[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/modules/kernel/, policy/modules/system/

[Jason Zaman]

commit:     df80c8bf3a5c5e581370d75bf6ea5154a8b02b0b
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Sun Sep 10 13:00:36 2017 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Sep 10 13:00:36 2017 +0000
URL:        
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=df80c8bf

Allow sysadm to map all non auth files

 policy/modules/kernel/files.if      | 20 ++++++++++++++++++++
 policy/modules/system/userdomain.if |  1 +
 2 files changed, 21 insertions(+)

diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
index f2b76f86..35dcfe7b 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -1474,6 +1474,26 @@ interface(`files_manage_non_auth_files',`
 
 ########################################
 ## <summary>
+##     Mmap non-authentication related
+##     files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+## <rolecap/>
+#
+interface(`files_map_non_auth_files',`
+       gen_require(`
+               attribute non_auth_file_type;
+       ')
+
+       allow $1 non_auth_file_type:file map;
+')
+
+########################################
+## <summary>
 ##     Relabel all non-authentication related
 ##     files.
 ## </summary>

diff --git a/policy/modules/system/userdomain.if 
b/policy/modules/system/userdomain.if
index 84e9c57e..16789a3c 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -1256,6 +1256,7 @@ template(`userdom_admin_user_template',`
        auth_getattr_shadow($1_t)
        # Manage almost all files
        files_manage_non_auth_files($1_t)
+       files_map_non_auth_files($1_t)
        # Relabel almost all files
        files_relabel_non_auth_files($1_t)