commit: 31c5b9a3d82c234e5a2423a9cf49d09e474aa218
Author: James Carter <jwcart2 <AT> tycho <DOT> nsa <DOT> gov>
AuthorDate: Wed Apr 11 18:57:12 2018 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Apr 22 11:53:03 2018 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=31c5b9a3
Fix interfaces that use an undeclared identifier
All the interfaces below were always being removed because of unmet requires.
ccs.if:ccs_admin()
Use cluster_conf_t instead of ccs_conf_t.
Called in roles/sysadm.te.
cfengine.if:cfengine_dontaudit_write_log_files()
Use cfengine_log_t instead of cfengine_var_log_t.
Called in contrib/sendmail.te.
cobbler.if:cobbler_admin()
Use cobbler_content_t instead of httpd_cobbler_content_t,
httpd_cobbler_content_ra_t, and httpd_cobbler_content_rw_t.
Called in roles/sysadm.te.
cron.if:cron_manage_system_spool()
Use system_cron_spool_t instead of cron_system_spool_t.
Called in system/init.te.
rpm.if:rpm_admin()
Use rpm_var_cache_t instead of rpm_cache_t.
Called in roles/sysadm.te
sssd.if:sssd_admin()
Use sssd_var_log_t instead of sssd_log_t.
Called in roles/sysadm.te
Signed-off-by: James Carter <jwcart2 <AT> tycho.nsa.gov>
policy/modules/contrib/ccs.if | 4 ++--
policy/modules/contrib/cfengine.if | 4 ++--
policy/modules/contrib/cobbler.if | 6 +++---
policy/modules/contrib/cron.if | 4 ++--
policy/modules/contrib/rpm.if | 4 ++--
policy/modules/contrib/sssd.if | 4 ++--
6 files changed, 13 insertions(+), 13 deletions(-)
diff --git a/policy/modules/contrib/ccs.if b/policy/modules/contrib/ccs.if
index 92f67fa4..767fb712 100644
--- a/policy/modules/contrib/ccs.if
+++ b/policy/modules/contrib/ccs.if
@@ -99,7 +99,7 @@ interface(`ccs_admin',`
gen_require(`
type ccs_t, ccs_initrc_exec_t, cluster_conf_t;
type ccs_var_lib_t, ccs_var_log_t;
- type ccs_var_run_t, ccs_tmp_t, ccs_conf_t;
+ type ccs_var_run_t, ccs_tmp_t;
')
allow $1 ccs_t:process { ptrace signal_perms };
@@ -108,7 +108,7 @@ interface(`ccs_admin',`
init_startstop_service($1, $2, ccs_t, ccs_initrc_exec_t)
files_search_etc($1)
- admin_pattern($1, ccs_conf_t)
+ admin_pattern($1, cluster_conf_t)
files_search_var_lib($1)
admin_pattern($1, ccs_var_lib_t)
diff --git a/policy/modules/contrib/cfengine.if
b/policy/modules/contrib/cfengine.if
index fdef5f34..ff0b0038 100644
--- a/policy/modules/contrib/cfengine.if
+++ b/policy/modules/contrib/cfengine.if
@@ -65,10 +65,10 @@ interface(`cfengine_read_lib_files',`
#
interface(`cfengine_dontaudit_write_log_files',`
gen_require(`
- type cfengine_var_log_t;
+ type cfengine_log_t;
')
- dontaudit $1 cfengine_var_log_t:file write_file_perms;
+ dontaudit $1 cfengine_log_t:file write_file_perms;
')
########################################
diff --git a/policy/modules/contrib/cobbler.if
b/policy/modules/contrib/cobbler.if
index 40f89990..6c6b5757 100644
--- a/policy/modules/contrib/cobbler.if
+++ b/policy/modules/contrib/cobbler.if
@@ -154,8 +154,8 @@ interface(`cobbler_manage_lib_files',`
interface(`cobbler_admin',`
gen_require(`
type cobblerd_t, cobbler_var_lib_t, cobbler_var_log_t;
- type cobbler_etc_t, cobblerd_initrc_exec_t,
httpd_cobbler_content_t;
- type httpd_cobbler_content_ra_t, httpd_cobbler_content_rw_t,
cobbler_tmp_t;
+ type cobbler_etc_t, cobblerd_initrc_exec_t, cobbler_content_t;
+ type cobbler_tmp_t;
')
allow $1 cobblerd_t:process { ptrace signal_perms };
@@ -176,5 +176,5 @@ interface(`cobbler_admin',`
admin_pattern($1, cobbler_var_log_t)
apache_search_sys_content($1)
- admin_pattern($1, { httpd_cobbler_content_t httpd_cobbler_content_ra_t
httpd_cobbler_content_rw_t })
+ admin_pattern($1, cobbler_content_t)
')
diff --git a/policy/modules/contrib/cron.if b/policy/modules/contrib/cron.if
index 7bb5d6e6..7bb6065b 100644
--- a/policy/modules/contrib/cron.if
+++ b/policy/modules/contrib/cron.if
@@ -696,11 +696,11 @@ interface(`cron_use_system_job_fds',`
#
interface(`cron_manage_system_spool',`
gen_require(`
- type cron_system_spool_t;
+ type system_cron_spool_t;
')
files_search_spool($1)
- manage_files_pattern($1, cron_system_spool_t, cron_system_spool_t)
+ manage_files_pattern($1, system_cron_spool_t, system_cron_spool_t)
')
########################################
diff --git a/policy/modules/contrib/rpm.if b/policy/modules/contrib/rpm.if
index 016cdb2a..d316410d 100644
--- a/policy/modules/contrib/rpm.if
+++ b/policy/modules/contrib/rpm.if
@@ -613,7 +613,7 @@ interface(`rpm_pid_filetrans_rpm_pid',`
interface(`rpm_admin',`
gen_require(`
type rpm_t, rpm_script_t, rpm_initrc_exec_t;
- type rpm_cache_t, rpm_var_lib_t, rpm_lock_t;
+ type rpm_var_cache_t, rpm_var_lib_t, rpm_lock_t;
type rpm_log_t, rpm_tmpfs_t, rpm_tmp_t, rpm_var_run_t;
type rpm_script_tmp_t, rpm_script_tmpfs_t, rpm_file_t;
')
@@ -626,7 +626,7 @@ interface(`rpm_admin',`
admin_pattern($1, rpm_file_t)
files_list_var($1)
- admin_pattern($1, rpm_cache_t)
+ admin_pattern($1, rpm_var_cache_t)
files_list_tmp($1)
admin_pattern($1, { rpm_tmp_t rpm_script_tmp_t })
diff --git a/policy/modules/contrib/sssd.if b/policy/modules/contrib/sssd.if
index e1b4cb01..bdb7f881 100644
--- a/policy/modules/contrib/sssd.if
+++ b/policy/modules/contrib/sssd.if
@@ -336,7 +336,7 @@ interface(`sssd_admin',`
gen_require(`
type sssd_t, sssd_public_t, sssd_initrc_exec_t;
type sssd_var_lib_t, sssd_var_run_t, sssd_conf_t;
- type sssd_log_t;
+ type sssd_var_log_t;
')
allow $1 sssd_t:process { ptrace signal_perms };
@@ -354,5 +354,5 @@ interface(`sssd_admin',`
admin_pattern($1, sssd_var_run_t)
logging_search_logs($1)
- admin_pattern($1, sssd_log_t)
+ admin_pattern($1, sssd_var_log_t)
')
