[gentoo-commits] proj/hardened-refpolicy:master commit in: /

["Sven Vermeulen" <swift@gentoo.org>]

commit:     7601edab81d7dd32ebe8270c7cd3ac17b0f28431
Author:     Chris PeBenito <pebenito <AT> ieee <DOT> org>
AuthorDate: Sun Oct  9 11:47:09 2016 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Mon Oct 24 15:57:32 2016 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=7601edab

Rearrange lines in syncthing.

Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>

 syncthing.if | 19 +++++++++----------
 syncthing.te | 20 +++++++-------------
 2 files changed, 16 insertions(+), 23 deletions(-)

diff --git a/syncthing.if b/syncthing.if
index d71fdaa..065800a 100644
--- a/syncthing.if
+++ b/syncthing.if
@@ -16,17 +16,16 @@
 ## </param>
 #
 interface(`syncthing_role', `
+	gen_require(`
+		attribute_role syncthing_roles;
+		type syncthing_t, syncthing_exec_t, syncthing_config_home_t;
+	')
 
-    gen_require(`
-        attribute_role syncthing_roles;
-        type syncthing_t, syncthing_exec_t, syncthing_config_home_t;
-    ')
+	roleattribute $1 syncthing_roles;
 
-    roleattribute $1 syncthing_roles;
+	domtrans_pattern($2, syncthing_exec_t, syncthing_t)
 
-    domtrans_pattern($2, syncthing_exec_t, syncthing_t)
-
-    allow $2 syncthing_config_home_t:file { manage_file_perms relabel_file_perms };
-    allow $2 syncthing_config_home_t:dir { manage_dir_perms relabel_dir_perms };
-    allow $2 syncthing_config_home_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
+	allow $2 syncthing_config_home_t:file { manage_file_perms relabel_file_perms };
+	allow $2 syncthing_config_home_t:dir { manage_dir_perms relabel_dir_perms };
+	allow $2 syncthing_config_home_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
 ')

diff --git a/syncthing.te b/syncthing.te
index 8144389..92d0bf5 100644
--- a/syncthing.te
+++ b/syncthing.te
@@ -27,23 +27,23 @@ allow syncthing_t self:tcp_socket { listen accept };
 
 can_exec(syncthing_t, syncthing_exec_t)
 
+manage_dirs_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t)
+manage_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t)
+manage_lnk_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t)
+
 kernel_read_kernel_sysctls(syncthing_t)
 kernel_read_net_sysctls(syncthing_t)
 kernel_read_system_state(syncthing_t)
 
 corenet_tcp_sendrecv_generic_if(syncthing_t)
 corenet_udp_sendrecv_generic_if(syncthing_t)
-
 corenet_tcp_bind_generic_node(syncthing_t)
 corenet_tcp_sendrecv_generic_node(syncthing_t)
 corenet_tcp_sendrecv_all_ports(syncthing_t)
-
 corenet_udp_bind_generic_node(syncthing_t)
 corenet_udp_sendrecv_generic_node(syncthing_t)
 corenet_udp_sendrecv_all_ports(syncthing_t)
-
 corenet_tcp_connect_all_ports(syncthing_t)
-
 corenet_tcp_bind_syncthing_port(syncthing_t)
 corenet_udp_bind_syncthing_discovery_port(syncthing_t)
 corenet_tcp_bind_syncthing_admin_port(syncthing_t)
@@ -55,10 +55,6 @@ fs_getattr_xattr_fs(syncthing_t)
 
 auth_use_nsswitch(syncthing_t)
 
-manage_dirs_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t)
-manage_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t)
-manage_lnk_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t)
-
 miscfiles_read_generic_certs(syncthing_t)
 miscfiles_read_localization(syncthing_t)
 
@@ -66,13 +62,11 @@ userdom_manage_user_home_content_files(syncthing_t)
 userdom_manage_user_home_content_dirs(syncthing_t)
 userdom_manage_user_home_content_symlinks(syncthing_t)
 userdom_user_home_dir_filetrans_user_home_content(syncthing_t, dir)
-
+userdom_use_user_terminals(syncthing_t)
 # newly created files in ~/.config/syncthing/ will transition to syncthing_config_home_t
 userdom_user_home_content_filetrans(syncthing_t, syncthing_config_home_t, dir, "syncthing")
 
-userdom_use_user_terminals(syncthing_t)
-
 optional_policy(`
-    # temporary hack for /run/NetworkManager/resolv.conf until we make this part of sysnet_dns_name_resolve()
-    networkmanager_read_pid_files(syncthing_t)
+	# temporary hack for /run/NetworkManager/resolv.conf until we make this part of sysnet_dns_name_resolve()
+	networkmanager_read_pid_files(syncthing_t)
 ')