commit: 61dedbfbae31d9ab77c89176a73b09cab9700c4e
Author: cgzones <cgzones <AT> googlemail <DOT> com>
AuthorDate: Wed Mar 8 20:21:44 2017 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Thu Mar 30 13:58:38 2017 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=61dedbfb
dphysswapfile: update
policy/modules/contrib/dphysswapfile.fc | 8 +++++---
policy/modules/contrib/dphysswapfile.if | 33 +++++++++++++++++++++++++++++++++
policy/modules/contrib/dphysswapfile.te | 6 +++++-
3 files changed, 43 insertions(+), 4 deletions(-)
diff --git a/policy/modules/contrib/dphysswapfile.fc
b/policy/modules/contrib/dphysswapfile.fc
index 3cf1968d..5c0feb83 100644
--- a/policy/modules/contrib/dphysswapfile.fc
+++ b/policy/modules/contrib/dphysswapfile.fc
@@ -1,5 +1,7 @@
-/etc/dphys-swapfile --
gen_context(system_u:object_r:dphysswapfile_conf_t,s0)
+/etc/dphys-swapfile --
gen_context(system_u:object_r:dphysswapfile_conf_t,s0)
-/usr/sbin/dphys-swapfile --
gen_context(system_u:object_r:dphysswapfile_exec_t,s0)
+/etc/rc\.d/init\.d/dphys-swapfile --
gen_context(system_u:object_r:dphysswapfile_initrc_exec_t,s0)
-/var/swap --
gen_context(system_u:object_r:dphysswapfile_swap_t,s0)
+/usr/sbin/dphys-swapfile --
gen_context(system_u:object_r:dphysswapfile_exec_t,s0)
+
+/var/swap --
gen_context(system_u:object_r:dphysswapfile_swap_t,s0)
diff --git a/policy/modules/contrib/dphysswapfile.if
b/policy/modules/contrib/dphysswapfile.if
index 53725743..7dda9553 100644
--- a/policy/modules/contrib/dphysswapfile.if
+++ b/policy/modules/contrib/dphysswapfile.if
@@ -17,3 +17,36 @@ interface(`dphysswapfile_dontaudit_read_swap',`
dontaudit $1 dphysswapfile_swap_t:file read_file_perms;
')
+
+########################################
+## <summary>
+## All of the rules required to
+## administrate an dphys-swapfile environment.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## Role allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`dphysswapfile_admin',`
+ gen_require(`
+ type dphysswapfile_t, dphysswapfile_conf_t;
+ type dphysswapfile_initrc_exec_t;
+ ')
+
+ admin_process_pattern($1, dphysswapfile_t)
+
+ init_startstop_service($1, $2, dphysswapfile_t,
dphysswapfile_initrc_exec_t)
+
+ files_search_etc($1)
+ admin_pattern($1, dphysswapfile_conf_t)
+
+ # do not grant access to swap file for now
+')
diff --git a/policy/modules/contrib/dphysswapfile.te
b/policy/modules/contrib/dphysswapfile.te
index 26faf67d..cb3d194f 100644
--- a/policy/modules/contrib/dphysswapfile.te
+++ b/policy/modules/contrib/dphysswapfile.te
@@ -12,6 +12,9 @@ init_system_domain(dphysswapfile_t, dphysswapfile_exec_t)
type dphysswapfile_conf_t;
files_config_file(dphysswapfile_conf_t)
+type dphysswapfile_initrc_exec_t;
+init_script_file(dphysswapfile_initrc_exec_t)
+
type dphysswapfile_swap_t;
files_type(dphysswapfile_swap_t)
@@ -20,7 +23,7 @@ files_type(dphysswapfile_swap_t)
# Policy
#
-# sys_admin : for swapon
+# sys_admin : swapon
allow dphysswapfile_t self:capability sys_admin;
allow dphysswapfile_t self:fifo_file rw_fifo_file_perms;
allow dphysswapfile_t self:unix_stream_socket { create connect };
@@ -36,6 +39,7 @@ kernel_read_system_state(dphysswapfile_t)
corecmd_exec_bin(dphysswapfile_t)
corecmd_exec_shell(dphysswapfile_t)
+# ignore ls -l /var/swap noise
files_dontaudit_getattr_pid_dirs(dphysswapfile_t)
files_read_etc_files(dphysswapfile_t)
files_search_var(dphysswapfile_t)
