patch from dan Mon, 20 Feb 2006 17:19:34 -0500

refpolicy/Changelog

@@ -1,3 +1,4 @@
+- Add semanage policy for semodule from Dan Walsh.
 - Remove allow_execmem from targeted policy domain_base_type().
 - Add users_extra and seusers support.
 - Postfix fixes from Serge Hallyn.

refpolicy/policy/modules/admin/su.if

@@ -220,6 +220,14 @@ template(`su_per_userdomain_template',`
 		nscd_socket_use($1_su_t)
 	')
 
+	# Modify .Xauthority file (via xauth program).
+	optional_policy(`xserver',`
+#		file_type_auto_trans($1_su_t, staff_home_dir_t, staff_xauth_home_t, file)
+#		file_type_auto_trans($1_su_t, user_home_dir_t, user_xauth_home_t, file)
+#		file_type_auto_trans($1_su_t, sysadm_home_dir_t, sysadm_xauth_home_t, file)
+		xserver_domtrans_user_xauth($1, $1_su_t)
+	')
+
 	ifdef(`TODO',`
 	# Caused by su - init scripts
 	dontaudit $1_su_t initrc_devpts_t:chr_file { getattr ioctl };
@@ -235,17 +243,6 @@ template(`su_per_userdomain_template',`
 	dontaudit $1_su_t home_dir_type:dir { search write };
 	')
 
-	# Modify .Xauthority file (via xauth program).
-	ifdef(`xauth.te', `
-	file_type_auto_trans($1_su_t, staff_home_dir_t, staff_xauth_home_t, file)
-	file_type_auto_trans($1_su_t, user_home_dir_t, user_xauth_home_t, file)
-	file_type_auto_trans($1_su_t, sysadm_home_dir_t, sysadm_xauth_home_t, file)
-	domain_auto_trans($1_su_t, xauth_exec_t, $1_xauth_t)
-	')
-
-	ifdef(`cyrus.te', `
-	allow $1_su_t cyrus_var_lib_t:dir search;
-	')
 	ifdef(`ssh.te', `
 	# Access sshd cookie files.
 	allow $1_su_t sshd_tmp_t:file rw_file_perms;

refpolicy/policy/modules/admin/su.te

@@ -1,5 +1,5 @@
 
-policy_module(su,1.2.1)
+policy_module(su,1.2.2)
 
 ########################################
 #

refpolicy/policy/modules/apps/slocate.te

@@ -1,5 +1,5 @@
 
-policy_module(slocate,1.0.1)
+policy_module(slocate,1.0.2)
 
 #################################
 #
@@ -38,6 +38,8 @@ files_list_all(locate_t)
 files_getattr_all_files(locate_t)
 files_read_etc_runtime_files(locate_t)
 files_read_etc_files(locate_t)
+# mls Higher level directories will be refused, so dontaudit
+files_dontaudit_getattr_all_dirs(locate_t)
 
 fs_getattr_xattr_fs(locate_t)
 

refpolicy/policy/modules/kernel/devices.if

@@ -1056,6 +1056,44 @@ interface(`dev_rw_crypto',`
 	allow $1 crypt_device_t:chr_file rw_file_perms;
 ')
 
+########################################
+## <summary>
+##	getattr the dri devices.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dev_getattr_dri_dev',`
+	gen_require(`
+		type device_t, dri_device_t;
+	')
+
+	allow $1 device_t:dir r_dir_perms;
+	allow $1 dri_device_t:chr_file getattr;
+')
+
+########################################
+## <summary>
+##	Setattr the dri devices.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dev_setattr_dri_dev',`
+	gen_require(`
+		type device_t, dri_device_t;
+	')
+
+	allow $1 device_t:dir r_dir_perms;
+	allow $1 dri_device_t:chr_file setattr;
+')
+
 ########################################
 ## <summary>
 ##	Read and write the dri devices.

refpolicy/policy/modules/kernel/devices.te

@@ -1,5 +1,5 @@
 
-policy_module(devices,1.0.3)
+policy_module(devices,1.0.4)
 
 ########################################
 #

refpolicy/policy/modules/services/cron.if

@@ -544,7 +544,7 @@ interface(`cron_rw_system_job_pipes',`
 		type system_crond_t;
 	')
 
-	allow $1 system_crond_t:file rw_file_perms;
+	allow $1 system_crond_t:fifo_file rw_file_perms;
 ')
 
 ########################################

refpolicy/policy/modules/services/cron.te

@@ -1,5 +1,5 @@
 
-policy_module(cron,1.2.1)
+policy_module(cron,1.2.2)
 
 gen_require(`
 	class passwd rootok;
@@ -392,6 +392,10 @@ ifdef(`targeted_policy',`
 		nscd_socket_use(system_crond_t)
 	')
 
+	optional_policy(`postfix',`
+		postfix_read_config(system_crond_t)
+	')	
+
 	optional_policy(`prelink',`
 		prelink_read_cache(system_crond_t)
 		prelink_manage_log(system_crond_t)

refpolicy/policy/modules/services/cups.if

@@ -167,6 +167,25 @@ interface(`cups_read_log',`
 	allow $1 cupsd_log_t:file { getattr read };
 ')
 
+########################################
+## <summary>
+##	Write cups log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cups_write_log',`
+	gen_require(`
+		type cupsd_log_t;
+	')
+
+	logging_search_logs($1)
+	allow $1 cupsd_log_t:file write;
+')
+
 ########################################
 ## <summary>
 ##	Connect to ptal over an unix domain stream socket.

refpolicy/policy/modules/services/cups.te

@@ -1,5 +1,5 @@
 
-policy_module(cups,1.2.1)
+policy_module(cups,1.2.2)
 
 ########################################
 #

refpolicy/policy/modules/services/ssh.if

@@ -279,6 +279,8 @@ template(`ssh_per_userdomain_template',`
 
 	allow $1_ssh_agent_t { $1_ssh_agent_t $2 }:process signull;
 
+	allow $1_ssh_agent_t self:unix_stream_socket { connectto rw_socket_perms };
+
 	allow $1_ssh_t $1_ssh_agent_t:unix_stream_socket connectto;
 
 	# for ssh-add

refpolicy/policy/modules/services/ssh.te

@@ -1,5 +1,5 @@
 
-policy_module(ssh,1.2.0)
+policy_module(ssh,1.2.1)
 
 ########################################
 #

refpolicy/policy/modules/system/authlogin.te

@@ -1,5 +1,5 @@
 
-policy_module(authlogin,1.2.1)
+policy_module(authlogin,1.2.2)
 
 ########################################
 #
@@ -153,6 +153,8 @@ kernel_read_system_state(pam_console_t)
 dev_read_sysfs(pam_console_t)
 dev_getattr_apm_bios_dev(pam_console_t)
 dev_setattr_apm_bios_dev(pam_console_t)
+dev_getattr_dri_dev(pam_console_t)
+dev_setattr_dri_dev(pam_console_t)
 dev_getattr_framebuffer_dev(pam_console_t)
 dev_setattr_framebuffer_dev(pam_console_t)
 dev_getattr_misc_dev(pam_console_t)

refpolicy/policy/modules/system/selinuxutil.fc

@@ -4,13 +4,13 @@
 # /etc
 #
 /etc/selinux(/.*)?			gen_context(system_u:object_r:selinux_config_t,s0)
-
 /etc/selinux/([^/]*/)?contexts(/.*)?	gen_context(system_u:object_r:default_context_t,s0)
-
 /etc/selinux/([^/]*/)?contexts/files(/.*)? gen_context(system_u:object_r:file_context_t,s0)
-
 /etc/selinux/([^/]*/)?policy(/.*)?	gen_context(system_u:object_r:policy_config_t,s15:c0.c255)
 /etc/selinux/([^/]*/)?seusers	--	gen_context(system_u:object_r:selinux_config_t,s15:c0.c255)
+/etc/selinux([^/]*/)?modules/(active|tmp|previous)(/.*)?     --	gen_context(system_u:object_r:semanage_store_t,s0)
+/etc/selinux([^/]*/)?modules/semanage.read.LOCK    --	gen_context(system_u:object_r:semanage_read_lock_t,s0)
+/etc/selinux([^/]*/)?modules/semanage.trans.LOCK   --	gen_context(system_u:object_r:semanage_trans_lock_t,s0)
 /etc/selinux/([^/]*/)?users(/.*)?	--	gen_context(system_u:object_r:selinux_config_t,s15:c0.c255)
 
 #
@@ -35,6 +35,7 @@
 /usr/sbin/load_policy		--	gen_context(system_u:object_r:load_policy_exec_t,s0)
 /usr/sbin/run_init		--	gen_context(system_u:object_r:run_init_exec_t,s0)
 /usr/sbin/setfiles.*		--	gen_context(system_u:object_r:setfiles_exec_t,s0)
+/usr/sbin/semodule		--	gen_context(system_u:object_r:semanage_exec_t,s0)
 
 ifdef(`distro_debian', `
 /usr/share/selinux(/.*)?		gen_context(system_u:object_r:policy_src_t,s0)

refpolicy/policy/modules/system/selinuxutil.if

@@ -778,3 +778,124 @@ interface(`seutil_manage_src_policy',`
 	allow $1 policy_src_t:dir create_dir_perms;
 	allow $1 policy_src_t:file create_file_perms;
 ')
+
+########################################
+## <summary>
+##	Execute a domain transition to run semanage.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`seutil_domtrans_semanage',`
+	gen_require(`
+		type semanage_t, semanage_exec_t;
+	')
+
+	files_search_usr($1)
+	corecmd_search_bin($1)
+	domain_auto_trans($1,semanage_exec_t,semanage_t)
+
+	allow $1 semanage_t:fd use;
+	allow semanage_t $1:fd use;
+	allow semanage_t $1:fifo_file rw_file_perms;
+	allow semanage_t $1:process sigchld;
+')
+
+########################################
+## <summary>
+##	Execute semanage in the semanage domain, and
+##	allow the specified role the semanage domain,
+##	and use the caller's terminal.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed the checkpolicy domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the terminal allow the semanage domain to use.
+##	</summary>
+## </param>
+#
+interface(`seutil_run_semanage',`
+	gen_require(`
+		type semanage_t;
+	')
+
+	seutil_domtrans_semanage($1)
+	role $2 types semanage_t;
+	allow semanage_t $3:chr_file rw_term_perms;
+')
+
+########################################
+## <summary>
+##	Full management of the semanage
+##	module store.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`seutil_manage_module_store',`
+	gen_require(`
+		type selinux_config_t, semanage_store_t;
+	')
+
+	files_search_etc($1)
+	allow $1 selinux_config_t:dir rw_dir_perms;
+	type_transition $1 selinux_config_t:dir semanage_store_t;
+
+	allow $1 semanage_store_t:dir create_dir_perms;
+	allow $1 semanage_store_t:file create_file_perms;
+')
+
+#######################################
+## <summary>
+##	Get read lock on module store
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`seutil_get_semanage_read_lock',`
+	gen_require(`
+		type selinux_config_t, semanage_read_lock_t;
+	')
+
+	files_search_etc($1)
+	allow $1 selinux_config_t:dir search_dir_perms;
+	allow $1 semanage_read_lock_t:file rw_file_perms;
+')
+
+#######################################
+## <summary>
+##	Get trans lock on module store
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`seutil_get_semanage_trans_lock',`
+	gen_require(`
+		type selinux_config_t, semanage_trans_lock_t;
+	')
+
+	files_search_etc($1)
+	allow $1 selinux_config_t:dir search_dir_perms;
+	allow $1 semanage_trans_lock_t:file rw_file_perms;
+')

refpolicy/policy/modules/system/selinuxutil.te

@@ -1,5 +1,5 @@
 
-policy_module(selinuxutil,1.1.5)
+policy_module(selinuxutil,1.1.6)
 
 gen_require(`
 	bool secure_mode;
@@ -89,6 +89,22 @@ domain_type(run_init_t)
 domain_entry_file(run_init_t,run_init_exec_t)
 domain_system_change_exemption(run_init_t)
 
+type semanage_t;
+domain_type(semanage_t)
+
+type semanage_exec_t;
+domain_entry_file(semanage_t, semanage_exec_t)
+role system_r types semanage_t;
+
+type semanage_store_t;
+files_type(semanage_store_t)
+
+type semanage_read_lock_t;
+files_type(semanage_read_lock_t)
+
+type semanage_trans_lock_t; 
+files_type(semanage_trans_lock_t)
+
 type setfiles_t, can_relabelto_binary_policy;
 domain_obj_id_change_exemption(setfiles_t)
 domain_type(setfiles_t)
@@ -464,6 +480,47 @@ ifdef(`targeted_policy',`',`
 	')
 ') dnl end ifdef targeted policy
 
+########################################
+#
+# semodule local policy
+#
+
+allow semanage_t self:unix_stream_socket create_stream_socket_perms;
+
+allow semanage_t policy_config_t:file { read write };
+
+kernel_read_system_state(semanage_t)
+kernel_read_kernel_sysctls(semanage_t)
+
+corecmd_exec_bin(semanage_t)
+corecmd_exec_sbin(semanage_t)
+
+files_read_etc_files(semanage_t)
+files_read_usr_files(semanage_t)
+files_list_pids(semanage_t)
+
+mls_file_write_down(semanage_t)
+mls_rangetrans_target(semanage_t)
+
+selinux_get_enforce_mode(semanage_t)
+
+term_use_all_terms(semanage_t)
+
+libs_use_ld_so(semanage_t)
+libs_use_shared_libs(semanage_t)
+libs_use_lib_files(semanage_t)
+
+seutil_search_default_contexts(semanage_t)
+seutil_rw_file_contexts(semanage_t)
+seutil_domtrans_setfiles(semanage_t)
+seutil_domtrans_loadpolicy(semanage_t)
+seutil_read_config(semanage_t)
+seutil_manage_bin_policy(semanage_t)
+seutil_use_newrole_fds(semanage_t)
+seutil_manage_module_store(semanage_t)
+seutil_get_semanage_trans_lock(semanage_t)
+seutil_get_semanage_read_lock(semanage_t)
+
 ########################################
 #
 # Setfiles local policy
@@ -525,12 +582,8 @@ logging_send_syslog_msg(setfiles_t)
 
 miscfiles_read_localization(setfiles_t)
 
+seutil_get_semanage_read_lock(setfiles_t)
+
 userdom_use_all_users_fds(setfiles_t)
 # for config files in a home directory
 userdom_read_all_users_home_content_files(setfiles_t)
-
-ifdef(`TODO',`
-# for upgrading glibc and other shared objects - without this the upgrade
-# scripts will put things in a state such that setfiles can not be run!
-allow setfiles_t lib_t:file { read execute };
-') dnl endif TODO

refpolicy/policy/modules/system/userdomain.if

@@ -145,6 +145,7 @@ template(`base_user_template',`
 	allow $1_t unpriv_userdomain:fd use;
 
 	kernel_read_kernel_sysctls($1_t)
+	kernel_read_net_sysctls($1_t)
 	kernel_dontaudit_list_unlabeled($1_t)
 	kernel_dontaudit_getattr_unlabeled_files($1_t)
 	kernel_dontaudit_getattr_unlabeled_symlinks($1_t)
@@ -414,6 +415,8 @@ template(`base_user_template',`
 	optional_policy(`rpm',`
 		files_getattr_var_lib_dirs($1_t)
 		files_search_var_lib($1_t)
+		rpm_read_db($1_t)
+		rpm_dontaudit_manage_db($1_t)
 	')
 
 	optional_policy(`samba',`
@@ -3944,6 +3947,8 @@ interface(`userdom_manage_generic_user_home_content_dirs',`
 		type user_home_t;
 	')
 
+	files_search_home($1)
+	allow $1 user_home_dir_t:dir search_dir_perms;
 	allow $1 user_home_t:dir create_dir_perms;
 ')
 
@@ -3963,6 +3968,8 @@ interface(`userdom_manage_generic_user_home_content_files',`
 		type user_home_t;
 	')
 
+	files_search_home($1)
+	allow $1 user_home_dir_t:dir search_dir_perms;
 	allow $1 user_home_t:dir rw_dir_perms;
 	allow $1 user_home_t:file create_file_perms;
 ')
@@ -3983,6 +3990,8 @@ interface(`userdom_manage_generic_user_home_content_symlinks',`
 		type user_home_t;
 	')
 
+	files_search_home($1)
+	allow $1 user_home_dir_t:dir search_dir_perms;
 	allow $1 user_home_t:dir rw_dir_perms;
 	allow $1 user_home_t:lnk_file create_lnk_perms;
 ')
@@ -4003,6 +4012,8 @@ interface(`userdom_manage_generic_user_home_content_pipes',`
 		type user_home_t;
 	')
 
+	files_search_home($1)
+	allow $1 user_home_dir_t:dir search_dir_perms;
 	allow $1 user_home_t:dir rw_dir_perms;
 	allow $1 user_home_t:fifo_file create_file_perms;
 ')
@@ -4023,6 +4034,8 @@ interface(`userdom_manage_generic_user_home_content_sockets',`
 		type user_home_t;
 	')
 
+	files_search_home($1)
+	allow $1 user_home_dir_t:dir search_dir_perms;
 	allow $1 user_home_t:dir rw_dir_perms;
 	allow $1 user_home_t:sock_file create_file_perms;
 ')

refpolicy/policy/modules/system/userdomain.te

@@ -1,5 +1,5 @@
 
-policy_module(userdomain,1.2.8)
+policy_module(userdomain,1.2.9)
 
 gen_require(`
 	role sysadm_r, staff_r, user_r;
@@ -70,12 +70,12 @@ ifdef(`targeted_policy',`
 	unconfined_alias_domain(sysadm_t)
 
 	# User home directory type.
-	type user_home_t alias { staff_home_t sysadm_home_t }, home_type;
+	type user_home_t alias { staff_home_t sysadm_home_t }, home_type, user_home_type;
 	files_type(user_home_t)
 	files_associate_tmp(user_home_t)
 	fs_associate_tmpfs(user_home_t)
 
-	type user_home_dir_t alias { staff_home_dir_t sysadm_home_dir_t }, home_dir_type, home_type;
+	type user_home_dir_t alias { staff_home_dir_t sysadm_home_dir_t }, home_dir_type, home_type, user_home_dir_type;
 	files_type(user_home_dir_t)
 	files_associate_tmp(user_home_dir_t)
 	fs_associate_tmpfs(user_home_dir_t)
@@ -363,6 +363,7 @@ ifdef(`targeted_policy',`
 			seutil_manage_bin_policy(secadm_t)
 			seutil_run_checkpolicy(secadm_t,secadm_r,admin_terminal)
 			seutil_run_loadpolicy(secadm_t,secadm_r,admin_terminal)
+			seutil_run_semanage(secadm_t,secadm_r,admin_terminal)
 			seutil_run_setfiles(secadm_t,secadm_r,admin_terminal)
 			seutil_run_restorecon(secadm_t,secadm_r,admin_terminal)
 		', `
@@ -373,6 +374,7 @@ ifdef(`targeted_policy',`
 			seutil_manage_bin_policy(sysadm_t)
 			seutil_run_checkpolicy(sysadm_t,sysadm_r,admin_terminal)
 			seutil_run_loadpolicy(sysadm_t,sysadm_r,admin_terminal)
+			seutil_run_semanage(sysadm_t,sysadm_r,admin_terminal)
 			seutil_run_setfiles(sysadm_t,sysadm_r,admin_terminal)
 		')
 	')