- Change to svirt to only access svirt_image_t
This commit is contained in:
Daniel J Walsh
parent
d4b8dcf968
commit
095146a89d
@ -125,9 +125,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/con
|
||||
+system_u:system_r:svirt_t:s0
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/virtual_image_context serefpolicy-3.6.9/config/appconfig-mcs/virtual_image_context
|
||||
--- nsaserefpolicy/config/appconfig-mcs/virtual_image_context 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ serefpolicy-3.6.9/config/appconfig-mcs/virtual_image_context 2009-03-12 13:35:00.000000000 -0400
|
||||
+++ serefpolicy-3.6.9/config/appconfig-mcs/virtual_image_context 2009-03-16 14:03:57.000000000 -0400
|
||||
@@ -0,0 +1 @@
|
||||
+system_u:object_r:virt_image_t:s0
|
||||
+system_u:object_r:svirt_image_t:s0
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts serefpolicy-3.6.9/config/appconfig-mcs/xguest_u_default_contexts
|
||||
--- nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ serefpolicy-3.6.9/config/appconfig-mcs/xguest_u_default_contexts 2009-03-12 13:35:00.000000000 -0400
|
||||
@ -338,18 +338,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mcs serefpolicy-3.6.9/policy/mcs
|
||||
--- nsaserefpolicy/policy/mcs 2009-02-03 22:50:50.000000000 -0500
|
||||
+++ serefpolicy-3.6.9/policy/mcs 2009-03-12 13:35:00.000000000 -0400
|
||||
@@ -67,7 +67,8 @@
|
||||
+++ serefpolicy-3.6.9/policy/mcs 2009-03-17 15:25:30.000000000 -0400
|
||||
@@ -67,7 +67,7 @@
|
||||
# Note that getattr on files is always permitted.
|
||||
#
|
||||
mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom }
|
||||
- ( h1 dom h2 );
|
||||
+ ((( h1 dom h2 ) or ( t1 == mlsfilewrite ))
|
||||
+ and ((t1 != virtualseparateddomain) or (t2 != virtual_image_type) or (h1 == h2)));
|
||||
+ (( h1 dom h2 ) or ( t1 == mlsfilewrite ));
|
||||
|
||||
mlsconstrain dir { create getattr setattr read write link unlink rename search add_name remove_name reparent rmdir lock ioctl }
|
||||
(( h1 dom h2 ) or ( t2 == domain ) or ( t1 == mlsfileread ));
|
||||
@@ -75,19 +76,22 @@
|
||||
@@ -75,7 +75,7 @@
|
||||
# New filesystem object labels must be dominated by the relabeling subject
|
||||
# clearance, also the objects are single-level.
|
||||
mlsconstrain file { create relabelto }
|
||||
@ -358,12 +357,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
# At this time we do not restrict "ps" type operations via MCS. This
|
||||
# will probably change in future.
|
||||
mlsconstrain file { read }
|
||||
- (( h1 dom h2 ) or ( t2 == domain ) or ( t1 == mlsfileread ));
|
||||
+ ((( h1 dom h2 ) or ( t1 == mlsfileread ))
|
||||
+ and ((t1 != virtualseparateddomain) or (t2 != virtual_image_type) or (h1 == h2)));
|
||||
+# ((( h1 dom h2 ) or ( t2 == domain ) or ( t1 == mlsfileread ))
|
||||
+# and ((t1 != virtualseparateddomain) or (t2 != virtual_image_type) or (h1 == h2)));
|
||||
@@ -84,10 +84,10 @@
|
||||
|
||||
# new file labels must be dominated by the relabeling subject clearance
|
||||
mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }
|
||||
@ -3383,8 +3377,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+/usr/bin/pulseaudio -- gen_context(system_u:object_r:pulseaudio_exec_t,s0)
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.if serefpolicy-3.6.9/policy/modules/apps/pulseaudio.if
|
||||
--- nsaserefpolicy/policy/modules/apps/pulseaudio.if 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ serefpolicy-3.6.9/policy/modules/apps/pulseaudio.if 2009-03-12 13:35:00.000000000 -0400
|
||||
@@ -0,0 +1,86 @@
|
||||
+++ serefpolicy-3.6.9/policy/modules/apps/pulseaudio.if 2009-03-17 14:36:39.000000000 -0400
|
||||
@@ -0,0 +1,105 @@
|
||||
+
|
||||
+## <summary>policy for pulseaudio</summary>
|
||||
+
|
||||
@ -3435,6 +3429,24 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Execute a pulseaudio in the current domain
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed to transition.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+interface(`pulseaudio_exec',`
|
||||
+ gen_require(`
|
||||
+ type pulseaudio_exec_t;
|
||||
+ ')
|
||||
+
|
||||
+ can_exec($1,pulseaudio_exec_t)
|
||||
+')
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Role access for pulseaudio
|
||||
+## </summary>
|
||||
+## <param name="role">
|
||||
@ -3471,10 +3483,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+ userdom_manage_tmp_role($1, pulseaudio_t)
|
||||
+ userdom_manage_tmpfs_role($1, pulseaudio_t)
|
||||
+')
|
||||
+
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.9/policy/modules/apps/pulseaudio.te
|
||||
--- nsaserefpolicy/policy/modules/apps/pulseaudio.te 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ serefpolicy-3.6.9/policy/modules/apps/pulseaudio.te 2009-03-12 13:35:00.000000000 -0400
|
||||
@@ -0,0 +1,88 @@
|
||||
+++ serefpolicy-3.6.9/policy/modules/apps/pulseaudio.te 2009-03-17 14:30:29.000000000 -0400
|
||||
@@ -0,0 +1,97 @@
|
||||
+policy_module(pulseaudio,1.0.0)
|
||||
+
|
||||
+########################################
|
||||
@ -3514,6 +3527,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+dev_read_sysfs(pulseaudio_t)
|
||||
+dev_read_urand(pulseaudio_t)
|
||||
+
|
||||
+kernel_read_kernel_sysctls(pulseaudio_t)
|
||||
+
|
||||
+files_read_etc_files(pulseaudio_t)
|
||||
+files_read_usr_files(pulseaudio_t)
|
||||
+
|
||||
@ -3547,6 +3562,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ polkit_domtrans_auth(pulseaudio_t)
|
||||
+ polkit_read_lib(pulseaudio_t)
|
||||
+ polkit_read_reload(pulseaudio_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ udev_read_db(pulseaudio_t)
|
||||
+')
|
||||
+
|
||||
@ -3554,6 +3575,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+ xserver_common_app(pulseaudio_t)
|
||||
+ xserver_read_xdm_pid(pulseaudio_t)
|
||||
+ xserver_stream_connect(pulseaudio_t)
|
||||
+ xserver_manage_xdm_tmp_files(pulseaudio_t)
|
||||
+')
|
||||
+
|
||||
+tunable_policy(`pulseaudio_network',`
|
||||
@ -5199,9 +5221,32 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
')
|
||||
|
||||
########################################
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.6.9/policy/modules/kernel/filesystem.te
|
||||
--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2009-03-04 15:43:10.000000000 -0500
|
||||
+++ serefpolicy-3.6.9/policy/modules/kernel/filesystem.te 2009-03-17 14:10:23.000000000 -0400
|
||||
@@ -206,6 +206,10 @@
|
||||
genfscon ntfs-3g / gen_context(system_u:object_r:dosfs_t,s0)
|
||||
genfscon ntfs / gen_context(system_u:object_r:dosfs_t,s0)
|
||||
genfscon vfat / gen_context(system_u:object_r:dosfs_t,s0)
|
||||
+# Labeling dosfs_t since these are removable file systems with the i
|
||||
+# same security properties as dosfs_t
|
||||
+genfscon hfs / gen_context(system_u:object_r:dosfs_t,s0)
|
||||
+genfscon hfsplus / gen_context(system_u:object_r:dosfs_t,s0)
|
||||
|
||||
type fusefs_t;
|
||||
fs_noxattr_type(fusefs_t)
|
||||
@@ -244,8 +248,6 @@
|
||||
genfscon afs / gen_context(system_u:object_r:nfs_t,s0)
|
||||
genfscon dazukofs / gen_context(system_u:object_r:nfs_t,s0)
|
||||
genfscon coda / gen_context(system_u:object_r:nfs_t,s0)
|
||||
-genfscon hfs / gen_context(system_u:object_r:nfs_t,s0)
|
||||
-genfscon hfsplus / gen_context(system_u:object_r:nfs_t,s0)
|
||||
genfscon lustre / gen_context(system_u:object_r:nfs_t,s0)
|
||||
genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0)
|
||||
genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0)
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.6.9/policy/modules/kernel/kernel.if
|
||||
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2009-01-05 15:39:38.000000000 -0500
|
||||
+++ serefpolicy-3.6.9/policy/modules/kernel/kernel.if 2009-03-12 13:35:00.000000000 -0400
|
||||
+++ serefpolicy-3.6.9/policy/modules/kernel/kernel.if 2009-03-17 14:28:38.000000000 -0400
|
||||
@@ -1197,6 +1197,26 @@
|
||||
')
|
||||
|
||||
@ -10991,8 +11036,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.6.9/policy/modules/services/devicekit.te
|
||||
--- nsaserefpolicy/policy/modules/services/devicekit.te 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ serefpolicy-3.6.9/policy/modules/services/devicekit.te 2009-03-16 11:44:53.000000000 -0400
|
||||
@@ -0,0 +1,202 @@
|
||||
+++ serefpolicy-3.6.9/policy/modules/services/devicekit.te 2009-03-17 15:39:17.000000000 -0400
|
||||
@@ -0,0 +1,209 @@
|
||||
+policy_module(devicekit,1.0.0)
|
||||
+
|
||||
+########################################
|
||||
@ -11053,7 +11098,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+#
|
||||
+# DeviceKit-Power local policy
|
||||
+#
|
||||
+allow devicekit_power_t self:capability { sys_tty_config dac_override };
|
||||
+allow devicekit_power_t self:capability { dac_override sys_tty_config sys_nice };
|
||||
+allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
|
||||
+allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
|
||||
+
|
||||
@ -11163,12 +11208,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+
|
||||
+fs_list_inotifyfs(devicekit_disk_t)
|
||||
+
|
||||
+storage_getattr_fixed_disk_dev(devicekit_disk_t)
|
||||
+storage_raw_read_fixed_disk(devicekit_disk_t)
|
||||
+storage_raw_read_removable_device(devicekit_disk_t)
|
||||
+storage_raw_write_removable_device(devicekit_disk_t)
|
||||
+
|
||||
+term_use_all_terms(devicekit_disk_t)
|
||||
+
|
||||
+auth_use_nsswitch(devicekit_disk_t)
|
||||
+
|
||||
+miscfiles_read_localization(devicekit_disk_t)
|
||||
+
|
||||
+userdom_read_all_users_state(devicekit_disk_t)
|
||||
+
|
||||
+optional_policy(`
|
||||
@ -11176,6 +11225,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ lvm_domtrans(devicekit_disk_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ polkit_domtrans_auth(devicekit_disk_t)
|
||||
+ polkit_read_lib(devicekit_disk_t)
|
||||
+ polkit_read_reload(devicekit_disk_t)
|
||||
@ -11194,7 +11247,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+ consolekit_dbus_chat(devicekit_disk_t)
|
||||
+ ')
|
||||
+')
|
||||
+
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.if serefpolicy-3.6.9/policy/modules/services/dhcp.if
|
||||
--- nsaserefpolicy/policy/modules/services/dhcp.if 2008-11-18 18:57:20.000000000 -0500
|
||||
+++ serefpolicy-3.6.9/policy/modules/services/dhcp.if 2009-03-12 13:35:00.000000000 -0400
|
||||
@ -21566,7 +21618,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+/var/run/libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_var_run_t,s0)
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.6.9/policy/modules/services/virt.if
|
||||
--- nsaserefpolicy/policy/modules/services/virt.if 2009-01-05 15:39:43.000000000 -0500
|
||||
+++ serefpolicy-3.6.9/policy/modules/services/virt.if 2009-03-12 13:35:00.000000000 -0400
|
||||
+++ serefpolicy-3.6.9/policy/modules/services/virt.if 2009-03-17 10:31:34.000000000 -0400
|
||||
@@ -2,28 +2,6 @@
|
||||
|
||||
########################################
|
||||
@ -21714,7 +21766,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.9/policy/modules/services/virt.te
|
||||
--- nsaserefpolicy/policy/modules/services/virt.te 2009-01-19 11:06:49.000000000 -0500
|
||||
+++ serefpolicy-3.6.9/policy/modules/services/virt.te 2009-03-12 14:17:50.000000000 -0400
|
||||
+++ serefpolicy-3.6.9/policy/modules/services/virt.te 2009-03-17 10:32:36.000000000 -0400
|
||||
@@ -8,20 +8,18 @@
|
||||
|
||||
## <desc>
|
||||
@ -21796,19 +21848,20 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
read_files_pattern(virtd_t, virt_etc_t, virt_etc_t)
|
||||
read_lnk_files_pattern(virtd_t, virt_etc_t, virt_etc_t)
|
||||
|
||||
@@ -67,7 +92,10 @@
|
||||
@@ -67,7 +92,11 @@
|
||||
manage_lnk_files_pattern(virtd_t, virt_etc_rw_t, virt_etc_rw_t)
|
||||
filetrans_pattern(virtd_t, virt_etc_t, virt_etc_rw_t, dir)
|
||||
|
||||
-manage_files_pattern(virtd_t, virt_image_type, virt_image_type)
|
||||
+virtual_manage_image(virtd_t)
|
||||
+virtual_manage_relabel(virtd_t)
|
||||
+
|
||||
+manage_dirs_pattern(virtd_t, virt_content_t, virt_content_t)
|
||||
+manage_files_pattern(virtd_t, virt_content_t, virt_content_t)
|
||||
|
||||
manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t)
|
||||
manage_files_pattern(virtd_t, virt_log_t, virt_log_t)
|
||||
@@ -86,6 +114,7 @@
|
||||
@@ -86,6 +115,7 @@
|
||||
kernel_read_network_state(virtd_t)
|
||||
kernel_rw_net_sysctls(virtd_t)
|
||||
kernel_load_module(virtd_t)
|
||||
@ -21816,7 +21869,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
corecmd_exec_bin(virtd_t)
|
||||
corecmd_exec_shell(virtd_t)
|
||||
@@ -96,7 +125,7 @@
|
||||
@@ -96,7 +126,7 @@
|
||||
corenet_tcp_sendrecv_generic_node(virtd_t)
|
||||
corenet_tcp_sendrecv_all_ports(virtd_t)
|
||||
corenet_tcp_bind_generic_node(virtd_t)
|
||||
@ -21825,10 +21878,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
corenet_tcp_bind_vnc_port(virtd_t)
|
||||
corenet_tcp_connect_vnc_port(virtd_t)
|
||||
corenet_tcp_connect_soundd_port(virtd_t)
|
||||
@@ -104,21 +133,37 @@
|
||||
@@ -104,21 +134,38 @@
|
||||
|
||||
dev_read_sysfs(virtd_t)
|
||||
dev_read_rand(virtd_t)
|
||||
+dev_read_kvm(virtd_t)
|
||||
+dev_getattr_all_chr_files(virtd_t)
|
||||
|
||||
# Init script handling
|
||||
@ -21864,7 +21918,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
term_getattr_pty_fs(virtd_t)
|
||||
term_use_ptmx(virtd_t)
|
||||
|
||||
@@ -129,6 +174,11 @@
|
||||
@@ -129,6 +176,11 @@
|
||||
|
||||
logging_send_syslog_msg(virtd_t)
|
||||
|
||||
@ -21876,7 +21930,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
userdom_read_all_users_state(virtd_t)
|
||||
|
||||
tunable_policy(`virt_use_nfs',`
|
||||
@@ -167,22 +217,34 @@
|
||||
@@ -167,22 +219,34 @@
|
||||
dnsmasq_domtrans(virtd_t)
|
||||
dnsmasq_signal(virtd_t)
|
||||
dnsmasq_kill(virtd_t)
|
||||
@ -21895,9 +21949,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+optional_policy(`
|
||||
+ kerberos_keytab_template(virtd, virtd_t)
|
||||
+')
|
||||
|
||||
optional_policy(`
|
||||
- qemu_domtrans(virtd_t)
|
||||
+
|
||||
+optional_policy(`
|
||||
+ lvm_domtrans(virtd_t)
|
||||
+')
|
||||
+
|
||||
@ -21906,8 +21959,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+ polkit_domtrans_resolve(virtd_t)
|
||||
+ polkit_read_lib(virtd_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
|
||||
optional_policy(`
|
||||
- qemu_domtrans(virtd_t)
|
||||
+ qemu_spec_domtrans(virtd_t, svirt_t)
|
||||
qemu_read_state(virtd_t)
|
||||
qemu_signal(virtd_t)
|
||||
@ -21916,7 +21970,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -198,5 +260,73 @@
|
||||
@@ -198,5 +262,73 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -21949,6 +22003,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+manage_lnk_files_pattern(svirt_t, svirt_var_run_t, svirt_var_run_t)
|
||||
+files_pid_filetrans(svirt_t, svirt_var_run_t, { dir file })
|
||||
+
|
||||
+allow svirt_t svirt_image_t:dir search_dir_perms;
|
||||
+manage_dirs_pattern(svirt_t, svirt_image_t, svirt_image_t)
|
||||
+manage_files_pattern(svirt_t, svirt_image_t, svirt_image_t)
|
||||
+
|
||||
+storage_raw_write_removable_device(svirt_t)
|
||||
+storage_raw_read_removable_device(svirt_t)
|
||||
+
|
||||
@ -21981,10 +22039,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ virt_manage_images(svirt_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ xen_rw_image_files(svirt_t)
|
||||
+')
|
||||
+
|
||||
@ -22085,7 +22139,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.6.9/policy/modules/services/xserver.if
|
||||
--- nsaserefpolicy/policy/modules/services/xserver.if 2009-01-05 15:39:43.000000000 -0500
|
||||
+++ serefpolicy-3.6.9/policy/modules/services/xserver.if 2009-03-12 13:35:00.000000000 -0400
|
||||
+++ serefpolicy-3.6.9/policy/modules/services/xserver.if 2009-03-17 14:33:04.000000000 -0400
|
||||
@@ -90,7 +90,7 @@
|
||||
allow $2 xauth_home_t:file manage_file_perms;
|
||||
allow $2 xauth_home_t:file { relabelfrom relabelto };
|
||||
@ -22095,10 +22149,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
##############################
|
||||
#
|
||||
@@ -116,6 +116,7 @@
|
||||
@@ -115,7 +115,8 @@
|
||||
# write: gnome-settings-daemon RANDR:SelectInput
|
||||
# setattr: gnome-settings-daemon X11:GrabKey
|
||||
# manage: metacity X11:ChangeWindowAttributes
|
||||
allow $2 rootwindow_t:x_drawable { read write manage setattr };
|
||||
- allow $2 rootwindow_t:x_drawable { read write manage setattr };
|
||||
+ allow $2 rootwindow_t:x_drawable { read write manage get_property getattr setattr };
|
||||
+ allow $2 $2:x_drawable all_x_drawable_perms;
|
||||
|
||||
# setattr: metacity X11:InstallColormap
|
||||
@ -22259,10 +22315,29 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -779,6 +799,31 @@
|
||||
@@ -779,6 +799,50 @@
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
+## Read XDM var lib files.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed access.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+interface(`xserver_manage_xdm_lib_files',`
|
||||
+ gen_require(`
|
||||
+ type xdm_var_lib_t;
|
||||
+ ')
|
||||
+
|
||||
+ manage_files_pattern($1, xdm_var_lib_t, xdm_var_lib_t)
|
||||
+ read_lnk_files_pattern($1, xdm_var_lib_t, xdm_var_lib_t)
|
||||
+')
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Execute xsever in the xserver domain, and
|
||||
+## allow the specified role the xserver domain.
|
||||
+## </summary>
|
||||
@ -22291,7 +22366,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
## Make an X session script an entrypoint for the specified domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
@@ -872,6 +917,27 @@
|
||||
@@ -872,6 +936,27 @@
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
@ -22319,7 +22394,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
## Do not audit attempts to write the X server
|
||||
## log files.
|
||||
## </summary>
|
||||
@@ -1018,10 +1084,11 @@
|
||||
@@ -1018,10 +1103,11 @@
|
||||
#
|
||||
interface(`xserver_domtrans',`
|
||||
gen_require(`
|
||||
@ -22332,7 +22407,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
domtrans_pattern($1, xserver_exec_t, xserver_t)
|
||||
')
|
||||
|
||||
@@ -1159,6 +1226,275 @@
|
||||
@@ -1159,6 +1245,275 @@
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
@ -22608,7 +22683,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
## Interface to provide X object permissions on a given X server to
|
||||
## an X client domain. Gives the domain complete control over the
|
||||
## display.
|
||||
@@ -1172,7 +1508,102 @@
|
||||
@@ -1172,7 +1527,102 @@
|
||||
interface(`xserver_unconfined',`
|
||||
gen_require(`
|
||||
attribute xserver_unconfined_type;
|
||||
@ -22713,7 +22788,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.9/policy/modules/services/xserver.te
|
||||
--- nsaserefpolicy/policy/modules/services/xserver.te 2009-01-19 11:06:49.000000000 -0500
|
||||
+++ serefpolicy-3.6.9/policy/modules/services/xserver.te 2009-03-12 13:35:00.000000000 -0400
|
||||
+++ serefpolicy-3.6.9/policy/modules/services/xserver.te 2009-03-17 14:38:53.000000000 -0400
|
||||
@@ -34,6 +34,13 @@
|
||||
|
||||
## <desc>
|
||||
@ -22914,7 +22989,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
# Allow gdm to run gdm-binary
|
||||
can_exec(xdm_t, xdm_exec_t)
|
||||
@@ -329,6 +360,8 @@
|
||||
@@ -329,22 +360,38 @@
|
||||
manage_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
|
||||
manage_sock_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
|
||||
files_tmp_filetrans(xdm_t, xdm_tmp_t, { file dir sock_file })
|
||||
@ -22923,10 +22998,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
manage_dirs_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
|
||||
manage_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
|
||||
@@ -336,15 +369,30 @@
|
||||
manage_lnk_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
|
||||
manage_fifo_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
|
||||
manage_sock_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
|
||||
fs_tmpfs_filetrans(xdm_t, xdm_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
|
||||
-fs_tmpfs_filetrans(xdm_t, xdm_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
|
||||
+fs_getattr_all_fs(xdm_t)
|
||||
+fs_search_inotifyfs(xdm_t)
|
||||
+fs_read_noxattr_fs_files(xdm_t)
|
||||
@ -22956,7 +23031,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
allow xdm_t xserver_t:process signal;
|
||||
allow xdm_t xserver_t:unix_stream_socket connectto;
|
||||
@@ -358,6 +406,7 @@
|
||||
@@ -358,6 +405,7 @@
|
||||
allow xdm_t xserver_t:process { noatsecure siginh rlimitinh signal sigkill };
|
||||
|
||||
allow xdm_t xserver_t:shm rw_shm_perms;
|
||||
@ -22964,7 +23039,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
# connect to xdm xserver over stream socket
|
||||
stream_connect_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t,xserver_t)
|
||||
@@ -366,10 +415,14 @@
|
||||
@@ -366,10 +414,14 @@
|
||||
delete_files_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t)
|
||||
delete_sock_files_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t)
|
||||
|
||||
@ -22980,7 +23055,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
kernel_read_system_state(xdm_t)
|
||||
kernel_read_kernel_sysctls(xdm_t)
|
||||
@@ -389,11 +442,13 @@
|
||||
@@ -389,11 +441,13 @@
|
||||
corenet_udp_sendrecv_all_ports(xdm_t)
|
||||
corenet_tcp_bind_generic_node(xdm_t)
|
||||
corenet_udp_bind_generic_node(xdm_t)
|
||||
@ -22994,7 +23069,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
dev_read_rand(xdm_t)
|
||||
dev_read_sysfs(xdm_t)
|
||||
dev_getattr_framebuffer_dev(xdm_t)
|
||||
@@ -401,6 +456,7 @@
|
||||
@@ -401,6 +455,7 @@
|
||||
dev_getattr_mouse_dev(xdm_t)
|
||||
dev_setattr_mouse_dev(xdm_t)
|
||||
dev_rw_apm_bios(xdm_t)
|
||||
@ -23002,7 +23077,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
dev_setattr_apm_bios_dev(xdm_t)
|
||||
dev_rw_dri(xdm_t)
|
||||
dev_rw_agp(xdm_t)
|
||||
@@ -413,14 +469,17 @@
|
||||
@@ -413,14 +468,17 @@
|
||||
dev_setattr_video_dev(xdm_t)
|
||||
dev_getattr_scanner_dev(xdm_t)
|
||||
dev_setattr_scanner_dev(xdm_t)
|
||||
@ -23022,7 +23097,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
files_read_etc_files(xdm_t)
|
||||
files_read_var_files(xdm_t)
|
||||
@@ -431,9 +490,13 @@
|
||||
@@ -431,9 +489,13 @@
|
||||
files_read_usr_files(xdm_t)
|
||||
# Poweroff wants to create the /poweroff file when run from xdm
|
||||
files_create_boot_flag(xdm_t)
|
||||
@ -23036,7 +23111,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
storage_dontaudit_read_fixed_disk(xdm_t)
|
||||
storage_dontaudit_write_fixed_disk(xdm_t)
|
||||
@@ -442,6 +505,7 @@
|
||||
@@ -442,6 +504,7 @@
|
||||
storage_dontaudit_raw_write_removable_device(xdm_t)
|
||||
storage_dontaudit_setattr_removable_dev(xdm_t)
|
||||
storage_dontaudit_rw_scsi_generic(xdm_t)
|
||||
@ -23044,7 +23119,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
term_setattr_console(xdm_t)
|
||||
term_use_unallocated_ttys(xdm_t)
|
||||
@@ -450,6 +514,7 @@
|
||||
@@ -450,6 +513,7 @@
|
||||
auth_domtrans_pam_console(xdm_t)
|
||||
auth_manage_pam_pid(xdm_t)
|
||||
auth_manage_pam_console_data(xdm_t)
|
||||
@ -23052,7 +23127,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
auth_rw_faillog(xdm_t)
|
||||
auth_write_login_records(xdm_t)
|
||||
|
||||
@@ -460,10 +525,10 @@
|
||||
@@ -460,10 +524,10 @@
|
||||
|
||||
logging_read_generic_logs(xdm_t)
|
||||
|
||||
@ -23065,11 +23140,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
userdom_dontaudit_use_unpriv_user_fds(xdm_t)
|
||||
userdom_create_all_users_keys(xdm_t)
|
||||
@@ -472,6 +537,7 @@
|
||||
@@ -472,6 +536,8 @@
|
||||
# Search /proc for any user domain processes.
|
||||
userdom_read_all_users_state(xdm_t)
|
||||
userdom_signal_all_users(xdm_t)
|
||||
+userdom_manage_user_tmp_sockets(xdm_t)
|
||||
+userdom_manage_tmpfs_role(system_r, xdm_t)
|
||||
|
||||
xserver_rw_session(xdm_t,xdm_tmpfs_t)
|
||||
xserver_unconfined(xdm_t)
|
||||
@ -23138,7 +23214,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ pulseaudio_role(system_r, xdm_t)
|
||||
+ pulseaudio_exec(xdm_t)
|
||||
+')
|
||||
+
|
||||
+# On crash gdm execs gdb to dump stack
|
||||
@ -28022,7 +28098,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.9/policy/modules/system/userdomain.if
|
||||
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-01-19 11:07:34.000000000 -0500
|
||||
+++ serefpolicy-3.6.9/policy/modules/system/userdomain.if 2009-03-12 13:35:00.000000000 -0400
|
||||
+++ serefpolicy-3.6.9/policy/modules/system/userdomain.if 2009-03-17 14:38:03.000000000 -0400
|
||||
@@ -30,8 +30,9 @@
|
||||
')
|
||||
|
||||
@ -29962,8 +30038,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+# No application file contexts.
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virtual.if serefpolicy-3.6.9/policy/modules/system/virtual.if
|
||||
--- nsaserefpolicy/policy/modules/system/virtual.if 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ serefpolicy-3.6.9/policy/modules/system/virtual.if 2009-03-12 13:35:00.000000000 -0400
|
||||
@@ -0,0 +1,99 @@
|
||||
+++ serefpolicy-3.6.9/policy/modules/system/virtual.if 2009-03-17 15:49:05.000000000 -0400
|
||||
@@ -0,0 +1,118 @@
|
||||
+## <summary>Virtual machine emulator and virtualizer</summary>
|
||||
+
|
||||
+########################################
|
||||
@ -30055,7 +30131,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+#
|
||||
+interface(`virtual_manage_image',`
|
||||
+ gen_require(`
|
||||
+ type virtual_image_type;
|
||||
+ attribute virtual_image_type;
|
||||
+ ')
|
||||
+
|
||||
+ manage_dirs_pattern($1, virtual_image_type, virtual_image_type)
|
||||
@ -30063,6 +30139,25 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+ manage_lnk_files_pattern($1, virtual_image_type, virtual_image_type)
|
||||
+ rw_blk_files_pattern($1, virtual_image_type, virtual_image_type)
|
||||
+')
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Allow domain to relabel virt image files
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain to not audit.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+interface(`virtual_manage_relabel',`
|
||||
+ gen_require(`
|
||||
+ attribute virtual_image_type;
|
||||
+ ')
|
||||
+
|
||||
+ allow $1 virtual_image_type:file { relabelfrom relabelto };
|
||||
+')
|
||||
+
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virtual.te serefpolicy-3.6.9/policy/modules/system/virtual.te
|
||||
--- nsaserefpolicy/policy/modules/system/virtual.te 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ serefpolicy-3.6.9/policy/modules/system/virtual.te 2009-03-12 13:35:00.000000000 -0400
|
||||
|
||||
@ -20,7 +20,7 @@
|
||||
Summary: SELinux policy configuration
|
||||
Name: selinux-policy
|
||||
Version: 3.6.9
|
||||
Release: 2%{?dist}
|
||||
Release: 3%{?dist}
|
||||
License: GPLv2+
|
||||
Group: System Environment/Base
|
||||
Source: serefpolicy-%{version}.tgz
|
||||
@ -444,6 +444,9 @@ exit 0
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Tue Mar 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-3
|
||||
- Change to svirt to only access svirt_image_t
|
||||
|
||||
* Thu Mar 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-2
|
||||
- Fix libvirt policy
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user