From 7572070111d24a7494c34af7f9b23359f4d4a57c Mon Sep 17 00:00:00 2001
From: Chris PeBenito <cpebenito@tresys.com>
Date: Dec 01 2005 22:53:20 +0000
Subject: loadable module build fixes



---

diff --git a/refpolicy/policy/modules/admin/amanda.if b/refpolicy/policy/modules/admin/amanda.if
index ca3b683..be99340 100644
--- a/refpolicy/policy/modules/admin/amanda.if
+++ b/refpolicy/policy/modules/admin/amanda.if
@@ -62,3 +62,19 @@ interface(`amanda_search_lib',`
 	allow $1 amanda_usr_lib_t:dir search;
 	files_search_usr($1)
 ')
+
+########################################
+## <summary>
+##	Do not audit attempts to read /etc/dumpdates.
+## </summary>
+## <param name="domain">
+##	Domain to not audit.
+## </param>
+#
+interface(`amanda_dontaudit_read_dumpdates',`
+	gen_require(`
+		type amanda_dumpdates_t;
+	')
+
+	dontaudit $1 amanda_dumpdates_t:file { getattr read };
+')
diff --git a/refpolicy/policy/modules/admin/rpm.if b/refpolicy/policy/modules/admin/rpm.if
index e8550e0..12f93fa 100644
--- a/refpolicy/policy/modules/admin/rpm.if
+++ b/refpolicy/policy/modules/admin/rpm.if
@@ -175,3 +175,22 @@ interface(`rpm_manage_db',`
 	allow $1 rpm_var_lib_t:file { getattr create read write append unlink };
 	allow $1 rpm_var_lib_t:lnk_file { getattr read write unlink };
 ')
+
+########################################
+## <summary>
+##	Do not audit attempts to create, read, 
+##	write, and delete the RPM package database.
+## </summary>
+## <param name="domain">
+##	Domain to not audit.
+## </param>
+#
+interface(`rpm_dontaudit_manage_db',`
+	gen_require(`
+		type rpm_var_lib_t;
+	')
+
+	dontaudit $1 rpm_var_lib_t:dir rw_dir_perms;
+	dontaudit $1 rpm_var_lib_t:file create_file_perms;
+	dontaudit $1 rpm_var_lib_t:lnk_file create_lnk_perms;
+')
diff --git a/refpolicy/policy/modules/services/snmp.te b/refpolicy/policy/modules/services/snmp.te
index 6b194b3..e8f3794 100644
--- a/refpolicy/policy/modules/services/snmp.te
+++ b/refpolicy/policy/modules/services/snmp.te
@@ -1,5 +1,5 @@
 
-policy_module(snmp,1.0)
+policy_module(snmp,1.0.1)
 
 ########################################
 #
@@ -117,6 +117,7 @@ userdom_dontaudit_search_sysadm_home_dir(snmpd_t)
 ifdef(`distro_redhat', `
 	optional_policy(`rpm',`
 		rpm_read_db(snmpd_t)
+		rpm_dontaudit_manage_db(snmpd_t)
 	')
 ')
 
@@ -126,6 +127,10 @@ ifdef(`targeted_policy', `
 	files_dontaudit_read_root_file(snmpd_t)
 ')
 
+optional_policy(`amanda',`
+	amanda_dontaudit_read_dumpdates(snmpd_t)
+')
+
 optional_policy(`nis',`
 	nis_use_ypbind(snmpd_t)
 ')
@@ -151,16 +156,5 @@ optional_policy(`cupsd',`
 ')
 ') dnl end TODO
 
-ifdef(`distro_redhat', `
-	optional_policy(`rpm',`
-		dontaudit snmpd_t rpm_var_lib_t:dir write;
-		dontaudit snmpd_t rpm_var_lib_t:file write;
-	')
-')
-
-optional_policy(`amanda',`
-	dontaudit snmpd_t amanda_dumpdates_t:file { getattr read };
-')
-
 allow snmpd_t rpc_pipefs_t:dir getattr;
 allow snmpd_t var_lib_nfs_t:dir search;
diff --git a/refpolicy/policy/modules/services/spamassassin.if b/refpolicy/policy/modules/services/spamassassin.if
index 4106ec9..83179b8 100644
--- a/refpolicy/policy/modules/services/spamassassin.if
+++ b/refpolicy/policy/modules/services/spamassassin.if
@@ -29,7 +29,7 @@
 # toggled on activation of spamc, and similarly for spamd.
 template(`spamassassin_per_userdomain_template',`
 	gen_require(`
-		type spamd_t;
+		type spamd_t, spamd_tmp_t;
 		type spamc_exec_t, spamassassin_exec_t;
 	')
 
@@ -287,16 +287,6 @@ template(`spamassassin_per_userdomain_template',`
 		corenet_tcp_connect_all_ports($1_spamassassin_t)
 
 		sysnet_read_config($1_spamassassin_t)
-
-		optional_policy(`mount',`
-			mount_send_nfs_client_request($1_spamassassin_t)
-		')
-	')
-
-	tunable_policy(`spamassasin_can_network && allow_ypbind',`
-		optional_policy(`nis',`
-			nis_use_ypbind_uncond($1_spamassassin_t)
-		')
 	')
 
 	tunable_policy(`use_nfs_home_dirs',`
@@ -312,7 +302,13 @@ template(`spamassassin_per_userdomain_template',`
 	')
 
 	optional_policy(`nis',`
+		# cjp: clearly some redundancy here
+
 		nis_use_ypbind($1_spamassassin_t)
+
+		tunable_policy(`spamassasin_can_network && allow_ypbind',`
+			nis_use_ypbind_uncond($1_spamassassin_t)
+		')
 	')
 
 	optional_policy(`sendmail',`
diff --git a/refpolicy/policy/modules/system/userdomain.if b/refpolicy/policy/modules/system/userdomain.if
index a4f90d9..56a6796 100644
--- a/refpolicy/policy/modules/system/userdomain.if
+++ b/refpolicy/policy/modules/system/userdomain.if
@@ -1000,7 +1000,7 @@ template(`admin_user_template',`
 #
 template(`userdom_home_file',`
 	gen_require(`
-		type $1_file_type;
+		attribute $1_file_type;
 	')
 
 	typeattribute $2 $1_file_type;