Merge ncftool from Fedora.

Changelog

@@ -38,6 +38,7 @@
 	cmirrord (Miroslav Grepl)
 	mediawiki (Miroslav Grepl)
 	mpd (Miroslav Grepl)
+	ncftool
 	passenger (Miroslav Grepl)
 	qpid (Dan Walsh)
 	samhain (Harry Ciao)

policy/modules/admin/ncftool.fc

@@ -0,0 +1 @@
+/usr/bin/ncftool	--	gen_context(system_u:object_r:ncftool_exec_t,s0)

policy/modules/admin/ncftool.if

@@ -0,0 +1,48 @@
+## <summary>Netcf network configuration tool (ncftool).</summary>
+
+########################################
+## <summary>
+##	Execute a domain transition to run ncftool.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`ncftool_domtrans',`
+	gen_require(`
+		type ncftool_t, ncftool_exec_t;
+	')
+
+	domtrans_pattern($1, ncftool_exec_t, ncftool_t)
+')
+
+########################################
+## <summary>
+##	Execute ncftool in the ncftool domain, and
+##	allow the specified role the ncftool domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed the ncftool domain.
+##	</summary>
+## </param>
+#
+interface(`ncftool_run',`
+	gen_require(`
+		type ncftool_t;
+	')
+
+	ncftool_domtrans($1)
+	role $2 types ncftool_t;
+
+	optional_policy(`
+		brctl_run(ncftool_t, $2)
+	')
+')

policy/modules/admin/ncftool.te

@@ -0,0 +1,78 @@
+policy_module(ncftool, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type ncftool_t;
+type ncftool_exec_t;
+application_domain(ncftool_t, ncftool_exec_t)
+domain_obj_id_change_exemption(ncftool_t)
+domain_system_change_exemption(ncftool_t)
+role system_r types ncftool_t;
+
+########################################
+#
+# ncftool local policy
+#
+
+allow ncftool_t self:capability { net_admin sys_ptrace };
+allow ncftool_t self:process signal;
+allow ncftool_t self:fifo_file manage_fifo_file_perms;
+allow ncftool_t self:unix_stream_socket create_stream_socket_perms;
+allow ncftool_t self:tcp_socket create_stream_socket_perms;
+allow ncftool_t self:netlink_route_socket create_netlink_socket_perms;
+
+kernel_read_kernel_sysctls(ncftool_t)
+kernel_read_modprobe_sysctls(ncftool_t)
+kernel_read_network_state(ncftool_t)
+kernel_read_system_state(ncftool_t)
+kernel_request_load_module(ncftool_t)
+kernel_rw_net_sysctls(ncftool_t)
+
+corecmd_exec_bin(ncftool_t)
+corecmd_exec_shell(ncftool_t)
+
+domain_read_all_domains_state(ncftool_t)
+
+dev_read_sysfs(ncftool_t)
+
+files_read_etc_files(ncftool_t)
+files_read_etc_runtime_files(ncftool_t)
+files_read_usr_files(ncftool_t)
+
+miscfiles_read_localization(ncftool_t)
+
+sysnet_delete_dhcpc_pid(ncftool_t)
+sysnet_domtrans_dhcpc(ncftool_t)
+sysnet_domtrans_ifconfig(ncftool_t)
+sysnet_etc_filetrans_config(ncftool_t)
+sysnet_manage_config(ncftool_t)
+sysnet_read_dhcpc_state(ncftool_t)
+sysnet_read_dhcpc_pid(ncftool_t)
+sysnet_signal_dhcpc(ncftool_t)
+
+userdom_use_user_terminals(ncftool_t)
+userdom_read_user_tmp_files(ncftool_t)
+
+optional_policy(`
+	consoletype_exec(ncftool_t)
+')
+
+optional_policy(`
+	dbus_system_bus_client(ncftool_t)
+')
+
+optional_policy(`
+	iptables_initrc_domtrans(ncftool_t)
+')
+
+optional_policy(`
+	modutils_read_module_config(ncftool_t)
+	modutils_domtrans_insmod(ncftool_t)
+')
+
+optional_policy(`
+	netutils_domtrans(ncftool_t)
+')