diff options
author | Chris PeBenito <pebenito@ieee.org> | 2022-02-18 13:46:24 -0500 |
---|---|---|
committer | Jason Zaman <perfinion@gentoo.org> | 2022-02-26 18:13:17 -0800 |
commit | 4234b23d214dd8b53dd631560f9c98778f1c9ac5 (patch) | |
tree | 763c0f0b6ac4c4162bcadd180542495fa5fdb181 | |
parent | matrixd-synapse policy V3 (diff) | |
download | hardened-refpolicy-4234b23d214dd8b53dd631560f9c98778f1c9ac5.tar.gz hardened-refpolicy-4234b23d214dd8b53dd631560f9c98778f1c9ac5.tar.bz2 hardened-refpolicy-4234b23d214dd8b53dd631560f9c98778f1c9ac5.zip |
matrixd: Cleanups.
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
Signed-off-by: Jason Zaman <perfinion@gentoo.org>
-rw-r--r-- | policy/modules/services/matrixd.fc | 6 | ||||
-rw-r--r-- | policy/modules/services/matrixd.if | 2 | ||||
-rw-r--r-- | policy/modules/services/matrixd.te | 35 |
3 files changed, 21 insertions, 22 deletions
diff --git a/policy/modules/services/matrixd.fc b/policy/modules/services/matrixd.fc index b59b1c75..6db2d7ed 100644 --- a/policy/modules/services/matrixd.fc +++ b/policy/modules/services/matrixd.fc @@ -1,4 +1,6 @@ -/var/lib/matrix-synapse(/.*)? gen_context(system_u:object_r:matrixd_var_t,s0) -/var/log/matrix-synapse(/.*)? gen_context(system_u:object_r:matrixd_log_t,s0) /etc/matrix-synapse(/.*)? gen_context(system_u:object_r:matrixd_conf_t,s0) + /usr/bin/synctl -- gen_context(system_u:object_r:matrixd_exec_t,s0) + +/var/lib/matrix-synapse(/.*)? gen_context(system_u:object_r:matrixd_var_t,s0) +/var/log/matrix-synapse(/.*)? gen_context(system_u:object_r:matrixd_log_t,s0) diff --git a/policy/modules/services/matrixd.if b/policy/modules/services/matrixd.if index f1eff5f0..8cf2a845 100644 --- a/policy/modules/services/matrixd.if +++ b/policy/modules/services/matrixd.if @@ -1 +1 @@ -## <summary>Matrixd</summary> +## <summary>matrix.org synapse reference server.</summary> diff --git a/policy/modules/services/matrixd.te b/policy/modules/services/matrixd.te index 5c217678..2c7f384c 100644 --- a/policy/modules/services/matrixd.te +++ b/policy/modules/services/matrixd.te @@ -1,4 +1,4 @@ -policy_module(matrixd, 1.0.0) +policy_module(matrixd) ######################################## # @@ -20,23 +20,22 @@ gen_tunable(matrix_allow_federation, true) ## </desc> gen_tunable(matrix_postgresql_connect, false) - type matrixd_t; type matrixd_exec_t; init_daemon_domain(matrixd_t, matrixd_exec_t) -type matrixd_var_t; -files_type(matrixd_var_t) +type matrixd_conf_t; +files_config_file(matrixd_conf_t) type matrixd_log_t; logging_log_file(matrixd_log_t) -type matrixd_conf_t; -files_config_file(matrixd_conf_t) - type matrixd_tmp_t; files_tmp_file(matrixd_tmp_t) +type matrixd_var_t; +files_type(matrixd_var_t) + ######################################## # # Local policy @@ -56,16 +55,15 @@ allow matrixd_t matrixd_tmp_t:file { manage_file_perms map }; files_tmp_filetrans(matrixd_t, matrixd_tmp_t, file) fs_tmpfs_filetrans(matrixd_t, matrixd_tmp_t, file) -manage_files_pattern(matrixd_t, matrixd_var_t, matrixd_var_t) -files_search_var_lib(matrixd_t) -allow matrixd_t matrixd_var_t:file map; -allow matrixd_t matrixd_var_t:dir manage_dir_perms; +allow matrixd_t matrixd_conf_t:dir list_dir_perms; +read_files_pattern(matrixd_t, matrixd_conf_t, matrixd_conf_t) logging_search_logs(matrixd_t) manage_files_pattern(matrixd_t, matrixd_log_t, matrixd_log_t) -read_files_pattern(matrixd_t, matrixd_conf_t, matrixd_conf_t) -allow matrixd_t matrixd_conf_t:dir list_dir_perms; +mmap_manage_files_pattern(matrixd_t, matrixd_var_t, matrixd_var_t) +manage_dirs_pattern(matrixd_t, matrixd_var_t, matrixd_var_t) +files_search_var_lib(matrixd_t) kernel_read_system_state(matrixd_t) kernel_read_vm_overcommit_sysctl(matrixd_t) @@ -81,7 +79,6 @@ corenet_tcp_bind_generic_node(matrixd_t) corenet_tcp_bind_http_port(matrixd_t) corenet_tcp_connect_http_cache_port(matrixd_t) corenet_tcp_connect_http_port(matrixd_t) - corenet_udp_bind_generic_node(matrixd_t) corenet_udp_bind_generic_port(matrixd_t) corenet_udp_bind_reserved_port(matrixd_t) @@ -91,11 +88,11 @@ dev_read_urand(matrixd_t) files_read_etc_files(matrixd_t) files_read_etc_runtime_files(matrixd_t) files_read_etc_symlinks(matrixd_t) - # for /usr/share/ca-certificates files_read_usr_files(matrixd_t) init_search_runtime(matrixd_t) + logging_send_syslog_msg(matrixd_t) miscfiles_read_generic_tls_privkey(matrixd_t) @@ -106,10 +103,6 @@ sysnet_read_config(matrixd_t) userdom_search_user_runtime_root(matrixd_t) -optional_policy(` - apache_search_config(matrixd_t) -') - tunable_policy(`matrix_allow_federation',` corenet_tcp_connect_all_unreserved_ports(matrixd_t) corenet_tcp_connect_generic_port(matrixd_t) @@ -124,3 +117,7 @@ tunable_policy(`matrix_postgresql_connect',` postgresql_tcp_connect(matrixd_t) ') +optional_policy(` + apache_search_config(matrixd_t) +') +
\ No newline at end of file |