rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Allow rpm to chat with networkmanager

Browse Source
This commit is contained in:
Daniel J Walsh 2007-10-17 18:45:12 +00:00
parent b4ed6dbce0
commit 195d643241
1 changed files with 126 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

177
policy-20070703.patch
View File

@ -1613,7 +1613,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.0.8/policy/modules/admin/su.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.0.8/policy/modules/admin/su.if
--- nsaserefpolicy/policy/modules/admin/su.if 2007-08-22 07:14:14.000000000 -0400 --- nsaserefpolicy/policy/modules/admin/su.if 2007-08-22 07:14:14.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/admin/su.if 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/admin/su.if 2007-10-17 13:00:35.000000000 -0400
@@ -41,12 +41,11 @@ @@ -41,12 +41,11 @@
allow $2 $1_su_t:process signal; allow $2 $1_su_t:process signal;
@ -1654,7 +1654,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s
- allow $1_su_t self:capability { audit_control audit_write setuid setgid net_bind_service chown dac_override fowner sys_nice sys_resource }; - allow $1_su_t self:capability { audit_control audit_write setuid setgid net_bind_service chown dac_override fowner sys_nice sys_resource };
+ allow $1_su_t self:capability { setuid setgid net_bind_service chown dac_override fowner sys_nice sys_resource }; + allow $1_su_t self:capability { setuid setgid net_bind_service chown dac_override fowner sys_nice sys_resource };
dontaudit $1_su_t self:capability sys_tty_config; dontaudit $1_su_t self:capability sys_tty_config;
allow $1_su_t self:process { setexec setsched setrlimit }; - allow $1_su_t self:process { setexec setsched setrlimit };
+ allow $1_su_t self:process { getsched setexec setsched setrlimit };
allow $1_su_t self:fifo_file rw_fifo_file_perms; allow $1_su_t self:fifo_file rw_fifo_file_perms;
- allow $1_su_t self:netlink_audit_socket { nlmsg_relay create_netlink_socket_perms }; - allow $1_su_t self:netlink_audit_socket { nlmsg_relay create_netlink_socket_perms };
allow $1_su_t self:key { search write }; allow $1_su_t self:key { search write };
@ -1794,7 +1795,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool
') ')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.fc serefpolicy-3.0.8/policy/modules/admin/vpn.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.fc serefpolicy-3.0.8/policy/modules/admin/vpn.fc
--- nsaserefpolicy/policy/modules/admin/vpn.fc 2007-05-29 14:10:59.000000000 -0400 --- nsaserefpolicy/policy/modules/admin/vpn.fc 2007-05-29 14:10:59.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/admin/vpn.fc 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/admin/vpn.fc 2007-10-17 09:43:19.000000000 -0400
@@ -7,3 +7,5 @@ @@ -7,3 +7,5 @@
# sbin # sbin
# #
@ -1832,7 +1833,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.if
+ +
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te serefpolicy-3.0.8/policy/modules/admin/vpn.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te serefpolicy-3.0.8/policy/modules/admin/vpn.te
--- nsaserefpolicy/policy/modules/admin/vpn.te 2007-07-25 10:37:43.000000000 -0400 --- nsaserefpolicy/policy/modules/admin/vpn.te 2007-07-25 10:37:43.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/admin/vpn.te 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/admin/vpn.te 2007-10-17 10:38:01.000000000 -0400
@@ -22,7 +22,7 @@ @@ -22,7 +22,7 @@
# Local policy # Local policy
# #
@ -1842,7 +1843,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te
allow vpnc_t self:process getsched; allow vpnc_t self:process getsched;
allow vpnc_t self:fifo_file { getattr ioctl read write }; allow vpnc_t self:fifo_file { getattr ioctl read write };
allow vpnc_t self:netlink_route_socket rw_netlink_socket_perms; allow vpnc_t self:netlink_route_socket rw_netlink_socket_perms;
@@ -96,7 +96,7 @@ @@ -38,8 +38,9 @@
manage_files_pattern(vpnc_t,vpnc_tmp_t,vpnc_tmp_t)
files_tmp_filetrans(vpnc_t, vpnc_tmp_t, { file dir })
+manage_dirs_pattern(vpnc_t,vpnc_var_run_t,vpnc_var_run_t)
manage_files_pattern(vpnc_t,vpnc_var_run_t,vpnc_var_run_t)
-files_pid_filetrans(vpnc_t,vpnc_var_run_t,file)
+files_pid_filetrans(vpnc_t,vpnc_var_run_t,{ file dir})
kernel_read_system_state(vpnc_t)
kernel_read_network_state(vpnc_t)
@@ -96,7 +97,7 @@
seutil_dontaudit_search_config(vpnc_t) seutil_dontaudit_search_config(vpnc_t)
seutil_use_newrole_fds(vpnc_t) seutil_use_newrole_fds(vpnc_t)
@ -2813,17 +2825,30 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp
auth_search_pam_console_data($1_userhelper_t) auth_search_pam_console_data($1_userhelper_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.0.8/policy/modules/apps/vmware.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.0.8/policy/modules/apps/vmware.fc
--- nsaserefpolicy/policy/modules/apps/vmware.fc 2007-09-12 10:34:49.000000000 -0400 --- nsaserefpolicy/policy/modules/apps/vmware.fc 2007-09-12 10:34:49.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/apps/vmware.fc 2007-10-12 08:22:18.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/apps/vmware.fc 2007-10-17 14:12:11.000000000 -0400
@@ -30,10 +30,12 @@ @@ -21,19 +21,25 @@
/usr/bin/vmware-nmbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
/usr/bin/vmware-ping -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
/usr/bin/vmware-smbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
+/usr/sbin/vmware-guest.* -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
/usr/bin/vmware-smbpasswd -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
/usr/bin/vmware-smbpasswd\.bin -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
/usr/bin/vmware-vmx -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
/usr/bin/vmware-wizard -- gen_context(system_u:object_r:vmware_exec_t,s0)
/usr/bin/vmware -- gen_context(system_u:object_r:vmware_exec_t,s0)
+/usr/sbin/vmware-serverd -- gen_context(system_u:object_r:vmware_exec_t,s0)
/usr/lib/vmware/config -- gen_context(system_u:object_r:vmware_sys_conf_t,s0) /usr/lib/vmware/config -- gen_context(system_u:object_r:vmware_sys_conf_t,s0)
/usr/lib/vmware/bin/vmware-mks -- gen_context(system_u:object_r:vmware_exec_t,s0) /usr/lib/vmware/bin/vmware-mks -- gen_context(system_u:object_r:vmware_exec_t,s0)
/usr/lib/vmware/bin/vmware-ui -- gen_context(system_u:object_r:vmware_exec_t,s0) /usr/lib/vmware/bin/vmware-ui -- gen_context(system_u:object_r:vmware_exec_t,s0)
+/usr/lib/vmware/bin/vmplayer -- gen_context(system_u:object_r:vmware_exec_t,s0) +/usr/lib/vmware/bin/vmplayer -- gen_context(system_u:object_r:vmware_exec_t,s0)
+/usr/lib/vmware/bin/vmware-vmx -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
/usr/lib64/vmware/config -- gen_context(system_u:object_r:vmware_sys_conf_t,s0) /usr/lib64/vmware/config -- gen_context(system_u:object_r:vmware_sys_conf_t,s0)
/usr/lib64/vmware/bin/vmware-mks -- gen_context(system_u:object_r:vmware_exec_t,s0) /usr/lib64/vmware/bin/vmware-mks -- gen_context(system_u:object_r:vmware_exec_t,s0)
/usr/lib64/vmware/bin/vmware-ui -- gen_context(system_u:object_r:vmware_exec_t,s0) /usr/lib64/vmware/bin/vmware-ui -- gen_context(system_u:object_r:vmware_exec_t,s0)
+/usr/lib64/vmware/bin/vmplayer -- gen_context(system_u:object_r:vmware_exec_t,s0) +/usr/lib64/vmware/bin/vmplayer -- gen_context(system_u:object_r:vmware_exec_t,s0)
+/usr/lib64/vmware/bin/vmware-vmx -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
ifdef(`distro_gentoo',` ifdef(`distro_gentoo',`
/opt/vmware/workstation/bin/vmnet-bridge -- gen_context(system_u:object_r:vmware_host_exec_t,s0) /opt/vmware/workstation/bin/vmnet-bridge -- gen_context(system_u:object_r:vmware_host_exec_t,s0)
@ -4151,6 +4176,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin
fs_type(devpts_t) fs_type(devpts_t)
fs_use_trans devpts gen_context(system_u:object_r:devpts_t,s0); fs_use_trans devpts gen_context(system_u:object_r:devpts_t,s0);
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.0.8/policy/modules/services/amavis.te
--- nsaserefpolicy/policy/modules/services/amavis.te 2007-09-12 10:34:50.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/services/amavis.te 2007-10-17 10:28:41.000000000 -0400
@@ -65,6 +65,7 @@
# Spool Files
manage_dirs_pattern(amavis_t,amavis_spool_t,amavis_spool_t)
manage_files_pattern(amavis_t,amavis_spool_t,amavis_spool_t)
+manage_lnk_files_pattern(amavis_t,amavis_spool_t,amavis_spool_t)
manage_sock_files_pattern(amavis_t,amavis_spool_t,amavis_spool_t)
filetrans_pattern(amavis_t,amavis_spool_t,amavis_var_run_t,sock_file)
files_search_spool(amavis_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.0.8/policy/modules/services/apache.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.0.8/policy/modules/services/apache.fc
--- nsaserefpolicy/policy/modules/services/apache.fc 2007-05-29 14:10:57.000000000 -0400 --- nsaserefpolicy/policy/modules/services/apache.fc 2007-05-29 14:10:57.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/services/apache.fc 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/services/apache.fc 2007-10-03 11:10:24.000000000 -0400
@ -8068,7 +8104,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.8/policy/modules/services/networkmanager.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.8/policy/modules/services/networkmanager.te
--- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-09-12 10:34:50.000000000 -0400 --- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-09-12 10:34:50.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/services/networkmanager.te 2007-10-10 15:23:55.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/services/networkmanager.te 2007-10-17 14:21:59.000000000 -0400
@@ -13,6 +13,9 @@ @@ -13,6 +13,9 @@
type NetworkManager_var_run_t; type NetworkManager_var_run_t;
files_pid_file(NetworkManager_var_run_t) files_pid_file(NetworkManager_var_run_t)
@ -8116,7 +8152,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw
') ')
optional_policy(` optional_policy(`
@@ -173,8 +177,10 @@ @@ -162,6 +166,7 @@
ppp_domtrans(NetworkManager_t)
ppp_read_pid_files(NetworkManager_t)
ppp_signal(NetworkManager_t)
+ ppp_read_read_config(NetworkManager_t)
')
optional_policy(`
@@ -173,8 +178,10 @@
') ')
optional_policy(` optional_policy(`
@ -9029,6 +9073,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
######################################## ########################################
# #
# postgresql Local policy # postgresql Local policy
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.if serefpolicy-3.0.8/policy/modules/services/ppp.if
--- nsaserefpolicy/policy/modules/services/ppp.if 2007-05-29 14:10:57.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/services/ppp.if 2007-10-17 14:23:38.000000000 -0400
@@ -159,6 +159,25 @@
########################################
## <summary>
+## Read ppp configuration files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`ppp_read_read_config',`
+ gen_require(`
+ type pppd_etc_t;
+ ')
+
+ read_files_pattern($1, pppd_etc_t, pppd_etc_t)
+ files_search_etc($1)
+')
+
+########################################
+## <summary>
## Read PPP-writable configuration files.
## </summary>
## <param name="domain">
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.0.8/policy/modules/services/procmail.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.0.8/policy/modules/services/procmail.te
--- nsaserefpolicy/policy/modules/services/procmail.te 2007-07-25 10:37:42.000000000 -0400 --- nsaserefpolicy/policy/modules/services/procmail.te 2007-07-25 10:37:42.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/services/procmail.te 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/services/procmail.te 2007-10-03 11:10:24.000000000 -0400
@ -15299,7 +15372,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
/tmp/gconfd-USER -d gen_context(system_u:object_r:ROLE_tmp_t,s0) /tmp/gconfd-USER -d gen_context(system_u:object_r:ROLE_tmp_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.8/policy/modules/system/userdomain.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.8/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-08-27 09:18:17.000000000 -0400 --- nsaserefpolicy/policy/modules/system/userdomain.if 2007-08-27 09:18:17.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/system/userdomain.if 2007-10-12 11:59:04.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/system/userdomain.if 2007-10-17 13:10:23.000000000 -0400
@@ -29,8 +29,9 @@ @@ -29,8 +29,9 @@
') ')
@ -15311,7 +15384,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
domain_type($1_t) domain_type($1_t)
corecmd_shell_entry_type($1_t) corecmd_shell_entry_type($1_t)
corecmd_bin_entry_type($1_t) corecmd_bin_entry_type($1_t)
@@ -45,65 +46,70 @@ @@ -45,65 +46,72 @@
type $1_tty_device_t; type $1_tty_device_t;
term_user_tty($1_t,$1_tty_device_t) term_user_tty($1_t,$1_tty_device_t)
@ -15342,6 +15415,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
- kernel_dontaudit_getattr_unlabeled_chr_files($1_t) - kernel_dontaudit_getattr_unlabeled_chr_files($1_t)
+ allow $1_usertype $1_usertype:process { signal_perms getsched setsched share getpgid setpgid setcap getsession getattr }; + allow $1_usertype $1_usertype:process { signal_perms getsched setsched share getpgid setpgid setcap getsession getattr };
+ allow $1_usertype $1_usertype:fd use; + allow $1_usertype $1_usertype:fd use;
+ allow $1_usertype $1_t:key { create view read write search link setattr };
+
+ allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms; + allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
+ allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto }; + allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
+ allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto }; + allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
@ -15433,7 +15508,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
tunable_policy(`allow_execmem',` tunable_policy(`allow_execmem',`
# Allow loading DSOs that require executable stack. # Allow loading DSOs that require executable stack.
@@ -114,6 +120,10 @@ @@ -114,6 +122,10 @@
# Allow making the stack executable via mprotect. # Allow making the stack executable via mprotect.
allow $1_t self:process execstack; allow $1_t self:process execstack;
') ')
@ -15444,7 +15519,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
####################################### #######################################
@@ -184,7 +194,7 @@ @@ -184,7 +196,7 @@
files_list_home($1_t) files_list_home($1_t)
tunable_policy(`use_nfs_home_dirs',` tunable_policy(`use_nfs_home_dirs',`
@ -15453,7 +15528,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
fs_read_nfs_files($1_t) fs_read_nfs_files($1_t)
fs_read_nfs_symlinks($1_t) fs_read_nfs_symlinks($1_t)
fs_read_nfs_named_sockets($1_t) fs_read_nfs_named_sockets($1_t)
@@ -195,7 +205,7 @@ @@ -195,7 +207,7 @@
') ')
tunable_policy(`use_samba_home_dirs',` tunable_policy(`use_samba_home_dirs',`
@ -15462,7 +15537,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
fs_read_cifs_files($1_t) fs_read_cifs_files($1_t)
fs_read_cifs_symlinks($1_t) fs_read_cifs_symlinks($1_t)
fs_read_cifs_named_sockets($1_t) fs_read_cifs_named_sockets($1_t)
@@ -262,42 +272,42 @@ @@ -262,42 +274,42 @@
# full control of the home directory # full control of the home directory
allow $1_t $1_home_t:file entrypoint; allow $1_t $1_home_t:file entrypoint;
@ -15532,7 +15607,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
') ')
@@ -315,14 +325,20 @@ @@ -315,14 +327,20 @@
## <rolebase/> ## <rolebase/>
# #
template(`userdom_exec_home_template',` template(`userdom_exec_home_template',`
@ -15558,7 +15633,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
') ')
@@ -374,12 +390,12 @@ @@ -374,12 +392,12 @@
type $1_tmp_t, $1_file_type; type $1_tmp_t, $1_file_type;
files_tmp_file($1_tmp_t) files_tmp_file($1_tmp_t)
@ -15577,7 +15652,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
####################################### #######################################
@@ -395,7 +411,9 @@ @@ -395,7 +413,9 @@
## <rolebase/> ## <rolebase/>
# #
template(`userdom_exec_tmp_template',` template(`userdom_exec_tmp_template',`
@ -15588,7 +15663,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
####################################### #######################################
@@ -509,10 +527,6 @@ @@ -509,10 +529,6 @@
## <rolebase/> ## <rolebase/>
# #
template(`userdom_exec_generic_pgms_template',` template(`userdom_exec_generic_pgms_template',`
@ -15599,7 +15674,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
corecmd_exec_bin($1_t) corecmd_exec_bin($1_t)
') ')
@@ -530,9 +544,6 @@ @@ -530,9 +546,6 @@
## <rolebase/> ## <rolebase/>
# #
template(`userdom_basic_networking_template',` template(`userdom_basic_networking_template',`
@ -15609,7 +15684,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
allow $1_t self:tcp_socket create_stream_socket_perms; allow $1_t self:tcp_socket create_stream_socket_perms;
allow $1_t self:udp_socket create_socket_perms; allow $1_t self:udp_socket create_socket_perms;
@@ -563,32 +574,29 @@ @@ -563,32 +576,29 @@
# #
template(`userdom_xwindows_client_template',` template(`userdom_xwindows_client_template',`
gen_require(` gen_require(`
@ -15663,7 +15738,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
####################################### #######################################
@@ -664,67 +672,39 @@ @@ -664,67 +674,39 @@
attribute unpriv_userdomain; attribute unpriv_userdomain;
') ')
@ -15734,7 +15809,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
files_exec_etc_files($1_t) files_exec_etc_files($1_t)
files_search_locks($1_t) files_search_locks($1_t)
# Check to see if cdrom is mounted # Check to see if cdrom is mounted
@@ -737,12 +717,6 @@ @@ -737,12 +719,6 @@
# Stat lost+found. # Stat lost+found.
files_getattr_lost_found_dirs($1_t) files_getattr_lost_found_dirs($1_t)
@ -15747,7 +15822,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
# cjp: some of this probably can be removed # cjp: some of this probably can be removed
selinux_get_fs_mount($1_t) selinux_get_fs_mount($1_t)
selinux_validate_context($1_t) selinux_validate_context($1_t)
@@ -755,31 +729,16 @@ @@ -755,31 +731,15 @@
storage_getattr_fixed_disk_dev($1_t) storage_getattr_fixed_disk_dev($1_t)
auth_read_login_records($1_t) auth_read_login_records($1_t)
@ -15756,7 +15831,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
auth_run_pam($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) auth_run_pam($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
auth_run_utempter($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) auth_run_utempter($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
+ auth_run_upd_passwd_chk($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) + auth_run_upd_passwd_chk($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
+ auth_read_key($1_t)
init_read_utmp($1_t) init_read_utmp($1_t)
- # The library functions always try to open read-write first, - # The library functions always try to open read-write first,
@ -15781,7 +15855,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
seutil_run_newrole($1_t,$1_r,{ $1_devpts_t $1_tty_device_t }) seutil_run_newrole($1_t,$1_r,{ $1_devpts_t $1_tty_device_t })
seutil_exec_checkpolicy($1_t) seutil_exec_checkpolicy($1_t)
seutil_exec_setfiles($1_t) seutil_exec_setfiles($1_t)
@@ -794,19 +753,12 @@ @@ -794,19 +754,12 @@
files_read_default_symlinks($1_t) files_read_default_symlinks($1_t)
files_read_default_sockets($1_t) files_read_default_sockets($1_t)
files_read_default_pipes($1_t) files_read_default_pipes($1_t)
@ -15801,7 +15875,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
optional_policy(` optional_policy(`
alsa_read_rw_config($1_t) alsa_read_rw_config($1_t)
') ')
@@ -821,11 +773,6 @@ @@ -821,11 +774,6 @@
') ')
optional_policy(` optional_policy(`
@ -15813,7 +15887,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
allow $1_t self:dbus send_msg; allow $1_t self:dbus send_msg;
dbus_system_bus_client_template($1,$1_t) dbus_system_bus_client_template($1,$1_t)
@@ -834,20 +781,20 @@ @@ -834,20 +782,20 @@
') ')
optional_policy(` optional_policy(`
@ -15839,7 +15913,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
') ')
@@ -876,17 +823,17 @@ @@ -876,17 +824,17 @@
') ')
optional_policy(` optional_policy(`
@ -15865,7 +15939,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
optional_policy(` optional_policy(`
@@ -900,16 +847,6 @@ @@ -900,16 +848,6 @@
') ')
optional_policy(` optional_policy(`
@ -15882,7 +15956,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
resmgr_stream_connect($1_t) resmgr_stream_connect($1_t)
') ')
@@ -919,11 +856,6 @@ @@ -919,11 +857,6 @@
') ')
optional_policy(` optional_policy(`
@ -15894,7 +15968,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
samba_stream_connect_winbind($1_t) samba_stream_connect_winbind($1_t)
') ')
@@ -954,21 +886,167 @@ @@ -954,21 +887,167 @@
## </summary> ## </summary>
## </param> ## </param>
# #
@ -16068,7 +16142,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
domain_interactive_fd($1_t) domain_interactive_fd($1_t)
typeattribute $1_devpts_t user_ptynode; typeattribute $1_devpts_t user_ptynode;
@@ -977,23 +1055,51 @@ @@ -977,23 +1056,51 @@
typeattribute $1_tmp_t user_tmpfile; typeattribute $1_tmp_t user_tmpfile;
typeattribute $1_tty_device_t user_ttynode; typeattribute $1_tty_device_t user_ttynode;
@ -16131,24 +16205,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
# port access is audited even if dac would not have allowed it, so dontaudit it here # port access is audited even if dac would not have allowed it, so dontaudit it here
corenet_dontaudit_tcp_bind_all_reserved_ports($1_t) corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
@@ -1029,15 +1135,7 @@ @@ -1029,15 +1136,11 @@
# and may change other protocols # and may change other protocols
tunable_policy(`user_tcp_server',` tunable_policy(`user_tcp_server',`
corenet_tcp_bind_all_nodes($1_t) corenet_tcp_bind_all_nodes($1_t)
- corenet_tcp_bind_generic_port($1_t) - corenet_tcp_bind_generic_port($1_t)
- ') + corenet_tcp_bind_all_unreserved_ports($1_t)
- ')
- optional_policy(`
optional_policy(`
- kerberos_use($1_t) - kerberos_use($1_t)
- ') - ')
- -
- optional_policy(` - optional_policy(`
- loadkeys_run($1_t,$1_r,$1_tty_device_t) - loadkeys_run($1_t,$1_r,$1_tty_device_t)
+ corenet_tcp_bind_all_unreserved_ports($1_t) + hal_dbus_chat($1_t)
') ')
optional_policy(` optional_policy(`
@@ -1054,17 +1152,6 @@ @@ -1054,17 +1157,6 @@
setroubleshoot_stream_connect($1_t) setroubleshoot_stream_connect($1_t)
') ')
@ -16166,7 +16241,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
####################################### #######################################
@@ -1102,6 +1189,8 @@ @@ -1102,6 +1194,8 @@
class passwd { passwd chfn chsh rootok crontab }; class passwd { passwd chfn chsh rootok crontab };
') ')
@ -16175,7 +16250,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
############################## ##############################
# #
# Declarations # Declarations
@@ -1127,7 +1216,7 @@ @@ -1127,7 +1221,7 @@
# $1_t local policy # $1_t local policy
# #
@ -16184,7 +16259,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
allow $1_t self:process { setexec setfscreate }; allow $1_t self:process { setexec setfscreate };
# Set password information for other users. # Set password information for other users.
@@ -1139,7 +1228,11 @@ @@ -1139,7 +1233,11 @@
# Manipulate other users crontab. # Manipulate other users crontab.
allow $1_t self:passwd crontab; allow $1_t self:passwd crontab;
@ -16197,7 +16272,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
kernel_read_software_raid_state($1_t) kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t) kernel_getattr_core_if($1_t)
@@ -1642,9 +1735,13 @@ @@ -1642,9 +1740,13 @@
template(`userdom_user_home_content',` template(`userdom_user_home_content',`
gen_require(` gen_require(`
attribute $1_file_type; attribute $1_file_type;
@ -16211,7 +16286,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
files_type($2) files_type($2)
') ')
@@ -1894,10 +1991,46 @@ @@ -1894,10 +1996,46 @@
template(`userdom_manage_user_home_content_dirs',` template(`userdom_manage_user_home_content_dirs',`
gen_require(` gen_require(`
type $1_home_dir_t, $1_home_t; type $1_home_dir_t, $1_home_t;
@ -16259,7 +16334,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -3078,7 +3211,7 @@ @@ -3078,7 +3216,7 @@
# #
template(`userdom_tmp_filetrans_user_tmp',` template(`userdom_tmp_filetrans_user_tmp',`
gen_require(` gen_require(`
@ -16268,7 +16343,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
files_tmp_filetrans($2,$1_tmp_t,$3) files_tmp_filetrans($2,$1_tmp_t,$3)
@@ -4609,11 +4742,29 @@ @@ -4609,11 +4747,29 @@
# #
interface(`userdom_search_all_users_home_dirs',` interface(`userdom_search_all_users_home_dirs',`
gen_require(` gen_require(`
@ -16299,7 +16374,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4633,6 +4784,14 @@ @@ -4633,6 +4789,14 @@
files_list_home($1) files_list_home($1)
allow $1 home_dir_type:dir list_dir_perms; allow $1 home_dir_type:dir list_dir_perms;
@ -16314,7 +16389,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -5323,7 +5482,7 @@ @@ -5323,7 +5487,7 @@
attribute user_tmpfile; attribute user_tmpfile;
') ')
@ -16323,7 +16398,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -5559,3 +5718,380 @@ @@ -5559,3 +5723,380 @@
interface(`userdom_unconfined',` interface(`userdom_unconfined',`
refpolicywarn(`$0($*) has been deprecated.') refpolicywarn(`$0($*) has been deprecated.')
') ')
@ -16706,7 +16781,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ +
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.8/policy/modules/system/userdomain.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.8/policy/modules/system/userdomain.te
--- nsaserefpolicy/policy/modules/system/userdomain.te 2007-09-12 10:34:51.000000000 -0400 --- nsaserefpolicy/policy/modules/system/userdomain.te 2007-09-12 10:34:51.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/system/userdomain.te 2007-10-05 08:59:51.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/system/userdomain.te 2007-10-17 12:58:33.000000000 -0400
@@ -24,13 +24,6 @@ @@ -24,13 +24,6 @@
## <desc> ## <desc>
@ -17091,7 +17166,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.i
+## <summary>Policy for guest user</summary> +## <summary>Policy for guest user</summary>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.0.8/policy/modules/users/guest.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.0.8/policy/modules/users/guest.te
--- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.0.8/policy/modules/users/guest.te 2007-10-12 12:03:20.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/users/guest.te 2007-10-17 12:57:05.000000000 -0400
@@ -0,0 +1,13 @@ @@ -0,0 +1,13 @@
+policy_module(guest,1.0.0) +policy_module(guest,1.0.0)
+userdom_unpriv_login_user(guest) +userdom_unpriv_login_user(guest)