add content

sec-policy/selinux-toe/Manifest

@@ -0,0 +1,4 @@
+AUX toe.cil 850 BLAKE2B 868de20c80b2a15e4b9952d238314ff847b094a33e55ca31c77cc63fe585d394c8c46a2a72852cccbd4250d1f6c21f008c3d3946f2ab54422a56aefb8e3ec0a7 SHA512 0985266aa4fd290df95d611d73b6fe1dc821c52a1280485886efdd9696e358442cf7c8016c8fe47fcdbcbddb0fcf0ef511c37f524ee5f83d9a57fba94b61a4f9
+DIST patchbundle-selinux-base-policy-2.20180701-r1.tar.bz2 315378 BLAKE2B eeeb0b04c023c40289b6d964aefd1773d2b5d6912f1dffebf9509e6dcdbb39b17e722ee4483fb2b11193d4b987a85f90c7dc7e61cef3cf982fc2ba368d4900ef SHA512 a8b049120f1c420f9bfb55aba9ed0157ff7896ace402cd1b77b01d1ea52b67e49d915f1c00de83ff4d59b1cf8b8aa1f39b50ba312d842ed4850e75fcc7f5be42
+DIST refpolicy-2.20180701.tar.bz2 753050 BLAKE2B 7069a1b9b9bef25950e62bb50ac09f4a9d5ef6fd0acc667d321da396c3935939348534458df129f7bc81687dca240b4c4fc120d1f46d452665d335c9f023da8c SHA512 9dd5a1e10da5d25fea96cc25efb682f8ac866e835a1d940b161c1ce944cac9a90a5836b03c14311acad6bf9acd9a78003f36e050d35d8edb43606575523857b5
+EBUILD selinux-toe-2.20180701-r1.ebuild 390 BLAKE2B d5f793a0130e6cd1812e83860a1f307142a86d9543e9f5052447297d7f80b11fbe7a1de18e4c121135eb6a7bada6552a36dd8454f7bf2b7a3a62a38a230438a5 SHA512 7597ec58304a19796053339032e0d65e8801372c716388554d6fb2fe7d88207f5cbf1fab842f08449910bcef82bc5d60792200e4e901b3b41dbd0132d56efef9

sec-policy/selinux-toe/files/toe.cil

@@ -0,0 +1,23 @@
+; Name: TOE (Trusted Owner Execution) SELinux module.
+; Author: Alexander Miroshnichenko (alexminder)
+; e-mail: alexminder@gmail.com
+; Purpose: Prevent users to execute untrusted their (non system_u context) or tmp files.
+; License: GPL-3
+;
+(typeattributeset cil_gen_require (user_home_t git_user_content_t portage_tmp_t initrc_tmp_t gcc_config_tmp_t semanage_tmp_t portage_fetch_tmp_t virt_tmp_t))
+(typeattribute toe_insecure_type)
+(typeattribute toe_exclude_type)
+(typeattributeset toe_insecure_type (user_home_t git_user_content_t))
+(typeattributeset toe_exclude_type (portage_tmp_t initrc_tmp_t gcc_config_tmp_t semanage_tmp_t portage_fetch_tmp_t virt_tmp_t))
+(constrain (file (execute))
+  (and
+    (neq t2 toe_insecure_type)
+    (or
+      (eq t2 toe_exclude_type)
+      (and
+        (eq u2 system_u)
+        (neq t2 tmpfile)
+      )
+    )
+  )
+)

sec-policy/selinux-toe/selinux-toe-2.20180701-r1.ebuild

@@ -0,0 +1,20 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+EAPI="5"
+
+IUSE=""
+MODS="toe"
+POLICY_FILES="toe.cil"
+
+inherit selinux-policy-2
+
+DESCRIPTION="SELinux policy for trusted owner (sysadm_u) execution"
+
+RDEPEND="sec-policy/selinux-base-policy"
+
+if [[ $PV == 9999* ]] ; then
+        KEYWORDS=""
+else
+        KEYWORDS="amd64 x86"
+fi