Skip to contentSkip to conversation

Mark use of deprecated interfaces that are not providing replacement as errors

PATCH New Laurent Bigonville 5 participants 25 messages Sep 4, 2012 – Oct 9, 2012

lore
Share & tools
lore

Laurent Bigonville

author
#0 lore raw

PATCH 1/9 Mark use of deprecated interfaces that are not providing replacement as errors

From: Laurent Bigonville <[email protected]>

---
 bind.if        |    2 +-
 bluetooth.if   |    4 ++--
 cups.if        |    2 +-
 dictd.if       |    2 +-
 finger.if      |    2 +-
 ftp.if         |    2 +-
 i18n_input.if  |    2 +-
 inetd.if       |    4 ++--
 jabber.if      |    2 +-
 ldap.if        |    2 +-
 mta.if         |    2 +-
 nessus.if      |    2 +-
 nis.if         |    4 ++--
 nsd.if         |    4 ++--
 perdition.if   |    2 +-
 portmap.if     |    6 +++---
 radius.if      |    2 +-
 rpc.if         |    4 ++--
 snmp.if        |    4 ++--
 soundserver.if |    2 +-
 squid.if       |    2 +-
 21 files changed, 29 insertions(+), 29 deletions(-)
bind.if +1 -1
index 44a1e3d..b5e0ea5 100644
@@ -336,7 +336,7 @@ interface(`bind_manage_zone',`
 ## </param>
 #
 interface(`bind_udp_chat_named',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
bluetooth.if +2 -2
index 3e45431..f232b3b 100644
@@ -126,7 +126,7 @@ interface(`bluetooth_dbus_chat',`
 ## </param>
 #
 interface(`bluetooth_domtrans_helper',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################

@@ -152,7 +152,7 @@ interface(`bluetooth_domtrans_helper',`
 ## <rolecap/>
 #
 interface(`bluetooth_run_helper',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
cups.if +1 -1
index 305ddf4..56cb53f 100644
@@ -75,7 +75,7 @@ interface(`cups_stream_connect',`
 ## </param>
 #
 interface(`cups_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
dictd.if +1 -1
index a0d23ce..7650335 100644
@@ -12,7 +12,7 @@
 ## </param>
 #
 interface(`dictd_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
finger.if +1 -1
index b5dd671..9bbb169 100644
@@ -29,5 +29,5 @@ interface(`finger_domtrans',`
 ## </param>
 #
 interface(`finger_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
ftp.if +1 -1
index 9d3201b..3d29482 100644
@@ -29,7 +29,7 @@ interface(`ftp_dyntrans_anon_sftpd',`
 ## </param>
 #
 interface(`ftp_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
i18n_input.if +1 -1
index bc7de4f..bd85f3b 100644
@@ -11,5 +11,5 @@
 ## </param>
 #
 interface(`i18n_use',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
inetd.if +2 -2
index df48e5e..75a7539 100644
@@ -150,7 +150,7 @@ interface(`inetd_use_fds',`
 ## </param>
 #
 interface(`inetd_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################

@@ -183,7 +183,7 @@ interface(`inetd_domtrans_child',`
 ## </param>
 #
 interface(`inetd_udp_send',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
jabber.if +1 -1
index 9878499..00f78ed 100644
@@ -11,7 +11,7 @@
 ## </param>
 #
 interface(`jabber_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
ldap.if +1 -1
index d6b7b2d..5585d7d 100644
@@ -50,7 +50,7 @@ interface(`ldap_read_config',`
 ## </param>
 #
 interface(`ldap_use',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
mta.if +1 -1
index 4e2a5ba..f5b7fcd 100644
@@ -587,7 +587,7 @@ interface(`mta_dontaudit_rw_delivery_tcp_sockets',`
 ## </param>
 #
 interface(`mta_tcp_connect_all_mailservers',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 #######################################
nessus.if +1 -1
index 6ec8003..edc4d91 100644
@@ -11,5 +11,5 @@
 ## </param>
 #
 interface(`nessus_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
nis.if +2 -2
index abe3f7f..1430352 100644
@@ -205,7 +205,7 @@ interface(`nis_list_var_yp',`
 ## </param>
 #
 interface(`nis_udp_send_ypbind',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################

@@ -219,7 +219,7 @@ interface(`nis_udp_send_ypbind',`
 ## </param>
 #
 interface(`nis_tcp_connect_ypbind',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
nsd.if +2 -2
index a1371d5..5142540 100644
@@ -11,7 +11,7 @@
 ## </param>
 #
 interface(`nsd_udp_chat',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################

@@ -25,5 +25,5 @@ interface(`nsd_udp_chat',`
 ## </param>
 #
 interface(`nsd_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
perdition.if +1 -1
index 2b0bd64..8919276 100644
@@ -11,5 +11,5 @@
 ## </param>
 #
 interface(`perdition_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
portmap.if +3 -3
index 374afcf..f0484c3 100644
@@ -57,7 +57,7 @@ interface(`portmap_run_helper',`
 ## </param>
 #
 interface(`portmap_udp_send',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################

@@ -71,7 +71,7 @@ interface(`portmap_udp_send',`
 ## </param>
 #
 interface(`portmap_udp_chat',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################

@@ -85,5 +85,5 @@ interface(`portmap_udp_chat',`
 ## </param>
 #
 interface(`portmap_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
radius.if +1 -1
index 75e5dc4..9b35194 100644
@@ -11,7 +11,7 @@
 ## </param>
 #
 interface(`radius_use',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
rpc.if +2 -2
index dddabcf..a8a31b7 100644
@@ -133,7 +133,7 @@ template(`rpc_domain_template', `
 ## </param>
 #
 interface(`rpc_udp_send',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################

@@ -374,7 +374,7 @@ interface(`rpc_udp_rw_nfs_sockets',`
 ## </param>
 #
 interface(`rpc_udp_send_nfs',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
snmp.if +2 -2
index 275f9fb..f143171 100644
@@ -30,7 +30,7 @@ interface(`snmp_stream_connect',`
 ## </param>
 #
 interface(`snmp_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################

@@ -44,7 +44,7 @@ interface(`snmp_tcp_connect',`
 ## </param>
 #
 interface(`snmp_udp_chat',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
soundserver.if +1 -1
index 93fe7bf..d27ebc5 100644
@@ -11,7 +11,7 @@
 ## </param>
 #
 interface(`soundserver_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
squid.if +1 -1
index d2496bd..de25872 100644
@@ -184,7 +184,7 @@ interface(`squid_manage_logs',`
 ## </param>
 #
 interface(`squid_use',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
Signature · 1 line
1.7.10.4
author
#1 lore raw

PATCH 2/9 Allow saslauthd_t to talk to mysqld via TCP

From: Mika Pfl?ger <[email protected]>

---
 sasl.te |    1 +
 1 file changed, 1 insertion(+)
sasl.te +1 -0
index 9d9f8ce..a066d33 100644
@@ -99,6 +99,7 @@ optional_policy(`
 optional_policy(`
 	mysql_search_db(saslauthd_t)
 	mysql_stream_connect(saslauthd_t)
+	mysql_tcp_connect(saslauthd_t)
 ')
 
 optional_policy(`
Signature · 1 line
1.7.10.4
#2 lore raw

PATCH 2/9 Allow saslauthd_t to talk to mysqld via TCP

Quoted 12 lines · Laurent Bigonville

From: Mika Pfl??ger <[email protected]>

---
 sasl.te |    1 +
 1 file changed, 1 insertion(+)
sasl.te +0 -0
index 9d9f8ce..a066d33 100644

sasl.te optional_policy(` · line 105

Quoted 7 lines
sasl.te +1 -0
@@ -99,6 +99,7 @@ optional_policy(`
 optional_policy(`
 	mysql_search_db(saslauthd_t)
 	mysql_stream_connect(saslauthd_t)
+	mysql_tcp_connect(saslauthd_t)
 ')
 
 optional_policy(`

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
author
#3 lore raw

PATCH 3/9 Policykit debian fixes

In reply to Laurent Bigonville

From: Mika Pfl?ger <[email protected]>

---
 policykit.fc |    2 ++
 1 file changed, 2 insertions(+)
policykit.fc +2 -0
index 63d0061..6bbd28c 100644
@@ -4,6 +4,8 @@
 /usr/lib/policykit/polkitd		--	gen_context(system_u:object_r:policykit_exec_t,s0)
 /usr/lib/policykit-1/polkitd		--	gen_context(system_u:object_r:policykit_exec_t,s0)
 
+/usr/lib/policykit-1/polkitd		--	gen_context(system_u:object_r:policykit_exec_t,s0)
+
 /usr/libexec/polkit-read-auth-helper	--	gen_context(system_u:object_r:policykit_auth_exec_t,s0)
 /usr/libexec/polkit-grant-helper.*	--	gen_context(system_u:object_r:policykit_grant_exec_t,s0)
 /usr/libexec/polkit-resolve-exe-helper.* --	gen_context(system_u:object_r:policykit_resolve_exec_t,s0)
Signature · 1 line
1.7.10.4
#4 lore raw

PATCH 3/9 Policykit debian fixes

Quoted 11 lines · Laurent Bigonville

From: Mika Pfl??ger <[email protected]>

---
 policykit.fc |    2 ++
 1 file changed, 2 insertions(+)
policykit.fc +0 -0
index 63d0061..6bbd28c 100644

policykit.fc line 11

Quoted 8 lines
policykit.fc +2 -0
@@ -4,6 +4,8 @@
 /usr/lib/policykit/polkitd		--	gen_context(system_u:object_r:policykit_exec_t,s0)
 /usr/lib/policykit-1/polkitd		--	gen_context(system_u:object_r:policykit_exec_t,s0)
 
+/usr/lib/policykit-1/polkitd		--	gen_context(system_u:object_r:policykit_exec_t,s0)
+
 /usr/libexec/polkit-read-auth-helper	--	gen_context(system_u:object_r:policykit_auth_exec_t,s0)
 /usr/libexec/polkit-grant-helper.*	--	gen_context(system_u:object_r:policykit_grant_exec_t,s0)
 /usr/libexec/polkit-resolve-exe-helper.* --	gen_context(system_u:object_r:policykit_resolve_exec_t,s0)

Looks like a duplicate to me.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
author
#5 lore raw

PATCH 4/9 Quota policy adjustments: * Allow quota_t to load kernel modules

In reply to Laurent Bigonville

From: Mika Pfl?ger <[email protected]>

---
 quota.te |    1 +
 1 file changed, 1 insertion(+)
quota.te +1 -0
index 5dd42f5..5ec1cf3 100644
@@ -20,6 +20,7 @@ files_type(quota_flag_t)
 # Local policy
 #
 
+kernel_request_load_module(quota_t)
 allow quota_t self:capability { sys_admin dac_override };
 dontaudit quota_t self:capability sys_tty_config;
 allow quota_t self:process signal_perms;
Signature · 1 line
1.7.10.4
#6 lore raw

PATCH 4/9 Quota policy adjustments: * Allow quota_t to load kernel modules

Quoted 11 lines · Laurent Bigonville

From: Mika Pfl??ger <[email protected]>

---
 quota.te |    1 +
 1 file changed, 1 insertion(+)
quota.te +0 -0
index 5dd42f5..5ec1cf3 100644

quota.te files_type(quota_flag_t) · line 26

Quoted 7 lines
quota.te +1 -0
@@ -20,6 +20,7 @@ files_type(quota_flag_t)
 # Local policy
 #
 
+kernel_request_load_module(quota_t)
 allow quota_t self:capability { sys_admin dac_override };
 dontaudit quota_t self:capability sys_tty_config;
 allow quota_t self:process signal_perms;

Merged. Moved the line to the appropriate place.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
author
#7 lore raw

PATCH 5/9 Label /usr/lib/udisks/udisks-helper-* with bin_t

In reply to Laurent Bigonville

From: Laurent Bigonville <[email protected]>

---
 devicekit.fc |    1 +
 1 file changed, 1 insertion(+)
devicekit.fc +1 -0
index 9af85c8..ae2d805 100644
@@ -1,4 +1,5 @@
 /usr/lib/udisks/udisks-daemon	--	gen_context(system_u:object_r:devicekit_disk_exec_t,s0)
+/usr/lib/udisks/udisks-helper-.* --     gen_context(system_u:object_r:bin_t,s0)
 
 /usr/libexec/devkit-daemon	--	gen_context(system_u:object_r:devicekit_exec_t,s0)
 /usr/libexec/devkit-disks-daemon --	gen_context(system_u:object_r:devicekit_disk_exec_t,s0)
Signature · 1 line
1.7.10.4
#8 lore raw

PATCH 5/9 Label /usr/lib/udisks/udisks-helper-* with bin_t

Quoted 12 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

---
 devicekit.fc |    1 +
 1 file changed, 1 insertion(+)
devicekit.fc +0 -0
index 9af85c8..ae2d805 100644

devicekit.fc line 5

Quoted 5 lines
devicekit.fc +1 -0
@@ -1,4 +1,5 @@
 /usr/lib/udisks/udisks-daemon	--	gen_context(system_u:object_r:devicekit_disk_exec_t,s0)
+/usr/lib/udisks/udisks-helper-.* --     gen_context(system_u:object_r:bin_t,s0)
 
 /usr/libexec/devkit-daemon	--	gen_context(system_u:object_r:devicekit_exec_t,s0)
 /usr/libexec/devkit-disks-daemon --	gen_context(system_u:object_r:devicekit_disk_exec_t,s0)

This belongs in corecommands, if bin_t is appropriate.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
#9 lore raw

PATCH 5/9 Label /usr/lib/udisks/udisks-helper-* with bin_t

In light of the contrib split, perhaps we might want to consider allowing these generic types that should be on everyone"s base policy within the modules?

Quoted 25 lines · Christopher J. PeBenito

devicekit.fc line 1

Quoted 12 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

---
 devicekit.fc |    1 +
 1 file changed, 1 insertion(+)
devicekit.fc +0 -0
index 9af85c8..ae2d805 100644
@@ -1,4 +1,5 @@
 /usr/lib/udisks/udisks-daemon        --

gen_context(system_u:object_r:devicekit_disk_exec_t,s0)

devicekit.fc line 2

Quoted 1 line
devicekit.fc +1 -0
+/usr/lib/udisks/udisks-helper-.* --

gen_context(system_u:object_r:bin_t,s0)

devicekit.fc line 3

Quoted 2 lines
devicekit.fc +0 -0
 /usr/libexec/devkit-daemon   --

gen_context(system_u:object_r:devicekit_exec_t,s0)

devicekit.fc line 4

Quoted 1 line
devicekit.fc +0 -0
 /usr/libexec/devkit-disks-daemon --

gen_context(system_u:object_r:devicekit_disk_exec_t,s0)

Quoted 1 line

This belongs in corecommands, if bin_t is appropriate.

Quoted 9 lines

--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20120907/f3a69036/attachment.html

#10 lore raw

PATCH 5/9 Label /usr/lib/udisks/udisks-helper-* with bin_t

Quoted 23 lines · Sven Vermeulen

In light of the contrib split, perhaps we might want to consider allowing these generic types that should be on everyone"s base policy within the modules?

On Sep 7, 2012 3:08 PM, "Christopher J. PeBenito" <[email protected] <mailto:[email protected]>> wrote:

    On 09/04/12 17:37, Laurent Bigonville wrote:
     > From: Laurent Bigonville <bigon at bigon.be <mailto:[email protected]>>
     >
     > ---
     >  devicekit.fc |    1 +
     >  1 file changed, 1 insertion(+)
     >
     > diff --git a/devicekit.fc b/devicekit.fc
     > index 9af85c8..ae2d805 100644
     > --- a/devicekit.fc
     > +++ b/devicekit.fc
     > @@ -1,4 +1,5 @@
     >  /usr/lib/udisks/udisks-daemon        --
      gen_context(system_u:object_r:devicekit_disk_exec_t,s0)
     > +/usr/lib/udisks/udisks-helper-.* --
    gen_context(system_u:object_r:bin_t,s0)
Quoted 8 lines
     >
     >  /usr/libexec/devkit-daemon   --
      gen_context(system_u:object_r:devicekit_exec_t,s0)
     >  /usr/libexec/devkit-disks-daemon --
      gen_context(system_u:object_r:devicekit_disk_exec_t,s0)
     >

    This belongs in corecommands, if bin_t is appropriate.

/usr/lib/udisks for udev version 1 (such as udisks-1.0.4) helpers is not the standard location, as the standard location is /usr/libexec. So this is a customization, which should eventually be enclosed in one or more ifdef_distro blocks.

The standard location is the one produced by the raw execution of the configure script (i.e. without options passed) or otherwise (where autotools are not used) by an unedited Makefile (with the expection perhaps of default Makefiles that install in /usr/local).

When the standard location is used, the udev1 helpers are labelled as bin_t.

Finally, udev version 2 is no longer going to have the helpers.

And, all types should stick in their appropriate place, as otherwise they might sooner or later become unmanageable.

Quoted 5 lines

--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com <http://www.tresys.com> | oss.tresys.com
<http://oss.tresys.com>

Regards,

Guido

author
#11 lore raw

PATCH 6/9 Include policy for the iodine IP over DNS tunnel daemon

In reply to Laurent Bigonville

From: Russell Coker <[email protected]>

---
 contrib/iodine.fc |    1 +
 contrib/iodine.if |    1 +
 contrib/iodine.te |   26 ++++++++++++++++++++++++++
 3 files changed, 28 insertions(+)
 create mode 100644 contrib/iodine.fc
 create mode 100644 contrib/iodine.if
 create mode 100644 contrib/iodine.te
contrib/iodine.fc new file +1 -0
new file mode 100644
index 0000000..4e144ea
@@ -0,0 +1 @@
+/usr/sbin/iodine.*	-- gen_context(system_u:object_r:iodine_exec_t,s0)
contrib/iodine.if new file +1 -0
new file mode 100644
index 0000000..3eb6a30
@@ -0,0 +1 @@
+## <summary></summary>
contrib/iodine.te new file +26 -0
new file mode 100644
index 0000000..96a7de7
@@ -0,0 +1,26 @@
+policy_module(iodine,1.0.0)
+
+# policy for the iodine IP over DNS tunneling daemon
+type iodine_t;
+type iodine_exec_t;
+files_type(iodine_exec_t)
+init_daemon_domain(iodine_t, iodine_exec_t)
+
+logging_send_syslog_msg(iodine_t)
+kernel_search_network_sysctl(iodine_t)
+kernel_read_network_state(iodine_t)
+kernel_request_load_module(iodine_t)
+kernel_read_system_state(iodine_t)
+files_read_etc_files(iodine_t)
+corecmd_exec_shell(iodine_t)
+allow iodine_t self:capability { setgid setuid net_bind_service net_admin net_raw sys_chroot };
+sysnet_domtrans_ifconfig(iodine_t)
+
+allow iodine_t self:rawip_socket { write read create };
+allow iodine_t self:unix_dgram_socket { create connect };
+corenet_raw_receive_generic_node(iodine_t)
+corenet_rw_tun_tap_dev(iodine_t)
+corenet_udp_bind_dns_port(iodine_t)
+corenet_udp_bind_generic_node(iodine_t)
+allow iodine_t self:udp_socket connected_socket_perms;
+allow iodine_t self:tun_socket create;
Signature · 1 line
1.7.10.4
#12 lore raw

PATCH 6/9 Include policy for the iodine IP over DNS tunnel daemon

Just a quick review. comments in-line:

Quoted 31 lines · Laurent Bigonville

From: Russell Coker <[email protected]>

---
 contrib/iodine.fc |    1 +
 contrib/iodine.if |    1 +
 contrib/iodine.te |   26 ++++++++++++++++++++++++++
 3 files changed, 28 insertions(+)
 create mode 100644 contrib/iodine.fc
 create mode 100644 contrib/iodine.if
 create mode 100644 contrib/iodine.te
contrib/iodine.fc new file +1 -0
new file mode 100644
index 0000000..4e144ea
@@ -0,0 +1 @@
+/usr/sbin/iodine.*	-- gen_context(system_u:object_r:iodine_exec_t,s0)
contrib/iodine.if new file +1 -0
new file mode 100644
index 0000000..3eb6a30
@@ -0,0 +1 @@
+## <summary></summary>
contrib/iodine.te new file +0 -0
new file mode 100644
index 0000000..96a7de7

contrib/iodine.te line 3

Quoted 3 lines
contrib/iodine.te new file +3 -0
@@ -0,0 +1,26 @@
+policy_module(iodine,1.0.0)
+
+# policy for the iodine IP over DNS tunneling daemon

the above description should be in the iodine.if between the <summary></summary> tags

contrib/iodine.te line 6

Quoted 3 lines
contrib/iodine.te new file +3 -0
+type iodine_t;
+type iodine_exec_t;
+files_type(iodine_exec_t)

The above line is redundant. it is already included with the line below

contrib/iodine.te line 8

Quoted 2 lines
contrib/iodine.te new file +2 -0
+init_daemon_domain(iodine_t, iodine_exec_t)
+

The first rules should be the rules wher the target is self, starting with and rules where the object class is capability then process (if theres any)

Then use alfa-numeric sorting of "self" rules

below that go rules where the target types are local to the module if any.

Then the calls to external interface. starting with calls to kernel layer, kernel interfaces, again

then other kernel layer interfaces in alfa numeric order

then calls to external interfaces in other layers in the following order

so after kernel layer interface calls:

system layer

others

then ifdefs, tunable then optional policy in that order

see:
http://oss.tresys.com/projects/refpolicy/wiki/StyleGuide

You might think why all these style rules? well consistency make policy writing and maintaining much earier and intuitive. if done correctly things start to make sense and one can get far by just following intuition.

If you peruse the existing refpolicy and look for patterns youll see that everything has a place and reason. if you look long enough things start to make more sense.

Quoted 19 lines
contrib/iodine.te new file +18 -0
+logging_send_syslog_msg(iodine_t)
 
+kernel_search_network_sysctl(iodine_t)
+kernel_read_network_state(iodine_t)
+kernel_request_load_module(iodine_t)
+kernel_read_system_state(iodine_t)
+files_read_etc_files(iodine_t)
+corecmd_exec_shell(iodine_t)
+allow iodine_t self:capability { setgid setuid net_bind_service net_admin net_raw sys_chroot };
+sysnet_domtrans_ifconfig(iodine_t)
+
+allow iodine_t self:rawip_socket { write read create };
+allow iodine_t self:unix_dgram_socket { create connect };
+corenet_raw_receive_generic_node(iodine_t)
+corenet_rw_tun_tap_dev(iodine_t)
+corenet_udp_bind_dns_port(iodine_t)
+corenet_udp_bind_generic_node(iodine_t)
+allow iodine_t self:udp_socket connected_socket_perms;
+allow iodine_t self:tun_socket create;
#13 lore raw

PATCH 6/9 Include policy for the iodine IP over DNS tunnel daemon

oh and forgot one thing that caught my eye on short notice:

Quoted 88 lines · Dominick Grift

Just a quick review. comments in-line:

Quoted 31 lines · Laurent Bigonville

From: Russell Coker <[email protected]>

---
 contrib/iodine.fc |    1 +
 contrib/iodine.if |    1 +
 contrib/iodine.te |   26 ++++++++++++++++++++++++++
 3 files changed, 28 insertions(+)
 create mode 100644 contrib/iodine.fc
 create mode 100644 contrib/iodine.if
 create mode 100644 contrib/iodine.te
contrib/iodine.fc new file +1 -0
new file mode 100644
index 0000000..4e144ea
@@ -0,0 +1 @@
+/usr/sbin/iodine.*	-- gen_context(system_u:object_r:iodine_exec_t,s0)
contrib/iodine.if new file +1 -0
new file mode 100644
index 0000000..3eb6a30
@@ -0,0 +1 @@
+## <summary></summary>
contrib/iodine.te new file +0 -0
new file mode 100644
index 0000000..96a7de7

contrib/iodine.te line 3

Quoted 3 lines
contrib/iodine.te new file +3 -0
@@ -0,0 +1,26 @@
+policy_module(iodine,1.0.0)
+
+# policy for the iodine IP over DNS tunneling daemon

the above description should be in the iodine.if between the <summary></summary> tags

contrib/iodine.te line 6

Quoted 3 lines
contrib/iodine.te new file +3 -0
+type iodine_t;
+type iodine_exec_t;
+files_type(iodine_exec_t)

The above line is redundant. it is already included with the line below

contrib/iodine.te line 8

Quoted 2 lines
contrib/iodine.te new file +2 -0
+init_daemon_domain(iodine_t, iodine_exec_t)
+

The first rules should be the rules wher the target is self, starting with and rules where the object class is capability then process (if theres any)

Then use alfa-numeric sorting of "self" rules

below that go rules where the target types are local to the module if any.

Then the calls to external interface. starting with calls to kernel layer, kernel interfaces, again

then other kernel layer interfaces in alfa numeric order

then calls to external interfaces in other layers in the following order

so after kernel layer interface calls:

system layer

others

then ifdefs, tunable then optional policy in that order

see:
http://oss.tresys.com/projects/refpolicy/wiki/StyleGuide

You might think why all these style rules? well consistency make policy writing and maintaining much earier and intuitive. if done correctly things start to make sense and one can get far by just following intuition.

If you peruse the existing refpolicy and look for patterns youll see that everything has a place and reason. if you look long enough things start to make more sense.

Quoted 1 line
contrib/iodine.te new file +1 -0
+logging_send_syslog_msg(iodine_t)
Quoted 11 lines

contrib/iodine.te line 20

Quoted 11 lines
contrib/iodine.te new file +11 -0
+kernel_search_network_sysctl(iodine_t)
+kernel_read_network_state(iodine_t)
+kernel_request_load_module(iodine_t)
+kernel_read_system_state(iodine_t)
+files_read_etc_files(iodine_t)
+corecmd_exec_shell(iodine_t)
+allow iodine_t self:capability { setgid setuid net_bind_service net_admin net_raw sys_chroot };
+sysnet_domtrans_ifconfig(iodine_t)
+
+allow iodine_t self:rawip_socket { write read create };
+allow iodine_t self:unix_dgram_socket { create connect };

above line is redundant i believe. logging_send_syslog_msg() already provides this

Quoted 8 lines
Quoted 6 lines
contrib/iodine.te new file +6 -0
+corenet_raw_receive_generic_node(iodine_t)
+corenet_rw_tun_tap_dev(iodine_t)
+corenet_udp_bind_dns_port(iodine_t)
+corenet_udp_bind_generic_node(iodine_t)
+allow iodine_t self:udp_socket connected_socket_perms;
+allow iodine_t self:tun_socket create;
author
#14 lore raw

PATCH v2 6/9 Include policy for the iodine IP over DNS tunnel daemon

In reply to Laurent Bigonville

From: Russell Coker <[email protected]>

---
 iodine.fc |    1 +
 iodine.if |    1 +
 iodine.te |   29 +++++++++++++++++++++++++++++
 3 files changed, 31 insertions(+)
 create mode 100644 iodine.fc
 create mode 100644 iodine.if
 create mode 100644 iodine.te
iodine.fc new file +1 -0
new file mode 100644
index 0000000..71c964d
@@ -0,0 +1 @@
+/usr/sbin/iodine.*	-- gen_context(system_u:object_r:iodine_exec_t, s0)
iodine.if new file +1 -0
new file mode 100644
index 0000000..4bec253
@@ -0,0 +1 @@
+## <summary>policy for the iodine IP over DNS tunneling daemon</summary>
iodine.te new file +29 -0
new file mode 100644
index 0000000..c383ad4
@@ -0,0 +1,29 @@
+policy_module(iodine,1.0.0)
+
+type iodine_t;
+type iodine_exec_t;
+init_daemon_domain(iodine_t, iodine_exec_t)
+
+allow iodine_t self:capability { setgid setuid net_bind_service net_admin net_raw sys_chroot };
+allow iodine_t self:rawip_socket { write read create };
+allow iodine_t self:tun_socket create;
+allow iodine_t self:udp_socket connected_socket_perms;
+allow iodine_t self:unix_dgram_socket { create connect };
+
+kernel_read_network_state(iodine_t)
+kernel_read_system_state(iodine_t)
+kernel_request_load_module(iodine_t)
+kernel_search_network_sysctl(iodine_t)
+
+corenet_raw_receive_generic_node(iodine_t)
+corenet_rw_tun_tap_dev(iodine_t)
+corenet_udp_bind_dns_port(iodine_t)
+corenet_udp_bind_generic_node(iodine_t)
+
+corecmd_exec_shell(iodine_t)
+
+files_read_etc_files(iodine_t)
+
+logging_send_syslog_msg(iodine_t)
+
+sysnet_domtrans_ifconfig(iodine_t)
Signature · 1 line
1.7.10.4
#15 lore raw

PATCH v2 6/9 Include policy for the iodine IP over DNS tunnel daemon

Russell,

Some questions with regard to this policy module.

You labeled all of /usr/sbin/iodine.* type iodine_exec_t.

I have reviewed the debian init script for iodine package and it only runs iodined and not the other iodine binaries in /usr/sbin

How come? Am i looking at the wrong init script or am i missing something here?

Also that same init script mentions a pid file and its not created by the init script. Therefore i asume it gets created by iodined.

However the iodine policy module has no rules to allow iodine to create a pid file.

In Fedora we also have iodine. The package is split into a server and a client. Both server and client get started by init.

However, I suspect the client needs rules that are different from the rules that the server needs.

Should there not, in that case, be a client domain as well as a server domain?

I hope you can clarify the above

Quoted 60 lines · Laurent Bigonville

From: Russell Coker <[email protected]>

---
 iodine.fc |    1 +
 iodine.if |    1 +
 iodine.te |   29 +++++++++++++++++++++++++++++
 3 files changed, 31 insertions(+)
 create mode 100644 iodine.fc
 create mode 100644 iodine.if
 create mode 100644 iodine.te
iodine.fc new file +1 -0
new file mode 100644
index 0000000..71c964d
@@ -0,0 +1 @@
+/usr/sbin/iodine.*	-- gen_context(system_u:object_r:iodine_exec_t, s0)
iodine.if new file +1 -0
new file mode 100644
index 0000000..4bec253
@@ -0,0 +1 @@
+## <summary>policy for the iodine IP over DNS tunneling daemon</summary>
iodine.te new file +29 -0
new file mode 100644
index 0000000..c383ad4
@@ -0,0 +1,29 @@
+policy_module(iodine,1.0.0)
+
+type iodine_t;
+type iodine_exec_t;
+init_daemon_domain(iodine_t, iodine_exec_t)
+
+allow iodine_t self:capability { setgid setuid net_bind_service net_admin net_raw sys_chroot };
+allow iodine_t self:rawip_socket { write read create };
+allow iodine_t self:tun_socket create;
+allow iodine_t self:udp_socket connected_socket_perms;
+allow iodine_t self:unix_dgram_socket { create connect };
+
+kernel_read_network_state(iodine_t)
+kernel_read_system_state(iodine_t)
+kernel_request_load_module(iodine_t)
+kernel_search_network_sysctl(iodine_t)
+
+corenet_raw_receive_generic_node(iodine_t)
+corenet_rw_tun_tap_dev(iodine_t)
+corenet_udp_bind_dns_port(iodine_t)
+corenet_udp_bind_generic_node(iodine_t)
+
+corecmd_exec_shell(iodine_t)
+
+files_read_etc_files(iodine_t)
+
+logging_send_syslog_msg(iodine_t)
+
+sysnet_domtrans_ifconfig(iodine_t)
#16 lore raw

PATCH v2 6/9 Include policy for the iodine IP over DNS tunnel daemon

In reply to Laurent Bigonville
Quoted 50 lines · Laurent Bigonville

From: Russell Coker <[email protected]>

---
 iodine.fc |    1 +
 iodine.if |    1 +
 iodine.te |   29 +++++++++++++++++++++++++++++
 3 files changed, 31 insertions(+)
 create mode 100644 iodine.fc
 create mode 100644 iodine.if
 create mode 100644 iodine.te
iodine.fc new file +1 -0
new file mode 100644
index 0000000..71c964d
@@ -0,0 +1 @@
+/usr/sbin/iodine.*	-- gen_context(system_u:object_r:iodine_exec_t, s0)
iodine.if new file +1 -0
new file mode 100644
index 0000000..4bec253
@@ -0,0 +1 @@
+## <summary>policy for the iodine IP over DNS tunneling daemon</summary>
iodine.te new file +19 -0
new file mode 100644
index 0000000..c383ad4
@@ -0,0 +1,29 @@
+policy_module(iodine,1.0.0)
+
+type iodine_t;
+type iodine_exec_t;
+init_daemon_domain(iodine_t, iodine_exec_t)
+
+allow iodine_t self:capability { setgid setuid net_bind_service net_admin net_raw sys_chroot };
+allow iodine_t self:rawip_socket { write read create };
+allow iodine_t self:tun_socket create;
+allow iodine_t self:udp_socket connected_socket_perms;
+allow iodine_t self:unix_dgram_socket { create connect };
+
+kernel_read_network_state(iodine_t)
+kernel_read_system_state(iodine_t)
+kernel_request_load_module(iodine_t)
+kernel_search_network_sysctl(iodine_t)
+
+corenet_raw_receive_generic_node(iodine_t)
+corenet_rw_tun_tap_dev(iodine_t)

iodine.te line 29

Quoted 10 lines
iodine.te new file +10 -0
+corenet_udp_bind_dns_port(iodine_t)
+corenet_udp_bind_generic_node(iodine_t)
+
+corecmd_exec_shell(iodine_t)
+
+files_read_etc_files(iodine_t)
+
+logging_send_syslog_msg(iodine_t)
+
+sysnet_domtrans_ifconfig(iodine_t)

Merged with changes, thanks

author
#17 lore raw

PATCH 7/9 Added new "lda" module for email local delivery agents such as maildrop and procmail

In reply to Laurent Bigonville

From: Russell Coker <[email protected]>

---
 courier.if |   19 +++++++
 lda.fc     |    9 ++++
 lda.if     |   41 +++++++++++++++
 lda.te     |  162 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 postfix.te |    6 ++-
 5 files changed, 236 insertions(+), 1 deletion(-)
 create mode 100644 lda.fc
 create mode 100644 lda.if
 create mode 100644 lda.te
courier.if +19 -0
index 9971337..be99138 100644
@@ -106,6 +106,25 @@ interface(`courier_domtrans_authdaemon',`
 
 ########################################
 ## <summary>
+##	Act as a client for the courier authdaemon
+## </summary>
+## <param name="prefix">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`courier_authdaemon_client',`
+	gen_require(`
+		type courier_authdaemon_t, courier_etc_t, courier_var_run_t;
+	')
+	allow $1 courier_authdaemon_t:unix_stream_socket connectto;
+	allow $1 courier_etc_t:dir search;
+	allow $1 courier_var_run_t:sock_file write;
+')
+
+########################################
+## <summary>
 ##	Execute the courier POP3 and IMAP server with
 ##	a domain transition.
 ## </summary>
lda.fc new file +9 -0
new file mode 100644
index 0000000..f5745ae
@@ -0,0 +1,9 @@
+
+/usr/bin/procmail	--	gen_context(system_u:object_r:lda_exec_t,s0)
+/usr/bin/maildrop	--	gen_context(system_u:object_r:lda_exec_t,s0)
+/usr/sbin/deliverquota.maildrop	--	gen_context(system_u:object_r:lda_exec_t,s0)
+/usr/lib/dovecot/deliver --	gen_context(system_u:object_r:lda_exec_t,s0)
+/usr/bin/mailbot	--	gen_context(system_u:object_r:lda_exec_t,s0)
+
+/etc/courier/maildroprc	--	gen_context(system_u:object_r:lda_etc_t,s0)
+/var/log/maildrop.log	--	gen_context(system_u:object_r:lda_log_t,s0)
lda.if new file +41 -0

41 lines not on this page · raw message

lda.te new file +162 -0

162 lines not on this page · raw message

postfix.te +5 -1
index f358c69..221a5d1 100644
@@ -319,7 +319,7 @@ optional_policy(`
 ')
 
 optional_policy(`
-	procmail_domtrans(postfix_local_t)
+	lda_domtrans(postfix_local_t)
 ')
 
 ########################################

@@ -425,6 +425,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	lda_domtrans(postfix_pipe_t)
+')
+
+optional_policy(`
 	mailman_domtrans_queue(postfix_pipe_t)
 ')
Signature · 1 line
1.7.10.4
#18 lore raw

PATCH 7/9 Added new "lda" module for email local delivery agents such as maildrop and procmail

Quoted 1 line · Laurent Bigonville

From: Russell Coker <[email protected]>

I'm not adverse to something like this, but it would need some more work, since there already is a procmail policy. That policy would need to be removed and compatibility would have to be preserved.

Quoted 294 lines
---
 courier.if |   19 +++++++
 lda.fc     |    9 ++++
 lda.if     |   41 +++++++++++++++
 lda.te     |  162 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 postfix.te |    6 ++-
 5 files changed, 236 insertions(+), 1 deletion(-)
 create mode 100644 lda.fc
 create mode 100644 lda.if
 create mode 100644 lda.te
courier.if +19 -0
index 9971337..be99138 100644
@@ -106,6 +106,25 @@ interface(`courier_domtrans_authdaemon',`
 
 ########################################
 ## <summary>
+##	Act as a client for the courier authdaemon
+## </summary>
+## <param name="prefix">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`courier_authdaemon_client',`
+	gen_require(`
+		type courier_authdaemon_t, courier_etc_t, courier_var_run_t;
+	')
+	allow $1 courier_authdaemon_t:unix_stream_socket connectto;
+	allow $1 courier_etc_t:dir search;
+	allow $1 courier_var_run_t:sock_file write;
+')
+
+########################################
+## <summary>
 ##	Execute the courier POP3 and IMAP server with
 ##	a domain transition.
 ## </summary>
lda.fc new file +9 -0
new file mode 100644
index 0000000..f5745ae
@@ -0,0 +1,9 @@
+
+/usr/bin/procmail	--	gen_context(system_u:object_r:lda_exec_t,s0)
+/usr/bin/maildrop	--	gen_context(system_u:object_r:lda_exec_t,s0)
+/usr/sbin/deliverquota.maildrop	--	gen_context(system_u:object_r:lda_exec_t,s0)
+/usr/lib/dovecot/deliver --	gen_context(system_u:object_r:lda_exec_t,s0)
+/usr/bin/mailbot	--	gen_context(system_u:object_r:lda_exec_t,s0)
+
+/etc/courier/maildroprc	--	gen_context(system_u:object_r:lda_etc_t,s0)
+/var/log/maildrop.log	--	gen_context(system_u:object_r:lda_log_t,s0)
lda.if new file +41 -0
new file mode 100644
index 0000000..ec97dc8
@@ -0,0 +1,41 @@
+## <summary>mail delivery agent</summary>
+
+########################################
+## <summary>
+##	Execute lda with a domain transition.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`lda_domtrans',`
+	gen_require(`
+		type lda_exec_t, lda_t;
+	')
+
+	files_search_usr($1)
+	corecmd_search_bin($1)
+	domtrans_pattern($1,lda_exec_t,lda_t)
+')
+
+########################################
+## <summary>
+##	Execute lda in the caller domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`lda_exec',`
+	gen_require(`
+		type lda_exec_t;
+	')
+
+	files_search_usr($1)
+	corecmd_search_bin($1)
+	can_exec($1,lda_exec_t)
+')
lda.te new file +162 -0
new file mode 100644
index 0000000..d9bc95d
@@ -0,0 +1,162 @@
+
+policy_module(lda, 1.9.0)
+
+########################################
+#
+# Declarations
+#
+
+type lda_t;
+typealias lda_t alias procmail_t;
+type lda_exec_t;
+typealias lda_exec_t alias procmail_exec_t;
+application_domain(lda_t,lda_exec_t)
+role system_r types lda_t;
+
+type lda_tmp_t;
+typealias lda_tmp_t alias procmail_tmp_t;
+files_tmp_file(lda_tmp_t)
+
+type lda_etc_t;
+files_config_file(lda_etc_t)
+
+type lda_log_t;
+logging_log_file(lda_log_t)
+manage_files_pattern(lda_t,lda_log_t,lda_log_t)
+logging_log_filetrans(lda_t,lda_log_t,file)
+
+
+########################################
+#
+# Local policy
+#
+
+allow lda_t self:capability { sys_nice chown setuid setgid dac_override };
+allow lda_t self:process { setsched signal signull };
+allow lda_t self:fifo_file rw_fifo_file_perms;
+allow lda_t self:unix_stream_socket create_socket_perms;
+allow lda_t self:unix_dgram_socket create_socket_perms;
+allow lda_t self:tcp_socket create_stream_socket_perms;
+allow lda_t self:udp_socket create_socket_perms;
+read_files_pattern(lda_t,lda_etc_t,lda_etc_t)
+read_lnk_files_pattern(lda_t,lda_etc_t,lda_etc_t)
+
+can_exec(lda_t,lda_exec_t)
+
+allow lda_t lda_tmp_t:file manage_file_perms;
+files_tmp_filetrans(lda_t, lda_tmp_t, file)
+
+kernel_read_system_state(lda_t)
+kernel_read_kernel_sysctls(lda_t)
+
+corenet_all_recvfrom_unlabeled(lda_t)
+corenet_all_recvfrom_netlabel(lda_t)
+corenet_tcp_sendrecv_all_if(lda_t)
+corenet_udp_sendrecv_all_if(lda_t)
+corenet_tcp_sendrecv_all_nodes(lda_t)
+corenet_udp_sendrecv_all_nodes(lda_t)
+corenet_tcp_sendrecv_all_ports(lda_t)
+corenet_udp_sendrecv_all_ports(lda_t)
+corenet_udp_bind_all_nodes(lda_t)
+corenet_tcp_connect_spamd_port(lda_t)
+corenet_sendrecv_spamd_client_packets(lda_t)
+corenet_sendrecv_comsat_client_packets(lda_t)
+
+dev_read_urand(lda_t)
+
+fs_getattr_xattr_fs(lda_t)
+fs_search_auto_mountpoints(lda_t)
+fs_rw_anon_inodefs_files(lda_t)
+
+auth_use_nsswitch(lda_t)
+
+corecmd_exec_bin(lda_t)
+corecmd_exec_shell(lda_t)
+
+files_read_etc_files(lda_t)
+files_read_etc_runtime_files(lda_t)
+files_search_pids(lda_t)
+# for spamassasin
+files_read_usr_files(lda_t)
+
+libs_use_ld_so(lda_t)
+libs_use_shared_libs(lda_t)
+
+logging_send_syslog_msg(lda_t)
+
+miscfiles_read_localization(lda_t)
+
+# only works until we define a different type for maildir
+userdom_manage_user_home_content_dirs(lda_t)
+userdom_manage_user_home_content_files(lda_t)
+userdom_user_home_dir_filetrans_user_home_content(lda_t, { dir file })
+
+optional_policy(`
+	gen_require(`
+		bool daemon_access_unconfined_home;
+	')
+#	tunable_policy(`daemon_access_unconfined_home', `
+#		unconfined_write_home_content_files(lda_t)
+#	')
+')
+
+mta_manage_spool(lda_t)
+
+ifdef(`hide_broken_symptoms',`
+	mta_dontaudit_rw_queue(lda_t)
+')
+
+tunable_policy(`use_nfs_home_dirs',`
+	fs_manage_nfs_dirs(lda_t)
+	fs_manage_nfs_files(lda_t)
+	fs_manage_nfs_symlinks(lda_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+	fs_manage_cifs_dirs(lda_t)
+	fs_manage_cifs_files(lda_t)
+	fs_manage_cifs_symlinks(lda_t)
+')
+
+optional_policy(`
+	clamav_domtrans_clamscan(lda_t)
+	clamav_search_lib(lda_t)
+')
+
+optional_policy(`
+	courier_authdaemon_client(lda_t)
+')
+
+optional_policy(`
+	munin_dontaudit_search_lib(lda_t)
+')
+
+optional_policy(`
+	# for a bug in the postfix local program
+	postfix_dontaudit_rw_local_tcp_sockets(lda_t)
+	postfix_dontaudit_use_fds(lda_t)
+	postfix_read_spool_files(lda_t)
+	postfix_read_local_state(lda_t)
+	postfix_read_master_state(lda_t)
+')
+
+optional_policy(`
+	pyzor_domtrans(lda_t)
+')
+
+optional_policy(`
+	mta_read_config(lda_t)
+	sendmail_domtrans(lda_t)
+	sendmail_rw_tcp_sockets(lda_t)
+	sendmail_rw_unix_stream_sockets(lda_t)
+')
+
+optional_policy(`
+	corenet_udp_bind_generic_port(lda_t)
+	corenet_dontaudit_udp_bind_all_ports(lda_t)
+
+	spamassassin_exec(lda_t)
+	spamassassin_exec_client(lda_t)
+	spamassassin_read_lib_files(lda_t)
+')
+
postfix.te +5 -1
index f358c69..221a5d1 100644
@@ -319,7 +319,7 @@ optional_policy(`
 ')
 
 optional_policy(`
-	procmail_domtrans(postfix_local_t)
+	lda_domtrans(postfix_local_t)
 ')
 
 ########################################

@@ -425,6 +425,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	lda_domtrans(postfix_pipe_t)
+')
+
+optional_policy(`
 	mailman_domtrans_queue(postfix_pipe_t)
 ')
Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
author
#19 lore raw

PATCH 8/9 Fix djbdns ports

In reply to Laurent Bigonville

From: Russell Coker <[email protected]>

---
 djbdns.if |    2 ++
 1 file changed, 2 insertions(+)
djbdns.if +2 -0
index ade3079..d53902d 100644
@@ -45,7 +45,9 @@ template(`djbdns_daemontools_domain_template',`
 	corenet_tcp_bind_generic_node(djbdns_$1_t)
 	corenet_udp_bind_generic_node(djbdns_$1_t)
 	corenet_tcp_bind_dns_port(djbdns_$1_t)
+	corenet_tcp_connect_dns_port(djbdns_$1_t)
 	corenet_udp_bind_dns_port(djbdns_$1_t)
+	corenet_tcp_bind_generic_port(djbdns_$1_t)
 	corenet_udp_bind_generic_port(djbdns_$1_t)
 	corenet_sendrecv_dns_server_packets(djbdns_$1_t)
 	corenet_sendrecv_generic_server_packets(djbdns_$1_t)
Signature · 1 line
1.7.10.4
#20 lore raw

PATCH 8/9 Fix djbdns ports

Quoted 11 lines · Laurent Bigonville

From: Russell Coker <[email protected]>

---
 djbdns.if |    2 ++
 1 file changed, 2 insertions(+)
djbdns.if +0 -0
index ade3079..d53902d 100644

djbdns.if template(`djbdns_daemontools_domain_template',` · line 53

Quoted 9 lines
djbdns.if +2 -0
@@ -45,7 +45,9 @@ template(`djbdns_daemontools_domain_template',`
 	corenet_tcp_bind_generic_node(djbdns_$1_t)
 	corenet_udp_bind_generic_node(djbdns_$1_t)
 	corenet_tcp_bind_dns_port(djbdns_$1_t)
+	corenet_tcp_connect_dns_port(djbdns_$1_t)
 	corenet_udp_bind_dns_port(djbdns_$1_t)
+	corenet_tcp_bind_generic_port(djbdns_$1_t)
 	corenet_udp_bind_generic_port(djbdns_$1_t)
 	corenet_sendrecv_dns_server_packets(djbdns_$1_t)
 	corenet_sendrecv_generic_server_packets(djbdns_$1_t)

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
author
#21 lore raw

PATCH 9/9 Add dirmngr support

In reply to Laurent Bigonville

From: Russell Coker <[email protected]>

---
 dirmngr.fc |    9 +++++++++
 dirmngr.if |    1 +
 dirmngr.te |   57 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 67 insertions(+)
 create mode 100644 dirmngr.fc
 create mode 100644 dirmngr.if
 create mode 100644 dirmngr.te
dirmngr.fc new file +9 -0
new file mode 100644
index 0000000..f4a88e0
@@ -0,0 +1,9 @@
+/etc/dirmngr(/.*)?		gen_context(system_u:object_r:dirmngr_conf_t,s0)
+
+/usr/bin/dirmngr		--	gen_context(system_u:object_r:dirmngr_exec_t,s0)
+
+# labelling for PID file that is created by init script
+/var/run/dirmngr\.pid	--	gen_context(system_u:object_r:initrc_var_run_t,s0)
+/var/run/dirmngr(/.*)?		gen_context(system_u:object_r:dirmngr_var_run_t,s0)
+/var/log/dirmngr(/.*)?		gen_context(system_u:object_r:dirmngr_log_t,s0)
+/var/lib/dirmngr(/.*)?		gen_context(system_u:object_r:dirmngr_data_t,s0)
dirmngr.if new file +1 -0
new file mode 100644
index 0000000..3eb6a30
@@ -0,0 +1 @@
+## <summary></summary>
dirmngr.te new file +57 -0

57 lines not on this page · raw message

Signature · 1 line
1.7.10.4
#22 lore raw

PATCH 9/9 Add dirmngr support

Quoted 17 lines · Laurent Bigonville

From: Russell Coker <[email protected]>

---
 dirmngr.fc |    9 +++++++++
 dirmngr.if |    1 +
 dirmngr.te |   57 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 67 insertions(+)
 create mode 100644 dirmngr.fc
 create mode 100644 dirmngr.if
 create mode 100644 dirmngr.te
dirmngr.fc new file +0 -0
new file mode 100644
index 0000000..f4a88e0

dirmngr.fc line 6

Quoted 6 lines
dirmngr.fc new file +6 -0
@@ -0,0 +1,9 @@
+/etc/dirmngr(/.*)?		gen_context(system_u:object_r:dirmngr_conf_t,s0)
+
+/usr/bin/dirmngr		--	gen_context(system_u:object_r:dirmngr_exec_t,s0)
+
+# labelling for PID file that is created by init script
+/var/run/dirmngr\.pid	--	gen_context(system_u:object_r:initrc_var_run_t,s0)

Doesn't belong in this module.

dirmngr.if line 1

Quoted 10 lines
dirmngr.fc new file +3 -0
+/var/run/dirmngr(/.*)?		gen_context(system_u:object_r:dirmngr_var_run_t,s0)
+/var/log/dirmngr(/.*)?		gen_context(system_u:object_r:dirmngr_log_t,s0)
+/var/lib/dirmngr(/.*)?		gen_context(system_u:object_r:dirmngr_data_t,s0)
dirmngr.if new file +1 -0
new file mode 100644
index 0000000..3eb6a30
@@ -0,0 +1 @@
+## <summary></summary>

Need a real summary.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
#23 lore raw

PATCH 9/9 Add dirmngr support

In reply to Laurent Bigonville
Quoted 86 lines · Laurent Bigonville

From: Russell Coker <[email protected]>

---
 dirmngr.fc |    9 +++++++++
 dirmngr.if |    1 +
 dirmngr.te |   57 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 67 insertions(+)
 create mode 100644 dirmngr.fc
 create mode 100644 dirmngr.if
 create mode 100644 dirmngr.te
dirmngr.fc new file +9 -0
new file mode 100644
index 0000000..f4a88e0
@@ -0,0 +1,9 @@
+/etc/dirmngr(/.*)?		gen_context(system_u:object_r:dirmngr_conf_t,s0)
+
+/usr/bin/dirmngr		--	gen_context(system_u:object_r:dirmngr_exec_t,s0)
+
+# labelling for PID file that is created by init script
+/var/run/dirmngr\.pid	--	gen_context(system_u:object_r:initrc_var_run_t,s0)
+/var/run/dirmngr(/.*)?		gen_context(system_u:object_r:dirmngr_var_run_t,s0)
+/var/log/dirmngr(/.*)?		gen_context(system_u:object_r:dirmngr_log_t,s0)
+/var/lib/dirmngr(/.*)?		gen_context(system_u:object_r:dirmngr_data_t,s0)
dirmngr.if new file +1 -0
new file mode 100644
index 0000000..3eb6a30
@@ -0,0 +1 @@
+## <summary></summary>
dirmngr.te new file +47 -0
new file mode 100644
index 0000000..f7f7df3
@@ -0,0 +1,57 @@
+policy_module(dirmngr, 1.10.0)
+
+########################################
+#
+# Declarations
+#
+
+type dirmngr_t;
+type dirmngr_exec_t;
+init_daemon_domain(dirmngr_t, dirmngr_exec_t)
+
+# type for /var/cache/dirmngr
+type dirmngr_data_t;
+files_type(dirmngr_data_t)
+
+type dirmngr_conf_t;
+files_type(dirmngr_conf_t)
+
+type dirmngr_initrc_exec_t;
+init_script_file(dirmngr_initrc_exec_t)
+
+type dirmngr_log_t;
+logging_log_file(dirmngr_log_t)
+
+type dirmngr_var_run_t;
+files_pid_file(dirmngr_var_run_t)
+
+########################################
+#
+# Local policy
+#
+
+allow dirmngr_t dirmngr_var_run_t:sock_file manage_file_perms;
+allow dirmngr_t self:fifo_file rw_file_perms;
+files_list_var_lib(dirmngr_t)
+files_read_etc_files(dirmngr_t)
+files_read_var_files(dirmngr_t)
+kernel_read_crypto_sysctls(dirmngr_t)
+logging_read_generic_logs(dirmngr_t)
+miscfiles_read_localization(dirmngr_t)
+
+
+# Grant permissions to create, access, and delete cache files.
+manage_dirs_pattern(dirmngr_t, dirmngr_data_t, dirmngr_data_t)
+manage_files_pattern(dirmngr_t, dirmngr_data_t, dirmngr_data_t)
+manage_lnk_files_pattern(dirmngr_t, dirmngr_data_t, dirmngr_data_t)
+

dirmngr.te line 57

Quoted 10 lines
dirmngr.te new file +10 -0
+allow dirmngr_t dirmngr_conf_t:dir list_dir_perms;
+read_files_pattern(dirmngr_t, dirmngr_conf_t, dirmngr_conf_t)
+read_lnk_files_pattern(dirmngr_t, dirmngr_conf_t, dirmngr_conf_t)
+
+manage_dirs_pattern(dirmngr_t, dirmngr_log_t, dirmngr_log_t)
+manage_files_pattern(dirmngr_t, dirmngr_log_t, dirmngr_log_t)
+logging_log_filetrans(dirmngr_t, dirmngr_log_t, { file dir })
+
+manage_files_pattern(dirmngr_t, dirmngr_var_run_t, dirmngr_var_run_t)
+files_pid_filetrans(dirmngr_t, dirmngr_var_run_t, { file sock_file })

Merged with changes, thanks

#24 lore raw

PATCH 1/9 Mark use of deprecated interfaces that are not providing replacement as errors

In reply to Laurent Bigonville
Quoted 17 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

---
 bind.if        |    2 +-
 bluetooth.if   |    4 ++--
 cups.if        |    2 +-
 dictd.if       |    2 +-
 finger.if      |    2 +-
 ftp.if         |    2 +-
 i18n_input.if  |    2 +-
 inetd.if       |    4 ++--
 jabber.if      |    2 +-
 ldap.if        |    2 +-
 mta.if         |    2 +-
 nessus.if      |    2 +-
 nis.if         |    4 ++--
 nsd.if         |    4 ++--
Quoted 8 lines
 perdition.if   |    2 +-
 portmap.if     |    6 +++---
 radius.if      |    2 +-
 rpc.if         |    4 ++--
 snmp.if        |    4 ++--
 soundserver.if |    2 +-
 squid.if       |    2 +-
 21 files changed, 29 insertions(+), 29 deletions(-)

I can see why you'd want to do this as a distribution, but for upstream, I'd prefer to keep it a warning. I'd be open to a patch that created a build option that would turn warnings into errors, like -Werror for gcc.

Quoted 334 lines
bind.if +1 -1
index 44a1e3d..b5e0ea5 100644
@@ -336,7 +336,7 @@ interface(`bind_manage_zone',`
 ## </param>
 #
 interface(`bind_udp_chat_named',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
bluetooth.if +2 -2
index 3e45431..f232b3b 100644
@@ -126,7 +126,7 @@ interface(`bluetooth_dbus_chat',`
 ## </param>
 #
 interface(`bluetooth_domtrans_helper',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################

@@ -152,7 +152,7 @@ interface(`bluetooth_domtrans_helper',`
 ## <rolecap/>
 #
 interface(`bluetooth_run_helper',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
cups.if +1 -1
index 305ddf4..56cb53f 100644
@@ -75,7 +75,7 @@ interface(`cups_stream_connect',`
 ## </param>
 #
 interface(`cups_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
dictd.if +1 -1
index a0d23ce..7650335 100644
@@ -12,7 +12,7 @@
 ## </param>
 #
 interface(`dictd_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
finger.if +1 -1
index b5dd671..9bbb169 100644
@@ -29,5 +29,5 @@ interface(`finger_domtrans',`
 ## </param>
 #
 interface(`finger_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
ftp.if +1 -1
index 9d3201b..3d29482 100644
@@ -29,7 +29,7 @@ interface(`ftp_dyntrans_anon_sftpd',`
 ## </param>
 #
 interface(`ftp_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
i18n_input.if +1 -1
index bc7de4f..bd85f3b 100644
@@ -11,5 +11,5 @@
 ## </param>
 #
 interface(`i18n_use',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
inetd.if +2 -2
index df48e5e..75a7539 100644
@@ -150,7 +150,7 @@ interface(`inetd_use_fds',`
 ## </param>
 #
 interface(`inetd_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################

@@ -183,7 +183,7 @@ interface(`inetd_domtrans_child',`
 ## </param>
 #
 interface(`inetd_udp_send',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
jabber.if +1 -1
index 9878499..00f78ed 100644
@@ -11,7 +11,7 @@
 ## </param>
 #
 interface(`jabber_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
ldap.if +1 -1
index d6b7b2d..5585d7d 100644
@@ -50,7 +50,7 @@ interface(`ldap_read_config',`
 ## </param>
 #
 interface(`ldap_use',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
mta.if +1 -1
index 4e2a5ba..f5b7fcd 100644
@@ -587,7 +587,7 @@ interface(`mta_dontaudit_rw_delivery_tcp_sockets',`
 ## </param>
 #
 interface(`mta_tcp_connect_all_mailservers',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 #######################################
nessus.if +1 -1
index 6ec8003..edc4d91 100644
@@ -11,5 +11,5 @@
 ## </param>
 #
 interface(`nessus_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
nis.if +2 -2
index abe3f7f..1430352 100644
@@ -205,7 +205,7 @@ interface(`nis_list_var_yp',`
 ## </param>
 #
 interface(`nis_udp_send_ypbind',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################

@@ -219,7 +219,7 @@ interface(`nis_udp_send_ypbind',`
 ## </param>
 #
 interface(`nis_tcp_connect_ypbind',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
nsd.if +2 -2
index a1371d5..5142540 100644
@@ -11,7 +11,7 @@
 ## </param>
 #
 interface(`nsd_udp_chat',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################

@@ -25,5 +25,5 @@ interface(`nsd_udp_chat',`
 ## </param>
 #
 interface(`nsd_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
perdition.if +1 -1
index 2b0bd64..8919276 100644
@@ -11,5 +11,5 @@
 ## </param>
 #
 interface(`perdition_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
portmap.if +3 -3
index 374afcf..f0484c3 100644
@@ -57,7 +57,7 @@ interface(`portmap_run_helper',`
 ## </param>
 #
 interface(`portmap_udp_send',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################

@@ -71,7 +71,7 @@ interface(`portmap_udp_send',`
 ## </param>
 #
 interface(`portmap_udp_chat',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################

@@ -85,5 +85,5 @@ interface(`portmap_udp_chat',`
 ## </param>
 #
 interface(`portmap_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
radius.if +1 -1
index 75e5dc4..9b35194 100644
@@ -11,7 +11,7 @@
 ## </param>
 #
 interface(`radius_use',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
rpc.if +2 -2
index dddabcf..a8a31b7 100644
@@ -133,7 +133,7 @@ template(`rpc_domain_template', `
 ## </param>
 #
 interface(`rpc_udp_send',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################

@@ -374,7 +374,7 @@ interface(`rpc_udp_rw_nfs_sockets',`
 ## </param>
 #
 interface(`rpc_udp_send_nfs',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
snmp.if +2 -2
index 275f9fb..f143171 100644
@@ -30,7 +30,7 @@ interface(`snmp_stream_connect',`
 ## </param>
 #
 interface(`snmp_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################

@@ -44,7 +44,7 @@ interface(`snmp_tcp_connect',`
 ## </param>
 #
 interface(`snmp_udp_chat',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
soundserver.if +1 -1
index 93fe7bf..d27ebc5 100644
@@ -11,7 +11,7 @@
 ## </param>
 #
 interface(`soundserver_tcp_connect',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
squid.if +1 -1
index d2496bd..de25872 100644
@@ -184,7 +184,7 @@ interface(`squid_manage_logs',`
 ## </param>
 #
 interface(`squid_use',`
-	refpolicywarn(`$0($*) has been deprecated.')
+	refpolicyerr(`$0($*) has been deprecated.')
 ')
 
 ########################################
Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com