From 7297073f9ae00bd1ff8f3261597591a9d73c2788 Mon Sep 17 00:00:00 2001 From: "Anthony G. Basile" Date: Sat, 5 Feb 2011 20:41:06 +0000 Subject: Bulk addition of new selinux policies. (Portage version: 2.1.9.25/cvs/Linux x86_64) --- sec-policy/selinux-gorg/ChangeLog | 13 +++++ sec-policy/selinux-gorg/files/add-gorg.patch | 68 ++++++++++++++++++++++ sec-policy/selinux-gorg/metadata.xml | 10 ++++ .../selinux-gorg/selinux-gorg-2.20101213.ebuild | 16 +++++ 4 files changed, 107 insertions(+) create mode 100644 sec-policy/selinux-gorg/ChangeLog create mode 100644 sec-policy/selinux-gorg/files/add-gorg.patch create mode 100644 sec-policy/selinux-gorg/metadata.xml create mode 100644 sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild (limited to 'sec-policy/selinux-gorg') diff --git a/sec-policy/selinux-gorg/ChangeLog b/sec-policy/selinux-gorg/ChangeLog new file mode 100644 index 000000000000..087f7dd422e9 --- /dev/null +++ b/sec-policy/selinux-gorg/ChangeLog @@ -0,0 +1,13 @@ +# ChangeLog for sec-policy/selinux-gorg +# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-gorg/ChangeLog,v 1.1 2011/02/05 20:41:04 blueness Exp $ + + 05 Feb 2011; Anthony G. Basile ChangeLog: + Initial commit to portage. + +*selinux-gorg-2.20101213 (07 Jan 2011) + + 07 Jan 2011; +selinux-gorg-2.20101213.ebuild, + +files/add-gorg.patch: + Adding gorg module + diff --git a/sec-policy/selinux-gorg/files/add-gorg.patch b/sec-policy/selinux-gorg/files/add-gorg.patch new file mode 100644 index 000000000000..71e8cb10d02c --- /dev/null +++ b/sec-policy/selinux-gorg/files/add-gorg.patch @@ -0,0 +1,68 @@ +--- services/gorg.te 1970-01-01 01:00:00.000000000 +0100 ++++ ../../../refpolicy/policy/modules/services/gorg.te 2011-01-07 22:35:18.986000107 +0100 +@@ -0,0 +1,59 @@ ++policy_module(gorg, 1.0.0) ++ ++type gorg_t; ++type gorg_exec_t; ++typealias gorg_t alias { staff_gorg_t user_gorg_t }; ++application_domain(gorg_t, gorg_exec_t) ++role staff_r types gorg_t; ++role user_r types gorg_t; ++ ++type gorg_cache_t; ++files_type(gorg_cache_t); ++ ++type gorg_config_t; ++files_type(gorg_config_t); ++ ++# Allow gorg_t to put files in the gorg_cache_t location(s) ++manage_dirs_pattern(gorg_t, gorg_cache_t, gorg_cache_t) ++manage_files_pattern(gorg_t, gorg_cache_t, gorg_cache_t) ++ ++# Allow gorg_t to read configuration file(s) ++allow gorg_t gorg_config_t:dir list_dir_perms; ++read_files_pattern(gorg_t, gorg_config_t, gorg_config_t) ++ ++# gorg logs through /dev/log ++logging_send_syslog_msg(gorg_t) ++ ++# Allow gorg to bind to port 8080 (http_cache_port_t) ++sysnet_read_config(gorg_t) ++sysnet_dns_name_resolve(gorg_t) ++corenet_all_recvfrom_unlabeled(gorg_t) ++corenet_all_recvfrom_netlabel(gorg_t) ++corenet_tcp_sendrecv_generic_if(gorg_t) ++corenet_tcp_sendrecv_generic_node(gorg_t) ++#corenet_tcp_sendrecv_all_ports(gorg_t) ++corenet_tcp_bind_generic_node(gorg_t) ++corenet_tcp_bind_http_cache_port(gorg_t) ++allow gorg_t self:netlink_route_socket { create_socket_perms nlmsg_read }; ++allow gorg_t self:tcp_socket { listen accept }; ++ ++# Allow gorg read access to user home files (usually where cvs/git pull is stored) ++files_search_home(gorg_t) ++userdom_search_user_home_dirs(gorg_t) ++userdom_user_home_content(gorg_t) ++userdom_list_user_home_content(gorg_t) ++userdom_read_user_home_content_symlinks(gorg_t) ++userdom_read_user_home_content_files(gorg_t) ++ ++# Local policy ++allow gorg_t self:fifo_file rw_fifo_file_perms; ++ ++# Read /etc files (xml/catalog, hosts.conf, ...) ++files_read_etc_files(gorg_t) ++ ++# Gorg is ruby, so be able to execute ruby ++corecmd_exec_bin(gorg_t) ++ ++# Output to screen ++userdom_use_user_terminals(gorg_t) ++domain_use_interactive_fds(gorg_t) +--- services/gorg.fc 1970-01-01 01:00:00.000000000 +0100 ++++ ../../../refpolicy/policy/modules/services/gorg.fc 2011-01-07 22:35:22.840999786 +0100 +@@ -0,0 +1,3 @@ ++/etc/gorg(/.*)? gen_context(system_u:object_r:gorg_config_t,s0) ++/var/cache/gorg(/.*)? gen_context(system_u:object_r:gorg_cache_t,s0) ++/usr/bin/gorg -- gen_context(system_u:object_r:gorg_exec_t,s0) diff --git a/sec-policy/selinux-gorg/metadata.xml b/sec-policy/selinux-gorg/metadata.xml new file mode 100644 index 000000000000..22e4e153f44e --- /dev/null +++ b/sec-policy/selinux-gorg/metadata.xml @@ -0,0 +1,10 @@ + + + +hardened + + selinux@gentoo.org + +Gentoo SELinux policy for gorg. + + diff --git a/sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild b/sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild new file mode 100644 index 000000000000..45edb5aba2bf --- /dev/null +++ b/sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild @@ -0,0 +1,16 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-gorg/selinux-gorg-2.20101213.ebuild,v 1.1 2011/02/05 20:41:04 blueness Exp $ + +IUSE="" + +MODS="gorg" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for general applications" + +KEYWORDS="~amd64 ~x86" + +POLICY_PATCH="${FILESDIR}/add-gorg.patch" +RDEPEND=">=sec-policy/selinux-base-policy-2.20101213-r3" -- cgit v1.2.3-65-gdbad