On Tue, 2008-07-22 at 23:11 +0200, Dominick Grift wrote:
> This patch replaces local policy by interface calls
These aren't 1:1 replacements (see below).
> Index: /home/domg472/Workspace/refpolicy_trunk/policy/modules/apps/mozilla.if
> ===================================================================
> --- /home/domg472/Workspace/refpolicy_trunk/policy/modules/apps/mozilla.if (revision 2762)
> +++ /home/domg472/Workspace/refpolicy_trunk/policy/modules/apps/mozilla.if (working copy)
> @@ -78,10 +78,9 @@
> userdom_search_user_home_dirs($1,$1_mozilla_t)
>
> # Mozpluggerrc
> - allow $1_mozilla_t mozilla_conf_t:file read_file_perms;
> + read_files_pattern($1_mozilla_t, mozilla_conf_t, mozilla_conf_t)
Based on the .fc, there aren't any mozilla_conf_t directories. The
pattern adds that permission
> allow $1_mozilla_t $2:fd use;
> - allow $1_mozilla_t $2:process sigchld;
> allow $1_mozilla_t $2:unix_stream_socket connectto;
> allow $2 $1_mozilla_t:fd use;
> allow $2 $1_mozilla_t:shm { associate getattr };
> @@ -190,6 +189,8 @@
> userdom_manage_user_tmp_dirs($1,$1_mozilla_t)
> userdom_manage_user_tmp_files($1,$1_mozilla_t)
> userdom_manage_user_tmp_sockets($1,$1_mozilla_t)
> +
> + userdom_sigchld_all_users($1_mozilla_t)
The raw rule only allows the mozilla to sigchld the user domain that
transitions to the mozilla instance, e.g., user_mozilla_t sigchld'ing
user_t. The above rule allows user_mozilla_t to sigchld all user
domains, which we don't want.
> xserver_user_x_domain_template($1,$1_mozilla,$1_mozilla_t,
> $1_mozilla_tmpfs_t)
> xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t)
--
Chris PeBenito
<pebenito@xxxxxxxxxx>
Developer,
Hardened Gentoo Linux
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A CB00 BC8E E42D E6AF 9243
Attachment:
signature.asc
Description: This is a digitally signed message part
