Changes to the imaze policy module

Module clean up

Make imaze_exec_t a application executable file so that confined users
can run it in the callers domain

Remove conflicting policy

Type imaze_data_lab_t is a unused type

Add file context specification for imaze pid file

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>

3 files changed, 20 insertions, 31 deletions

diff --git a/policy/modules/contrib/imaze.fc b/policy/modules/contrib/imaze.fc
index 8d455ba64..16f104c55 100644
--- a/policy/modules/contrib/imaze.fc
+++ b/policy/modules/contrib/imaze.fc
@@ -1,4 +1,7 @@
-/usr/games/imazesrv		 --	gen_context(system_u:object_r:imazesrv_exec_t,s0)
-/usr/share/games/imaze(/.*)?		gen_context(system_u:object_r:imazesrv_data_t,s0)
+/usr/games/imazesrv	--	gen_context(system_u:object_r:imazesrv_exec_t,s0)
 
-/var/log/imaze\.log		 --	gen_context(system_u:object_r:imazesrv_log_t,s0)
+/usr/share/games/imaze(/.*)?	gen_context(system_u:object_r:imazesrv_data_t,s0)
+
+/var/log/imaze\.log.*	--	gen_context(system_u:object_r:imazesrv_log_t,s0)
+
+/var/run/imaze\.pid	--	gen_context(system_u:object_r:imazesrv_var_run_t,s0)
diff --git a/policy/modules/contrib/imaze.if b/policy/modules/contrib/imaze.if
index 8eb9ec3a7..db53881db 100644
--- a/policy/modules/contrib/imaze.if
+++ b/policy/modules/contrib/imaze.if
@@ -1 +1 @@
-## <summary>iMaze game server</summary>
+## <summary>iMaze game server.</summary>
diff --git a/policy/modules/contrib/imaze.te b/policy/modules/contrib/imaze.te
index 0778af87a..05387d162 100644
--- a/policy/modules/contrib/imaze.te
+++ b/policy/modules/contrib/imaze.te
@@ -1,4 +1,4 @@
-policy_module(imaze, 1.7.0)
+policy_module(imaze, 1.7.1)
 
 ########################################
 #
@@ -7,14 +7,12 @@ policy_module(imaze, 1.7.0)
 
 type imazesrv_t;
 type imazesrv_exec_t;
+application_executable_file(imazesrv_exec_t)
 init_daemon_domain(imazesrv_t, imazesrv_exec_t)
 
 type imazesrv_data_t;
 files_type(imazesrv_data_t)
 
-type imazesrv_data_labs_t;
-files_type(imazesrv_data_labs_t)
-
 type imazesrv_log_t;
 logging_log_file(imazesrv_log_t)
 
@@ -28,30 +26,23 @@ files_pid_file(imazesrv_var_run_t)
 
 dontaudit imazesrv_t self:capability sys_tty_config;
 allow imazesrv_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
-allow imazesrv_t self:fd use;
 allow imazesrv_t self:fifo_file rw_fifo_file_perms;
-allow imazesrv_t self:unix_dgram_socket { create_socket_perms sendto };
-allow imazesrv_t self:unix_stream_socket { create_stream_socket_perms connectto };
-allow imazesrv_t self:shm create_shm_perms;
-allow imazesrv_t self:sem create_sem_perms;
-allow imazesrv_t self:msgq create_msgq_perms;
-allow imazesrv_t self:msg { send receive };
-allow imazesrv_t self:tcp_socket create_stream_socket_perms;
-allow imazesrv_t self:udp_socket create_socket_perms;
+allow imazesrv_t self:tcp_socket { accept listen };
+allow imazesrv_t self:unix_dgram_socket sendto;
+allow imazesrv_t self:unix_stream_socket { accept connectto listen };
 
 allow imazesrv_t imazesrv_data_t:dir list_dir_perms;
 read_files_pattern(imazesrv_t, imazesrv_data_t, imazesrv_data_t)
 read_lnk_files_pattern(imazesrv_t, imazesrv_data_t, imazesrv_data_t)
 
-allow imazesrv_t imazesrv_log_t:file manage_file_perms;
-allow imazesrv_t imazesrv_log_t:dir add_entry_dir_perms;
+allow imazesrv_t imazesrv_log_t:file { append_file_perms create_file_perms setattr_file_perms };
 logging_log_filetrans(imazesrv_t, imazesrv_log_t, file)
 
 manage_files_pattern(imazesrv_t, imazesrv_var_run_t, imazesrv_var_run_t)
 files_pid_filetrans(imazesrv_t, imazesrv_var_run_t, file)
 
-kernel_read_kernel_sysctls(imazesrv_t)
 kernel_list_proc(imazesrv_t)
+kernel_read_kernel_sysctls(imazesrv_t)
 kernel_read_proc_symlinks(imazesrv_t)
 
 corenet_all_recvfrom_unlabeled(imazesrv_t)
@@ -60,37 +51,32 @@ corenet_tcp_sendrecv_generic_if(imazesrv_t)
 corenet_udp_sendrecv_generic_if(imazesrv_t)
 corenet_tcp_sendrecv_generic_node(imazesrv_t)
 corenet_udp_sendrecv_generic_node(imazesrv_t)
-corenet_tcp_sendrecv_all_ports(imazesrv_t)
-corenet_udp_sendrecv_all_ports(imazesrv_t)
 corenet_tcp_bind_generic_node(imazesrv_t)
 corenet_udp_bind_generic_node(imazesrv_t)
+
+corenet_sendrecv_imaze_server_packets(imazesrv_t)
 corenet_tcp_bind_imaze_port(imazesrv_t)
+corenet_tcp_sendrecv_imaze_port(imazesrv_t)
 corenet_udp_bind_imaze_port(imazesrv_t)
-corenet_sendrecv_imaze_server_packets(imazesrv_t)
+corenet_udp_sendrecv_imaze_port(imazesrv_t)
 
 dev_read_sysfs(imazesrv_t)
 
 domain_use_interactive_fds(imazesrv_t)
 
-files_read_etc_files(imazesrv_t)
-
 fs_getattr_all_fs(imazesrv_t)
 fs_search_auto_mountpoints(imazesrv_t)
 
+auth_use_nsswitch(imazesrv_t)
+
 logging_send_syslog_msg(imazesrv_t)
 
 miscfiles_read_localization(imazesrv_t)
 
-sysnet_read_config(imazesrv_t)
-
 userdom_use_unpriv_users_fds(imazesrv_t)
 userdom_dontaudit_search_user_home_dirs(imazesrv_t)
 
 optional_policy(`
-	nis_use_ypbind(imazesrv_t)
-')
-
-optional_policy(`
 	seutil_sigchld_newrole(imazesrv_t)
 ')