rpms/selinux-policy
5
0
Fork 0
Code Issues Pull Requests Releases Activity

* Wed Feb 04 2015 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-108

Browse Source 
- Fix labels, improve sysnet_manage_config interface.
- Label /var/run/NetworkManager/resolv.conf.tmp as net_conf_t.
- Dontaudit network connections related to thumb_t. BZ(1187981)
- Remove sysnet_filetrans_named_content from fail2ban
This commit is contained in:
Lukas Vrabec 2015-02-04 13:06:40 +01:00
parent 1808b757f1
commit 203031a6db
3 changed files with 134 additions and 108 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

220
policy-rawhide-base.patch
View File

@ -25701,10 +25701,10 @@ index 6bf0ecc..b036584 100644
+') +')
+ +
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index 8b40377..635442b 100644 index 8b40377..5a2c173 100644
--- a/policy/modules/services/xserver.te --- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te
@@ -26,28 +26,59 @@ gen_require(` @@ -26,28 +26,66 @@ gen_require(`
# #
## <desc> ## <desc>
@ -25754,6 +25754,13 @@ index 8b40377..635442b 100644
+ +
+## <desc> +## <desc>
+## <p> +## <p>
+## Allows xdm_t to bind on vnc_port_t(5910)
+## </p>
+## </desc>
+gen_tunable(xdm_bind_vnc_tcp_port, false)
+
+## <desc>
+## <p>
+## Support X userspace object manager +## Support X userspace object manager
+## </p> +## </p>
## </desc> ## </desc>
@ -25773,7 +25780,7 @@ index 8b40377..635442b 100644
# X Events # X Events
attribute xevent_type; attribute xevent_type;
@@ -107,44 +138,54 @@ xserver_object_types_template(remote) @@ -107,44 +145,54 @@ xserver_object_types_template(remote)
xserver_common_x_domain_template(remote, remote_t) xserver_common_x_domain_template(remote, remote_t)
type user_fonts_t; type user_fonts_t;
@ -25829,7 +25836,7 @@ index 8b40377..635442b 100644
typealias xauth_tmp_t alias { auditadm_xauth_tmp_t secadm_xauth_tmp_t }; typealias xauth_tmp_t alias { auditadm_xauth_tmp_t secadm_xauth_tmp_t };
userdom_user_tmp_file(xauth_tmp_t) userdom_user_tmp_file(xauth_tmp_t)
@@ -155,19 +196,28 @@ dev_associate(xconsole_device_t) @@ -155,19 +203,28 @@ dev_associate(xconsole_device_t)
fs_associate_tmpfs(xconsole_device_t) fs_associate_tmpfs(xconsole_device_t)
files_associate_tmp(xconsole_device_t) files_associate_tmp(xconsole_device_t)
@ -25861,7 +25868,7 @@ index 8b40377..635442b 100644
type xdm_var_lib_t; type xdm_var_lib_t;
files_type(xdm_var_lib_t) files_type(xdm_var_lib_t)
@@ -175,13 +225,21 @@ files_type(xdm_var_lib_t) @@ -175,13 +232,21 @@ files_type(xdm_var_lib_t)
type xdm_var_run_t; type xdm_var_run_t;
files_pid_file(xdm_var_run_t) files_pid_file(xdm_var_run_t)
@ -25886,7 +25893,7 @@ index 8b40377..635442b 100644
# type for /var/lib/xkb # type for /var/lib/xkb
type xkb_var_lib_t; type xkb_var_lib_t;
files_type(xkb_var_lib_t) files_type(xkb_var_lib_t)
@@ -194,15 +252,13 @@ typealias xserver_t alias { auditadm_xserver_t secadm_xserver_t xdm_xserver_t }; @@ -194,15 +259,13 @@ typealias xserver_t alias { auditadm_xserver_t secadm_xserver_t xdm_xserver_t };
init_system_domain(xserver_t, xserver_exec_t) init_system_domain(xserver_t, xserver_exec_t)
ubac_constrained(xserver_t) ubac_constrained(xserver_t)
@ -25907,7 +25914,7 @@ index 8b40377..635442b 100644
type xsession_exec_t; type xsession_exec_t;
corecmd_executable_file(xsession_exec_t) corecmd_executable_file(xsession_exec_t)
@@ -226,21 +282,35 @@ optional_policy(` @@ -226,21 +289,35 @@ optional_policy(`
# #
allow iceauth_t iceauth_home_t:file manage_file_perms; allow iceauth_t iceauth_home_t:file manage_file_perms;
@ -25950,7 +25957,7 @@ index 8b40377..635442b 100644
') ')
######################################## ########################################
@@ -248,48 +318,91 @@ tunable_policy(`use_samba_home_dirs',` @@ -248,48 +325,91 @@ tunable_policy(`use_samba_home_dirs',`
# Xauth local policy # Xauth local policy
# #
@ -26042,18 +26049,18 @@ index 8b40377..635442b 100644
+ifdef(`hide_broken_symptoms',` +ifdef(`hide_broken_symptoms',`
+ term_dontaudit_use_unallocated_ttys(xauth_t) + term_dontaudit_use_unallocated_ttys(xauth_t)
+ dev_dontaudit_rw_dri(xauth_t) + dev_dontaudit_rw_dri(xauth_t)
+')
+
+optional_policy(`
+ nx_var_lib_filetrans(xauth_t, xauth_home_t, file)
') ')
optional_policy(` optional_policy(`
+ nx_var_lib_filetrans(xauth_t, xauth_home_t, file)
+')
+
+optional_policy(`
+ ssh_use_ptys(xauth_t) + ssh_use_ptys(xauth_t)
ssh_sigchld(xauth_t) ssh_sigchld(xauth_t)
ssh_read_pipes(xauth_t) ssh_read_pipes(xauth_t)
ssh_dontaudit_rw_tcp_sockets(xauth_t) ssh_dontaudit_rw_tcp_sockets(xauth_t)
@@ -300,64 +413,103 @@ optional_policy(` @@ -300,64 +420,103 @@ optional_policy(`
# XDM Local policy # XDM Local policy
# #
@ -26081,14 +26088,14 @@ index 8b40377..635442b 100644
allow xdm_t self:appletalk_socket create_socket_perms; allow xdm_t self:appletalk_socket create_socket_perms;
allow xdm_t self:key { search link write }; allow xdm_t self:key { search link write };
+allow xdm_t self:dbus { send_msg acquire_svc }; +allow xdm_t self:dbus { send_msg acquire_svc };
+
-allow xdm_t xconsole_device_t:fifo_file { getattr setattr };
+allow xdm_t xauth_home_t:file manage_file_perms; +allow xdm_t xauth_home_t:file manage_file_perms;
+ +
+allow xdm_t xconsole_device_t:fifo_file { getattr_fifo_file_perms setattr_fifo_file_perms }; +allow xdm_t xconsole_device_t:fifo_file { getattr_fifo_file_perms setattr_fifo_file_perms };
+manage_dirs_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t) +manage_dirs_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t)
+manage_files_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t) +manage_files_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t)
+
-allow xdm_t xconsole_device_t:fifo_file { getattr setattr };
+manage_dirs_pattern(xdm_t, xdm_home_t, xdm_home_t) +manage_dirs_pattern(xdm_t, xdm_home_t, xdm_home_t)
+manage_files_pattern(xdm_t, xdm_home_t, xdm_home_t) +manage_files_pattern(xdm_t, xdm_home_t, xdm_home_t)
+xserver_filetrans_home_content(xdm_t) +xserver_filetrans_home_content(xdm_t)
@ -26170,7 +26177,7 @@ index 8b40377..635442b 100644
# connect to xdm xserver over stream socket # connect to xdm xserver over stream socket
stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t)
@@ -366,20 +518,30 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) @@ -366,20 +525,30 @@ stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t)
delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)
delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)
@ -26203,7 +26210,7 @@ index 8b40377..635442b 100644
corenet_all_recvfrom_netlabel(xdm_t) corenet_all_recvfrom_netlabel(xdm_t)
corenet_tcp_sendrecv_generic_if(xdm_t) corenet_tcp_sendrecv_generic_if(xdm_t)
corenet_udp_sendrecv_generic_if(xdm_t) corenet_udp_sendrecv_generic_if(xdm_t)
@@ -389,38 +551,49 @@ corenet_tcp_sendrecv_all_ports(xdm_t) @@ -389,38 +558,49 @@ corenet_tcp_sendrecv_all_ports(xdm_t)
corenet_udp_sendrecv_all_ports(xdm_t) corenet_udp_sendrecv_all_ports(xdm_t)
corenet_tcp_bind_generic_node(xdm_t) corenet_tcp_bind_generic_node(xdm_t)
corenet_udp_bind_generic_node(xdm_t) corenet_udp_bind_generic_node(xdm_t)
@ -26257,7 +26264,7 @@ index 8b40377..635442b 100644
files_read_etc_files(xdm_t) files_read_etc_files(xdm_t)
files_read_var_files(xdm_t) files_read_var_files(xdm_t)
@@ -431,9 +604,28 @@ files_list_mnt(xdm_t) @@ -431,9 +611,28 @@ files_list_mnt(xdm_t)
files_read_usr_files(xdm_t) files_read_usr_files(xdm_t)
# Poweroff wants to create the /poweroff file when run from xdm # Poweroff wants to create the /poweroff file when run from xdm
files_create_boot_flag(xdm_t) files_create_boot_flag(xdm_t)
@ -26286,7 +26293,7 @@ index 8b40377..635442b 100644
storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_read_fixed_disk(xdm_t)
storage_dontaudit_write_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t)
@@ -442,28 +634,45 @@ storage_dontaudit_raw_read_removable_device(xdm_t) @@ -442,28 +641,45 @@ storage_dontaudit_raw_read_removable_device(xdm_t)
storage_dontaudit_raw_write_removable_device(xdm_t) storage_dontaudit_raw_write_removable_device(xdm_t)
storage_dontaudit_setattr_removable_dev(xdm_t) storage_dontaudit_setattr_removable_dev(xdm_t)
storage_dontaudit_rw_scsi_generic(xdm_t) storage_dontaudit_rw_scsi_generic(xdm_t)
@ -26335,7 +26342,7 @@ index 8b40377..635442b 100644
userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_dontaudit_use_unpriv_user_fds(xdm_t)
userdom_create_all_users_keys(xdm_t) userdom_create_all_users_keys(xdm_t)
@@ -472,24 +681,155 @@ userdom_read_user_home_content_files(xdm_t) @@ -472,24 +688,155 @@ userdom_read_user_home_content_files(xdm_t)
# Search /proc for any user domain processes. # Search /proc for any user domain processes.
userdom_read_all_users_state(xdm_t) userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t) userdom_signal_all_users(xdm_t)
@ -26497,10 +26504,15 @@ index 8b40377..635442b 100644
tunable_policy(`xdm_sysadm_login',` tunable_policy(`xdm_sysadm_login',`
userdom_xsession_spec_domtrans_all_users(xdm_t) userdom_xsession_spec_domtrans_all_users(xdm_t)
# FIXME: # FIXME:
@@ -503,11 +843,26 @@ tunable_policy(`xdm_sysadm_login',` @@ -502,12 +849,31 @@ tunable_policy(`xdm_sysadm_login',`
# allow xserver_t xdm_tmpfs_t:file rw_file_perms;
') ')
optional_policy(` +tunable_policy(`xdm_bind_vnc_tcp_port',`
+ corenet_tcp_bind_vnc_port(xdm_t)
+')
+
+optional_policy(`
+ accountsd_read_lib_files(xdm_t) + accountsd_read_lib_files(xdm_t)
+ accountsd_dbus_chat(xdm_t) + accountsd_dbus_chat(xdm_t)
+') +')
@ -26513,7 +26525,7 @@ index 8b40377..635442b 100644
+ boinc_dontaudit_getattr_lib(xdm_t) + boinc_dontaudit_getattr_lib(xdm_t)
+') +')
+ +
+optional_policy(` optional_policy(`
alsa_domtrans(xdm_t) alsa_domtrans(xdm_t)
+ alsa_read_rw_config(xdm_t) + alsa_read_rw_config(xdm_t)
') ')
@ -26524,7 +26536,7 @@ index 8b40377..635442b 100644
') ')
optional_policy(` optional_policy(`
@@ -517,9 +872,34 @@ optional_policy(` @@ -517,9 +883,34 @@ optional_policy(`
optional_policy(` optional_policy(`
dbus_system_bus_client(xdm_t) dbus_system_bus_client(xdm_t)
dbus_connect_system_bus(xdm_t) dbus_connect_system_bus(xdm_t)
@ -26560,7 +26572,7 @@ index 8b40377..635442b 100644
') ')
') ')
@@ -530,6 +910,20 @@ optional_policy(` @@ -530,6 +921,20 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -26581,7 +26593,7 @@ index 8b40377..635442b 100644
hostname_exec(xdm_t) hostname_exec(xdm_t)
') ')
@@ -547,28 +941,78 @@ optional_policy(` @@ -547,28 +952,78 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -26669,7 +26681,7 @@ index 8b40377..635442b 100644
') ')
optional_policy(` optional_policy(`
@@ -580,6 +1024,14 @@ optional_policy(` @@ -580,6 +1035,14 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -26684,7 +26696,7 @@ index 8b40377..635442b 100644
xfs_stream_connect(xdm_t) xfs_stream_connect(xdm_t)
') ')
@@ -594,7 +1046,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t; @@ -594,7 +1057,7 @@ type_transition xserver_t xserver_t:x_colormap root_xcolormap_t;
type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t; type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t;
allow xserver_t { root_xdrawable_t x_domain }:x_drawable send; allow xserver_t { root_xdrawable_t x_domain }:x_drawable send;
@ -26693,7 +26705,7 @@ index 8b40377..635442b 100644
# setuid/setgid for the wrapper program to change UID # setuid/setgid for the wrapper program to change UID
# sys_rawio is for iopl access - should not be needed for frame-buffer # sys_rawio is for iopl access - should not be needed for frame-buffer
@@ -604,8 +1056,11 @@ allow xserver_t input_xevent_t:x_event send; @@ -604,8 +1067,11 @@ allow xserver_t input_xevent_t:x_event send;
# execheap needed until the X module loader is fixed. # execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack # NVIDIA Needs execstack
@ -26706,7 +26718,7 @@ index 8b40377..635442b 100644
allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow xserver_t self:fd use; allow xserver_t self:fd use;
allow xserver_t self:fifo_file rw_fifo_file_perms; allow xserver_t self:fifo_file rw_fifo_file_perms;
@@ -618,8 +1073,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; @@ -618,8 +1084,15 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:tcp_socket create_stream_socket_perms;
allow xserver_t self:udp_socket create_socket_perms; allow xserver_t self:udp_socket create_socket_perms;
@ -26722,7 +26734,7 @@ index 8b40377..635442b 100644
manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
@@ -627,6 +1089,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file }) @@ -627,6 +1100,10 @@ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file) filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t, sock_file)
@ -26733,7 +26745,7 @@ index 8b40377..635442b 100644
manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
@@ -638,25 +1104,32 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) @@ -638,25 +1115,32 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
files_search_var_lib(xserver_t) files_search_var_lib(xserver_t)
@ -26770,7 +26782,7 @@ index 8b40377..635442b 100644
corenet_all_recvfrom_netlabel(xserver_t) corenet_all_recvfrom_netlabel(xserver_t)
corenet_tcp_sendrecv_generic_if(xserver_t) corenet_tcp_sendrecv_generic_if(xserver_t)
corenet_udp_sendrecv_generic_if(xserver_t) corenet_udp_sendrecv_generic_if(xserver_t)
@@ -677,23 +1150,28 @@ dev_rw_apm_bios(xserver_t) @@ -677,23 +1161,28 @@ dev_rw_apm_bios(xserver_t)
dev_rw_agp(xserver_t) dev_rw_agp(xserver_t)
dev_rw_framebuffer(xserver_t) dev_rw_framebuffer(xserver_t)
dev_manage_dri_dev(xserver_t) dev_manage_dri_dev(xserver_t)
@ -26802,7 +26814,7 @@ index 8b40377..635442b 100644
# brought on by rhgb # brought on by rhgb
files_search_mnt(xserver_t) files_search_mnt(xserver_t)
@@ -705,6 +1183,14 @@ fs_search_nfs(xserver_t) @@ -705,6 +1194,14 @@ fs_search_nfs(xserver_t)
fs_search_auto_mountpoints(xserver_t) fs_search_auto_mountpoints(xserver_t)
fs_search_ramfs(xserver_t) fs_search_ramfs(xserver_t)
@ -26817,7 +26829,7 @@ index 8b40377..635442b 100644
mls_xwin_read_to_clearance(xserver_t) mls_xwin_read_to_clearance(xserver_t)
selinux_validate_context(xserver_t) selinux_validate_context(xserver_t)
@@ -718,20 +1204,18 @@ init_getpgid(xserver_t) @@ -718,20 +1215,18 @@ init_getpgid(xserver_t)
term_setattr_unallocated_ttys(xserver_t) term_setattr_unallocated_ttys(xserver_t)
term_use_unallocated_ttys(xserver_t) term_use_unallocated_ttys(xserver_t)
@ -26841,7 +26853,7 @@ index 8b40377..635442b 100644
userdom_search_user_home_dirs(xserver_t) userdom_search_user_home_dirs(xserver_t)
userdom_use_user_ttys(xserver_t) userdom_use_user_ttys(xserver_t)
@@ -739,8 +1223,6 @@ userdom_setattr_user_ttys(xserver_t) @@ -739,8 +1234,6 @@ userdom_setattr_user_ttys(xserver_t)
userdom_read_user_tmp_files(xserver_t) userdom_read_user_tmp_files(xserver_t)
userdom_rw_user_tmpfs_files(xserver_t) userdom_rw_user_tmpfs_files(xserver_t)
@ -26850,7 +26862,7 @@ index 8b40377..635442b 100644
ifndef(`distro_redhat',` ifndef(`distro_redhat',`
allow xserver_t self:process { execmem execheap execstack }; allow xserver_t self:process { execmem execheap execstack };
domain_mmap_low_uncond(xserver_t) domain_mmap_low_uncond(xserver_t)
@@ -785,17 +1267,50 @@ optional_policy(` @@ -785,17 +1278,50 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -26903,7 +26915,7 @@ index 8b40377..635442b 100644
') ')
optional_policy(` optional_policy(`
@@ -803,6 +1318,10 @@ optional_policy(` @@ -803,6 +1329,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -26914,7 +26926,7 @@ index 8b40377..635442b 100644
xfs_stream_connect(xserver_t) xfs_stream_connect(xserver_t)
') ')
@@ -818,18 +1337,17 @@ allow xserver_t xdm_t:shm rw_shm_perms; @@ -818,18 +1348,17 @@ allow xserver_t xdm_t:shm rw_shm_perms;
# NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open # NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open
# handle of a file inside the dir!!! # handle of a file inside the dir!!!
@ -26939,7 +26951,7 @@ index 8b40377..635442b 100644
can_exec(xserver_t, xkb_var_lib_t) can_exec(xserver_t, xkb_var_lib_t)
# VNC v4 module in X server # VNC v4 module in X server
@@ -842,26 +1360,21 @@ init_use_fds(xserver_t) @@ -842,26 +1371,21 @@ init_use_fds(xserver_t)
# to read ROLE_home_t - examine this in more detail # to read ROLE_home_t - examine this in more detail
# (xauth?) # (xauth?)
userdom_read_user_home_content_files(xserver_t) userdom_read_user_home_content_files(xserver_t)
@ -26974,7 +26986,7 @@ index 8b40377..635442b 100644
') ')
optional_policy(` optional_policy(`
@@ -912,7 +1425,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy @@ -912,7 +1436,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show }; allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show };
# operations allowed on my windows # operations allowed on my windows
allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive }; allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
@ -26983,7 +26995,7 @@ index 8b40377..635442b 100644
# operations allowed on all windows # operations allowed on all windows
allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child }; allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child };
@@ -966,11 +1479,31 @@ allow x_domain self:x_resource { read write }; @@ -966,11 +1490,31 @@ allow x_domain self:x_resource { read write };
# can mess with the screensaver # can mess with the screensaver
allow x_domain xserver_t:x_screen { getattr saver_getattr }; allow x_domain xserver_t:x_screen { getattr saver_getattr };
@ -27015,7 +27027,7 @@ index 8b40377..635442b 100644
tunable_policy(`! xserver_object_manager',` tunable_policy(`! xserver_object_manager',`
# should be xserver_unconfined(x_domain), # should be xserver_unconfined(x_domain),
# but typeattribute doesnt work in conditionals # but typeattribute doesnt work in conditionals
@@ -992,18 +1525,148 @@ tunable_policy(`! xserver_object_manager',` @@ -992,18 +1536,148 @@ tunable_policy(`! xserver_object_manager',`
allow x_domain xevent_type:{ x_event x_synthetic_event } *; allow x_domain xevent_type:{ x_event x_synthetic_event } *;
') ')
@ -30997,7 +31009,7 @@ index 79a45f6..b88e8a2 100644
+ init_pid_filetrans($1, systemd_unit_file_t, dir, "system") + init_pid_filetrans($1, systemd_unit_file_t, dir, "system")
+') +')
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 17eda24..32af6e4 100644 index 17eda24..1381948 100644
--- a/policy/modules/system/init.te --- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te +++ b/policy/modules/system/init.te
@@ -11,10 +11,31 @@ gen_require(` @@ -11,10 +11,31 @@ gen_require(`
@ -31875,7 +31887,7 @@ index 17eda24..32af6e4 100644
+ sysnet_relabelfrom_dhcpc_state(initrc_t) + sysnet_relabelfrom_dhcpc_state(initrc_t)
+ sysnet_relabelfrom_net_conf(initrc_t) + sysnet_relabelfrom_net_conf(initrc_t)
+ sysnet_relabelto_net_conf(initrc_t) + sysnet_relabelto_net_conf(initrc_t)
+ sysnet_filetrans_named_content(initrc_t) + #sysnet_filetrans_named_content(initrc_t)
+ ') + ')
+ +
+ optional_policy(` + optional_policy(`
@ -39130,10 +39142,10 @@ index 1447687..d5e6fb9 100644
seutil_read_config(setrans_t) seutil_read_config(setrans_t)
diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
index 40edc18..bdc6d52 100644 index 40edc18..963b974 100644
--- a/policy/modules/system/sysnetwork.fc --- a/policy/modules/system/sysnetwork.fc
+++ b/policy/modules/system/sysnetwork.fc +++ b/policy/modules/system/sysnetwork.fc
@@ -17,23 +17,28 @@ ifdef(`distro_debian',` @@ -17,23 +17,27 @@ ifdef(`distro_debian',`
/etc/dhclient.*conf -- gen_context(system_u:object_r:dhcp_etc_t,s0) /etc/dhclient.*conf -- gen_context(system_u:object_r:dhcp_etc_t,s0)
/etc/dhclient-script -- gen_context(system_u:object_r:dhcp_etc_t,s0) /etc/dhclient-script -- gen_context(system_u:object_r:dhcp_etc_t,s0)
/etc/dhcpc.* gen_context(system_u:object_r:dhcp_etc_t,s0) /etc/dhcpc.* gen_context(system_u:object_r:dhcp_etc_t,s0)
@ -39146,10 +39158,10 @@ index 40edc18..bdc6d52 100644
+/etc/hosts[^/]* -- gen_context(system_u:object_r:net_conf_t,s0) +/etc/hosts[^/]* -- gen_context(system_u:object_r:net_conf_t,s0)
/etc/hosts\.deny.* -- gen_context(system_u:object_r:net_conf_t,s0) /etc/hosts\.deny.* -- gen_context(system_u:object_r:net_conf_t,s0)
/etc/denyhosts.* -- gen_context(system_u:object_r:net_conf_t,s0) /etc/denyhosts.* -- gen_context(system_u:object_r:net_conf_t,s0)
/etc/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0) -/etc/resolv\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
+/etc/resolv\.conf.* gen_context(system_u:object_r:net_conf_t,s0)
/etc/yp\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0) /etc/yp\.conf.* -- gen_context(system_u:object_r:net_conf_t,s0)
+/etc/ntp\.conf -- gen_context(system_u:object_r:net_conf_t,s0) +/etc/ntp\.conf -- gen_context(system_u:object_r:net_conf_t,s0)
+/etc/\.resolv\.conf\.NetworkManager gen_context(system_u:object_r:net_conf_t,s0)
-/etc/dhcp3(/.*)? gen_context(system_u:object_r:dhcp_etc_t,s0) -/etc/dhcp3(/.*)? gen_context(system_u:object_r:dhcp_etc_t,s0)
+/etc/dhcp3?(/.*)? gen_context(system_u:object_r:dhcp_etc_t,s0) +/etc/dhcp3?(/.*)? gen_context(system_u:object_r:dhcp_etc_t,s0)
@ -39162,11 +39174,11 @@ index 40edc18..bdc6d52 100644
+/var/run/systemd/network(/.*)? gen_context(system_u:object_r:net_conf_t,s0) +/var/run/systemd/network(/.*)? gen_context(system_u:object_r:net_conf_t,s0)
+/var/run/systemd/resolve/resolv\.conf -- gen_context(system_u:object_r:net_conf_t,s0) +/var/run/systemd/resolve/resolv\.conf -- gen_context(system_u:object_r:net_conf_t,s0)
') ')
+/var/run/NetworkManager/resolve/resolv\.conf -- gen_context(system_u:object_r:net_conf_t,s0) +/var/run/NetworkManager/resolv\.conf -- gen_context(system_u:object_r:net_conf_t,s0)
# #
# /sbin # /sbin
@@ -44,6 +49,7 @@ ifdef(`distro_redhat',` @@ -44,6 +48,7 @@ ifdef(`distro_redhat',`
/sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0) /sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
/sbin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0) /sbin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
/sbin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0) /sbin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
@ -39174,7 +39186,7 @@ index 40edc18..bdc6d52 100644
/sbin/ipx_configure -- gen_context(system_u:object_r:ifconfig_exec_t,s0) /sbin/ipx_configure -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
/sbin/ipx_interface -- gen_context(system_u:object_r:ifconfig_exec_t,s0) /sbin/ipx_interface -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
/sbin/ipx_internal_net -- gen_context(system_u:object_r:ifconfig_exec_t,s0) /sbin/ipx_internal_net -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
@@ -55,6 +61,21 @@ ifdef(`distro_redhat',` @@ -55,6 +60,21 @@ ifdef(`distro_redhat',`
# #
# /usr # /usr
# #
@ -39196,7 +39208,7 @@ index 40edc18..bdc6d52 100644
/usr/sbin/tc -- gen_context(system_u:object_r:ifconfig_exec_t,s0) /usr/sbin/tc -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
# #
@@ -77,3 +98,6 @@ ifdef(`distro_debian',` @@ -77,3 +97,6 @@ ifdef(`distro_debian',`
/var/run/network(/.*)? gen_context(system_u:object_r:net_conf_t,s0) /var/run/network(/.*)? gen_context(system_u:object_r:net_conf_t,s0)
') ')
@ -39204,7 +39216,7 @@ index 40edc18..bdc6d52 100644
+/etc/firestarter/firestarter\.sh gen_context(system_u:object_r:dhcpc_helper_exec_t,s0) +/etc/firestarter/firestarter\.sh gen_context(system_u:object_r:dhcpc_helper_exec_t,s0)
+ +
diff --git a/policy/modules/system/sysnetwork.if b/policy/modules/system/sysnetwork.if diff --git a/policy/modules/system/sysnetwork.if b/policy/modules/system/sysnetwork.if
index 2cea692..b52919c 100644 index 2cea692..fcd75c1 100644
--- a/policy/modules/system/sysnetwork.if --- a/policy/modules/system/sysnetwork.if
+++ b/policy/modules/system/sysnetwork.if +++ b/policy/modules/system/sysnetwork.if
@@ -38,11 +38,30 @@ interface(`sysnet_domtrans_dhcpc',` @@ -38,11 +38,30 @@ interface(`sysnet_domtrans_dhcpc',`
@ -39355,10 +39367,14 @@ index 2cea692..b52919c 100644
read_files_pattern($1, net_conf_t, net_conf_t) read_files_pattern($1, net_conf_t, net_conf_t)
') ')
') ')
@@ -440,6 +538,40 @@ interface(`sysnet_etc_filetrans_config',` @@ -438,6 +536,42 @@ interface(`sysnet_etc_filetrans_config',`
files_etc_filetrans($1, net_conf_t, file, $2) ')
')
files_etc_filetrans($1, net_conf_t, file, $2)
+ files_etc_filetrans($1, net_conf_t, lnk_file, $2)
+
+')
+
+######################################## +########################################
+## <summary> +## <summary>
+## Transition content to the type used for +## Transition content to the type used for
@ -39391,12 +39407,19 @@ index 2cea692..b52919c 100644
+ ') + ')
+ +
+ filetrans_pattern($1, $2, net_conf_t, $3, $4) + filetrans_pattern($1, $2, net_conf_t, $3, $4)
+') ')
+
####################################### #######################################
## <summary> @@ -453,7 +587,7 @@ interface(`sysnet_etc_filetrans_config',`
## Create, read, write, and delete network config files. interface(`sysnet_manage_config',`
@@ -463,12 +595,45 @@ interface(`sysnet_manage_config',` gen_require(`
type net_conf_t;
- ')
+ ')
allow $1 net_conf_t:file manage_file_perms;
@@ -463,7 +597,42 @@ interface(`sysnet_manage_config',`
') ')
ifdef(`distro_redhat',` ifdef(`distro_redhat',`
@ -39404,11 +39427,13 @@ index 2cea692..b52919c 100644
+ init_search_pid_dirs($1) + init_search_pid_dirs($1)
+ allow $1 net_conf_t:dir list_dir_perms; + allow $1 net_conf_t:dir list_dir_perms;
manage_files_pattern($1, net_conf_t, net_conf_t) manage_files_pattern($1, net_conf_t, net_conf_t)
') + manage_lnk_files_pattern($1, net_conf_t, net_conf_t)
') + ')
+ sysnet_filetrans_named_content($1)
####################################### +')
## <summary> +
+#######################################
+## <summary>
+## Create, read, write, and delete network config dirs. +## Create, read, write, and delete network config dirs.
+## </summary> +## </summary>
+## <param name="domain"> +## <param name="domain">
@ -39434,15 +39459,10 @@ index 2cea692..b52919c 100644
+ init_search_pid_dirs($1) + init_search_pid_dirs($1)
+ allow $1 net_conf_t:dir list_dir_perms; + allow $1 net_conf_t:dir list_dir_perms;
+ manage_dirs_pattern($1, net_conf_t, net_conf_t) + manage_dirs_pattern($1, net_conf_t, net_conf_t)
+ ') ')
+') ')
+
+####################################### @@ -501,6 +670,7 @@ interface(`sysnet_delete_dhcpc_pid',`
+## <summary>
## Read the dhcp client pid file.
## </summary>
## <param name="domain">
@@ -501,6 +666,7 @@ interface(`sysnet_delete_dhcpc_pid',`
type dhcpc_var_run_t; type dhcpc_var_run_t;
') ')
@ -39450,7 +39470,7 @@ index 2cea692..b52919c 100644
allow $1 dhcpc_var_run_t:file unlink; allow $1 dhcpc_var_run_t:file unlink;
') ')
@@ -610,6 +776,25 @@ interface(`sysnet_signull_ifconfig',` @@ -610,6 +780,25 @@ interface(`sysnet_signull_ifconfig',`
######################################## ########################################
## <summary> ## <summary>
@ -39476,7 +39496,7 @@ index 2cea692..b52919c 100644
## Read the DHCP configuration files. ## Read the DHCP configuration files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -626,6 +811,7 @@ interface(`sysnet_read_dhcp_config',` @@ -626,6 +815,7 @@ interface(`sysnet_read_dhcp_config',`
files_search_etc($1) files_search_etc($1)
allow $1 dhcp_etc_t:dir list_dir_perms; allow $1 dhcp_etc_t:dir list_dir_perms;
read_files_pattern($1, dhcp_etc_t, dhcp_etc_t) read_files_pattern($1, dhcp_etc_t, dhcp_etc_t)
@ -39484,7 +39504,7 @@ index 2cea692..b52919c 100644
') ')
######################################## ########################################
@@ -647,6 +833,26 @@ interface(`sysnet_search_dhcp_state',` @@ -647,6 +837,26 @@ interface(`sysnet_search_dhcp_state',`
allow $1 dhcp_state_t:dir search_dir_perms; allow $1 dhcp_state_t:dir search_dir_perms;
') ')
@ -39511,7 +39531,7 @@ index 2cea692..b52919c 100644
######################################## ########################################
## <summary> ## <summary>
## Create DHCP state data. ## Create DHCP state data.
@@ -711,8 +917,6 @@ interface(`sysnet_dns_name_resolve',` @@ -711,8 +921,6 @@ interface(`sysnet_dns_name_resolve',`
allow $1 self:udp_socket create_socket_perms; allow $1 self:udp_socket create_socket_perms;
allow $1 self:netlink_route_socket r_netlink_socket_perms; allow $1 self:netlink_route_socket r_netlink_socket_perms;
@ -39520,7 +39540,7 @@ index 2cea692..b52919c 100644
corenet_tcp_sendrecv_generic_if($1) corenet_tcp_sendrecv_generic_if($1)
corenet_udp_sendrecv_generic_if($1) corenet_udp_sendrecv_generic_if($1)
corenet_tcp_sendrecv_generic_node($1) corenet_tcp_sendrecv_generic_node($1)
@@ -720,8 +924,11 @@ interface(`sysnet_dns_name_resolve',` @@ -720,8 +928,11 @@ interface(`sysnet_dns_name_resolve',`
corenet_tcp_sendrecv_dns_port($1) corenet_tcp_sendrecv_dns_port($1)
corenet_udp_sendrecv_dns_port($1) corenet_udp_sendrecv_dns_port($1)
corenet_tcp_connect_dns_port($1) corenet_tcp_connect_dns_port($1)
@ -39532,7 +39552,7 @@ index 2cea692..b52919c 100644
sysnet_read_config($1) sysnet_read_config($1)
optional_policy(` optional_policy(`
@@ -750,8 +957,6 @@ interface(`sysnet_use_ldap',` @@ -750,8 +961,6 @@ interface(`sysnet_use_ldap',`
allow $1 self:tcp_socket create_socket_perms; allow $1 self:tcp_socket create_socket_perms;
@ -39541,7 +39561,7 @@ index 2cea692..b52919c 100644
corenet_tcp_sendrecv_generic_if($1) corenet_tcp_sendrecv_generic_if($1)
corenet_tcp_sendrecv_generic_node($1) corenet_tcp_sendrecv_generic_node($1)
corenet_tcp_sendrecv_ldap_port($1) corenet_tcp_sendrecv_ldap_port($1)
@@ -760,9 +965,14 @@ interface(`sysnet_use_ldap',` @@ -760,9 +969,14 @@ interface(`sysnet_use_ldap',`
# Support for LDAPS # Support for LDAPS
dev_read_rand($1) dev_read_rand($1)
@ -39556,7 +39576,7 @@ index 2cea692..b52919c 100644
') ')
######################################## ########################################
@@ -784,7 +994,6 @@ interface(`sysnet_use_portmap',` @@ -784,7 +998,6 @@ interface(`sysnet_use_portmap',`
allow $1 self:udp_socket create_socket_perms; allow $1 self:udp_socket create_socket_perms;
corenet_all_recvfrom_unlabeled($1) corenet_all_recvfrom_unlabeled($1)
@ -39564,7 +39584,7 @@ index 2cea692..b52919c 100644
corenet_tcp_sendrecv_generic_if($1) corenet_tcp_sendrecv_generic_if($1)
corenet_udp_sendrecv_generic_if($1) corenet_udp_sendrecv_generic_if($1)
corenet_tcp_sendrecv_generic_node($1) corenet_tcp_sendrecv_generic_node($1)
@@ -796,3 +1005,120 @@ interface(`sysnet_use_portmap',` @@ -796,3 +1009,122 @@ interface(`sysnet_use_portmap',`
sysnet_read_config($1) sysnet_read_config($1)
') ')
@ -39634,6 +39654,7 @@ index 2cea692..b52919c 100644
+ files_etc_filetrans($1, net_conf_t, file, "resolv.conf.tmp") + files_etc_filetrans($1, net_conf_t, file, "resolv.conf.tmp")
+ files_etc_filetrans($1, net_conf_t, file, "resolv.conf.fp-tmp") + files_etc_filetrans($1, net_conf_t, file, "resolv.conf.fp-tmp")
+ files_etc_filetrans($1, net_conf_t, file, "resolv.conf.fp-saved") + files_etc_filetrans($1, net_conf_t, file, "resolv.conf.fp-saved")
+ files_etc_filetrans($1, net_conf_t, lnk_file, ".resolv.conf")
+ files_etc_filetrans($1, net_conf_t, lnk_file, ".resolv.conf.NetworkManager") + files_etc_filetrans($1, net_conf_t, lnk_file, ".resolv.conf.NetworkManager")
+ files_etc_filetrans($1, net_conf_t, file, "denyhosts") + files_etc_filetrans($1, net_conf_t, file, "denyhosts")
+ files_etc_filetrans($1, net_conf_t, file, "hosts") + files_etc_filetrans($1, net_conf_t, file, "hosts")
@ -39644,8 +39665,9 @@ index 2cea692..b52919c 100644
+ init_pid_filetrans($1, net_conf_t, dir, "network") + init_pid_filetrans($1, net_conf_t, dir, "network")
+ +
+ optional_policy(` + optional_policy(`
+ networkmanager_pid_filetrans($1, net_conf_t, file, "resolv.conf") + networkmanager_pid_filetrans($1, net_conf_t, file, "resolv.conf")
+ ') + networkmanager_pid_filetrans($1, net_conf_t, file, "resolv.conf.tmp")
+ ')
+') +')
+ +
+######################################## +########################################
@ -41601,10 +41623,10 @@ index 0000000..d2a8fc7
+') +')
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644 new file mode 100644
index 0000000..db531dc index 0000000..3ebbad0
--- /dev/null --- /dev/null
+++ b/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te
@@ -0,0 +1,707 @@ @@ -0,0 +1,706 @@
+policy_module(systemd, 1.0.0) +policy_module(systemd, 1.0.0)
+ +
+####################################### +#######################################
@ -41863,7 +41885,6 @@ index 0000000..db531dc
+ +
+auth_read_passwd(systemd_networkd_t) +auth_read_passwd(systemd_networkd_t)
+ +
+sysnet_filetrans_named_content(systemd_networkd_t)
+sysnet_manage_config(systemd_networkd_t) +sysnet_manage_config(systemd_networkd_t)
+sysnet_manage_config_dirs(systemd_networkd_t) +sysnet_manage_config_dirs(systemd_networkd_t)
+ +
@ -42610,7 +42631,7 @@ index 9a1650d..d7e8a01 100644
######################################## ########################################
diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
index 39f185f..880b174 100644 index 39f185f..a253f3f 100644
--- a/policy/modules/system/udev.te --- a/policy/modules/system/udev.te
+++ b/policy/modules/system/udev.te +++ b/policy/modules/system/udev.te
@@ -17,16 +17,17 @@ init_daemon_domain(udev_t, udev_exec_t) @@ -17,16 +17,17 @@ init_daemon_domain(udev_t, udev_exec_t)
@ -42769,12 +42790,11 @@ index 39f185f..880b174 100644
seutil_read_config(udev_t) seutil_read_config(udev_t)
seutil_read_default_contexts(udev_t) seutil_read_default_contexts(udev_t)
@@ -169,7 +191,11 @@ sysnet_read_dhcpc_pid(udev_t) @@ -169,7 +191,10 @@ sysnet_read_dhcpc_pid(udev_t)
sysnet_delete_dhcpc_pid(udev_t) sysnet_delete_dhcpc_pid(udev_t)
sysnet_signal_dhcpc(udev_t) sysnet_signal_dhcpc(udev_t)
sysnet_manage_config(udev_t) sysnet_manage_config(udev_t)
-sysnet_etc_filetrans_config(udev_t) -sysnet_etc_filetrans_config(udev_t)
+sysnet_filetrans_named_content(udev_t)
+#sysnet_etc_filetrans_config(udev_t) +#sysnet_etc_filetrans_config(udev_t)
+ +
+systemd_login_read_pid_files(udev_t) +systemd_login_read_pid_files(udev_t)
@ -42782,7 +42802,7 @@ index 39f185f..880b174 100644
userdom_dontaudit_search_user_home_content(udev_t) userdom_dontaudit_search_user_home_content(udev_t)
@@ -195,16 +221,9 @@ ifdef(`distro_gentoo',` @@ -195,16 +220,9 @@ ifdef(`distro_gentoo',`
') ')
ifdef(`distro_redhat',` ifdef(`distro_redhat',`
@ -42801,7 +42821,7 @@ index 39f185f..880b174 100644
# for arping used for static IP addresses on PCMCIA ethernet # for arping used for static IP addresses on PCMCIA ethernet
netutils_domtrans(udev_t) netutils_domtrans(udev_t)
@@ -242,6 +261,7 @@ optional_policy(` @@ -242,6 +260,7 @@ optional_policy(`
optional_policy(` optional_policy(`
cups_domtrans_config(udev_t) cups_domtrans_config(udev_t)
@ -42809,7 +42829,7 @@ index 39f185f..880b174 100644
') ')
optional_policy(` optional_policy(`
@@ -249,17 +269,31 @@ optional_policy(` @@ -249,17 +268,31 @@ optional_policy(`
dbus_use_system_bus_fds(udev_t) dbus_use_system_bus_fds(udev_t)
optional_policy(` optional_policy(`
@ -42843,7 +42863,7 @@ index 39f185f..880b174 100644
') ')
optional_policy(` optional_policy(`
@@ -289,6 +323,10 @@ optional_policy(` @@ -289,6 +322,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -42854,7 +42874,7 @@ index 39f185f..880b174 100644
openct_read_pid_files(udev_t) openct_read_pid_files(udev_t)
openct_domtrans(udev_t) openct_domtrans(udev_t)
') ')
@@ -303,6 +341,15 @@ optional_policy(` @@ -303,6 +340,15 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -42870,7 +42890,7 @@ index 39f185f..880b174 100644
unconfined_signal(udev_t) unconfined_signal(udev_t)
') ')
@@ -315,6 +362,7 @@ optional_policy(` @@ -315,6 +361,7 @@ optional_policy(`
kernel_read_xen_state(udev_t) kernel_read_xen_state(udev_t)
xen_manage_log(udev_t) xen_manage_log(udev_t)
xen_read_image_files(udev_t) xen_read_image_files(udev_t)

14
policy-rawhide-contrib.patch
View File

@ -27741,7 +27741,7 @@ index 50d0084..94e1936 100644
fail2ban_run_client($1, $2) fail2ban_run_client($1, $2)
diff --git a/fail2ban.te b/fail2ban.te diff --git a/fail2ban.te b/fail2ban.te
index cf0e567..9ebb247 100644 index cf0e567..6c3ce35 100644
--- a/fail2ban.te --- a/fail2ban.te
+++ b/fail2ban.te +++ b/fail2ban.te
@@ -37,7 +37,7 @@ role fail2ban_client_roles types fail2ban_client_t; @@ -37,7 +37,7 @@ role fail2ban_client_roles types fail2ban_client_t;
@ -27769,7 +27769,7 @@ index cf0e567..9ebb247 100644
files_list_var(fail2ban_t) files_list_var(fail2ban_t)
files_dontaudit_list_tmp(fail2ban_t) files_dontaudit_list_tmp(fail2ban_t)
@@ -92,24 +90,38 @@ fs_getattr_all_fs(fail2ban_t) @@ -92,24 +90,37 @@ fs_getattr_all_fs(fail2ban_t)
auth_use_nsswitch(fail2ban_t) auth_use_nsswitch(fail2ban_t)
logging_read_all_logs(fail2ban_t) logging_read_all_logs(fail2ban_t)
@ -27785,7 +27785,6 @@ index cf0e567..9ebb247 100644
-sysnet_etc_filetrans_config(fail2ban_t) -sysnet_etc_filetrans_config(fail2ban_t)
- -
-mta_send_mail(fail2ban_t) -mta_send_mail(fail2ban_t)
+sysnet_filetrans_named_content(fail2ban_t)
optional_policy(` optional_policy(`
apache_read_log(fail2ban_t) apache_read_log(fail2ban_t)
@ -27812,7 +27811,7 @@ index cf0e567..9ebb247 100644
iptables_domtrans(fail2ban_t) iptables_domtrans(fail2ban_t)
') ')
@@ -118,6 +130,10 @@ optional_policy(` @@ -118,6 +129,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -27823,7 +27822,7 @@ index cf0e567..9ebb247 100644
shorewall_domtrans(fail2ban_t) shorewall_domtrans(fail2ban_t)
') ')
@@ -131,22 +147,30 @@ allow fail2ban_client_t self:unix_stream_socket { create connect write read }; @@ -131,22 +146,30 @@ allow fail2ban_client_t self:unix_stream_socket { create connect write read };
domtrans_pattern(fail2ban_client_t, fail2ban_exec_t, fail2ban_t) domtrans_pattern(fail2ban_client_t, fail2ban_exec_t, fail2ban_t)
@ -101816,10 +101815,10 @@ index 0000000..9524b50
+') +')
diff --git a/thumb.te b/thumb.te diff --git a/thumb.te b/thumb.te
new file mode 100644 new file mode 100644
index 0000000..02ed710 index 0000000..e80cde4
--- /dev/null --- /dev/null
+++ b/thumb.te +++ b/thumb.te
@@ -0,0 +1,161 @@ @@ -0,0 +1,162 @@
+policy_module(thumb, 1.0.0) +policy_module(thumb, 1.0.0)
+ +
+######################################## +########################################
@ -101891,6 +101890,7 @@ index 0000000..02ed710
+corecmd_exec_shell(thumb_t) +corecmd_exec_shell(thumb_t)
+ +
+corenet_tcp_connect_xserver_port(thumb_t) +corenet_tcp_connect_xserver_port(thumb_t)
+corenet_dontaudit_tcp_connect_all_ports(thumb_t)
+ +
+dev_read_sysfs(thumb_t) +dev_read_sysfs(thumb_t)
+dev_read_urand(thumb_t) +dev_read_urand(thumb_t)

8
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.13.1 Version: 3.13.1
Release: 107%{?dist} Release: 108%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -605,6 +605,12 @@ SELinux Reference policy mls base module.
%endif %endif
%changelog %changelog
* Wed Feb 04 2015 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-108
- Fix labels, improve sysnet_manage_config interface.
- Label /var/run/NetworkManager/resolv.conf.tmp as net_conf_t.
- Dontaudit network connections related to thumb_t. BZ(1187981)
- Remove sysnet_filetrans_named_content from fail2ban
* Thu Feb 02 2015 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-107 * Thu Feb 02 2015 Lukas Vrabec <lvrabec@redhat.com> 3.13.1-107
- Fix labels on new location of resolv.conf - Fix labels on new location of resolv.conf
- syslog is not writing to the audit socket - syslog is not writing to the audit socket