Bulk addition of new selinux policies.

(Portage version: 2.1.9.25/cvs/Linux x86_64)

4 files changed, 107 insertions, 0 deletions

diff --git a/sec-policy/selinux-gorg/ChangeLog b/sec-policy/selinux-gorg/ChangeLog
new file mode 100644
index 000000000000..087f7dd422e9
--- /dev/null
+++ b/sec-policy/selinux-gorg/ChangeLog
@@ -0,0 +1,13 @@
+# ChangeLog for sec-policy/selinux-gorg
+# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-gorg/ChangeLog,v 1.1 2011/02/05 20:41:04 blueness Exp $
+
+  05 Feb 2011; Anthony G. Basile <blueness@gentoo.org> ChangeLog:
+  Initial commit to portage.
+
+*selinux-gorg-2.20101213 (07 Jan 2011)
+
+  07 Jan 2011; <swift@gentoo.org> +selinux-gorg-2.20101213.ebuild,
+  +files/add-gorg.patch:
+  Adding gorg module
+
diff --git a/sec-policy/selinux-gorg/files/add-gorg.patch b/sec-policy/selinux-gorg/files/add-gorg.patch
new file mode 100644
index 000000000000..71e8cb10d02c
--- /dev/null
+++ b/sec-policy/selinux-gorg/files/add-gorg.patch
@@ -0,0 +1,68 @@
+--- services/gorg.te	1970-01-01 01:00:00.000000000 +0100
++++ ../../../refpolicy/policy/modules/services/gorg.te	2011-01-07 22:35:18.986000107 +0100
+@@ -0,0 +1,59 @@
++policy_module(gorg, 1.0.0)
++
++type gorg_t;
++type gorg_exec_t;
++typealias gorg_t alias { staff_gorg_t user_gorg_t };
++application_domain(gorg_t, gorg_exec_t)
++role staff_r types gorg_t;
++role user_r types gorg_t;
++
++type gorg_cache_t;
++files_type(gorg_cache_t);
++
++type gorg_config_t;
++files_type(gorg_config_t);
++
++# Allow gorg_t to put files in the gorg_cache_t location(s)
++manage_dirs_pattern(gorg_t, gorg_cache_t, gorg_cache_t)
++manage_files_pattern(gorg_t, gorg_cache_t, gorg_cache_t)
++
++# Allow gorg_t to read configuration file(s)
++allow gorg_t gorg_config_t:dir list_dir_perms;
++read_files_pattern(gorg_t, gorg_config_t, gorg_config_t)
++
++# gorg logs through /dev/log
++logging_send_syslog_msg(gorg_t)
++
++# Allow gorg to bind to port 8080 (http_cache_port_t)
++sysnet_read_config(gorg_t)
++sysnet_dns_name_resolve(gorg_t)
++corenet_all_recvfrom_unlabeled(gorg_t)
++corenet_all_recvfrom_netlabel(gorg_t)
++corenet_tcp_sendrecv_generic_if(gorg_t)
++corenet_tcp_sendrecv_generic_node(gorg_t)
++#corenet_tcp_sendrecv_all_ports(gorg_t)
++corenet_tcp_bind_generic_node(gorg_t)
++corenet_tcp_bind_http_cache_port(gorg_t)
++allow gorg_t self:netlink_route_socket { create_socket_perms nlmsg_read };
++allow gorg_t self:tcp_socket { listen accept };
++
++# Allow gorg read access to user home files (usually where cvs/git pull is stored)
++files_search_home(gorg_t)
++userdom_search_user_home_dirs(gorg_t)
++userdom_user_home_content(gorg_t)
++userdom_list_user_home_content(gorg_t)
++userdom_read_user_home_content_symlinks(gorg_t)
++userdom_read_user_home_content_files(gorg_t)
++
++# Local policy
++allow gorg_t self:fifo_file rw_fifo_file_perms;
++
++# Read /etc files (xml/catalog, hosts.conf, ...)
++files_read_etc_files(gorg_t)
++
++# Gorg is ruby, so be able to execute ruby
++corecmd_exec_bin(gorg_t)
++
++# Output to screen
++userdom_use_user_terminals(gorg_t)
++domain_use_interactive_fds(gorg_t)
+--- services/gorg.fc	1970-01-01 01:00:00.000000000 +0100
++++ ../../../refpolicy/policy/modules/services/gorg.fc	2011-01-07 22:35:22.840999786 +0100
+@@ -0,0 +1,3 @@
++/etc/gorg(/.*)?				gen_context(system_u:object_r:gorg_config_t,s0)
++/var/cache/gorg(/.*)?			gen_context(system_u:object_r:gorg_cache_t,s0)
++/usr/bin/gorg			--	gen_context(system_u:object_r:gorg_exec_t,s0)
diff --git a/sec-policy/selinux-gorg/metadata.xml b/sec-policy/selinux-gorg/metadata.xml
new file mode 100644
index 000000000000..22e4e153f44e
--- /dev/null
+++ b/sec-policy/selinux-gorg/metadata.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<herd>hardened</herd>
+<maintainer>
+  <email>selinux@gentoo.org</email>
+</maintainer>
+<longdescription>Gentoo SELinux policy for gorg.</longdescription>
+</pkgmetadata>
+
diff --git a/sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild b/sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild
new file mode 100644
index 000000000000..45edb5aba2bf
--- /dev/null
+++ b/sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild
@@ -0,0 +1,16 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild,v 1.1 2011/02/05 20:41:04 blueness Exp $
+
+IUSE=""
+
+MODS="gorg"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for general applications"
+
+KEYWORDS="~amd64 ~x86"
+
+POLICY_PATCH="${FILESDIR}/add-gorg.patch"
+RDEPEND=">=sec-policy/selinux-base-policy-2.20101213-r3"