Update audio-entropyd to support haveged

Package-Manager: portage-2.1.10.3/cvs/Linux x86_64

diff --git a/sec-policy/selinux-audio-entropyd/ChangeLog b/sec-policy/selinux-audio-entropyd/ChangeLog
index 021edebe9030016a07da1711c7e7a209133b53e8..2f84771dc9aa5671d55b5e4e4bbd513cdf3a0f89 100644 (file)
--- a/sec-policy/selinux-audio-entropyd/ChangeLog
+++ b/sec-policy/selinux-audio-entropyd/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for sec-policy/selinux-audio-entropyd
 # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-audio-entropyd/ChangeLog,v 1.21 2011/06/04 16:08:00 blueness Exp $
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-audio-entropyd/ChangeLog,v 1.22 2011/07/25 22:25:22 blueness Exp $
+
+*selinux-audio-entropyd-2.20101213-r1 (25 Jul 2011)
+
+  25 Jul 2011; Anthony G. Basile <blueness@gentoo.org>
+  +files/fix-services-audioentropy-r1.patch,
+  +selinux-audio-entropyd-2.20101213-r1.ebuild:
+  Update audio-entropyd to support haveged
 
   04 Jun 2011; Anthony G. Basile <blueness@gentoo.org>
   -selinux-audio-entropyd-2.20090730.ebuild,

diff --git a/sec-policy/selinux-audio-entropyd/Manifest b/sec-policy/selinux-audio-entropyd/Manifest
index a39ba0d73103401890f31a2a23634117f12dd8c1..b7cc53b797b59dd561a6ac86a29eb3f08968f146 100644 (file)
--- a/sec-policy/selinux-audio-entropyd/Manifest
+++ b/sec-policy/selinux-audio-entropyd/Manifest
@@ -1,14 +1,16 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA256
 
+AUX fix-services-audioentropy-r1.patch 2270 RMD160 f34a2e9a8c925162a1b0faebf76b57b53a741e5f SHA1 1ee12035497ea3015207732191c051b420581bad SHA256 a63db610f8cd1eaebb895b148b4ccbaf678594d4c53be3007172dda3c288f1d8
 DIST refpolicy-2.20101213.tar.bz2 559450 RMD160 4858f792f4db5b179de6fb8419a626c29d59bdd3 SHA1 0e881e99b8950a358eadc44633551ca10f12eaee SHA256 b691ee8f6066cc19bb0d4384fe3be277d97d22e9d4ac2db0c252065e8c3535de
+EBUILD selinux-audio-entropyd-2.20101213-r1.ebuild 626 RMD160 93cc1a79cd7ce2e0945370a0197f93a5072d26c3 SHA1 bd6ca3b9d674c31ce0b68a2632b02d488ca20d4b SHA256 fefe2a2f36c830b3a479bc54946ae370b08d22d918d6550d30fb5c4a969b2197
 EBUILD selinux-audio-entropyd-2.20101213.ebuild 384 RMD160 7e718a1c3e32d0ce237f582755aa671059f677e6 SHA1 451c7703fe3b9f25fea282604f6981f70dde6206 SHA256 af097fbcfe5754e75ce660cd3c02e76f5b8cd99bc85b9d641b8620495db25e5e
-MISC ChangeLog 3361 RMD160 4f7519ff3654f9925682286648c39d231aebfeb9 SHA1 cb9d0c10c1c285091db91e9255a15a3afe25d0a6 SHA256 302f8da6f9d91bad231104b3fb60d95b3d271d324dec33993dd492f6ac518dfc
+MISC ChangeLog 3606 RMD160 4c2d428cad67cbe5d359b4b98254c30f0273dfa5 SHA1 f3eb8b3cb9917c3e20bc31507ad50b11d2090d8e SHA256 2f2515d2e8ceb239bad562ec372630538b7fbd81e40111d020c4f22c4ac43ffd
 MISC metadata.xml 238 RMD160 11240cce23db1e9fe9bef8eec5965a0c443cecf8 SHA1 6dbca0ab23c6c25f4d06f8c722b0f744448b97b4 SHA256 db855a0621427000f781e9b845ad054b6e43ec0688fb45b4ebb8c26d06cd822c
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.17 (GNU/Linux)
 
-iEYEAREIAAYFAk3qWGoACgkQl5yvQNBFVTUsJQCeJVZHThHgRaKHJfL0z1LJ/uuO
-G0cAn1hCxz7eE4qVk147sNCX+axSH/LJ
-=y+w4
+iEYEAREIAAYFAk4t7VwACgkQl5yvQNBFVTVGxgCfYw2GwHNCZp1Zgw0MTa5vkDSd
+KJcAnRrHQP89gTGWDrqRBGCnUGmNSYxY
+=tt/m
 -----END PGP SIGNATURE-----

diff --git a/sec-policy/selinux-audio-entropyd/files/fix-services-audioentropy-r1.patch b/sec-policy/selinux-audio-entropyd/files/fix-services-audioentropy-r1.patch
new file mode 100644 (file)
index 0000000..1ab0192
--- /dev/null
+++ b/sec-policy/selinux-audio-entropyd/files/fix-services-audioentropy-r1.patch
@@ -0,0 +1,74 @@
+--- services/audioentropy.te   2010-08-03 15:11:05.000000000 +0200
++++ services/audioentropy.te   2011-07-20 20:39:57.861005056 +0200
+@@ -5,6 +5,13 @@
+ # Declarations
+ #
+ 
++## <desc>
++## <p>
++##   Allow the use of the audio devices as the source for the entropy feeds
++## </p>
++## </desc>
++gen_tunable(entropyd_use_audio, false)
++
+ type entropyd_t;
+ type entropyd_exec_t;
+ init_daemon_domain(entropyd_t, entropyd_exec_t)
+@@ -20,11 +27,12 @@
+ allow entropyd_t self:capability { dac_override ipc_lock sys_admin };
+ dontaudit entropyd_t self:capability sys_tty_config;
+ allow entropyd_t self:process signal_perms;
++allow entropyd_t self:unix_dgram_socket create_socket_perms;
+ 
+ manage_files_pattern(entropyd_t, entropyd_var_run_t, entropyd_var_run_t)
+ files_pid_filetrans(entropyd_t, entropyd_var_run_t, file)
+ 
+-kernel_read_kernel_sysctls(entropyd_t)
++kernel_rw_kernel_sysctl(entropyd_t)
+ kernel_list_proc(entropyd_t)
+ kernel_read_proc_symlinks(entropyd_t)
+ 
+@@ -33,11 +41,6 @@
+ dev_write_urand(entropyd_t)
+ dev_read_rand(entropyd_t)
+ dev_write_rand(entropyd_t)
+-dev_read_sound(entropyd_t)
+-# set sound card parameters such as
+-# sample format, number of channels
+-# and sample rate.
+-dev_write_sound(entropyd_t)
+ 
+ files_read_etc_files(entropyd_t)
+ files_read_usr_files(entropyd_t)
+@@ -55,8 +58,19 @@
+ userdom_dontaudit_search_user_home_dirs(entropyd_t)
+ 
+ optional_policy(`
+-      alsa_read_lib(entropyd_t)
+-      alsa_read_rw_config(entropyd_t)
++      tunable_policy(`entropyd_use_audio',`
++              dev_read_sound(entropyd_t)
++              # set sound card parameters such as sample format, number of channels
++              # and sample rate.
++              dev_write_sound(entropyd_t)
++      ')
++')
++
++optional_policy(`
++      tunable_policy(`entropyd_use_audio',`
++              alsa_read_lib(entropyd_t)
++              alsa_read_rw_config(entropyd_t)
++      ')
+ ')
+ 
+ optional_policy(`
+--- services/audioentropy.fc   2010-08-03 15:11:05.000000000 +0200
++++ services/audioentropy.fc   2011-07-20 19:45:01.674004962 +0200
+@@ -2,5 +2,7 @@
+ # /usr
+ #
+ /usr/sbin/audio-entropyd      --      gen_context(system_u:object_r:entropyd_exec_t,s0)
++/usr/sbin/haveged             --      gen_context(system_u:object_r:entropyd_exec_t,s0)
+ 
+ /var/run/audio-entropyd\.pid  --      gen_context(system_u:object_r:entropyd_var_run_t,s0)
++/var/run/haveged\.pid         --      gen_context(system_u:object_r:entropyd_var_run_t,s0)

diff --git a/sec-policy/selinux-audio-entropyd/selinux-audio-entropyd-2.20101213-r1.ebuild b/sec-policy/selinux-audio-entropyd/selinux-audio-entropyd-2.20101213-r1.ebuild
new file mode 100644 (file)
index 0000000..455a5d8
--- /dev/null
+++ b/sec-policy/selinux-audio-entropyd/selinux-audio-entropyd-2.20101213-r1.ebuild
@@ -0,0 +1,17 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-audio-entropyd/selinux-audio-entropyd-2.20101213-r1.ebuild,v 1.1 2011/07/25 22:25:22 blueness Exp $
+
+MODS="audioentropy"
+IUSE=""
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for entropy-managing domains like audioentropyd, haveged, etc."
+
+KEYWORDS="~amd64 ~x86"
+RDEPEND="!<=sec-policy/selinux-haveged-2.20101213-r1
+       >=sys-apps/policycoreutils-1.30.30
+       >=sec-policy/selinux-base-policy-${PV}"
+
+POLICY_PATCH="${FILESDIR}/fix-services-audioentropy-r1.patch"