: patch set to update the git reference policy

PATCH New Guido Trentalancia 3 participants 4 messages Jan 24, 2011

lore

Share & tools

lore

Guido Trentalancia

author

2011-01-24 00:43 UTC #0 lore raw

PATCH 1/19 : patch set to update the git reference policy

policy/modules/services/dbus.fc +13 -0

diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf refpolicy-git-18012011/policy/modules/services/dbus.fc refpolicy-git-18012011-update/policy/modules/services/dbus.fc
@@ -1,11 +1,24 @@
 /etc/dbus-1(/.*)?		gen_context(system_u:object_r:dbusd_etc_t,s0)
 
 /bin/dbus-daemon 	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-cleanup-sockets	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-launch	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-monitor	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-send		--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-uuidgen	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-binding-tool	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
 
 /lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
 /lib64/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
 
 /usr/bin/dbus-daemon(-1)? --	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-cleanup-sockets	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-launch	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-monitor	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-send	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-uuidgen	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-binding-tool	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+
 /usr/libexec/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
 
 /var/lib/dbus(/.*)?		gen_context(system_u:object_r:system_dbusd_var_lib_t,s0)

policy/modules/system/init.fc +2 -0

diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf refpolicy-git-18012011/policy/modules/system/init.fc refpolicy-git-18012011-update/policy/modules/system/init.fc
@@ -34,6 +34,8 @@ ifdef(`distro_gentoo', `
 # /sbin
 #
 /sbin/init(ng)?		--	gen_context(system_u:object_r:init_exec_t,s0)
+# because nowadays, /sbin/init is often a symlink to /sbin/upstart
+/sbin/upstart		--	gen_context(system_u:object_r:init_exec_t,s0)
 
 ifdef(`distro_gentoo', `
 /sbin/rc		--	gen_context(system_u:object_r:initrc_exec_t,s0)

Dominick Grift

2011-01-24 14:26 UTC #1 lore raw

PATCH 1/19 : patch set to update the git reference policy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 15 lines · Guido Trentalancia

diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf refpolicy-git-18012011/policy/modules/services/dbus.fc refpolicy-git-18012011-update/policy/modules/services/dbus.fc

policy/modules/services/dbus.fc +6 -0

@@ -1,11 +1,24 @@
 /etc/dbus-1(/.*)?		gen_context(system_u:object_r:dbusd_etc_t,s0)
 
 /bin/dbus-daemon 	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-cleanup-sockets	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-launch	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-monitor	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-send		--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-uuidgen	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-binding-tool	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
 
 /lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)

policy/modules/services/dbus.fc line 21

Quoted 10 lines

policy/modules/services/dbus.fc +7 -0

 /lib64/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
 
 /usr/bin/dbus-daemon(-1)? --	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-cleanup-sockets	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-launch	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-monitor	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-send	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-uuidgen	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-binding-tool	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+

I am not sure if labelling all these dbus_exec_t is a good idea or even beneficial in any way

Quoted 17 lines

policy/modules/services/dbus.fc +0 -0
 /usr/libexec/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
 
 /var/lib/dbus(/.*)?		gen_context(system_u:object_r:system_dbusd_var_lib_t,s0)
diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf refpolicy-git-18012011/policy/modules/system/init.fc refpolicy-git-18012011-update/policy/modules/system/init.fc
policy/modules/system/init.fc +2 -0
@@ -34,6 +34,8 @@ ifdef(`distro_gentoo', `
 # /sbin
 #
 /sbin/init(ng)?		--	gen_context(system_u:object_r:init_exec_t,s0)
+# because nowadays, /sbin/init is often a symlink to /sbin/upstart
+/sbin/upstart		--	gen_context(system_u:object_r:init_exec_t,s0)
 
 ifdef(`distro_gentoo', `
 /sbin/rc		--	gen_context(system_u:object_r:initrc_exec_t,s0)

Quoted 4 lines

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk09i/oACgkQMlxVo39jgT/NzgCfV//vFrkoXxFfZLjxaNhQonBq jP0AoJ4hVYn7UUXi/uRsKFWVIAkIGomU
=EkxZ
-----END PGP SIGNATURE-----

Daniel J Walsh

2011-01-24 14:50 UTC #2 lore raw

PATCH 1/19 : patch set to update the git reference policy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 18 lines · Dominick Grift

Quoted 16 lines · Guido Trentalancia

diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf refpolicy-git-18012011/policy/modules/services/dbus.fc refpolicy-git-18012011-update/policy/modules/services/dbus.fc

policy/modules/services/dbus.fc +6 -0

@@ -1,11 +1,24 @@
 /etc/dbus-1(/.*)?		gen_context(system_u:object_r:dbusd_etc_t,s0)
 
 /bin/dbus-daemon 	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-cleanup-sockets	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-launch	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-monitor	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-send		--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-uuidgen	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-binding-tool	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
 
 /lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
 /lib64/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)

Quoted 12 lines

policy/modules/services/dbus.fc line 21

Quoted 8 lines

policy/modules/services/dbus.fc +7 -0

 /usr/bin/dbus-daemon(-1)? --	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-cleanup-sockets	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-launch	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-monitor	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-send	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-uuidgen	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-binding-tool	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+

I am not sure if labelling all these dbus_exec_t is a good idea or even beneficial in any way

Definitely not.

Quoted 13 lines

Quoted 12 lines
policy/modules/services/dbus.fc +0 -0
 /usr/libexec/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
 
 /var/lib/dbus(/.*)?		gen_context(system_u:object_r:system_dbusd_var_lib_t,s0)
diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf refpolicy-git-18012011/policy/modules/system/init.fc refpolicy-git-18012011-update/policy/modules/system/init.fc
policy/modules/system/init.fc +2 -0
@@ -34,6 +34,8 @@ ifdef(`distro_gentoo', `
 # /sbin
 #
 /sbin/init(ng)?		--	gen_context(system_u:object_r:init_exec_t,s0)
+# because nowadays, /sbin/init is often a symlink to /sbin/upstart
+/sbin/upstart		--	gen_context(system_u:object_r:init_exec_t,s0)

Quoted 9 lines

Quoted 8 lines
policy/modules/system/init.fc +0 -0
 ifdef(`distro_gentoo', `
 /sbin/rc		--	gen_context(system_u:object_r:initrc_exec_t,s0)
 
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk09kZYACgkQrlYvE4MpobNd1ACfWcH/QOjVkM2+puln2AJvaTye 07sAoNoOoWE6SK5ODGX1DwrMa5ibAxKi
=6QNt
-----END PGP SIGNATURE-----

Guido Trentalancia

author

2011-01-24 15:05 UTC #3 lore raw

PATCH 1/19 : patch set to update the git reference policy

In reply to Dominick Grift

Quoted 18 lines · Dominick Grift

Quoted 17 lines · Guido Trentalancia

diff -pruN -x .git -x corenetwork.if -x corenetwork.te -x booleans.conf refpolicy-git-18012011/policy/modules/services/dbus.fc refpolicy-git-18012011-update/policy/modules/services/dbus.fc

policy/modules/services/dbus.fc +6 -0

@@ -1,11 +1,24 @@
 /etc/dbus-1(/.*)?		gen_context(system_u:object_r:dbusd_etc_t,s0)
 
 /bin/dbus-daemon 	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-cleanup-sockets	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-launch	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-monitor	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-send		--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-uuidgen	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/bin/dbus-binding-tool	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
 
 /lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
 /lib64/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)

Quoted 11 lines

policy/modules/services/dbus.fc line 21

Quoted 8 lines

policy/modules/services/dbus.fc +7 -0

 /usr/bin/dbus-daemon(-1)? --	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-cleanup-sockets	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-launch	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-monitor	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-send	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-uuidgen	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+/usr/bin/dbus-binding-tool	--	gen_context(system_u:object_r:dbusd_exec_t,s0)
+

I am not sure if labelling all these dbus_exec_t is a good idea or even beneficial in any way

Yes, you are right. Only {/bin,/usr/bin}/dbus-daemon should be labelled that way.

Will change it.

Regards,

Guido