trunk: 4 patches from dan.

policy/modules/admin/bootloader.te

@@ -1,5 +1,5 @@
 
-policy_module(bootloader,1.5.1)
+policy_module(bootloader,1.5.2)
 
 ########################################
 #
@@ -185,6 +185,7 @@ optional_policy(`
 
 optional_policy(`
 	hal_dontaudit_append_lib_files(bootloader_t)
+	hal_write_log(bootloader_t)
 ')
 
 optional_policy(`

policy/modules/admin/vbetool.te

@@ -1,5 +1,5 @@
 
-policy_module(vbetool,1.1.0)
+policy_module(vbetool,1.1.1)
 
 ########################################
 #
@@ -32,4 +32,5 @@ miscfiles_read_localization(vbetool_t)
 
 optional_policy(`
 	hal_rw_pid_files(vbetool_t)
+	hal_write_log(vbetool_t)
 ')

policy/modules/services/clamav.fc

@@ -1,6 +1,5 @@
 /etc/clamav(/.*)?			gen_context(system_u:object_r:clamd_etc_t,s0)
 
-
 /usr/bin/clamscan		--	gen_context(system_u:object_r:clamscan_exec_t,s0)
 /usr/bin/clamdscan		--	gen_context(system_u:object_r:clamscan_exec_t,s0)
 /usr/bin/freshclam		--	gen_context(system_u:object_r:freshclam_exec_t,s0)
@@ -9,8 +8,13 @@
 
 /var/run/amavis(d)?/clamd\.pid	--	gen_context(system_u:object_r:clamd_var_run_t,s0)
 /var/run/clamav(/.*)?			gen_context(system_u:object_r:clamd_var_run_t,s0)
+/var/run/clamd\..*			gen_context(system_u:object_r:clamd_var_run_t,s0)
+/var/run/clamav\..*			gen_context(system_u:object_r:clamd_var_run_t,s0)
+
 /var/lib/clamav(/.*)?			gen_context(system_u:object_r:clamd_var_lib_t,s0)
+
 /var/log/clamav			-d	gen_context(system_u:object_r:clamd_var_log_t,s0)
 /var/log/clamav/clamav.*	--	gen_context(system_u:object_r:clamd_var_log_t,s0)
 /var/log/clamav/freshclam.*	--	gen_context(system_u:object_r:freshclam_var_log_t,s0)
+
 /var/spool/amavisd/clamd\.sock	-s	gen_context(system_u:object_r:clamd_var_run_t,s0)

policy/modules/services/clamav.te

@@ -1,5 +1,5 @@
 
-policy_module(clamav,1.4.0)
+policy_module(clamav,1.4.1)
 
 ########################################
 #
@@ -74,17 +74,19 @@ manage_dirs_pattern(clamd_t,clamd_var_lib_t,clamd_var_lib_t)
 manage_files_pattern(clamd_t,clamd_var_lib_t,clamd_var_lib_t)
 
 # log files
-allow clamd_t clamd_var_log_t:dir setattr;
+manage_dirs_pattern(clamd_t,clamd_var_log_t,clamd_var_log_t)
 manage_files_pattern(clamd_t,clamd_var_log_t,clamd_var_log_t)
-logging_log_filetrans(clamd_t,clamd_var_log_t,file)
+logging_log_filetrans(clamd_t,clamd_var_log_t,{ dir file })
 
 # pid file
+manage_dirs_pattern(clamd_t,clamd_var_log_t,clamd_var_log_t)
 manage_files_pattern(clamd_t,clamd_var_run_t,clamd_var_run_t)
 manage_sock_files_pattern(clamd_t,clamd_var_run_t,clamd_var_run_t)
-files_pid_filetrans(clamd_t,clamd_var_run_t,file)
+files_pid_filetrans(clamd_t,clamd_var_run_t,{ file dir })
 
 kernel_dontaudit_list_proc(clamd_t)
 kernel_read_sysctl(clamd_t)
+kernel_read_kernel_sysctls(clamd_t)
 
 corenet_all_recvfrom_unlabeled(clamd_t)
 corenet_all_recvfrom_netlabel(clamd_t)
@@ -213,7 +215,7 @@ manage_files_pattern(clamscan_t,clamscan_tmp_t,clamscan_tmp_t)
 files_tmp_filetrans(clamscan_t,clamscan_tmp_t,{ file dir })
 
 # var/lib files together with clamd
-read_files_pattern(clamscan_t,clamd_var_lib_t,clamd_var_lib_t)
+manage_files_pattern(clamscan_t,clamd_var_lib_t,clamd_var_lib_t)
 allow clamscan_t clamd_var_lib_t:dir list_dir_perms;
 
 kernel_read_kernel_sysctls(clamscan_t)
@@ -222,6 +224,9 @@ files_read_etc_files(clamscan_t)
 files_read_etc_runtime_files(clamscan_t)
 files_search_var_lib(clamscan_t)
 
+init_read_utmp(clamscan_t)
+init_dontaudit_write_utmp(clamscan_t)
+
 libs_use_ld_so(clamscan_t)
 libs_use_shared_libs(clamscan_t)
 

policy/modules/services/hal.fc

@@ -2,6 +2,8 @@
 /etc/hal/device\.d/printer_remove\.hal -- 	gen_context(system_u:object_r:hald_exec_t,s0)
 /etc/hal/capability\.d/printer_update\.hal --	gen_context(system_u:object_r:hald_exec_t,s0)
 
+/usr/bin/hal-setup-keymap		--	gen_context(system_u:object_r:hald_keymap_exec_t,s0)
+
 /usr/libexec/hal-acl-tool		--	gen_context(system_u:object_r:hald_acl_exec_t,s0)
 /usr/libexec/hal-hotplug-map 		--	gen_context(system_u:object_r:hald_exec_t,s0)
 /usr/libexec/hal-system-sonypic	 	--	gen_context(system_u:object_r:hald_sonypic_exec_t,s0)
@@ -13,4 +15,7 @@
 
 /var/lib/hal(/.*)?				gen_context(system_u:object_r:hald_var_lib_t,s0)
 
+/var/log/pm-suspend.log				gen_context(system_u:object_r:hald_log_t,s0)
+
 /var/run/haldaemon.pid	--	 		gen_context(system_u:object_r:hald_var_run_t,s0)
+/var/run/vbestate 	--			gen_context(system_u:object_r:hald_var_run_t,s0)

policy/modules/services/hal.if

@@ -18,6 +18,42 @@ interface(`hal_domtrans',`
 	domtrans_pattern($1,hald_exec_t,hald_t)
 ')
 
+########################################
+## <summary>
+##	Allow ptrace of hal domain
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`hal_ptrace',`
+	gen_require(`
+		type hald_t;
+	')
+
+	allow $1 hald_t:process ptrace;
+')
+
+########################################
+## <summary>
+##	Allow domain to use file descriptors from hal.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`hal_use_fds',`
+	gen_require(`
+		type hald_t;
+	')
+
+	allow $1 hald_t:fd use; 
+')
+
 ########################################
 ## <summary>
 ##	Do not audit attempts to use file descriptors from hal.
@@ -36,6 +72,25 @@ interface(`hal_dontaudit_use_fds',`
 	dontaudit $1 hald_t:fd use; 
 ')
 
+########################################
+## <summary>
+##	Allow attempts to read and write to
+##	hald unnamed pipes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`hal_rw_pipes',`
+	gen_require(`
+		type hald_t;
+	')
+
+	allow $1 hald_t:fifo_file rw_fifo_file_perms; 
+')
+
 ########################################
 ## <summary>
 ##	Do not audit attempts to read and write to
@@ -133,6 +188,45 @@ interface(`hal_dbus_chat',`
 	allow hald_t $1:dbus send_msg;
 ')
 
+########################################
+## <summary>
+##	Allow attempts to write the hal
+##	log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit
+##	</summary>
+## </param>
+#
+interface(`hal_write_log',`
+	gen_require(`
+		type hald_log_t;
+	')
+
+	logging_search_logs($1)
+	allow $1 hald_log_t:file write_file_perms;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to write the hal
+##	log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit
+##	</summary>
+## </param>
+#
+interface(`hal_dontaudit_write_log',`
+	gen_require(`
+		type hald_log_t;
+	')
+
+	dontaudit $1 hald_log_t:file { append write };
+')
+
 ########################################
 ## <summary>
 ##	Read hald tmp files.

policy/modules/services/hal.te

@@ -1,5 +1,5 @@
 
-policy_module(hal,1.7.0)
+policy_module(hal,1.7.1)
 
 ########################################
 #
@@ -19,6 +19,12 @@ role system_r types hald_acl_t;
 type hald_cache_t;
 files_pid_file(hald_cache_t)
 
+type hald_keymap_t;
+type hald_keymap_exec_t;
+domain_type(hald_keymap_t)
+domain_entry_file(hald_keymap_t,hald_keymap_exec_t)
+role system_r types hald_keymap_t;
+
 type hald_log_t;
 files_type(hald_log_t)
 
@@ -81,6 +87,7 @@ files_pid_filetrans(hald_t,hald_var_run_t,file)
 
 kernel_read_system_state(hald_t)
 kernel_read_network_state(hald_t)
+kernel_read_software_raid_state(hald_t)
 kernel_rw_kernel_sysctl(hald_t)
 kernel_read_fs_sysctls(hald_t)
 kernel_rw_irq_sysctls(hald_t)
@@ -131,6 +138,7 @@ files_read_usr_files(hald_t)
 files_create_boot_flag(hald_t)
 files_getattr_all_dirs(hald_t)
 files_read_kernel_img(hald_t)
+files_rw_lock_dirs(hald_t)
 
 fs_getattr_all_fs(hald_t)
 fs_search_all(hald_t)
@@ -180,6 +188,7 @@ modutils_domtrans_insmod(hald_t)
 
 seutil_read_config(hald_t)
 seutil_read_default_contexts(hald_t)
+seutil_read_file_contexts(hald_t)
 
 sysnet_read_config(hald_t)
 
@@ -192,6 +201,7 @@ ifdef(`targeted_policy',`
 ')
 
 optional_policy(`
+	alsa_domtrans(hald_t)
 	alsa_read_rw_config(hald_t)
 ')
 
@@ -301,7 +311,10 @@ files_search_var_lib(hald_acl_t)
 corecmd_exec_bin(hald_acl_t)
 
 dev_getattr_all_chr_files(hald_acl_t)
+dev_getattr_generic_usb_dev(hald_acl_t)
+dev_getattr_video_dev(hald_acl_t)
 dev_setattr_video_dev(hald_acl_t)
+dev_getattr_sound_dev(hald_acl_t)
 dev_setattr_sound_dev(hald_acl_t)
 dev_setattr_generic_usb_dev(hald_acl_t)
 dev_setattr_usbfs_files(hald_acl_t)
@@ -378,3 +391,25 @@ ifdef(`targeted_policy',`
 	term_dontaudit_use_console(hald_sonypic_t)
 	term_dontaudit_use_generic_ptys(hald_sonypic_t)
 ')
+
+########################################
+#
+# Hal keymap local policy
+#
+
+domtrans_pattern(hald_t, hald_keymap_exec_t, hald_keymap_t)
+allow hald_t hald_keymap_t:process signal;
+allow hald_keymap_t hald_t:unix_stream_socket connectto;
+
+manage_dirs_pattern(hald_keymap_t,hald_var_lib_t,hald_var_lib_t)
+manage_files_pattern(hald_keymap_t,hald_var_lib_t,hald_var_lib_t)
+files_search_var_lib(hald_keymap_t)
+
+dev_rw_input_dev(hald_keymap_t)
+
+files_read_usr_files(hald_keymap_t)
+
+libs_use_ld_so(hald_keymap_t)
+libs_use_shared_libs(hald_keymap_t)
+
+miscfiles_read_localization(hald_keymap_t)

policy/support/file_patterns.spt

@@ -36,6 +36,11 @@ define(`del_entry_dirs_pattern',`
 	allow $1 $3:dir del_entry_dir_perms;
 ')
 
+define(`rw_dirs_pattern',`
+	allow $1 $2:dir search_dir_perms;
+	allow $1 $3:dir { add_entry_dir_perms del_entry_dir_perms };
+')
+
 define(`create_dirs_pattern',`
 	allow $1 $2:dir add_entry_dir_perms;
 	allow $1 $3:dir create_dir_perms;