rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Change to svirt to only access svirt_image_t

Browse Source
This commit is contained in:
Daniel J Walsh 2009-03-17 19:52:35 +00:00
parent d4b8dcf968
commit 095146a89d
2 changed files with 167 additions and 69 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

231
policy-20090105.patch
View File

@ -125,9 +125,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/con
+system_u:system_r:svirt_t:s0 +system_u:system_r:svirt_t:s0
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/virtual_image_context serefpolicy-3.6.9/config/appconfig-mcs/virtual_image_context diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/virtual_image_context serefpolicy-3.6.9/config/appconfig-mcs/virtual_image_context
--- nsaserefpolicy/config/appconfig-mcs/virtual_image_context 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/config/appconfig-mcs/virtual_image_context 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.9/config/appconfig-mcs/virtual_image_context 2009-03-12 13:35:00.000000000 -0400 +++ serefpolicy-3.6.9/config/appconfig-mcs/virtual_image_context 2009-03-16 14:03:57.000000000 -0400
@@ -0,0 +1 @@ @@ -0,0 +1 @@
+system_u:object_r:virt_image_t:s0 +system_u:object_r:svirt_image_t:s0
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts serefpolicy-3.6.9/config/appconfig-mcs/xguest_u_default_contexts diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts serefpolicy-3.6.9/config/appconfig-mcs/xguest_u_default_contexts
--- nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.9/config/appconfig-mcs/xguest_u_default_contexts 2009-03-12 13:35:00.000000000 -0400 +++ serefpolicy-3.6.9/config/appconfig-mcs/xguest_u_default_contexts 2009-03-12 13:35:00.000000000 -0400
@ -338,18 +338,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mcs serefpolicy-3.6.9/policy/mcs diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mcs serefpolicy-3.6.9/policy/mcs
--- nsaserefpolicy/policy/mcs 2009-02-03 22:50:50.000000000 -0500 --- nsaserefpolicy/policy/mcs 2009-02-03 22:50:50.000000000 -0500
+++ serefpolicy-3.6.9/policy/mcs 2009-03-12 13:35:00.000000000 -0400 +++ serefpolicy-3.6.9/policy/mcs 2009-03-17 15:25:30.000000000 -0400
@@ -67,7 +67,8 @@ @@ -67,7 +67,7 @@
# Note that getattr on files is always permitted. # Note that getattr on files is always permitted.
# #
mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom } mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom }
- ( h1 dom h2 ); - ( h1 dom h2 );
+ ((( h1 dom h2 ) or ( t1 == mlsfilewrite )) + (( h1 dom h2 ) or ( t1 == mlsfilewrite ));
+ and ((t1 != virtualseparateddomain) or (t2 != virtual_image_type) or (h1 == h2)));
mlsconstrain dir { create getattr setattr read write link unlink rename search add_name remove_name reparent rmdir lock ioctl } mlsconstrain dir { create getattr setattr read write link unlink rename search add_name remove_name reparent rmdir lock ioctl }
(( h1 dom h2 ) or ( t2 == domain ) or ( t1 == mlsfileread )); (( h1 dom h2 ) or ( t2 == domain ) or ( t1 == mlsfileread ));
@@ -75,19 +76,22 @@ @@ -75,7 +75,7 @@
# New filesystem object labels must be dominated by the relabeling subject # New filesystem object labels must be dominated by the relabeling subject
# clearance, also the objects are single-level. # clearance, also the objects are single-level.
mlsconstrain file { create relabelto } mlsconstrain file { create relabelto }
@ -358,12 +357,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# At this time we do not restrict "ps" type operations via MCS. This # At this time we do not restrict "ps" type operations via MCS. This
# will probably change in future. # will probably change in future.
mlsconstrain file { read } @@ -84,10 +84,10 @@
- (( h1 dom h2 ) or ( t2 == domain ) or ( t1 == mlsfileread ));
+ ((( h1 dom h2 ) or ( t1 == mlsfileread ))
+ and ((t1 != virtualseparateddomain) or (t2 != virtual_image_type) or (h1 == h2)));
+# ((( h1 dom h2 ) or ( t2 == domain ) or ( t1 == mlsfileread ))
+# and ((t1 != virtualseparateddomain) or (t2 != virtual_image_type) or (h1 == h2)));
# new file labels must be dominated by the relabeling subject clearance # new file labels must be dominated by the relabeling subject clearance
mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom } mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }
@ -3383,8 +3377,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/usr/bin/pulseaudio -- gen_context(system_u:object_r:pulseaudio_exec_t,s0) +/usr/bin/pulseaudio -- gen_context(system_u:object_r:pulseaudio_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.if serefpolicy-3.6.9/policy/modules/apps/pulseaudio.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.if serefpolicy-3.6.9/policy/modules/apps/pulseaudio.if
--- nsaserefpolicy/policy/modules/apps/pulseaudio.if 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/apps/pulseaudio.if 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.9/policy/modules/apps/pulseaudio.if 2009-03-12 13:35:00.000000000 -0400 +++ serefpolicy-3.6.9/policy/modules/apps/pulseaudio.if 2009-03-17 14:36:39.000000000 -0400
@@ -0,0 +1,86 @@ @@ -0,0 +1,105 @@
+ +
+## <summary>policy for pulseaudio</summary> +## <summary>policy for pulseaudio</summary>
+ +
@ -3435,6 +3429,24 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
+######################################## +########################################
+## <summary> +## <summary>
+## Execute a pulseaudio in the current domain
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`pulseaudio_exec',`
+ gen_require(`
+ type pulseaudio_exec_t;
+ ')
+
+ can_exec($1,pulseaudio_exec_t)
+')
+
+########################################
+## <summary>
+## Role access for pulseaudio +## Role access for pulseaudio
+## </summary> +## </summary>
+## <param name="role"> +## <param name="role">
@ -3471,10 +3483,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ userdom_manage_tmp_role($1, pulseaudio_t) + userdom_manage_tmp_role($1, pulseaudio_t)
+ userdom_manage_tmpfs_role($1, pulseaudio_t) + userdom_manage_tmpfs_role($1, pulseaudio_t)
+') +')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.9/policy/modules/apps/pulseaudio.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.9/policy/modules/apps/pulseaudio.te
--- nsaserefpolicy/policy/modules/apps/pulseaudio.te 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/apps/pulseaudio.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.9/policy/modules/apps/pulseaudio.te 2009-03-12 13:35:00.000000000 -0400 +++ serefpolicy-3.6.9/policy/modules/apps/pulseaudio.te 2009-03-17 14:30:29.000000000 -0400
@@ -0,0 +1,88 @@ @@ -0,0 +1,97 @@
+policy_module(pulseaudio,1.0.0) +policy_module(pulseaudio,1.0.0)
+ +
+######################################## +########################################
@ -3514,6 +3527,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+dev_read_sysfs(pulseaudio_t) +dev_read_sysfs(pulseaudio_t)
+dev_read_urand(pulseaudio_t) +dev_read_urand(pulseaudio_t)
+ +
+kernel_read_kernel_sysctls(pulseaudio_t)
+
+files_read_etc_files(pulseaudio_t) +files_read_etc_files(pulseaudio_t)
+files_read_usr_files(pulseaudio_t) +files_read_usr_files(pulseaudio_t)
+ +
@ -3547,6 +3562,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
+ +
+optional_policy(` +optional_policy(`
+ polkit_domtrans_auth(pulseaudio_t)
+ polkit_read_lib(pulseaudio_t)
+ polkit_read_reload(pulseaudio_t)
+')
+
+optional_policy(`
+ udev_read_db(pulseaudio_t) + udev_read_db(pulseaudio_t)
+') +')
+ +
@ -3554,6 +3575,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ xserver_common_app(pulseaudio_t) + xserver_common_app(pulseaudio_t)
+ xserver_read_xdm_pid(pulseaudio_t) + xserver_read_xdm_pid(pulseaudio_t)
+ xserver_stream_connect(pulseaudio_t) + xserver_stream_connect(pulseaudio_t)
+ xserver_manage_xdm_tmp_files(pulseaudio_t)
+') +')
+ +
+tunable_policy(`pulseaudio_network',` +tunable_policy(`pulseaudio_network',`
@ -5199,9 +5221,32 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.6.9/policy/modules/kernel/filesystem.te
--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2009-03-04 15:43:10.000000000 -0500
+++ serefpolicy-3.6.9/policy/modules/kernel/filesystem.te 2009-03-17 14:10:23.000000000 -0400
@@ -206,6 +206,10 @@
genfscon ntfs-3g / gen_context(system_u:object_r:dosfs_t,s0)
genfscon ntfs / gen_context(system_u:object_r:dosfs_t,s0)
genfscon vfat / gen_context(system_u:object_r:dosfs_t,s0)
+# Labeling dosfs_t since these are removable file systems with the i
+# same security properties as dosfs_t
+genfscon hfs / gen_context(system_u:object_r:dosfs_t,s0)
+genfscon hfsplus / gen_context(system_u:object_r:dosfs_t,s0)
type fusefs_t;
fs_noxattr_type(fusefs_t)
@@ -244,8 +248,6 @@
genfscon afs / gen_context(system_u:object_r:nfs_t,s0)
genfscon dazukofs / gen_context(system_u:object_r:nfs_t,s0)
genfscon coda / gen_context(system_u:object_r:nfs_t,s0)
-genfscon hfs / gen_context(system_u:object_r:nfs_t,s0)
-genfscon hfsplus / gen_context(system_u:object_r:nfs_t,s0)
genfscon lustre / gen_context(system_u:object_r:nfs_t,s0)
genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0)
genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.6.9/policy/modules/kernel/kernel.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.6.9/policy/modules/kernel/kernel.if
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2009-01-05 15:39:38.000000000 -0500 --- nsaserefpolicy/policy/modules/kernel/kernel.if 2009-01-05 15:39:38.000000000 -0500
+++ serefpolicy-3.6.9/policy/modules/kernel/kernel.if 2009-03-12 13:35:00.000000000 -0400 +++ serefpolicy-3.6.9/policy/modules/kernel/kernel.if 2009-03-17 14:28:38.000000000 -0400
@@ -1197,6 +1197,26 @@ @@ -1197,6 +1197,26 @@
') ')
@ -10991,8 +11036,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.6.9/policy/modules/services/devicekit.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.6.9/policy/modules/services/devicekit.te
--- nsaserefpolicy/policy/modules/services/devicekit.te 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/services/devicekit.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.9/policy/modules/services/devicekit.te 2009-03-16 11:44:53.000000000 -0400 +++ serefpolicy-3.6.9/policy/modules/services/devicekit.te 2009-03-17 15:39:17.000000000 -0400
@@ -0,0 +1,202 @@ @@ -0,0 +1,209 @@
+policy_module(devicekit,1.0.0) +policy_module(devicekit,1.0.0)
+ +
+######################################## +########################################
@ -11053,7 +11098,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+# +#
+# DeviceKit-Power local policy +# DeviceKit-Power local policy
+# +#
+allow devicekit_power_t self:capability { sys_tty_config dac_override }; +allow devicekit_power_t self:capability { dac_override sys_tty_config sys_nice };
+allow devicekit_power_t self:fifo_file rw_fifo_file_perms; +allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
+allow devicekit_power_t self:unix_dgram_socket create_socket_perms; +allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
+ +
@ -11163,12 +11208,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
+fs_list_inotifyfs(devicekit_disk_t) +fs_list_inotifyfs(devicekit_disk_t)
+ +
+storage_getattr_fixed_disk_dev(devicekit_disk_t) +storage_raw_read_fixed_disk(devicekit_disk_t)
+storage_raw_read_removable_device(devicekit_disk_t) +storage_raw_read_removable_device(devicekit_disk_t)
+storage_raw_write_removable_device(devicekit_disk_t) +storage_raw_write_removable_device(devicekit_disk_t)
+ +
+term_use_all_terms(devicekit_disk_t) +term_use_all_terms(devicekit_disk_t)
+ +
+auth_use_nsswitch(devicekit_disk_t)
+
+miscfiles_read_localization(devicekit_disk_t)
+
+userdom_read_all_users_state(devicekit_disk_t) +userdom_read_all_users_state(devicekit_disk_t)
+ +
+optional_policy(` +optional_policy(`
@ -11176,6 +11225,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
+ +
+optional_policy(` +optional_policy(`
+ lvm_domtrans(devicekit_disk_t)
+')
+
+optional_policy(`
+ polkit_domtrans_auth(devicekit_disk_t) + polkit_domtrans_auth(devicekit_disk_t)
+ polkit_read_lib(devicekit_disk_t) + polkit_read_lib(devicekit_disk_t)
+ polkit_read_reload(devicekit_disk_t) + polkit_read_reload(devicekit_disk_t)
@ -11194,7 +11247,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ consolekit_dbus_chat(devicekit_disk_t) + consolekit_dbus_chat(devicekit_disk_t)
+ ') + ')
+') +')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.if serefpolicy-3.6.9/policy/modules/services/dhcp.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.if serefpolicy-3.6.9/policy/modules/services/dhcp.if
--- nsaserefpolicy/policy/modules/services/dhcp.if 2008-11-18 18:57:20.000000000 -0500 --- nsaserefpolicy/policy/modules/services/dhcp.if 2008-11-18 18:57:20.000000000 -0500
+++ serefpolicy-3.6.9/policy/modules/services/dhcp.if 2009-03-12 13:35:00.000000000 -0400 +++ serefpolicy-3.6.9/policy/modules/services/dhcp.if 2009-03-12 13:35:00.000000000 -0400
@ -21566,7 +21618,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/run/libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_var_run_t,s0) +/var/run/libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.6.9/policy/modules/services/virt.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.6.9/policy/modules/services/virt.if
--- nsaserefpolicy/policy/modules/services/virt.if 2009-01-05 15:39:43.000000000 -0500 --- nsaserefpolicy/policy/modules/services/virt.if 2009-01-05 15:39:43.000000000 -0500
+++ serefpolicy-3.6.9/policy/modules/services/virt.if 2009-03-12 13:35:00.000000000 -0400 +++ serefpolicy-3.6.9/policy/modules/services/virt.if 2009-03-17 10:31:34.000000000 -0400
@@ -2,28 +2,6 @@ @@ -2,28 +2,6 @@
######################################## ########################################
@ -21714,7 +21766,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.9/policy/modules/services/virt.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.9/policy/modules/services/virt.te
--- nsaserefpolicy/policy/modules/services/virt.te 2009-01-19 11:06:49.000000000 -0500 --- nsaserefpolicy/policy/modules/services/virt.te 2009-01-19 11:06:49.000000000 -0500
+++ serefpolicy-3.6.9/policy/modules/services/virt.te 2009-03-12 14:17:50.000000000 -0400 +++ serefpolicy-3.6.9/policy/modules/services/virt.te 2009-03-17 10:32:36.000000000 -0400
@@ -8,20 +8,18 @@ @@ -8,20 +8,18 @@
## <desc> ## <desc>
@ -21796,19 +21848,20 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
read_files_pattern(virtd_t, virt_etc_t, virt_etc_t) read_files_pattern(virtd_t, virt_etc_t, virt_etc_t)
read_lnk_files_pattern(virtd_t, virt_etc_t, virt_etc_t) read_lnk_files_pattern(virtd_t, virt_etc_t, virt_etc_t)
@@ -67,7 +92,10 @@ @@ -67,7 +92,11 @@
manage_lnk_files_pattern(virtd_t, virt_etc_rw_t, virt_etc_rw_t) manage_lnk_files_pattern(virtd_t, virt_etc_rw_t, virt_etc_rw_t)
filetrans_pattern(virtd_t, virt_etc_t, virt_etc_rw_t, dir) filetrans_pattern(virtd_t, virt_etc_t, virt_etc_rw_t, dir)
-manage_files_pattern(virtd_t, virt_image_type, virt_image_type) -manage_files_pattern(virtd_t, virt_image_type, virt_image_type)
+virtual_manage_image(virtd_t) +virtual_manage_image(virtd_t)
+virtual_manage_relabel(virtd_t)
+ +
+manage_dirs_pattern(virtd_t, virt_content_t, virt_content_t) +manage_dirs_pattern(virtd_t, virt_content_t, virt_content_t)
+manage_files_pattern(virtd_t, virt_content_t, virt_content_t) +manage_files_pattern(virtd_t, virt_content_t, virt_content_t)
manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t) manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t)
manage_files_pattern(virtd_t, virt_log_t, virt_log_t) manage_files_pattern(virtd_t, virt_log_t, virt_log_t)
@@ -86,6 +114,7 @@ @@ -86,6 +115,7 @@
kernel_read_network_state(virtd_t) kernel_read_network_state(virtd_t)
kernel_rw_net_sysctls(virtd_t) kernel_rw_net_sysctls(virtd_t)
kernel_load_module(virtd_t) kernel_load_module(virtd_t)
@ -21816,7 +21869,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corecmd_exec_bin(virtd_t) corecmd_exec_bin(virtd_t)
corecmd_exec_shell(virtd_t) corecmd_exec_shell(virtd_t)
@@ -96,7 +125,7 @@ @@ -96,7 +126,7 @@
corenet_tcp_sendrecv_generic_node(virtd_t) corenet_tcp_sendrecv_generic_node(virtd_t)
corenet_tcp_sendrecv_all_ports(virtd_t) corenet_tcp_sendrecv_all_ports(virtd_t)
corenet_tcp_bind_generic_node(virtd_t) corenet_tcp_bind_generic_node(virtd_t)
@ -21825,10 +21878,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_tcp_bind_vnc_port(virtd_t) corenet_tcp_bind_vnc_port(virtd_t)
corenet_tcp_connect_vnc_port(virtd_t) corenet_tcp_connect_vnc_port(virtd_t)
corenet_tcp_connect_soundd_port(virtd_t) corenet_tcp_connect_soundd_port(virtd_t)
@@ -104,21 +133,37 @@ @@ -104,21 +134,38 @@
dev_read_sysfs(virtd_t) dev_read_sysfs(virtd_t)
dev_read_rand(virtd_t) dev_read_rand(virtd_t)
+dev_read_kvm(virtd_t)
+dev_getattr_all_chr_files(virtd_t) +dev_getattr_all_chr_files(virtd_t)
# Init script handling # Init script handling
@ -21864,7 +21918,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
term_getattr_pty_fs(virtd_t) term_getattr_pty_fs(virtd_t)
term_use_ptmx(virtd_t) term_use_ptmx(virtd_t)
@@ -129,6 +174,11 @@ @@ -129,6 +176,11 @@
logging_send_syslog_msg(virtd_t) logging_send_syslog_msg(virtd_t)
@ -21876,7 +21930,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_read_all_users_state(virtd_t) userdom_read_all_users_state(virtd_t)
tunable_policy(`virt_use_nfs',` tunable_policy(`virt_use_nfs',`
@@ -167,22 +217,34 @@ @@ -167,22 +219,34 @@
dnsmasq_domtrans(virtd_t) dnsmasq_domtrans(virtd_t)
dnsmasq_signal(virtd_t) dnsmasq_signal(virtd_t)
dnsmasq_kill(virtd_t) dnsmasq_kill(virtd_t)
@ -21895,9 +21949,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+optional_policy(` +optional_policy(`
+ kerberos_keytab_template(virtd, virtd_t) + kerberos_keytab_template(virtd, virtd_t)
+') +')
+
optional_policy(` +optional_policy(`
- qemu_domtrans(virtd_t)
+ lvm_domtrans(virtd_t) + lvm_domtrans(virtd_t)
+') +')
+ +
@ -21906,8 +21959,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ polkit_domtrans_resolve(virtd_t) + polkit_domtrans_resolve(virtd_t)
+ polkit_read_lib(virtd_t) + polkit_read_lib(virtd_t)
+') +')
+
+optional_policy(` optional_policy(`
- qemu_domtrans(virtd_t)
+ qemu_spec_domtrans(virtd_t, svirt_t) + qemu_spec_domtrans(virtd_t, svirt_t)
qemu_read_state(virtd_t) qemu_read_state(virtd_t)
qemu_signal(virtd_t) qemu_signal(virtd_t)
@ -21916,7 +21970,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -198,5 +260,73 @@ @@ -198,5 +262,73 @@
') ')
optional_policy(` optional_policy(`
@ -21949,6 +22003,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+manage_lnk_files_pattern(svirt_t, svirt_var_run_t, svirt_var_run_t) +manage_lnk_files_pattern(svirt_t, svirt_var_run_t, svirt_var_run_t)
+files_pid_filetrans(svirt_t, svirt_var_run_t, { dir file }) +files_pid_filetrans(svirt_t, svirt_var_run_t, { dir file })
+ +
+allow svirt_t svirt_image_t:dir search_dir_perms;
+manage_dirs_pattern(svirt_t, svirt_image_t, svirt_image_t)
+manage_files_pattern(svirt_t, svirt_image_t, svirt_image_t)
+
+storage_raw_write_removable_device(svirt_t) +storage_raw_write_removable_device(svirt_t)
+storage_raw_read_removable_device(svirt_t) +storage_raw_read_removable_device(svirt_t)
+ +
@ -21981,10 +22039,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
+ +
+optional_policy(` +optional_policy(`
+ virt_manage_images(svirt_t)
+')
+
+optional_policy(`
+ xen_rw_image_files(svirt_t) + xen_rw_image_files(svirt_t)
+') +')
+ +
@ -22085,7 +22139,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0) /var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.6.9/policy/modules/services/xserver.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.6.9/policy/modules/services/xserver.if
--- nsaserefpolicy/policy/modules/services/xserver.if 2009-01-05 15:39:43.000000000 -0500 --- nsaserefpolicy/policy/modules/services/xserver.if 2009-01-05 15:39:43.000000000 -0500
+++ serefpolicy-3.6.9/policy/modules/services/xserver.if 2009-03-12 13:35:00.000000000 -0400 +++ serefpolicy-3.6.9/policy/modules/services/xserver.if 2009-03-17 14:33:04.000000000 -0400
@@ -90,7 +90,7 @@ @@ -90,7 +90,7 @@
allow $2 xauth_home_t:file manage_file_perms; allow $2 xauth_home_t:file manage_file_perms;
allow $2 xauth_home_t:file { relabelfrom relabelto }; allow $2 xauth_home_t:file { relabelfrom relabelto };
@ -22095,10 +22149,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
############################## ##############################
# #
@@ -116,6 +116,7 @@ @@ -115,7 +115,8 @@
# write: gnome-settings-daemon RANDR:SelectInput
# setattr: gnome-settings-daemon X11:GrabKey # setattr: gnome-settings-daemon X11:GrabKey
# manage: metacity X11:ChangeWindowAttributes # manage: metacity X11:ChangeWindowAttributes
allow $2 rootwindow_t:x_drawable { read write manage setattr }; - allow $2 rootwindow_t:x_drawable { read write manage setattr };
+ allow $2 rootwindow_t:x_drawable { read write manage get_property getattr setattr };
+ allow $2 $2:x_drawable all_x_drawable_perms; + allow $2 $2:x_drawable all_x_drawable_perms;
# setattr: metacity X11:InstallColormap # setattr: metacity X11:InstallColormap
@ -22259,10 +22315,29 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -779,6 +799,31 @@ @@ -779,6 +799,50 @@
######################################## ########################################
## <summary> ## <summary>
+## Read XDM var lib files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`xserver_manage_xdm_lib_files',`
+ gen_require(`
+ type xdm_var_lib_t;
+ ')
+
+ manage_files_pattern($1, xdm_var_lib_t, xdm_var_lib_t)
+ read_lnk_files_pattern($1, xdm_var_lib_t, xdm_var_lib_t)
+')
+
+########################################
+## <summary>
+## Execute xsever in the xserver domain, and +## Execute xsever in the xserver domain, and
+## allow the specified role the xserver domain. +## allow the specified role the xserver domain.
+## </summary> +## </summary>
@ -22291,7 +22366,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Make an X session script an entrypoint for the specified domain. ## Make an X session script an entrypoint for the specified domain.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -872,6 +917,27 @@ @@ -872,6 +936,27 @@
######################################## ########################################
## <summary> ## <summary>
@ -22319,7 +22394,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Do not audit attempts to write the X server ## Do not audit attempts to write the X server
## log files. ## log files.
## </summary> ## </summary>
@@ -1018,10 +1084,11 @@ @@ -1018,10 +1103,11 @@
# #
interface(`xserver_domtrans',` interface(`xserver_domtrans',`
gen_require(` gen_require(`
@ -22332,7 +22407,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
domtrans_pattern($1, xserver_exec_t, xserver_t) domtrans_pattern($1, xserver_exec_t, xserver_t)
') ')
@@ -1159,6 +1226,275 @@ @@ -1159,6 +1245,275 @@
######################################## ########################################
## <summary> ## <summary>
@ -22608,7 +22683,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Interface to provide X object permissions on a given X server to ## Interface to provide X object permissions on a given X server to
## an X client domain. Gives the domain complete control over the ## an X client domain. Gives the domain complete control over the
## display. ## display.
@@ -1172,7 +1508,102 @@ @@ -1172,7 +1527,102 @@
interface(`xserver_unconfined',` interface(`xserver_unconfined',`
gen_require(` gen_require(`
attribute xserver_unconfined_type; attribute xserver_unconfined_type;
@ -22713,7 +22788,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.9/policy/modules/services/xserver.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.9/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2009-01-19 11:06:49.000000000 -0500 --- nsaserefpolicy/policy/modules/services/xserver.te 2009-01-19 11:06:49.000000000 -0500
+++ serefpolicy-3.6.9/policy/modules/services/xserver.te 2009-03-12 13:35:00.000000000 -0400 +++ serefpolicy-3.6.9/policy/modules/services/xserver.te 2009-03-17 14:38:53.000000000 -0400
@@ -34,6 +34,13 @@ @@ -34,6 +34,13 @@
## <desc> ## <desc>
@ -22914,7 +22989,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Allow gdm to run gdm-binary # Allow gdm to run gdm-binary
can_exec(xdm_t, xdm_exec_t) can_exec(xdm_t, xdm_exec_t)
@@ -329,6 +360,8 @@ @@ -329,22 +360,38 @@
manage_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t) manage_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
manage_sock_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t) manage_sock_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
files_tmp_filetrans(xdm_t, xdm_tmp_t, { file dir sock_file }) files_tmp_filetrans(xdm_t, xdm_tmp_t, { file dir sock_file })
@ -22923,10 +22998,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
manage_dirs_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t) manage_dirs_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
manage_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t) manage_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
@@ -336,15 +369,30 @@ manage_lnk_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
manage_fifo_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t) manage_fifo_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
manage_sock_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t) manage_sock_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
fs_tmpfs_filetrans(xdm_t, xdm_tmpfs_t,{ dir file lnk_file sock_file fifo_file }) -fs_tmpfs_filetrans(xdm_t, xdm_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
+fs_getattr_all_fs(xdm_t) +fs_getattr_all_fs(xdm_t)
+fs_search_inotifyfs(xdm_t) +fs_search_inotifyfs(xdm_t)
+fs_read_noxattr_fs_files(xdm_t) +fs_read_noxattr_fs_files(xdm_t)
@ -22956,7 +23031,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow xdm_t xserver_t:process signal; allow xdm_t xserver_t:process signal;
allow xdm_t xserver_t:unix_stream_socket connectto; allow xdm_t xserver_t:unix_stream_socket connectto;
@@ -358,6 +406,7 @@ @@ -358,6 +405,7 @@
allow xdm_t xserver_t:process { noatsecure siginh rlimitinh signal sigkill }; allow xdm_t xserver_t:process { noatsecure siginh rlimitinh signal sigkill };
allow xdm_t xserver_t:shm rw_shm_perms; allow xdm_t xserver_t:shm rw_shm_perms;
@ -22964,7 +23039,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# connect to xdm xserver over stream socket # connect to xdm xserver over stream socket
stream_connect_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t,xserver_t) stream_connect_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t,xserver_t)
@@ -366,10 +415,14 @@ @@ -366,10 +414,14 @@
delete_files_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t) delete_files_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t)
delete_sock_files_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t) delete_sock_files_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t)
@ -22980,7 +23055,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_system_state(xdm_t) kernel_read_system_state(xdm_t)
kernel_read_kernel_sysctls(xdm_t) kernel_read_kernel_sysctls(xdm_t)
@@ -389,11 +442,13 @@ @@ -389,11 +441,13 @@
corenet_udp_sendrecv_all_ports(xdm_t) corenet_udp_sendrecv_all_ports(xdm_t)
corenet_tcp_bind_generic_node(xdm_t) corenet_tcp_bind_generic_node(xdm_t)
corenet_udp_bind_generic_node(xdm_t) corenet_udp_bind_generic_node(xdm_t)
@ -22994,7 +23069,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dev_read_rand(xdm_t) dev_read_rand(xdm_t)
dev_read_sysfs(xdm_t) dev_read_sysfs(xdm_t)
dev_getattr_framebuffer_dev(xdm_t) dev_getattr_framebuffer_dev(xdm_t)
@@ -401,6 +456,7 @@ @@ -401,6 +455,7 @@
dev_getattr_mouse_dev(xdm_t) dev_getattr_mouse_dev(xdm_t)
dev_setattr_mouse_dev(xdm_t) dev_setattr_mouse_dev(xdm_t)
dev_rw_apm_bios(xdm_t) dev_rw_apm_bios(xdm_t)
@ -23002,7 +23077,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dev_setattr_apm_bios_dev(xdm_t) dev_setattr_apm_bios_dev(xdm_t)
dev_rw_dri(xdm_t) dev_rw_dri(xdm_t)
dev_rw_agp(xdm_t) dev_rw_agp(xdm_t)
@@ -413,14 +469,17 @@ @@ -413,14 +468,17 @@
dev_setattr_video_dev(xdm_t) dev_setattr_video_dev(xdm_t)
dev_getattr_scanner_dev(xdm_t) dev_getattr_scanner_dev(xdm_t)
dev_setattr_scanner_dev(xdm_t) dev_setattr_scanner_dev(xdm_t)
@ -23022,7 +23097,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_read_etc_files(xdm_t) files_read_etc_files(xdm_t)
files_read_var_files(xdm_t) files_read_var_files(xdm_t)
@@ -431,9 +490,13 @@ @@ -431,9 +489,13 @@
files_read_usr_files(xdm_t) files_read_usr_files(xdm_t)
# Poweroff wants to create the /poweroff file when run from xdm # Poweroff wants to create the /poweroff file when run from xdm
files_create_boot_flag(xdm_t) files_create_boot_flag(xdm_t)
@ -23036,7 +23111,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_read_fixed_disk(xdm_t)
storage_dontaudit_write_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t)
@@ -442,6 +505,7 @@ @@ -442,6 +504,7 @@
storage_dontaudit_raw_write_removable_device(xdm_t) storage_dontaudit_raw_write_removable_device(xdm_t)
storage_dontaudit_setattr_removable_dev(xdm_t) storage_dontaudit_setattr_removable_dev(xdm_t)
storage_dontaudit_rw_scsi_generic(xdm_t) storage_dontaudit_rw_scsi_generic(xdm_t)
@ -23044,7 +23119,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
term_setattr_console(xdm_t) term_setattr_console(xdm_t)
term_use_unallocated_ttys(xdm_t) term_use_unallocated_ttys(xdm_t)
@@ -450,6 +514,7 @@ @@ -450,6 +513,7 @@
auth_domtrans_pam_console(xdm_t) auth_domtrans_pam_console(xdm_t)
auth_manage_pam_pid(xdm_t) auth_manage_pam_pid(xdm_t)
auth_manage_pam_console_data(xdm_t) auth_manage_pam_console_data(xdm_t)
@ -23052,7 +23127,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
auth_rw_faillog(xdm_t) auth_rw_faillog(xdm_t)
auth_write_login_records(xdm_t) auth_write_login_records(xdm_t)
@@ -460,10 +525,10 @@ @@ -460,10 +524,10 @@
logging_read_generic_logs(xdm_t) logging_read_generic_logs(xdm_t)
@ -23065,11 +23140,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_dontaudit_use_unpriv_user_fds(xdm_t)
userdom_create_all_users_keys(xdm_t) userdom_create_all_users_keys(xdm_t)
@@ -472,6 +537,7 @@ @@ -472,6 +536,8 @@
# Search /proc for any user domain processes. # Search /proc for any user domain processes.
userdom_read_all_users_state(xdm_t) userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t) userdom_signal_all_users(xdm_t)
+userdom_manage_user_tmp_sockets(xdm_t) +userdom_manage_user_tmp_sockets(xdm_t)
+userdom_manage_tmpfs_role(system_r, xdm_t)
xserver_rw_session(xdm_t,xdm_tmpfs_t) xserver_rw_session(xdm_t,xdm_tmpfs_t)
xserver_unconfined(xdm_t) xserver_unconfined(xdm_t)
@ -23138,7 +23214,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
+ +
+optional_policy(` +optional_policy(`
+ pulseaudio_role(system_r, xdm_t) + pulseaudio_exec(xdm_t)
+') +')
+ +
+# On crash gdm execs gdb to dump stack +# On crash gdm execs gdb to dump stack
@ -28022,7 +28098,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0) +/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.9/policy/modules/system/userdomain.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.9/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-01-19 11:07:34.000000000 -0500 --- nsaserefpolicy/policy/modules/system/userdomain.if 2009-01-19 11:07:34.000000000 -0500
+++ serefpolicy-3.6.9/policy/modules/system/userdomain.if 2009-03-12 13:35:00.000000000 -0400 +++ serefpolicy-3.6.9/policy/modules/system/userdomain.if 2009-03-17 14:38:03.000000000 -0400
@@ -30,8 +30,9 @@ @@ -30,8 +30,9 @@
') ')
@ -29962,8 +30038,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+# No application file contexts. +# No application file contexts.
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virtual.if serefpolicy-3.6.9/policy/modules/system/virtual.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virtual.if serefpolicy-3.6.9/policy/modules/system/virtual.if
--- nsaserefpolicy/policy/modules/system/virtual.if 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/system/virtual.if 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.9/policy/modules/system/virtual.if 2009-03-12 13:35:00.000000000 -0400 +++ serefpolicy-3.6.9/policy/modules/system/virtual.if 2009-03-17 15:49:05.000000000 -0400
@@ -0,0 +1,99 @@ @@ -0,0 +1,118 @@
+## <summary>Virtual machine emulator and virtualizer</summary> +## <summary>Virtual machine emulator and virtualizer</summary>
+ +
+######################################## +########################################
@ -30055,7 +30131,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+# +#
+interface(`virtual_manage_image',` +interface(`virtual_manage_image',`
+ gen_require(` + gen_require(`
+ type virtual_image_type; + attribute virtual_image_type;
+ ') + ')
+ +
+ manage_dirs_pattern($1, virtual_image_type, virtual_image_type) + manage_dirs_pattern($1, virtual_image_type, virtual_image_type)
@ -30063,6 +30139,25 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ manage_lnk_files_pattern($1, virtual_image_type, virtual_image_type) + manage_lnk_files_pattern($1, virtual_image_type, virtual_image_type)
+ rw_blk_files_pattern($1, virtual_image_type, virtual_image_type) + rw_blk_files_pattern($1, virtual_image_type, virtual_image_type)
+') +')
+
+########################################
+## <summary>
+## Allow domain to relabel virt image files
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain to not audit.
+## </summary>
+## </param>
+#
+interface(`virtual_manage_relabel',`
+ gen_require(`
+ attribute virtual_image_type;
+ ')
+
+ allow $1 virtual_image_type:file { relabelfrom relabelto };
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virtual.te serefpolicy-3.6.9/policy/modules/system/virtual.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virtual.te serefpolicy-3.6.9/policy/modules/system/virtual.te
--- nsaserefpolicy/policy/modules/system/virtual.te 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/system/virtual.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.9/policy/modules/system/virtual.te 2009-03-12 13:35:00.000000000 -0400 +++ serefpolicy-3.6.9/policy/modules/system/virtual.te 2009-03-12 13:35:00.000000000 -0400

5
selinux-policy.spec
View File

@ -20,7 +20,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.6.9 Version: 3.6.9
Release: 2%{?dist} Release: 3%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -444,6 +444,9 @@ exit 0
%endif %endif
%changelog %changelog
* Tue Mar 17 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-3
- Change to svirt to only access svirt_image_t
* Thu Mar 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-2 * Thu Mar 12 2009 Dan Walsh <dwalsh@redhat.com> 3.6.9-2
- Fix libvirt policy - Fix libvirt policy