rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Latest fixes

Browse Source
This commit is contained in:
Dan Walsh 2010-08-26 20:30:04 -04:00
parent 9561b0ab08
commit 08e567dc56
13 changed files with 19 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
policy/modules/admin/alsa.fc
View File

@ -2,7 +2,7 @@ HOME_DIR/\.asoundrc -- gen_context(system_u:object_r:alsa_home_t,s0)
/bin/alsaunmute -- gen_context(system_u:object_r:alsa_exec_t,s0)
/etc/alsa/asound\.state -- gen_context(system_u:object_r:alsa_etc_rw_t,s0)
/etc/alsa/asound\.state -- gen_context(system_u:object_r:alsa_etc_rw_t,s0)
/etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0)
/etc/asound(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0)
/etc/asound\.state -- gen_context(system_u:object_r:alsa_etc_rw_t,s0)

1
policy/modules/admin/sectoolm.te
View File

@ -84,7 +84,6 @@ logging_send_syslog_msg(sectoolm_t)
sysnet_domtrans_ifconfig(sectoolm_t)
userdom_manage_user_tmp_sockets(sectoolm_t)
userdom_write_user_tmp_sockets(sectoolm_t)
optional_policy(`
mount_exec(sectoolm_t)

1
policy/modules/kernel/filesystem.fc
View File

@ -1,3 +1,4 @@
/dev/shm -d gen_context(system_u:object_r:tmpfs_t,s0)
/cgroup(/.*)? gen_context(system_u:object_r:cgroup_t,s0)
/sys/fs/cgroup(/.*)? gen_context(system_u:object_r:cgroup_t,s0)

2
policy/modules/services/clamav.te
View File

@ -90,7 +90,7 @@ manage_files_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t)
logging_log_filetrans(clamd_t, clamd_var_log_t, { dir file })
# pid file
manage_dirs_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t)
manage_dirs_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t)
manage_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t)
manage_sock_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t)
files_pid_filetrans(clamd_t, clamd_var_run_t, { sock_file file dir })

7
policy/modules/services/cobbler.if
View File

@ -148,7 +148,7 @@ interface(`cobbler_manage_lib_files',`
########################################
## <summary>
## Read and write Cobbler log files.
## dontaudit read and write Cobbler log files.
## </summary>
## <param name="domain">
## <summary>
@ -156,13 +156,12 @@ interface(`cobbler_manage_lib_files',`
## </summary>
## </param>
#
interface(`cobbler_rw_log',`
interface(`cobbler_dontaudit_rw_log',`
gen_require(`
type cobbler_var_log_t;
')
rw_files_pattern($1, cobbler_var_log_t, cobbler_var_log_t)
logging_search_logs($1)
dontaudit $1 cobbler_var_log_t:file rw_inherited_files_perms;
')
########################################

2
policy/modules/services/devicekit.te
View File

@ -241,6 +241,8 @@ auth_use_nsswitch(devicekit_power_t)
miscfiles_read_localization(devicekit_power_t)
modutils_domtrans_insmod(devicekit_power_t)
sysnet_read_config(devicekit_power_t)
sysnet_domtrans_ifconfig(devicekit_power_t)

3
policy/modules/services/dhcp.te
View File

@ -111,8 +111,7 @@ optional_policy(`
')
optional_policy(`
# Should we dontaudit or not?
cobbler_rw_log(dhcpd_t)
cobbler_dontaudit_rw_log(dhcpd_t)
')
optional_policy(`

2
policy/modules/services/hddtemp.fc
View File

@ -1,3 +1,5 @@
/etc/rc\.d/init\.d/hddtemp -- gen_context(system_u:object_r:hddtemp_initrc_exec_t,s0)
/etc/sysconfig/hddtemp -- gen_context(system_u:object_r:hddtemp_etc_t,s0)
/usr/sbin/hddtemp -- gen_context(system_u:object_r:hddtemp_exec_t,s0)

2
policy/modules/services/kerberos.te
View File

@ -152,6 +152,7 @@ selinux_validate_context(kadmind_t)
logging_send_syslog_msg(kadmind_t)
miscfiles_read_certs(kadmind_t)
miscfiles_read_localization(kadmind_t)
seutil_read_file_contexts(kadmind_t)
@ -251,6 +252,7 @@ selinux_validate_context(krb5kdc_t)
logging_send_syslog_msg(krb5kdc_t)
miscfiles_read_certs(krb5kdc_t)
miscfiles_read_localization(krb5kdc_t)
seutil_read_file_contexts(krb5kdc_t)

2
policy/modules/services/ldap.fc
View File

@ -17,4 +17,4 @@ ifdef(`distro_debian',`
/var/run/openldap(/.*)? gen_context(system_u:object_r:slapd_var_run_t,s0)
/var/run/slapd\.args -- gen_context(system_u:object_r:slapd_var_run_t,s0)
/var/run/slapd\.pid -- gen_context(system_u:object_r:slapd_var_run_t,s0)
#/var/run/slapd.* -s gen_context(system_u:object_r:slapd_var_run_t,s0)
/var/run/slapd.* -s gen_context(system_u:object_r:slapd_var_run_t,s0)

1
policy/modules/services/virt.fc
View File

@ -1,3 +1,4 @@
HOME_DIR/.libvirt(/.*)? gen_context(system_u:object_r:virt_content_t,s0)
HOME_DIR/.virtinst(/.*)? gen_context(system_u:object_r:virt_content_t,s0)
HOME_DIR/VirtualMachines(/.*)? gen_context(system_u:object_r:virt_image_t,s0)
HOME_DIR/VirtualMachines/isos(/.*)? gen_context(system_u:object_r:virt_content_t,s0)

1
policy/modules/system/authlogin.fc
View File

@ -28,6 +28,7 @@ ifdef(`distro_gentoo', `
/var/db/shadow.* -- gen_context(system_u:object_r:shadow_t,s0)
/var/run/user(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
/var/lib/abl(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
/var/lib/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0)

3
policy/modules/system/init.te
View File

@ -220,6 +220,7 @@ storage_raw_rw_fixed_disk(init_t)
modutils_domtrans_insmod(init_t)
tunable_policy(`init_systemd',`
allow init_t self:unix_dgram_socket create_socket_perms;
allow init_t self:process { setsockcreate setfscreate };
allow init_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow init_t self:netlink_kobject_uevent_socket create_socket_perms;
@ -256,6 +257,8 @@ tunable_policy(`init_systemd',`
init_read_script_state(init_t)
seutil_read_file_contexts(init_t)
storage_getattr_removable_dev(init_t)
')
optional_policy(`