rpms/selinux-policy
5
0
Fork 0
Code Issues Pull Requests Releases Activity

- Allow all user roles to executae samba net command

Browse Source
This commit is contained in:
Daniel J Walsh 2008-01-30 13:56:22 +00:00
parent 7c2be34d14
commit 0f70114e58
2 changed files with 122 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

161
policy-20071130.patch
View File

@ -972,7 +972,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.2.5/policy/modules/admin/rpm.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.2.5/policy/modules/admin/rpm.if
--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400 --- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400
+++ serefpolicy-3.2.5/policy/modules/admin/rpm.if 2008-01-18 12:40:46.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/admin/rpm.if 2008-01-29 10:17:11.000000000 -0500
@@ -152,6 +152,24 @@ @@ -152,6 +152,24 @@
######################################## ########################################
@ -1276,7 +1276,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te
java_domtrans(rpm_script_t) java_domtrans(rpm_script_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.2.5/policy/modules/admin/sudo.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.2.5/policy/modules/admin/sudo.if
--- nsaserefpolicy/policy/modules/admin/sudo.if 2007-12-04 11:02:51.000000000 -0500 --- nsaserefpolicy/policy/modules/admin/sudo.if 2007-12-04 11:02:51.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/admin/sudo.if 2008-01-18 12:40:46.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/admin/sudo.if 2008-01-29 16:49:45.000000000 -0500
@@ -55,7 +55,7 @@ @@ -55,7 +55,7 @@
# #
@ -1286,7 +1286,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
allow $1_sudo_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow $1_sudo_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow $1_sudo_t self:process { setexec setrlimit }; allow $1_sudo_t self:process { setexec setrlimit };
allow $1_sudo_t self:fd use; allow $1_sudo_t self:fd use;
@@ -68,27 +68,26 @@ @@ -68,33 +68,32 @@
allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms; allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms;
allow $1_sudo_t self:unix_dgram_socket sendto; allow $1_sudo_t self:unix_dgram_socket sendto;
allow $1_sudo_t self:unix_stream_socket connectto; allow $1_sudo_t self:unix_stream_socket connectto;
@ -1316,7 +1316,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
# sudo stores a token in the pam_pid directory # sudo stores a token in the pam_pid directory
auth_manage_pam_pid($1_sudo_t) auth_manage_pam_pid($1_sudo_t)
auth_use_nsswitch($1_sudo_t) auth_use_nsswitch($1_sudo_t)
@@ -106,12 +105,14 @@
corecmd_read_bin_symlinks($1_sudo_t)
- corecmd_getattr_all_executables($1_sudo_t)
+ corecmd_exec_all_executables($1_sudo_t)
domain_use_interactive_fds($1_sudo_t)
domain_sigchld_interactive_fds($1_sudo_t)
@@ -106,16 +105,20 @@
files_getattr_usr_files($1_sudo_t) files_getattr_usr_files($1_sudo_t)
# for some PAM modules and for cwd # for some PAM modules and for cwd
files_dontaudit_search_home($1_sudo_t) files_dontaudit_search_home($1_sudo_t)
@ -1331,7 +1338,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
logging_send_syslog_msg($1_sudo_t) logging_send_syslog_msg($1_sudo_t)
miscfiles_read_localization($1_sudo_t) miscfiles_read_localization($1_sudo_t)
@@ -125,13 +126,4 @@
+ mta_per_role_template($1, $1_sudo_t, $3)
+
userdom_manage_user_home_content_files($1,$1_sudo_t)
userdom_manage_user_home_content_symlinks($1,$1_sudo_t)
userdom_manage_user_tmp_files($1,$1_sudo_t)
@@ -125,13 +128,12 @@
# for some PAM modules and for cwd # for some PAM modules and for cwd
userdom_dontaudit_search_all_users_home_content($1_sudo_t) userdom_dontaudit_search_all_users_home_content($1_sudo_t)
@ -1344,6 +1357,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
- ') - ')
- -
- ') dnl end TODO - ') dnl end TODO
+ domain_role_change_exemption($1_sudo_t)
+ userdom_spec_domtrans_all_users($1_sudo_t)
+ selinux_validate_context($1_sudo_t)
+ selinux_compute_relabel_context($1_sudo_t)
+ term_use_all_user_ttys($1_sudo_t)
+ term_use_all_user_ptys($1_sudo_t)
+ term_relabel_all_user_ttys($1_sudo_t)
+ term_relabel_all_user_ptys($1_sudo_t)
') ')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.2.5/policy/modules/admin/su.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.2.5/policy/modules/admin/su.if
--- nsaserefpolicy/policy/modules/admin/su.if 2007-10-12 08:56:09.000000000 -0400 --- nsaserefpolicy/policy/modules/admin/su.if 2007-10-12 08:56:09.000000000 -0400
@ -4777,7 +4798,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
+ +
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-3.2.5/policy/modules/kernel/corecommands.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-3.2.5/policy/modules/kernel/corecommands.if
--- nsaserefpolicy/policy/modules/kernel/corecommands.if 2007-11-14 08:17:58.000000000 -0500 --- nsaserefpolicy/policy/modules/kernel/corecommands.if 2007-11-14 08:17:58.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/kernel/corecommands.if 2008-01-18 12:40:46.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/kernel/corecommands.if 2008-01-29 16:49:06.000000000 -0500
@@ -875,6 +875,7 @@ @@ -875,6 +875,7 @@
read_lnk_files_pattern($1,bin_t,bin_t) read_lnk_files_pattern($1,bin_t,bin_t)
@ -8076,7 +8097,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons
+/var/log/ConsoleKit(/.*)? gen_context(system_u:object_r:consolekit_var_run_t,s0) +/var/log/ConsoleKit(/.*)? gen_context(system_u:object_r:consolekit_var_run_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.2.5/policy/modules/services/consolekit.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.2.5/policy/modules/services/consolekit.te
--- nsaserefpolicy/policy/modules/services/consolekit.te 2007-12-19 05:32:17.000000000 -0500 --- nsaserefpolicy/policy/modules/services/consolekit.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/services/consolekit.te 2008-01-28 11:46:35.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/services/consolekit.te 2008-01-29 13:05:07.000000000 -0500
@@ -13,6 +13,9 @@ @@ -13,6 +13,9 @@
type consolekit_var_run_t; type consolekit_var_run_t;
files_pid_file(consolekit_var_run_t) files_pid_file(consolekit_var_run_t)
@ -8131,7 +8152,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons
hal_dbus_chat(consolekit_t) hal_dbus_chat(consolekit_t)
optional_policy(` optional_policy(`
@@ -67,3 +86,14 @@ @@ -64,6 +83,21 @@
')
optional_policy(`
+ polkit_domtrans_auth(consolekit_t)
+')
+
+optional_policy(`
xserver_read_all_users_xauth(consolekit_t) xserver_read_all_users_xauth(consolekit_t)
xserver_stream_connect_xdm_xserver(consolekit_t) xserver_stream_connect_xdm_xserver(consolekit_t)
') ')
@ -9443,7 +9471,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru
# Local policy # Local policy
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.5/policy/modules/services/dbus.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.5/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500 --- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/services/dbus.if 2008-01-25 14:07:09.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/services/dbus.if 2008-01-29 10:21:26.000000000 -0500
@@ -53,6 +53,7 @@ @@ -53,6 +53,7 @@
gen_require(` gen_require(`
type system_dbusd_exec_t, system_dbusd_t, dbusd_etc_t; type system_dbusd_exec_t, system_dbusd_t, dbusd_etc_t;
@ -9666,7 +9694,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.2.5/policy/modules/services/dbus.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.2.5/policy/modules/services/dbus.te
--- nsaserefpolicy/policy/modules/services/dbus.te 2007-12-19 05:32:17.000000000 -0500 --- nsaserefpolicy/policy/modules/services/dbus.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/services/dbus.te 2008-01-18 14:09:36.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/services/dbus.te 2008-01-29 10:21:10.000000000 -0500
@@ -9,6 +9,7 @@ @@ -9,6 +9,7 @@
# #
# Delcarations # Delcarations
@ -9675,6 +9703,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
type dbusd_etc_t alias etc_dbusd_t; type dbusd_etc_t alias etc_dbusd_t;
files_type(dbusd_etc_t) files_type(dbusd_etc_t)
@@ -21,7 +22,7 @@
files_tmp_file(system_dbusd_tmp_t)
type system_dbusd_var_lib_t;
-files_pid_file(system_dbusd_var_lib_t)
+files_type(system_dbusd_var_lib_t)
type system_dbusd_var_run_t;
files_pid_file(system_dbusd_var_run_t)
@@ -65,6 +66,7 @@ @@ -65,6 +66,7 @@
fs_getattr_all_fs(system_dbusd_t) fs_getattr_all_fs(system_dbusd_t)
@ -9952,8 +9989,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.2.5/policy/modules/services/dhcp.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.2.5/policy/modules/services/dhcp.te
--- nsaserefpolicy/policy/modules/services/dhcp.te 2007-12-19 05:32:17.000000000 -0500 --- nsaserefpolicy/policy/modules/services/dhcp.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/services/dhcp.te 2008-01-18 12:40:46.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/services/dhcp.te 2008-01-29 08:02:57.000000000 -0500
@@ -19,6 +19,9 @@ @@ -19,18 +19,20 @@
type dhcpd_var_run_t; type dhcpd_var_run_t;
files_pid_file(dhcpd_var_run_t) files_pid_file(dhcpd_var_run_t)
@ -9963,7 +10000,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp
######################################## ########################################
# #
# Local policy # Local policy
@@ -30,7 +33,6 @@ #
-allow dhcpd_t self:capability net_raw;
+allow dhcpd_t self:capability { net_raw sys_resource };
dontaudit dhcpd_t self:capability { net_admin sys_tty_config };
allow dhcpd_t self:process signal_perms;
allow dhcpd_t self:fifo_file { read write getattr }; allow dhcpd_t self:fifo_file { read write getattr };
allow dhcpd_t self:unix_dgram_socket create_socket_perms; allow dhcpd_t self:unix_dgram_socket create_socket_perms;
allow dhcpd_t self:unix_stream_socket create_socket_perms; allow dhcpd_t self:unix_stream_socket create_socket_perms;
@ -11986,7 +12028,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail
## <param name="domain"> ## <param name="domain">
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.2.5/policy/modules/services/mailman.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.2.5/policy/modules/services/mailman.te
--- nsaserefpolicy/policy/modules/services/mailman.te 2007-12-19 05:32:17.000000000 -0500 --- nsaserefpolicy/policy/modules/services/mailman.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/services/mailman.te 2008-01-18 12:40:46.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/services/mailman.te 2008-01-29 09:37:11.000000000 -0500
@@ -53,10 +53,9 @@ @@ -53,10 +53,9 @@
apache_use_fds(mailman_cgi_t) apache_use_fds(mailman_cgi_t)
apache_dontaudit_append_log(mailman_cgi_t) apache_dontaudit_append_log(mailman_cgi_t)
@ -12000,11 +12042,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail
') ')
######################################## ########################################
@@ -65,6 +64,10 @@ @@ -65,6 +64,11 @@
# #
allow mailman_mail_t self:unix_dgram_socket create_socket_perms; allow mailman_mail_t self:unix_dgram_socket create_socket_perms;
+allow mailman_mail_t initrc_t:process signal; +allow mailman_mail_t initrc_t:process signal;
+allow mailman_mail_t self:process signal;
+allow mailman_mail_t self:capability { setuid setgid }; +allow mailman_mail_t self:capability { setuid setgid };
+ +
+files_search_spool(mailman_mail_t) +files_search_spool(mailman_mail_t)
@ -13950,7 +13993,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polk
+/var/lib/PolicyKit-public(/.*)? gen_context(system_u:object_r:polkit_var_lib_t,s0) +/var/lib/PolicyKit-public(/.*)? gen_context(system_u:object_r:polkit_var_lib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.if serefpolicy-3.2.5/policy/modules/services/polkit.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.if serefpolicy-3.2.5/policy/modules/services/polkit.if
--- nsaserefpolicy/policy/modules/services/polkit.if 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/services/polkit.if 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/services/polkit.if 2008-01-18 12:40:46.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/services/polkit.if 2008-01-29 13:04:40.000000000 -0500
@@ -0,0 +1,59 @@ @@ -0,0 +1,59 @@
+ +
+## <summary>policy for polkit_auth</summary> +## <summary>policy for polkit_auth</summary>
@ -14946,7 +14989,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc
+/var/log/procmail(/.*)? gen_context(system_u:object_r:procmail_log_t,s0) +/var/log/procmail(/.*)? gen_context(system_u:object_r:procmail_log_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.if serefpolicy-3.2.5/policy/modules/services/procmail.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.if serefpolicy-3.2.5/policy/modules/services/procmail.if
--- nsaserefpolicy/policy/modules/services/procmail.if 2007-01-02 12:57:43.000000000 -0500 --- nsaserefpolicy/policy/modules/services/procmail.if 2007-01-02 12:57:43.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/services/procmail.if 2008-01-18 12:40:46.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/services/procmail.if 2008-01-28 15:44:39.000000000 -0500
@@ -39,3 +39,22 @@ @@ -39,3 +39,22 @@
corecmd_search_bin($1) corecmd_search_bin($1)
can_exec($1,procmail_exec_t) can_exec($1,procmail_exec_t)
@ -16471,7 +16514,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
+ +
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.2.5/policy/modules/services/samba.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.2.5/policy/modules/services/samba.te
--- nsaserefpolicy/policy/modules/services/samba.te 2007-12-19 05:32:17.000000000 -0500 --- nsaserefpolicy/policy/modules/services/samba.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/services/samba.te 2008-01-18 12:40:46.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/services/samba.te 2008-01-28 14:28:32.000000000 -0500
@@ -26,28 +26,28 @@ @@ -26,28 +26,28 @@
## <desc> ## <desc>
@ -16505,7 +16548,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
## </p> ## </p>
## </desc> ## </desc>
gen_tunable(samba_run_unconfined,false) gen_tunable(samba_run_unconfined,false)
@@ -139,6 +139,14 @@ @@ -73,11 +73,9 @@
logging_log_file(samba_log_t)
type samba_net_t;
-domain_type(samba_net_t)
-role system_r types samba_net_t;
-
type samba_net_exec_t;
-domain_entry_file(samba_net_t,samba_net_exec_t)
+role system_r types samba_net_t;
+application_domain(samba_net_t, samba_net_exec_t)
type samba_net_tmp_t;
files_tmp_file(samba_net_tmp_t)
@@ -139,6 +137,14 @@
type winbind_var_run_t; type winbind_var_run_t;
files_pid_file(winbind_var_run_t) files_pid_file(winbind_var_run_t)
@ -16520,7 +16577,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
######################################## ########################################
# #
# Samba net local policy # Samba net local policy
@@ -193,6 +201,8 @@ @@ -193,6 +199,8 @@
miscfiles_read_localization(samba_net_t) miscfiles_read_localization(samba_net_t)
@ -16529,7 +16586,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
userdom_dontaudit_search_sysadm_home_dirs(samba_net_t) userdom_dontaudit_search_sysadm_home_dirs(samba_net_t)
optional_policy(` optional_policy(`
@@ -213,7 +223,7 @@ @@ -213,7 +221,7 @@
allow smbd_t self:msgq create_msgq_perms; allow smbd_t self:msgq create_msgq_perms;
allow smbd_t self:sem create_sem_perms; allow smbd_t self:sem create_sem_perms;
allow smbd_t self:shm create_shm_perms; allow smbd_t self:shm create_shm_perms;
@ -16538,7 +16595,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
allow smbd_t self:tcp_socket create_stream_socket_perms; allow smbd_t self:tcp_socket create_stream_socket_perms;
allow smbd_t self:udp_socket create_socket_perms; allow smbd_t self:udp_socket create_socket_perms;
allow smbd_t self:unix_dgram_socket { create_socket_perms sendto }; allow smbd_t self:unix_dgram_socket { create_socket_perms sendto };
@@ -221,10 +231,8 @@ @@ -221,10 +229,8 @@
allow smbd_t samba_etc_t:file { rw_file_perms setattr }; allow smbd_t samba_etc_t:file { rw_file_perms setattr };
@ -16551,7 +16608,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
allow smbd_t samba_net_tmp_t:file getattr; allow smbd_t samba_net_tmp_t:file getattr;
@@ -234,6 +242,7 @@ @@ -234,6 +240,7 @@
manage_dirs_pattern(smbd_t,samba_share_t,samba_share_t) manage_dirs_pattern(smbd_t,samba_share_t,samba_share_t)
manage_files_pattern(smbd_t,samba_share_t,samba_share_t) manage_files_pattern(smbd_t,samba_share_t,samba_share_t)
manage_lnk_files_pattern(smbd_t,samba_share_t,samba_share_t) manage_lnk_files_pattern(smbd_t,samba_share_t,samba_share_t)
@ -16559,7 +16616,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
manage_dirs_pattern(smbd_t,samba_var_t,samba_var_t) manage_dirs_pattern(smbd_t,samba_var_t,samba_var_t)
manage_files_pattern(smbd_t,samba_var_t,samba_var_t) manage_files_pattern(smbd_t,samba_var_t,samba_var_t)
@@ -251,7 +260,7 @@ @@ -251,7 +258,7 @@
manage_sock_files_pattern(smbd_t,smbd_var_run_t,smbd_var_run_t) manage_sock_files_pattern(smbd_t,smbd_var_run_t,smbd_var_run_t)
files_pid_filetrans(smbd_t,smbd_var_run_t,file) files_pid_filetrans(smbd_t,smbd_var_run_t,file)
@ -16568,7 +16625,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
kernel_getattr_core_if(smbd_t) kernel_getattr_core_if(smbd_t)
kernel_getattr_message_if(smbd_t) kernel_getattr_message_if(smbd_t)
@@ -340,6 +349,17 @@ @@ -340,6 +347,17 @@
tunable_policy(`samba_share_nfs',` tunable_policy(`samba_share_nfs',`
fs_manage_nfs_dirs(smbd_t) fs_manage_nfs_dirs(smbd_t)
fs_manage_nfs_files(smbd_t) fs_manage_nfs_files(smbd_t)
@ -16586,7 +16643,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
') ')
optional_policy(` optional_policy(`
@@ -391,7 +411,7 @@ @@ -391,7 +409,7 @@
allow nmbd_t self:msgq create_msgq_perms; allow nmbd_t self:msgq create_msgq_perms;
allow nmbd_t self:sem create_sem_perms; allow nmbd_t self:sem create_sem_perms;
allow nmbd_t self:shm create_shm_perms; allow nmbd_t self:shm create_shm_perms;
@ -16595,7 +16652,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
allow nmbd_t self:tcp_socket create_stream_socket_perms; allow nmbd_t self:tcp_socket create_stream_socket_perms;
allow nmbd_t self:udp_socket create_socket_perms; allow nmbd_t self:udp_socket create_socket_perms;
allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto }; allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto };
@@ -403,8 +423,7 @@ @@ -403,8 +421,7 @@
read_files_pattern(nmbd_t,samba_etc_t,samba_etc_t) read_files_pattern(nmbd_t,samba_etc_t,samba_etc_t)
manage_dirs_pattern(nmbd_t,samba_log_t,samba_log_t) manage_dirs_pattern(nmbd_t,samba_log_t,samba_log_t)
@ -16605,7 +16662,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
read_files_pattern(nmbd_t,samba_log_t,samba_log_t) read_files_pattern(nmbd_t,samba_log_t,samba_log_t)
create_files_pattern(nmbd_t,samba_log_t,samba_log_t) create_files_pattern(nmbd_t,samba_log_t,samba_log_t)
@@ -439,6 +458,7 @@ @@ -439,6 +456,7 @@
dev_getattr_mtrr_dev(nmbd_t) dev_getattr_mtrr_dev(nmbd_t)
fs_getattr_all_fs(nmbd_t) fs_getattr_all_fs(nmbd_t)
@ -16613,7 +16670,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
fs_search_auto_mountpoints(nmbd_t) fs_search_auto_mountpoints(nmbd_t)
domain_use_interactive_fds(nmbd_t) domain_use_interactive_fds(nmbd_t)
@@ -522,6 +542,7 @@ @@ -522,6 +540,7 @@
storage_raw_write_fixed_disk(smbmount_t) storage_raw_write_fixed_disk(smbmount_t)
term_list_ptys(smbmount_t) term_list_ptys(smbmount_t)
@ -16621,7 +16678,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
corecmd_list_bin(smbmount_t) corecmd_list_bin(smbmount_t)
@@ -546,28 +567,37 @@ @@ -546,28 +565,37 @@
userdom_use_all_users_fds(smbmount_t) userdom_use_all_users_fds(smbmount_t)
@ -16666,7 +16723,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
allow swat_t smbd_var_run_t:file read; allow swat_t smbd_var_run_t:file read;
manage_dirs_pattern(swat_t,swat_tmp_t,swat_tmp_t) manage_dirs_pattern(swat_t,swat_tmp_t,swat_tmp_t)
@@ -577,7 +607,9 @@ @@ -577,7 +605,9 @@
manage_files_pattern(swat_t,swat_var_run_t,swat_var_run_t) manage_files_pattern(swat_t,swat_var_run_t,swat_var_run_t)
files_pid_filetrans(swat_t,swat_var_run_t,file) files_pid_filetrans(swat_t,swat_var_run_t,file)
@ -16677,7 +16734,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
kernel_read_kernel_sysctls(swat_t) kernel_read_kernel_sysctls(swat_t)
kernel_read_system_state(swat_t) kernel_read_system_state(swat_t)
@@ -602,6 +634,7 @@ @@ -602,6 +632,7 @@
dev_read_urand(swat_t) dev_read_urand(swat_t)
@ -16685,7 +16742,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
files_read_etc_files(swat_t) files_read_etc_files(swat_t)
files_search_home(swat_t) files_search_home(swat_t)
files_read_usr_files(swat_t) files_read_usr_files(swat_t)
@@ -614,6 +647,7 @@ @@ -614,6 +645,7 @@
libs_use_shared_libs(swat_t) libs_use_shared_libs(swat_t)
logging_send_syslog_msg(swat_t) logging_send_syslog_msg(swat_t)
@ -16693,7 +16750,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
logging_search_logs(swat_t) logging_search_logs(swat_t)
miscfiles_read_localization(swat_t) miscfiles_read_localization(swat_t)
@@ -631,6 +665,17 @@ @@ -631,6 +663,17 @@
kerberos_use(swat_t) kerberos_use(swat_t)
') ')
@ -16711,7 +16768,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
######################################## ########################################
# #
# Winbind local policy # Winbind local policy
@@ -679,6 +724,8 @@ @@ -679,6 +722,8 @@
manage_sock_files_pattern(winbind_t,winbind_var_run_t,winbind_var_run_t) manage_sock_files_pattern(winbind_t,winbind_var_run_t,winbind_var_run_t)
files_pid_filetrans(winbind_t,winbind_var_run_t,file) files_pid_filetrans(winbind_t,winbind_var_run_t,file)
@ -16720,7 +16777,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
kernel_read_kernel_sysctls(winbind_t) kernel_read_kernel_sysctls(winbind_t)
kernel_list_proc(winbind_t) kernel_list_proc(winbind_t)
kernel_read_proc_symlinks(winbind_t) kernel_read_proc_symlinks(winbind_t)
@@ -766,6 +813,7 @@ @@ -766,6 +811,7 @@
optional_policy(` optional_policy(`
squid_read_log(winbind_helper_t) squid_read_log(winbind_helper_t)
squid_append_log(winbind_helper_t) squid_append_log(winbind_helper_t)
@ -16728,7 +16785,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
') ')
######################################## ########################################
@@ -790,3 +838,37 @@ @@ -790,3 +836,37 @@
domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t) domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t)
') ')
') ')
@ -20678,7 +20735,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zebr
optional_policy(` optional_policy(`
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.2.5/policy/modules/system/authlogin.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.2.5/policy/modules/system/authlogin.fc
--- nsaserefpolicy/policy/modules/system/authlogin.fc 2007-12-12 11:35:28.000000000 -0500 --- nsaserefpolicy/policy/modules/system/authlogin.fc 2007-12-12 11:35:28.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/system/authlogin.fc 2008-01-18 12:40:46.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/system/authlogin.fc 2008-01-29 16:36:06.000000000 -0500
@@ -29,7 +29,6 @@ @@ -29,7 +29,6 @@
/var/db/shadow.* -- gen_context(system_u:object_r:shadow_t,s0) /var/db/shadow.* -- gen_context(system_u:object_r:shadow_t,s0)
@ -20687,8 +20744,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
/var/log/btmp.* -- gen_context(system_u:object_r:faillog_t,s0) /var/log/btmp.* -- gen_context(system_u:object_r:faillog_t,s0)
/var/log/dmesg -- gen_context(system_u:object_r:var_log_t,s0) /var/log/dmesg -- gen_context(system_u:object_r:var_log_t,s0)
@@ -42,3 +41,6 @@ @@ -40,5 +39,10 @@
/var/log/wtmp.* -- gen_context(system_u:object_r:wtmp_t,s0)
/var/run/console(/.*)? gen_context(system_u:object_r:pam_var_console_t,s0) /var/run/console(/.*)? gen_context(system_u:object_r:pam_var_console_t,s0)
+/var/run/pam_mount(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
+/var/run/sepermit(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
/var/run/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0) /var/run/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
+/var/run/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0) +/var/run/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
@ -21512,6 +21573,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
dev_read_urand(racoon_t) dev_read_urand(racoon_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.2.5/policy/modules/system/iscsi.te
--- nsaserefpolicy/policy/modules/system/iscsi.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/system/iscsi.te 2008-01-29 09:44:07.000000000 -0500
@@ -29,7 +29,7 @@
#
allow iscsid_t self:capability { dac_override ipc_lock net_admin sys_nice sys_resource };
-allow iscsid_t self:process setsched;
+allow iscsid_t self:process { setrlimit setsched };
allow iscsid_t self:fifo_file { read write };
allow iscsid_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow iscsid_t self:unix_dgram_socket create_socket_perms;
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.2.5/policy/modules/system/libraries.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.2.5/policy/modules/system/libraries.fc
--- nsaserefpolicy/policy/modules/system/libraries.fc 2007-12-12 11:35:28.000000000 -0500 --- nsaserefpolicy/policy/modules/system/libraries.fc 2007-12-12 11:35:28.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/system/libraries.fc 2008-01-18 12:40:46.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/system/libraries.fc 2008-01-18 12:40:46.000000000 -0500
@ -22119,12 +22192,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti
################################# #################################
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.2.5/policy/modules/system/mount.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.2.5/policy/modules/system/mount.fc
--- nsaserefpolicy/policy/modules/system/mount.fc 2006-11-16 17:15:24.000000000 -0500 --- nsaserefpolicy/policy/modules/system/mount.fc 2006-11-16 17:15:24.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/system/mount.fc 2008-01-18 12:40:46.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/system/mount.fc 2008-01-29 09:05:12.000000000 -0500
@@ -1,4 +1,3 @@ @@ -1,4 +1,5 @@
/bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
/bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
- -
-/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) -/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0)
+/sbin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
+/sbin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
+/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) +/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.2.5/policy/modules/system/mount.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.2.5/policy/modules/system/mount.te
--- nsaserefpolicy/policy/modules/system/mount.te 2007-12-19 05:32:17.000000000 -0500 --- nsaserefpolicy/policy/modules/system/mount.te 2007-12-19 05:32:17.000000000 -0500
@ -22597,7 +22672,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.2.5/policy/modules/system/selinuxutil.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.2.5/policy/modules/system/selinuxutil.te
--- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-12-19 05:32:17.000000000 -0500 --- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/system/selinuxutil.te 2008-01-21 15:06:00.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/system/selinuxutil.te 2008-01-29 15:11:06.000000000 -0500
@@ -75,7 +75,6 @@ @@ -75,7 +75,6 @@
type restorecond_exec_t; type restorecond_exec_t;
init_daemon_domain(restorecond_t,restorecond_exec_t) init_daemon_domain(restorecond_t,restorecond_exec_t)
@ -26908,7 +26983,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.i
+## <summary>Policy for staff user</summary> +## <summary>Policy for staff user</summary>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.te serefpolicy-3.2.5/policy/modules/users/staff.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.te serefpolicy-3.2.5/policy/modules/users/staff.te
--- nsaserefpolicy/policy/modules/users/staff.te 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/users/staff.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/users/staff.te 2008-01-24 16:05:12.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/users/staff.te 2008-01-29 15:10:46.000000000 -0500
@@ -0,0 +1,47 @@ @@ -0,0 +1,47 @@
+policy_module(staff,1.0.1) +policy_module(staff,1.0.1)
+userdom_unpriv_user_template(staff) +userdom_unpriv_user_template(staff)

5
selinux-policy.spec
View File

@ -17,7 +17,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.2.5 Version: 3.2.5
Release: 20%{?dist} Release: 21%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -387,6 +387,9 @@ exit 0
%endif %endif
%changelog %changelog
* Mon Jan 28 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-21
- Allow all user roles to executae samba net command
* Fri Jan 25 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-20 * Fri Jan 25 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-20
- Allow usertypes to read/write noxattr file systems - Allow usertypes to read/write noxattr file systems