rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

+- Allow mozilla_plugin_t to manage mozilla_home_t

Browse Source 
+- Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain
+- Add label for tumblerd
This commit is contained in:
Miroslav 2011-12-08 17:15:52 +01:00
parent 1094d02fe9
commit 202bb4cfa3
2 changed files with 60 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

98
policy-F16.patch
View File

@ -8114,7 +8114,7 @@ index fbb5c5a..e187982 100644
+ allow $1 mozilla_plugin_rw_t:dir rw_dir_perms; + allow $1 mozilla_plugin_rw_t:dir rw_dir_perms;
') ')
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
index 2e9318b..fc7a18e 100644 index 2e9318b..bb90a3b 100644
--- a/policy/modules/apps/mozilla.te --- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te +++ b/policy/modules/apps/mozilla.te
@@ -23,8 +23,9 @@ type mozilla_conf_t; @@ -23,8 +23,9 @@ type mozilla_conf_t;
@ -8247,9 +8247,9 @@ index 2e9318b..fc7a18e 100644
can_exec(mozilla_plugin_t, mozilla_home_t) can_exec(mozilla_plugin_t, mozilla_home_t)
-read_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t) -read_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t)
+manage_dirs_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t) +manage_dirs_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t)
+manage_files_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t) +manage_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t)
+manage_lnk_files_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t) +manage_lnk_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t)
manage_dirs_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) manage_dirs_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
@ -12732,7 +12732,7 @@ index 223ad43..d95e720 100644
rsync_exec(yam_t) rsync_exec(yam_t)
') ')
diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
index 3fae11a..5d00aa0 100644 index 3fae11a..cdd0dcf 100644
--- a/policy/modules/kernel/corecommands.fc --- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc +++ b/policy/modules/kernel/corecommands.fc
@@ -1,7 +1,7 @@ @@ -1,7 +1,7 @@
@ -12791,7 +12791,7 @@ index 3fae11a..5d00aa0 100644
/opt/gutenprint/cups/lib/filter(/.*)? gen_context(system_u:object_r:bin_t,s0) /opt/gutenprint/cups/lib/filter(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -179,67 +174,90 @@ ifdef(`distro_gentoo',` @@ -179,67 +174,91 @@ ifdef(`distro_gentoo',`
/opt/vmware/workstation/lib/lib/wrapper-gtk24\.sh -- gen_context(system_u:object_r:bin_t,s0) /opt/vmware/workstation/lib/lib/wrapper-gtk24\.sh -- gen_context(system_u:object_r:bin_t,s0)
') ')
@ -12900,6 +12900,7 @@ index 3fae11a..5d00aa0 100644
+/usr/lib/rpm/rpmk -- gen_context(system_u:object_r:bin_t,s0) +/usr/lib/rpm/rpmk -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/rpm/rpmq -- gen_context(system_u:object_r:bin_t,s0) +/usr/lib/rpm/rpmq -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/rpm/rpmv -- gen_context(system_u:object_r:bin_t,s0) +/usr/lib/rpm/rpmv -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/tumbler-[^/]*/tumblerd -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:bin_t,s0) +/usr/lib/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/sftp-server -- gen_context(system_u:object_r:bin_t,s0) +/usr/lib/sftp-server -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/vte/gnome-pty-helper -- gen_context(system_u:object_r:bin_t,s0) +/usr/lib/vte/gnome-pty-helper -- gen_context(system_u:object_r:bin_t,s0)
@ -12927,7 +12928,7 @@ index 3fae11a..5d00aa0 100644
/usr/libexec(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/libexec(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/libexec/git-core/git-shell -- gen_context(system_u:object_r:shell_exec_t,s0) /usr/libexec/git-core/git-shell -- gen_context(system_u:object_r:shell_exec_t,s0)
@@ -247,11 +265,18 @@ ifdef(`distro_gentoo',` @@ -247,11 +266,18 @@ ifdef(`distro_gentoo',`
/usr/libexec/openssh/sftp-server -- gen_context(system_u:object_r:bin_t,s0) /usr/libexec/openssh/sftp-server -- gen_context(system_u:object_r:bin_t,s0)
@ -12947,7 +12948,7 @@ index 3fae11a..5d00aa0 100644
/usr/sbin/scponlyc -- gen_context(system_u:object_r:shell_exec_t,s0) /usr/sbin/scponlyc -- gen_context(system_u:object_r:shell_exec_t,s0)
/usr/sbin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0) /usr/sbin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0)
/usr/sbin/smrsh -- gen_context(system_u:object_r:shell_exec_t,s0) /usr/sbin/smrsh -- gen_context(system_u:object_r:shell_exec_t,s0)
@@ -267,6 +292,10 @@ ifdef(`distro_gentoo',` @@ -267,6 +293,10 @@ ifdef(`distro_gentoo',`
/usr/share/cluster/.*\.sh gen_context(system_u:object_r:bin_t,s0) /usr/share/cluster/.*\.sh gen_context(system_u:object_r:bin_t,s0)
/usr/share/cluster/ocf-shellfuncs -- gen_context(system_u:object_r:bin_t,s0) /usr/share/cluster/ocf-shellfuncs -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/cluster/svclib_nfslock -- gen_context(system_u:object_r:bin_t,s0) /usr/share/cluster/svclib_nfslock -- gen_context(system_u:object_r:bin_t,s0)
@ -12958,7 +12959,7 @@ index 3fae11a..5d00aa0 100644
/usr/share/e16/misc(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/e16/misc(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/gedit-2/plugins/externaltools/tools(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/gedit-2/plugins/externaltools/tools(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/gitolite/hooks/common/update -- gen_context(system_u:object_r:bin_t,s0) /usr/share/gitolite/hooks/common/update -- gen_context(system_u:object_r:bin_t,s0)
@@ -286,15 +315,19 @@ ifdef(`distro_gentoo',` @@ -286,15 +316,19 @@ ifdef(`distro_gentoo',`
/usr/share/smolt/client(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/smolt/client(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall/compiler\.pl -- gen_context(system_u:object_r:bin_t,s0) /usr/share/shorewall/compiler\.pl -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall/configpath -- gen_context(system_u:object_r:bin_t,s0) /usr/share/shorewall/configpath -- gen_context(system_u:object_r:bin_t,s0)
@ -12979,7 +12980,7 @@ index 3fae11a..5d00aa0 100644
ifdef(`distro_gentoo', ` ifdef(`distro_gentoo', `
/usr/.*-.*-linux-gnu/gcc-bin/.*(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/.*-.*-linux-gnu/gcc-bin/.*(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -306,10 +339,11 @@ ifdef(`distro_redhat', ` @@ -306,10 +340,11 @@ ifdef(`distro_redhat', `
/etc/gdm/[^/]+ -d gen_context(system_u:object_r:bin_t,s0) /etc/gdm/[^/]+ -d gen_context(system_u:object_r:bin_t,s0)
/etc/gdm/[^/]+/.* gen_context(system_u:object_r:bin_t,s0) /etc/gdm/[^/]+/.* gen_context(system_u:object_r:bin_t,s0)
@ -12993,7 +12994,7 @@ index 3fae11a..5d00aa0 100644
/usr/lib/vmware-tools/(s)?bin32(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib/vmware-tools/(s)?bin32(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib/vmware-tools/(s)?bin64(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib/vmware-tools/(s)?bin64(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/authconfig/authconfig-gtk\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/authconfig/authconfig-gtk\.py -- gen_context(system_u:object_r:bin_t,s0)
@@ -319,9 +353,11 @@ ifdef(`distro_redhat', ` @@ -319,9 +354,11 @@ ifdef(`distro_redhat', `
/usr/share/clamav/clamd-gen -- gen_context(system_u:object_r:bin_t,s0) /usr/share/clamav/clamd-gen -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/clamav/freshclam-sleep -- gen_context(system_u:object_r:bin_t,s0) /usr/share/clamav/freshclam-sleep -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/createrepo(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/share/createrepo(/.*)? gen_context(system_u:object_r:bin_t,s0)
@ -13005,7 +13006,7 @@ index 3fae11a..5d00aa0 100644
/usr/share/pwlib/make/ptlib-config -- gen_context(system_u:object_r:bin_t,s0) /usr/share/pwlib/make/ptlib-config -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/pydict/pydict\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/pydict/pydict\.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/rhn/rhn_applet/applet\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/rhn/rhn_applet/applet\.py -- gen_context(system_u:object_r:bin_t,s0)
@@ -363,7 +399,7 @@ ifdef(`distro_redhat', ` @@ -363,7 +400,7 @@ ifdef(`distro_redhat', `
ifdef(`distro_suse', ` ifdef(`distro_suse', `
/usr/lib/cron/run-crons -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/cron/run-crons -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/samba/classic/.* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/samba/classic/.* -- gen_context(system_u:object_r:bin_t,s0)
@ -13014,7 +13015,7 @@ index 3fae11a..5d00aa0 100644
/usr/share/apache2/[^/]* -- gen_context(system_u:object_r:bin_t,s0) /usr/share/apache2/[^/]* -- gen_context(system_u:object_r:bin_t,s0)
') ')
@@ -375,8 +411,8 @@ ifdef(`distro_suse', ` @@ -375,8 +412,8 @@ ifdef(`distro_suse', `
/var/ftp/bin(/.*)? gen_context(system_u:object_r:bin_t,s0) /var/ftp/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
/var/lib/asterisk/agi-bin(/.*)? gen_context(system_u:object_r:bin_t,s0) /var/lib/asterisk/agi-bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
@ -13025,7 +13026,7 @@ index 3fae11a..5d00aa0 100644
/var/qmail/bin -d gen_context(system_u:object_r:bin_t,s0) /var/qmail/bin -d gen_context(system_u:object_r:bin_t,s0)
/var/qmail/bin(/.*)? gen_context(system_u:object_r:bin_t,s0) /var/qmail/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -385,3 +421,12 @@ ifdef(`distro_suse', ` @@ -385,3 +422,12 @@ ifdef(`distro_suse', `
ifdef(`distro_suse',` ifdef(`distro_suse',`
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0) /var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
') ')
@ -61166,10 +61167,10 @@ index 078bcd7..84d29ee 100644
+/root/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0) +/root/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
+/root/\.shosts gen_context(system_u:object_r:ssh_home_t,s0) +/root/\.shosts gen_context(system_u:object_r:ssh_home_t,s0)
diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index 22adaca..c2efd25 100644 index 22adaca..6ec295a 100644
--- a/policy/modules/services/ssh.if --- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if +++ b/policy/modules/services/ssh.if
@@ -32,10 +32,10 @@ @@ -32,10 +32,11 @@
## </param> ## </param>
# #
template(`ssh_basic_client_template',` template(`ssh_basic_client_template',`
@ -61177,11 +61178,12 @@ index 22adaca..c2efd25 100644
gen_require(` gen_require(`
attribute ssh_server; attribute ssh_server;
type ssh_exec_t, sshd_key_t, sshd_tmp_t; type ssh_exec_t, sshd_key_t, sshd_tmp_t;
+ type ssh_keysign_exec_t, ssh_keysign_t;
+ type ssh_home_t; + type ssh_home_t;
') ')
############################## ##############################
@@ -47,10 +47,6 @@ template(`ssh_basic_client_template',` @@ -47,10 +48,6 @@ template(`ssh_basic_client_template',`
application_domain($1_ssh_t, ssh_exec_t) application_domain($1_ssh_t, ssh_exec_t)
role $3 types $1_ssh_t; role $3 types $1_ssh_t;
@ -61192,7 +61194,15 @@ index 22adaca..c2efd25 100644
############################## ##############################
# #
# Client local policy # Client local policy
@@ -93,18 +89,18 @@ template(`ssh_basic_client_template',` @@ -89,22 +86,26 @@ template(`ssh_basic_client_template',`
# or "regular" (not special like sshd_extern_t) servers
allow $2 ssh_server:unix_stream_socket rw_stream_socket_perms;
+ # derived domain can execute ssh-keysign
+ domtrans_pattern($1_ssh_t, ssh_keysign_exec_t, ssh_keysign_t)
+ role $3 types ssh_keysign_t;
+
# allow ps to show ssh
ps_process_pattern($2, $1_ssh_t) ps_process_pattern($2, $1_ssh_t)
# user can manage the keys and config # user can manage the keys and config
@ -61219,7 +61229,7 @@ index 22adaca..c2efd25 100644
kernel_read_kernel_sysctls($1_ssh_t) kernel_read_kernel_sysctls($1_ssh_t)
kernel_read_system_state($1_ssh_t) kernel_read_system_state($1_ssh_t)
@@ -116,6 +112,8 @@ template(`ssh_basic_client_template',` @@ -116,6 +117,8 @@ template(`ssh_basic_client_template',`
corenet_tcp_sendrecv_all_ports($1_ssh_t) corenet_tcp_sendrecv_all_ports($1_ssh_t)
corenet_tcp_connect_ssh_port($1_ssh_t) corenet_tcp_connect_ssh_port($1_ssh_t)
corenet_sendrecv_ssh_client_packets($1_ssh_t) corenet_sendrecv_ssh_client_packets($1_ssh_t)
@ -61228,7 +61238,7 @@ index 22adaca..c2efd25 100644
dev_read_urand($1_ssh_t) dev_read_urand($1_ssh_t)
@@ -148,6 +146,29 @@ template(`ssh_basic_client_template',` @@ -148,6 +151,29 @@ template(`ssh_basic_client_template',`
') ')
') ')
@ -61258,7 +61268,7 @@ index 22adaca..c2efd25 100644
####################################### #######################################
## <summary> ## <summary>
## The template to define a ssh server. ## The template to define a ssh server.
@@ -168,7 +189,7 @@ template(`ssh_basic_client_template',` @@ -168,7 +194,7 @@ template(`ssh_basic_client_template',`
## </summary> ## </summary>
## </param> ## </param>
# #
@ -61267,7 +61277,7 @@ index 22adaca..c2efd25 100644
type $1_t, ssh_server; type $1_t, ssh_server;
auth_login_pgm_domain($1_t) auth_login_pgm_domain($1_t)
@@ -181,16 +202,18 @@ template(`ssh_server_template', ` @@ -181,16 +207,18 @@ template(`ssh_server_template', `
type $1_var_run_t; type $1_var_run_t;
files_pid_file($1_var_run_t) files_pid_file($1_var_run_t)
@ -61289,7 +61299,7 @@ index 22adaca..c2efd25 100644
term_create_pty($1_t, $1_devpts_t) term_create_pty($1_t, $1_devpts_t)
manage_files_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t) manage_files_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t)
@@ -206,6 +229,7 @@ template(`ssh_server_template', ` @@ -206,6 +234,7 @@ template(`ssh_server_template', `
kernel_read_kernel_sysctls($1_t) kernel_read_kernel_sysctls($1_t)
kernel_read_network_state($1_t) kernel_read_network_state($1_t)
@ -61297,7 +61307,7 @@ index 22adaca..c2efd25 100644
corenet_all_recvfrom_unlabeled($1_t) corenet_all_recvfrom_unlabeled($1_t)
corenet_all_recvfrom_netlabel($1_t) corenet_all_recvfrom_netlabel($1_t)
@@ -220,10 +244,13 @@ template(`ssh_server_template', ` @@ -220,10 +249,13 @@ template(`ssh_server_template', `
corenet_tcp_bind_generic_node($1_t) corenet_tcp_bind_generic_node($1_t)
corenet_udp_bind_generic_node($1_t) corenet_udp_bind_generic_node($1_t)
corenet_tcp_bind_ssh_port($1_t) corenet_tcp_bind_ssh_port($1_t)
@ -61313,7 +61323,7 @@ index 22adaca..c2efd25 100644
auth_rw_login_records($1_t) auth_rw_login_records($1_t)
auth_rw_faillog($1_t) auth_rw_faillog($1_t)
@@ -234,6 +261,7 @@ template(`ssh_server_template', ` @@ -234,6 +266,7 @@ template(`ssh_server_template', `
corecmd_getattr_bin_files($1_t) corecmd_getattr_bin_files($1_t)
domain_interactive_fd($1_t) domain_interactive_fd($1_t)
@ -61321,7 +61331,7 @@ index 22adaca..c2efd25 100644
files_read_etc_files($1_t) files_read_etc_files($1_t)
files_read_etc_runtime_files($1_t) files_read_etc_runtime_files($1_t)
@@ -243,21 +271,13 @@ template(`ssh_server_template', ` @@ -243,21 +276,13 @@ template(`ssh_server_template', `
miscfiles_read_localization($1_t) miscfiles_read_localization($1_t)
@ -61345,7 +61355,7 @@ index 22adaca..c2efd25 100644
optional_policy(` optional_policy(`
kerberos_use($1_t) kerberos_use($1_t)
@@ -268,6 +288,14 @@ template(`ssh_server_template', ` @@ -268,6 +293,14 @@ template(`ssh_server_template', `
files_read_var_lib_symlinks($1_t) files_read_var_lib_symlinks($1_t)
nx_spec_domtrans_server($1_t) nx_spec_domtrans_server($1_t)
') ')
@ -61360,7 +61370,7 @@ index 22adaca..c2efd25 100644
') ')
######################################## ########################################
@@ -290,11 +318,11 @@ template(`ssh_server_template', ` @@ -290,11 +323,11 @@ template(`ssh_server_template', `
## User domain for the role ## User domain for the role
## </summary> ## </summary>
## </param> ## </param>
@ -61373,7 +61383,7 @@ index 22adaca..c2efd25 100644
type ssh_t, ssh_exec_t, ssh_tmpfs_t, ssh_home_t; type ssh_t, ssh_exec_t, ssh_tmpfs_t, ssh_home_t;
type ssh_agent_exec_t, ssh_keysign_t, ssh_tmpfs_t; type ssh_agent_exec_t, ssh_keysign_t, ssh_tmpfs_t;
type ssh_agent_tmp_t; type ssh_agent_tmp_t;
@@ -327,17 +355,20 @@ template(`ssh_role_template',` @@ -327,17 +360,20 @@ template(`ssh_role_template',`
# allow ps to show ssh # allow ps to show ssh
ps_process_pattern($3, ssh_t) ps_process_pattern($3, ssh_t)
@ -61395,7 +61405,7 @@ index 22adaca..c2efd25 100644
############################## ##############################
# #
@@ -359,7 +390,7 @@ template(`ssh_role_template',` @@ -359,7 +395,7 @@ template(`ssh_role_template',`
stream_connect_pattern($3, ssh_agent_tmp_t, ssh_agent_tmp_t, $1_ssh_agent_t) stream_connect_pattern($3, ssh_agent_tmp_t, ssh_agent_tmp_t, $1_ssh_agent_t)
# Allow the user shell to signal the ssh program. # Allow the user shell to signal the ssh program.
@ -61404,7 +61414,7 @@ index 22adaca..c2efd25 100644
# allow ps to show ssh # allow ps to show ssh
ps_process_pattern($3, $1_ssh_agent_t) ps_process_pattern($3, $1_ssh_agent_t)
@@ -381,7 +412,6 @@ template(`ssh_role_template',` @@ -381,7 +417,6 @@ template(`ssh_role_template',`
files_read_etc_files($1_ssh_agent_t) files_read_etc_files($1_ssh_agent_t)
files_read_etc_runtime_files($1_ssh_agent_t) files_read_etc_runtime_files($1_ssh_agent_t)
@ -61412,7 +61422,7 @@ index 22adaca..c2efd25 100644
libs_read_lib_files($1_ssh_agent_t) libs_read_lib_files($1_ssh_agent_t)
@@ -393,28 +423,15 @@ template(`ssh_role_template',` @@ -393,28 +428,15 @@ template(`ssh_role_template',`
seutil_dontaudit_read_config($1_ssh_agent_t) seutil_dontaudit_read_config($1_ssh_agent_t)
# Write to the user domain tty. # Write to the user domain tty.
@ -61428,15 +61438,15 @@ index 22adaca..c2efd25 100644
- -
- tunable_policy(`use_nfs_home_dirs',` - tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_files($1_ssh_agent_t) - fs_manage_nfs_files($1_ssh_agent_t)
-
- # transition back to normal privs upon exec - # transition back to normal privs upon exec
- fs_nfs_domtrans($1_ssh_agent_t, $3) - fs_nfs_domtrans($1_ssh_agent_t, $3)
- ') - ')
+ ssh_exec_keygen($3)
- tunable_policy(`use_samba_home_dirs',` - tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_files($1_ssh_agent_t) - fs_manage_cifs_files($1_ssh_agent_t)
- + ssh_exec_keygen($3)
- # transition back to normal privs upon exec - # transition back to normal privs upon exec
- fs_cifs_domtrans($1_ssh_agent_t, $3) - fs_cifs_domtrans($1_ssh_agent_t, $3)
- ') - ')
@ -61444,7 +61454,7 @@ index 22adaca..c2efd25 100644
optional_policy(` optional_policy(`
nis_use_ypbind($1_ssh_agent_t) nis_use_ypbind($1_ssh_agent_t)
@@ -464,6 +481,24 @@ interface(`ssh_signal',` @@ -464,6 +486,24 @@ interface(`ssh_signal',`
######################################## ########################################
## <summary> ## <summary>
@ -61469,7 +61479,7 @@ index 22adaca..c2efd25 100644
## Read a ssh server unnamed pipe. ## Read a ssh server unnamed pipe.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -477,8 +512,27 @@ interface(`ssh_read_pipes',` @@ -477,8 +517,27 @@ interface(`ssh_read_pipes',`
type sshd_t; type sshd_t;
') ')
@ -61498,7 +61508,7 @@ index 22adaca..c2efd25 100644
######################################## ########################################
## <summary> ## <summary>
## Read and write a ssh server unnamed pipe. ## Read and write a ssh server unnamed pipe.
@@ -494,7 +548,7 @@ interface(`ssh_rw_pipes',` @@ -494,7 +553,7 @@ interface(`ssh_rw_pipes',`
type sshd_t; type sshd_t;
') ')
@ -61507,7 +61517,7 @@ index 22adaca..c2efd25 100644
') ')
######################################## ########################################
@@ -586,6 +640,24 @@ interface(`ssh_domtrans',` @@ -586,6 +645,24 @@ interface(`ssh_domtrans',`
######################################## ########################################
## <summary> ## <summary>
@ -61532,7 +61542,7 @@ index 22adaca..c2efd25 100644
## Execute the ssh client in the caller domain. ## Execute the ssh client in the caller domain.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -618,7 +690,7 @@ interface(`ssh_setattr_key_files',` @@ -618,7 +695,7 @@ interface(`ssh_setattr_key_files',`
type sshd_key_t; type sshd_key_t;
') ')
@ -61541,7 +61551,7 @@ index 22adaca..c2efd25 100644
files_search_pids($1) files_search_pids($1)
') ')
@@ -643,6 +715,42 @@ interface(`ssh_agent_exec',` @@ -643,6 +720,42 @@ interface(`ssh_agent_exec',`
######################################## ########################################
## <summary> ## <summary>
@ -61584,7 +61594,7 @@ index 22adaca..c2efd25 100644
## Read ssh home directory content ## Read ssh home directory content
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -682,6 +790,50 @@ interface(`ssh_domtrans_keygen',` @@ -682,6 +795,50 @@ interface(`ssh_domtrans_keygen',`
######################################## ########################################
## <summary> ## <summary>
@ -61635,7 +61645,7 @@ index 22adaca..c2efd25 100644
## Read ssh server keys ## Read ssh server keys
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -695,7 +847,7 @@ interface(`ssh_dontaudit_read_server_keys',` @@ -695,7 +852,7 @@ interface(`ssh_dontaudit_read_server_keys',`
type sshd_key_t; type sshd_key_t;
') ')
@ -61644,7 +61654,7 @@ index 22adaca..c2efd25 100644
') ')
###################################### ######################################
@@ -735,3 +887,63 @@ interface(`ssh_delete_tmp',` @@ -735,3 +892,63 @@ interface(`ssh_delete_tmp',`
files_search_tmp($1) files_search_tmp($1)
delete_files_pattern($1, sshd_tmp_t, sshd_tmp_t) delete_files_pattern($1, sshd_tmp_t, sshd_tmp_t)
') ')

7
selinux-policy.spec
View File

@ -17,7 +17,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.10.0 Version: 3.10.0
Release: 66%{?dist} Release: 67%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -470,6 +470,11 @@ SELinux Reference policy mls base module.
%endif %endif
%changelog %changelog
* Thu Dec 8 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-67
- Allow mozilla_plugin_t to manage mozilla_home_t
- Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain
- Add label for tumblerd
* Wed Dec 7 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-66 * Wed Dec 7 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-66
- Fixes for xguest package - Fixes for xguest package