[prev in list] [next in list] [prev in thread] [next in thread]
List: gentoo-commits
Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/, policy/modules/s
From: "Sven Vermeulen" <sven.vermeulen () siphos ! be>
Date: 2012-12-31 23:19:06
Message-ID: 1356974679.2e34d4ed1a88947b99dc82d88f1e5e0b0f026211.SwifT () gentoo
[Download RAW message or body]
commit: 2e34d4ed1a88947b99dc82d88f1e5e0b0f026211
Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Mon Dec 31 17:24:39 2012 +0000
Commit: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Dec 31 17:24:39 2012 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=2e34d4ed
Create filetransition for ld.so.cache~
When portage calls ldconfig (which runs in the portage domain, so no transition
occurs), ldconfig creates the ld.so.cache~ file (which later gets renamed to
ld.so.cache). As this file would then be labeled as etc_t, this results in a
wrongly labeled ld.so.cache file.
Introduce a file transition for ld.so.cache~ so that this comes through
correctly.
---
policy/modules/contrib/portage.te | 7 +++++++
policy/modules/system/libraries.if | 33 +++++++++++++++++++++++++++++++++
2 files changed, 40 insertions(+), 0 deletions(-)
diff --git a/policy/modules/contrib/portage.te b/policy/modules/contrib/portage.te
index 5a1e463..dd5c0d0 100644
--- a/policy/modules/contrib/portage.te
+++ b/policy/modules/contrib/portage.te
@@ -383,6 +383,13 @@ ifdef(`distro_gentoo',`
##########################################
#
+ # Portage local policy
+ #
+
+ libs_generic_etc_filetrans_ld_so_cache(portage_t, file, "ld.so.cache~")
+
+ ##########################################
+ #
# Portage sandbox local policy
#
diff --git a/policy/modules/system/libraries.if b/policy/modules/system/libraries.if
index 808ba93..41a44f3 100644
--- a/policy/modules/system/libraries.if
+++ b/policy/modules/system/libraries.if
@@ -534,3 +534,36 @@ interface(`lib_filetrans_shared_lib',`
interface(`files_lib_filetrans_shared_lib',`
refpolicywarn(`$0($*) has been deprecated.')
')
+
+# This is gentoo specific but cannot use ifdef distro_gentoo here
+
+########################################
+## <summary>
+## Create an object in etc with a type transition to
+## the ld_so_cache_t type
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access
+## </summary>
+## </param>
+## <param name="class">
+## <summary>
+## Class of the resource for which a type transition occurs.
+## This is usually file as ld_so_cache is currently not used
+## for any other resources.
+## </summary>
+## </param>
+## <param name="filename" optional="true">
+## <summary>
+## Name of the resource created for which a type transition occurs
+## </summary>
+## </param>
+#
+interface(`libs_generic_etc_filetrans_ld_so_cache',`
+ gen_require(`
+ type ld_so_cache_t;
+ ')
+
+ files_etc_filetrans($1, ld_so_cache_t, $2, $3)
+')
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic