- Update to upstream
This commit is contained in:
Daniel J Walsh
parent
30a020fcb8
commit
129ba16c5a
@ -28,3 +28,4 @@ serefpolicy-2.1.11.tgz
|
||||
serefpolicy-2.1.12.tgz
|
||||
serefpolicy-2.1.13.tgz
|
||||
serefpolicy-2.2.2.tgz
|
||||
serefpolicy-2.2.4.tgz
|
||||
|
||||
208
booleans-strict.conf
Normal file
208
booleans-strict.conf
Normal file
@ -0,0 +1,208 @@
|
||||
# Allow making anonymous memory executable, e.g.for runtime-code generation or executable stack.
|
||||
#
|
||||
allow_execmem = false
|
||||
|
||||
# Allow making a modified private filemapping executable (text relocation).
|
||||
#
|
||||
allow_execmod = false
|
||||
|
||||
# Allow making the stack executable via mprotect.Also requires allow_execmem.
|
||||
#
|
||||
allow_execstack = false
|
||||
|
||||
# Allow ftp servers to modify public filesused for public file transfer services.
|
||||
#
|
||||
allow_ftpd_anon_write = false
|
||||
|
||||
# Allow gssd to read temp directory.
|
||||
#
|
||||
allow_gssd_read_tmp = false
|
||||
|
||||
# Allow Apache to modify public filesused for public file transfer services.
|
||||
#
|
||||
allow_httpd_anon_write = false
|
||||
|
||||
# Allow system to run with kerberos
|
||||
#
|
||||
allow_kerberos = true
|
||||
|
||||
# Allow rsync to modify public filesused for public file transfer services.
|
||||
#
|
||||
allow_rsync_anon_write = false
|
||||
|
||||
# Allow sasl to read shadow
|
||||
#
|
||||
allow_saslauthd_read_shadow = false
|
||||
|
||||
# Allow samba to modify public filesused for public file transfer services.
|
||||
#
|
||||
allow_smbd_anon_write = false
|
||||
|
||||
# Allow sysadm to ptrace all processes
|
||||
#
|
||||
allow_ptrace = false
|
||||
|
||||
# Allow system to run with NIS
|
||||
#
|
||||
allow_ypbind = false
|
||||
|
||||
# Enable extra rules in the cron domainto support fcron.
|
||||
#
|
||||
fcron_crond = false
|
||||
|
||||
# Allow ftp to read and write files in the user home directories
|
||||
#
|
||||
ftp_home_dir = false
|
||||
|
||||
# Allow ftpd to run directly without inetd
|
||||
#
|
||||
ftpd_is_daemon = true
|
||||
|
||||
# Allow httpd to use built in scripting (usually php)
|
||||
#
|
||||
httpd_builtin_scripting = false
|
||||
|
||||
# Allow http daemon to tcp connect
|
||||
#
|
||||
httpd_can_network_connect = false
|
||||
|
||||
# Allow httpd cgi support
|
||||
#
|
||||
httpd_enable_cgi = false
|
||||
|
||||
# Allow httpd to act as a FTP server bylistening on the ftp port.
|
||||
#
|
||||
httpd_enable_ftp_server = false
|
||||
|
||||
# Allow httpd to read home directories
|
||||
#
|
||||
httpd_enable_homedirs = false
|
||||
|
||||
# Run SSI execs in system CGI script domain.
|
||||
#
|
||||
httpd_ssi_exec = false
|
||||
|
||||
# Allow http daemon to communicate with the TTY
|
||||
#
|
||||
httpd_tty_comm = false
|
||||
|
||||
# Run CGI in the main httpd domain
|
||||
#
|
||||
httpd_unified = false
|
||||
|
||||
# Allow BIND to write the master zone files.Generally this is used for dynamic DNS.
|
||||
#
|
||||
named_write_master_zones = false
|
||||
|
||||
# Allow nfs to be exported read/write.
|
||||
#
|
||||
nfs_export_all_rw = false
|
||||
|
||||
# Allow nfs to be exported read only
|
||||
#
|
||||
nfs_export_all_ro = false
|
||||
|
||||
# Allow pppd to load kernel modules for certain modems
|
||||
#
|
||||
pppd_can_insmod = false
|
||||
|
||||
# Allow reading of default_t files.
|
||||
#
|
||||
read_default_t = false
|
||||
|
||||
# Allow ssh to run from inetd instead of as a daemon.
|
||||
#
|
||||
run_ssh_inetd = false
|
||||
|
||||
# Allow samba to export user home directories.
|
||||
#
|
||||
samba_enable_home_dirs = false
|
||||
|
||||
# Allow squid to connect to all ports, not justHTTP, FTP, and Gopher ports.
|
||||
#
|
||||
squid_connect_any = false
|
||||
|
||||
# Allow ssh logins as sysadm_r:sysadm_t
|
||||
#
|
||||
ssh_sysadm_login = false
|
||||
|
||||
# Configure stunnel to be a standalone daemon orinetd service.
|
||||
#
|
||||
stunnel_is_daemon = false
|
||||
|
||||
# Support NFS home directories
|
||||
#
|
||||
use_nfs_home_dirs = false
|
||||
|
||||
# Support SAMBA home directories
|
||||
#
|
||||
use_samba_home_dirs = false
|
||||
|
||||
# Control users use of ping and traceroute
|
||||
#
|
||||
user_ping = false
|
||||
|
||||
# Allow gpg executable stack
|
||||
#
|
||||
allow_gpg_execstack = false
|
||||
|
||||
# allow host key based authentication
|
||||
#
|
||||
allow_ssh_keysign = false
|
||||
|
||||
# Allow users to connect to mysql
|
||||
#
|
||||
allow_user_mysql_connect = false
|
||||
|
||||
# Allow system cron jobs to relabel filesystemfor restoring file contexts.
|
||||
#
|
||||
cron_can_relabel = false
|
||||
|
||||
# Allow pppd to be run for a regular user
|
||||
#
|
||||
pppd_for_user = false
|
||||
|
||||
# Allow applications to read untrusted contentIf this is disallowed, Internet content hasto be manually relabeled for read access to be granted
|
||||
#
|
||||
read_untrusted_content = false
|
||||
|
||||
# Allow user spamassassin clients to use the network.
|
||||
#
|
||||
spamassassin_can_network = false
|
||||
|
||||
# Allow staff_r users to search the sysadm homedir and read files (such as ~/.bashrc)
|
||||
#
|
||||
staff_read_sysadm_file = false
|
||||
|
||||
# Allow regular users direct mouse access
|
||||
#
|
||||
user_direct_mouse = false
|
||||
|
||||
# Allow users to read system messages.
|
||||
#
|
||||
user_dmesg = false
|
||||
|
||||
# Allow users to control network interfaces(also needs USERCTL=true)
|
||||
#
|
||||
user_net_control = false
|
||||
|
||||
# Allow user to r/w files on filesystemsthat do not have extended attributes (FAT, CDROM, FLOPPY)
|
||||
#
|
||||
user_rw_noexattrfile = false
|
||||
|
||||
# Allow users to rw usb devices
|
||||
#
|
||||
user_rw_usb = false
|
||||
|
||||
# Allow users to run TCP servers (bind to ports and accept connection fromthe same domain and outside users) disabling this forces FTP passive modeand may change other protocols.
|
||||
#
|
||||
user_tcp_server = false
|
||||
|
||||
# Allow w to display everyone
|
||||
#
|
||||
user_ttyfile_stat = false
|
||||
|
||||
# Allow applications to write untrusted contentIf this is disallowed, no Internet contentwill be stored.
|
||||
#
|
||||
write_untrusted_content = false
|
||||
|
||||
1129
modules-strict.conf
Normal file
1129
modules-strict.conf
Normal file
File diff suppressed because it is too large
Load Diff
@ -188,7 +188,7 @@ logrotate = base
|
||||
#
|
||||
# ddcprobe retrieves monitor and graphics card information
|
||||
#
|
||||
ddcprobe = module
|
||||
ddcprobe = off
|
||||
|
||||
# Layer: admin
|
||||
# Module: quota
|
||||
@ -216,7 +216,7 @@ sudo = off
|
||||
#
|
||||
# run real-mode video BIOS code to alter hardware state
|
||||
#
|
||||
vbetool = module
|
||||
vbetool = off
|
||||
|
||||
# Layer: admin
|
||||
# Module: firstboot
|
||||
@ -329,7 +329,7 @@ canna = base
|
||||
#
|
||||
# IIIMF htt server
|
||||
#
|
||||
i18n_input = module
|
||||
i18n_input = off
|
||||
|
||||
# Layer: services
|
||||
# Module: uucp
|
||||
@ -394,7 +394,7 @@ howl = base
|
||||
#
|
||||
# MIDI to WAV converter and player configured as a service
|
||||
#
|
||||
timidity = module
|
||||
timidity = off
|
||||
|
||||
# Layer: services
|
||||
# Module: postgresql
|
||||
@ -408,7 +408,7 @@ postgresql = base
|
||||
#
|
||||
# Service for handling smart card readers.
|
||||
#
|
||||
openct = module
|
||||
openct = off
|
||||
|
||||
# Layer: services
|
||||
# Module: snmp
|
||||
@ -605,7 +605,7 @@ ppp = base
|
||||
#
|
||||
# Smart disk monitoring daemon policy
|
||||
#
|
||||
smartmon = module
|
||||
smartmon = off
|
||||
|
||||
# Layer: services
|
||||
# Module: ftp
|
||||
@ -689,7 +689,7 @@ apache = base
|
||||
#
|
||||
# Service for downloading news feeds the slrn newsreader.
|
||||
#
|
||||
slrnpull = module
|
||||
slrnpull = off
|
||||
|
||||
# Layer: services
|
||||
# Module: rsync
|
||||
|
||||
@ -1,12 +1,11 @@
|
||||
%define distro redhat
|
||||
%define direct_initrc y
|
||||
%define monolithic n
|
||||
%define POLICYVER 20
|
||||
%define POLICYCOREUTILSVER 1.29.5-1
|
||||
%define CHECKPOLICYVER 1.28-3
|
||||
Summary: SELinux policy configuration
|
||||
Name: selinux-policy
|
||||
Version: 2.2.2
|
||||
Version: 2.2.4
|
||||
Release: 1
|
||||
License: GPL
|
||||
Group: System Environment/Base
|
||||
@ -20,6 +19,10 @@ Source5: modules-mls.conf
|
||||
Source6: booleans-mls.conf
|
||||
Source7: seusers-mls
|
||||
Source8: setrans-mls.conf
|
||||
Source9: modules-strict.conf
|
||||
Source10: booleans-strict.conf
|
||||
Source11: seusers-strict
|
||||
Source12: setrans-strict.conf
|
||||
|
||||
Url: http://serefpolicy.sourceforge.net
|
||||
BuildRoot: %{_tmppath}/serefpolicy-buildroot
|
||||
@ -61,10 +64,6 @@ make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic}
|
||||
make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} enableaudit \
|
||||
make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} base.pp \
|
||||
install -m0644 base.pp ${RPM_BUILD_ROOT}%{_usr}/share/selinux/%1/enableaudit.pp \
|
||||
for file in $(ls ${RPM_BUILD_ROOT}%{_usr}/share/selinux/%1 | grep -v -e base.pp -e enableaudit.pp ) \
|
||||
do \
|
||||
rm ${RPM_BUILD_ROOT}%{_usr}/share/selinux/%1/$file; \
|
||||
done; \
|
||||
rm -rf $RPM_BUILD_ROOT%{_sysconfdir}/selinux/%1/booleans \
|
||||
touch $RPM_BUILD_ROOT%{_sysconfdir}/selinux/config \
|
||||
touch $RPM_BUILD_ROOT%{_sysconfdir}/selinux/%1/seusers \
|
||||
@ -80,8 +79,7 @@ install -m0644 ${RPM_SOURCE_DIR}/setrans-%1.conf ${RPM_BUILD_ROOT}%{_sysconfdir}
|
||||
%defattr(-,root,root) \
|
||||
%dir %{_usr}/share/selinux \
|
||||
%dir %{_usr}/share/selinux/%1 \
|
||||
%{_usr}/share/selinux/%1/base.pp \
|
||||
%{_usr}/share/selinux/%1/enableaudit.pp \
|
||||
%{_usr}/share/selinux/%1/*.pp \
|
||||
%dir %{_sysconfdir}/selinux \
|
||||
%ghost %config(noreplace) %{_sysconfdir}/selinux/config \
|
||||
%dir %{_sysconfdir}/selinux/%1 \
|
||||
@ -146,7 +144,19 @@ make conf
|
||||
mkdir -p ${RPM_BUILD_ROOT}%{_mandir}/man8/
|
||||
install -m 644 man/man8/*.8 ${RPM_BUILD_ROOT}%{_mandir}/man8/
|
||||
|
||||
%installCmds targeted targeted-mcs %{direct_initrc}
|
||||
|
||||
|
||||
# Build targeted policy
|
||||
# Commented out because only targeted ref policy currently builds
|
||||
make clean
|
||||
make conf
|
||||
%installCmds targeted targeted-mcs y
|
||||
|
||||
# Build strict policy
|
||||
# Commented out because only targeted ref policy currently builds
|
||||
make clean
|
||||
make conf
|
||||
%installCmds strict strict-mcs y
|
||||
|
||||
# Build mls policy
|
||||
make clean
|
||||
@ -154,12 +164,6 @@ make conf
|
||||
%installCmds mls strict-mls n
|
||||
|
||||
|
||||
# Build strict policy
|
||||
# Commented out because only targeted ref policy currently builds
|
||||
# make clean
|
||||
# make conf
|
||||
#%#installCmds strict strict-mcs %{direct_initrc}
|
||||
|
||||
%clean
|
||||
%{__rm} -fR $RPM_BUILD_ROOT
|
||||
|
||||
@ -233,7 +237,6 @@ SELinux Reference policy mls base module.
|
||||
%files mls
|
||||
%fileList mls
|
||||
|
||||
%if 0
|
||||
%package strict
|
||||
Summary: SELinux strict base policy
|
||||
Group: System Environment/Base
|
||||
@ -259,9 +262,14 @@ SELinux Reference policy strict base module.
|
||||
%files strict
|
||||
%fileList strict
|
||||
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Mon Jan 23 2006 Dan Walsh <dwalsh@redhat.com> 2.2.4-1
|
||||
- Update to upstream
|
||||
|
||||
* Wed Jan 18 2006 Dan Walsh <dwalsh@redhat.com> 2.2.3-1
|
||||
- Update to upstream
|
||||
- Fixes for booting and logging in on MLS machine
|
||||
|
||||
* Wed Jan 18 2006 Dan Walsh <dwalsh@redhat.com> 2.2.2-1
|
||||
- Update to upstream
|
||||
- Turn off execheap execstack for unconfined users
|
||||
|
||||
19
setrans-strict.conf
Normal file
19
setrans-strict.conf
Normal file
@ -0,0 +1,19 @@
|
||||
#
|
||||
# Multi-Category Security translation table for SELinux
|
||||
#
|
||||
# Uncomment the following to disable translation libary
|
||||
# disable=1
|
||||
#
|
||||
# Objects can be categorized with 0-256 categories defined by the admin.
|
||||
# Objects can be in more than one category at a time.
|
||||
# Categories are stored in the system as c0-c255. Users can use this
|
||||
# table to translate the categories into a more meaningful output.
|
||||
# Examples:
|
||||
# s0:c0=CompanyConfidential
|
||||
# s0:c1=PatientRecord
|
||||
# s0:c2=Unclassified
|
||||
# s0:c3=TopSecret
|
||||
# s0:c1,c3=CompanyConfidentialRedHat
|
||||
s0=
|
||||
s0-s0:c0.c255=SystemLow-SystemHigh
|
||||
s0:c0.c255=SystemHigh
|
||||
2
seusers-strict
Normal file
2
seusers-strict
Normal file
@ -0,0 +1,2 @@
|
||||
root:root:s0-s0:c0.c255
|
||||
__default__:user_u:s0
|
||||
Loading…
Reference in New Issue
Block a user