rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Disable nsplugin module

This commit is contained in:
Miroslav 2011-11-28 15:54:55 +01:00
parent 218172dd16
commit 0ca57d1d0a
2 changed files with 173 additions and 77 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

248
policy-F16.patch
View File

@ -8570,10 +8570,10 @@ index 0000000..8d7c751
+')
diff --git a/policy/modules/apps/namespace.te b/policy/modules/apps/namespace.te
new file mode 100644
index 0000000..6d4ec21
index 0000000..a337d62
--- /dev/null
+++ b/policy/modules/apps/namespace.te
@@ -0,0 +1,40 @@
@@ -0,0 +1,42 @@
+policy_module(namespace,1.0.0)
+
+########################################
@ -8598,6 +8598,8 @@ index 0000000..6d4ec21
+
+kernel_read_system_state(namespace_init_t)
+
+corecmd_exec_shell(namespace_init_t)
+
+domain_use_interactive_fds(namespace_init_t)
+
+files_read_etc_files(namespace_init_t)
@ -12554,7 +12556,7 @@ index 223ad43..d95e720 100644
rsync_exec(yam_t)
')
diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
index 3fae11a..37d3b99 100644
index 3fae11a..c82360e 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
@@ -97,8 +97,6 @@ ifdef(`distro_redhat',`
@ -12791,7 +12793,7 @@ index 3fae11a..37d3b99 100644
/var/qmail/bin -d gen_context(system_u:object_r:bin_t,s0)
/var/qmail/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -385,3 +401,11 @@ ifdef(`distro_suse', `
@@ -385,3 +401,12 @@ ifdef(`distro_suse', `
ifdef(`distro_suse',`
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
')
@ -12800,6 +12802,7 @@ index 3fae11a..37d3b99 100644
+# /usr/lib
+#
+
+/usr/lib/iscan/network -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/ruby/gems/.*/agents(/.*)? gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/virtualbox/VBoxManage -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/yp/.+ -- gen_context(system_u:object_r:bin_t,s0)
@ -21553,7 +21556,7 @@ index 2be17d2..de3c13e 100644
+ userdom_execmod_user_home_files(staff_usertype)
+')
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
index e14b961..b8f0df4 100644
index e14b961..37bdf8d 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -5,13 +5,6 @@ policy_module(sysadm, 2.2.1)
@ -21663,7 +21666,7 @@ index e14b961..b8f0df4 100644
optional_policy(`
- consoletype_run(sysadm_t, sysadm_r)
+ cron_admin_role(sysadm_r, sysadm_t)
+ cron_role(sysadm_r, sysadm_t)
+ #cron_role(sysadm_r, sysadm_t)
')
optional_policy(`
@ -27260,7 +27263,7 @@ index 44a1e3d..7cc67ec 100644
+ named_systemctl($1)
')
diff --git a/policy/modules/services/bind.te b/policy/modules/services/bind.te
index 4deca04..fc86505 100644
index 4deca04..7859fa1 100644
--- a/policy/modules/services/bind.te
+++ b/policy/modules/services/bind.te
@@ -6,16 +6,24 @@ policy_module(bind, 1.11.0)
@ -27334,18 +27337,20 @@ index 4deca04..fc86505 100644
tunable_policy(`named_write_master_zones',`
manage_dirs_pattern(named_t, named_zone_t, named_zone_t)
manage_files_pattern(named_t, named_zone_t, named_zone_t)
@@ -154,6 +170,10 @@ tunable_policy(`named_write_master_zones',`
@@ -154,6 +170,12 @@ tunable_policy(`named_write_master_zones',`
')
optional_policy(`
+ # needed by FreeIPA with DNS support
+ dirsrv_stream_connect(named_t)
+ ldap_stream_connect(named_t)
+')
+
+optional_policy(`
init_dbus_chat_script(named_t)
sysnet_dbus_chat_dhcpc(named_t)
@@ -198,18 +218,18 @@ allow ndc_t self:process { fork signal_perms };
@@ -198,18 +220,18 @@ allow ndc_t self:process { fork signal_perms };
allow ndc_t self:fifo_file rw_fifo_file_perms;
allow ndc_t self:unix_stream_socket { connect create_stream_socket_perms };
allow ndc_t self:tcp_socket create_socket_perms;
@ -27367,7 +27372,7 @@ index 4deca04..fc86505 100644
kernel_read_kernel_sysctls(ndc_t)
corenet_all_recvfrom_unlabeled(ndc_t)
@@ -228,6 +248,8 @@ files_search_pids(ndc_t)
@@ -228,6 +250,8 @@ files_search_pids(ndc_t)
fs_getattr_xattr_fs(ndc_t)
@ -27376,7 +27381,7 @@ index 4deca04..fc86505 100644
init_use_fds(ndc_t)
init_use_script_ptys(ndc_t)
@@ -235,24 +257,13 @@ logging_send_syslog_msg(ndc_t)
@@ -235,24 +259,13 @@ logging_send_syslog_msg(ndc_t)
miscfiles_read_localization(ndc_t)
@ -29917,7 +29922,7 @@ index 1f11572..717fb8d 100644
init_labeled_script_domtrans($1, clamd_initrc_exec_t)
diff --git a/policy/modules/services/clamav.te b/policy/modules/services/clamav.te
index f758323..4bc077f 100644
index f758323..4c06224 100644
--- a/policy/modules/services/clamav.te
+++ b/policy/modules/services/clamav.te
@@ -1,9 +1,16 @@
@ -29991,7 +29996,7 @@ index f758323..4bc077f 100644
optional_policy(`
amavis_read_lib_files(clamd_t)
amavis_read_spool_files(clamd_t)
@@ -142,13 +147,30 @@ optional_policy(`
@@ -142,13 +147,31 @@ optional_policy(`
')
optional_policy(`
@ -30011,6 +30016,7 @@ index f758323..4bc077f 100644
+
+optional_policy(`
+ spamd_stream_connect(clamd_t)
+ spamd_read_pid(clamd_t)
+')
+
tunable_policy(`clamd_use_jit',`
@ -30023,7 +30029,7 @@ index f758323..4bc077f 100644
')
########################################
@@ -178,10 +200,16 @@ files_pid_filetrans(freshclam_t, clamd_var_run_t, file)
@@ -178,10 +201,16 @@ files_pid_filetrans(freshclam_t, clamd_var_run_t, file)
# log files (own logfiles only)
manage_files_pattern(freshclam_t, freshclam_var_log_t, freshclam_var_log_t)
@ -30042,7 +30048,7 @@ index f758323..4bc077f 100644
corenet_all_recvfrom_unlabeled(freshclam_t)
corenet_all_recvfrom_netlabel(freshclam_t)
corenet_tcp_sendrecv_generic_if(freshclam_t)
@@ -189,6 +217,7 @@ corenet_tcp_sendrecv_generic_node(freshclam_t)
@@ -189,6 +218,7 @@ corenet_tcp_sendrecv_generic_node(freshclam_t)
corenet_tcp_sendrecv_all_ports(freshclam_t)
corenet_tcp_sendrecv_clamd_port(freshclam_t)
corenet_tcp_connect_http_port(freshclam_t)
@ -30050,7 +30056,7 @@ index f758323..4bc077f 100644
corenet_sendrecv_http_client_packets(freshclam_t)
dev_read_rand(freshclam_t)
@@ -207,16 +236,18 @@ miscfiles_read_localization(freshclam_t)
@@ -207,16 +237,18 @@ miscfiles_read_localization(freshclam_t)
clamav_stream_connect(freshclam_t)
@ -30073,7 +30079,7 @@ index f758323..4bc077f 100644
########################################
#
# clamscam local policy
@@ -242,15 +273,29 @@ files_tmp_filetrans(clamscan_t, clamscan_tmp_t, { file dir })
@@ -242,15 +274,29 @@ files_tmp_filetrans(clamscan_t, clamscan_tmp_t, { file dir })
manage_files_pattern(clamscan_t, clamd_var_lib_t, clamd_var_lib_t)
allow clamscan_t clamd_var_lib_t:dir list_dir_perms;
@ -30103,7 +30109,7 @@ index f758323..4bc077f 100644
files_read_etc_files(clamscan_t)
files_read_etc_runtime_files(clamscan_t)
@@ -264,10 +309,15 @@ miscfiles_read_public_files(clamscan_t)
@@ -264,10 +310,15 @@ miscfiles_read_public_files(clamscan_t)
clamav_stream_connect(clamscan_t)
@ -31175,10 +31181,10 @@ index 0000000..40a0157
+
diff --git a/policy/modules/services/collectd.te b/policy/modules/services/collectd.te
new file mode 100644
index 0000000..e4d7098
index 0000000..ca71d08
--- /dev/null
+++ b/policy/modules/services/collectd.te
@@ -0,0 +1,79 @@
@@ -0,0 +1,80 @@
+policy_module(collectd, 1.0.0)
+
+########################################
@ -31252,17 +31258,32 @@ index 0000000..e4d7098
+
+optional_policy(`
+ apache_content_template(collectd)
+
+
+ files_search_var_lib(httpd_collectd_script_t)
+ read_files_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
+ list_dirs_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
+ miscfiles_setattr_fonts_cache_dirs(httpd_collectd_script_t)
+')
+
diff --git a/policy/modules/services/colord.te b/policy/modules/services/colord.te
index 74505cc..145a4eb 100644
index 74505cc..246bbf9 100644
--- a/policy/modules/services/colord.te
+++ b/policy/modules/services/colord.te
@@ -23,6 +23,7 @@ files_type(colord_var_lib_t)
@@ -5,6 +5,13 @@ policy_module(colord, 1.0.0)
# Declarations
#
+## <desc>
+## <p>
+## Allow colord domain to connect to the network using TCP.
+## </p>
+## </desc>
+gen_tunable(colord_can_network_connect, false)
+
type colord_t;
type colord_exec_t;
dbus_system_domain(colord_t, colord_exec_t)
@@ -23,9 +30,11 @@ files_type(colord_var_lib_t)
# colord local policy
#
allow colord_t self:capability { dac_read_search dac_override };
@ -31270,7 +31291,11 @@ index 74505cc..145a4eb 100644
allow colord_t self:process signal;
allow colord_t self:fifo_file rw_fifo_file_perms;
allow colord_t self:netlink_kobject_uevent_socket create_socket_perms;
@@ -41,8 +42,13 @@ manage_dirs_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
+allow colord_t self:tcp_socket create_stream_socket_perms;
allow colord_t self:udp_socket create_socket_perms;
allow colord_t self:unix_dgram_socket create_socket_perms;
@@ -41,8 +50,14 @@ manage_dirs_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
manage_files_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
files_var_lib_filetrans(colord_t, colord_var_lib_t, { file dir })
@ -31282,10 +31307,11 @@ index 74505cc..145a4eb 100644
+
+# reads *.ini files
+corecmd_exec_bin(colord_t)
+corecmd_exec_shell(colord_t)
corenet_all_recvfrom_unlabeled(colord_t)
corenet_all_recvfrom_netlabel(colord_t)
@@ -50,6 +56,8 @@ corenet_udp_bind_generic_node(colord_t)
@@ -50,6 +65,8 @@ corenet_udp_bind_generic_node(colord_t)
corenet_udp_bind_ipp_port(colord_t)
corenet_tcp_connect_ipp_port(colord_t)
@ -31294,7 +31320,7 @@ index 74505cc..145a4eb 100644
dev_read_video_dev(colord_t)
dev_write_video_dev(colord_t)
dev_rw_printer(colord_t)
@@ -65,21 +73,24 @@ files_list_mnt(colord_t)
@@ -65,19 +82,36 @@ files_list_mnt(colord_t)
files_read_etc_files(colord_t)
files_read_usr_files(colord_t)
@ -31315,19 +31341,24 @@ index 74505cc..145a4eb 100644
-sysnet_dns_name_resolve(colord_t)
+fs_getattr_tmpfs(colord_t)
+userdom_rw_user_tmpfs_files(colord_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(colord_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(colord_t)
-')
+
+userdom_home_reader(colord_t)
+
+tunable_policy(`colord_can_network_connect',`
+ corenet_tcp_connect_all_ports(colord_t)
+')
optional_policy(`
cups_read_config(colord_t)
@@ -89,6 +100,12 @@ optional_policy(`
tunable_policy(`use_nfs_home_dirs',`
+ fs_getattr_nfs(colord_t)
fs_read_nfs_files(colord_t)
')
tunable_policy(`use_samba_home_dirs',`
+ fs_getattr_cifs(colord_t)
fs_read_cifs_files(colord_t)
')
@@ -89,6 +123,12 @@ optional_policy(`
')
optional_policy(`
@ -31340,7 +31371,7 @@ index 74505cc..145a4eb 100644
policykit_dbus_chat(colord_t)
policykit_domtrans_auth(colord_t)
policykit_read_lib(colord_t)
@@ -96,5 +113,16 @@ optional_policy(`
@@ -96,5 +136,16 @@ optional_policy(`
')
optional_policy(`
@ -33674,7 +33705,7 @@ index c43ff4c..5da88b5 100644
init_labeled_script_domtrans($1, cvs_initrc_exec_t)
domain_system_change_exemption($1)
diff --git a/policy/modules/services/cvs.te b/policy/modules/services/cvs.te
index 88e7e97..e18dc0b 100644
index 88e7e97..1546703 100644
--- a/policy/modules/services/cvs.te
+++ b/policy/modules/services/cvs.te
@@ -6,9 +6,9 @@ policy_module(cvs, 1.9.0)
@ -33704,7 +33735,16 @@ index 88e7e97..e18dc0b 100644
manage_dirs_pattern(cvs_t, cvs_data_t, cvs_data_t)
manage_files_pattern(cvs_t, cvs_data_t, cvs_data_t)
@@ -112,4 +112,5 @@ optional_policy(`
@@ -81,6 +81,8 @@ files_read_etc_runtime_files(cvs_t)
# for identd; cjp: this should probably only be inetd_child rules?
files_search_home(cvs_t)
+init_dontaudit_read_utmp(cvs_t)
+
logging_send_syslog_msg(cvs_t)
logging_send_audit_msgs(cvs_t)
@@ -112,4 +114,5 @@ optional_policy(`
read_files_pattern(httpd_cvs_script_t, cvs_data_t, cvs_data_t)
manage_dirs_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t)
manage_files_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t)
@ -36415,7 +36455,7 @@ index 9bd812b..144cbb7 100644
+ dnsmasq_systemctl($1)
')
diff --git a/policy/modules/services/dnsmasq.te b/policy/modules/services/dnsmasq.te
index fdaeeba..8542225 100644
index fdaeeba..b1ea136 100644
--- a/policy/modules/services/dnsmasq.te
+++ b/policy/modules/services/dnsmasq.te
@@ -24,6 +24,9 @@ logging_log_file(dnsmasq_var_log_t)
@ -36428,7 +36468,7 @@ index fdaeeba..8542225 100644
########################################
#
# Local policy
@@ -48,11 +51,13 @@ files_var_lib_filetrans(dnsmasq_t, dnsmasq_lease_t, file)
@@ -48,11 +51,14 @@ files_var_lib_filetrans(dnsmasq_t, dnsmasq_lease_t, file)
manage_files_pattern(dnsmasq_t, dnsmasq_var_log_t, dnsmasq_var_log_t)
logging_log_filetrans(dnsmasq_t, dnsmasq_var_log_t, file)
@ -36439,11 +36479,12 @@ index fdaeeba..8542225 100644
kernel_read_kernel_sysctls(dnsmasq_t)
kernel_read_system_state(dnsmasq_t)
+kernel_read_network_state(dnsmasq_t)
+kernel_request_load_module(dnsmasq_t)
corenet_all_recvfrom_unlabeled(dnsmasq_t)
corenet_all_recvfrom_netlabel(dnsmasq_t)
@@ -88,6 +93,8 @@ logging_send_syslog_msg(dnsmasq_t)
@@ -88,6 +94,8 @@ logging_send_syslog_msg(dnsmasq_t)
miscfiles_read_localization(dnsmasq_t)
@ -36452,7 +36493,7 @@ index fdaeeba..8542225 100644
userdom_dontaudit_use_unpriv_user_fds(dnsmasq_t)
userdom_dontaudit_search_user_home_dirs(dnsmasq_t)
@@ -96,7 +103,20 @@ optional_policy(`
@@ -96,7 +104,20 @@ optional_policy(`
')
optional_policy(`
@ -36473,7 +36514,7 @@ index fdaeeba..8542225 100644
')
optional_policy(`
@@ -114,4 +134,5 @@ optional_policy(`
@@ -114,4 +135,5 @@ optional_policy(`
optional_policy(`
virt_manage_lib_files(dnsmasq_t)
virt_read_pid_files(dnsmasq_t)
@ -43323,7 +43364,7 @@ index 67c7fdd..d7338be 100644
## <summary>
## Execute mailman CGI scripts in the
diff --git a/policy/modules/services/mailman.te b/policy/modules/services/mailman.te
index af4d572..cea085e 100644
index af4d572..0c0925e 100644
--- a/policy/modules/services/mailman.te
+++ b/policy/modules/services/mailman.te
@@ -19,6 +19,9 @@ logging_log_file(mailman_log_t)
@ -43336,7 +43377,7 @@ index af4d572..cea085e 100644
mailman_domain_template(mail)
init_daemon_domain(mailman_mail_t, mailman_mail_exec_t)
@@ -61,14 +64,22 @@ optional_policy(`
@@ -61,14 +64,24 @@ optional_policy(`
# Mailman mail local policy
#
@ -43357,11 +43398,13 @@ index af4d572..cea085e 100644
+# make NNTP gateway working
+corenet_tcp_connect_innd_port(mailman_mail_t)
+corenet_tcp_connect_spamd_port(mailman_mail_t)
+
+dev_read_urand(mailman_mail_t)
+
files_search_spool(mailman_mail_t)
fs_rw_anon_inodefs_files(mailman_mail_t)
@@ -81,11 +92,16 @@ optional_policy(`
@@ -81,11 +94,16 @@ optional_policy(`
')
optional_policy(`
@ -43378,7 +43421,7 @@ index af4d572..cea085e 100644
')
########################################
@@ -104,6 +120,8 @@ manage_lnk_files_pattern(mailman_queue_t, mailman_archive_t, mailman_archive_t)
@@ -104,6 +122,8 @@ manage_lnk_files_pattern(mailman_queue_t, mailman_archive_t, mailman_archive_t)
kernel_read_proc_symlinks(mailman_queue_t)
@ -43387,7 +43430,7 @@ index af4d572..cea085e 100644
auth_domtrans_chk_passwd(mailman_queue_t)
files_dontaudit_search_pids(mailman_queue_t)
@@ -125,4 +143,4 @@ optional_policy(`
@@ -125,4 +145,4 @@ optional_policy(`
optional_policy(`
su_exec(mailman_queue_t)
@ -53190,7 +53233,7 @@ index 2855a44..58bb459 100644
+ allow $1 puppet_var_run_t:dir search_dir_perms;
+')
diff --git a/policy/modules/services/puppet.te b/policy/modules/services/puppet.te
index 64c5f95..fb500de 100644
index 64c5f95..e237da7 100644
--- a/policy/modules/services/puppet.te
+++ b/policy/modules/services/puppet.te
@@ -6,12 +6,19 @@ policy_module(puppet, 1.0.0)
@ -53386,7 +53429,7 @@ index 64c5f95..fb500de 100644
#
allow puppetmaster_t self:capability { dac_read_search dac_override setuid setgid fowner chown fsetid sys_tty_config };
@@ -171,29 +258,35 @@ allow puppetmaster_t self:fifo_file rw_fifo_file_perms;
@@ -171,29 +258,36 @@ allow puppetmaster_t self:fifo_file rw_fifo_file_perms;
allow puppetmaster_t self:netlink_route_socket create_netlink_socket_perms;
allow puppetmaster_t self:socket create;
allow puppetmaster_t self:tcp_socket create_stream_socket_perms;
@ -53419,13 +53462,14 @@ index 64c5f95..fb500de 100644
+allow puppetmaster_t puppet_tmp_t:dir relabel_dir_perms;
kernel_dontaudit_search_kernel_sysctl(puppetmaster_t)
+`kernel_read_network_state(puppetmaster_t)
kernel_read_system_state(puppetmaster_t)
kernel_read_crypto_sysctls(puppetmaster_t)
+kernel_read_kernel_sysctls(puppetmaster_t)
corecmd_exec_bin(puppetmaster_t)
corecmd_exec_shell(puppetmaster_t)
@@ -206,21 +299,46 @@ corenet_tcp_bind_generic_node(puppetmaster_t)
@@ -206,21 +300,46 @@ corenet_tcp_bind_generic_node(puppetmaster_t)
corenet_tcp_bind_puppet_port(puppetmaster_t)
corenet_sendrecv_puppet_server_packets(puppetmaster_t)
@ -53475,7 +53519,7 @@ index 64c5f95..fb500de 100644
optional_policy(`
hostname_exec(puppetmaster_t)
')
@@ -231,3 +349,9 @@ optional_policy(`
@@ -231,3 +350,9 @@ optional_policy(`
rpm_exec(puppetmaster_t)
rpm_read_db(puppetmaster_t)
')
@ -57937,7 +57981,7 @@ index 82cb169..48c023e 100644
+ samba_systemctl($1)
')
diff --git a/policy/modules/services/samba.te b/policy/modules/services/samba.te
index e30bb63..d893f99 100644
index e30bb63..bac0112 100644
--- a/policy/modules/services/samba.te
+++ b/policy/modules/services/samba.te
@@ -85,6 +85,9 @@ files_config_file(samba_etc_t)
@ -58253,7 +58297,22 @@ index e30bb63..d893f99 100644
corenet_tcp_connect_epmap_port(winbind_t)
corenet_tcp_connect_all_unreserved_ports(winbind_t)
@@ -863,6 +888,12 @@ userdom_manage_user_home_content_pipes(winbind_t)
@@ -850,10 +875,14 @@ domain_use_interactive_fds(winbind_t)
files_read_etc_files(winbind_t)
files_read_usr_symlinks(winbind_t)
+files_list_var_lib(winbind_t)
logging_send_syslog_msg(winbind_t)
miscfiles_read_localization(winbind_t)
+miscfiles_read_generic_certs(winbind_t)
+
+sysnet_use_ldap(winbind_t)
userdom_dontaudit_use_unpriv_user_fds(winbind_t)
userdom_manage_user_home_content_dirs(winbind_t)
@@ -863,6 +892,12 @@ userdom_manage_user_home_content_pipes(winbind_t)
userdom_manage_user_home_content_sockets(winbind_t)
userdom_user_home_dir_filetrans_user_home_content(winbind_t, { dir file lnk_file fifo_file sock_file })
@ -58266,7 +58325,7 @@ index e30bb63..d893f99 100644
optional_policy(`
kerberos_use(winbind_t)
')
@@ -904,7 +935,7 @@ logging_send_syslog_msg(winbind_helper_t)
@@ -904,7 +939,7 @@ logging_send_syslog_msg(winbind_helper_t)
miscfiles_read_localization(winbind_helper_t)
@ -58275,7 +58334,7 @@ index e30bb63..d893f99 100644
optional_policy(`
apache_append_log(winbind_helper_t)
@@ -922,6 +953,18 @@ optional_policy(`
@@ -922,6 +957,18 @@ optional_policy(`
#
optional_policy(`
@ -58294,7 +58353,7 @@ index e30bb63..d893f99 100644
type samba_unconfined_script_t;
type samba_unconfined_script_exec_t;
domain_type(samba_unconfined_script_t)
@@ -932,9 +975,12 @@ optional_policy(`
@@ -932,9 +979,12 @@ optional_policy(`
allow smbd_t samba_unconfined_script_exec_t:dir search_dir_perms;
allow smbd_t samba_unconfined_script_exec_t:file ioctl;
@ -58613,7 +58672,7 @@ index f1aea88..3e6a93f 100644
admin_pattern($1, saslauthd_var_run_t)
')
diff --git a/policy/modules/services/sasl.te b/policy/modules/services/sasl.te
index cfc60dd..791c5b3 100644
index cfc60dd..71d76cf 100644
--- a/policy/modules/services/sasl.te
+++ b/policy/modules/services/sasl.te
@@ -19,9 +19,6 @@ init_daemon_domain(saslauthd_t, saslauthd_exec_t)
@ -58650,7 +58709,15 @@ index cfc60dd..791c5b3 100644
corenet_all_recvfrom_unlabeled(saslauthd_t)
corenet_all_recvfrom_netlabel(saslauthd_t)
@@ -94,6 +94,7 @@ tunable_policy(`allow_saslauthd_read_shadow',`
@@ -55,6 +55,7 @@ corenet_tcp_sendrecv_generic_if(saslauthd_t)
corenet_tcp_sendrecv_generic_node(saslauthd_t)
corenet_tcp_sendrecv_all_ports(saslauthd_t)
corenet_tcp_connect_pop_port(saslauthd_t)
+corenet_tcp_connect_zarafa_port(saslauthd_t)
corenet_sendrecv_pop_client_packets(saslauthd_t)
dev_read_urand(saslauthd_t)
@@ -94,6 +95,7 @@ tunable_policy(`allow_saslauthd_read_shadow',`
optional_policy(`
kerberos_keytab_template(saslauthd, saslauthd_t)
@ -59663,7 +59730,7 @@ index 6b3abf9..a785741 100644
+/var/spool/MD-Quarantine(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0)
+/var/spool/MIMEDefang(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0)
diff --git a/policy/modules/services/spamassassin.if b/policy/modules/services/spamassassin.if
index c954f31..85e8212 100644
index c954f31..4aac595 100644
--- a/policy/modules/services/spamassassin.if
+++ b/policy/modules/services/spamassassin.if
@@ -14,6 +14,7 @@
@ -59782,7 +59849,7 @@ index c954f31..85e8212 100644
allow $1 spamd_tmp_t:file read_file_perms;
')
@@ -223,5 +291,75 @@ interface(`spamassassin_dontaudit_getattr_spamd_tmp_sockets',`
@@ -223,5 +291,94 @@ interface(`spamassassin_dontaudit_getattr_spamd_tmp_sockets',`
type spamd_tmp_t;
')
@ -59790,6 +59857,25 @@ index c954f31..85e8212 100644
+ dontaudit $1 spamd_tmp_t:sock_file getattr_sock_file_perms;
+')
+
+#######################################
+## <summary>
+## Read spamd pid file.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to connect.
+## </summary>
+## </param>
+#
+interface(`spamd_read_pid',`
+ gen_require(`
+ type spamd_t, spamd_var_run_t;
+ ')
+
+ files_search_pids($1)
+ read_files_pattern($1, spamd_var_run_t, spamd_var_run_t)
+')
+
+########################################
+## <summary>
+## Connect to run spamd.
@ -59860,7 +59946,7 @@ index c954f31..85e8212 100644
+ admin_pattern($1, spamd_var_run_t)
')
diff --git a/policy/modules/services/spamassassin.te b/policy/modules/services/spamassassin.te
index ec1eb1e..fdb471a 100644
index ec1eb1e..9d10f0b 100644
--- a/policy/modules/services/spamassassin.te
+++ b/policy/modules/services/spamassassin.te
@@ -6,56 +6,101 @@ policy_module(spamassassin, 2.4.0)
@ -60280,7 +60366,15 @@ index ec1eb1e..fdb471a 100644
')
optional_policy(`
@@ -451,3 +531,51 @@ optional_policy(`
@@ -444,6 +524,7 @@ optional_policy(`
')
optional_policy(`
+ mta_send_mail(spamd_t)
sendmail_stub(spamd_t)
mta_read_config(spamd_t)
')
@@ -451,3 +532,51 @@ optional_policy(`
optional_policy(`
udev_read_db(spamd_t)
')
@ -60448,21 +60542,22 @@ index 4b2230e..950e65a 100644
+ kerberos_manage_host_rcache(squid_t)
+')
diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc
index 078bcd7..2d60774 100644
index 078bcd7..84d29ee 100644
--- a/policy/modules/services/ssh.fc
+++ b/policy/modules/services/ssh.fc
@@ -1,4 +1,10 @@
@@ -1,4 +1,11 @@
HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
+HOME_DIR/\.shosts gen_context(system_u:object_r:ssh_home_t,s0)
+
+/var/lib/amanda/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
+/var/lib/gitolite/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
+/var/lib/gitolite/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
+/var/lib/nocpulse/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
+
+/etc/rc\.d/init\.d/sshd -- gen_context(system_u:object_r:sshd_initrc_exec_t,s0)
/etc/ssh/primes -- gen_context(system_u:object_r:sshd_key_t,s0)
/etc/ssh/ssh_host_key -- gen_context(system_u:object_r:sshd_key_t,s0)
@@ -14,3 +20,7 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
@@ -14,3 +21,7 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
/usr/sbin/sshd -- gen_context(system_u:object_r:sshd_exec_t,s0)
/var/run/sshd\.init\.pid -- gen_context(system_u:object_r:sshd_var_run_t,s0)
@ -73997,7 +74092,7 @@ index 8b5c196..da41726 100644
+ role $2 types showmount_t;
')
diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
index 15832c7..b90b726 100644
index 15832c7..a50ceba 100644
--- a/policy/modules/system/mount.te
+++ b/policy/modules/system/mount.te
@@ -17,17 +17,29 @@ type mount_exec_t;
@ -74078,7 +74173,7 @@ index 15832c7..b90b726 100644
kernel_dontaudit_write_debugfs_dirs(mount_t)
kernel_dontaudit_write_proc_dirs(mount_t)
# To load binfmt_misc kernel module
@@ -57,65 +92,93 @@ kernel_request_load_module(mount_t)
@@ -57,65 +92,94 @@ kernel_request_load_module(mount_t)
# required for mount.smbfs
corecmd_exec_bin(mount_t)
@ -74087,6 +74182,7 @@ index 15832c7..b90b726 100644
dev_list_all_dev_nodes(mount_t)
+dev_read_usbfs(mount_t)
+dev_read_rand(mount_t)
+dev_read_urand(mount_t)
dev_read_sysfs(mount_t)
dev_dontaudit_write_sysfs_dirs(mount_t)
dev_rw_lvm_control(mount_t)
@ -74181,7 +74277,7 @@ index 15832c7..b90b726 100644
logging_send_syslog_msg(mount_t)
@@ -126,6 +189,8 @@ sysnet_use_portmap(mount_t)
@@ -126,6 +190,8 @@ sysnet_use_portmap(mount_t)
seutil_read_config(mount_t)
userdom_use_all_users_fds(mount_t)
@ -74190,7 +74286,7 @@ index 15832c7..b90b726 100644
ifdef(`distro_redhat',`
optional_policy(`
@@ -141,26 +206,28 @@ ifdef(`distro_ubuntu',`
@@ -141,26 +207,28 @@ ifdef(`distro_ubuntu',`
')
')
@ -74229,7 +74325,7 @@ index 15832c7..b90b726 100644
corenet_tcp_bind_generic_port(mount_t)
corenet_udp_bind_generic_port(mount_t)
corenet_tcp_bind_reserved_port(mount_t)
@@ -174,6 +241,8 @@ optional_policy(`
@@ -174,6 +242,8 @@ optional_policy(`
fs_search_rpc(mount_t)
rpc_stub(mount_t)
@ -74238,7 +74334,7 @@ index 15832c7..b90b726 100644
')
optional_policy(`
@@ -181,6 +250,28 @@ optional_policy(`
@@ -181,6 +251,28 @@ optional_policy(`
')
optional_policy(`
@ -74267,7 +74363,7 @@ index 15832c7..b90b726 100644
ifdef(`hide_broken_symptoms',`
# for a bug in the X server
rhgb_dontaudit_rw_stream_sockets(mount_t)
@@ -188,21 +279,87 @@ optional_policy(`
@@ -188,21 +280,87 @@ optional_policy(`
')
')

2
selinux-policy.spec
View File

@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.10.0
Release: 59%{?dist}
Release: 61%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz