Various small updates on contrib modules
cover Various small updates on contrib modules
This patchset contains a list of smaller updates to various contrib modules
Sven Vermeulen (6):
Mark glsa-check as portage_exec_t
Allow gcc-config to work on NFS-mounted portage tree Reshuffle tunable/optional
Do not mark java configuration tools as java entry points Allow portage fetch domain to show download progress Further enhance portage git support
java.fc | 2 +- portage.fc | 2 ++ portage.if | 1 + portage.te | 6 ++++++ telnet.te | 10 +++++----- 5 files changed, 15 insertions(+), 6 deletions(-)
Signature · 1 line
1.7.8.6
PATCH 1/6 Mark glsa-check as portage_exec_t
The glsa-check application is Gentoo's application for reporting on security-vulnerable installed packages. It reads its input from the portage tree and allows users to update just the affected packages.
For this it needs to run in the portage_t domain.
--- portage.fc | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
portage.fc +1 -0
@@ -4,6 +4,7 @@ /etc/portage/gpg(/.*)? gen_context(system_u:object_r:portage_gpg_t,s0) /usr/bin/gcc-config -- gen_context(system_u:object_r:gcc_config_exec_t,s0) +/usr/bin/glsa-check -- gen_context(system_u:object_r:portage_exec_t,s0) /usr/bin/layman -- gen_context(system_u:object_r:portage_fetch_exec_t,s0) /usr/bin/sandbox -- gen_context(system_u:object_r:portage_exec_t,s0)
Signature · 1 line
1.7.8.6
PATCH 2/6 Allow gcc-config to work on NFS-mounted portage tree
In reply to Sven VermeulenWhen the portage tree is mounted on an NFS mount, we already introduced the portage_use_nfs tunable to allow the portage domains to handle NFS-labeled files.
One other domain that also needs this is the gcc_config_t domain, responsible for listing and updating a systems' gcc. The requirement stems from gcc-config using portageq to query for information, which requires a readable portage tree.
--- portage.te | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)
portage.te +4 -0
@@ -132,6 +132,10 @@ ifdef(`distro_gentoo',` init_exec_rc(gcc_config_t) ') +tunable_policy(`portage_use_nfs',` + fs_read_nfs_files(gcc_config_t) +') + optional_policy(` seutil_use_newrole_fds(gcc_config_t) ')
Signature · 1 line
1.7.8.6
PATCH 3/6 Reshuffle tunable/optional
In reply to Sven VermeulenAs per the Reference Policy Style Guide, tunable_policy blocks need to go before the optional_policy blocks.
--- telnet.te | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-)
telnet.te +5 -5
@@ -86,11 +86,6 @@ remotelogin_domtrans(telnetd_t) userdom_search_user_home_dirs(telnetd_t) userdom_setattr_user_ptys(telnetd_t) -optional_policy(` - kerberos_keytab_template(telnetd, telnetd_t) - kerberos_manage_host_rcache(telnetd_t) -') - tunable_policy(`use_nfs_home_dirs',` fs_search_nfs(telnetd_t) ')
@@ -98,3 +93,8 @@ tunable_policy(`use_nfs_home_dirs',` tunable_policy(`use_samba_home_dirs',` fs_search_cifs(telnetd_t) ') + +optional_policy(` + kerberos_keytab_template(telnetd, telnetd_t) + kerberos_manage_host_rcache(telnetd_t) +')
Signature · 1 line
1.7.8.6
PATCH 4/6 Do not mark java configuration tools as java entry points
In reply to Sven VermeulenSome java-supporting tools, like java-config and java-check-environment, are not to be used as entry points for the java_t domain. Instead, these should run with the privileges of the calling domain (and as such should remain bin_t).
The expression itself (java[^-]*) is to still support commonly found java version binaries (java1.4, java5, java6).
--- java.fc | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
java.fc +1 -1
@@ -9,7 +9,7 @@ # # /usr # -/usr/(.*/)?bin/java.* -- gen_context(system_u:object_r:java_exec_t,s0) +/usr/(.*/)?bin/java[^-]* -- gen_context(system_u:object_r:java_exec_t,s0) /usr/bin/fastjar -- gen_context(system_u:object_r:java_exec_t,s0) /usr/bin/frysk -- gen_context(system_u:object_r:java_exec_t,s0) /usr/bin/gappletviewer -- gen_context(system_u:object_r:java_exec_t,s0)
Signature · 1 line
1.7.8.6
PATCH 5/6 Allow portage fetch domain to show download progress
In reply to Sven VermeulenWhen downloading software packages, the portage application is inside the portage_fetch_t domain. At that point, Portage wants to show the fetch progress of the software on the users' screen. For this, it needs proper access to portage_devpts_t.
--- portage.te | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-)
portage.te +2 -0
@@ -248,6 +248,8 @@ allow portage_fetch_t self:unix_stream_socket create_socket_perms; allow portage_fetch_t portage_conf_t:dir list_dir_perms; +allow portage_fetch_t portage_devpts_t:chr_file { rw_chr_file_perms setattr }; + allow portage_fetch_t portage_gpg_t:dir rw_dir_perms; allow portage_fetch_t portage_gpg_t:file manage_file_perms;
Signature · 1 line
1.7.8.6
PATCH 6/6 Further enhance portage git support
In reply to Sven VermeulenThe git sources for ebuilds that use the git-2 eclass are stored in egit-src.
In this patch, we also allow connections towards git services.
--- portage.fc | 1 + portage.if | 1 + 2 files changed, 2 insertions(+), 0 deletions(-)
portage.fc +1 -0
@@ -18,6 +18,7 @@ /usr/portage(/.*)? gen_context(system_u:object_r:portage_ebuild_t,s0) /usr/portage/distfiles/cvs-src(/.*)? gen_context(system_u:object_r:portage_srcrepo_t,s0) +/usr/portage/distfiles/egit-src(/.*)? gen_context(system_u:object_r:portage_srcrepo_t,s0) /usr/portage/distfiles/git-src(/.*)? gen_context(system_u:object_r:portage_srcrepo_t,s0) /usr/portage/distfiles/svn-src(/.*)? gen_context(system_u:object_r:portage_srcrepo_t,s0)
portage.if +1 -0
@@ -151,6 +151,7 @@ interface(`portage_compile_domain',` corenet_udp_sendrecv_all_ports($1) corenet_tcp_connect_all_reserved_ports($1) corenet_tcp_connect_distccd_port($1) + corenet_tcp_connect_git_port($1) dev_read_sysfs($1) dev_read_rand($1)
Signature · 1 line
1.7.8.6
cover Various small updates on contrib modules
In reply to Sven VermeulenQuoted 10 lines · Sven Vermeulen
This patchset contains a list of smaller updates to various contrib modules
Sven Vermeulen (6):
Mark glsa-check asportage_exec_t
Allow gcc-config to work on NFS-mounted portage tree Reshuffle tunable/optional
Do not mark java configuration tools as java entry points Allow portage fetch domain to show download progress Further enhance portage git support
Quoted 6 lines
java.fc | 2 +- portage.fc | 2 ++ portage.if | 1 + portage.te | 6 ++++++ telnet.te | 10 +++++----- 5 files changed, 15 insertions(+), 6 deletions(-)
This set is merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com