Attachment 611396 Details for Bug 848339 – lightsquid patch

[patch] lightsquid patch

Initial-lightsquid-policy-module.patch (text/plain), 3.65 KB, created by Dominick Grift on 2012-09-10 10:50:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Dominick Grift

Created: 2012-09-10 10:50:36 UTC

Size: 3.65 KB

patch

obsolete

>From 3a5f3793ffa4dff5da115e59126be48cdd956776 Mon, 10 Sep 2012 12:42:32 +0200
>From: Dominick Grift <dominick.grift@gmail.com>
>Date: Mon, 10 Sep 2012 12:28:19 +0200
>Subject: [PATCH] Initial lightsquid policy module
>
>
>Light and fast log analyzer for squid proxy
>
>This is a rewrite of Fedoras' "squid_cron_t"
>
>Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
>diff --git a/lightsquid.fc b/lightsquid.fc
>new file mode 100644
>index 0000000..923d9e4
>--- /dev/null
>+++ b/lightsquid.fc
>@@ -0,0 +1,10 @@
>+/etc/cron\.daily/lightsquid	--	gen_context(system_u:object_r:lightsquid_exec_t,s0)
>+
>+/usr/lib/cgi-bin/lightsquid/.*\.cfg	--	gen_context(system_u:object_r:httpd_lightsquid_content_t,s0)
>+/usr/lib/cgi-bin/lightsquid/.*\.cgi	--	gen_context(system_u:object_r:httpd_lightsquid_script_exec_t,s0)
>+
>+/usr/share/lightsquid/cgi/.*\.cgi	--	gen_context(system_u:object_r:httpd_lightsquid_script_exec_t,s0)
>+
>+/var/lightsquid(/.*)?	gen_context(system_u:object_r:lightsquid_rw_content_t,s0)
>+
>+/var/www/html/lightsquid/report(/.*)?	gen_context(system_u:object_r:lightsquid_rw_content_t,s0)
>diff --git a/lightsquid.if b/lightsquid.if
>new file mode 100644
>index 0000000..c9155f6
>--- /dev/null
>+++ b/lightsquid.if
>@@ -0,0 +1,47 @@
>+## <summary>Log analyzer for squid proxy.</summary>
>+
>+########################################
>+## <summary>
>+##	Execute the lightsquid program in
>+##	the lightsquid domain.
>+## </summary>
>+## <param name="domain">
>+##	<summary>
>+##	Domain allowed to transition.
>+##	</summary>
>+## </param>
>+#
>+interface(`lightsquid_domtrans',`
>+	gen_require(`
>+		type lightsquid_t, lightsquid_exec_t;
>+	')
>+
>+	corecmd_search_bin($1)
>+	domtrans_pattern($1, lightsquid_exec_t, lightsquid_t)
>+')
>+
>+########################################
>+## <summary>
>+##	Execute lightsquid in the
>+##	lightsquid domain, and allow the
>+##	specified role the lightsquid domain.
>+## </summary>
>+## <param name="domain">
>+##	<summary>
>+##	Domain allowed to transition.
>+##	</summary>
>+## </param>
>+## <param name="role">
>+##	<summary>
>+##	Role allowed access.
>+##	</summary>
>+## </param>
>+#
>+interface(`lightsquid_run',`
>+	gen_require(`
>+		type lightsquid_t;
>+	')
>+
>+	lightsquid_domtrans($1)
>+	role $2 types lightsquid_t;
>+')
>diff --git a/lightsquid.te b/lightsquid.te
>new file mode 100644
>index 0000000..8c9f1b3
>--- /dev/null
>+++ b/lightsquid.te
>@@ -0,0 +1,48 @@
>+policy_module(lightsquid, 1.0.0)
>+
>+########################################
>+#
>+# Declarations
>+#
>+
>+type lightsquid_t;
>+type lightsquid_exec_t;
>+application_domain(lightsquid_t, lightsquid_exec_t)
>+
>+type lightsquid_rw_content_t;
>+files_type(lightsquid_rw_content_t)
>+
>+########################################
>+#
>+# Local policy
>+#
>+
>+manage_dirs_pattern(lightsquid_t, lightsquid_rw_content_t, lightsquid_rw_content_t)
>+manage_files_pattern(lightsquid_t, lightsquid_rw_content_t, lightsquid_rw_content_t)
>+manage_lnk_files_pattern(lightsquid_t, lightsquid_rw_content_t, lightsquid_rw_content_t)
>+files_var_filetrans(lightsquid_t, lightsquid_rw_content_t, dir)
>+
>+corecmd_exec_bin(lightsquid_t)
>+corecmd_exec_shell(lightsquid_t)
>+
>+dev_read_urand(lightsquid_t)
>+
>+files_read_etc_files(lightsquid_t)
>+files_read_usr_files(lightsquid_t)
>+
>+miscfiles_read_localization(lightsquid_t)
>+
>+squid_read_config(lightsquid_t)
>+squid_read_log(lightsquid_t)
>+
>+optional_policy(`
>+	apache_content_template(lightsquid)
>+
>+	list_dirs_pattern(httpd_lightsquid_script_t, lightsquid_rw_content_t, lightsquid_rw_content_t)
>+	read_files_pattern(httpd_lightsquid_script_t, lightsquid_rw_content_t, lightsquid_rw_content_t)
>+	read_lnk_files_pattern(httpd_lightsquid_script_t, lightsquid_rw_content_t, lightsquid_rw_content_t)
>+')
>+
>+optional_policy(`
>+	cron_system_entry(lightsquid_t, lightsquid_exec_t)
>+')

Actions: View | Diff

Attachments on bug 848339: 604566 | 611395 | 611396 | 611400