rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity
628fb6b378
selinux-policy/execmem.patch

2590 lines
74 KiB
Diff
Raw Normal View History

Merge
2011-11-16 15:58:53 +00:00
diff --git a/policy/modules/admin/rpm.te b/policy/modules/admin/rpm.te
index 17b5426..a485d76 100644
--- a/policy/modules/admin/rpm.te
+++ b/policy/modules/admin/rpm.te
@@ -419,7 +419,6 @@ optional_policy(`
optional_policy(`
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
unconfined_domain_noaudit(rpm_script_t)
unconfined_domtrans(rpm_script_t)
Merge
2011-11-16 15:58:53 +00:00
- unconfined_execmem_domtrans(rpm_script_t)
optional_policy(`
java_domtrans_unconfined(rpm_script_t)
diff --git a/policy/modules/admin/sudo.if b/policy/modules/admin/sudo.if
index 634c47a..748db5b 100644
--- a/policy/modules/admin/sudo.if
+++ b/policy/modules/admin/sudo.if
@@ -47,6 +47,7 @@ template(`sudo_role_template',`
domain_role_change_exemption($1_sudo_t)
ubac_constrained($1_sudo_t)
role $2 types $1_sudo_t;
+ userdom_home_manager($1_sudo_t)
type $1_sudo_tmp_t;
files_tmp_file($1_sudo_tmp_t)
diff --git a/policy/modules/admin/sudo.te b/policy/modules/admin/sudo.te
index 71bf5e8..9ce39dd 100644
--- a/policy/modules/admin/sudo.te
+++ b/policy/modules/admin/sudo.te
@@ -101,14 +101,6 @@ userdom_search_user_home_content(sudodomain)
userdom_search_admin_dir(sudodomain)
userdom_manage_all_users_keys(sudodomain)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_files(sudodomain)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_files(sudodomain)
-')
-
optional_policy(`
dbus_system_bus_client(sudodomain)
')
diff --git a/policy/modules/apps/cdrecord.te b/policy/modules/apps/cdrecord.te
index f7183ef..49ce279 100644
--- a/policy/modules/apps/cdrecord.te
+++ b/policy/modules/apps/cdrecord.te
@@ -109,11 +109,7 @@ tunable_policy(`cdrecord_read_content',`
userdom_dontaudit_read_user_home_content_files(cdrecord_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- files_search_mnt(cdrecord_t)
- fs_read_nfs_files(cdrecord_t)
- fs_read_nfs_symlinks(cdrecord_t)
-')
+userdom_home_manager(cdrecord_t)
optional_policy(`
resmgr_stream_connect(cdrecord_t)
diff --git a/policy/modules/apps/chrome.te b/policy/modules/apps/chrome.te
index 6c642a2..acb325c 100644
--- a/policy/modules/apps/chrome.te
+++ b/policy/modules/apps/chrome.te
@@ -92,11 +92,6 @@ miscfiles_read_fonts(chrome_sandbox_t)
sysnet_dns_name_resolve(chrome_sandbox_t)
optional_policy(`
- execmem_exec(chrome_sandbox_t)
- execmem_execmod(chrome_sandbox_t)
-')
-
-optional_policy(`
gnome_rw_inherited_config(chrome_sandbox_t)
gnome_read_home_config(chrome_sandbox_t)
')
diff --git a/policy/modules/apps/execmem.fc b/policy/modules/apps/execmem.fc
deleted file mode 100644
index 5e09952..0000000
--- a/policy/modules/apps/execmem.fc
+++ /dev/null
@@ -1,49 +0,0 @@
-
-/usr/bin/aticonfig -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/darcs -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/dosbox -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/haddock.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/hasktags -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/plasma-desktop -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/runghc -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/runhaskell -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/sbcl -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/skype -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/valgrind -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/sbin/vboxadd-service -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/sbin/VBox.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-ifdef(`distro_gentoo',`
-/usr/lib32/openoffice/program/[^/]+\.bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-')
-/usr/lib/chromium-browser/chromium-browser gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/lib/erlang/erts-[^/]+/bin/beam.smp -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/lib/R/bin/exec/R -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-/usr/libexec/ghc-[^/]+/.*bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/libexec/ghc-[^/]+/ghc.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/lib/ghc-[^/]+/ghc.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/lib/ia32el/ia32x_loader -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/lib/virtualbox/VirtualBox -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-/opt/real/(.*/)?realplay\.bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/opt/secondlife-install/bin/SLPlugin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-/opt/real/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-/usr/local/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-/usr/lib/gimp/[^/]+/plug-ins/help-browser -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/lib/wingide-[^/]+/bin/PyCore/python -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/lib/thunderbird-[^/]+/thunderbird-bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-/opt/Adobe.*AIR/.*/Resources/Adobe.AIR.Updater -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/opt/Adobe.*AIR/.*/Resources/Adobe.AIR.Application -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-/opt/likewise/bin/domainjoin-cli -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-/opt/google/chrome/chrome -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/opt/google/chrome/google-chrome -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/opt/Komodo-Edit-5/lib/mozilla/komodo-bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/opt/Adobe/Reader9/Reader/intellinux/bin/acroread -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/local/Wolfram/Mathematica(/.*)?MathKernel -- gen_context(system_u:object_r:execmem_exec_t,s0)
diff --git a/policy/modules/apps/execmem.if b/policy/modules/apps/execmem.if
deleted file mode 100644
index e23f640..0000000
--- a/policy/modules/apps/execmem.if
+++ /dev/null
@@ -1,132 +0,0 @@
-## <summary>execmem domain</summary>
-
-########################################
-## <summary>
-## Execute the execmem program
-## in the caller domain.
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-#
-interface(`execmem_exec',`
- gen_require(`
- type execmem_exec_t;
- ')
-
- can_exec($1, execmem_exec_t)
-')
-
-#######################################
-## <summary>
-## The role template for the execmem module.
-## </summary>
-## <desc>
-## <p>
-## This template creates a derived domains which are used
-## for execmem applications.
-## </p>
-## </desc>
-## <param name="role_prefix">
-## <summary>
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-## </summary>
-## </param>
-## <param name="user_role">
-## <summary>
-## The role associated with the user domain.
-## </summary>
-## </param>
-## <param name="user_domain">
-## <summary>
-## The type of the user domain.
-## </summary>
-## </param>
-#
-template(`execmem_role_template',`
- gen_require(`
- type execmem_exec_t;
- ')
-
- type $1_execmem_t;
- domain_type($1_execmem_t)
- domain_entry_file($1_execmem_t, execmem_exec_t)
- role $2 types $1_execmem_t;
-
- userdom_unpriv_usertype($1, $1_execmem_t)
- userdom_manage_tmp_role($2, $1_execmem_t)
- userdom_manage_tmpfs_role($2, $1_execmem_t)
-
- allow $1_execmem_t self:process { execmem execstack };
- allow $3 $1_execmem_t:process { getattr ptrace noatsecure signal_perms };
- domtrans_pattern($3, execmem_exec_t, $1_execmem_t)
-
- files_execmod_tmp($1_execmem_t)
-
- allow $3 execmem_exec_t:file execmod;
- allow $1_execmem_t execmem_exec_t:file execmod;
-
- # needed by plasma-desktop
- optional_policy(`
- gnome_read_usr_config($1_execmem_t)
- ')
-
- optional_policy(`
- mozilla_execmod_user_home_files($1_execmem_t)
- ')
-
- optional_policy(`
- nsplugin_rw_shm($1_execmem_t)
- nsplugin_rw_semaphores($1_execmem_t)
- ')
-
- optional_policy(`
- xserver_role($2, $1_execmem_t)
- ')
-')
-
-########################################
-## <summary>
-## Execute a execmem_exec file
-## in the specified domain.
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-## <param name="target_domain">
-## <summary>
-## The type of the new process.
-## </summary>
-## </param>
-#
-interface(`execmem_domtrans',`
- gen_require(`
- type execmem_exec_t;
- ')
-
- domtrans_pattern($1, execmem_exec_t, $2)
-')
-
-########################################
-## <summary>
-## Execmod the execmem_exec applications
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-#
-interface(`execmem_execmod',`
- gen_require(`
- type execmem_exec_t;
- ')
-
- allow $1 execmem_exec_t:file execmod;
-')
-
diff --git a/policy/modules/apps/execmem.te b/policy/modules/apps/execmem.te
deleted file mode 100644
index a7d37e2..0000000
--- a/policy/modules/apps/execmem.te
+++ /dev/null
@@ -1,10 +0,0 @@
-policy_module(execmem, 1.0.0)
-
-########################################
-#
-# Declarations
-#
-
-type execmem_exec_t alias unconfined_execmem_exec_t;
-application_executable_file(execmem_exec_t)
-
diff --git a/policy/modules/apps/gift.te b/policy/modules/apps/gift.te
index 10a2ce4..5c81832 100644
--- a/policy/modules/apps/gift.te
+++ b/policy/modules/apps/gift.te
@@ -70,17 +70,7 @@ sysnet_read_config(gift_t)
# giftui looks in .icons, .themes.
userdom_dontaudit_read_user_home_content_files(gift_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(gift_t)
- fs_manage_nfs_files(gift_t)
- fs_manage_nfs_symlinks(gift_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(gift_t)
- fs_manage_cifs_files(gift_t)
- fs_manage_cifs_symlinks(gift_t)
-')
+userdom_home_manager(gift_t)
optional_policy(`
nscd_socket_use(gift_t)
@@ -133,15 +123,4 @@ miscfiles_read_localization(giftd_t)
sysnet_read_config(giftd_t)
userdom_use_inherited_user_terminals(giftd_t)
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(giftd_t)
- fs_manage_nfs_files(giftd_t)
- fs_manage_nfs_symlinks(giftd_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(giftd_t)
- fs_manage_cifs_files(giftd_t)
- fs_manage_cifs_symlinks(giftd_t)
-')
+userdom_home_manager(gitd_t)
diff --git a/policy/modules/apps/gnome.if b/policy/modules/apps/gnome.if
index deab06c..00762c5 100644
--- a/policy/modules/apps/gnome.if
+++ b/policy/modules/apps/gnome.if
@@ -70,6 +70,8 @@ interface(`gnome_role_gkeyringd',`
ubac_constrained($1_gkeyringd_t)
domain_user_exemption_target($1_gkeyringd_t)
+ userdom_home_manager($1_gkeyringd_t)
+
role $2 types $1_gkeyringd_t;
domtrans_pattern($3, gkeyringd_exec_t, $1_gkeyringd_t)
diff --git a/policy/modules/apps/gnome.te b/policy/modules/apps/gnome.te
index 45b4ca9..14d7e30 100644
--- a/policy/modules/apps/gnome.te
+++ b/policy/modules/apps/gnome.te
@@ -153,15 +153,7 @@ optional_policy(`
policykit_read_reload(gconfdefaultsm_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(gconfdefaultsm_t)
- fs_manage_nfs_files(gconfdefaultsm_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(gconfdefaultsm_t)
- fs_manage_cifs_files(gconfdefaultsm_t)
-')
+userdom_home_manager(gconfdefaultsm_t)
#######################################
#
@@ -233,6 +225,7 @@ corecmd_search_bin(gkeyringd_domain)
dev_read_rand(gkeyringd_domain)
dev_read_urand(gkeyringd_domain)
+dev_read_sysfs(gkeyringd_domain)
files_read_etc_files(gkeyringd_domain)
files_read_usr_files(gkeyringd_domain)
@@ -268,13 +261,3 @@ domain_use_interactive_fds(gnome_domain)
userdom_use_inherited_user_terminals(gnome_domain)
-tunable_policy(`use_nfs_home_dirs',`
- fs_getattr_nfs(gkeyringd_domain)
- fs_manage_nfs_dirs(gkeyringd_domain)
- fs_manage_nfs_files(gkeyringd_domain)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(gkeyringd_domain)
- fs_manage_cifs_files(gkeyringd_domain)
-')
diff --git a/policy/modules/apps/gpg.te b/policy/modules/apps/gpg.te
index 401a4ec..80f8c31 100644
--- a/policy/modules/apps/gpg.te
+++ b/policy/modules/apps/gpg.te
@@ -150,15 +150,7 @@ userdom_stream_connect(gpg_t)
mta_write_config(gpg_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(gpg_t)
- fs_manage_nfs_files(gpg_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(gpg_t)
- fs_manage_cifs_files(gpg_t)
-')
+userdom_home_manager(gpg_t)
optional_policy(`
gnome_read_config(gpg_t)
@@ -290,17 +282,7 @@ tunable_policy(`gpg_agent_env_file',`
userdom_manage_user_home_content_files(gpg_agent_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(gpg_agent_t)
- fs_manage_nfs_files(gpg_agent_t)
- fs_manage_nfs_symlinks(gpg_agent_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(gpg_agent_t)
- fs_manage_cifs_files(gpg_agent_t)
- fs_manage_cifs_symlinks(gpg_agent_t)
-')
+userdom_home_manager(gpg_agent_t)
optional_policy(`
mozilla_dontaudit_rw_user_home_files(gpg_agent_t)
@@ -371,13 +353,7 @@ allow gpg_pinentry_t user_tmpfs_t:file unlink;
userdom_signull_unpriv_users(gpg_pinentry_t)
userdom_use_user_terminals(gpg_pinentry_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(gpg_pinentry_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(gpg_pinentry_t)
-')
+userdom_home_reader(gpg_pinentry_t)
optional_policy(`
gnome_read_home_config(gpg_pinentry_t)
diff --git a/policy/modules/apps/irc.te b/policy/modules/apps/irc.te
index b69a628..4bc18b6 100644
--- a/policy/modules/apps/irc.te
+++ b/policy/modules/apps/irc.te
@@ -110,17 +110,7 @@ sysnet_read_config(irc_t)
# Write to the user domain tty.
userdom_use_inherited_user_terminals(irc_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(irc_t)
- fs_manage_nfs_files(irc_t)
- fs_manage_nfs_symlinks(irc_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(irc_t)
- fs_manage_cifs_files(irc_t)
- fs_manage_cifs_symlinks(irc_t)
-')
+userdom_home_manager(irc_t)
optional_policy(`
nis_use_ypbind(irc_t)
@@ -185,17 +175,7 @@ tunable_policy(`irssi_use_full_network', `
corenet_sendrecv_all_client_packets(irssi_t)
')
-tunable_policy(`use_nfs_home_dirs', `
- fs_manage_nfs_dirs(irssi_t)
- fs_manage_nfs_files(irssi_t)
- fs_manage_nfs_symlinks(irssi_t)
-')
-
-tunable_policy(`use_samba_home_dirs', `
- fs_manage_cifs_dirs(irssi_t)
- fs_manage_cifs_files(irssi_t)
- fs_manage_cifs_symlinks(irssi_t)
-')
+userdom_home_manager(irssi_t)
optional_policy(`
automount_dontaudit_getattr_tmp_dirs(irssi_t)
diff --git a/policy/modules/apps/java.fc b/policy/modules/apps/java.fc
index 5d2130c..86c1768 100644
--- a/policy/modules/apps/java.fc
+++ b/policy/modules/apps/java.fc
@@ -5,13 +5,10 @@
/opt/ibm/java.*/(bin|javaws)(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0)
/opt/local/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0)
/opt/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0)
-/opt/local/MATLAB.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0)
-/opt/MATLAB.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0)
#
# /usr
#
-/usr/Aptana[^/]*/AptanaStudio -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/(.*/)?bin/java.* -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/bin/fastjar -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/bin/frysk -- gen_context(system_u:object_r:java_exec_t,s0)
@@ -30,14 +27,12 @@
/usr/lib/jvm/java(.*/)bin(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/lib/opera(/.*)?/opera -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/lib/opera(/.*)?/works -- gen_context(system_u:object_r:java_exec_t,s0)
+/usr/lib64/jvm/java(.*/)bin(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/local/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0)
-/opt/ibm/lotus/Symphony/framework/rcp/eclipse/plugins(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0)
-/opt/ibm(/.*)?/eclipse/plugins(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0)
-
ifdef(`distro_redhat',`
/usr/java/eclipse[^/]*/eclipse -- gen_context(system_u:object_r:java_exec_t,s0)
')
diff --git a/policy/modules/apps/java.if b/policy/modules/apps/java.if
index 7c398c0..e6d84e8 100644
--- a/policy/modules/apps/java.if
+++ b/policy/modules/apps/java.if
@@ -72,8 +72,7 @@ template(`java_role_template',`
domain_interactive_fd($1_java_t)
- userdom_unpriv_usertype($1, $1_java_t)
- userdom_manage_tmpfs_role($2, $1_java_t)
+ userdom_manage_user_tmpfs_files($1_java_t)
allow $1_java_t self:process { ptrace signal getsched execmem execstack };
@@ -83,7 +82,7 @@ template(`java_role_template',`
domtrans_pattern($3, java_exec_t, $1_java_t)
- corecmd_bin_domtrans($1_java_t, $1_t)
+ corecmd_bin_domtrans($1_java_t, $3)
dev_dontaudit_append_rand($1_java_t)
@@ -106,7 +105,7 @@ template(`java_role_template',`
## </summary>
## </param>
#
-interface(`java_domtrans',`
+template(`java_domtrans',`
gen_require(`
type java_t, java_exec_t;
')
@@ -180,10 +179,6 @@ interface(`java_run_unconfined',`
java_domtrans_unconfined($1)
role $2 types unconfined_java_t;
-
- optional_policy(`
- nsplugin_role_notrans($2, unconfined_java_t)
- ')
')
########################################
diff --git a/policy/modules/apps/java.te b/policy/modules/apps/java.te
index 27d37b0..167950d 100644
--- a/policy/modules/apps/java.te
+++ b/policy/modules/apps/java.te
@@ -82,20 +82,18 @@ dev_read_urand(java_t)
dev_read_rand(java_t)
dev_dontaudit_append_rand(java_t)
-files_read_etc_files(java_t)
files_read_usr_files(java_t)
files_search_home(java_t)
files_search_var_lib(java_t)
files_read_etc_runtime_files(java_t)
# Read global fonts and font config
+files_read_etc_files(java_t)
fs_getattr_xattr_fs(java_t)
fs_dontaudit_rw_tmpfs_files(java_t)
logging_send_syslog_msg(java_t)
-auth_use_nsswitch(java_t)
-
miscfiles_read_localization(java_t)
# Read global fonts and font config
miscfiles_read_fonts(java_t)
@@ -125,6 +123,14 @@ tunable_policy(`allow_java_execstack',`
')
optional_policy(`
+ nis_use_ypbind(java_t)
+')
+
+optional_policy(`
+ nscd_socket_use(java_t)
+')
+
+optional_policy(`
xserver_user_x_domain_template(java, java_t, java_tmpfs_t)
')
@@ -137,21 +143,14 @@ optional_policy(`
# execheap is needed for itanium/BEA jrocket
allow unconfined_java_t self:process { execstack execmem execheap };
- init_dbus_chat_script(unconfined_java_t)
-
files_execmod_all_files(unconfined_java_t)
init_dbus_chat_script(unconfined_java_t)
unconfined_domain_noaudit(unconfined_java_t)
unconfined_dbus_chat(unconfined_java_t)
- userdom_unpriv_usertype(unconfined, unconfined_java_t)
optional_policy(`
rpm_domtrans(unconfined_java_t)
')
-
- optional_policy(`
- wine_domtrans(unconfined_java_t)
- ')
')
diff --git a/policy/modules/apps/mono.if b/policy/modules/apps/mono.if
index b2b83ad..7b08e13 100644
--- a/policy/modules/apps/mono.if
+++ b/policy/modules/apps/mono.if
@@ -40,16 +40,16 @@ template(`mono_role_template',`
domain_interactive_fd($1_mono_t)
application_type($1_mono_t)
- allow $1_mono_t self:process { signal getsched execheap execmem execstack };
- allow $3 $1_mono_t:process { getattr noatsecure signal_perms };
+ allow $1_mono_t self:process { ptrace signal getsched execheap execmem execstack };
+
+ allow $3 $1_mono_t:process { getattr ptrace noatsecure signal_perms };
domtrans_pattern($3, mono_exec_t, $1_mono_t)
fs_dontaudit_rw_tmpfs_files($1_mono_t)
corecmd_bin_domtrans($1_mono_t, $1_t)
- userdom_unpriv_usertype($1, $1_mono_t)
- userdom_manage_tmpfs_role($2, $1_mono_t)
+ userdom_manage_user_tmpfs_files($1_mono_t)
optional_policy(`
xserver_role($1_r, $1_mono_t)
diff --git a/policy/modules/apps/mono.te b/policy/modules/apps/mono.te
index ecab36d..dff0f12 100644
--- a/policy/modules/apps/mono.te
+++ b/policy/modules/apps/mono.te
@@ -15,7 +15,7 @@ init_system_domain(mono_t, mono_exec_t)
# Local policy
#
-allow mono_t self:process { signal getsched execheap execmem execstack };
+allow mono_t self:process { ptrace signal getsched execheap execmem execstack };
init_dbus_chat_script(mono_t)
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
index 69e2534..3654ad3 100644
--- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te
@@ -186,17 +186,7 @@ tunable_policy(`deny_execmem',`',`
allow mozilla_t self:process execmem;
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(mozilla_t)
- fs_manage_nfs_files(mozilla_t)
- fs_manage_nfs_symlinks(mozilla_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(mozilla_t)
- fs_manage_cifs_files(mozilla_t)
- fs_manage_cifs_symlinks(mozilla_t)
-')
+userdom_home_manager(mozilla_t)
# Uploads, local html
tunable_policy(`mozilla_read_content && use_nfs_home_dirs',`
@@ -426,17 +416,7 @@ tunable_policy(`allow_execstack',`
allow mozilla_plugin_t self:process execstack;
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(mozilla_plugin_t)
- fs_manage_nfs_files(mozilla_plugin_t)
- fs_manage_nfs_symlinks(mozilla_plugin_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(mozilla_plugin_t)
- fs_manage_cifs_files(mozilla_plugin_t)
- fs_manage_cifs_symlinks(mozilla_plugin_t)
-')
+userdom_home_manager(mozilla_plugin_t)
optional_policy(`
alsa_read_rw_config(mozilla_plugin_t)
diff --git a/policy/modules/apps/mplayer.te b/policy/modules/apps/mplayer.te
index 8b1fa1b..320963b 100644
--- a/policy/modules/apps/mplayer.te
+++ b/policy/modules/apps/mplayer.te
@@ -84,6 +84,7 @@ userdom_read_user_tmp_files(mencoder_t)
userdom_read_user_tmp_symlinks(mencoder_t)
userdom_read_user_home_content_files(mencoder_t)
userdom_read_user_home_content_symlinks(mencoder_t)
+userdom_home_manager(mencoder_t)
# Read content to encode
ifndef(`enable_mls',`
@@ -104,46 +105,6 @@ tunable_policy(`allow_mplayer_execstack',`
allow mencoder_t self:process { execmem execstack };
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(mencoder_t)
- fs_manage_nfs_files(mencoder_t)
- fs_manage_nfs_symlinks(mencoder_t)
-
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(mencoder_t)
- fs_manage_cifs_files(mencoder_t)
- fs_manage_cifs_symlinks(mencoder_t)
-
-')
-
-# Read content to encode
-tunable_policy(`use_nfs_home_dirs',`
- fs_list_auto_mountpoints(mencoder_t)
- files_list_home(mencoder_t)
- fs_read_nfs_files(mencoder_t)
- fs_read_nfs_symlinks(mencoder_t)
-
-',`
- files_dontaudit_list_home(mencoder_t)
- fs_dontaudit_list_auto_mountpoints(mencoder_t)
- fs_dontaudit_read_nfs_files(mencoder_t)
- fs_dontaudit_list_nfs(mencoder_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_list_auto_mountpoints(mencoder_t)
- files_list_home(mencoder_t)
- fs_read_cifs_files(mencoder_t)
- fs_read_cifs_symlinks(mencoder_t)
-',`
- files_dontaudit_list_home(mencoder_t)
- fs_dontaudit_list_auto_mountpoints(mencoder_t)
- fs_dontaudit_read_cifs_files(mencoder_t)
- fs_dontaudit_list_cifs(mencoder_t)
-')
-
########################################
#
# mplayer local policy
@@ -242,6 +203,7 @@ userdom_read_user_tmp_symlinks(mplayer_t)
userdom_read_user_home_content_files(mplayer_t)
userdom_read_user_home_content_symlinks(mplayer_t)
userdom_write_user_tmp_sockets(mplayer_t)
+userdom_home_manager(mplayer_t)
xserver_user_x_domain_template(mplayer, mplayer_t, mplayer_tmpfs_t)
@@ -264,47 +226,12 @@ tunable_policy(`allow_mplayer_execstack',`
allow mplayer_t self:process { execmem execstack };
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(mplayer_t)
- fs_manage_nfs_files(mplayer_t)
- fs_manage_nfs_symlinks(mplayer_t)
-')
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(mplayer_t)
- fs_manage_cifs_files(mplayer_t)
- fs_manage_cifs_symlinks(mplayer_t)
-')
-
# Legacy domain issues
tunable_policy(`allow_mplayer_execstack',`
allow mplayer_t mplayer_tmpfs_t:file execute;
')
-# Read songs
-tunable_policy(`use_nfs_home_dirs',`
- fs_list_auto_mountpoints(mplayer_t)
- files_list_home(mplayer_t)
- fs_read_nfs_files(mplayer_t)
- fs_read_nfs_symlinks(mplayer_t)
-
-',`
- files_dontaudit_list_home(mplayer_t)
- fs_dontaudit_list_auto_mountpoints(mplayer_t)
- fs_dontaudit_read_nfs_files(mplayer_t)
- fs_dontaudit_list_nfs(mplayer_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_list_auto_mountpoints(mplayer_t)
- files_list_home(mplayer_t)
- fs_read_cifs_files(mplayer_t)
- fs_read_cifs_symlinks(mplayer_t)
-',`
- files_dontaudit_list_home(mplayer_t)
- fs_dontaudit_list_auto_mountpoints(mplayer_t)
- fs_dontaudit_read_cifs_files(mplayer_t)
- fs_dontaudit_list_cifs(mplayer_t)
-')
+userdom_home_manager(mplayer_t)
optional_policy(`
alsa_read_rw_config(mplayer_t)
diff --git a/policy/modules/apps/nsplugin.te b/policy/modules/apps/nsplugin.te
index 3b6b4cb..cc6b555 100644
--- a/policy/modules/apps/nsplugin.te
+++ b/policy/modules/apps/nsplugin.te
@@ -208,10 +208,6 @@ optional_policy(`
')
optional_policy(`
- unconfined_execmem_signull(nsplugin_t)
-')
-
-optional_policy(`
sandbox_read_tmpfs_files(nsplugin_t)
')
@@ -329,7 +325,3 @@ optional_policy(`
pulseaudio_manage_home_files(nsplugin_t)
pulseaudio_setattr_home_dir(nsplugin_t)
')
-
-optional_policy(`
- unconfined_execmem_exec(nsplugin_t)
-')
diff --git a/policy/modules/apps/openoffice.fc b/policy/modules/apps/openoffice.fc
deleted file mode 100644
index 4428be4..0000000
--- a/policy/modules/apps/openoffice.fc
+++ /dev/null
@@ -1,3 +0,0 @@
-/usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0)
-/opt/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0)
-
diff --git a/policy/modules/apps/openoffice.if b/policy/modules/apps/openoffice.if
deleted file mode 100644
index 792bf9c..0000000
--- a/policy/modules/apps/openoffice.if
+++ /dev/null
@@ -1,124 +0,0 @@
-## <summary>Openoffice</summary>
-
-#######################################
-## <summary>
-## The per role template for the openoffice module.
-## </summary>
-## <param name="user_domain">
-## <summary>
-## The type of the user domain.
-## </summary>
-## </param>
-#
-interface(`openoffice_plugin_role',`
- gen_require(`
- type openoffice_exec_t;
- type openoffice_t;
- ')
-
- ########################################
- #
- # Local policy
- #
-
- domtrans_pattern($1, openoffice_exec_t, openoffice_t)
- allow $1 openoffice_t:process { signal sigkill };
-')
-
-#######################################
-## <summary>
-## role for openoffice
-## </summary>
-## <desc>
-## <p>
-## This template creates a derived domains which are used
-## for java applications.
-## </p>
-## </desc>
-## <param name="role_prefix">
-## <summary>
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-## </summary>
-## </param>
-## <param name="user_role">
-## <summary>
-## The role associated with the user domain.
-## </summary>
-## </param>
-## <param name="user_domain">
-## <summary>
-## The type of the user domain.
-## </summary>
-## </param>
-#
-interface(`openoffice_role_template',`
- gen_require(`
- type openoffice_exec_t;
- ')
-
- role $2 types $1_openoffice_t;
-
- type $1_openoffice_t;
- domain_type($1_openoffice_t)
- domain_entry_file($1_openoffice_t, openoffice_exec_t)
- domain_interactive_fd($1_openoffice_t)
-
- userdom_unpriv_usertype($1, $1_openoffice_t)
- userdom_exec_user_home_content_files($1_openoffice_t)
-
- allow $1_openoffice_t self:process { getsched sigkill execmem execstack };
-
- allow $3 $1_openoffice_t:process { getattr signal_perms noatsecure siginh rlimitinh };
- allow $1_openoffice_t $3:tcp_socket { read write };
-
- domtrans_pattern($3, openoffice_exec_t, $1_openoffice_t)
-
- dev_read_urand($1_openoffice_t)
- dev_read_rand($1_openoffice_t)
-
- fs_dontaudit_rw_tmpfs_files($1_openoffice_t)
-
- allow $3 $1_openoffice_t:process { signal sigkill };
- allow $1_openoffice_t $3:unix_stream_socket connectto;
-
- optional_policy(`
- xserver_role($2, $1_openoffice_t)
- ')
-')
-
-########################################
-## <summary>
-## Execute openoffice_exec_t
-## in the specified domain.
-## </summary>
-## <desc>
-## <p>
-## Execute a openoffice_exec_t
-## in the specified domain.
-## </p>
-## <p>
-## No interprocess communication (signals, pipes,
-## etc.) is provided by this interface since
-## the domains are not owned by this module.
-## </p>
-## </desc>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-## <param name="target_domain">
-## <summary>
-## The type of the new process.
-## </summary>
-## </param>
-#
-interface(`openoffice_exec_domtrans',`
- gen_require(`
- type openoffice_exec_t;
- ')
-
- allow $2 openoffice_exec_t:file entrypoint;
- domtrans_pattern($1, openoffice_exec_t, $2)
-')
diff --git a/policy/modules/apps/openoffice.te b/policy/modules/apps/openoffice.te
deleted file mode 100644
index a842371..0000000
--- a/policy/modules/apps/openoffice.te
+++ /dev/null
@@ -1,16 +0,0 @@
-policy_module(openoffice, 1.0.0)
-
-########################################
-#
-# Declarations
-#
-
-type openoffice_t;
-type openoffice_exec_t;
-application_domain(openoffice_t, openoffice_exec_t)
-
-########################################
-#
-# Unconfined java local policy
-#
-
diff --git a/policy/modules/apps/pulseaudio.te b/policy/modules/apps/pulseaudio.te
index 5314e57..a4f8158 100644
--- a/policy/modules/apps/pulseaudio.te
+++ b/policy/modules/apps/pulseaudio.te
@@ -43,6 +43,7 @@ allow pulseaudio_t self:netlink_kobject_uevent_socket create_socket_perms;
manage_dirs_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t)
manage_files_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t)
+manage_lnk_files_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t)
userdom_search_user_home_dirs(pulseaudio_t)
userdom_search_admin_dir(pulseaudio_t)
diff --git a/policy/modules/apps/screen.if b/policy/modules/apps/screen.if
index f9fbc60..b0b3ce6 100644
--- a/policy/modules/apps/screen.if
+++ b/policy/modules/apps/screen.if
@@ -39,6 +39,8 @@ template(`screen_role_template',`
ubac_constrained($1_screen_t)
role $2 types $1_screen_t;
+ userdom_home_reader($1_screen_t)
+
domtrans_pattern($3, screen_exec_t, $1_screen_t)
allow $3 $1_screen_t:process { signal sigchld };
dontaudit $3 $1_screen_t:unix_stream_socket { read write };
diff --git a/policy/modules/apps/screen.te b/policy/modules/apps/screen.te
index b3b144c..0bd13e3 100644
--- a/policy/modules/apps/screen.te
+++ b/policy/modules/apps/screen.te
@@ -115,12 +115,3 @@ userdom_create_user_pty(screen_domain)
userdom_setattr_user_ptys(screen_domain)
userdom_setattr_user_ttys(screen_domain)
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_symlinks(screen_domain)
- fs_list_cifs(screen_domain)
-')
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_list_nfs(screen_domain)
- fs_read_nfs_symlinks(screen_domain)
-')
diff --git a/policy/modules/apps/telepathy.te b/policy/modules/apps/telepathy.te
index 546f5a5..7942965 100644
--- a/policy/modules/apps/telepathy.te
+++ b/policy/modules/apps/telepathy.te
@@ -116,15 +116,7 @@ tunable_policy(`telepathy_tcp_connect_generic_network_ports',`
corenet_sendrecv_generic_client_packets(telepathy_gabble_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(telepathy_gabble_t)
- fs_manage_nfs_files(telepathy_gabble_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(telepathy_gabble_t)
- fs_manage_cifs_files(telepathy_gabble_t)
-')
+userdom_home_manager(telepathy_gabble_t)
optional_policy(`
dbus_system_bus_client(telepathy_gabble_t)
@@ -183,15 +175,7 @@ files_search_pids(telepathy_logger_t)
fs_getattr_all_fs(telepathy_logger_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(telepathy_logger_t)
- fs_manage_nfs_files(telepathy_logger_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(telepathy_logger_t)
- fs_manage_cifs_files(telepathy_logger_t)
-')
+userdom_home_manager(telepathy_logger_t)
optional_policy(`
# ~/.config/dconf/user
@@ -220,15 +204,7 @@ fs_getattr_all_fs(telepathy_mission_control_t)
files_read_etc_files(telepathy_mission_control_t)
files_read_usr_files(telepathy_mission_control_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(telepathy_mission_control_t)
- fs_manage_nfs_files(telepathy_mission_control_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(telepathy_mission_control_t)
- fs_manage_cifs_files(telepathy_mission_control_t)
-')
+userdom_home_manager(telepathy_mission_control_t)
optional_policy(`
dbus_system_bus_client(telepathy_mission_control_t)
diff --git a/policy/modules/apps/thunderbird.te b/policy/modules/apps/thunderbird.te
index f50789e..9ba6da8 100644
--- a/policy/modules/apps/thunderbird.te
+++ b/policy/modules/apps/thunderbird.te
@@ -114,17 +114,7 @@ xserver_read_xdm_tmp_files(thunderbird_t)
xserver_dontaudit_getattr_xdm_tmp_sockets(thunderbird_t)
# Access ~/.thunderbird
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(thunderbird_t)
- fs_manage_nfs_files(thunderbird_t)
- fs_manage_nfs_symlinks(thunderbird_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(thunderbird_t)
- fs_manage_cifs_files(thunderbird_t)
- fs_manage_cifs_symlinks(thunderbird_t)
-')
+userdom_home_manager(thunderbird_t)
tunable_policy(`mail_read_content && use_nfs_home_dirs',`
files_list_home(thunderbird_t)
diff --git a/policy/modules/apps/tvtime.te b/policy/modules/apps/tvtime.te
index 98bfbf3..38318b9 100644
--- a/policy/modules/apps/tvtime.te
+++ b/policy/modules/apps/tvtime.te
@@ -77,16 +77,7 @@ userdom_use_inherited_user_terminals(tvtime_t)
userdom_read_user_home_content_files(tvtime_t)
# X access, Home files
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(tvtime_t)
- fs_manage_nfs_files(tvtime_t)
- fs_manage_nfs_symlinks(tvtime_t)
-')
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(tvtime_t)
- fs_manage_cifs_files(tvtime_t)
- fs_manage_cifs_symlinks(tvtime_t)
-')
+userdom_home_manager(tvtime_t)
optional_policy(`
xserver_user_x_domain_template(tvtime, tvtime_t, tvtime_tmpfs_t)
diff --git a/policy/modules/apps/wireshark.te b/policy/modules/apps/wireshark.te
index 95a3d06..356e2a1 100644
--- a/policy/modules/apps/wireshark.te
+++ b/policy/modules/apps/wireshark.te
@@ -97,17 +97,7 @@ sysnet_read_config(wireshark_t)
userdom_manage_user_home_content_files(wireshark_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(wireshark_t)
- fs_manage_nfs_files(wireshark_t)
- fs_manage_nfs_symlinks(wireshark_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(wireshark_t)
- fs_manage_cifs_files(wireshark_t)
- fs_manage_cifs_symlinks(wireshark_t)
-')
+userdom_home_manager(wireshark_t)
# Manual transition from userhelper
optional_policy(`
diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
index 7bcafea..0b0896b 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
@@ -302,6 +302,7 @@ ifdef(`distro_gentoo',`
/usr/share/shorewall6-lite(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/spamassassin/sa-update\.cron gen_context(system_u:object_r:bin_t,s0)
/usr/share/turboprint/lib(/.*)? -- gen_context(system_u:object_r:bin_t,s0)
+/usr/share/tucan.*/tucan.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/vhostmd/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/virtualbox/.*\.sh gen_context(system_u:object_r:bin_t,s0)
/usr/share/wicd/daemon(/.*)? gen_context(system_u:object_r:bin_t,s0)
diff --git a/policy/modules/kernel/corecommands.te b/policy/modules/kernel/corecommands.te
index 9527971..23a1c3c 100644
--- a/policy/modules/kernel/corecommands.te
+++ b/policy/modules/kernel/corecommands.te
@@ -13,7 +13,7 @@ attribute exec_type;
#
# bin_t is the type of files in the system bin/sbin directories.
#
-type bin_t alias { ls_exec_t sbin_t java_exec_t execmem_exec_t mono_exec_t };
+type bin_t alias { ls_exec_t sbin_t };
corecmd_executable_file(bin_t)
dev_associate(bin_t) #For /dev/MAKEDEV
diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
index 12bd6fc..b48524e 100644
--- a/policy/modules/kernel/devices.fc
+++ b/policy/modules/kernel/devices.fc
@@ -137,6 +137,7 @@ ifdef(`distro_suse', `
/dev/bus/usb/.*/[0-9]+ -c gen_context(system_u:object_r:usb_device_t,s0)
+/dev/ati/card.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
/dev/card.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
/dev/cmx.* -c gen_context(system_u:object_r:smartcard_device_t,s0)
diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
index e5652a1..6342520 100644
--- a/policy/modules/kernel/filesystem.if
+++ b/policy/modules/kernel/filesystem.if
@@ -2167,6 +2167,24 @@ interface(`fs_read_fusefs_symlinks',`
########################################
## <summary>
+## Manage symbolic links on a FUSEFS filesystem.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`fs_manage_fusefs_symlinks',`
+ gen_require(`
+ type fusefs_t;
+ ')
+
+ manage_lnk_files_pattern($1, fusefs_t, fusefs_t)
+')
+
+########################################
+## <summary>
## Get the attributes of an hugetlbfs
## filesystem.
## </summary>
diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index cfea862..de3c13e 100644
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -66,6 +66,10 @@ optional_policy(`
')
optional_policy(`
+ blueman_dbus_chat(staff_t)
+')
+
+optional_policy(`
dbadm_role_change(staff_r)
')
@@ -234,10 +238,6 @@ ifndef(`distro_redhat',`
')
optional_policy(`
- blueman_dbus_chat(staff_t)
- ')
-
- optional_policy(`
bluetooth_role(staff_r, staff_t)
')
diff --git a/policy/modules/roles/unconfineduser.if b/policy/modules/roles/unconfineduser.if
index 8b2cdf3..bac0dc0 100644
--- a/policy/modules/roles/unconfineduser.if
+++ b/policy/modules/roles/unconfineduser.if
@@ -220,42 +220,6 @@ interface(`unconfined_signull',`
########################################
## <summary>
-## Send a SIGNULL signal to the unconfined execmem domain.
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-#
-interface(`unconfined_execmem_signull',`
- gen_require(`
- type unconfined_execmem_t;
- ')
-
- allow $1 unconfined_execmem_t:process signull;
-')
-
-########################################
-## <summary>
-## Send a signal to the unconfined execmem domain.
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-#
-interface(`unconfined_execmem_signal',`
- gen_require(`
- type unconfined_execmem_t;
- ')
-
- allow $1 unconfined_execmem_t:process signal;
-')
-
-########################################
-## <summary>
## Send generic signals to the unconfined domain.
## </summary>
## <param name="domain">
@@ -557,62 +521,6 @@ interface(`unconfined_rw_shm',`
########################################
## <summary>
-## Read and write to unconfined execmem shared memory.
-## </summary>
-## <param name="domain">
-## <summary>
-## The type of the process performing this action.
-## </summary>
-## </param>
-#
-interface(`unconfined_execmem_rw_shm',`
- gen_require(`
- type unconfined_execmem_t;
- ')
-
- allow $1 unconfined_execmem_t:shm rw_shm_perms;
-')
-
-########################################
-## <summary>
-## Transition to the unconfined_execmem domain.
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-#
-interface(`unconfined_execmem_domtrans',`
-
- gen_require(`
- type unconfined_execmem_t;
- ')
-
- execmem_domtrans($1, unconfined_execmem_t)
-')
-
-########################################
-## <summary>
-## execute the execmem applications
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-#
-interface(`unconfined_execmem_exec',`
-
- gen_require(`
- type execmem_exec_t;
- ')
-
- can_exec($1, execmem_exec_t)
-')
-
-########################################
-## <summary>
## Allow apps to set rlimits on userdomain
## </summary>
## <param name="domain">
diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
index 4ce2685..11ad8fb 100644
--- a/policy/modules/roles/unconfineduser.te
+++ b/policy/modules/roles/unconfineduser.te
@@ -320,13 +320,6 @@ optional_policy(`
')
optional_policy(`
- mono_role_template(unconfined, unconfined_r, unconfined_t)
- unconfined_domain_noaudit(unconfined_mono_t)
- role system_r types unconfined_mono_t;
-')
-
-
-optional_policy(`
mozilla_role_plugin(unconfined_r)
tunable_policy(`unconfined_mozilla_plugin_transition', `
diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
index 9db5ebd..454e627 100644
--- a/policy/modules/roles/unprivuser.te
+++ b/policy/modules/roles/unprivuser.te
@@ -31,6 +31,10 @@ optional_policy(`
')
optional_policy(`
+ blueman_dbus_chat(user_t)
+')
+
+optional_policy(`
colord_dbus_chat(user_t)
')
@@ -116,10 +120,6 @@ ifndef(`distro_redhat',`
')
optional_policy(`
- blueman_dbus_chat(staff_t)
- ')
-
- optional_policy(`
bluetooth_role(user_r, user_t)
')
diff --git a/policy/modules/roles/xguest.te b/policy/modules/roles/xguest.te
index b1ea76e..6f176f9 100644
--- a/policy/modules/roles/xguest.te
+++ b/policy/modules/roles/xguest.te
@@ -86,6 +86,13 @@ optional_policy(`
')
optional_policy(`
+ tunable_policy(`xguest_use_bluetooth',`
+ blueman_dbus_chat(xguest_t)
+ ')
+')
+
+
+optional_policy(`
chrome_role(xguest_r, xguest_usertype)
')
@@ -106,10 +113,6 @@ optional_policy(`
')
optional_policy(`
- mono_role_template(xguest, xguest_r, xguest_t)
-')
-
-optional_policy(`
mozilla_run_plugin(xguest_usertype, xguest_r)
')
diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te
index 7cb2fe5..2ef8fef 100644
--- a/policy/modules/services/apache.te
+++ b/policy/modules/services/apache.te
@@ -1401,5 +1401,3 @@ tunable_policy(`httpd_builtin_scripting',`
read_files_pattern(httpd_t, httpd_content_type, httpd_content_type)
read_lnk_files_pattern(httpd_t, httpd_content_type, httpd_content_type)
')
-
-
diff --git a/policy/modules/services/blueman.te b/policy/modules/services/blueman.te
index fde1531..12ef44c 100644
--- a/policy/modules/services/blueman.te
+++ b/policy/modules/services/blueman.te
@@ -26,6 +26,7 @@ domain_use_interactive_fds(blueman_t)
files_read_etc_files(blueman_t)
files_read_usr_files(blueman_t)
+auth_use_nsswitch(blueman_t)
auth_read_passwd(blueman_t)
logging_send_syslog_msg(blueman_t)
diff --git a/policy/modules/services/cloudform.te b/policy/modules/services/cloudform.te
index 5c0c84f..83fc37d 100644
--- a/policy/modules/services/cloudform.te
+++ b/policy/modules/services/cloudform.te
@@ -137,12 +137,7 @@ corenet_tcp_connect_all_ports(iwhd_t)
dev_read_rand(iwhd_t)
dev_read_urand(iwhd_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_list_auto_mountpoints(iwhd_t)
- fs_manage_nfs_dirs(iwhd_t)
- fs_manage_nfs_files(iwhd_t)
- fs_manage_nfs_symlinks(iwhd_t)
-')
+userdom_home_manager(iwhd_t)
########################################
#
diff --git a/policy/modules/services/colord.te b/policy/modules/services/colord.te
index 6ff206b..74f1baa 100644
--- a/policy/modules/services/colord.te
+++ b/policy/modules/services/colord.te
@@ -91,15 +91,7 @@ sysnet_dns_name_resolve(colord_t)
userdom_rw_user_tmpfs_files(colord_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_getattr_nfs(colord_t)
- fs_read_nfs_files(colord_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_getattr_cifs(colord_t)
- fs_read_cifs_files(colord_t)
-')
+userdom_home_reader(colord_t)
optional_policy(`
cups_read_config(colord_t)
diff --git a/policy/modules/services/consolekit.te b/policy/modules/services/consolekit.te
index 5b322ca..d45381d 100644
--- a/policy/modules/services/consolekit.te
+++ b/policy/modules/services/consolekit.te
@@ -82,13 +82,7 @@ userdom_dontaudit_read_user_home_content_files(consolekit_t)
userdom_dontaudit_getattr_admin_home_files(consolekit_t)
userdom_read_user_tmp_files(consolekit_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(consolekit_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(consolekit_t)
-')
+userdom_home_reader(consolekit_t)
optional_policy(`
cron_read_system_job_lib_files(consolekit_t)
diff --git a/policy/modules/services/cron.te b/policy/modules/services/cron.te
index 258a3d7..a2e960c 100644
--- a/policy/modules/services/cron.te
+++ b/policy/modules/services/cron.te
@@ -300,10 +300,6 @@ optional_policy(`
')
optional_policy(`
- mono_domtrans(crond_t)
-')
-
-optional_policy(`
amanda_search_var_lib(crond_t)
')
@@ -553,10 +549,6 @@ optional_policy(`
')
optional_policy(`
- mono_domtrans(system_cronjob_t)
-')
-
-optional_policy(`
mrtg_append_create_logs(system_cronjob_t)
')
diff --git a/policy/modules/services/cups.te b/policy/modules/services/cups.te
index 825cafb..3bc4cfd 100644
--- a/policy/modules/services/cups.te
+++ b/policy/modules/services/cups.te
@@ -625,16 +625,7 @@ optional_policy(`
lpd_manage_spool(cups_pdf_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_search_auto_mountpoints(cups_pdf_t)
- fs_manage_nfs_dirs(cups_pdf_t)
- fs_manage_nfs_files(cups_pdf_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(cups_pdf_t)
- fs_manage_cifs_files(cups_pdf_t)
-')
+userdom_home_manager(cups_pdf_t)
optional_policy(`
gnome_read_config(cups_pdf_t)
diff --git a/policy/modules/services/dbus.if b/policy/modules/services/dbus.if
index 3558f18..115133d 100644
--- a/policy/modules/services/dbus.if
+++ b/policy/modules/services/dbus.if
@@ -56,6 +56,8 @@ template(`dbus_role_template',`
ubac_constrained($1_dbusd_t)
role $2 types $1_dbusd_t;
+ userdom_home_manager($1_dbusd_t)
+
##############################
#
# Local policy
diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te
index f0266a9..c9396db 100644
--- a/policy/modules/services/dbus.te
+++ b/policy/modules/services/dbus.te
@@ -143,13 +143,7 @@ seutil_sigchld_newrole(system_dbusd_t)
userdom_dontaudit_use_unpriv_user_fds(system_dbusd_t)
userdom_dontaudit_search_user_home_dirs(system_dbusd_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(system_dbusd_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(system_dbusd_t)
-')
+userdom_home_reader(system_dbusd_t)
optional_policy(`
bind_domtrans(system_dbusd_t)
@@ -309,16 +303,6 @@ userdom_manage_user_home_content_dirs(session_bus_type)
userdom_manage_user_home_content_files(session_bus_type)
userdom_user_home_dir_filetrans_user_home_content(session_bus_type, { dir file })
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(session_bus_type)
- fs_manage_nfs_files(session_bus_type)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(session_bus_type)
- fs_manage_cifs_files(session_bus_type)
-')
-
optional_policy(`
gnome_read_gconf_home_files(session_bus_type)
')
diff --git a/policy/modules/services/dovecot.te b/policy/modules/services/dovecot.te
index 2fbb869..194f170 100644
--- a/policy/modules/services/dovecot.te
+++ b/policy/modules/services/dovecot.te
@@ -142,6 +142,7 @@ files_dontaudit_list_default(dovecot_t)
# Dovecot now has quota support and it uses getmntent() to find the mountpoints.
files_read_etc_runtime_files(dovecot_t)
files_search_all_mountpoints(dovecot_t)
+files_read_var_lib_files(dovecot_t)
init_getattr_utmp(dovecot_t)
@@ -152,6 +153,7 @@ logging_send_syslog_msg(dovecot_t)
miscfiles_read_generic_certs(dovecot_t)
miscfiles_read_localization(dovecot_t)
+userdom_home_manager(dovecot_t)
userdom_dontaudit_use_unpriv_user_fds(dovecot_t)
userdom_manage_user_home_content_dirs(dovecot_t)
userdom_manage_user_home_content_files(dovecot_t)
@@ -238,7 +240,6 @@ files_read_usr_files(dovecot_auth_t)
files_read_usr_symlinks(dovecot_auth_t)
files_read_var_lib_files(dovecot_auth_t)
files_search_tmp(dovecot_auth_t)
-files_read_var_lib_files(dovecot_t)
fs_getattr_xattr_fs(dovecot_auth_t)
@@ -330,23 +331,7 @@ userdom_manage_user_home_content_pipes(dovecot_deliver_t)
userdom_manage_user_home_content_sockets(dovecot_deliver_t)
userdom_user_home_dir_filetrans_user_home_content(dovecot_deliver_t, { dir file lnk_file fifo_file sock_file })
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(dovecot_deliver_t)
- fs_manage_nfs_files(dovecot_deliver_t)
- fs_manage_nfs_symlinks(dovecot_deliver_t)
- fs_manage_nfs_dirs(dovecot_t)
- fs_manage_nfs_files(dovecot_t)
- fs_manage_nfs_symlinks(dovecot_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(dovecot_deliver_t)
- fs_manage_cifs_files(dovecot_deliver_t)
- fs_manage_cifs_symlinks(dovecot_deliver_t)
- fs_manage_cifs_dirs(dovecot_t)
- fs_manage_cifs_files(dovecot_t)
- fs_manage_cifs_symlinks(dovecot_t)
-')
+userdom_home_manager(dovecot_deliver_t)
optional_policy(`
gnome_manage_data(dovecot_deliver_t)
diff --git a/policy/modules/services/fail2ban.te b/policy/modules/services/fail2ban.te
index 2599f96..c7a0911 100644
--- a/policy/modules/services/fail2ban.te
+++ b/policy/modules/services/fail2ban.te
@@ -98,6 +98,9 @@ miscfiles_read_localization(fail2ban_t)
mta_send_mail(fail2ban_t)
+sysnet_manage_config(fail2ban_t)
+sysnet_filetrans_named_content(fail2ban_t)
+
optional_policy(`
apache_read_log(fail2ban_t)
')
diff --git a/policy/modules/services/ftp.te b/policy/modules/services/ftp.te
index 3bc14c3..6c4a30d 100644
--- a/policy/modules/services/ftp.te
+++ b/policy/modules/services/ftp.te
@@ -458,16 +458,4 @@ tunable_policy(`sftpd_full_access',`
files_manage_non_security_files(sftpd_t)
')
-tunable_policy(`use_samba_home_dirs',`
- # allow read access to /home by default
- fs_list_cifs(sftpd_t)
- fs_read_cifs_files(sftpd_t)
- fs_read_cifs_symlinks(sftpd_t)
-')
-
-tunable_policy(`use_nfs_home_dirs',`
- # allow read access to /home by default
- fs_list_nfs(sftpd_t)
- fs_read_nfs_files(sftpd_t)
- fs_read_nfs_symlinks(ftpd_t)
-')
+userdom_home_reader(sftpd_t)
diff --git a/policy/modules/services/git.if b/policy/modules/services/git.if
index 27945d1..9077b2d 100644
--- a/policy/modules/services/git.if
+++ b/policy/modules/services/git.if
@@ -209,17 +209,7 @@ interface(`git_rwx_all_content',`
userdom_search_user_home_dirs($1)
files_search_var_lib($1)
- tunable_policy(`use_nfs_home_dirs',`
- fs_exec_nfs_files($1)
- fs_manage_nfs_dirs($1)
- fs_manage_nfs_files($1)
- ')
-
- tunable_policy(`use_samba_home_dirs',`
- fs_exec_cifs_files($1)
- fs_manage_cifs_dirs($1)
- fs_manage_cifs_files($1)
- ')
+ userdom_home_manager($1)
tunable_policy(`git_system_use_cifs',`
fs_exec_cifs_files($1)
@@ -323,15 +313,7 @@ interface(`git_read_all_content_files',`
userdom_search_user_home_dirs($1)
files_search_var_lib($1)
- tunable_policy(`use_nfs_home_dirs',`
- fs_list_nfs($1)
- fs_read_nfs_files($1)
- ')
-
- tunable_policy(`use_samba_home_dirs',`
- fs_list_cifs($1)
- fs_read_cifs_files($1)
- ')
+ userdom_home_reader($1)
tunable_policy(`git_system_use_cifs',`
fs_list_cifs($1)
@@ -363,16 +345,7 @@ interface(`git_read_session_content_files',`
list_dirs_pattern($1, git_session_content_t, git_session_content_t)
read_files_pattern($1, git_session_content_t, git_session_content_t)
userdom_search_user_home_dirs($1)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
-
Merge
2011-11-16 15:58:53 +00:00
- tunable_policy(`use_nfs_home_dirs',`
- fs_list_nfs($1)
- fs_read_nfs_files($1)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
- ')
-
Merge
2011-11-16 15:58:53 +00:00
- tunable_policy(`use_samba_home_dirs',`
- fs_list_cifs($1)
- fs_read_cifs_files($1)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
- ')
Merge
2011-11-16 15:58:53 +00:00
+ userdom_home_reader($1)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
')
Merge
2011-11-16 15:58:53 +00:00
#######################################
diff --git a/policy/modules/services/git.te b/policy/modules/services/git.te
index 2ef543c..fa32fcf 100644
--- a/policy/modules/services/git.te
+++ b/policy/modules/services/git.te
@@ -166,15 +166,7 @@ tunable_policy(`git_session_bind_all_unreserved_ports',`
corenet_sendrecv_generic_server_packets(git_session_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_list_nfs(git_session_t)
- fs_read_nfs_files(git_session_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_list_cifs(git_session_t)
- fs_read_cifs_files(git_session_t)
-')
+userdom_home_reader(git_session_t)
########################################
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
#
Merge
2011-11-16 15:58:53 +00:00
diff --git a/policy/modules/services/i18n_input.te b/policy/modules/services/i18n_input.te
index 5fc89c4..738c3e2 100644
--- a/policy/modules/services/i18n_input.te
+++ b/policy/modules/services/i18n_input.te
@@ -74,16 +74,7 @@ sysnet_read_config(i18n_input_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
userdom_dontaudit_use_unpriv_user_fds(i18n_input_t)
userdom_read_user_home_content_files(i18n_input_t)
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(i18n_input_t)
- fs_read_nfs_symlinks(i18n_input_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(i18n_input_t)
- fs_read_cifs_symlinks(i18n_input_t)
-')
+userdom_home_reader(i18n_input_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
optional_policy(`
canna_stream_connect(i18n_input_t)
diff --git a/policy/modules/services/lpd.te b/policy/modules/services/lpd.te
index f28acd2..27d96e1 100644
--- a/policy/modules/services/lpd.te
+++ b/policy/modules/services/lpd.te
@@ -308,19 +308,7 @@ tunable_policy(`use_lpd_server',`
read_lnk_files_pattern(lpr_t, printconf_t, printconf_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
')
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_nfs_home_dirs',`
- files_list_home(lpr_t)
- fs_list_auto_mountpoints(lpr_t)
- fs_read_nfs_files(lpr_t)
- fs_read_nfs_symlinks(lpr_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
-')
-
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_samba_home_dirs',`
- files_list_home(lpr_t)
- fs_list_auto_mountpoints(lpr_t)
- fs_read_cifs_files(lpr_t)
- fs_read_cifs_symlinks(lpr_t)
-')
+userdom_home_reader(lpr_t)
optional_policy(`
cups_read_config(lpr_t)
diff --git a/policy/modules/services/mock.te b/policy/modules/services/mock.te
index b1107b5..4389219 100644
--- a/policy/modules/services/mock.te
+++ b/policy/modules/services/mock.te
@@ -127,6 +127,7 @@ userdom_use_user_ptys(mock_t)
files_search_home(mock_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
tunable_policy(`mock_enable_homedirs',`
+ userdom_manage_user_home_content_dirs(mock_t)
userdom_manage_user_home_content_files(mock_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
')
Merge
2011-11-16 15:58:53 +00:00
diff --git a/policy/modules/services/mpd.te b/policy/modules/services/mpd.te
index e4ac35e..36ff69d 100644
--- a/policy/modules/services/mpd.te
+++ b/policy/modules/services/mpd.te
@@ -108,16 +108,7 @@ miscfiles_read_localization(mpd_t)
userdom_read_home_audio_files(mpd_t)
userdom_read_user_tmpfs_files(mpd_t)
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(mpd_t)
- fs_read_cifs_symlinks(mpd_t)
-')
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(mpd_t)
- fs_read_nfs_symlinks(mpd_t)
-')
+userdom_home_reader(mpd_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
optional_policy(`
Merge
2011-11-16 15:58:53 +00:00
alsa_read_rw_config(mpd_t)
diff --git a/policy/modules/services/mta.if b/policy/modules/services/mta.if
index e5519fd..867dfac 100644
--- a/policy/modules/services/mta.if
+++ b/policy/modules/services/mta.if
@@ -340,6 +340,8 @@ interface(`mta_mailserver_delivery',`
')
typeattribute $1 mailserver_delivery;
+
+ userdom_home_manager($1)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
')
Merge
2011-11-16 15:58:53 +00:00
#######################################
diff --git a/policy/modules/services/mta.te b/policy/modules/services/mta.te
index 65fd01f..7f55b85 100644
--- a/policy/modules/services/mta.te
+++ b/policy/modules/services/mta.te
@@ -233,18 +233,6 @@ read_files_pattern(mailserver_delivery, mail_home_t, mail_home_t)
read_files_pattern(mailserver_delivery, system_mail_tmp_t, system_mail_tmp_t)
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(mailserver_delivery)
- fs_manage_cifs_files(mailserver_delivery)
- fs_manage_cifs_symlinks(mailserver_delivery)
-')
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(mailserver_delivery)
- fs_manage_nfs_files(mailserver_delivery)
- fs_manage_nfs_symlinks(mailserver_delivery)
-')
-
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
optional_policy(`
Merge
2011-11-16 15:58:53 +00:00
dovecot_manage_spool(mailserver_delivery)
dovecot_domtrans_deliver(mailserver_delivery)
diff --git a/policy/modules/services/oident.te b/policy/modules/services/oident.te
index 98f541f..58148ed 100644
--- a/policy/modules/services/oident.te
+++ b/policy/modules/services/oident.te
@@ -59,17 +59,8 @@ miscfiles_read_localization(oidentd_t)
sysnet_read_config(oidentd_t)
oident_read_user_content(oidentd_t)
+userdom_home_reader(oidentd_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
optional_policy(`
Merge
2011-11-16 15:58:53 +00:00
nis_use_ypbind(oidentd_t)
')
-
-tunable_policy(`use_samba_home_dirs', `
- fs_list_cifs(oidentd_t)
- fs_read_cifs_files(oidentd_t)
-')
-
-tunable_policy(`use_nfs_home_dirs', `
- fs_list_nfs(oidentd_t)
- fs_read_nfs_files(oidentd_t)
-')
diff --git a/policy/modules/services/polipo.te b/policy/modules/services/polipo.te
index 89ab1b6..d958b53 100644
--- a/policy/modules/services/polipo.te
+++ b/policy/modules/services/polipo.te
@@ -146,14 +146,4 @@ tunable_policy(`polipo_session_send_syslog_msg',`
logging_send_syslog_msg(polipo_session_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
')
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_files(polipo_session_t)
-',`
- fs_dontaudit_manage_nfs_files(polipo_session_t)
-')
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
-
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_files(polipo_session_t)
-',`
- fs_dontaudit_manage_cifs_files(polipo_session_t)
-')
+userdom_home_manager(polipo_session_t)
diff --git a/policy/modules/services/procmail.te b/policy/modules/services/procmail.te
index 6451f82..4c188f9 100644
--- a/policy/modules/services/procmail.te
+++ b/policy/modules/services/procmail.te
@@ -110,17 +110,7 @@ ifdef(`hide_broken_symptoms',`
mta_dontaudit_rw_queue(procmail_t)
')
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(procmail_t)
- fs_manage_nfs_files(procmail_t)
- fs_manage_nfs_symlinks(procmail_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(procmail_t)
- fs_manage_cifs_files(procmail_t)
- fs_manage_cifs_symlinks(procmail_t)
-')
+userdom_home_manager(procmail_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
optional_policy(`
clamav_domtrans_clamscan(procmail_t)
diff --git a/policy/modules/services/razor.te b/policy/modules/services/razor.te
index cc1775e..9405f78 100644
--- a/policy/modules/services/razor.te
+++ b/policy/modules/services/razor.te
@@ -121,17 +121,7 @@ ifdef(`distro_redhat',`
userdom_search_user_home_dirs(razor_t)
userdom_use_inherited_user_terminals(razor_t)
- tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(razor_t)
- fs_manage_nfs_files(razor_t)
- fs_manage_nfs_symlinks(razor_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
- ')
-
Merge
2011-11-16 15:58:53 +00:00
- tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(razor_t)
- fs_manage_cifs_files(razor_t)
- fs_manage_cifs_symlinks(razor_t)
- ')
+ userdom_home_manager(razor_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
optional_policy(`
milter_manage_spamass_state(razor_t)
diff --git a/policy/modules/services/remotelogin.te b/policy/modules/services/remotelogin.te
index adc198d..a475797 100644
--- a/policy/modules/services/remotelogin.te
+++ b/policy/modules/services/remotelogin.te
@@ -88,15 +88,7 @@ userdom_manage_user_tmp_dirs(remote_login_t)
userdom_manage_user_tmp_files(remote_login_t)
userdom_tmp_filetrans_user_tmp(remote_login_t, { file dir })
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(remote_login_t)
- fs_read_nfs_symlinks(remote_login_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(remote_login_t)
- fs_read_cifs_symlinks(remote_login_t)
-')
+userdom_home_reader(remote_login_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
optional_policy(`
Merge
2011-11-16 15:58:53 +00:00
alsa_domtrans(remote_login_t)
diff --git a/policy/modules/services/rlogin.te b/policy/modules/services/rlogin.te
index 4bcaacc..91c8ee8 100644
--- a/policy/modules/services/rlogin.te
+++ b/policy/modules/services/rlogin.te
@@ -92,21 +92,10 @@ userdom_search_admin_dir(rlogind_t)
userdom_manage_user_tmp_files(rlogind_t)
userdom_tmp_filetrans_user_tmp(rlogind_t, file)
userdom_use_user_terminals(rlogind_t)
+userdom_home_reader(rlogind_t)
rlogin_read_home_content(rlogind_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_list_nfs(rlogind_t)
- fs_read_nfs_files(rlogind_t)
- fs_read_nfs_symlinks(rlogind_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
-')
-
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_samba_home_dirs',`
- fs_list_cifs(rlogind_t)
- fs_read_cifs_files(rlogind_t)
- fs_read_cifs_symlinks(rlogind_t)
-')
-
optional_policy(`
kerberos_keytab_template(rlogind, rlogind_t)
kerberos_manage_host_rcache(rlogind_t)
diff --git a/policy/modules/services/rshd.te b/policy/modules/services/rshd.te
index 49a4283..cdf9184 100644
--- a/policy/modules/services/rshd.te
+++ b/policy/modules/services/rshd.te
@@ -68,15 +68,7 @@ seutil_read_default_contexts(rshd_t)
userdom_search_user_home_content(rshd_t)
userdom_manage_tmp_role(system_r, rshd_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(rshd_t)
- fs_read_nfs_symlinks(rshd_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(rshd_t)
- fs_read_cifs_symlinks(rshd_t)
-')
+userdom_home_reader(rshd_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
optional_policy(`
kerberos_keytab_template(rshd, rshd_t)
diff --git a/policy/modules/services/spamassassin.te b/policy/modules/services/spamassassin.te
index a370364..32019d8 100644
--- a/policy/modules/services/spamassassin.te
+++ b/policy/modules/services/spamassassin.te
@@ -147,6 +147,7 @@ manage_lnk_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
manage_fifo_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
manage_sock_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
userdom_user_home_dir_filetrans(spamd_t, spamassassin_home_t, { dir file lnk_file sock_file fifo_file })
+userdom_home_manager(spamassassin_t)
kernel_read_kernel_sysctls(spamassassin_t)
@@ -207,18 +208,6 @@ tunable_policy(`spamd_enable_home_dirs',`
userdom_manage_user_home_content_symlinks(spamd_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
')
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(spamassassin_t)
- fs_manage_nfs_files(spamassassin_t)
- fs_manage_nfs_symlinks(spamassassin_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(spamassassin_t)
- fs_manage_cifs_files(spamassassin_t)
- fs_manage_cifs_symlinks(spamassassin_t)
-')
-
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
optional_policy(`
Merge
2011-11-16 15:58:53 +00:00
# Write pid file and socket in ~/.evolution/cache/tmp
evolution_home_filetrans(spamd_t, spamd_tmp_t, { file sock_file })
@@ -328,18 +317,7 @@ seutil_read_config(spamc_t)
sysnet_read_config(spamc_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(spamc_t)
- fs_manage_nfs_files(spamc_t)
- fs_manage_nfs_symlinks(spamc_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
-')
-
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(spamc_t)
- fs_manage_cifs_files(spamc_t)
- fs_manage_cifs_symlinks(spamc_t)
-')
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
-
Merge
2011-11-16 15:58:53 +00:00
+userdom_home_manager(spamc_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
optional_policy(`
abrt_stream_connect(spamc_t)
@@ -479,22 +457,13 @@ miscfiles_read_localization(spamd_t)
userdom_use_unpriv_users_fds(spamd_t)
userdom_search_user_home_dirs(spamd_t)
+userdom_home_manager(spamd_t)
optional_policy(`
exim_manage_spool_dirs(spamd_t)
exim_manage_spool_files(spamd_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(spamd_t)
- fs_manage_nfs_files(spamd_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(spamd_t)
- fs_manage_cifs_files(spamd_t)
-')
-
optional_policy(`
amavis_manage_lib_files(spamd_t)
')
diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index 5439f7e..126255f 100644
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -277,19 +277,7 @@ template(`ssh_server_template',`
# Allow checking users mail at login
mta_getattr_spool($1_t)
- tunable_policy(`use_fusefs_home_dirs',`
- fs_manage_fusefs_dirs($1_t)
- fs_manage_fusefs_files($1_t)
- ')
-
- tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files($1_t)
- fs_read_nfs_symlinks($1_t)
- ')
-
- tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files($1_t)
- ')
+ userdom_home_manager($1_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
optional_policy(`
Merge
2011-11-16 15:58:53 +00:00
kerberos_use($1_t)
@@ -443,19 +431,7 @@ template(`ssh_role_template',`
ssh_exec_keygen($3)
- tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_files($1_ssh_agent_t)
-
- # transition back to normal privs upon exec
- fs_nfs_domtrans($1_ssh_agent_t, $3)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
- ')
-
Merge
2011-11-16 15:58:53 +00:00
- tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_files($1_ssh_agent_t)
-
- # transition back to normal privs upon exec
- fs_cifs_domtrans($1_ssh_agent_t, $3)
- ')
+ userdom_home_manager($1_ssh_agent_t)
optional_policy(`
nis_use_ypbind($1_ssh_agent_t)
diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te
index 02e70c9..e93db05 100644
--- a/policy/modules/services/ssh.te
+++ b/policy/modules/services/ssh.te
@@ -200,6 +200,7 @@ userdom_read_user_tmp_files(ssh_t)
userdom_write_user_tmp_files(ssh_t)
userdom_read_user_home_content_symlinks(ssh_t)
userdom_read_home_certs(ssh_t)
+userdom_home_manager(ssh_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
tunable_policy(`allow_ssh_keysign',`
domtrans_pattern(ssh_t, ssh_keysign_exec_t, ssh_keysign_t)
@@ -210,16 +211,6 @@ tunable_policy(`use_fusefs_home_dirs',`
fs_manage_fusefs_files(ssh_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
')
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(ssh_t)
- fs_manage_nfs_files(ssh_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
-')
-
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(ssh_t)
- fs_manage_cifs_files(ssh_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
-')
-
Merge
2011-11-16 15:58:53 +00:00
# for port forwarding
tunable_policy(`user_tcp_server',`
corenet_tcp_bind_ssh_port(ssh_t)
@@ -498,14 +489,7 @@ tunable_policy(`use_samba_home_dirs',`
fs_read_cifs_symlinks(chroot_user_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
')
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(chroot_user_t)
- fs_read_nfs_symlinks(chroot_user_t)
-')
-
-tunable_policy(`use_fusefs_home_dirs',`
- fs_read_fusefs_files(chroot_user_t)
-')
+userdom_home_manager(chroot_user_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
optional_policy(`
Merge
2011-11-16 15:58:53 +00:00
ssh_rw_dgram_sockets(chroot_user_t)
diff --git a/policy/modules/services/sssd.te b/policy/modules/services/sssd.te
index 5c32a99..eb8979d 100644
--- a/policy/modules/services/sssd.te
+++ b/policy/modules/services/sssd.te
@@ -117,17 +117,7 @@ optional_policy(`
ldap_stream_connect(sssd_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
')
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(sssd_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
-')
-
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(sssd_t)
-')
-
-tunable_policy(`use_fusefs_home_dirs',`
- fs_read_fusefs_files(sssd_t)
-')
+userdom_home_reader(sssd_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
diff --git a/policy/modules/services/virt.te b/policy/modules/services/virt.te
index 3619ec3..629863f 100644
--- a/policy/modules/services/virt.te
+++ b/policy/modules/services/virt.te
@@ -842,10 +842,6 @@ miscfiles_read_localization(virtd_lxc_t)
sysnet_domtrans_ifconfig(virtd_lxc_t)
-optional_policy(`
- execmem_exec(virtd_lxc_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
-')
-
Merge
2011-11-16 15:58:53 +00:00
#optional_policy(`
# unconfined_shell_domtrans(virtd_lxc_t)
# unconfined_signal(virtd_t)
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index 743ea2b..ab908aa 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -286,18 +286,7 @@ fs_search_auto_mountpoints(iceauth_t)
userdom_use_inherited_user_terminals(iceauth_t)
userdom_read_user_tmp_files(iceauth_t)
userdom_read_all_users_state(iceauth_t)
-
-tunable_policy(`use_fusefs_home_dirs',`
- fs_manage_fusefs_files(iceauth_t)
-')
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_files(iceauth_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_files(iceauth_t)
-')
+userdom_home_manager(iceauth_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
ifdef(`hide_broken_symptoms',`
dev_dontaudit_read_urand(iceauth_t)
@@ -388,14 +377,7 @@ tunable_policy(`use_fusefs_home_dirs',`
fs_manage_fusefs_files(xauth_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
')
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_files(xauth_t)
- fs_read_nfs_symlinks(xauth_t)
-')
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
-
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_files(xauth_t)
-')
+userdom_home_manager(xauth_t)
ifdef(`hide_broken_symptoms',`
term_dontaudit_use_unallocated_ttys(xauth_t)
@@ -614,6 +596,7 @@ files_dontaudit_access_check_etc(xdm_t)
files_dontaudit_getattr_all_dirs(xdm_t)
files_dontaudit_getattr_all_symlinks(xdm_t)
files_dontaudit_getattr_all_tmp_sockets(xdm_t)
+files_dontaudit_all_access_check(xdm_t)
fs_getattr_all_fs(xdm_t)
fs_search_auto_mountpoints(xdm_t)
@@ -678,6 +661,7 @@ userdom_manage_user_tmp_dirs(xdm_t)
userdom_manage_user_tmp_files(xdm_t)
userdom_manage_user_tmp_sockets(xdm_t)
userdom_manage_tmpfs_role(system_r, xdm_t)
+userdom_home_manager(xdm_t)
application_signal(xdm_t)
@@ -699,16 +683,10 @@ tunable_policy(`use_fusefs_home_dirs',`
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
')
Merge
2011-11-16 15:58:53 +00:00
tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(xdm_t)
- fs_manage_nfs_files(xdm_t)
- fs_manage_nfs_symlinks(xdm_t)
fs_exec_nfs_files(xdm_t)
')
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(xdm_t)
- fs_manage_cifs_files(xdm_t)
- fs_manage_cifs_symlinks(xdm_t)
fs_exec_cifs_files(xdm_t)
')
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
@@ -1227,26 +1205,10 @@ init_use_fds(xserver_t)
# (xauth?)
userdom_read_user_home_content_files(xserver_t)
userdom_read_all_users_state(xserver_t)
+userdom_home_manager(xserver_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
xserver_use_user_fonts(xserver_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(xserver_t)
- fs_manage_nfs_files(xserver_t)
- fs_manage_nfs_symlinks(xserver_t)
-')
-
-tunable_policy(`use_fusefs_home_dirs',`
- fs_manage_fusefs_dirs(xserver_t)
- fs_manage_fusefs_files(xserver_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(xserver_t)
- fs_manage_cifs_files(xserver_t)
- fs_manage_cifs_symlinks(xserver_t)
-')
-
optional_policy(`
dbus_system_bus_client(xserver_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
@@ -1434,7 +1396,6 @@ tunable_policy(`use_nfs_home_dirs',`
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
optional_policy(`
unconfined_rw_shm(xserver_t)
- unconfined_execmem_rw_shm(xserver_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
# xserver signals unconfined user on startx
unconfined_signal(xserver_t)
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 5a963ef..2409206 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -650,7 +650,7 @@ interface(`init_dontaudit_rw_stream_socket',`
type init_t;
')
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
- dontaudit $1 init_t:unix_stream_socket { read write };
+ dontaudit $1 init_t:unix_stream_socket { getattr read write };
')
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
########################################
Merge
2011-11-16 15:58:53 +00:00
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 75f6d6b..f44bdae 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -1206,13 +1206,6 @@ optional_policy(`
rpm_transition_script(initrc_t)
optional_policy(`
- gen_require(`
- type unconfined_execmem_t, execmem_exec_t;
- ')
- init_system_domain(unconfined_execmem_t, execmem_exec_t)
- ')
-
- optional_policy(`
rtkit_scheduled(initrc_t)
')
')
diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
index 37a5bb4..2291a13 100644
--- a/policy/modules/system/locallogin.te
+++ b/policy/modules/system/locallogin.te
@@ -154,15 +154,7 @@ tunable_policy(`console_login',`
term_relabel_console(local_login_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(local_login_t)
- fs_read_nfs_symlinks(local_login_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(local_login_t)
- fs_read_cifs_symlinks(local_login_t)
-')
+userdom_home_reader(local_login_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
tunable_policy(`allow_console_login',`
term_use_console(local_login_t)
diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
index 2273e1a..6b39756 100644
--- a/policy/modules/system/modutils.te
+++ b/policy/modules/system/modutils.te
@@ -78,6 +78,7 @@ userdom_use_inherited_user_terminals(depmod_t)
files_list_home(depmod_t)
userdom_read_user_home_content_files(depmod_t)
userdom_manage_user_tmp_files(depmod_t)
+userdom_home_reader(depmod_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
ifdef(`distro_ubuntu',`
optional_policy(`
@@ -85,14 +86,6 @@ ifdef(`distro_ubuntu',`
')
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
')
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(depmod_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(depmod_t)
-')
-
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
optional_policy(`
Merge
2011-11-16 15:58:53 +00:00
bootloader_rw_tmp_files(insmod_t)
')
diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
index 3ee9ea8..ac8b214 100644
--- a/policy/modules/system/selinuxutil.te
+++ b/policy/modules/system/selinuxutil.te
@@ -492,14 +492,7 @@ seutil_manage_default_contexts(semanage_t)
# Handle pp files created in homedir and /tmp
userdom_read_user_home_content_files(semanage_t)
userdom_read_user_tmp_files(semanage_t)
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(semanage_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
-')
-
Merge
2011-11-16 15:58:53 +00:00
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(semanage_t)
-')
+userdom_home_reader(semanage_t)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
Merge
2011-11-16 15:58:53 +00:00
ifdef(`distro_debian',`
files_read_var_lib_files(semanage_t)
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 31047e8..0bb4d1e 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -1144,10 +1144,6 @@ template(`userdom_restricted_xwindows_user_template',`
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
')
optional_policy(`
Merge
2011-11-16 15:58:53 +00:00
- openoffice_role_template($1, $1_r, $1_usertype)
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
- ')
-
- optional_policy(`
Merge
2011-11-16 15:58:53 +00:00
policykit_role($1_r, $1_usertype)
')
@@ -1282,10 +1278,6 @@ template(`userdom_unpriv_user_template', `
')
optional_policy(`
Allow logrotate setuid and setgid since logrotate is supposed to do it Fixes for thumb policy by grift Add new nfsd ports Added fix to allow confined apps to execmod on chrome Add labeling for additional vdsm directories Allow Exim and Dovecot SASL Add label for /var/run/nmbd Add fixes to make virsh and xen working together Colord executes ls /var/spool/cron is now labeled as user_cron_spool_t
2011-10-04 14:50:39 +00:00
- mono_role_template($1, $1_r, $1_t)
- ')
-
- optional_policy(`
mount_run_fusermount($1_t, $1_r)
mount_read_pid_files($1_t)
')
Merge
2011-11-16 15:58:53 +00:00
@@ -5065,3 +5057,41 @@ interface(`userdom_filetrans_home_content',`
# gnome_admin_home_gconf_filetrans($1, home_bin_t, dir, "bin")
#')
MCS fixes quota fixes
2011-11-04 19:27:05 +00:00
')
+
Merge
2011-11-16 15:58:53 +00:00
+########################################
MCS fixes quota fixes
2011-11-04 19:27:05 +00:00
+## <summary>
Merge
2011-11-16 15:58:53 +00:00
+## Make the specified type able to read content in user home dirs
MCS fixes quota fixes
2011-11-04 19:27:05 +00:00
+## </summary>
Merge
2011-11-16 15:58:53 +00:00
+## <param name="type">
MCS fixes quota fixes
2011-11-04 19:27:05 +00:00
+## <summary>
Merge
2011-11-16 15:58:53 +00:00
+## Domain allowed access.
MCS fixes quota fixes
2011-11-04 19:27:05 +00:00
+## </summary>
+## </param>
+#
Merge
2011-11-16 15:58:53 +00:00
+interface(`userdom_home_reader',`
MCS fixes quota fixes
2011-11-04 19:27:05 +00:00
+ gen_require(`
Merge
2011-11-16 15:58:53 +00:00
+ attribute userdom_home_reader_type;
MCS fixes quota fixes
2011-11-04 19:27:05 +00:00
+ ')
+
Merge
2011-11-16 15:58:53 +00:00
+ typeattribute $1 userdom_home_reader_type;
MCS fixes quota fixes
2011-11-04 19:27:05 +00:00
+')
+
Merge
2011-11-16 15:58:53 +00:00
+
+########################################
MCS fixes quota fixes
2011-11-04 19:27:05 +00:00
+## <summary>
Merge
2011-11-16 15:58:53 +00:00
+## Make the specified type able to manage content in user home dirs
MCS fixes quota fixes
2011-11-04 19:27:05 +00:00
+## </summary>
Merge
2011-11-16 15:58:53 +00:00
+## <param name="type">
MCS fixes quota fixes
2011-11-04 19:27:05 +00:00
+## <summary>
Merge
2011-11-16 15:58:53 +00:00
+## Domain allowed access.
MCS fixes quota fixes
2011-11-04 19:27:05 +00:00
+## </summary>
+## </param>
+#
Merge
2011-11-16 15:58:53 +00:00
+interface(`userdom_home_manager',`
MCS fixes quota fixes
2011-11-04 19:27:05 +00:00
+ gen_require(`
Merge
2011-11-16 15:58:53 +00:00
+ attribute userdom_home_manager_type;
MCS fixes quota fixes
2011-11-04 19:27:05 +00:00
+ ')
+
Merge
2011-11-16 15:58:53 +00:00
+ typeattribute $1 userdom_home_manager_type;
+')
+
diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index d6c3860..ced52ff 100644
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -73,6 +73,9 @@ attribute unpriv_userdomain;
attribute untrusted_content_type;
attribute untrusted_content_tmp_type;
+attribute userdom_home_reader_type;
+attribute userdom_home_manager_type;
+
# unprivileged user domains
attribute user_home_type;
attribute user_tmp_type;
@@ -172,3 +175,36 @@ optional_policy(`
optional_policy(`
xserver_filetrans_home_content(userdomain)
')
+
+
+tunable_policy(`use_nfs_home_dirs',`
+ fs_read_nfs_files(userdom_home_reader_type)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+ fs_read_cifs_files(userdom_home_reader_type)
+')
+
+tunable_policy(`use_fusefs_home_dirs',`
+ fs_read_fusefs_files(userdom_home_reader_type)
+')
+
+tunable_policy(`use_nfs_home_dirs',`
+ fs_list_auto_mountpoints(userdom_home_manager_type)
+ fs_manage_nfs_dirs(userdom_home_manager_type)
+ fs_manage_nfs_files(userdom_home_manager_type)
+ fs_manage_nfs_symlinks(userdom_home_manager_type)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+ fs_manage_cifs_dirs(userdom_home_manager_type)
+ fs_manage_cifs_files(userdom_home_manager_type)
+ fs_manage_cifs_symlinks(userdom_home_manager_type)
+')
+
+tunable_policy(`use_fusefs_home_dirs',`
+ fs_manage_fusefs_dirs(userdom_home_manager_type)
+ fs_manage_fusefs_files(userdom_home_manager_type)
+ fs_manage_fusefs_symlinks(userdom_home_manager_type)
MCS fixes quota fixes
2011-11-04 19:27:05 +00:00
+')
Merge
2011-11-16 15:58:53 +00:00
+
Reference in New Issue Copy Permalink