From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 55B88138C92 for ; Mon, 24 Oct 2016 16:03:49 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 36ED421C038; Mon, 24 Oct 2016 16:03:06 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id EF9E621C038 for ; Mon, 24 Oct 2016 16:03:05 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 13F533416AA for ; Mon, 24 Oct 2016 16:03:05 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id D69B733D for ; Mon, 24 Oct 2016 16:03:03 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1477324645.a172282d756622acde353c6bd9387431b0b3ff9e.swift@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:next commit in: / X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: syncthing.fc syncthing.if syncthing.te X-VCS-Directories: / X-VCS-Committer: swift X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: a172282d756622acde353c6bd9387431b0b3ff9e X-VCS-Branch: next Date: Mon, 24 Oct 2016 16:03:03 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: e0f932ea-4d56-4a5b-8b77-5377c82f7b3c X-Archives-Hash: e8dacfe71bdc3a10224397a1b8a852a0 Message-ID: <20161024160303.NVJyOLkLb61LIWoaolmIvnXTN8ydruXCHKy2ccw-8dk@z> commit: a172282d756622acde353c6bd9387431b0b3ff9e Author: Naftuli Tzvi Kay gmail com> AuthorDate: Sun Aug 21 07:08:42 2016 +0000 Commit: Sven Vermeulen gentoo org> CommitDate: Mon Oct 24 15:57:25 2016 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=a172282d Syncthing Policy Policy governing Syncthing - a file synchronization utility written in Go. Signed-off-by: Sven Vermeulen siphos.be> syncthing.fc | 3 +++ syncthing.if | 32 +++++++++++++++++++++++++ syncthing.te | 78 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 113 insertions(+) diff --git a/syncthing.fc b/syncthing.fc new file mode 100644 index 0000000..4f7f53e --- /dev/null +++ b/syncthing.fc @@ -0,0 +1,3 @@ +/usr/bin/syncthing -- gen_context(system_u:object_r:syncthing_exec_t,s0) + +HOME_DIR/\.config/syncthing(/.*)? gen_context(system_u:object_r:syncthing_config_home_t,s0) diff --git a/syncthing.if b/syncthing.if new file mode 100644 index 0000000..d71fdaa --- /dev/null +++ b/syncthing.if @@ -0,0 +1,32 @@ +## Application that lets you synchronize your files across multiple devices. + +######################################## +## +## Role access for Syncthing +## +## +## +## Role allowed access +## +## +## +## +## User domain for the role +## +## +# +interface(`syncthing_role', ` + + gen_require(` + attribute_role syncthing_roles; + type syncthing_t, syncthing_exec_t, syncthing_config_home_t; + ') + + roleattribute $1 syncthing_roles; + + domtrans_pattern($2, syncthing_exec_t, syncthing_t) + + allow $2 syncthing_config_home_t:file { manage_file_perms relabel_file_perms }; + allow $2 syncthing_config_home_t:dir { manage_dir_perms relabel_dir_perms }; + allow $2 syncthing_config_home_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms }; +') diff --git a/syncthing.te b/syncthing.te new file mode 100644 index 0000000..8144389 --- /dev/null +++ b/syncthing.te @@ -0,0 +1,78 @@ +policy_module(syncthing, 1.0.0) + +######################################## +# +# Declarations +# + +attribute_role syncthing_roles; +role syncthing_roles types syncthing_t; + +type syncthing_t; +type syncthing_exec_t; +init_daemon_domain(syncthing_t, syncthing_exec_t) +userdom_user_application_domain(syncthing_t, syncthing_exec_t) + +type syncthing_config_home_t; +userdom_user_home_content(syncthing_config_home_t) + +######################################## +# +# Declarations +# + +allow syncthing_t self:process getsched; +allow syncthing_t self:fifo_file rw_fifo_file_perms; +allow syncthing_t self:tcp_socket { listen accept }; + +can_exec(syncthing_t, syncthing_exec_t) + +kernel_read_kernel_sysctls(syncthing_t) +kernel_read_net_sysctls(syncthing_t) +kernel_read_system_state(syncthing_t) + +corenet_tcp_sendrecv_generic_if(syncthing_t) +corenet_udp_sendrecv_generic_if(syncthing_t) + +corenet_tcp_bind_generic_node(syncthing_t) +corenet_tcp_sendrecv_generic_node(syncthing_t) +corenet_tcp_sendrecv_all_ports(syncthing_t) + +corenet_udp_bind_generic_node(syncthing_t) +corenet_udp_sendrecv_generic_node(syncthing_t) +corenet_udp_sendrecv_all_ports(syncthing_t) + +corenet_tcp_connect_all_ports(syncthing_t) + +corenet_tcp_bind_syncthing_port(syncthing_t) +corenet_udp_bind_syncthing_discovery_port(syncthing_t) +corenet_tcp_bind_syncthing_admin_port(syncthing_t) + +dev_read_rand(syncthing_t) +dev_read_urand(syncthing_t) + +fs_getattr_xattr_fs(syncthing_t) + +auth_use_nsswitch(syncthing_t) + +manage_dirs_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) +manage_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) +manage_lnk_files_pattern(syncthing_t, syncthing_config_home_t, syncthing_config_home_t) + +miscfiles_read_generic_certs(syncthing_t) +miscfiles_read_localization(syncthing_t) + +userdom_manage_user_home_content_files(syncthing_t) +userdom_manage_user_home_content_dirs(syncthing_t) +userdom_manage_user_home_content_symlinks(syncthing_t) +userdom_user_home_dir_filetrans_user_home_content(syncthing_t, dir) + +# newly created files in ~/.config/syncthing/ will transition to syncthing_config_home_t +userdom_user_home_content_filetrans(syncthing_t, syncthing_config_home_t, dir, "syncthing") + +userdom_use_user_terminals(syncthing_t) + +optional_policy(` + # temporary hack for /run/NetworkManager/resolv.conf until we make this part of sysnet_dns_name_resolve() + networkmanager_read_pid_files(syncthing_t) +')