diff options
| author |   Luis Ressel <aranea@aixah.de> | 2015-10-15 12:44:42 +0200 |
|---|---|---|
| committer |   Jason Zaman <jason@perfinion.com> | 2015-10-18 00:47:50 +0800 |
| commit | 26930c8978e8ae49829ee8b13e9da9ca05e024ce (patch) | |
| tree | d42d826260b3dcdb051ddc05b1842b2ceb53b742 | |
| parent | portage: Fix the gen_require of the portage_compile_domain interface (diff) | |
| download | hardened-refpolicy-26930c8978e8ae49829ee8b13e9da9ca05e024ce.tar.gz hardened-refpolicy-26930c8978e8ae49829ee8b13e9da9ca05e024ce.tar.bz2 hardened-refpolicy-26930c8978e8ae49829ee8b13e9da9ca05e024ce.zip | |
portage: New read-only interfaces for srcrepo and logs
Create portage_read_srcrepo and portage_read_log interfaces.
| -rw-r--r-- | policy/modules/contrib/portage.if | 40 |
1 files changed, 40 insertions, 0 deletions
diff --git a/policy/modules/contrib/portage.if b/policy/modules/contrib/portage.if index 465231947..962dccab3 100644 --- a/policy/modules/contrib/portage.if +++ b/policy/modules/contrib/portage.if @@ -498,6 +498,46 @@ interface(`portage_read_ebuild',` ######################################## ## <summary> +## Read portage log files +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access +## </summary> +## </param> +# +interface(`portage_read_log',` + gen_require(` + type portage_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, portage_log_t, portage_log_t) +') + +######################################## +## <summary> +## Read portage src repository files +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access +## </summary> +## </param> +# +interface(`portage_read_srcrepo',` + gen_require(` + type portage_ebuild_t, portage_srcrepo_t; + ') + + files_search_usr($1) + list_dirs_pattern($1, portage_ebuild_t, portage_srcrepo_t) + read_files_pattern($1, portage_srcrepo_t, portage_srcrepo_t) + read_lnk_files_pattern($1, portage_srcrepo_t, portage_srcrepo_t) +') + +######################################## +## <summary> ## Do not audit writing portage cache files ## </summary> ## <param name="domain"> |