rewrite weechat.cilHEADmaster

1 files changed, 95 insertions, 49 deletions

diff --git a/src/agent/weechat.cil b/src/agent/weechat.cil
index 4fd8a64..bfb9f99 100644
--- a/src/agent/weechat.cil
+++ b/src/agent/weechat.cil
@@ -15,23 +15,49 @@
 
 (in agent
     (block weechat
-
         (blockinherit .subj.common.template)
-        (call subj.common.type (subj))
 
         (roletype .sys.role subj)
 
+        (allow subj self (file (setattr getattr)))
+
+        ;; allow execing ourself and allow type transition
         (call exec.subj_type_transition (.sys.subj subj))
         (call exec.entrypoint_file_files (subj))
         (call exec.mapexecute_file_files (subj))
         (call exec.read_file_files (subj))
 
-        ;; unix socket
+        ;; allow accessing our own data files
+        (call data.search_file_dirs (subj))
+        (call data.create_file_dirs (subj))
+        (call data.create_file_files (subj))
+        (call data.delete_file_files (subj))
+        (call data.readwrite_file_files (subj))
+        (call data.rename_file_files (subj))
+        (call data.addname_file_dirs (subj))
+        (call data.deletename_file_dirs (subj))
+        (call data.rename_file_dirs (subj))
+
+        ;; allow accessing our own runtime files
+        (call run.search_file_dirs (subj))
+        (call run.create_file_dirs (subj))
+        (call run.create_file_files (subj))
+        (call run.delete_file_files (subj))
+        (call run.readwrite_file_files (subj))
+        (call run.rename_file_files (subj))
+        (call run.addname_file_dirs (subj))
+        (call run.deletename_file_dirs (subj))
+        (call run.rename_file_dirs (subj))
+        
+        ;; allow using unix sockets so long as they are the same type as ourself
         (allow subj self (unix_dgram_socket (create sendto read write)))
 
-        ;; network
+        ;; allowing using the network but only irc ports specifically
         (allow subj self create_tcp_socket)
         (call irc.nameconnect_port_tcp_sockets (subj))
+
+        ;; use pipes
+        (call .sys.readwriteinherited_subj_fifo_files (subj))
         
         ;; use ssl certs
         (call .cert.search_file_dirs (subj))
@@ -40,66 +66,86 @@
         ;; use terminal
         (call .sys.use_subj_fds (subj))
         (call .dev.readwriteinherited_file_chr_files (subj))
-        (call .ptytermdev.readwriteinherited_all_chr_files (subj))
-
-        ;; use pipes
-        (call .sys.readwriteinherited_subj_fifo_files (subj))
-        
-        ;; read root
-        (call .root.search_file_dirs (subj))
+        (call .ptytermdev.readwriteinherited_all_chr_files (subj))    
 
-        ;; read /etc
-        (call .conf.search_file_dirs (subj))
-        (call .conf.read_file_files (subj))
-        (call .conf.read_file_lnk_files (subj))
-        
         ;; read /usr/share
         (call .data.search_file_dirs (subj))
         (call .data.read_file_files (subj))
-        
-        ;; access config stuff
+
+        ;; traverse /home
         (call .home.search_file_dirs (subj))
+
+        ;; traverse user home files
         (call .user.home.search_file_dirs (subj))
-        (call .user.home.create_file_dirs (subj))
-        (call .agent.weechat.home.search_file_dirs (subj))
-        (call .agent.weechat.home.readwrite_file_files (subj))
 
-        ;; access /run/user
-        (call .run.search_file_dirs (subj))
-        (call .runuser.search_file_dirs (subj))
-        (call .user.run.search_file_dirs (subj))
-        (call .user.run.create_file_dirs (subj))
-        (call .user.run.addname_file_dirs (subj))
+        ;; allow creating dirs in ~/.config
+        (call .xdg.config.user.home.search_file_dirs (subj))
+        (call .xdg.config.user.home.create_file_dirs (subj))
+        (call .xdg.config.user.home.addname_file_dirs (subj))        
+        
+        ;; allow creating dirs in ~/.cache
+        (call .xdg.cache.user.home.search_file_dirs (subj))
+        (call .xdg.cache.user.home.create_file_dirs (subj))
+        (call .xdg.cache.user.home.addname_file_dirs (subj))
+        
+        ;; allow creating dirs in ~/.local/share
+        (call .xdg.share.user.home.search_file_dirs (subj))
+        (call .xdg.share.user.home.create_file_dirs (subj))
+        (call .xdg.share.user.home.addname_file_dirs (subj))
 
-        ;; access /run/user/${UID}/weechat
-        (call .agent.weechat.run.search_file_dirs (subj))
-        (call .agent.weechat.run.create_file_dirs (subj))
-        (call .agent.weechat.run.write_file_dirs (subj))
-        (call .agent.weechat.run.readwrite_file_files (subj))
+        ;; allow creating dirs in ~/.local/state    
+        (call .xdg.state.user.home.search_file_dirs (subj))
+        (call .xdg.state.user.home.create_file_dirs (subj))
+        (call .xdg.state.user.home.addname_file_dirs (subj))
 
+        ;; allow creating files in the runtime directory
+        (call .run.search_file_dirs (subj))
+        (call .runuser.search_file_dirs (subj))
+        (call .runuser.create_file_dirs (subj))
+        (call .runuser.addname_file_dirs (subj))
+        
         (block exec
-            
-            (filecon "/usr/bin/weechat" file file_context)
-
-            (blockinherit .file.exec.template))
-
-        (block home
-
-            (filecon "HOME_DIR/\.config/weechat(/.*)?" any file_context)
-            (filecon "HOME_DIR/\.local/share/weechat(/.*)?" any file_context)
-            (filecon "HOME_DIR/\.local/state/weechat(/.*)?" any file_context)
-            (filecon "HOME_DIR/\.cache/weechat(/.*)?" any file_context)
-
-            (blockinherit .file.home.user.template))
+            (blockinherit .file.exec.template)
+
+            ;; Label the weechat executable itself.
+            ;; This along with some macros we called earlier cause executing weechat to transition to
+            ;; the .weechat.subj context.
+            (filecon "/usr/bin/weechat" file file_context))
+
+        (block data
+            ;; This macro will be called at some point and is what makes the files and directories
+            ;; weechat creates in ~/.config and such transition to .weechat.data.file type from
+            ;; .user.home.file.
+            (macro xdg_file_type_transition_file ((type ARG1) (class ARG2) (name ARG3))
+                (call .xdg.config.user.home.file_type_transition (ARG1 file ARG2 ARG3))
+                (call .xdg.cache.user.home.file_type_transition (ARG1 file ARG2 ARG3))
+                (call .xdg.share.user.home.file_type_transition (ARG1 file ARG2 ARG3))
+                (call .xdg.state.user.home.file_type_transition (ARG1 file ARG2 ARG3)))
+
+            (blockinherit .file.home.template)
+
+            (filecon "HOME_DIR/\.config/weechat" dir file_context)
+            (filecon "HOME_DIR/\.config/weechat/.*" file file_context)            
+            (filecon "HOME_DIR/\.local/share/weechat" dir file_context)
+            (filecon "HOME_DIR/\.local/share/weechat/.*" file file_context)            
+            (filecon "HOME_DIR/\.local/state/weechat" dir file_context)
+            (filecon "HOME_DIR/\.local/state/weechat/.*?" file file_context)            
+            (filecon "HOME_DIR/\.cache/weechat" dir file_context)
+            (filecon "HOME_DIR/\.cache/weechat/.*" file file_context))
 
         (block run
+            ;; This is similar to the file type transition macro above, but for runtime files instead
+            ;; of config and state files.
             (macro file_type_transition_file ((type ARG1) (class ARG2) (name ARG3))
-                (call .user.run.file_type_transition (ARG1 file ARG2 ARG3)))
-            
-            (blockinherit .file.user.run.template)
-            
+                (call .run.file_type_transition (ARG1 file ARG2 ARG3)))
+
+            (blockinherit .file.run.template)
+
             (filecon "/run/user/%{USERID}/weechat" dir file_context)
             (filecon "/run/user/%{USERID}/weechat/.*" any file_context))))
 
+(call .agent.weechat.data.xdg_file_type_transition_file (.agent.weechat.subj dir "*"))
+(call .agent.weechat.data.xdg_file_type_transition_file (.agent.weechat.subj file "*"))
+
 (call .agent.weechat.run.file_type_transition_file (.agent.weechat.subj dir "weechat"))
 (call .agent.weechat.run.file_type_transition_file (.agent.weechat.subj file "*"))