[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     1e570633210d20c462a98fdfa0c3a23e9a2652ec
Author:     Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Fri Sep 20 07:28:45 2013 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Sep 23 06:28:39 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=1e570633

Clean up initial redis policy module

Need a redis port type

Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>

---
 policy/modules/contrib/redis.fc |  10 +-
 policy/modules/contrib/redis.if | 243 ++--------------------------------------
 policy/modules/contrib/redis.te |  15 ++-
 3 files changed, 20 insertions(+), 248 deletions(-)

diff --git a/policy/modules/contrib/redis.fc b/policy/modules/contrib/redis.fc
index 638d6b4..e240ac9 100644
--- a/policy/modules/contrib/redis.fc
+++ b/policy/modules/contrib/redis.fc
@@ -1,11 +1,9 @@
 /etc/rc\.d/init\.d/redis	--	gen_context(system_u:object_r:redis_initrc_exec_t,s0)
 
-/usr/lib/systemd/system/redis.*		--	gen_context(system_u:object_r:redis_unit_file_t,s0)
+/usr/sbin/redis-server	--	gen_context(system_u:object_r:redis_exec_t,s0)
 
-/usr/sbin/redis-server		--	gen_context(system_u:object_r:redis_exec_t,s0)
+/var/lib/redis(/.*)?	gen_context(system_u:object_r:redis_var_lib_t,s0)
 
-/var/lib/redis(/.*)?		gen_context(system_u:object_r:redis_var_lib_t,s0)
+/var/log/redis(/.*)?	gen_context(system_u:object_r:redis_log_t,s0)
 
-/var/log/redis(/.*)?		gen_context(system_u:object_r:redis_log_t,s0)
-
-/var/run/redis(/.*)?		gen_context(system_u:object_r:redis_var_run_t,s0)
+/var/run/redis(/.*)?	gen_context(system_u:object_r:redis_var_run_t,s0)

diff --git a/policy/modules/contrib/redis.if b/policy/modules/contrib/redis.if
index e3efff0..16c8ecb 100644
--- a/policy/modules/contrib/redis.if
+++ b/policy/modules/contrib/redis.if
@@ -1,226 +1,9 @@
-
-## <summary>policy for redis</summary>
-
-########################################
-## <summary>
-##	Execute TEMPLATE in the redis domin.
-## </summary>
-## <param name="domain">
-## <summary>
-##	Domain allowed to transition.
-## </summary>
-## </param>
-#
-interface(`redis_domtrans',`
-	gen_require(`
-		type redis_t, redis_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	domtrans_pattern($1, redis_exec_t, redis_t)
-')
-
-########################################
-## <summary>
-##	Execute redis server in the redis domain.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`redis_initrc_domtrans',`
-	gen_require(`
-		type redis_initrc_exec_t;
-	')
-
-	init_labeled_script_domtrans($1, redis_initrc_exec_t)
-')
-########################################
-## <summary>
-##	Read redis's log files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-## <rolecap/>
-#
-interface(`redis_read_log',`
-	gen_require(`
-		type redis_log_t;
-	')
-
-	logging_search_logs($1)
-	read_files_pattern($1, redis_log_t, redis_log_t)
-')
-
-########################################
-## <summary>
-##	Append to redis log files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`redis_append_log',`
-	gen_require(`
-		type redis_log_t;
-	')
-
-	logging_search_logs($1)
-	append_files_pattern($1, redis_log_t, redis_log_t)
-')
-
-########################################
-## <summary>
-##	Manage redis log files
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`redis_manage_log',`
-	gen_require(`
-		type redis_log_t;
-	')
-
-	logging_search_logs($1)
-	manage_dirs_pattern($1, redis_log_t, redis_log_t)
-	manage_files_pattern($1, redis_log_t, redis_log_t)
-	manage_lnk_files_pattern($1, redis_log_t, redis_log_t)
-')
-
-########################################
-## <summary>
-##	Search redis lib directories.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`redis_search_lib',`
-	gen_require(`
-		type redis_var_lib_t;
-	')
-
-	allow $1 redis_var_lib_t:dir search_dir_perms;
-	files_search_var_lib($1)
-')
-
-########################################
-## <summary>
-##	Read redis lib files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`redis_read_lib_files',`
-	gen_require(`
-		type redis_var_lib_t;
-	')
-
-	files_search_var_lib($1)
-	read_files_pattern($1, redis_var_lib_t, redis_var_lib_t)
-')
-
-########################################
-## <summary>
-##	Manage redis lib files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`redis_manage_lib_files',`
-	gen_require(`
-		type redis_var_lib_t;
-	')
-
-	files_search_var_lib($1)
-	manage_files_pattern($1, redis_var_lib_t, redis_var_lib_t)
-')
-
-########################################
-## <summary>
-##	Manage redis lib directories.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`redis_manage_lib_dirs',`
-	gen_require(`
-		type redis_var_lib_t;
-	')
-
-	files_search_var_lib($1)
-	manage_dirs_pattern($1, redis_var_lib_t, redis_var_lib_t)
-')
-
-########################################
-## <summary>
-##	Read redis PID files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`redis_read_pid_files',`
-	gen_require(`
-		type redis_var_run_t;
-	')
-
-	files_search_pids($1)
-	read_files_pattern($1, redis_var_run_t, redis_var_run_t)
-')
+## <summary>Advanced key-value store.</summary>
 
 ########################################
 ## <summary>
-##	Execute redis server in the redis domain.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed to transition.
-##	</summary>
-## </param>
-#
-interface(`redis_systemctl',`
-	gen_require(`
-		type redis_t;
-		type redis_unit_file_t;
-	')
-
-	systemd_exec_systemctl($1)
-        systemd_read_fifo_file_password_run($1)
-	allow $1 redis_unit_file_t:file read_file_perms;
-	allow $1 redis_unit_file_t:service manage_service_perms;
-
-	ps_process_pattern($1, redis_t)
-')
-
-
-########################################
-## <summary>
-##	All of the rules required to administrate
-##	an redis environment
+##	All of the rules required to
+##	administrate an redis environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -236,36 +19,24 @@ interface(`redis_systemctl',`
 #
 interface(`redis_admin',`
 	gen_require(`
-		type redis_t;
-		type redis_initrc_exec_t;
-		type redis_log_t;
-		type redis_var_lib_t;
-		type redis_var_run_t;
-	type redis_unit_file_t;
+		type redis_t, redis_initrc_exec_t, redis_var_lib_t;
+		type redis_log_t, redis_var_run_t;
 	')
 
 	allow $1 redis_t:process { ptrace signal_perms };
 	ps_process_pattern($1, redis_t)
 
-	redis_initrc_domtrans($1)
+	init_labeled_script_domtrans($1, redis_initrc_exec_t)
 	domain_system_change_exemption($1)
 	role_transition $2 redis_initrc_exec_t system_r;
 	allow $2 system_r;
 
 	logging_search_logs($1)
-	admin_pattern($1, redis_log_t)
+	admin_pattern($!, redis_log_t)
 
 	files_search_var_lib($1)
 	admin_pattern($1, redis_var_lib_t)
 
 	files_search_pids($1)
 	admin_pattern($1, redis_var_run_t)
-
-	redis_systemctl($1)
-	admin_pattern($1, redis_unit_file_t)
-	allow $1 redis_unit_file_t:service all_service_perms;
-	optional_policy(`
-		systemd_passwd_agent_exec($1)
-		systemd_read_fifo_file_passwd_run($1)
-	')
 ')

diff --git a/policy/modules/contrib/redis.te b/policy/modules/contrib/redis.te
index e5e9cf7..f98e40e 100644
--- a/policy/modules/contrib/redis.te
+++ b/policy/modules/contrib/redis.te
@@ -21,12 +21,9 @@ files_type(redis_var_lib_t)
 type redis_var_run_t;
 files_pid_file(redis_var_run_t)
 
-type redis_unit_file_t;
-systemd_unit_file(redis_unit_file_t)
-
 ########################################
 #
-# redis local policy
+# Local policy
 #
 
 allow redis_t self:process { setrlimit signal_perms };
@@ -48,8 +45,15 @@ manage_lnk_files_pattern(redis_t, redis_var_run_t, redis_var_run_t)
 
 kernel_read_system_state(redis_t)
 
+corenet_all_recvfrom_unlabeled(redis_t)
+corenet_all_recvfrom_netlabel(redis_t)
+corenet_tcp_sendrecv_generic_if(redis_t)
+corenet_tcp_sendrecv_generic_node(redis_t)
 corenet_tcp_bind_generic_node(redis_t)
-corenet_tcp_bind_redis_port(redis_t)
+
+# corenet_sendrecv_redis_server_packets(redis_t)
+# corenet_tcp_bind_redis_port(redis_t)
+# corenet_tcp_sendrecv_redis_port(redis_t)
 
 dev_read_sysfs(redis_t)
 dev_read_urand(redis_t)
@@ -59,4 +63,3 @@ logging_send_syslog_msg(redis_t)
 miscfiles_read_localization(redis_t)
 
 sysnet_dns_name_resolve(redis_t)
-