commit: b7d31bbf66452be6655b7c32fc5a992c23807cb4
Author: Chris PeBenito <pebenito <AT> ieee <DOT> org>
AuthorDate: Tue Feb 16 14:30:13 2021 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Mar 21 21:38:23 2021 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=b7d31bbf
rpc: Move lines.
No rule changes.
Signed-off-by: Chris PeBenito <pebenito <AT> ieee.org>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/services/rpc.te | 189 ++++++++++++++++++++---------------------
1 file changed, 94 insertions(+), 95 deletions(-)
diff --git a/policy/modules/services/rpc.te b/policy/modules/services/rpc.te
index 5cacb381..37b57537 100644
--- a/policy/modules/services/rpc.te
+++ b/policy/modules/services/rpc.te
@@ -33,6 +33,13 @@ gen_tunable(allow_nfsd_anon_write, false)
attribute rpc_domain;
+rpc_domain_template(blkmapd)
+
+type blkmapd_runtime_t;
+files_runtime_file(blkmapd_runtime_t)
+files_runtime_filetrans(blkmapd_t, blkmapd_runtime_t, file, "blkmapd.pid")
+allow blkmapd_t blkmapd_runtime_t:file manage_file_perms;
+
type exports_t;
files_config_file(exports_t)
@@ -72,14 +79,6 @@ init_unit_file(nfsd_unit_t)
type var_lib_nfs_t;
files_mountpoint(var_lib_nfs_t)
-rpc_domain_template(blkmapd)
-
-type blkmapd_runtime_t;
-files_runtime_file(blkmapd_runtime_t)
-files_runtime_filetrans(blkmapd_t, blkmapd_runtime_t, file, "blkmapd.pid")
-allow blkmapd_t blkmapd_runtime_t:file manage_file_perms;
-
-
########################################
#
# Common rpc domain local policy
@@ -141,6 +140,93 @@ optional_policy(`
seutil_sigchld_newrole(rpc_domain)
')
+########################################
+#
+# BLKMAPD local policy
+#
+
+allow blkmapd_t self:capability sys_rawio;
+allow blkmapd_t self:unix_dgram_socket create_socket_perms;
+
+fs_list_rpc(blkmapd_t)
+storage_raw_read_fixed_disk(blkmapd_t)
+
+########################################
+#
+# GSSD local policy
+#
+
+allow gssd_t self:capability { dac_override dac_read_search setgid setuid
sys_nice };
+allow gssd_t self:process { getsched setsched };
+allow gssd_t self:fifo_file rw_fifo_file_perms;
+
+allow gssd_t gssd_keytab_t:file read_file_perms;
+
+manage_dirs_pattern(gssd_t, gssd_tmp_t, gssd_tmp_t)
+manage_files_pattern(gssd_t, gssd_tmp_t, gssd_tmp_t)
+files_tmp_filetrans(gssd_t, gssd_tmp_t, { file dir })
+
+kernel_read_network_state(gssd_t)
+kernel_read_network_state_symlinks(gssd_t)
+kernel_request_load_module(gssd_t)
+kernel_search_network_sysctl(gssd_t)
+kernel_signal(gssd_t)
+
+corecmd_exec_bin(gssd_t)
+
+fs_list_inotifyfs(gssd_t)
+fs_list_rpc(gssd_t)
+fs_rw_rpc_sockets(gssd_t)
+fs_read_rpc_files(gssd_t)
+fs_read_nfs_files(gssd_t)
+
+files_list_tmp(gssd_t)
+files_dontaudit_write_var_dirs(gssd_t)
+
+auth_manage_cache(gssd_t)
+
+miscfiles_read_generic_certs(gssd_t)
+miscfiles_read_generic_tls_privkey(gssd_t)
+
+userdom_signal_all_users(gssd_t)
+
+tunable_policy(`allow_gssd_read_tmp',`
+ userdom_list_user_tmp(gssd_t)
+ userdom_read_user_tmp_files(gssd_t)
+ userdom_read_user_tmp_symlinks(gssd_t)
+')
+
+tunable_policy(`allow_gssd_write_tmp',`
+ userdom_list_user_tmp(gssd_t)
+ userdom_rw_user_tmp_files(gssd_t)
+')
+
+optional_policy(`
+ automount_signal(gssd_t)
+')
+
+optional_policy(`
+ gssproxy_stream_connect(gssd_t)
+')
+optional_policy(`
+ kerberos_manage_host_rcache(gssd_t)
+ kerberos_read_keytab(gssd_t)
+ kerberos_tmp_filetrans_host_rcache(gssd_t, file, "nfs_0")
+ kerberos_use(gssd_t)
+')
+
+optional_policy(`
+ mount_signal(gssd_t)
+')
+
+optional_policy(`
+ pcscd_read_runtime_files(gssd_t)
+')
+
+optional_policy(`
+ xserver_rw_xdm_tmp_files(gssd_t)
+')
+
########################################
#
# Local policy
@@ -287,90 +373,3 @@ tunable_policy(`nfs_export_all_ro',`
optional_policy(`
mount_exec(nfsd_t)
')
-
-########################################
-#
-# BLKMAPD local policy
-#
-
-allow blkmapd_t self:capability sys_rawio;
-allow blkmapd_t self:unix_dgram_socket create_socket_perms;
-
-fs_list_rpc(blkmapd_t)
-storage_raw_read_fixed_disk(blkmapd_t)
-
-########################################
-#
-# GSSD local policy
-#
-
-allow gssd_t self:capability { dac_override dac_read_search setgid setuid
sys_nice };
-allow gssd_t self:process { getsched setsched };
-allow gssd_t self:fifo_file rw_fifo_file_perms;
-
-allow gssd_t gssd_keytab_t:file read_file_perms;
-
-manage_dirs_pattern(gssd_t, gssd_tmp_t, gssd_tmp_t)
-manage_files_pattern(gssd_t, gssd_tmp_t, gssd_tmp_t)
-files_tmp_filetrans(gssd_t, gssd_tmp_t, { file dir })
-
-kernel_read_network_state(gssd_t)
-kernel_read_network_state_symlinks(gssd_t)
-kernel_request_load_module(gssd_t)
-kernel_search_network_sysctl(gssd_t)
-kernel_signal(gssd_t)
-
-corecmd_exec_bin(gssd_t)
-
-fs_list_inotifyfs(gssd_t)
-fs_list_rpc(gssd_t)
-fs_rw_rpc_sockets(gssd_t)
-fs_read_rpc_files(gssd_t)
-fs_read_nfs_files(gssd_t)
-
-files_list_tmp(gssd_t)
-files_dontaudit_write_var_dirs(gssd_t)
-
-auth_manage_cache(gssd_t)
-
-miscfiles_read_generic_certs(gssd_t)
-miscfiles_read_generic_tls_privkey(gssd_t)
-
-userdom_signal_all_users(gssd_t)
-
-tunable_policy(`allow_gssd_read_tmp',`
- userdom_list_user_tmp(gssd_t)
- userdom_read_user_tmp_files(gssd_t)
- userdom_read_user_tmp_symlinks(gssd_t)
-')
-
-tunable_policy(`allow_gssd_write_tmp',`
- userdom_list_user_tmp(gssd_t)
- userdom_rw_user_tmp_files(gssd_t)
-')
-
-optional_policy(`
- automount_signal(gssd_t)
-')
-
-optional_policy(`
- gssproxy_stream_connect(gssd_t)
-')
-optional_policy(`
- kerberos_manage_host_rcache(gssd_t)
- kerberos_read_keytab(gssd_t)
- kerberos_tmp_filetrans_host_rcache(gssd_t, file, "nfs_0")
- kerberos_use(gssd_t)
-')
-
-optional_policy(`
- mount_signal(gssd_t)
-')
-
-optional_policy(`
- pcscd_read_runtime_files(gssd_t)
-')
-
-optional_policy(`
- xserver_rw_xdm_tmp_files(gssd_t)
-')
