diff options
60 files changed, 1575 insertions, 0 deletions
diff --git a/sec-policy/selinux-alsa/ChangeLog b/sec-policy/selinux-alsa/ChangeLog new file mode 100644 index 000000000000..f3991356e907 --- /dev/null +++ b/sec-policy/selinux-alsa/ChangeLog @@ -0,0 +1,13 @@ +# ChangeLog for sec-policy/selinux-alsa +# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-alsa/ChangeLog,v 1.1 2011/02/05 20:41:04 blueness Exp $ + + 05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog: + Initial commit to portage. + +*selinux-alsa-2.20101213-r1 (22 Jan 2011) + + 22 Jan 2011; <swift@gentoo.org> +selinux-alsa-2.20101213-r1.ebuild, + +files/fix-alsa.patch: + Correct file context for alsactl command + diff --git a/sec-policy/selinux-alsa/files/fix-alsa.patch b/sec-policy/selinux-alsa/files/fix-alsa.patch new file mode 100644 index 000000000000..385ca2d6367c --- /dev/null +++ b/sec-policy/selinux-alsa/files/fix-alsa.patch @@ -0,0 +1,10 @@ +--- admin/alsa.fc 2010-09-03 17:23:05.000000000 +0200 ++++ ../../../refpolicy/policy/modules/admin/alsa.fc 2011-01-15 20:28:15.015000008 +0100 +@@ -8,6 +8,7 @@ + /etc/asound\.state -- gen_context(system_u:object_r:alsa_etc_rw_t,s0) + + /sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0) ++/usr/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0) + /sbin/salsa -- gen_context(system_u:object_r:alsa_exec_t,s0) + + /usr/bin/ainit -- gen_context(system_u:object_r:alsa_exec_t,s0) diff --git a/sec-policy/selinux-alsa/metadata.xml b/sec-policy/selinux-alsa/metadata.xml new file mode 100644 index 000000000000..b6b56659e582 --- /dev/null +++ b/sec-policy/selinux-alsa/metadata.xml @@ -0,0 +1,11 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> +<pkgmetadata> +<herd>hardened</herd> +<maintainer> + <email>pebenito@gentoo.org</email> + <name>Chris PeBenito</name> + <description>Primary Maintainer</description> +</maintainer> +<longdescription>Gentoo SELinux policy for the ALSA tools</longdescription> +</pkgmetadata> diff --git a/sec-policy/selinux-alsa/selinux-alsa-2.20101213-r1.ebuild b/sec-policy/selinux-alsa/selinux-alsa-2.20101213-r1.ebuild new file mode 100644 index 000000000000..64c8faff60d0 --- /dev/null +++ b/sec-policy/selinux-alsa/selinux-alsa-2.20101213-r1.ebuild @@ -0,0 +1,15 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-alsa/selinux-alsa-2.20101213-r1.ebuild,v 1.1 2011/02/05 20:41:04 blueness Exp $ + +IUSE="" + +MODS="alsa" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" + +POLICY_PATCH="${FILESDIR}/fix-alsa.patch" diff --git a/sec-policy/selinux-alsa/selinux-alsa-2.20101213.ebuild b/sec-policy/selinux-alsa/selinux-alsa-2.20101213.ebuild new file mode 100644 index 000000000000..75f88b50b473 --- /dev/null +++ b/sec-policy/selinux-alsa/selinux-alsa-2.20101213.ebuild @@ -0,0 +1,13 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-alsa/selinux-alsa-2.20101213.ebuild,v 1.1 2011/02/05 20:41:04 blueness Exp $ + +IUSE="" + +MODS="alsa" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" diff --git a/sec-policy/selinux-gorg/ChangeLog b/sec-policy/selinux-gorg/ChangeLog new file mode 100644 index 000000000000..087f7dd422e9 --- /dev/null +++ b/sec-policy/selinux-gorg/ChangeLog @@ -0,0 +1,13 @@ +# ChangeLog for sec-policy/selinux-gorg +# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-gorg/ChangeLog,v 1.1 2011/02/05 20:41:04 blueness Exp $ + + 05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog: + Initial commit to portage. + +*selinux-gorg-2.20101213 (07 Jan 2011) + + 07 Jan 2011; <swift@gentoo.org> +selinux-gorg-2.20101213.ebuild, + +files/add-gorg.patch: + Adding gorg module + diff --git a/sec-policy/selinux-gorg/files/add-gorg.patch b/sec-policy/selinux-gorg/files/add-gorg.patch new file mode 100644 index 000000000000..71e8cb10d02c --- /dev/null +++ b/sec-policy/selinux-gorg/files/add-gorg.patch @@ -0,0 +1,68 @@ +--- services/gorg.te 1970-01-01 01:00:00.000000000 +0100 ++++ ../../../refpolicy/policy/modules/services/gorg.te 2011-01-07 22:35:18.986000107 +0100 +@@ -0,0 +1,59 @@ ++policy_module(gorg, 1.0.0) ++ ++type gorg_t; ++type gorg_exec_t; ++typealias gorg_t alias { staff_gorg_t user_gorg_t }; ++application_domain(gorg_t, gorg_exec_t) ++role staff_r types gorg_t; ++role user_r types gorg_t; ++ ++type gorg_cache_t; ++files_type(gorg_cache_t); ++ ++type gorg_config_t; ++files_type(gorg_config_t); ++ ++# Allow gorg_t to put files in the gorg_cache_t location(s) ++manage_dirs_pattern(gorg_t, gorg_cache_t, gorg_cache_t) ++manage_files_pattern(gorg_t, gorg_cache_t, gorg_cache_t) ++ ++# Allow gorg_t to read configuration file(s) ++allow gorg_t gorg_config_t:dir list_dir_perms; ++read_files_pattern(gorg_t, gorg_config_t, gorg_config_t) ++ ++# gorg logs through /dev/log ++logging_send_syslog_msg(gorg_t) ++ ++# Allow gorg to bind to port 8080 (http_cache_port_t) ++sysnet_read_config(gorg_t) ++sysnet_dns_name_resolve(gorg_t) ++corenet_all_recvfrom_unlabeled(gorg_t) ++corenet_all_recvfrom_netlabel(gorg_t) ++corenet_tcp_sendrecv_generic_if(gorg_t) ++corenet_tcp_sendrecv_generic_node(gorg_t) ++#corenet_tcp_sendrecv_all_ports(gorg_t) ++corenet_tcp_bind_generic_node(gorg_t) ++corenet_tcp_bind_http_cache_port(gorg_t) ++allow gorg_t self:netlink_route_socket { create_socket_perms nlmsg_read }; ++allow gorg_t self:tcp_socket { listen accept }; ++ ++# Allow gorg read access to user home files (usually where cvs/git pull is stored) ++files_search_home(gorg_t) ++userdom_search_user_home_dirs(gorg_t) ++userdom_user_home_content(gorg_t) ++userdom_list_user_home_content(gorg_t) ++userdom_read_user_home_content_symlinks(gorg_t) ++userdom_read_user_home_content_files(gorg_t) ++ ++# Local policy ++allow gorg_t self:fifo_file rw_fifo_file_perms; ++ ++# Read /etc files (xml/catalog, hosts.conf, ...) ++files_read_etc_files(gorg_t) ++ ++# Gorg is ruby, so be able to execute ruby ++corecmd_exec_bin(gorg_t) ++ ++# Output to screen ++userdom_use_user_terminals(gorg_t) ++domain_use_interactive_fds(gorg_t) +--- services/gorg.fc 1970-01-01 01:00:00.000000000 +0100 ++++ ../../../refpolicy/policy/modules/services/gorg.fc 2011-01-07 22:35:22.840999786 +0100 +@@ -0,0 +1,3 @@ ++/etc/gorg(/.*)? gen_context(system_u:object_r:gorg_config_t,s0) ++/var/cache/gorg(/.*)? gen_context(system_u:object_r:gorg_cache_t,s0) ++/usr/bin/gorg -- gen_context(system_u:object_r:gorg_exec_t,s0) diff --git a/sec-policy/selinux-gorg/metadata.xml b/sec-policy/selinux-gorg/metadata.xml new file mode 100644 index 000000000000..22e4e153f44e --- /dev/null +++ b/sec-policy/selinux-gorg/metadata.xml @@ -0,0 +1,10 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> +<pkgmetadata> +<herd>hardened</herd> +<maintainer> + <email>selinux@gentoo.org</email> +</maintainer> +<longdescription>Gentoo SELinux policy for gorg.</longdescription> +</pkgmetadata> + diff --git a/sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild b/sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild new file mode 100644 index 000000000000..45edb5aba2bf --- /dev/null +++ b/sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild @@ -0,0 +1,16 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild,v 1.1 2011/02/05 20:41:04 blueness Exp $ + +IUSE="" + +MODS="gorg" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" + +POLICY_PATCH="${FILESDIR}/add-gorg.patch" +RDEPEND=">=sec-policy/selinux-base-policy-2.20101213-r3" diff --git a/sec-policy/selinux-links/ChangeLog b/sec-policy/selinux-links/ChangeLog new file mode 100644 index 000000000000..3fabe772f474 --- /dev/null +++ b/sec-policy/selinux-links/ChangeLog @@ -0,0 +1,13 @@ +# ChangeLog for sec-policy/selinux-links +# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-links/ChangeLog,v 1.1 2011/02/05 20:41:04 blueness Exp $ + + 05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog: + Initial commit to portage. + +*selinux-links-2.20101213 (22 Jan 2011) + + 22 Jan 2011; <swift@gentoo.org> +selinux-links-2.20101213.ebuild, + +files/add-apps-links.patch, +metadata.xml: + Adding SELinux policy for links webbrowser + diff --git a/sec-policy/selinux-links/files/add-apps-links.patch b/sec-policy/selinux-links/files/add-apps-links.patch new file mode 100644 index 000000000000..938ab975b74b --- /dev/null +++ b/sec-policy/selinux-links/files/add-apps-links.patch @@ -0,0 +1,66 @@ +--- apps/links.te 1970-01-01 01:00:00.000000000 +0100 ++++ apps/links.te 2011-01-22 15:01:55.272000135 +0100 +@@ -0,0 +1,58 @@ ++policy_module(links, 1.0.0) ++ ++############################ ++# ++# Declarations ++# ++ ++type links_t; ++type links_exec_t; ++application_domain(links_t, links_exec_t) ++ ++type links_home_t; ++typealias links_home_t alias { user_links_home_t staff_links_home_t sysadm_links_home_t }; ++userdom_user_home_content(links_home_t) ++ ++type links_tmpfs_t; ++typealias links_tmpfs_t alias { user_links_tmpfs_t staff_links_tmpfs_t sysadm_links_tmpfs_t }; ++files_tmpfs_file(links_tmpfs_t) ++ubac_constrained(links_tmpfs_t) ++ ++############################ ++# ++# Policy ++# ++ ++allow links_t self:process signal_perms; ++allow links_t self:unix_stream_socket create_stream_socket_perms; ++ ++manage_dirs_pattern(links_t, links_home_t, links_home_t) ++manage_files_pattern(links_t, links_home_t, links_home_t) ++manage_lnk_files_pattern(links_t, links_home_t, links_home_t) ++manage_sock_files_pattern(links_t, links_home_t, links_home_t) ++manage_fifo_files_pattern(links_t, links_home_t, links_home_t) ++userdom_user_home_dir_filetrans(links_t, links_home_t, dir) ++ ++manage_fifo_files_pattern(links_t, links_t, links_t) ++ ++manage_files_pattern(links_t, links_tmpfs_t, links_tmpfs_t) ++manage_lnk_files_pattern(links_t, links_tmpfs_t, links_tmpfs_t) ++manage_fifo_files_pattern(links_t, links_tmpfs_t, links_tmpfs_t) ++manage_sock_files_pattern(links_t, links_tmpfs_t, links_tmpfs_t) ++fs_tmpfs_filetrans(links_t, links_tmpfs_t, { file lnk_file sock_file fifo_file }) ++ ++xserver_user_x_domain_template(links, links_t, links_tmpfs_t) ++ ++domain_use_interactive_fds(links_t) ++ ++userdom_manage_user_home_content_dirs(links_t) ++userdom_manage_user_home_content_files(links_t) ++ ++auth_use_nsswitch(links_t) ++ ++userdom_use_user_terminals(links_t) ++ ++corenet_tcp_connect_http_port(links_t) ++ ++miscfiles_read_localization(links_t) ++ +--- apps/links.fc 1970-01-01 01:00:00.000000000 +0100 ++++ apps/links.fc 2011-01-16 10:50:48.058999501 +0100 +@@ -0,0 +1,2 @@ ++/usr/bin/links -- gen_context(system_u:object_r:links_exec_t,s0) ++HOME_DIR/\.links(/.*)? gen_context(system_u:object_r:links_home_t,s0) diff --git a/sec-policy/selinux-links/metadata.xml b/sec-policy/selinux-links/metadata.xml new file mode 100644 index 000000000000..5cbd4e92a68d --- /dev/null +++ b/sec-policy/selinux-links/metadata.xml @@ -0,0 +1,6 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> +<pkgmetadata> +<herd>hardened</herd> +<longdescription>Gentoo SELinux policy for the links web browser</longdescription> +</pkgmetadata> diff --git a/sec-policy/selinux-links/selinux-links-2.20101213.ebuild b/sec-policy/selinux-links/selinux-links-2.20101213.ebuild new file mode 100644 index 000000000000..61eb85459d6c --- /dev/null +++ b/sec-policy/selinux-links/selinux-links-2.20101213.ebuild @@ -0,0 +1,14 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-links/selinux-links-2.20101213.ebuild,v 1.1 2011/02/05 20:41:04 blueness Exp $ + +IUSE="" + +MODS="links" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" +POLICY_PATCH="${FILESDIR}/add-apps-links.patch" diff --git a/sec-policy/selinux-mozilla/ChangeLog b/sec-policy/selinux-mozilla/ChangeLog new file mode 100644 index 000000000000..64ccd9257cdc --- /dev/null +++ b/sec-policy/selinux-mozilla/ChangeLog @@ -0,0 +1,14 @@ +# ChangeLog for sec-policy/selinux-mozilla +# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mozilla/ChangeLog,v 1.1 2011/02/05 20:41:05 blueness Exp $ + + 05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog: + Initial commit to portage. + +*selinux-mozilla-2.20101213-r1 (22 Jan 2011) + + 22 Jan 2011; <swift@gentoo.org> +selinux-mozilla-2.20101213-r1.ebuild, + files/fix-mozilla.patch: + Support binary firefox, add call to alsa interface and support tmp type + for mozilla + diff --git a/sec-policy/selinux-mozilla/files/fix-mozilla.patch b/sec-policy/selinux-mozilla/files/fix-mozilla.patch new file mode 100644 index 000000000000..bfa24856170a --- /dev/null +++ b/sec-policy/selinux-mozilla/files/fix-mozilla.patch @@ -0,0 +1,57 @@ +--- apps/mozilla.te 2010-12-13 15:11:01.000000000 +0100 ++++ ../../../refpolicy/policy/modules/apps/mozilla.te 2011-01-15 16:27:48.031000003 +0100 +@@ -33,6 +33,10 @@ + files_tmpfs_file(mozilla_tmpfs_t) + ubac_constrained(mozilla_tmpfs_t) + ++type mozilla_tmp_t; ++files_tmp_file(mozilla_tmp_t) ++ubac_constrained(mozilla_tmp_t) ++ + ######################################## + # + # Local policy +@@ -68,6 +72,12 @@ + manage_sock_files_pattern(mozilla_t, mozilla_tmpfs_t, mozilla_tmpfs_t) + fs_tmpfs_filetrans(mozilla_t, mozilla_tmpfs_t, { file lnk_file sock_file fifo_file }) + ++manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) ++manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t) ++files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir } ) ++userdom_manage_user_tmp_files(mozilla_t) ++userdom_manage_user_tmp_sockets(mozilla_t) ++ + kernel_read_kernel_sysctls(mozilla_t) + kernel_read_network_state(mozilla_t) + # Access /proc, sysctl +@@ -143,6 +153,7 @@ + + userdom_use_user_ptys(mozilla_t) + ++ + xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t) + xserver_dontaudit_read_xdm_tmp_files(mozilla_t) + xserver_dontaudit_getattr_xdm_tmp_sockets(mozilla_t) +@@ -266,3 +277,7 @@ + optional_policy(` + thunderbird_domtrans(mozilla_t) + ') ++ ++optional_policy(` ++ alsa_read_rw_config(mozilla_t) ++') +--- apps/mozilla.fc 2010-08-03 15:11:03.000000000 +0200 ++++ ../../../refpolicy/policy/modules/apps/mozilla.fc 2011-01-02 22:23:34.407000019 +0100 +@@ -27,3 +27,12 @@ + /usr/lib(64)?/[^/]*firefox[^/]*/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) + /usr/lib/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) + /usr/lib64/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) ++ ++ifdef(`distro_gentoo',` ++/usr/bin/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) ++/opt/firefox/libxul\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) ++/opt/firefox/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) ++/opt/firefox/run-mozilla.sh -- gen_context(system_u:object_r:mozilla_exec_t,s0) ++/opt/firefox/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0) ++/opt/firefox/plugin-container -- gen_context(system_u:object_r:mozilla_exec_t,s0) ++') diff --git a/sec-policy/selinux-mozilla/metadata.xml b/sec-policy/selinux-mozilla/metadata.xml new file mode 100644 index 000000000000..d1cc6baa448f --- /dev/null +++ b/sec-policy/selinux-mozilla/metadata.xml @@ -0,0 +1,6 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> +<pkgmetadata> +<herd>hardened</herd> +<longdescription>Gentoo SELinux policy for mozilla</longdescription> +</pkgmetadata> diff --git a/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213-r1.ebuild b/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213-r1.ebuild new file mode 100644 index 000000000000..df8f5aa9928f --- /dev/null +++ b/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213-r1.ebuild @@ -0,0 +1,15 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213-r1.ebuild,v 1.1 2011/02/05 20:41:05 blueness Exp $ + +IUSE="" + +MODS="mozilla" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" + +POLICY_PATCH="${FILESDIR}/fix-mozilla.patch" diff --git a/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213.ebuild b/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213.ebuild new file mode 100644 index 000000000000..7045789cd713 --- /dev/null +++ b/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213.ebuild @@ -0,0 +1,15 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mozilla/selinux-mozilla-2.20101213.ebuild,v 1.1 2011/02/05 20:41:05 blueness Exp $ + +IUSE="" + +MODS="mozilla" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" + +POLICY_PATCH="${FILESDIR}/fix-mozilla.patch" diff --git a/sec-policy/selinux-mplayer/ChangeLog b/sec-policy/selinux-mplayer/ChangeLog new file mode 100644 index 000000000000..504d51545cce --- /dev/null +++ b/sec-policy/selinux-mplayer/ChangeLog @@ -0,0 +1,13 @@ +# ChangeLog for sec-policy/selinux-mplayer +# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mplayer/ChangeLog,v 1.1 2011/02/05 20:41:04 blueness Exp $ + + 05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog: + Initial commit to portage. + +*selinux-mplayer-2.20101213 (07 Jan 2011) + + 07 Jan 2011; <swift@gentoo.org> +selinux-mplayer-2.20101213.ebuild, + +files/fix-mplayer.patch: + Adding mplayer module + diff --git a/sec-policy/selinux-mplayer/files/fix-mplayer.patch b/sec-policy/selinux-mplayer/files/fix-mplayer.patch new file mode 100644 index 000000000000..2e51c7b2ee11 --- /dev/null +++ b/sec-policy/selinux-mplayer/files/fix-mplayer.patch @@ -0,0 +1,20 @@ +--- apps/mplayer.te 2010-12-13 15:11:01.000000000 +0100 ++++ ../../../refpolicy/policy/modules/apps/mplayer.te 2011-01-07 21:03:00.230000033 +0100 +@@ -197,6 +197,7 @@ + dev_rwx_zero(mplayer_t) + # Access to DVD/CD/V4L + dev_read_video_dev(mplayer_t) ++dev_write_video_dev(mplayer_t) + # Audio, alsa.conf + dev_read_sound_mixer(mplayer_t) + dev_write_sound_mixer(mplayer_t) +@@ -226,6 +227,9 @@ + miscfiles_read_fonts(mplayer_t) + + userdom_use_user_terminals(mplayer_t) ++domain_use_interactive_fds(mplayer_t) ++ ++# + # Read media files + userdom_list_user_tmp(mplayer_t) + userdom_read_user_tmp_files(mplayer_t) diff --git a/sec-policy/selinux-mplayer/metadata.xml b/sec-policy/selinux-mplayer/metadata.xml new file mode 100644 index 000000000000..bcf7d6334eaf --- /dev/null +++ b/sec-policy/selinux-mplayer/metadata.xml @@ -0,0 +1,10 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> +<pkgmetadata> +<herd>hardened</herd> +<maintainer> + <email>selinux@gentoo.org</email> +</maintainer> +<longdescription>Gentoo SELinux policy for mplayer.</longdescription> +</pkgmetadata> + diff --git a/sec-policy/selinux-mplayer/selinux-mplayer-2.20101213.ebuild b/sec-policy/selinux-mplayer/selinux-mplayer-2.20101213.ebuild new file mode 100644 index 000000000000..1d9f53e39e55 --- /dev/null +++ b/sec-policy/selinux-mplayer/selinux-mplayer-2.20101213.ebuild @@ -0,0 +1,15 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mplayer/selinux-mplayer-2.20101213.ebuild,v 1.1 2011/02/05 20:41:04 blueness Exp $ + +IUSE="" + +MODS="mplayer" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" + +POLICY_PATCH="${FILESDIR}/fix-mplayer.patch" diff --git a/sec-policy/selinux-mutt/ChangeLog b/sec-policy/selinux-mutt/ChangeLog new file mode 100644 index 000000000000..8331d17dc539 --- /dev/null +++ b/sec-policy/selinux-mutt/ChangeLog @@ -0,0 +1,19 @@ +# ChangeLog for sec-policy/selinux-mutt +# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mutt/ChangeLog,v 1.1 2011/02/05 20:41:03 blueness Exp $ + + 05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog: + Initial commit to portage. + +*selinux-mutt-2.20101213-r1 (31 Jan 2011) + + 31 Jan 2011; <swift@gentoo.org> +files/add-apps-mutt-r1.patch, + +selinux-mutt-2.20101213-r1.ebuild: + Updates on policy, allow writes on user homedir for instance + +*selinux-mutt-2.20101213 (22 Jan 2011) + + 22 Jan 2011; <swift@gentoo.org> +selinux-mutt-2.20101213.ebuild, + +files/add-apps-mutt.patch, +metadata.xml: + Add SELinux policy module for mutt + diff --git a/sec-policy/selinux-mutt/files/add-apps-mutt-r1.patch b/sec-policy/selinux-mutt/files/add-apps-mutt-r1.patch new file mode 100644 index 000000000000..d8127623373b --- /dev/null +++ b/sec-policy/selinux-mutt/files/add-apps-mutt-r1.patch @@ -0,0 +1,84 @@ +--- apps/mutt.te 1970-01-01 01:00:00.000000000 +0100 ++++ apps/mutt.te 2011-01-30 15:24:18.890000182 +0100 +@@ -0,0 +1,74 @@ ++policy_module(mutt, 1.0.0) ++ ++############################ ++# ++# Declarations ++# ++ ++type mutt_t; ++type mutt_exec_t; ++application_domain(mutt_t, mutt_exec_t) ++ubac_constrained(mutt_t) ++ ++type mutt_home_t; ++typealias mutt_home_t alias { user_mutt_home_t staff_mutt_home_t sysadm_mutt_home_t }; ++userdom_user_home_content(mutt_home_t) ++ ++type mutt_conf_t; ++typealias mutt_conf_t alias { user_mutt_conf_t staff_mutt_conf_t sysadm_mutt_conf_t }; ++userdom_user_home_content(mutt_conf_t) ++ ++type mutt_sys_conf_t; ++files_type(mutt_sys_conf_t) ++ ++type mutt_tmp_t; ++typealias mutt_tmp_t alias { user_mutt_tmp_t staff_mutt_tmp_t sysadm_mutt_tmp_t }; ++files_tmp_file(mutt_tmp_t) ++ubac_constrained(mutt_tmp_t) ++ ++############################ ++# ++# Local Policy Rules ++# ++ ++allow mutt_t self:process signal_perms; ++ ++ ++manage_dirs_pattern(mutt_t, mutt_home_t, mutt_home_t) ++manage_files_pattern(mutt_t, mutt_home_t, mutt_home_t) ++userdom_user_home_dir_filetrans(mutt_t, mutt_home_t, dir) ++ ++manage_dirs_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t) ++manage_files_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t) ++manage_fifo_files_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t) ++files_tmp_filetrans(mutt_t, mutt_tmp_t, { file dir }) ++files_search_tmp(mutt_t) ++ ++read_files_pattern(mutt_t, mutt_sys_conf_t, mutt_sys_conf_t) ++read_files_pattern(mutt_t, mutt_conf_t, mutt_conf_t) ++search_dirs_pattern(mutt_t, mutt_sys_conf_t, mutt_sys_conf_t) ++ ++ ++corecmd_exec_bin(mutt_t) ++corecmd_exec_shell(mutt_t) ++corenet_tcp_connect_pop_port(mutt_t) ++corenet_tcp_connect_smtp_port(mutt_t) ++dev_read_rand(mutt_t) ++dev_read_urand(mutt_t) ++domain_use_interactive_fds(mutt_t) ++files_read_usr_files(mutt_t) ++ ++ ++auth_use_nsswitch(mutt_t) ++miscfiles_read_localization(mutt_t) ++userdom_manage_user_home_content_files(mutt_t) ++userdom_manage_user_home_content_dirs(mutt_t) ++userdom_search_user_home_content(mutt_t) ++userdom_use_user_terminals(mutt_t) ++ ++ ++ ++ ++tunable_policy(`gentoo_try_dontaudit',` ++ kernel_dontaudit_search_sysctl(mutt_t) ++') +--- apps/mutt.fc 1970-01-01 01:00:00.000000000 +0100 ++++ apps/mutt.fc 2011-01-16 13:56:03.314000081 +0100 +@@ -0,0 +1,4 @@ ++/usr/bin/mutt -- gen_context(system_u:object_r:mutt_exec_t,s0) ++HOME_DIR/\.mutt(/.*)? gen_context(system_u:object_r:mutt_home_t,s0) ++HOME_DIR/\.muttrc -- gen_context(system_u:object_r:mutt_conf_t,s0) ++/etc/mutt(/.*)? gen_context(system_u:object_r:mutt_sys_conf_t,s0) diff --git a/sec-policy/selinux-mutt/files/add-apps-mutt.patch b/sec-policy/selinux-mutt/files/add-apps-mutt.patch new file mode 100644 index 000000000000..4dd6e05b55b2 --- /dev/null +++ b/sec-policy/selinux-mutt/files/add-apps-mutt.patch @@ -0,0 +1,86 @@ +--- apps/mutt.te 1970-01-01 01:00:00.000000000 +0100 ++++ apps/mutt.te 2011-01-22 15:22:46.330000061 +0100 +@@ -0,0 +1,76 @@ ++policy_module(mutt, 1.0.0) ++ ++############################ ++# ++# Declarations ++# ++ ++type mutt_t; ++type mutt_exec_t; ++application_domain(mutt_t, mutt_exec_t) ++ubac_constrained(mutt_t) ++ ++type mutt_home_t; ++typealias mutt_home_t alias { user_mutt_home_t staff_mutt_home_t sysadm_mutt_home_t }; ++userdom_user_home_content(mutt_home_t) ++ ++type mutt_conf_t; ++typealias mutt_conf_t alias { user_mutt_conf_t staff_mutt_conf_t sysadm_mutt_conf_t }; ++userdom_user_home_content(mutt_conf_t) ++ ++type mutt_sys_conf_t; ++files_type(mutt_sys_conf_t) ++ ++type mutt_tmp_t; ++typealias mutt_tmp_t alias { user_mutt_tmp_t staff_mutt_tmp_t sysadm_mutt_tmp_t }; ++files_tmp_file(mutt_tmp_t) ++ubac_constrained(mutt_tmp_t) ++ ++############################ ++# ++# Policy ++# ++ ++allow mutt_t self:process signal_perms; ++#allow mutt_t self:unix_stream_socket create_stream_socket_perms; ++ ++manage_dirs_pattern(mutt_t, mutt_home_t, mutt_home_t) ++manage_files_pattern(mutt_t, mutt_home_t, mutt_home_t) ++#manage_lnk_files_pattern(mutt_t, mutt_home_t, mutt_home_t) ++#manage_sock_files_pattern(mutt_t, mutt_home_t, mutt_home_t) ++#manage_fifo_files_pattern(mutt_t, mutt_home_t, mutt_home_t) ++userdom_user_home_dir_filetrans(mutt_t, mutt_home_t, dir) ++#manage_fifo_files_pattern(mutt_t, mutt_t, mutt_t) ++ ++manage_dirs_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t) ++manage_files_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t) ++manage_fifo_files_pattern(mutt_t, mutt_tmp_t, mutt_tmp_t) ++files_tmp_filetrans(mutt_t, mutt_tmp_t, { file dir }) ++files_search_tmp(mutt_t) ++ ++read_files_pattern(mutt_t, mutt_sys_conf_t, mutt_sys_conf_t) ++read_files_pattern(mutt_t, mutt_conf_t, mutt_conf_t) ++search_dirs_pattern(mutt_t, mutt_sys_conf_t, mutt_sys_conf_t) ++ ++userdom_search_user_home_content(mutt_t) ++userdom_manage_user_home_content_files(mutt_t) ++userdom_manage_user_home_content_dirs(mutt_t) ++ ++corecmd_exec_bin(mutt_t) ++corecmd_exec_shell(mutt_t) ++files_read_usr_files(mutt_t) ++ ++domain_use_interactive_fds(mutt_t) ++ ++auth_use_nsswitch(mutt_t) ++ ++userdom_use_user_terminals(mutt_t) ++ ++corenet_tcp_connect_pop_port(mutt_t) ++corenet_tcp_connect_smtp_port(mutt_t) ++ ++miscfiles_read_localization(mutt_t) ++ ++dev_read_rand(mutt_t) ++dev_read_urand(mutt_t) ++ +--- apps/mutt.fc 1970-01-01 01:00:00.000000000 +0100 ++++ apps/mutt.fc 2011-01-16 13:56:03.314000081 +0100 +@@ -0,0 +1,4 @@ ++/usr/bin/mutt -- gen_context(system_u:object_r:mutt_exec_t,s0) ++HOME_DIR/\.mutt(/.*)? gen_context(system_u:object_r:mutt_home_t,s0) ++HOME_DIR/\.muttrc -- gen_context(system_u:object_r:mutt_conf_t,s0) ++/etc/mutt(/.*)? gen_context(system_u:object_r:mutt_sys_conf_t,s0) diff --git a/sec-policy/selinux-mutt/metadata.xml b/sec-policy/selinux-mutt/metadata.xml new file mode 100644 index 000000000000..c89b0e8d6995 --- /dev/null +++ b/sec-policy/selinux-mutt/metadata.xml @@ -0,0 +1,6 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> +<pkgmetadata> +<herd>hardened</herd> +<longdescription>Gentoo SELinux policy for the mutt e-mail client</longdescription> +</pkgmetadata> diff --git a/sec-policy/selinux-mutt/selinux-mutt-2.20101213-r1.ebuild b/sec-policy/selinux-mutt/selinux-mutt-2.20101213-r1.ebuild new file mode 100644 index 000000000000..89c6393e546d --- /dev/null +++ b/sec-policy/selinux-mutt/selinux-mutt-2.20101213-r1.ebuild @@ -0,0 +1,15 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mutt/selinux-mutt-2.20101213-r1.ebuild,v 1.1 2011/02/05 20:41:03 blueness Exp $ + +IUSE="" + +MODS="mutt" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" + +POLICY_PATCH="${FILESDIR}/add-apps-mutt-r1.patch" diff --git a/sec-policy/selinux-mutt/selinux-mutt-2.20101213.ebuild b/sec-policy/selinux-mutt/selinux-mutt-2.20101213.ebuild new file mode 100644 index 000000000000..82b5607af0ea --- /dev/null +++ b/sec-policy/selinux-mutt/selinux-mutt-2.20101213.ebuild @@ -0,0 +1,15 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-mutt/selinux-mutt-2.20101213.ebuild,v 1.1 2011/02/05 20:41:03 blueness Exp $ + +IUSE="" + +MODS="mutt" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" + +POLICY_PATCH="${FILESDIR}/add-apps-mutt.patch" diff --git a/sec-policy/selinux-networkmanager/ChangeLog b/sec-policy/selinux-networkmanager/ChangeLog new file mode 100644 index 000000000000..6dd49c3ba62b --- /dev/null +++ b/sec-policy/selinux-networkmanager/ChangeLog @@ -0,0 +1,7 @@ +# ChangeLog for sec-policy/selinux-networkmanager +# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-networkmanager/ChangeLog,v 1.1 2011/02/05 20:41:05 blueness Exp $ + + 05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog: + Initial commit to portage. + diff --git a/sec-policy/selinux-networkmanager/files/fix-networkmanager.patch b/sec-policy/selinux-networkmanager/files/fix-networkmanager.patch new file mode 100644 index 000000000000..8c38757d1b44 --- /dev/null +++ b/sec-policy/selinux-networkmanager/files/fix-networkmanager.patch @@ -0,0 +1,75 @@ +--- services/networkmanager.te 2010-09-10 17:05:45.000000000 +0200 ++++ ../../../refpolicy/policy/modules/services/networkmanager.te 2011-01-02 15:40:48.781999979 +0100 +@@ -28,6 +28,9 @@ + type wpa_cli_exec_t; + init_system_domain(wpa_cli_t, wpa_cli_exec_t) + ++type wpa_cli_var_run_t; ++files_pid_file(wpa_cli_var_run_t) ++ + ######################################## + # + # Local policy +@@ -68,6 +71,11 @@ + manage_sock_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t) + files_pid_filetrans(NetworkManager_t, NetworkManager_var_run_t, { dir file sock_file }) + ++manage_dirs_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t) ++manage_files_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t) ++manage_sock_files_pattern(wpa_cli_t, wpa_cli_var_run_t, wpa_cli_var_run_t) ++files_pid_filetrans(wpa_cli_t, wpa_cli_var_run_t, { dir file sock_file }) ++ + kernel_read_system_state(NetworkManager_t) + kernel_read_network_state(NetworkManager_t) + kernel_read_kernel_sysctls(NetworkManager_t) +@@ -125,10 +133,12 @@ + init_read_utmp(NetworkManager_t) + init_dontaudit_write_utmp(NetworkManager_t) + init_domtrans_script(NetworkManager_t) ++init_domtrans_script(wpa_cli_t) + + auth_use_nsswitch(NetworkManager_t) + + logging_send_syslog_msg(NetworkManager_t) ++logging_send_syslog_msg(wpa_cli_t) + + miscfiles_read_localization(NetworkManager_t) + miscfiles_read_generic_certs(NetworkManager_t) +@@ -149,6 +159,7 @@ + + userdom_dontaudit_use_unpriv_user_fds(NetworkManager_t) + userdom_dontaudit_use_user_ttys(NetworkManager_t) ++userdom_use_user_ttys(wpa_cli_t) + # Read gnome-keyring + userdom_read_user_home_content_files(NetworkManager_t) + +@@ -287,3 +298,20 @@ + miscfiles_read_localization(wpa_cli_t) + + term_dontaudit_use_console(wpa_cli_t) ++ ++fs_search_tmpfs(wpa_cli_t) ++fs_search_tmpfs(NetworkManager_t) ++fs_rw_tmpfs_files(wpa_cli_t) ++fs_rw_tmpfs_files(NetworkManager_t) ++fs_manage_tmpfs_dirs(wpa_cli_t) ++fs_manage_tmpfs_sockets(wpa_cli_t) ++fs_manage_tmpfs_sockets(NetworkManager_t) ++getty_use_fds(wpa_cli_t) ++files_search_pids(wpa_cli_t) ++corecmd_exec_shell(wpa_cli_t) ++corecmd_exec_bin(wpa_cli_t) ++ ++ifdef(`distro_gentoo',` ++ sysnet_domtrans_dhcpc(wpa_cli_t) ++ allow wpa_cli_t etc_t:file { getattr }; ++') +--- services/networkmanager.fc 2010-08-03 15:11:06.000000000 +0200 ++++ ../../../refpolicy/policy/modules/services/networkmanager.fc 2011-01-02 17:30:48.448999997 +0100 +@@ -24,3 +24,6 @@ + /var/run/nm-dhclient.* gen_context(system_u:object_r:NetworkManager_var_run_t,s0) + /var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) + /var/run/wpa_supplicant-global -s gen_context(system_u:object_r:NetworkManager_var_run_t,s0) ++/var/run/wpa_cli-.* -- gen_context(system_u:object_r:wpa_cli_var_run_t,s0) ++/etc/wpa_supplicant/wpa_cli.sh -- gen_context(system_u:object_r:bin_t,s0) ++/usr/bin/wpa_cli -- gen_context(system_u:object_r:wpa_cli_exec_t,s0) diff --git a/sec-policy/selinux-networkmanager/metadata.xml b/sec-policy/selinux-networkmanager/metadata.xml new file mode 100644 index 000000000000..1323c5ca543a --- /dev/null +++ b/sec-policy/selinux-networkmanager/metadata.xml @@ -0,0 +1,6 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> +<pkgmetadata> +<herd>hardened</herd> +<longdescription>Gentoo SELinux policy for networkmanager</longdescription> +</pkgmetadata> diff --git a/sec-policy/selinux-networkmanager/selinux-networkmanager-2.20101213.ebuild b/sec-policy/selinux-networkmanager/selinux-networkmanager-2.20101213.ebuild new file mode 100644 index 000000000000..4a59b6060946 --- /dev/null +++ b/sec-policy/selinux-networkmanager/selinux-networkmanager-2.20101213.ebuild @@ -0,0 +1,22 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-networkmanager/selinux-networkmanager-2.20101213.ebuild,v 1.1 2011/02/05 20:41:05 blueness Exp $ + +IUSE="" + +MODS="networkmanager" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" + +MODDEPEND=">=sec-policy/selinux-base-policy-2.20101213-r1" + +# Patch "fix-networkmanager.patch" contains: +# - Support for wpa_cli. Gentoo's init scripts use wpa_cli to run the init +# scripts when wpa_supplicant has associated. +# - Support running wpa_cli from commandline (requires +# selinux-base-policy-2.20101213-r1) due to patch to sysadm_t domain +POLICY_PATCH="${FILESDIR}/fix-networkmanager.patch" diff --git a/sec-policy/selinux-qemu/ChangeLog b/sec-policy/selinux-qemu/ChangeLog new file mode 100644 index 000000000000..f9f57b57096c --- /dev/null +++ b/sec-policy/selinux-qemu/ChangeLog @@ -0,0 +1,13 @@ +# ChangeLog for sec-policy/selinux-qemu +# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-qemu/ChangeLog,v 1.1 2011/02/05 20:41:04 blueness Exp $ + + 05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog: + Initial commit to portage. + +*selinux-qemu-2.20101213 (22 Jan 2011) + + 22 Jan 2011; <swift@gentoo.org> +selinux-qemu-2.20101213.ebuild, + +files/fix-apps-qemu.patch, +metadata.xml: + Adding SELinux policy for QEMU + diff --git a/sec-policy/selinux-qemu/files/fix-apps-qemu.patch b/sec-policy/selinux-qemu/files/fix-apps-qemu.patch new file mode 100644 index 000000000000..9e15caa1923a --- /dev/null +++ b/sec-policy/selinux-qemu/files/fix-apps-qemu.patch @@ -0,0 +1,21 @@ +--- apps/qemu.te 2010-12-13 15:11:01.000000000 +0100 ++++ apps/qemu.te 2011-01-22 21:35:19.555999967 +0100 +@@ -56,6 +56,10 @@ + userdom_search_user_home_content(qemu_t) + userdom_read_user_tmpfs_files(qemu_t) + ++allow qemu_t self:socket create_socket_perms; ++ ++kernel_request_load_module(qemu_t) ++ + tunable_policy(`qemu_full_network',` + allow qemu_t self:udp_socket create_socket_perms; + +@@ -116,3 +120,7 @@ + allow unconfined_qemu_t self:process { execstack execmem }; + allow unconfined_qemu_t qemu_exec_t:file execmod; + ') ++ ++optional_policy(` ++ vde_connect(qemu_t) ++') diff --git a/sec-policy/selinux-qemu/metadata.xml b/sec-policy/selinux-qemu/metadata.xml new file mode 100644 index 000000000000..d53a19c789c7 --- /dev/null +++ b/sec-policy/selinux-qemu/metadata.xml @@ -0,0 +1,6 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> +<pkgmetadata> +<herd>hardened</herd> +<longdescription>Gentoo SELinux policy for the QEMU tools</longdescription> +</pkgmetadata> diff --git a/sec-policy/selinux-qemu/selinux-qemu-2.20101213.ebuild b/sec-policy/selinux-qemu/selinux-qemu-2.20101213.ebuild new file mode 100644 index 000000000000..08bf6a50ac05 --- /dev/null +++ b/sec-policy/selinux-qemu/selinux-qemu-2.20101213.ebuild @@ -0,0 +1,14 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-qemu/selinux-qemu-2.20101213.ebuild,v 1.1 2011/02/05 20:41:04 blueness Exp $ + +IUSE="" + +MODS="qemu" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" +POLICY_PATCH="${FILESDIR}/fix-apps-qemu.patch" diff --git a/sec-policy/selinux-skype/ChangeLog b/sec-policy/selinux-skype/ChangeLog new file mode 100644 index 000000000000..9a6d1e425f67 --- /dev/null +++ b/sec-policy/selinux-skype/ChangeLog @@ -0,0 +1,19 @@ +# ChangeLog for sec-policy/selinux-skype +# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-skype/ChangeLog,v 1.1 2011/02/05 20:41:03 blueness Exp $ + + 05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog: + Initial commit to portage. + +*selinux-skype-2.20101213-r2 (31 Jan 2011) + + 31 Jan 2011; <swift@gentoo.org> +files/add-apps-skype-r2.patch, + +selinux-skype-2.20101213-r2.ebuild: + Allow userhome access, set some dontaudits etc. + +*selinux-skype-2.20101213-r1 (22 Jan 2011) + + 22 Jan 2011; <swift@gentoo.org> +selinux-skype-2.20101213-r1.ebuild, + +files/add-apps-skype.patch: + Update skype module to 'comply' with suggested approach for domains + diff --git a/sec-policy/selinux-skype/files/add-apps-skype-r2.patch b/sec-policy/selinux-skype/files/add-apps-skype-r2.patch new file mode 100644 index 000000000000..95b6674334f1 --- /dev/null +++ b/sec-policy/selinux-skype/files/add-apps-skype-r2.patch @@ -0,0 +1,106 @@ +--- apps/skype.te 1970-01-01 01:00:00.000000000 +0100 ++++ apps/skype.te 2011-01-30 16:17:19.481000177 +0100 +@@ -0,0 +1,97 @@ ++policy_module(skype, 0.0.2) ++ ++############################ ++# ++# Declarations ++# ++ ++type skype_t; ++type skype_exec_t; ++application_domain(skype_t, skype_exec_t) ++ ++type skype_home_t; ++ ++type skype_tmpfs_t; ++files_tmpfs_file(skype_tmpfs_t) ++ubac_constrained(skype_tmpfs_t) ++ ++############################ ++# ++# Policy ++# ++ ++allow skype_t self:process { getsched setsched execmem }; ++allow skype_t self:fifo_file rw_fifo_file_perms; ++allow skype_t self:unix_stream_socket create_socket_perms; ++allow skype_t self:sem create_sem_perms; ++allow skype_t self:tcp_socket create_stream_socket_perms; ++ ++ ++manage_dirs_pattern(skype_t, skype_home_t, skype_home_t) ++manage_files_pattern(skype_t, skype_home_t, skype_home_t) ++manage_lnk_files_pattern(skype_t, skype_home_t, skype_home_t) ++userdom_user_home_dir_filetrans(skype_t, skype_home_t, dir) ++userdom_user_home_content(skype_home_t) ++ ++manage_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t) ++manage_lnk_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t) ++manage_fifo_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t) ++manage_sock_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t) ++fs_tmpfs_filetrans(skype_t, skype_tmpfs_t, { file lnk_file sock_file fifo_file }) ++ ++ ++kernel_read_system_state(skype_t) ++ ++can_exec(skype_t, skype_exec_t) ++corecmd_exec_bin(skype_t) ++corecmd_exec_shell(skype_t) ++corenet_all_recvfrom_netlabel(skype_t) ++corenet_all_recvfrom_unlabeled(skype_t) ++corenet_tcp_bind_generic_node(skype_t) ++corenet_udp_bind_generic_node(skype_t) ++corenet_tcp_bind_generic_port(skype_t) ++corenet_udp_bind_generic_port(skype_t) ++corenet_tcp_connect_generic_port(skype_t) ++corenet_tcp_connect_http_port(skype_t) ++corenet_tcp_sendrecv_http_port(skype_t) ++corenet_sendrecv_http_client_packets(skype_t) ++dev_read_sound(skype_t) ++dev_read_video_dev(skype_t) ++dev_write_sound(skype_t) ++dev_write_video_dev(skype_t) ++files_read_etc_files(skype_t) ++files_read_usr_files(skype_t) ++ ++ ++auth_use_nsswitch(skype_t) ++domain_use_interactive_fds(skype_t) ++libs_use_ld_so(skype_t) ++miscfiles_dontaudit_setattr_fonts_dirs(skype_t) ++miscfiles_read_localization(skype_t) ++userdom_manage_user_home_content_dirs(skype_t) ++userdom_manage_user_home_content_files(skype_t) ++userdom_use_user_terminals(skype_t) ++ ++ ++xserver_user_x_domain_template(skype, skype_t, skype_tmpfs_t) ++ ++tunable_policy(`gentoo_try_dontaudit',` ++ dev_dontaudit_search_sysfs(skype_t) ++ fs_dontaudit_getattr_xattr_fs(skype_t) ++') ++ ++optional_policy(` ++ tunable_policy(`gentoo_try_dontaudit',` ++ mozilla_dontaudit_manage_user_home_files(skype_t) ++ ') ++') ++ ++optional_policy(` ++ alsa_read_rw_config(skype_t) ++') ++ ++optional_policy(` ++ dbus_system_bus_client(skype_t) ++ dbus_session_bus_client(skype_t) ++') ++ +--- apps/skype.fc 1970-01-01 01:00:00.000000000 +0100 ++++ apps/skype.fc 2011-01-09 21:27:25.364999962 +0100 +@@ -0,0 +1,3 @@ ++/usr/bin/skype -- gen_context(system_u:object_r:skype_exec_t,s0) ++/opt/skype/skype -- gen_context(system_u:object_r:skype_exec_t,s0) ++HOME_DIR/\.Skype(/.*)? gen_context(system_u:object_r:skype_home_t,s0) diff --git a/sec-policy/selinux-skype/files/add-apps-skype.patch b/sec-policy/selinux-skype/files/add-apps-skype.patch new file mode 100644 index 000000000000..1fc492a733fa --- /dev/null +++ b/sec-policy/selinux-skype/files/add-apps-skype.patch @@ -0,0 +1,102 @@ +--- apps/skype.te 1970-01-01 01:00:00.000000000 +0100 ++++ apps/skype.te 2011-01-22 14:21:31.257000064 +0100 +@@ -0,0 +1,93 @@ ++policy_module(skype, 1.0.1) ++ ++############################ ++# ++# Declarations ++# ++ ++type skype_t; ++type skype_exec_t; ++application_domain(skype_t, skype_exec_t) ++ ++type skype_home_t; ++userdom_user_home_content(skype_home_t) ++ ++type skype_tmpfs_t; ++files_tmpfs_file(skype_tmpfs_t) ++ubac_constrained(skype_tmpfs_t) ++ ++############################ ++# ++# Policy ++# ++ ++allow skype_t self:process { getsched setsched }; ++allow skype_t self:fifo_file rw_fifo_file_perms; ++allow skype_t self:unix_stream_socket create_socket_perms; ++allow skype_t self:sem create_sem_perms; ++ ++manage_dirs_pattern(skype_t, skype_home_t, skype_home_t) ++manage_files_pattern(skype_t, skype_home_t, skype_home_t) ++manage_lnk_files_pattern(skype_t, skype_home_t, skype_home_t) ++userdom_user_home_dir_filetrans(skype_t, skype_home_t, dir) ++ ++userdom_manage_user_home_content_dirs(skype_t) ++userdom_manage_user_home_content_files(skype_t) ++ ++manage_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t) ++manage_lnk_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t) ++manage_fifo_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t) ++manage_sock_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t) ++fs_tmpfs_filetrans(skype_t, skype_tmpfs_t, { file lnk_file sock_file fifo_file }) ++ ++can_exec(skype_t, skype_exec_t) ++ ++kernel_read_system_state(skype_t) ++ ++corecmd_exec_bin(skype_t) ++corecmd_exec_shell(skype_t) ++ ++corenet_all_recvfrom_netlabel(skype_t) ++corenet_all_recvfrom_unlabeled(skype_t) ++corenet_tcp_bind_generic_node(skype_t) ++corenet_udp_bind_generic_node(skype_t) ++corenet_tcp_bind_generic_port(skype_t) ++corenet_udp_bind_generic_port(skype_t) ++corenet_tcp_connect_generic_port(skype_t) ++corenet_tcp_connect_http_port(skype_t) ++corenet_tcp_sendrecv_http_port(skype_t) ++corenet_sendrecv_http_client_packets(skype_t) ++allow skype_t self:tcp_socket create_stream_socket_perms; ++ ++dev_read_video_dev(skype_t) ++dev_write_video_dev(skype_t) ++dev_read_sound(skype_t) ++dev_write_sound(skype_t) ++ ++domain_use_interactive_fds(skype_t) ++ ++files_read_etc_files(skype_t) ++files_read_usr_files(skype_t) ++ ++auth_use_nsswitch(skype_t) ++ ++libs_use_ld_so(skype_t) ++ ++miscfiles_read_localization(skype_t) ++miscfiles_dontaudit_setattr_fonts_dirs(skype_t) ++ ++userdom_use_user_terminals(skype_t) ++ ++xserver_user_x_domain_template(skype, skype_t, skype_tmpfs_t) ++ ++allow skype_t self:process { execmem }; ++ ++optional_policy(` ++ alsa_read_rw_config(skype_t) ++') ++ ++optional_policy(` ++ dbus_system_bus_client(skype_t) ++ dbus_session_bus_client(skype_t) ++') ++ +--- apps/skype.fc 1970-01-01 01:00:00.000000000 +0100 ++++ apps/skype.fc 2011-01-09 21:27:25.364999962 +0100 +@@ -0,0 +1,3 @@ ++/usr/bin/skype -- gen_context(system_u:object_r:skype_exec_t,s0) ++/opt/skype/skype -- gen_context(system_u:object_r:skype_exec_t,s0) ++HOME_DIR/\.Skype(/.*)? gen_context(system_u:object_r:skype_home_t,s0) diff --git a/sec-policy/selinux-skype/files/add-skype.patch b/sec-policy/selinux-skype/files/add-skype.patch new file mode 100644 index 000000000000..493ef2232a64 --- /dev/null +++ b/sec-policy/selinux-skype/files/add-skype.patch @@ -0,0 +1,103 @@ +--- apps/skype.te 1970-01-01 01:00:00.000000000 +0100 ++++ ../../../refpolicy/policy/modules/apps/skype.te 2011-01-08 00:23:10.900000094 +0100 +@@ -0,0 +1,94 @@ ++policy_module(skype, 1.0.0) ++ ++############################ ++# ++# Declarations ++# ++ ++ ++type skype_t; ++type skype_exec_t; ++typealias skype_t alias { user_skype_t staff_skype_t sysadm_skype_t }; ++application_domain(skype_t, skype_exec_t) ++ ++type skype_home_t; ++typealias skype_home_t alias { user_skype_home_t staff_skype_home_t sysadm_skype_home_t }; ++userdom_user_home_content(skype_home_t) ++ ++type skype_tmpfs_t; ++typealias skype_tmpfs_t alias { user_skype_tmpfs_t staff_skype_tmpfs_t sysadm_skype_tmpfs_t }; ++files_tmpfs_file(skype_tmpfs_t) ++ubac_constrained(skype_tmpfs_t) ++ ++############################ ++# ++# Local policy ++# ++ ++# Looks as if the binary needs this; for the time being use the tunable policy ++tunable_policy(`allow_execmem',` ++ allow skype_t self:process { execmem }; ++') ++ ++# Manage ~/.Skype ++manage_dirs_pattern(skype_t, skype_home_t, skype_home_t) ++manage_files_pattern(skype_t, skype_home_t, skype_home_t) ++manage_lnk_files_pattern(skype_t, skype_home_t, skype_home_t) ++userdom_user_home_dir_filetrans(skype_t, skype_home_t, dir) ++userdom_search_user_home_dirs(skype_t) ++ ++# Declare access permissions on skype_tmpfs_t domain for X sessions ++manage_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t) ++manage_lnk_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t) ++manage_fifo_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t) ++manage_sock_files_pattern(skype_t, skype_tmpfs_t, skype_tmpfs_t) ++fs_tmpfs_filetrans(skype_t, skype_tmpfs_t, { file lnk_file sock_file fifo_file }) ++ ++# Be able to call skype from a terminal (debugging) ++userdom_use_user_terminals(skype_t) ++domain_use_interactive_fds(skype_t) ++ ++corecmd_exec_bin(skype_t) ++corecmd_exec_shell(skype_t) ++can_exec(skype_t, skype_exec_t) ++#exec_files_pattern(skype_t, skype_exec_t, skype_exec_t) ++libs_use_ld_so(skype_t) ++files_read_usr_symlinks(skype_t) ++ ++# This is an X application ++xserver_user_x_domain_template(skype, skype_t, skype_tmpfs_t) ++ ++files_search_var_lib(skype_t) ++miscfiles_read_fonts(skype_t) ++miscfiles_read_localization(skype_t) ++miscfiles_dontaudit_setattr_fonts_dirs(skype_t) ++dbus_system_bus_client(skype_t) ++files_read_etc_files(skype_t) ++libs_read_lib_files(skype_t) ++ ++corenet_tcp_bind_generic_node(skype_t) ++corenet_udp_bind_generic_node(skype_t) ++corenet_tcp_bind_generic_port(skype_t) ++corenet_udp_bind_generic_port(skype_t) ++corenet_tcp_connect_generic_port(skype_t) ++corenet_tcp_connect_http_port(skype_t) ++ ++dev_read_video_dev(skype_t) ++dev_write_video_dev(skype_t) ++dev_read_sound(skype_t) ++dev_write_sound(skype_t) ++alsa_read_rw_config(skype_t) ++ ++files_read_usr_files(skype_t) ++kernel_read_system_state(skype_t) ++sysnet_read_config(skype_t) ++ ++# Self ++allow skype_t self:process { getsched }; ++allow skype_t self:unix_stream_socket create_socket_perms; ++allow skype_t self:udp_socket create_stream_socket_perms; ++allow skype_t self:tcp_socket create_stream_socket_perms; ++allow skype_t self:sem create_sem_perms; ++allow skype_t self:netlink_route_socket rw_netlink_socket_perms; ++allow skype_t self:fifo_file rw_fifo_file_perms; ++ +--- apps/skype.fc 1970-01-01 01:00:00.000000000 +0100 ++++ ../../../refpolicy/policy/modules/apps/skype.fc 2011-01-07 21:46:47.603999891 +0100 +@@ -0,0 +1,3 @@ ++/usr/bin/skype -- gen_context(system_u:object_r:skype_exec_t,s0) ++/opt/skype/skype -- gen_context(system_u:object_r:skype_exec_t,s0) ++HOME_DIR/\.Skype(/.*)? gen_context(system_u:object_r:skype_home_t,s0) diff --git a/sec-policy/selinux-skype/metadata.xml b/sec-policy/selinux-skype/metadata.xml new file mode 100644 index 000000000000..3d9f93061222 --- /dev/null +++ b/sec-policy/selinux-skype/metadata.xml @@ -0,0 +1,10 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> +<pkgmetadata> +<herd>hardened</herd> +<maintainer> + <email>selinux@gentoo.org</email> +</maintainer> +<longdescription>Gentoo SELinux policy for skype.</longdescription> +</pkgmetadata> + diff --git a/sec-policy/selinux-skype/selinux-skype-2.20101213-r1.ebuild b/sec-policy/selinux-skype/selinux-skype-2.20101213-r1.ebuild new file mode 100644 index 000000000000..00f463e78458 --- /dev/null +++ b/sec-policy/selinux-skype/selinux-skype-2.20101213-r1.ebuild @@ -0,0 +1,16 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-skype/selinux-skype-2.20101213-r1.ebuild,v 1.1 2011/02/05 20:41:03 blueness Exp $ + +IUSE="" + +MODS="skype" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" + +POLICY_PATCH="${FILESDIR}/add-apps-skype.patch" +RDEPEND=">=sec-policy/selinux-base-policy-2.20101213-r4" diff --git a/sec-policy/selinux-skype/selinux-skype-2.20101213-r2.ebuild b/sec-policy/selinux-skype/selinux-skype-2.20101213-r2.ebuild new file mode 100644 index 000000000000..d4f1b790446b --- /dev/null +++ b/sec-policy/selinux-skype/selinux-skype-2.20101213-r2.ebuild @@ -0,0 +1,16 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-skype/selinux-skype-2.20101213-r2.ebuild,v 1.1 2011/02/05 20:41:03 blueness Exp $ + +IUSE="" + +MODS="skype" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" + +POLICY_PATCH="${FILESDIR}/add-apps-skype-r2.patch" +RDEPEND=">=sec-policy/selinux-base-policy-2.20101213-r4" diff --git a/sec-policy/selinux-skype/selinux-skype-2.20101213.ebuild b/sec-policy/selinux-skype/selinux-skype-2.20101213.ebuild new file mode 100644 index 000000000000..d08539a83afb --- /dev/null +++ b/sec-policy/selinux-skype/selinux-skype-2.20101213.ebuild @@ -0,0 +1,16 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-skype/selinux-skype-2.20101213.ebuild,v 1.1 2011/02/05 20:41:03 blueness Exp $ + +IUSE="" + +MODS="skype" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" + +POLICY_PATCH="${FILESDIR}/add-skype.patch" +RDEPEND=">=sec-policy/selinux-base-policy-2.20101213-r3" diff --git a/sec-policy/selinux-vde/ChangeLog b/sec-policy/selinux-vde/ChangeLog new file mode 100644 index 000000000000..f8be44be88ba --- /dev/null +++ b/sec-policy/selinux-vde/ChangeLog @@ -0,0 +1,13 @@ +# ChangeLog for sec-policy/selinux-vde +# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-vde/ChangeLog,v 1.1 2011/02/05 20:41:04 blueness Exp $ + + 05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog: + Initial commit to portage. + +*selinux-vde-2.20101213 (22 Jan 2011) + + 22 Jan 2011; <swift@gentoo.org> +selinux-vde-2.20101213.ebuild, + +files/add-services-vde.patch, +metadata.xml: + Adding SELinux policy module for VDE + diff --git a/sec-policy/selinux-vde/files/add-services-vde.patch b/sec-policy/selinux-vde/files/add-services-vde.patch new file mode 100644 index 000000000000..df49d872b1cc --- /dev/null +++ b/sec-policy/selinux-vde/files/add-services-vde.patch @@ -0,0 +1,69 @@ +--- services/vde.te 1970-01-01 01:00:00.000000000 +0100 ++++ services/vde.te 2011-01-22 22:20:13.375000222 +0100 +@@ -0,0 +1,56 @@ ++policy_module(vde, 0.0.1) ++ ++######################################## ++# ++# Declarations ++# ++ ++type vde_t; ++type vde_exec_t; ++init_daemon_domain(vde_t, vde_exec_t) ++ ++type vde_initrc_exec_t; ++init_script_file(vde_initrc_exec_t) ++ ++type vde_conf_t; ++files_type(vde_conf_t); ++ ++type vde_var_lib_t; ++files_type(vde_var_lib_t) ++ ++type vde_var_run_t; ++files_pid_file(vde_var_run_t) ++ ++type vde_tmp_t; ++files_tmp_file(vde_tmp_t) ++ ++######################################## ++# ++# Local policy ++# ++ ++allow vde_t self:process { signal_perms getcap setcap }; ++allow vde_t self:capability { chown net_admin dac_override fowner fsetid }; ++ ++allow vde_t vde_tmp_t:sock_file manage_sock_file_perms; ++allow vde_t self:unix_stream_socket { create_stream_socket_perms connectto }; ++allow vde_t self:unix_dgram_socket create_socket_perms; ++files_tmp_filetrans(vde_t, vde_tmp_t, sock_file) ++ ++manage_dirs_pattern(vde_t, vde_var_run_t, vde_var_run_t) ++manage_files_pattern(vde_t, vde_var_run_t, vde_var_run_t) ++manage_sock_files_pattern(vde_t, vde_var_run_t, vde_var_run_t) ++files_pid_filetrans(vde_t, vde_var_run_t, { dir file sock_file unix_dgram_socket }) ++ ++files_read_etc_files(vde_t) ++ ++allow vde_t vde_conf_t:dir list_dir_perms; ++read_files_pattern(vde_t, vde_conf_t, vde_conf_t) ++read_lnk_files_pattern(vde_t, vde_conf_t, vde_conf_t) ++ ++domain_use_interactive_fds(vde_t) ++userdom_use_user_terminals(vde_t) ++miscfiles_read_localization(vde_t) ++corenet_rw_tun_tap_dev(vde_t) ++ ++logging_send_syslog_msg(vde_t) +--- services/vde.fc 1970-01-01 01:00:00.000000000 +0100 ++++ services/vde.fc 2011-01-22 21:23:05.129000146 +0100 +@@ -0,0 +1,7 @@ ++/etc/init.d/vde -- gen_context(system_u:object_r:vde_initrc_exec_t,s0) ++/usr/bin/vde_switch -- gen_context(system_u:object_r:vde_exec_t,s0) ++/usr/sbin/vde_tunctl -- gen_context(system_u:object_r:vde_exec_t,s0) ++/etc/vde2(/.*)? gen_context(system_u:object_r:vde_conf_t,s0) ++/etc/vde2/libvdemgmt(/.*)? gen_context(system_u:object_r:vde_conf_t,s0) ++/var/run/vde\.ctl(/.*)? gen_context(system_u:object_r:vde_var_run_t,s0) ++/tmp/vde.[0-9-]* -s gen_context(system_u:object_r:vde_tmp_t,s0) diff --git a/sec-policy/selinux-vde/metadata.xml b/sec-policy/selinux-vde/metadata.xml new file mode 100644 index 000000000000..d7aecab0e9e9 --- /dev/null +++ b/sec-policy/selinux-vde/metadata.xml @@ -0,0 +1,6 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> +<pkgmetadata> +<herd>hardened</herd> +<longdescription>Gentoo SELinux policy for the Virtual Distributed Ethernet switching tools</longdescription> +</pkgmetadata> diff --git a/sec-policy/selinux-vde/selinux-vde-2.20101213.ebuild b/sec-policy/selinux-vde/selinux-vde-2.20101213.ebuild new file mode 100644 index 000000000000..85d80bf0424b --- /dev/null +++ b/sec-policy/selinux-vde/selinux-vde-2.20101213.ebuild @@ -0,0 +1,15 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-vde/selinux-vde-2.20101213.ebuild,v 1.1 2011/02/05 20:41:04 blueness Exp $ + +IUSE="" + +MODS="vde" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for Virtual Distributed Ethernet switch" + +KEYWORDS="~amd64 ~x86" + +POLICY_PATCH="${FILESDIR}/add-services-vde.patch" diff --git a/sec-policy/selinux-xfce4/ChangeLog b/sec-policy/selinux-xfce4/ChangeLog new file mode 100644 index 000000000000..05ee6b71a29b --- /dev/null +++ b/sec-policy/selinux-xfce4/ChangeLog @@ -0,0 +1,14 @@ +# ChangeLog for sec-policy/selinux-xfce4 +# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-xfce4/ChangeLog,v 1.1 2011/02/05 20:41:05 blueness Exp $ + + 05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog: + Initial commit to portage. + +*selinux-xfce4-2.20101213 (22 Jan 2011) + + 22 Jan 2011; <swift@gentoo.org> +files/add-apps-xfce4.patch, + +selinux-xfce4-2.20101213.ebuild, +metadata.xml: + Adding Gentoo SELinux module for xfce4 desktop environment, currently + limited to relabelling of proper files + diff --git a/sec-policy/selinux-xfce4/files/add-apps-xfce4.patch b/sec-policy/selinux-xfce4/files/add-apps-xfce4.patch new file mode 100644 index 000000000000..7761cde11b44 --- /dev/null +++ b/sec-policy/selinux-xfce4/files/add-apps-xfce4.patch @@ -0,0 +1,17 @@ +--- apps/xfce4.te 1970-01-01 01:00:00.000000000 +0100 ++++ apps/xfce4.te 2011-01-22 13:18:24.079000051 +0100 +@@ -0,0 +1,2 @@ ++policy_module(xfce, 0.0.1) ++ +--- apps/xfce4.fc 1970-01-01 01:00:00.000000000 +0100 ++++ apps/xfce4.fc 2011-01-22 13:22:10.602000045 +0100 +@@ -0,0 +1,9 @@ ++/usr/lib(64)?/xfce4/session/xfsm-shutdown-helper -- gen_context(system_u:object_r:bin_t,s0) ++/usr/lib(64)?/xfce4/session/balou-export-theme -- gen_context(system_u:object_r:bin_t,s0) ++/usr/lib(64)?/xfce4/session/balou-install-theme -- gen_context(system_u:object_r:bin_t,s0) ++/usr/lib(64)?/xfce4/xfwm4/helper-dialog -- gen_context(system_u:object_r:bin_t,s0) ++/usr/lib(64)?/xfce4/xfconf/xfconfd -- gen_context(system_u:object_r:bin_t,s0) ++/usr/lib(64)?/xfce4/panel/wrapper -- gen_context(system_u:object_r:bin_t,s0) ++/usr/lib(64)?/xfce4/panel/migrate -- gen_context(system_u:object_r:bin_t,s0) ++/usr/lib(64)?/xfce4/exo-1/exo-helper-1 -- gen_context(system_u:object_r:bin_t,s0) ++/usr/lib(64)?/xfce4/exo-1/exo-compose-mail-1 -- gen_context(system_u:object_r:bin_t,s0) diff --git a/sec-policy/selinux-xfce4/metadata.xml b/sec-policy/selinux-xfce4/metadata.xml new file mode 100644 index 000000000000..256a3148c890 --- /dev/null +++ b/sec-policy/selinux-xfce4/metadata.xml @@ -0,0 +1,6 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> +<pkgmetadata> +<herd>hardened</herd> +<longdescription>Gentoo SELinux policy for the XFCE4 desktop environment</longdescription> +</pkgmetadata> diff --git a/sec-policy/selinux-xfce4/selinux-xfce4-2.20101213.ebuild b/sec-policy/selinux-xfce4/selinux-xfce4-2.20101213.ebuild new file mode 100644 index 000000000000..34c9e34e6de5 --- /dev/null +++ b/sec-policy/selinux-xfce4/selinux-xfce4-2.20101213.ebuild @@ -0,0 +1,15 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-xfce4/selinux-xfce4-2.20101213.ebuild,v 1.1 2011/02/05 20:41:05 blueness Exp $ + +IUSE="" + +MODS="xfce4" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for XFCE4 desktop environment" + +KEYWORDS="~amd64 ~x86" + +POLICY_PATCH="${FILESDIR}/add-apps-xfce4.patch" diff --git a/sec-policy/selinux-xserver/ChangeLog b/sec-policy/selinux-xserver/ChangeLog new file mode 100644 index 000000000000..5afe2fcb59a4 --- /dev/null +++ b/sec-policy/selinux-xserver/ChangeLog @@ -0,0 +1,19 @@ +# ChangeLog for sec-policy/selinux-xserver +# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-xserver/ChangeLog,v 1.1 2011/02/05 20:41:03 blueness Exp $ + + 05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog: + Initial commit to portage. + +*selinux-xserver-2.20101213-r2 (02 Feb 2011) + + 02 Feb 2011; <swift@gentoo.org> +files/fix-services-xserver-r2.patch, + +selinux-xserver-2.20101213-r2.ebuild: + Allow use of ttys (improves console logging) + +*selinux-xserver-2.20101213-r1 (31 Jan 2011) + + 31 Jan 2011; <swift@gentoo.org> +files/fix-services-xserver-r1.patch, + +selinux-xserver-2.20101213-r1.ebuild: + Fix large timewait issues with xserver policy + diff --git a/sec-policy/selinux-xserver/files/fix-services-xserver-r1.patch b/sec-policy/selinux-xserver/files/fix-services-xserver-r1.patch new file mode 100644 index 000000000000..75046d36a321 --- /dev/null +++ b/sec-policy/selinux-xserver/files/fix-services-xserver-r1.patch @@ -0,0 +1,50 @@ +--- services/xserver.te 2010-12-13 15:11:02.000000000 +0100 ++++ services/xserver.te 2011-01-30 15:04:32.722000186 +0100 +@@ -234,9 +234,11 @@ + + allow xdm_t iceauth_home_t:file read_file_perms; + ++files_search_tmp(iceauth_t) + fs_search_auto_mountpoints(iceauth_t) + + userdom_use_user_terminals(iceauth_t) ++userdom_read_user_tmp_files(iceauth_t) + + tunable_policy(`use_nfs_home_dirs',` + fs_manage_nfs_files(iceauth_t) +@@ -279,6 +281,7 @@ + + userdom_use_user_terminals(xauth_t) + userdom_read_user_tmp_files(xauth_t) ++userdom_read_user_tmp_files(xserver_t) + + xserver_rw_xdm_tmp_files(xauth_t) + +@@ -588,6 +591,9 @@ + allow xserver_t { root_xdrawable_t x_domain }:x_drawable send; + allow xserver_t input_xevent_t:x_event send; + ++# Allow X to process keyboard events ++udev_read_db(xserver_t) ++ + # setuid/setgid for the wrapper program to change UID + # sys_rawio is for iopl access - should not be needed for frame-buffer + # sys_admin, locking shared mem? chowning IPC message queues or semaphores? +@@ -610,6 +616,7 @@ + allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; + allow xserver_t self:tcp_socket create_stream_socket_perms; + allow xserver_t self:udp_socket create_socket_perms; ++allow xserver_t self:netlink_kobject_uevent_socket create_socket_perms; + + manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) + manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) +--- services/xserver.fc 2010-08-03 15:11:09.000000000 +0200 ++++ services/xserver.fc 2011-01-03 23:07:16.852000013 +0100 +@@ -5,6 +5,7 @@ + HOME_DIR/\.fonts(/.*)? gen_context(system_u:object_r:user_fonts_t,s0) + HOME_DIR/\.fonts/auto(/.*)? gen_context(system_u:object_r:user_fonts_cache_t,s0) + HOME_DIR/\.fonts\.cache-.* -- gen_context(system_u:object_r:user_fonts_cache_t,s0) ++HOME_DIR/\.fontconfig(/.*)? gen_context(system_u:object_r:user_fonts_cache_t,s0) + HOME_DIR/\.ICEauthority.* -- gen_context(system_u:object_r:iceauth_home_t,s0) + HOME_DIR/\.xauth.* -- gen_context(system_u:object_r:xauth_home_t,s0) + HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) diff --git a/sec-policy/selinux-xserver/files/fix-services-xserver-r2.patch b/sec-policy/selinux-xserver/files/fix-services-xserver-r2.patch new file mode 100644 index 000000000000..3c73d86c19f8 --- /dev/null +++ b/sec-policy/selinux-xserver/files/fix-services-xserver-r2.patch @@ -0,0 +1,52 @@ +--- services/xserver.te 2010-12-13 15:11:02.000000000 +0100 ++++ services/xserver.te 2011-02-01 18:16:07.421000056 +0100 +@@ -234,9 +234,13 @@ + + allow xdm_t iceauth_home_t:file read_file_perms; + ++files_search_tmp(iceauth_t) + fs_search_auto_mountpoints(iceauth_t) + + userdom_use_user_terminals(iceauth_t) ++userdom_read_user_tmp_files(iceauth_t) ++ ++getty_use_fds(iceauth_t) + + tunable_policy(`use_nfs_home_dirs',` + fs_manage_nfs_files(iceauth_t) +@@ -279,6 +283,7 @@ + + userdom_use_user_terminals(xauth_t) + userdom_read_user_tmp_files(xauth_t) ++userdom_read_user_tmp_files(xserver_t) + + xserver_rw_xdm_tmp_files(xauth_t) + +@@ -588,6 +593,9 @@ + allow xserver_t { root_xdrawable_t x_domain }:x_drawable send; + allow xserver_t input_xevent_t:x_event send; + ++# Allow X to process keyboard events ++udev_read_db(xserver_t) ++ + # setuid/setgid for the wrapper program to change UID + # sys_rawio is for iopl access - should not be needed for frame-buffer + # sys_admin, locking shared mem? chowning IPC message queues or semaphores? +@@ -610,6 +618,7 @@ + allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; + allow xserver_t self:tcp_socket create_stream_socket_perms; + allow xserver_t self:udp_socket create_socket_perms; ++allow xserver_t self:netlink_kobject_uevent_socket create_socket_perms; + + manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) + manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) +--- services/xserver.fc 2010-08-03 15:11:09.000000000 +0200 ++++ services/xserver.fc 2011-01-03 23:07:16.852000013 +0100 +@@ -5,6 +5,7 @@ + HOME_DIR/\.fonts(/.*)? gen_context(system_u:object_r:user_fonts_t,s0) + HOME_DIR/\.fonts/auto(/.*)? gen_context(system_u:object_r:user_fonts_cache_t,s0) + HOME_DIR/\.fonts\.cache-.* -- gen_context(system_u:object_r:user_fonts_cache_t,s0) ++HOME_DIR/\.fontconfig(/.*)? gen_context(system_u:object_r:user_fonts_cache_t,s0) + HOME_DIR/\.ICEauthority.* -- gen_context(system_u:object_r:iceauth_home_t,s0) + HOME_DIR/\.xauth.* -- gen_context(system_u:object_r:xauth_home_t,s0) + HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) diff --git a/sec-policy/selinux-xserver/files/fix-xserver.patch b/sec-policy/selinux-xserver/files/fix-xserver.patch new file mode 100644 index 000000000000..4f6edf3def21 --- /dev/null +++ b/sec-policy/selinux-xserver/files/fix-xserver.patch @@ -0,0 +1,38 @@ +--- services/xserver.te 2010-12-13 15:11:02.000000000 +0100 ++++ ../../../refpolicy/policy/modules/services/xserver.te 2011-01-02 18:21:17.682000037 +0100 +@@ -279,6 +279,7 @@ + + userdom_use_user_terminals(xauth_t) + userdom_read_user_tmp_files(xauth_t) ++userdom_read_user_tmp_files(xserver_t) + + xserver_rw_xdm_tmp_files(xauth_t) + +@@ -588,6 +589,9 @@ + allow xserver_t { root_xdrawable_t x_domain }:x_drawable send; + allow xserver_t input_xevent_t:x_event send; + ++# Allow X to process keyboard events ++udev_read_db(xserver_t) ++ + # setuid/setgid for the wrapper program to change UID + # sys_rawio is for iopl access - should not be needed for frame-buffer + # sys_admin, locking shared mem? chowning IPC message queues or semaphores? +@@ -610,6 +614,7 @@ + allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; + allow xserver_t self:tcp_socket create_stream_socket_perms; + allow xserver_t self:udp_socket create_socket_perms; ++allow xserver_t self:netlink_kobject_uevent_socket create_socket_perms; + + manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) + manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) +--- services/xserver.fc 2010-08-03 15:11:09.000000000 +0200 ++++ ../../../refpolicy/policy/modules/services/xserver.fc 2011-01-03 23:07:16.852000013 +0100 +@@ -5,6 +5,7 @@ + HOME_DIR/\.fonts(/.*)? gen_context(system_u:object_r:user_fonts_t,s0) + HOME_DIR/\.fonts/auto(/.*)? gen_context(system_u:object_r:user_fonts_cache_t,s0) + HOME_DIR/\.fonts\.cache-.* -- gen_context(system_u:object_r:user_fonts_cache_t,s0) ++HOME_DIR/\.fontconfig(/.*)? gen_context(system_u:object_r:user_fonts_cache_t,s0) + HOME_DIR/\.ICEauthority.* -- gen_context(system_u:object_r:iceauth_home_t,s0) + HOME_DIR/\.xauth.* -- gen_context(system_u:object_r:xauth_home_t,s0) + HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) diff --git a/sec-policy/selinux-xserver/metadata.xml b/sec-policy/selinux-xserver/metadata.xml new file mode 100644 index 000000000000..e768672448a3 --- /dev/null +++ b/sec-policy/selinux-xserver/metadata.xml @@ -0,0 +1,6 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd"> +<pkgmetadata> +<herd>hardened</herd> +<longdescription>Gentoo SELinux policy for the Xorg server</longdescription> +</pkgmetadata> diff --git a/sec-policy/selinux-xserver/selinux-xserver-2.20101213-r1.ebuild b/sec-policy/selinux-xserver/selinux-xserver-2.20101213-r1.ebuild new file mode 100644 index 000000000000..63f27f96a095 --- /dev/null +++ b/sec-policy/selinux-xserver/selinux-xserver-2.20101213-r1.ebuild @@ -0,0 +1,15 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-xserver/selinux-xserver-2.20101213-r1.ebuild,v 1.1 2011/02/05 20:41:03 blueness Exp $ + +IUSE="" + +MODS="xserver" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" + +POLICY_PATCH="${FILESDIR}/fix-services-xserver-r1.patch" diff --git a/sec-policy/selinux-xserver/selinux-xserver-2.20101213-r2.ebuild b/sec-policy/selinux-xserver/selinux-xserver-2.20101213-r2.ebuild new file mode 100644 index 000000000000..57ff047fa8ee --- /dev/null +++ b/sec-policy/selinux-xserver/selinux-xserver-2.20101213-r2.ebuild @@ -0,0 +1,15 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-xserver/selinux-xserver-2.20101213-r2.ebuild,v 1.1 2011/02/05 20:41:03 blueness Exp $ + +IUSE="" + +MODS="xserver" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" + +POLICY_PATCH="${FILESDIR}/fix-services-xserver-r2.patch" diff --git a/sec-policy/selinux-xserver/selinux-xserver-2.20101213.ebuild b/sec-policy/selinux-xserver/selinux-xserver-2.20101213.ebuild new file mode 100644 index 000000000000..453800b67d3b --- /dev/null +++ b/sec-policy/selinux-xserver/selinux-xserver-2.20101213.ebuild @@ -0,0 +1,15 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-xserver/selinux-xserver-2.20101213.ebuild,v 1.1 2011/02/05 20:41:03 blueness Exp $ + +IUSE="" + +MODS="xserver" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" + +POLICY_PATCH="${FILESDIR}/fix-xserver.patch" |