[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/services/

[Jason Zaman]

commit:     8d0a8683e0532596db43884e8116ec390b33cb67
Author:     Russell Coker <russell <AT> coker <DOT> com <DOT> au>
AuthorDate: Tue Jun 17 12:47:19 2025 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Tue Jul 15 07:52:23 2025 +0000
URL:        
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=8d0a8683

Some small phone related patches

Signed-off-by: Russell Coker <russell <AT> coker.com.au>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/services/eg25manager.te  |  1 +
 policy/modules/services/geoclue.te      | 20 ++++++++++++++++++++
 policy/modules/services/gpsd.te         |  2 +-
 policy/modules/services/modemmanager.te |  2 +-
 4 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/policy/modules/services/eg25manager.te 
b/policy/modules/services/eg25manager.te
index e7d8f21cc..4db942a7d 100644
--- a/policy/modules/services/eg25manager.te
+++ b/policy/modules/services/eg25manager.te
@@ -34,6 +34,7 @@ allow eg25manager_t self:process { getsched setsched signal };
 allow eg25manager_t self:tcp_socket { connect create getattr getopt read 
setopt write };
 allow eg25manager_t self:udp_socket { connect create getattr read setopt write 
};
 allow eg25manager_t self:unix_dgram_socket { create write };
+allow eg25manager_t self:fifo_file rw_fifo_file_perms;
 
 files_tmp_filetrans(eg25manager_t, eg25manager_tmp_t, { file })
 allow eg25manager_t eg25manager_tmp_t:file manage_file_perms;

diff --git a/policy/modules/services/geoclue.te 
b/policy/modules/services/geoclue.te
index 331485878..c2060242f 100644
--- a/policy/modules/services/geoclue.te
+++ b/policy/modules/services/geoclue.te
@@ -20,9 +20,16 @@ files_type(geoclue_var_lib_t)
 # Local policy
 #
 
+allow geoclue_t self:process getsched;
+
 read_files_pattern(geoclue_t, geoclue_etc_t, geoclue_etc_t)
+allow geoclue_t geoclue_etc_t:dir list_dir_perms;
+
+allow geoclue_t geoclue_var_lib_t:dir rw_dir_perms;
 
 kernel_read_kernel_sysctls(geoclue_t)
+kernel_read_net_sysctls(geoclue_t)
+kernel_read_system_state(geoclue_t)
 
 corenet_tcp_connect_http_port(geoclue_t)
 
@@ -30,6 +37,10 @@ dev_read_urand(geoclue_t)
 
 auth_use_nsswitch(geoclue_t)
 
+files_read_usr_files(geoclue_t)
+files_map_usr_files(geoclue_t)
+files_watch_etc_dirs(geoclue_t)
+
 logging_send_syslog_msg(geoclue_t)
 
 miscfiles_read_generic_certs(geoclue_t)
@@ -50,3 +61,12 @@ optional_policy(`
 optional_policy(`
        modemmanager_dbus_chat(geoclue_t)
 ')
+
+optional_policy(`
+       unconfined_dbus_send(geoclue_t)
+')
+
+optional_policy(`
+       xserver_dbus_chat_xdm(geoclue_t)
+       xserver_read_xdm_state(geoclue_t)
+')

diff --git a/policy/modules/services/gpsd.te b/policy/modules/services/gpsd.te
index 3e603b78b..a86262fa9 100644
--- a/policy/modules/services/gpsd.te
+++ b/policy/modules/services/gpsd.te
@@ -29,7 +29,7 @@ files_tmpfs_file(gpsd_tmpfs_t)
 
 allow gpsd_t self:capability { fowner fsetid setgid setuid sys_nice sys_time 
sys_tty_config };
 dontaudit gpsd_t self:capability { dac_override dac_read_search };
-allow gpsd_t self:process { setsched signal_perms };
+allow gpsd_t self:process { getsession setsched signal_perms };
 allow gpsd_t self:shm create_shm_perms;
 allow gpsd_t self:unix_dgram_socket sendto;
 allow gpsd_t self:tcp_socket { accept listen };

diff --git a/policy/modules/services/modemmanager.te 
b/policy/modules/services/modemmanager.te
index f21b33c82..15387558c 100644
--- a/policy/modules/services/modemmanager.te
+++ b/policy/modules/services/modemmanager.te
@@ -19,7 +19,7 @@ allow modemmanager_t self:process { getsched setpgid setsched 
signal };
 allow modemmanager_t self:fifo_file rw_fifo_file_perms;
 allow modemmanager_t self:unix_stream_socket { connectto 
create_stream_socket_perms };
 allow modemmanager_t self:netlink_kobject_uevent_socket create_socket_perms;
-allow modemmanager_t self:netlink_route_socket { create getattr getopt 
nlmsg_write read write };
+allow modemmanager_t self:netlink_route_socket { create getattr getopt setopt 
nlmsg_write read write };
 allow modemmanager_t self:qipcrtr_socket { create getattr getopt read write };
 
 # ModemManager  calls mmap(PROT_READ|PROT_WRITE|PROT_EXEC)