commit: 7601edab81d7dd32ebe8270c7cd3ac17b0f28431
Author: Chris PeBenito <pebenito <AT> ieee <DOT> org>
AuthorDate: Sun Oct 9 11:47:09 2016 +0000
Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org>
CommitDate: Mon Oct 24 15:57:32 2016 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=7601edab
Rearrange lines in syncthing.
Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>
syncthing.if | 19 +++++++++----------
syncthing.te | 20 +++++++-------------
2 files changed, 16 insertions(+), 23 deletions(-)
diff --git a/syncthing.if b/syncthing.if
index d71fdaa..065800a 100644
--- a/syncthing.if
+++ b/syncthing.if
@@ -16,17 +16,16 @@
## </param>
#
interface(`syncthing_role', `
+ gen_require(`
+ attribute_role syncthing_roles;
+ type syncthing_t, syncthing_exec_t, syncthing_config_home_t;
+ ')
- gen_require(`
- attribute_role syncthing_roles;
- type syncthing_t, syncthing_exec_t, syncthing_config_home_t;
- ')
+ roleattribute $1 syncthing_roles;
- roleattribute $1 syncthing_roles;
+ domtrans_pattern($2, syncthing_exec_t, syncthing_t)
- domtrans_pattern($2, syncthing_exec_t, syncthing_t)
-
- allow $2 syncthing_config_home_t:file { manage_file_perms
relabel_file_perms };
- allow $2 syncthing_config_home_t:dir { manage_dir_perms relabel_dir_perms
};
- allow $2 syncthing_config_home_t:lnk_file { manage_lnk_file_perms
relabel_lnk_file_perms };
+ allow $2 syncthing_config_home_t:file { manage_file_perms
relabel_file_perms };
+ allow $2 syncthing_config_home_t:dir { manage_dir_perms
relabel_dir_perms };
+ allow $2 syncthing_config_home_t:lnk_file { manage_lnk_file_perms
relabel_lnk_file_perms };
')
diff --git a/syncthing.te b/syncthing.te
index 8144389..92d0bf5 100644
--- a/syncthing.te
+++ b/syncthing.te
@@ -27,23 +27,23 @@ allow syncthing_t self:tcp_socket { listen accept };
can_exec(syncthing_t, syncthing_exec_t)
+manage_dirs_pattern(syncthing_t, syncthing_config_home_t,
syncthing_config_home_t)
+manage_files_pattern(syncthing_t, syncthing_config_home_t,
syncthing_config_home_t)
+manage_lnk_files_pattern(syncthing_t, syncthing_config_home_t,
syncthing_config_home_t)
+
kernel_read_kernel_sysctls(syncthing_t)
kernel_read_net_sysctls(syncthing_t)
kernel_read_system_state(syncthing_t)
corenet_tcp_sendrecv_generic_if(syncthing_t)
corenet_udp_sendrecv_generic_if(syncthing_t)
-
corenet_tcp_bind_generic_node(syncthing_t)
corenet_tcp_sendrecv_generic_node(syncthing_t)
corenet_tcp_sendrecv_all_ports(syncthing_t)
-
corenet_udp_bind_generic_node(syncthing_t)
corenet_udp_sendrecv_generic_node(syncthing_t)
corenet_udp_sendrecv_all_ports(syncthing_t)
-
corenet_tcp_connect_all_ports(syncthing_t)
-
corenet_tcp_bind_syncthing_port(syncthing_t)
corenet_udp_bind_syncthing_discovery_port(syncthing_t)
corenet_tcp_bind_syncthing_admin_port(syncthing_t)
@@ -55,10 +55,6 @@ fs_getattr_xattr_fs(syncthing_t)
auth_use_nsswitch(syncthing_t)
-manage_dirs_pattern(syncthing_t, syncthing_config_home_t,
syncthing_config_home_t)
-manage_files_pattern(syncthing_t, syncthing_config_home_t,
syncthing_config_home_t)
-manage_lnk_files_pattern(syncthing_t, syncthing_config_home_t,
syncthing_config_home_t)
-
miscfiles_read_generic_certs(syncthing_t)
miscfiles_read_localization(syncthing_t)
@@ -66,13 +62,11 @@ userdom_manage_user_home_content_files(syncthing_t)
userdom_manage_user_home_content_dirs(syncthing_t)
userdom_manage_user_home_content_symlinks(syncthing_t)
userdom_user_home_dir_filetrans_user_home_content(syncthing_t, dir)
-
+userdom_use_user_terminals(syncthing_t)
# newly created files in ~/.config/syncthing/ will transition to
syncthing_config_home_t
userdom_user_home_content_filetrans(syncthing_t, syncthing_config_home_t, dir,
"syncthing")
-userdom_use_user_terminals(syncthing_t)
-
optional_policy(`
- # temporary hack for /run/NetworkManager/resolv.conf until we make this
part of sysnet_dns_name_resolve()
- networkmanager_read_pid_files(syncthing_t)
+ # temporary hack for /run/NetworkManager/resolv.conf until we make this
part of sysnet_dns_name_resolve()
+ networkmanager_read_pid_files(syncthing_t)
')
