fix corenetwork generation and add distcc

diff --git a/refpolicy/Changelog b/refpolicy/Changelog
index 463d1abffbc94d1e84184fb0c50d8659e43f868e..85402f9771bac5f1e8e01f7c57d69a7cfcac1a22 100644 (file)
--- a/refpolicy/Changelog
+++ b/refpolicy/Changelog
@@ -1,4 +1,8 @@
+- Fix corenetwork gen_context()'s to expand during the policy
+  build phase instead of during the generation phase.  
 - DISTRO=redhat now implies DIRECT_INITRC=y.
+- Added policies:
+       distcc
 
 * Wed Oct 19 2005 Chris PeBenito <selinux@tresys.com> - 20051019
 - Many fixes to make loadable modules build.

diff --git a/refpolicy/Makefile b/refpolicy/Makefile
index bd60810c52d19b87d0ff795efaf1504408019ace..967dac22137f532ca4a98d1b44250541b2137f26 100644 (file)
--- a/refpolicy/Makefile
+++ b/refpolicy/Makefile
@@ -224,7 +224,7 @@ $(MODDIR)/kernel/corenetwork.if: $(MODDIR)/kernel/corenetwork.if.m4 $(MODDIR)/ke
        @echo "#" >> $@
        $(QUIET) cat $(MODDIR)/kernel/corenetwork.if.in >> $@
        $(QUIET) egrep "^[[:blank:]]*network_(interface|node|port)\(.*\)" $(@:.if=.te).in \
-               | m4 -D self_contained_policy $(M4PARAM) $(M4SUPPORT) $(MODDIR)/kernel/corenetwork.if.m4 - \
+               | m4 -D self_contained_policy $(M4PARAM) $(MODDIR)/kernel/corenetwork.if.m4 - \
                | sed -e 's/dollarsone/\$$1/g' -e 's/dollarszero/\$$0/g' >> $@
 
 $(MODDIR)/kernel/corenetwork.te: $(MODDIR)/kernel/corenetwork.te.m4 $(MODDIR)/kernel/corenetwork.te.in
@@ -232,7 +232,7 @@ $(MODDIR)/kernel/corenetwork.te: $(MODDIR)/kernel/corenetwork.te.m4 $(MODDIR)/ke
        @echo "# This is a generated file!  Instead of modifying this file, the" >> $@
        @echo "# $(notdir $@).in or $(notdir $@).m4 file should be modified." >> $@
        @echo "#" >> $@
-       $(QUIET) m4 -D self_contained_policy $(M4PARAM) $(M4SUPPORT) $^ \
+       $(QUIET) m4 -D self_contained_policy $(M4PARAM) $^ \
                | sed -e 's/dollarsone/\$$1/g' -e 's/dollarszero/\$$0/g' >> $@
 
 ########################################

diff --git a/refpolicy/policy/modules/kernel/corenetwork.if.m4 b/refpolicy/policy/modules/kernel/corenetwork.if.m4
index a8d9e9e2dd20c440e36f1ec23aedba3f663601af..e5c6f84df6594001da04326501bf8af73c1c325b 100644 (file)
--- a/refpolicy/policy/modules/kernel/corenetwork.if.m4
+++ b/refpolicy/policy/modules/kernel/corenetwork.if.m4
@@ -1,3 +1,10 @@
+#
+# shiftn(num,list...)
+#
+# shift the list num times
+#
+define(`shiftn',`ifelse($1,0,`shift($*)',`shiftn(decr($1),shift(shift($*)))')')
+
 ########################################
 #
 # Network Interface generated macros 

diff --git a/refpolicy/policy/modules/kernel/corenetwork.te.in b/refpolicy/policy/modules/kernel/corenetwork.te.in
index 6e37fb1ed6903ce68f34281f1a4bec157fcf3d70..4bbbca6ae8800199b375978bb3ee4f786c414c34 100644 (file)
--- a/refpolicy/policy/modules/kernel/corenetwork.te.in
+++ b/refpolicy/policy/modules/kernel/corenetwork.te.in
@@ -55,6 +55,7 @@ network_port(dbskkd, tcp,1178,s0)
 network_port(dhcpc, udp,68,s0)
 network_port(dhcpd, udp,67,s0, tcp,647,s0, udp,647,s0, tcp,847,s0, udp,847,s0)
 network_port(dict, tcp,2628,s0)
+network_port(distcc, tcp,3632,s0)
 network_port(dns, udp,53,s0, tcp,53,s0)
 network_port(fingerd, tcp,79,s0)
 network_port(ftp_data, tcp,20,s0)

diff --git a/refpolicy/policy/modules/kernel/corenetwork.te.m4 b/refpolicy/policy/modules/kernel/corenetwork.te.m4
index 0931c054c558e51218e503e3171579170b657daf..1f53e62a873ce46ee40ab8c981184831b802bccf 100644 (file)
--- a/refpolicy/policy/modules/kernel/corenetwork.te.m4
+++ b/refpolicy/policy/modules/kernel/corenetwork.te.m4
@@ -1,3 +1,10 @@
+#
+# shiftn(num,list...)
+#
+# shift the list num times
+#
+define(`shiftn',`ifelse($1,0,`shift($*)',`shiftn(decr($1),shift(shift($*)))')')
+
 define(`declare_netifs',`dnl
 netifcon $2 gen_context(system_u:object_r:$1,$3) gen_context(system_u:object_r:unlabeled_t,$3)
 ifelse(`$4',`',`',`declare_netifs($1,shiftn(3,$*))')dnl

diff --git a/refpolicy/policy/modules/services/distcc.fc b/refpolicy/policy/modules/services/distcc.fc
new file mode 100644 (file)
index 0000000..6ce6b00
--- /dev/null
+++ b/refpolicy/policy/modules/services/distcc.fc
@@ -0,0 +1,2 @@
+
+/usr/bin/distccd       --      gen_context(system_u:object_r:distccd_exec_t,s0)

diff --git a/refpolicy/policy/modules/services/distcc.if b/refpolicy/policy/modules/services/distcc.if
new file mode 100644 (file)
index 0000000..926e959
--- /dev/null
+++ b/refpolicy/policy/modules/services/distcc.if
@@ -0,0 +1 @@
+## <summary>Distributed compiler daemon</summary>

diff --git a/refpolicy/policy/modules/services/distcc.te b/refpolicy/policy/modules/services/distcc.te
new file mode 100644 (file)
index 0000000..6e8c316
--- /dev/null
+++ b/refpolicy/policy/modules/services/distcc.te
@@ -0,0 +1,115 @@
+
+policy_module(distcc,1.0)
+
+########################################
+#
+# Declarations
+#
+
+type distccd_t;
+type distccd_exec_t;
+init_daemon_domain(distccd_t,distccd_exec_t)
+
+type distccd_log_t;
+logging_log_file(distccd_log_t)
+
+type distccd_tmp_t;
+files_tmp_file(distccd_tmp_t)
+
+type distccd_var_run_t;
+files_pid_file(distccd_var_run_t)
+
+########################################
+#
+# Local policy
+#
+
+allow distccd_t self:capability { setgid setuid };
+dontaudit distccd_t self:capability sys_tty_config;
+allow distccd_t self:process { signal_perms setsched };
+allow distccd_t self:fifo_file { read write getattr };
+allow distccd_t self:tcp_socket create_stream_socket_perms;
+allow distccd_t self:udp_socket create_socket_perms;
+
+allow distccd_t distccd_log_t:file create_file_perms;
+logging_create_log(distccd_t,distccd_log_t)
+
+allow distccd_t distccd_tmp_t:dir create_dir_perms;
+allow distccd_t distccd_tmp_t:file create_file_perms;
+files_create_tmp_files(distccd_t, distccd_tmp_t, { file dir })
+
+allow distccd_t distccd_var_run_t:file create_file_perms;
+allow distccd_t distccd_var_run_t:dir rw_dir_perms;
+files_create_pid(distccd_t,distccd_var_run_t)
+
+kernel_read_system_state(distccd_t)
+kernel_read_kernel_sysctl(distccd_t)
+
+allow distccd_t self:tcp_socket create_stream_socket_perms;
+allow distccd_t self:udp_socket create_socket_perms;
+corenet_tcp_sendrecv_all_if(distccd_t)
+corenet_udp_sendrecv_all_if(distccd_t)
+corenet_raw_sendrecv_all_if(distccd_t)
+corenet_tcp_sendrecv_all_nodes(distccd_t)
+corenet_udp_sendrecv_all_nodes(distccd_t)
+corenet_raw_sendrecv_all_nodes(distccd_t)
+corenet_tcp_sendrecv_all_ports(distccd_t)
+corenet_udp_sendrecv_all_ports(distccd_t)
+corenet_tcp_bind_all_nodes(distccd_t)
+corenet_udp_bind_all_nodes(distccd_t)
+corenet_tcp_bind_distcc_port(distccd_t)
+
+dev_read_sysfs(distccd_t)
+
+fs_getattr_all_fs(distccd_t)
+fs_search_auto_mountpoints(distccd_t)
+
+term_dontaudit_use_console(distccd_t)
+
+corecmd_exec_bin(distccd_t)
+corecmd_read_sbin_symlink(distccd_t)
+
+domain_use_wide_inherit_fd(distccd_t)
+
+files_read_etc_files(distccd_t)
+files_read_etc_runtime_files(distccd_t)
+
+init_use_fd(distccd_t)
+init_use_script_pty(distccd_t)
+
+libs_use_ld_so(distccd_t)
+libs_use_shared_libs(distccd_t)
+libs_exec_lib_files(distccd_t)
+
+logging_send_syslog_msg(distccd_t)
+
+miscfiles_read_localization(distccd_t)
+
+sysnet_read_config(distccd_t)
+
+userdom_dontaudit_use_unpriv_user_fd(distccd_t)
+userdom_dontaudit_search_sysadm_home_dir(distccd_t)
+
+ifdef(`targeted_policy',`
+       term_dontaudit_use_unallocated_tty(distccd_t)
+       term_dontaudit_use_generic_pty(distccd_t)
+       files_dontaudit_read_root_file(distccd_t)
+')
+
+optional_policy(`nis.te',`
+       nis_use_ypbind(distccd_t)
+')
+
+optional_policy(`selinuxutil.te',`
+       seutil_sigchld_newrole(distccd_t)
+')
+
+optional_policy(`udev.te',`
+       udev_read_db(distccd_t)
+')
+
+ifdef(`TODO',`
+optional_policy(`rhgb.te',`
+       rhgb_domain(distccd_t)
+')
+') dnl end TODO