PERFORCE change 113402 for review

[Todd Miller]

http://perforce.freebsd.org/chv.cgi?CH=113402

Change 113402 by millert at millert_macbook on 2007/01/22 20:02:00

	Update.

Affected files ...

.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/darwin/configd.te#13 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/darwin/loginwindow.te#11 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/darwin/securityd.te#12 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/darwin/update.te#6 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/services/ntp.te#4 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/system/init.te#10 edit

Differences ...

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/darwin/configd.te#13 (text+ko) ====

@@ -67,6 +67,7 @@
 allow configd_t self:rawip_socket create;
 allow configd_t self:socket { bind create listen read write };
 allow configd_t random_device_t:chr_file read;
+allow configd_t fs_t:filesystem { associate getattr };
 allow configd_t nfs_t:dir { add_name getattr read search };
 allow configd_t nfs_t:filesystem { getattr mount };
 allow configd_t nfs_t:lnk_file { create getattr read };
@@ -187,6 +188,7 @@
 # Read/write/manage keychain files
 darwin_allow_keychain_rw(configd_t)
 darwin_allow_keychain_manage(configd_t)
+allow configd_t darwin_keychain_t:dir { add_name remove_name };
 
 # Read files in /tmp
 files_getattr_tmp_dirs(configd_t)
@@ -203,3 +205,5 @@
 userdom_read_all_users_home_content_files(configd_t)
 userdom_manage_all_users_home_content_files(configd_t)
 
+# Search /var/vm
+files_search_vm(configd_t)

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/darwin/loginwindow.te#11 (text+ko) ====

@@ -28,7 +28,8 @@
 allow loginwindow_t self:unix_stream_socket create_stream_socket_perms;
 
 # Misc
-allow loginwindow_t console_device_t:chr_file { read setattr write };
+term_use_console(loginwindow_t)
+term_setattr_console(loginwindow_t)
 allow loginwindow_t lib_t:file execute_no_trans;
 allow loginwindow_t self:fd use;
 allow loginwindow_t self:process { taskforpid signal }; # XXX

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/darwin/securityd.te#12 (text+ko) ====

@@ -37,7 +37,7 @@
 # Misc
 allow securityd_t mnt_t:dir { getattr search };
 allow securityd_t nfs_t:dir { getattr search };
-allow securityd_t nfs_t:filesystem getattr;
+allow securityd_t { fs_t nfs_t }:filesystem getattr;
 allow securityd_t nfs_t:lnk_file read;
 allow securityd_t usr_t:file { getattr read };
 allow securityd_t random_device_t:chr_file { read write };

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/darwin/update.te#6 (text+ko) ====

@@ -25,6 +25,8 @@
 allow update_t self:fifo_file { read write };
 allow update_t self:unix_stream_socket create_stream_socket_perms;
 
+term_use_console(update_t)
+
 # talk to self
 mach_allow_message(update_t, update_t)
 

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/services/ntp.te#4 (text+ko) ====

@@ -101,6 +101,7 @@
 files_read_etc_runtime_files(ntpd_t)
 files_read_usr_files(ntpd_t)
 files_list_var_lib(ntpd_t)
+files_read_var_files(ntpd_t)
 
 init_exec_script_files(ntpd_t)
 init_use_fds(ntpd_t)
@@ -137,6 +138,8 @@
 allow ntpd_t mnt_t:dir search;
 allow ntpd_t nfs_t:lnk_file read;
 
+# Read /private
+darwin_allow_private_read(ntpd_t)
 
 ifdef(`targeted_policy', `
 	term_dontaudit_use_unallocated_ttys(ntpd_t)

==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/policy/modules/system/init.te#10 (text+ko) ====

@@ -670,6 +670,7 @@
 # Allow access to /private
 darwin_allow_private_manage(init_t)
 darwin_allow_private_rw(init_t)
+allow init_t darwin_private_t:dir relabelfrom;
 
 # Allow keychain access
 darwin_allow_keychain_read(init_t)