms;
 
-domain_use_interactive_fds(hypervkvp_t)
+allow hypervkvpd_t self:fifo_file rw_fifo_file_perms;
+allow hypervkvpd_t self:unix_stream_socket create_stream_socket_perms;
 
-logging_send_syslog_msg(hypervkvp_t)
+logging_send_syslog_msg(hypervkvpd_t)
 
-miscfiles_read_localization(hypervkvp_t)
+miscfiles_read_localization(hypervkvpd_t)
 
-sysnet_dns_name_resolve(hypervkvp_t)
+sysnet_dns_name_resolve(hypervkvpd_t)