diff --git a/policy/modules/admin/bootloader.te b/policy/modules/admin/bootloader.te
index a4674123..37f4d94e 100644
--- a/policy/modules/admin/bootloader.te
+++ b/policy/modules/admin/bootloader.te
@@ -1,5 +1,5 @@
-policy_module(bootloader,1.5.1)
+policy_module(bootloader,1.5.2)
########################################
#
@@ -185,6 +185,7 @@ optional_policy(`
optional_policy(`
hal_dontaudit_append_lib_files(bootloader_t)
+ hal_write_log(bootloader_t)
')
optional_policy(`
diff --git a/policy/modules/admin/vbetool.te b/policy/modules/admin/vbetool.te
index fb98c4eb..0d72e4cf 100644
--- a/policy/modules/admin/vbetool.te
+++ b/policy/modules/admin/vbetool.te
@@ -1,5 +1,5 @@
-policy_module(vbetool,1.1.0)
+policy_module(vbetool,1.1.1)
########################################
#
@@ -32,4 +32,5 @@ miscfiles_read_localization(vbetool_t)
optional_policy(`
hal_rw_pid_files(vbetool_t)
+ hal_write_log(vbetool_t)
')
diff --git a/policy/modules/services/clamav.fc b/policy/modules/services/clamav.fc
index f9790aac..0455984e 100644
--- a/policy/modules/services/clamav.fc
+++ b/policy/modules/services/clamav.fc
@@ -1,6 +1,5 @@
/etc/clamav(/.*)? gen_context(system_u:object_r:clamd_etc_t,s0)
-
/usr/bin/clamscan -- gen_context(system_u:object_r:clamscan_exec_t,s0)
/usr/bin/clamdscan -- gen_context(system_u:object_r:clamscan_exec_t,s0)
/usr/bin/freshclam -- gen_context(system_u:object_r:freshclam_exec_t,s0)
@@ -9,8 +8,13 @@
/var/run/amavis(d)?/clamd\.pid -- gen_context(system_u:object_r:clamd_var_run_t,s0)
/var/run/clamav(/.*)? gen_context(system_u:object_r:clamd_var_run_t,s0)
+/var/run/clamd\..* gen_context(system_u:object_r:clamd_var_run_t,s0)
+/var/run/clamav\..* gen_context(system_u:object_r:clamd_var_run_t,s0)
+
/var/lib/clamav(/.*)? gen_context(system_u:object_r:clamd_var_lib_t,s0)
+
/var/log/clamav -d gen_context(system_u:object_r:clamd_var_log_t,s0)
/var/log/clamav/clamav.* -- gen_context(system_u:object_r:clamd_var_log_t,s0)
/var/log/clamav/freshclam.* -- gen_context(system_u:object_r:freshclam_var_log_t,s0)
+
/var/spool/amavisd/clamd\.sock -s gen_context(system_u:object_r:clamd_var_run_t,s0)
diff --git a/policy/modules/services/clamav.te b/policy/modules/services/clamav.te
index a6a8905e..c4d4e5f7 100644
--- a/policy/modules/services/clamav.te
+++ b/policy/modules/services/clamav.te
@@ -1,5 +1,5 @@
-policy_module(clamav,1.4.0)
+policy_module(clamav,1.4.1)
########################################
#
@@ -74,17 +74,19 @@ manage_dirs_pattern(clamd_t,clamd_var_lib_t,clamd_var_lib_t)
manage_files_pattern(clamd_t,clamd_var_lib_t,clamd_var_lib_t)
# log files
-allow clamd_t clamd_var_log_t:dir setattr;
+manage_dirs_pattern(clamd_t,clamd_var_log_t,clamd_var_log_t)
manage_files_pattern(clamd_t,clamd_var_log_t,clamd_var_log_t)
-logging_log_filetrans(clamd_t,clamd_var_log_t,file)
+logging_log_filetrans(clamd_t,clamd_var_log_t,{ dir file })
# pid file
+manage_dirs_pattern(clamd_t,clamd_var_log_t,clamd_var_log_t)
manage_files_pattern(clamd_t,clamd_var_run_t,clamd_var_run_t)
manage_sock_files_pattern(clamd_t,clamd_var_run_t,clamd_var_run_t)
-files_pid_filetrans(clamd_t,clamd_var_run_t,file)
+files_pid_filetrans(clamd_t,clamd_var_run_t,{ file dir })
kernel_dontaudit_list_proc(clamd_t)
kernel_read_sysctl(clamd_t)
+kernel_read_kernel_sysctls(clamd_t)
corenet_all_recvfrom_unlabeled(clamd_t)
corenet_all_recvfrom_netlabel(clamd_t)
@@ -213,7 +215,7 @@ manage_files_pattern(clamscan_t,clamscan_tmp_t,clamscan_tmp_t)
files_tmp_filetrans(clamscan_t,clamscan_tmp_t,{ file dir })
# var/lib files together with clamd
-read_files_pattern(clamscan_t,clamd_var_lib_t,clamd_var_lib_t)
+manage_files_pattern(clamscan_t,clamd_var_lib_t,clamd_var_lib_t)
allow clamscan_t clamd_var_lib_t:dir list_dir_perms;
kernel_read_kernel_sysctls(clamscan_t)
@@ -222,6 +224,9 @@ files_read_etc_files(clamscan_t)
files_read_etc_runtime_files(clamscan_t)
files_search_var_lib(clamscan_t)
+init_read_utmp(clamscan_t)
+init_dontaudit_write_utmp(clamscan_t)
+
libs_use_ld_so(clamscan_t)
libs_use_shared_libs(clamscan_t)
diff --git a/policy/modules/services/hal.fc b/policy/modules/services/hal.fc
index 38cc6447..4c43b6ce 100644
--- a/policy/modules/services/hal.fc
+++ b/policy/modules/services/hal.fc
@@ -2,6 +2,8 @@
/etc/hal/device\.d/printer_remove\.hal -- gen_context(system_u:object_r:hald_exec_t,s0)
/etc/hal/capability\.d/printer_update\.hal -- gen_context(system_u:object_r:hald_exec_t,s0)
+/usr/bin/hal-setup-keymap -- gen_context(system_u:object_r:hald_keymap_exec_t,s0)
+
/usr/libexec/hal-acl-tool -- gen_context(system_u:object_r:hald_acl_exec_t,s0)
/usr/libexec/hal-hotplug-map -- gen_context(system_u:object_r:hald_exec_t,s0)
/usr/libexec/hal-system-sonypic -- gen_context(system_u:object_r:hald_sonypic_exec_t,s0)
@@ -13,4 +15,7 @@
/var/lib/hal(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0)
+/var/log/pm-suspend.log gen_context(system_u:object_r:hald_log_t,s0)
+
/var/run/haldaemon.pid -- gen_context(system_u:object_r:hald_var_run_t,s0)
+/var/run/vbestate -- gen_context(system_u:object_r:hald_var_run_t,s0)
diff --git a/policy/modules/services/hal.if b/policy/modules/services/hal.if
index d2203297..0e4c46b1 100644
--- a/policy/modules/services/hal.if
+++ b/policy/modules/services/hal.if
@@ -18,6 +18,42 @@ interface(`hal_domtrans',`
domtrans_pattern($1,hald_exec_t,hald_t)
')
+########################################
+##
+## Allow ptrace of hal domain
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`hal_ptrace',`
+ gen_require(`
+ type hald_t;
+ ')
+
+ allow $1 hald_t:process ptrace;
+')
+
+########################################
+##
+## Allow domain to use file descriptors from hal.
+##
+##
+##
+## Domain to not audit.
+##
+##
+#
+interface(`hal_use_fds',`
+ gen_require(`
+ type hald_t;
+ ')
+
+ allow $1 hald_t:fd use;
+')
+
########################################
##
## Do not audit attempts to use file descriptors from hal.
@@ -36,6 +72,25 @@ interface(`hal_dontaudit_use_fds',`
dontaudit $1 hald_t:fd use;
')
+########################################
+##
+## Allow attempts to read and write to
+## hald unnamed pipes.
+##
+##
+##
+## Domain to not audit.
+##
+##
+#
+interface(`hal_rw_pipes',`
+ gen_require(`
+ type hald_t;
+ ')
+
+ allow $1 hald_t:fifo_file rw_fifo_file_perms;
+')
+
########################################
##
## Do not audit attempts to read and write to
@@ -133,6 +188,45 @@ interface(`hal_dbus_chat',`
allow hald_t $1:dbus send_msg;
')
+########################################
+##
+## Allow attempts to write the hal
+## log files.
+##
+##
+##
+## Domain to not audit
+##
+##
+#
+interface(`hal_write_log',`
+ gen_require(`
+ type hald_log_t;
+ ')
+
+ logging_search_logs($1)
+ allow $1 hald_log_t:file write_file_perms;
+')
+
+########################################
+##
+## Do not audit attempts to write the hal
+## log files.
+##
+##
+##
+## Domain to not audit
+##
+##
+#
+interface(`hal_dontaudit_write_log',`
+ gen_require(`
+ type hald_log_t;
+ ')
+
+ dontaudit $1 hald_log_t:file { append write };
+')
+
########################################
##
## Read hald tmp files.
diff --git a/policy/modules/services/hal.te b/policy/modules/services/hal.te
index 1f1ddf1f..caa78571 100644
--- a/policy/modules/services/hal.te
+++ b/policy/modules/services/hal.te
@@ -1,5 +1,5 @@
-policy_module(hal,1.7.0)
+policy_module(hal,1.7.1)
########################################
#
@@ -19,6 +19,12 @@ role system_r types hald_acl_t;
type hald_cache_t;
files_pid_file(hald_cache_t)
+type hald_keymap_t;
+type hald_keymap_exec_t;
+domain_type(hald_keymap_t)
+domain_entry_file(hald_keymap_t,hald_keymap_exec_t)
+role system_r types hald_keymap_t;
+
type hald_log_t;
files_type(hald_log_t)
@@ -81,6 +87,7 @@ files_pid_filetrans(hald_t,hald_var_run_t,file)
kernel_read_system_state(hald_t)
kernel_read_network_state(hald_t)
+kernel_read_software_raid_state(hald_t)
kernel_rw_kernel_sysctl(hald_t)
kernel_read_fs_sysctls(hald_t)
kernel_rw_irq_sysctls(hald_t)
@@ -131,6 +138,7 @@ files_read_usr_files(hald_t)
files_create_boot_flag(hald_t)
files_getattr_all_dirs(hald_t)
files_read_kernel_img(hald_t)
+files_rw_lock_dirs(hald_t)
fs_getattr_all_fs(hald_t)
fs_search_all(hald_t)
@@ -180,6 +188,7 @@ modutils_domtrans_insmod(hald_t)
seutil_read_config(hald_t)
seutil_read_default_contexts(hald_t)
+seutil_read_file_contexts(hald_t)
sysnet_read_config(hald_t)
@@ -192,6 +201,7 @@ ifdef(`targeted_policy',`
')
optional_policy(`
+ alsa_domtrans(hald_t)
alsa_read_rw_config(hald_t)
')
@@ -301,7 +311,10 @@ files_search_var_lib(hald_acl_t)
corecmd_exec_bin(hald_acl_t)
dev_getattr_all_chr_files(hald_acl_t)
+dev_getattr_generic_usb_dev(hald_acl_t)
+dev_getattr_video_dev(hald_acl_t)
dev_setattr_video_dev(hald_acl_t)
+dev_getattr_sound_dev(hald_acl_t)
dev_setattr_sound_dev(hald_acl_t)
dev_setattr_generic_usb_dev(hald_acl_t)
dev_setattr_usbfs_files(hald_acl_t)
@@ -378,3 +391,25 @@ ifdef(`targeted_policy',`
term_dontaudit_use_console(hald_sonypic_t)
term_dontaudit_use_generic_ptys(hald_sonypic_t)
')
+
+########################################
+#
+# Hal keymap local policy
+#
+
+domtrans_pattern(hald_t, hald_keymap_exec_t, hald_keymap_t)
+allow hald_t hald_keymap_t:process signal;
+allow hald_keymap_t hald_t:unix_stream_socket connectto;
+
+manage_dirs_pattern(hald_keymap_t,hald_var_lib_t,hald_var_lib_t)
+manage_files_pattern(hald_keymap_t,hald_var_lib_t,hald_var_lib_t)
+files_search_var_lib(hald_keymap_t)
+
+dev_rw_input_dev(hald_keymap_t)
+
+files_read_usr_files(hald_keymap_t)
+
+libs_use_ld_so(hald_keymap_t)
+libs_use_shared_libs(hald_keymap_t)
+
+miscfiles_read_localization(hald_keymap_t)
diff --git a/policy/support/file_patterns.spt b/policy/support/file_patterns.spt
index 9f4a2918..69c93668 100644
--- a/policy/support/file_patterns.spt
+++ b/policy/support/file_patterns.spt
@@ -36,6 +36,11 @@ define(`del_entry_dirs_pattern',`
allow $1 $3:dir del_entry_dir_perms;
')
+define(`rw_dirs_pattern',`
+ allow $1 $2:dir search_dir_perms;
+ allow $1 $3:dir { add_entry_dir_perms del_entry_dir_perms };
+')
+
define(`create_dirs_pattern',`
allow $1 $2:dir add_entry_dir_perms;
allow $1 $3:dir create_dir_perms;