Attachment 313031 Details for Bug 457223 – git-daemon type enforcement file

git-daemon type enforcement file

git_daemon.te.patch.txt (text/plain), 2.19 KB, created by Dominick Grift on 2008-07-30 20:28:05 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Dominick Grift

Created: 2008-07-30 20:28:05 UTC

Size: 2.19 KB

patch

obsolete

>--- /home/domg472/Desktop/new/policy/modules/services/git_daemon.te 
>+++ <unnamed> 
>@@ -1,77 +1,1 @@
> 
>-policy_module(git_daemon, 0.0.1) 
>-
>-########################################
>-#
>-# Git private declarations.
>-#
>-type git_daemon_t;
>-type git_daemon_exec_t;
>-inetd_service_domain(git_daemon_t, git_daemon_exec_t)
>-role system_r types git_daemon_t;
>-
>-type git_daemon_data_t;
>-files_type(git_daemon_data_t)
>-
>-## <desc>
>-## <p>
>-## Allow the Git daemon to manage httpd
>-## user content.
>-## </p>
>-## </desc>
>-gen_tunable(git_daemon_manage_httpd_user_content, false)
>-
>-########################################
>-#
>-# Git private policy.
>-#
>-
>-allow git_daemon_t self:fifo_file rw_fifo_file_perms;
>-allow git_daemon_t self:netlink_route_socket { write getattr read bind create nlmsg_read };
>-allow git_daemon_t self:udp_socket { write read create connect getattr };
>-allow git_daemon_t self:unix_dgram_socket { write create connect };
>-
>-manage_dirs_pattern(git_daemon_t, git_daemon_data_t, git_daemon_data_t)
>-manage_files_pattern(git_daemon_t, git_daemon_data_t, git_daemon_data_t)
>-manage_lnk_files_pattern(git_daemon_t, git_daemon_data_t, git_daemon_data_t)
>-
>-corecmd_exec_bin(git_daemon_t)
>-corecmd_search_bin(git_daemon_t)
>-
>-corenet_all_recvfrom_unlabeled(git_daemon_t)
>-corenet_all_recvfrom_netlabel(git_daemon_t)
>-
>-files_read_etc_files(git_daemon_t)
>-
>-files_search_usr(git_daemon_t)
>-
>-kernel_read_system_state(git_daemon_t)
>-
>-libs_use_ld_so(git_daemon_t)
>-libs_use_shared_libs(git_daemon_t)
>-
>-logging_send_syslog_msg(git_daemon_t)
>-
>-miscfiles_read_localization(git_daemon_t)
>-
>-nscd_read_pid(git_daemon_t)
>-
>-sysnet_read_config(git_daemon_t)
>-
>-optional_policy(`
>-	apache_content_template(gitweb)
>-	apache_search_sys_content(httpd_gitweb_script_t)
>-	files_getattr_tmp_dirs(httpd_gitweb_script_t)
>-	git_daemon_read_git_daemon_data(httpd_gitweb_script_t)
>-')
>-
>-# Test me
>-tunable_policy(`git_daemon_manage_httpd_user_content', `
>-		apache_manage_all_user_content(git_daemon_t)
>-		apache_execute_all_user_content_files(git_daemon_t) #..oo noes, without this its pretty much useless.
>-# TODO
>-#	', `
>-#		dontaudit_apache_manage_all_user_content(git_daemon_t)
>-#		dontaudit_apache_execute_all_user_content_files(git_daemon_t)
>-')
>-

Actions: View

Attachments on bug 457223: 312988 | 312989 | 312990 | 313027 | 313028 | 313029 | 313030 | 313031 | 313032 | 313033 | 313034 | 313035 | 313195 | 313344