From cd146735037b56a9e659aee8a4a8351872ff0574 Mon Sep 17 00:00:00 2001 From: "Anthony G. Basile" Date: Mon, 25 Jul 2011 22:25:22 +0000 Subject: [PATCH] Update audio-entropyd to support haveged Package-Manager: portage-2.1.10.3/cvs/Linux x86_64 --- sec-policy/selinux-audio-entropyd/ChangeLog | 9 ++- sec-policy/selinux-audio-entropyd/Manifest | 10 ++- .../files/fix-services-audioentropy-r1.patch | 74 +++++++++++++++++++ ...elinux-audio-entropyd-2.20101213-r1.ebuild | 17 +++++ 4 files changed, 105 insertions(+), 5 deletions(-) create mode 100644 sec-policy/selinux-audio-entropyd/files/fix-services-audioentropy-r1.patch create mode 100644 sec-policy/selinux-audio-entropyd/selinux-audio-entropyd-2.20101213-r1.ebuild diff --git a/sec-policy/selinux-audio-entropyd/ChangeLog b/sec-policy/selinux-audio-entropyd/ChangeLog index 021edebe9030..2f84771dc9aa 100644 --- a/sec-policy/selinux-audio-entropyd/ChangeLog +++ b/sec-policy/selinux-audio-entropyd/ChangeLog @@ -1,6 +1,13 @@ # ChangeLog for sec-policy/selinux-audio-entropyd # Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-audio-entropyd/ChangeLog,v 1.21 2011/06/04 16:08:00 blueness Exp $ +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-audio-entropyd/ChangeLog,v 1.22 2011/07/25 22:25:22 blueness Exp $ + +*selinux-audio-entropyd-2.20101213-r1 (25 Jul 2011) + + 25 Jul 2011; Anthony G. Basile + +files/fix-services-audioentropy-r1.patch, + +selinux-audio-entropyd-2.20101213-r1.ebuild: + Update audio-entropyd to support haveged 04 Jun 2011; Anthony G. Basile -selinux-audio-entropyd-2.20090730.ebuild, diff --git a/sec-policy/selinux-audio-entropyd/Manifest b/sec-policy/selinux-audio-entropyd/Manifest index a39ba0d73103..b7cc53b797b5 100644 --- a/sec-policy/selinux-audio-entropyd/Manifest +++ b/sec-policy/selinux-audio-entropyd/Manifest @@ -1,14 +1,16 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 +AUX fix-services-audioentropy-r1.patch 2270 RMD160 f34a2e9a8c925162a1b0faebf76b57b53a741e5f SHA1 1ee12035497ea3015207732191c051b420581bad SHA256 a63db610f8cd1eaebb895b148b4ccbaf678594d4c53be3007172dda3c288f1d8 DIST refpolicy-2.20101213.tar.bz2 559450 RMD160 4858f792f4db5b179de6fb8419a626c29d59bdd3 SHA1 0e881e99b8950a358eadc44633551ca10f12eaee SHA256 b691ee8f6066cc19bb0d4384fe3be277d97d22e9d4ac2db0c252065e8c3535de +EBUILD selinux-audio-entropyd-2.20101213-r1.ebuild 626 RMD160 93cc1a79cd7ce2e0945370a0197f93a5072d26c3 SHA1 bd6ca3b9d674c31ce0b68a2632b02d488ca20d4b SHA256 fefe2a2f36c830b3a479bc54946ae370b08d22d918d6550d30fb5c4a969b2197 EBUILD selinux-audio-entropyd-2.20101213.ebuild 384 RMD160 7e718a1c3e32d0ce237f582755aa671059f677e6 SHA1 451c7703fe3b9f25fea282604f6981f70dde6206 SHA256 af097fbcfe5754e75ce660cd3c02e76f5b8cd99bc85b9d641b8620495db25e5e -MISC ChangeLog 3361 RMD160 4f7519ff3654f9925682286648c39d231aebfeb9 SHA1 cb9d0c10c1c285091db91e9255a15a3afe25d0a6 SHA256 302f8da6f9d91bad231104b3fb60d95b3d271d324dec33993dd492f6ac518dfc +MISC ChangeLog 3606 RMD160 4c2d428cad67cbe5d359b4b98254c30f0273dfa5 SHA1 f3eb8b3cb9917c3e20bc31507ad50b11d2090d8e SHA256 2f2515d2e8ceb239bad562ec372630538b7fbd81e40111d020c4f22c4ac43ffd MISC metadata.xml 238 RMD160 11240cce23db1e9fe9bef8eec5965a0c443cecf8 SHA1 6dbca0ab23c6c25f4d06f8c722b0f744448b97b4 SHA256 db855a0621427000f781e9b845ad054b6e43ec0688fb45b4ebb8c26d06cd822c -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (GNU/Linux) -iEYEAREIAAYFAk3qWGoACgkQl5yvQNBFVTUsJQCeJVZHThHgRaKHJfL0z1LJ/uuO -G0cAn1hCxz7eE4qVk147sNCX+axSH/LJ -=y+w4 +iEYEAREIAAYFAk4t7VwACgkQl5yvQNBFVTVGxgCfYw2GwHNCZp1Zgw0MTa5vkDSd +KJcAnRrHQP89gTGWDrqRBGCnUGmNSYxY +=tt/m -----END PGP SIGNATURE----- diff --git a/sec-policy/selinux-audio-entropyd/files/fix-services-audioentropy-r1.patch b/sec-policy/selinux-audio-entropyd/files/fix-services-audioentropy-r1.patch new file mode 100644 index 000000000000..1ab0192037f9 --- /dev/null +++ b/sec-policy/selinux-audio-entropyd/files/fix-services-audioentropy-r1.patch @@ -0,0 +1,74 @@ +--- services/audioentropy.te 2010-08-03 15:11:05.000000000 +0200 ++++ services/audioentropy.te 2011-07-20 20:39:57.861005056 +0200 +@@ -5,6 +5,13 @@ + # Declarations + # + ++## ++##

++## Allow the use of the audio devices as the source for the entropy feeds ++##

++## ++gen_tunable(entropyd_use_audio, false) ++ + type entropyd_t; + type entropyd_exec_t; + init_daemon_domain(entropyd_t, entropyd_exec_t) +@@ -20,11 +27,12 @@ + allow entropyd_t self:capability { dac_override ipc_lock sys_admin }; + dontaudit entropyd_t self:capability sys_tty_config; + allow entropyd_t self:process signal_perms; ++allow entropyd_t self:unix_dgram_socket create_socket_perms; + + manage_files_pattern(entropyd_t, entropyd_var_run_t, entropyd_var_run_t) + files_pid_filetrans(entropyd_t, entropyd_var_run_t, file) + +-kernel_read_kernel_sysctls(entropyd_t) ++kernel_rw_kernel_sysctl(entropyd_t) + kernel_list_proc(entropyd_t) + kernel_read_proc_symlinks(entropyd_t) + +@@ -33,11 +41,6 @@ + dev_write_urand(entropyd_t) + dev_read_rand(entropyd_t) + dev_write_rand(entropyd_t) +-dev_read_sound(entropyd_t) +-# set sound card parameters such as +-# sample format, number of channels +-# and sample rate. +-dev_write_sound(entropyd_t) + + files_read_etc_files(entropyd_t) + files_read_usr_files(entropyd_t) +@@ -55,8 +58,19 @@ + userdom_dontaudit_search_user_home_dirs(entropyd_t) + + optional_policy(` +- alsa_read_lib(entropyd_t) +- alsa_read_rw_config(entropyd_t) ++ tunable_policy(`entropyd_use_audio',` ++ dev_read_sound(entropyd_t) ++ # set sound card parameters such as sample format, number of channels ++ # and sample rate. ++ dev_write_sound(entropyd_t) ++ ') ++') ++ ++optional_policy(` ++ tunable_policy(`entropyd_use_audio',` ++ alsa_read_lib(entropyd_t) ++ alsa_read_rw_config(entropyd_t) ++ ') + ') + + optional_policy(` +--- services/audioentropy.fc 2010-08-03 15:11:05.000000000 +0200 ++++ services/audioentropy.fc 2011-07-20 19:45:01.674004962 +0200 +@@ -2,5 +2,7 @@ + # /usr + # + /usr/sbin/audio-entropyd -- gen_context(system_u:object_r:entropyd_exec_t,s0) ++/usr/sbin/haveged -- gen_context(system_u:object_r:entropyd_exec_t,s0) + + /var/run/audio-entropyd\.pid -- gen_context(system_u:object_r:entropyd_var_run_t,s0) ++/var/run/haveged\.pid -- gen_context(system_u:object_r:entropyd_var_run_t,s0) diff --git a/sec-policy/selinux-audio-entropyd/selinux-audio-entropyd-2.20101213-r1.ebuild b/sec-policy/selinux-audio-entropyd/selinux-audio-entropyd-2.20101213-r1.ebuild new file mode 100644 index 000000000000..455a5d81f145 --- /dev/null +++ b/sec-policy/selinux-audio-entropyd/selinux-audio-entropyd-2.20101213-r1.ebuild @@ -0,0 +1,17 @@ +# Copyright 1999-2011 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sec-policy/selinux-audio-entropyd/selinux-audio-entropyd-2.20101213-r1.ebuild,v 1.1 2011/07/25 22:25:22 blueness Exp $ + +MODS="audioentropy" +IUSE="" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for entropy-managing domains like audioentropyd, haveged, etc." + +KEYWORDS="~amd64 ~x86" +RDEPEND="!<=sec-policy/selinux-haveged-2.20101213-r1 + >=sys-apps/policycoreutils-1.30.30 + >=sec-policy/selinux-base-policy-${PV}" + +POLICY_PATCH="${FILESDIR}/fix-services-audioentropy-r1.patch" -- 2.26.2