From: "Sven Vermeulen" <swift@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/roles/
Date: Sat, 22 Nov 2014 18:24:43 +0000 (UTC) [thread overview]
Message-ID: <1416680455.9f71ba76490a062fa097c64028e719a803971b79.swift@gentoo> (raw)
Message-ID: <20141122182443.Y7FX3Xg6tuLwEf9AGsDxtckxQrrtFf6yMYoAIxRaxdg@z> (raw)
commit: 9f71ba76490a062fa097c64028e719a803971b79
Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Sat Nov 22 18:20:55 2014 +0000
Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Sat Nov 22 18:20:55 2014 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=9f71ba76
Reshuffle to match upstream better (for comparisons)
---
policy/modules/roles/sysadm.te | 136 ++++++++++++++++++++++-------------------
1 file changed, 74 insertions(+), 62 deletions(-)
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index af9d2cf..7e497b0 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -52,9 +52,6 @@ ifdef(`direct_sysadm_daemon',`
')
ifdef(`distro_gentoo',`
- # To support mirrorselect / netselect
- allow sysadm_t self:rawip_socket create_socket_perms;
-
init_exec_rc(sysadm_t)
')
@@ -89,7 +86,6 @@ optional_policy(`
')
optional_policy(`
- asterisk_admin(sysadm_t, sysadm_r)
asterisk_stream_connect(sysadm_t)
')
@@ -106,7 +102,6 @@ optional_policy(`
')
optional_policy(`
- bind_admin(sysadm_t, sysadm_r)
bind_run_ndc(sysadm_t, sysadm_r)
')
@@ -157,10 +152,6 @@ optional_policy(`
')
optional_policy(`
- dracut_run(sysadm_t, sysadm_r)
-')
-
-optional_policy(`
firstboot_run(sysadm_t, sysadm_r)
')
@@ -242,45 +233,25 @@ optional_policy(`
')
optional_policy(`
- mutt_role(sysadm_r, sysadm_t)
-')
-
-optional_policy(`
mysql_stream_connect(sysadm_t)
')
optional_policy(`
- networkmanager_run_wpa_cli(sysadm_t, sysadm_r)
-')
-
-optional_policy(`
netutils_run(sysadm_t, sysadm_r)
netutils_run_ping(sysadm_t, sysadm_r)
netutils_run_traceroute(sysadm_t, sysadm_r)
')
optional_policy(`
- nginx_admin(sysadm_t, sysadm_r)
-')
-
-optional_policy(`
ntp_stub()
corenet_udp_bind_ntp_port(sysadm_t)
')
optional_policy(`
- ntp_admin(sysadm_t, sysadm_r)
-')
-
-optional_policy(`
oav_run_update(sysadm_t, sysadm_r)
')
optional_policy(`
- openvpn_admin(sysadm_t, sysadm_r)
-')
-
-optional_policy(`
pcmcia_run_cardctl(sysadm_t, sysadm_r)
')
@@ -295,31 +266,10 @@ optional_policy(`
')
optional_policy(`
- postfix_admin(sysadm_t, sysadm_r)
-')
-
-optional_policy(`
- postgresql_admin(sysadm_t, sysadm_r)
- postgresql_exec(sysadm_t)
-')
-
-optional_policy(`
- puppet_admin(sysadm_t, sysadm_r)
-')
-
-optional_policy(`
pyzor_role(sysadm_r, sysadm_t)
')
optional_policy(`
- qemu_read_state(sysadm_t)
- qemu_signal(sysadm_t)
- qemu_kill(sysadm_t)
- qemu_setsched(sysadm_t)
- qemu_run(sysadm_t, sysadm_r)
-')
-
-optional_policy(`
quota_run(sysadm_t, sysadm_r)
')
@@ -348,10 +298,6 @@ optional_policy(`
')
optional_policy(`
- rtorrent_admin(sysadm_t, sysadm_r)
-')
-
-optional_policy(`
samba_run_net(sysadm_t, sysadm_r)
samba_run_winbind_helper(sysadm_t, sysadm_r)
')
@@ -444,10 +390,6 @@ optional_policy(`
')
optional_policy(`
- vde_role(sysadm_r, sysadm_t)
-')
-
-optional_policy(`
virt_stream_connect(sysadm_t)
')
@@ -517,10 +459,6 @@ ifndef(`distro_redhat',`
')
optional_policy(`
- gorg_role(sysadm_r, sysadm_t)
- ')
-
- optional_policy(`
gpg_role(sysadm_r, sysadm_t)
')
@@ -534,10 +472,27 @@ ifndef(`distro_redhat',`
')
ifdef(`distro_gentoo',`
+ #########################################
+ #
+ # Local sysadm_t policy
+ #
+
+ # To support mirrorselect / netselect
+ allow sysadm_t self:rawip_socket create_socket_perms;
+
+
# powertop support
dev_read_cpuid(sysadm_t)
optional_policy(`
+ asterisk_admin(sysadm_t, sysadm_r)
+ ')
+
+ optional_policy(`
+ bind_admin(sysadm_t, sysadm_r)
+ ')
+
+ optional_policy(`
dnsmasq_admin(sysadm_t, sysadm_r)
')
@@ -546,10 +501,59 @@ ifdef(`distro_gentoo',`
')
optional_policy(`
+ dracut_run(sysadm_t, sysadm_r)
+ ')
+
+ optional_policy(`
fail2ban_run_client(sysadm_t, sysadm_r)
')
optional_policy(`
+ gorg_role(sysadm_r, sysadm_t)
+ ')
+
+ optional_policy(`
+ mutt_role(sysadm_r, sysadm_t)
+ ')
+
+ optional_policy(`
+ networkmanager_run_wpa_cli(sysadm_t, sysadm_r)
+ ')
+
+ optional_policy(`
+ nginx_admin(sysadm_t, sysadm_r)
+ ')
+
+ optional_policy(`
+ ntp_admin(sysadm_t, sysadm_r)
+ ')
+
+ optional_policy(`
+ openvpn_admin(sysadm_t, sysadm_r)
+ ')
+
+ optional_policy(`
+ postfix_admin(sysadm_t, sysadm_r)
+ ')
+
+ optional_policy(`
+ postgresql_admin(sysadm_t, sysadm_r)
+ postgresql_exec(sysadm_t)
+ ')
+
+ optional_policy(`
+ puppet_admin(sysadm_t, sysadm_r)
+ ')
+
+ optional_policy(`
+ qemu_read_state(sysadm_t)
+ qemu_signal(sysadm_t)
+ qemu_kill(sysadm_t)
+ qemu_setsched(sysadm_t)
+ qemu_run(sysadm_t, sysadm_r)
+ ')
+
+ optional_policy(`
rpc_admin(sysadm_t, sysadm_r)
')
@@ -558,6 +562,10 @@ ifdef(`distro_gentoo',`
')
optional_policy(`
+ rtorrent_admin(sysadm_t, sysadm_r)
+ ')
+
+ optional_policy(`
salt_admin_master(sysadm_t, sysadm_r)
salt_admin_minion(sysadm_t, sysadm_r)
')
@@ -570,4 +578,8 @@ ifdef(`distro_gentoo',`
optional_policy(`
shorewall_admin(sysadm_t, sysadm_r)
')
+
+ optional_policy(`
+ vde_role(sysadm_r, sysadm_t)
+ ')
')
next reply other threads:[~2014-11-22 18:24 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-11-23 14:06 Sven Vermeulen [this message]
2014-11-22 18:24 ` [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/roles/ Sven Vermeulen
2014-11-28 10:04 ` [gentoo-commits] proj/hardened-refpolicy:next " Sven Vermeulen
-- strict thread matches above, loose matches on Subject: below --
2014-11-23 14:06 [gentoo-commits] proj/hardened-refpolicy:bitcoin " Sven Vermeulen
2014-11-22 18:24 [gentoo-commits] proj/hardened-refpolicy:master " Sven Vermeulen
2014-11-23 14:06 ` [gentoo-commits] proj/hardened-refpolicy:bitcoin " Sven Vermeulen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1416680455.9f71ba76490a062fa097c64028e719a803971b79.swift@gentoo \
--to=swift@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox