[gentoo-commits] proj/hardened-refpolicy:bitcoin commit in: policy/modules/system/

[Sven Vermeulen]

commit:     dee50b31c6dc717c65323de7df18f8a7a8d37400
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Tue Nov 11 15:58:55 2014 +0000
Commit:     Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Sun Nov 23 14:05:12 2014 +0000
URL:        
http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=dee50b31

Add support for init_script_readable

---
 policy/modules/system/init.if | 18 ++++++++++++++++++
 policy/modules/system/init.te |  6 ++++++
 2 files changed, 24 insertions(+)

diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 99e42fc..4d923d6 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -1916,3 +1916,21 @@ interface(`init_relabelto_script_state',`
        relabelto_files_pattern($1, initrc_state_t, initrc_state_t)
        relabelto_dirs_pattern($1, initrc_state_t, initrc_state_t)
 ')
+
+#########################################
+## <summary>
+##     Mark as a readable type for the initrc_t domain
+## </summary>
+## <param name="type">
+##     <summary>
+##     Type that initrc_t needs read access to
+##     </summary>
+## </param>
+#
+interface(`init_script_readable_type',`
+       gen_require(`
+               attribute init_script_readable;
+       ')
+
+       typeattribute $1 init_script_readable;
+')

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index cd2b0e4..6fd1d7f 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -935,12 +935,18 @@ optional_policy(`
 ')
 
 ifdef(`distro_gentoo',`
+       # Attribute to assign to types that the initrc_t domain needs read 
access to
+       attribute init_script_readable;
+
        #####################################
        #
        # Local initrc_t policy
        #
        allow initrc_t self:capability sys_admin;
 
+       read_files_pattern(initrc_t, init_script_readable, init_script_readable)
+       read_lnk_files_pattern(initrc_t, init_script_readable, 
init_script_readable)
+
        manage_dirs_pattern(initrc_t, initrc_var_run_t, initrc_var_run_t)
        files_pid_filetrans(initrc_t, initrc_var_run_t, dir)