gentoo diff for ipsec

[petre rodan <kaiowas@gentoo.org>]

[-- Attachment #1.1: Type: text/plain, Size: 703 bytes --]


Hi!

This policy was generated using the ipsec-tools that comes with gentoo [1]
setkey was used to set-up the Security Policy Database and Security Association Database and racoon to do the x509 certificate exchange.

the diff is needed because:

ipsec_conf_file_t is a directory structure, not a single file

ipsec_key_file_t is a directory structure that also contains symlinks (one of the ipsec_key_file_t directories must contain openssl hash-links to each certificate)

racoon is the IKE daemon that is started by initrc_t. so this is why the daemon_base_domain is used.


[1]. http://ipsec-tools.sourceforge.net/

bye,
peter

-- 
petre rodan
<kaiowas@gentoo.org>
Developer,
Hardened Gentoo Linux

[-- Attachment #1.2: selinux-ipsec-tools.diff --]
[-- Type: text/plain, Size: 1618 bytes --]

--- /root/public_html/policy/nsa/file_contexts/program/ipsec.fc	2004-09-09 18:27:39.000000000 +0300
+++ /root/cvs/cvs.gentoo.org/gentoo-projects/selinux/ipsec-tools/ipsec.fc	2004-10-06 04:59:57.000000000 +0300
@@ -25,3 +25,6 @@
 # Kame
 /usr/sbin/racoon	--	system_u:object_r:ipsec_exec_t
 /usr/sbin/setkey	--	system_u:object_r:ipsec_exec_t
+/etc/racoon(/.*)?		system_u:object_r:ipsec_conf_file_t
+/etc/racoon/certs(/.*)?	system_u:object_r:ipsec_key_file_t
+/etc/racoon/psk\.txt	--	system_u:object_r:ipsec_key_file_t
--- /root/public_html/policy/nsa/domains/program/unused/ipsec.te	2004-09-23 05:08:20.000000000 +0300
+++ /root/cvs/cvs.gentoo.org/gentoo-projects/selinux/ipsec-tools/ipsec.te	2004-10-06 06:12:51.000000000 +0300
@@ -10,10 +10,7 @@
 # Rules for the ipsec_t domain.
 #
 # a domain for things that need access to the PF_KEY socket
-type ipsec_t, domain, privlog;
-
-# type for executables that will run in the ipsec_t domain
-type ipsec_exec_t, file_type, sysadmfile, exec_type;
+daemon_base_domain(ipsec, `, privlog')
 
 # type for ipsec configuration file(s) - not for keys
 type ipsec_conf_file_t, file_type, sysadmfile;
@@ -48,9 +45,8 @@
 # I do not know where this pesky pipe is...
 allow ipsec_t initrc_t:fifo_file { write };
 
-allow ipsec_t ipsec_conf_file_t:file { getattr read ioctl };
-allow ipsec_t ipsec_key_file_t:file { getattr read ioctl };
-allow ipsec_t ipsec_key_file_t:dir r_dir_perms;
+r_dir_file(ipsec_t, ipsec_conf_file_t)
+r_dir_file(ipsec_t, ipsec_key_file_t)
 allow ipsec_mgmt_t ipsec_conf_file_t:file { getattr read ioctl };
 rw_dir_create_file(ipsec_mgmt_t, ipsec_key_file_t)
 

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 252 bytes --]