rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

firstboot is leaking a netlink_route socket into iptables. We need to dontaudit

Browse Source 
tmpfs_t/devpts_t files can be stored on device_t file system
unconfined_mono_t can pass file descriptors to chrome_sandbox, so need transition from all unoconfined users types
Hald can connect to user processes over streams
xdm_t now changes the brightness level on the system
mdadm needs to manage hugetlbfs filesystems
This commit is contained in:
Dan Walsh 2010-09-01 09:47:50 -04:00
parent c6fa935fd5
commit 03527520de
8 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
policy/modules/admin/firstboot.te
View File

@ -102,6 +102,10 @@ optional_policy(`
')
')
optional_policy(`
iptables_domtrans(firstboot_t)
')
optional_policy(`
nis_use_ypbind(firstboot_t)
')

2
policy/modules/kernel/devices.fc
View File

@ -159,6 +159,8 @@ ifdef(`distro_suse', `
/dev/mvideo/.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
/dev/hugepages(/.*)? <<none>>
/dev/mqueue(/.*)? <<none>>
/dev/pts(/.*)? <<none>>
/dev/s(ou)?nd/.* -c gen_context(system_u:object_r:sound_device_t,s0)

1
policy/modules/kernel/filesystem.te
View File

@ -185,6 +185,7 @@ fs_type(tmpfs_t)
files_type(tmpfs_t)
files_mountpoint(tmpfs_t)
files_poly_parent(tmpfs_t)
dev_associate(tmpfs_t)
# Use a transition SID based on the allocating task SID and the
# filesystem SID to label inodes in the following filesystem types,

1
policy/modules/kernel/terminal.te
View File

@ -29,6 +29,7 @@ files_mountpoint(devpts_t)
fs_associate_tmpfs(devpts_t)
fs_type(devpts_t)
fs_use_trans devpts gen_context(system_u:object_r:devpts_t,s0);
dev_associate(devpts_t)
#
# devtty_t is the type of /dev/tty.

2
policy/modules/roles/unconfineduser.te
View File

@ -226,7 +226,7 @@ optional_policy(`
')
optional_policy(`
chrome_role(unconfined_r, unconfined_t)
chrome_role(unconfined_r, unconfined_usertype)
')
optional_policy(`

1
policy/modules/services/hal.te
View File

@ -225,6 +225,7 @@ sysnet_signal_dhcpc(hald_t)
userdom_dontaudit_use_unpriv_user_fds(hald_t)
userdom_dontaudit_search_user_home_dirs(hald_t)
userdom_stream_connect(hald_t)
netutils_domtrans(hald_t)

2
policy/modules/services/xserver.te
View File

@ -545,7 +545,7 @@ corenet_dontaudit_tcp_bind_all_ports(xdm_t)
dev_rwx_zero(xdm_t)
dev_read_rand(xdm_t)
dev_read_sysfs(xdm_t)
dev_rw_sysfs(xdm_t)
dev_getattr_framebuffer_dev(xdm_t)
dev_setattr_framebuffer_dev(xdm_t)
dev_getattr_mouse_dev(xdm_t)

1
policy/modules/system/fstools.te
View File

@ -120,6 +120,7 @@ fs_getattr_tmpfs_dirs(fsadm_t)
fs_read_tmpfs_symlinks(fsadm_t)
fs_manage_nfs_files(fsadm_t)
fs_manage_cifs_files(fsadm_t)
fs_rw_hugetlbfs_files(fsadm_t)
# Recreate /mnt/cdrom.
files_manage_mnt_dirs(fsadm_t)
# for tune2fs