[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/roles/, policy/modules/apps/
commit: 90ed6629790f8ed980e3419b017c49dc6b6bdce9 Author: Jason Zaman gentoo org> AuthorDate: Sat Nov 20 23:32:17 2021 + Commit: Jason Zaman gentoo org> CommitDate: Sun Nov 21 01:09:03 2021 + URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=90ed6629 pulseaudio: Remove gentoo-specific interfaces pulseaudio_client_domain and pulseaudio_role were changed upstream to have more args. pulseaudio_client_domain was previously deprecated and unused in gentoo. Signed-off-by: Jason Zaman gentoo.org> policy/modules/apps/pulseaudio.if | 26 -- policy/modules/roles/staff.te | 4 policy/modules/roles/unprivuser.te | 4 3 files changed, 34 deletions(-) diff --git a/policy/modules/apps/pulseaudio.if b/policy/modules/apps/pulseaudio.if index 1796b771..b2d2f1d4 100644 --- a/policy/modules/apps/pulseaudio.if +++ b/policy/modules/apps/pulseaudio.if @@ -427,29 +427,3 @@ interface(`pulseaudio_rw_tmpfs_files',` fs_search_tmpfs($1) rw_files_pattern($1, pulseaudio_tmpfs_t, pulseaudio_tmpfs_t) ') - -# Below are Gentoo specifics but ifdef distro_gentoo cannot be used in interfaces - - -## -## Mark the specified domain as a PulseAudio client domain -## and the related tmpfs file type as a (shared) PulseAudio tmpfs -## file type used for the shared memory access -## -## -## -## Domain to become a PulseAudio client domain -## -## -## -## -## Tmpfs type used for shared memory of the given domain -## -## -# -interface(`pulseaudio_client_domain',` - refpolicywarn(`$0($*) has been deprecated') - - pulseaudio_domtrans($1) - pulseaudio_tmpfs_content($2) -') diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te index 3ac0650c..29f68027 100644 --- a/policy/modules/roles/staff.te +++ b/policy/modules/roles/staff.te @@ -260,10 +260,6 @@ ifdef(`distro_gentoo',` pan_role(staff_r, staff_t) ') - optional_policy(` - pulseaudio_role(staff_r, staff_t) - ') - optional_policy(` rtorrent_role(staff_r, staff_t) ') diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te index 249215b4..32c928d7 100644 --- a/policy/modules/roles/unprivuser.te +++ b/policy/modules/roles/unprivuser.te @@ -239,10 +239,6 @@ ifdef(`distro_gentoo',` pan_role(user_r, user_t) ') - optional_policy(` - pulseaudio_role(user_r, user_t) - ') - optional_policy(` rtorrent_role(user_r, user_t) ')
[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/roles/, policy/modules/apps/, policy/modules/admin/, ...
commit: 2742f6963821a93736cfce494abb24a44fdde15d Author: Chris PeBenito ieee org> AuthorDate: Wed Feb 3 13:38:26 2021 + Commit: Jason Zaman gentoo org> CommitDate: Sat Feb 6 21:15:10 2021 + URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=2742f696 Bump module versions for release. Signed-off-by: Chris PeBenito ieee.org> Signed-off-by: Jason Zaman gentoo.org> policy/modules/admin/acct.te | 2 +- policy/modules/admin/alsa.te | 2 +- policy/modules/admin/apt.te | 2 +- policy/modules/admin/bootloader.te| 2 +- policy/modules/admin/consoletype.te | 2 +- policy/modules/admin/ddcprobe.te | 2 +- policy/modules/admin/dmesg.te | 2 +- policy/modules/admin/dphysswapfile.te | 2 +- policy/modules/admin/dpkg.te | 2 +- policy/modules/admin/fakehwclock.te | 2 +- policy/modules/admin/firstboot.te | 2 +- policy/modules/admin/logrotate.te | 2 +- policy/modules/admin/mrtg.te | 2 +- policy/modules/admin/netutils.te | 2 +- policy/modules/admin/portage.te | 2 +- policy/modules/admin/quota.te | 2 +- policy/modules/admin/rpm.te | 2 +- policy/modules/admin/sosreport.te | 2 +- policy/modules/admin/sudo.te | 2 +- policy/modules/admin/sxid.te | 2 +- policy/modules/admin/updfstab.te | 2 +- policy/modules/admin/usbmodules.te| 2 +- policy/modules/admin/vbetool.te | 2 +- policy/modules/apps/chromium.te | 2 +- policy/modules/apps/cpufreqselector.te| 2 +- policy/modules/apps/evolution.te | 2 +- policy/modules/apps/games.te | 2 +- policy/modules/apps/gpg.te| 2 +- policy/modules/apps/livecd.te | 2 +- policy/modules/apps/loadkeys.te | 2 +- policy/modules/apps/mono.te | 2 +- policy/modules/apps/mozilla.te| 2 +- policy/modules/apps/mplayer.te| 2 +- policy/modules/apps/pulseaudio.te | 2 +- policy/modules/apps/screen.te | 2 +- policy/modules/apps/uml.te| 2 +- policy/modules/apps/vmware.te | 2 +- policy/modules/apps/wine.te | 2 +- policy/modules/apps/wm.te | 2 +- policy/modules/kernel/corecommands.te | 2 +- policy/modules/kernel/corenetwork.te.in | 2 +- policy/modules/kernel/devices.te | 2 +- policy/modules/kernel/files.te| 2 +- policy/modules/kernel/filesystem.te | 2 +- policy/modules/kernel/kernel.te | 2 +- policy/modules/kernel/mls.te | 2 +- policy/modules/kernel/selinux.te | 2 +- policy/modules/kernel/storage.te | 2 +- policy/modules/kernel/terminal.te | 2 +- policy/modules/roles/staff.te | 2 +- policy/modules/roles/sysadm.te| 2 +- policy/modules/roles/unprivuser.te| 2 +- policy/modules/roles/xguest.te| 2 +- policy/modules/services/accountsd.te | 2 +- policy/modules/services/acpi.te | 2 +- policy/modules/services/afs.te| 2 +- policy/modules/services/apache.te | 2 +- policy/modules/services/aptcacher.te | 2 +- policy/modules/services/arpwatch.te | 2 +- policy/modules/services/asterisk.te | 2 +- policy/modules/services/automount.te | 2 +- policy/modules/services/avahi.te | 2 +- policy/modules/services/bind.te | 2 +- policy/modules/services/bluetooth.te | 2 +- policy/modules/services/boinc.te | 2 +- policy/modules/services/canna.te | 2 +- policy/modules/services/certbot.te| 2 +- policy/modules/services/cipe.te | 2 +- policy/modules/services/clamav.te | 2 +- policy/modules/services/colord.te | 2 +- policy/modules/services/corosync.te | 2 +- policy/modules/services/courier.te| 2 +- policy/modules/services/cpucontrol.te | 2 +- policy/modules/services/cron.te | 2 +- policy/modules/services/cups.te | 2 +- policy/modules/services/cyrus.te | 2 +- policy/modules/services/dante.te | 2 +- policy/modules/services/dbus.te | 2 +- policy/modules/services/dcc.te| 2 +- policy/modules/services/ddclient.te | 2 +- policy/modules/services/devicekit.te | 2 +- policy/modules/services/dhcp.te | 2 +- policy/modules/services/dictd.te | 2 +- policy/modules/services/dirmngr.te| 2 +- policy/modules/services/distcc.te | 2 +- policy/modules/services/dkim.te | 2 +- policy/modules/services/dnsmasq.te| 2 +- policy/modules/services/dovecot.te| 2 +- policy/modules/services/entropyd.te | 2 +- policy/modules/services/fail2ban.te | 2 +- policy/modules/services/fetchmail.te | 2 +- policy/modules/services/fin
[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/roles/, policy/modules/apps/
commit: 60e0d1b33e0be37edd4e8971e3b2cd67966574ab
Author: Russell Coker coker com au>
AuthorDate: Mon Jan 28 08:46:49 2019 +
Commit: Jason Zaman gentoo org>
CommitDate: Sun Feb 10 04:11:25 2019 +
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=60e0d1b3
chromium
There are several nacl binaries that need labels.
Put an ifdef debian for some chromium paths.
Git policy misses chromium_role() lines, were they in another patch that was
submitted at the same time?
I don't know what this is for but doesn't seem harmful to allow it:
type=PROCTITLE msg=audit(28/01/19 19:31:42.361:3218) : proctitle=/bin/bash
/usr/bin/google-chrome
type=SYSCALL msg=audit(28/01/19 19:31:42.361:3218) : arch=x86_64 syscall=openat
success=yes exit=3 a0=0xff9c a1=0x563328f7b590 a2=O_WRONLY|O_CREAT|O_TRUNC
a3=0x1b6 items=0 ppid=5158 pid=5166 auid=test uid=test gid=test euid=test
suid=test fsuid=test egid=test sgid=test fsgid=test tty=pts7 ses=232
comm=google-chrome exe=/bin/bash subj=user_u:user_r:chromium_t:s0 key=(null)
type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { associate }
for pid=5166 comm=google-chrome name=63 scontext=user_u:object_r:chromium_t:s0
tcontext=system_u:object_r:proc_t:s0 tclass=filesystem
type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { create } for
pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0
tcontext=user_u:object_r:chromium_t:s0 tclass=file
type=AVC msg=audit(28/01/19 19:31:42.361:3218) : avc: granted { add_name }
for pid=5166 comm=google-chrome name=63 scontext=user_u:user_r:chromium_t:s0
tcontext=user_u:user_r:chromium_t:s0 tclass=dir
Allow domain_use_interactive_fds() for running via ssh -X.
Allow managing xdg data, cache, and config.
Allow reading public data from apt and dpkg, probably from lsb_release or some
other shell script.
How does the whold naclhelper thing work anyway? I'm nervous about process
share access involving chromium_sandbox_t, is that really what we want?
Added lots of other stuff like searching cgroup dirs etc.
Signed-off-by: Jason Zaman perfinion.com>
policy/modules/apps/chromium.fc| 7 ++-
policy/modules/apps/chromium.te| 32 +++-
policy/modules/roles/staff.te | 4
policy/modules/roles/sysadm.te | 4
policy/modules/roles/unprivuser.te | 4
5 files changed, 45 insertions(+), 6 deletions(-)
diff --git a/policy/modules/apps/chromium.fc b/policy/modules/apps/chromium.fc
index 534235dc..58a6cb45 100644
--- a/policy/modules/apps/chromium.fc
+++ b/policy/modules/apps/chromium.fc
@@ -2,7 +2,7 @@
/opt/google/chrome/chrome_sandbox --
gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
/opt/google/chrome/chrome-sandbox --
gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
/opt/google/chrome/google-chrome --
gen_context(system_u:object_r:chromium_exec_t,s0)
-/opt/google/chrome/nacl_helper_bootstrap --
gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0)
+/opt/google/chrome/nacl_.* --
gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0)
/opt/google/chrome/libudev.so.0
gen_context(system_u:object_r:lib_t,s0)
/opt/google/chrome-beta/chrome --
gen_context(system_u:object_r:chromium_exec_t,s0)
@@ -19,9 +19,14 @@
/opt/google/chrome-unstable/nacl_helper_bootstrap --
gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0)
/opt/google/chrome-unstable/libudev.so.0
gen_context(system_u:object_r:lib_t,s0)
+ifdef(`distro_debian',`
+/usr/lib/chromium/chromium --
gen_context(system_u:object_r:chromium_exec_t,s0)
+/usr/lib/chromium/chrome-sandbox --
gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
+', `
/usr/lib/chromium-browser/chrome --
gen_context(system_u:object_r:chromium_exec_t,s0)
/usr/lib/chromium-browser/chrome_sandbox --
gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
/usr/lib/chromium-browser/chrome-sandbox --
gen_context(system_u:object_r:chromium_sandbox_exec_t,s0)
+')
/usr/lib/chromium-browser/chromium-launcher\.sh--
gen_context(system_u:object_r:chromium_exec_t,s0)
/usr/lib/chromium-browser/nacl_helper_bootstrap--
gen_context(system_u:object_r:chromium_naclhelper_exec_t,s0)
diff --git a/policy/modules/apps/chromium.te b/policy/modules/apps/chromium.te
index 59c75491..7a18d814 100644
--- a/policy/modules/apps/chromium.te
+++ b/policy/modules/apps/chromium.te
@@ -94,8 +94,8 @@ allow chromium_t chromium_renderer_t:shm rw_shm_perms;
allow chromium_t chromium_renderer_t:unix_dgram_socket { read write };
allow
