[gentoo-commits] proj/hardened-refpolicy:master commit in: /

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     a1a159555aa5f11921596367e318cb987325c61e
Author:     Lukas Vrabec <lvrabec <AT> redhat <DOT> com>
AuthorDate: Wed Aug  7 13:33:55 2013 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Sep 23 06:27:39 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=a1a15955

Add policy for hypervkvpd

---
 hypervkvp.fc |  3 +++
 hypervkvp.if | 21 +++++++++++++++++++++
 hypervkvp.te | 30 ++++++++++++++++++++++++++++++
 3 files changed, 54 insertions(+)

diff --git a/hypervkvp.fc b/hypervkvp.fc
new file mode 100644
index 0000000..2a69ee4
--- /dev/null
+++ b/hypervkvp.fc
@@ -0,0 +1,3 @@
+/etc/rc\.d/init\.d/hypervkvpd	--	gen_context(system_u:object_r:hypervkvp_initrc_exec_t,s0)
+
+/usr/sbin/hv_kvp_daemon		--	gen_context(system_u:object_r:hypervkvp_exec_t,s0)

diff --git a/hypervkvp.if b/hypervkvp.if
new file mode 100644
index 0000000..7743be5
--- /dev/null
+++ b/hypervkvp.if
@@ -0,0 +1,21 @@
+
+## <summary>policy for hypervkvp</summary>
+
+########################################
+## <summary>
+##	Execute TEMPLATE in the hypervkvp domin.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`hypervkvp_domtrans',`
+	gen_require(`
+		type hypervkvp_t, hypervkvp_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, hypervkvp_exec_t, hypervkvp_t)
+')

diff --git a/hypervkvp.te b/hypervkvp.te
new file mode 100644
index 0000000..631ed79
--- /dev/null
+++ b/hypervkvp.te
@@ -0,0 +1,30 @@
+policy_module(hypervkvp, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type hypervkvp_t;
+type hypervkvp_exec_t;
+init_daemon_domain(hypervkvp_t, hypervkvp_exec_t)
+
+type hypervkvp_initrc_exec_t;
+init_script_file(hypervkvp_initrc_exec_t)
+
+
+########################################
+#
+# hypervkvp local policy
+#
+#
+allow hypervkvp_t self:fifo_file rw_fifo_file_perms;
+allow hypervkvp_t self:unix_stream_socket create_stream_socket_perms;
+
+domain_use_interactive_fds(hypervkvp_t)
+
+logging_send_syslog_msg(hypervkvp_t)
+
+miscfiles_read_localization(hypervkvp_t)
+
+sysnet_dns_name_resolve(hypervkvp_t)