From: sven.vermeulen@siphos.be (Sven Vermeulen) Date: Sat, 3 Sep 2011 16:22:22 +0200 Subject: [refpolicy] [PATCHv2 6/8] Introduce gpg_exec interface In-Reply-To: <20110903141833.GA25374@siphos.be> References: <20110903141833.GA25374@siphos.be> Message-ID: <20110903142222.GG25374@siphos.be> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com Some applications might want to execute gpg without requiring a transition. A possible use case is to allow applications to validate signatures (made by GnuPG). As long as the application doesn't need to generate signatures itself and its trustdb is not marked as gpg_secret_t, it suffices to grant it gpg_exec(). Note that it does require the application to have read/write rights in the directory where the trustdb is stored (as gpg tries to generate lock files where the trustdb file is located). Signed-off-by: Sven Vermeulen --- policy/modules/apps/gpg.if | 18 ++++++++++++++++++ 1 files changed, 18 insertions(+), 0 deletions(-) diff --git a/policy/modules/apps/gpg.if b/policy/modules/apps/gpg.if index 40e0a2a..6d50300 100644 --- a/policy/modules/apps/gpg.if +++ b/policy/modules/apps/gpg.if @@ -87,6 +87,24 @@ interface(`gpg_domtrans',` ######################################## ## +## Execute the gpg application without transitioning +## +## +## +## Domain allowed to execute gpg +## +## +# +interface(`gpg_exec',` + gen_require(` + type gpg_exec_t; + ') + + can_exec($1, gpg_exec_t) +') + +######################################## +## ## Send generic signals to user gpg processes. ## ## -- 1.7.3.4