rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

* Fri Jun 20 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-61

Browse Source 
- Add back MLS policy
This commit is contained in:
Miroslav Grepl 2014-06-20 16:27:18 +02:00
parent c04c318879
commit 211fb9932a
3 changed files with 109 additions and 68 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

103
policy-rawhide-base.patch
View File

@ -27856,7 +27856,7 @@ index edece47..cb014fd 100644
') ')
diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc diff --git a/policy/modules/system/fstools.fc b/policy/modules/system/fstools.fc
index 948ce2a..1b38e87 100644 index 948ce2a..8cab8ae 100644
--- a/policy/modules/system/fstools.fc --- a/policy/modules/system/fstools.fc
+++ b/policy/modules/system/fstools.fc +++ b/policy/modules/system/fstools.fc
@@ -1,4 +1,3 @@ @@ -1,4 +1,3 @@
@ -27872,7 +27872,7 @@ index 948ce2a..1b38e87 100644
/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -36,14 +34,53 @@ @@ -36,14 +34,55 @@
/sbin/swapoff -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/swapoff -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
@ -27920,8 +27920,10 @@ index 948ce2a..1b38e87 100644
+/usr/sbin/scsi_info -- gen_context(system_u:object_r:fsadm_exec_t,s0) +/usr/sbin/scsi_info -- gen_context(system_u:object_r:fsadm_exec_t,s0)
+/usr/sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0) +/usr/sbin/sfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/usr/sbin/smartctl -- gen_context(system_u:object_r:fsadm_exec_t,s0) /usr/sbin/smartctl -- gen_context(system_u:object_r:fsadm_exec_t,s0)
+/usr/sbin/swapoff -- gen_context(system_u:object_r:fsadm_exec_t,s0)
+/usr/sbin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) +/usr/sbin/swapon.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
+/usr/sbin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0) +/usr/sbin/tune2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
+/usr/sbin/xfs_growfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/var/log/fsck(/.*)? gen_context(system_u:object_r:fsadm_log_t,s0) /var/log/fsck(/.*)? gen_context(system_u:object_r:fsadm_log_t,s0)
+ +
@ -29903,7 +29905,7 @@ index 79a45f6..89b43aa 100644
+ files_etc_filetrans($1, machineid_t, file, "machine-id" ) + files_etc_filetrans($1, machineid_t, file, "machine-id" )
+') +')
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 17eda24..fc94c2a 100644 index 17eda24..7c66e96 100644
--- a/policy/modules/system/init.te --- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te +++ b/policy/modules/system/init.te
@@ -11,10 +11,31 @@ gen_require(` @@ -11,10 +11,31 @@ gen_require(`
@ -30177,7 +30179,7 @@ index 17eda24..fc94c2a 100644
ifdef(`distro_gentoo',` ifdef(`distro_gentoo',`
allow init_t self:process { getcap setcap }; allow init_t self:process { getcap setcap };
@@ -186,29 +305,236 @@ ifdef(`distro_gentoo',` @@ -186,29 +305,237 @@ ifdef(`distro_gentoo',`
') ')
ifdef(`distro_redhat',` ifdef(`distro_redhat',`
@ -30413,7 +30415,8 @@ index 17eda24..fc94c2a 100644
optional_policy(` optional_policy(`
- nscd_use(init_t) - nscd_use(init_t)
+ networkmanager_stream_connect(init_t) + networkmanager_stream_connect(init_t)
+ networkmanager_stream_connect(initrc_t)
+') +')
+ +
+optional_policy(` +optional_policy(`
@ -30423,7 +30426,7 @@ index 17eda24..fc94c2a 100644
') ')
optional_policy(` optional_policy(`
@@ -216,7 +542,31 @@ optional_policy(` @@ -216,7 +543,31 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30455,7 +30458,7 @@ index 17eda24..fc94c2a 100644
') ')
######################################## ########################################
@@ -225,9 +575,9 @@ optional_policy(` @@ -225,9 +576,9 @@ optional_policy(`
# #
allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched }; allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
@ -30467,7 +30470,7 @@ index 17eda24..fc94c2a 100644
allow initrc_t self:passwd rootok; allow initrc_t self:passwd rootok;
allow initrc_t self:key manage_key_perms; allow initrc_t self:key manage_key_perms;
@@ -258,12 +608,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t) @@ -258,12 +609,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
allow initrc_t initrc_var_run_t:file manage_file_perms; allow initrc_t initrc_var_run_t:file manage_file_perms;
files_pid_filetrans(initrc_t, initrc_var_run_t, file) files_pid_filetrans(initrc_t, initrc_var_run_t, file)
@ -30484,7 +30487,7 @@ index 17eda24..fc94c2a 100644
manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t) manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t) manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
@@ -279,23 +633,36 @@ kernel_change_ring_buffer_level(initrc_t) @@ -279,23 +634,36 @@ kernel_change_ring_buffer_level(initrc_t)
kernel_clear_ring_buffer(initrc_t) kernel_clear_ring_buffer(initrc_t)
kernel_get_sysvipc_info(initrc_t) kernel_get_sysvipc_info(initrc_t)
kernel_read_all_sysctls(initrc_t) kernel_read_all_sysctls(initrc_t)
@ -30527,7 +30530,7 @@ index 17eda24..fc94c2a 100644
corenet_tcp_sendrecv_all_ports(initrc_t) corenet_tcp_sendrecv_all_ports(initrc_t)
corenet_udp_sendrecv_all_ports(initrc_t) corenet_udp_sendrecv_all_ports(initrc_t)
corenet_tcp_connect_all_ports(initrc_t) corenet_tcp_connect_all_ports(initrc_t)
@@ -303,9 +670,11 @@ corenet_sendrecv_all_client_packets(initrc_t) @@ -303,9 +671,11 @@ corenet_sendrecv_all_client_packets(initrc_t)
dev_read_rand(initrc_t) dev_read_rand(initrc_t)
dev_read_urand(initrc_t) dev_read_urand(initrc_t)
@ -30539,7 +30542,7 @@ index 17eda24..fc94c2a 100644
dev_rw_sysfs(initrc_t) dev_rw_sysfs(initrc_t)
dev_list_usbfs(initrc_t) dev_list_usbfs(initrc_t)
dev_read_framebuffer(initrc_t) dev_read_framebuffer(initrc_t)
@@ -313,8 +682,10 @@ dev_write_framebuffer(initrc_t) @@ -313,8 +683,10 @@ dev_write_framebuffer(initrc_t)
dev_read_realtime_clock(initrc_t) dev_read_realtime_clock(initrc_t)
dev_read_sound_mixer(initrc_t) dev_read_sound_mixer(initrc_t)
dev_write_sound_mixer(initrc_t) dev_write_sound_mixer(initrc_t)
@ -30550,7 +30553,7 @@ index 17eda24..fc94c2a 100644
dev_delete_lvm_control_dev(initrc_t) dev_delete_lvm_control_dev(initrc_t)
dev_manage_generic_symlinks(initrc_t) dev_manage_generic_symlinks(initrc_t)
dev_manage_generic_files(initrc_t) dev_manage_generic_files(initrc_t)
@@ -322,8 +693,7 @@ dev_manage_generic_files(initrc_t) @@ -322,8 +694,7 @@ dev_manage_generic_files(initrc_t)
dev_delete_generic_symlinks(initrc_t) dev_delete_generic_symlinks(initrc_t)
dev_getattr_all_blk_files(initrc_t) dev_getattr_all_blk_files(initrc_t)
dev_getattr_all_chr_files(initrc_t) dev_getattr_all_chr_files(initrc_t)
@ -30560,7 +30563,7 @@ index 17eda24..fc94c2a 100644
domain_kill_all_domains(initrc_t) domain_kill_all_domains(initrc_t)
domain_signal_all_domains(initrc_t) domain_signal_all_domains(initrc_t)
@@ -332,7 +702,6 @@ domain_sigstop_all_domains(initrc_t) @@ -332,7 +703,6 @@ domain_sigstop_all_domains(initrc_t)
domain_sigchld_all_domains(initrc_t) domain_sigchld_all_domains(initrc_t)
domain_read_all_domains_state(initrc_t) domain_read_all_domains_state(initrc_t)
domain_getattr_all_domains(initrc_t) domain_getattr_all_domains(initrc_t)
@ -30568,7 +30571,7 @@ index 17eda24..fc94c2a 100644
domain_getsession_all_domains(initrc_t) domain_getsession_all_domains(initrc_t)
domain_use_interactive_fds(initrc_t) domain_use_interactive_fds(initrc_t)
# for lsof which is used by alsa shutdown: # for lsof which is used by alsa shutdown:
@@ -340,6 +709,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t) @@ -340,6 +710,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
domain_dontaudit_getattr_all_tcp_sockets(initrc_t) domain_dontaudit_getattr_all_tcp_sockets(initrc_t)
domain_dontaudit_getattr_all_dgram_sockets(initrc_t) domain_dontaudit_getattr_all_dgram_sockets(initrc_t)
domain_dontaudit_getattr_all_pipes(initrc_t) domain_dontaudit_getattr_all_pipes(initrc_t)
@ -30576,7 +30579,7 @@ index 17eda24..fc94c2a 100644
files_getattr_all_dirs(initrc_t) files_getattr_all_dirs(initrc_t)
files_getattr_all_files(initrc_t) files_getattr_all_files(initrc_t)
@@ -347,14 +717,15 @@ files_getattr_all_symlinks(initrc_t) @@ -347,14 +718,15 @@ files_getattr_all_symlinks(initrc_t)
files_getattr_all_pipes(initrc_t) files_getattr_all_pipes(initrc_t)
files_getattr_all_sockets(initrc_t) files_getattr_all_sockets(initrc_t)
files_purge_tmp(initrc_t) files_purge_tmp(initrc_t)
@ -30594,7 +30597,7 @@ index 17eda24..fc94c2a 100644
files_read_usr_files(initrc_t) files_read_usr_files(initrc_t)
files_manage_urandom_seed(initrc_t) files_manage_urandom_seed(initrc_t)
files_manage_generic_spool(initrc_t) files_manage_generic_spool(initrc_t)
@@ -364,8 +735,12 @@ files_list_isid_type_dirs(initrc_t) @@ -364,8 +736,12 @@ files_list_isid_type_dirs(initrc_t)
files_mounton_isid_type_dirs(initrc_t) files_mounton_isid_type_dirs(initrc_t)
files_list_default(initrc_t) files_list_default(initrc_t)
files_mounton_default(initrc_t) files_mounton_default(initrc_t)
@ -30608,7 +30611,7 @@ index 17eda24..fc94c2a 100644
fs_list_inotifyfs(initrc_t) fs_list_inotifyfs(initrc_t)
fs_register_binary_executable_type(initrc_t) fs_register_binary_executable_type(initrc_t)
# rhgb-console writes to ramfs # rhgb-console writes to ramfs
@@ -375,10 +750,11 @@ fs_mount_all_fs(initrc_t) @@ -375,10 +751,11 @@ fs_mount_all_fs(initrc_t)
fs_unmount_all_fs(initrc_t) fs_unmount_all_fs(initrc_t)
fs_remount_all_fs(initrc_t) fs_remount_all_fs(initrc_t)
fs_getattr_all_fs(initrc_t) fs_getattr_all_fs(initrc_t)
@ -30622,7 +30625,7 @@ index 17eda24..fc94c2a 100644
mcs_process_set_categories(initrc_t) mcs_process_set_categories(initrc_t)
mls_file_read_all_levels(initrc_t) mls_file_read_all_levels(initrc_t)
@@ -387,8 +763,10 @@ mls_process_read_up(initrc_t) @@ -387,8 +764,10 @@ mls_process_read_up(initrc_t)
mls_process_write_down(initrc_t) mls_process_write_down(initrc_t)
mls_rangetrans_source(initrc_t) mls_rangetrans_source(initrc_t)
mls_fd_share_all_levels(initrc_t) mls_fd_share_all_levels(initrc_t)
@ -30633,7 +30636,7 @@ index 17eda24..fc94c2a 100644
storage_getattr_fixed_disk_dev(initrc_t) storage_getattr_fixed_disk_dev(initrc_t)
storage_setattr_fixed_disk_dev(initrc_t) storage_setattr_fixed_disk_dev(initrc_t)
@@ -398,6 +776,7 @@ term_use_all_terms(initrc_t) @@ -398,6 +777,7 @@ term_use_all_terms(initrc_t)
term_reset_tty_labels(initrc_t) term_reset_tty_labels(initrc_t)
auth_rw_login_records(initrc_t) auth_rw_login_records(initrc_t)
@ -30641,7 +30644,7 @@ index 17eda24..fc94c2a 100644
auth_setattr_login_records(initrc_t) auth_setattr_login_records(initrc_t)
auth_rw_lastlog(initrc_t) auth_rw_lastlog(initrc_t)
auth_read_pam_pid(initrc_t) auth_read_pam_pid(initrc_t)
@@ -416,20 +795,18 @@ logging_read_all_logs(initrc_t) @@ -416,20 +796,18 @@ logging_read_all_logs(initrc_t)
logging_append_all_logs(initrc_t) logging_append_all_logs(initrc_t)
logging_read_audit_config(initrc_t) logging_read_audit_config(initrc_t)
@ -30665,7 +30668,7 @@ index 17eda24..fc94c2a 100644
ifdef(`distro_debian',` ifdef(`distro_debian',`
dev_setattr_generic_dirs(initrc_t) dev_setattr_generic_dirs(initrc_t)
@@ -451,7 +828,6 @@ ifdef(`distro_gentoo',` @@ -451,7 +829,6 @@ ifdef(`distro_gentoo',`
allow initrc_t self:process setfscreate; allow initrc_t self:process setfscreate;
dev_create_null_dev(initrc_t) dev_create_null_dev(initrc_t)
dev_create_zero_dev(initrc_t) dev_create_zero_dev(initrc_t)
@ -30673,7 +30676,7 @@ index 17eda24..fc94c2a 100644
term_create_console_dev(initrc_t) term_create_console_dev(initrc_t)
# unfortunately /sbin/rc does stupid tricks # unfortunately /sbin/rc does stupid tricks
@@ -486,6 +862,10 @@ ifdef(`distro_gentoo',` @@ -486,6 +863,10 @@ ifdef(`distro_gentoo',`
sysnet_setattr_config(initrc_t) sysnet_setattr_config(initrc_t)
optional_policy(` optional_policy(`
@ -30684,7 +30687,7 @@ index 17eda24..fc94c2a 100644
alsa_read_lib(initrc_t) alsa_read_lib(initrc_t)
') ')
@@ -506,7 +886,7 @@ ifdef(`distro_redhat',` @@ -506,7 +887,7 @@ ifdef(`distro_redhat',`
# Red Hat systems seem to have a stray # Red Hat systems seem to have a stray
# fd open from the initrd # fd open from the initrd
@ -30693,7 +30696,7 @@ index 17eda24..fc94c2a 100644
files_dontaudit_read_root_files(initrc_t) files_dontaudit_read_root_files(initrc_t)
# These seem to be from the initrd # These seem to be from the initrd
@@ -521,6 +901,7 @@ ifdef(`distro_redhat',` @@ -521,6 +902,7 @@ ifdef(`distro_redhat',`
files_create_boot_dirs(initrc_t) files_create_boot_dirs(initrc_t)
files_create_boot_flag(initrc_t) files_create_boot_flag(initrc_t)
files_rw_boot_symlinks(initrc_t) files_rw_boot_symlinks(initrc_t)
@ -30701,7 +30704,7 @@ index 17eda24..fc94c2a 100644
# wants to read /.fonts directory # wants to read /.fonts directory
files_read_default_files(initrc_t) files_read_default_files(initrc_t)
files_mountpoint(initrc_tmp_t) files_mountpoint(initrc_tmp_t)
@@ -541,6 +922,7 @@ ifdef(`distro_redhat',` @@ -541,6 +923,7 @@ ifdef(`distro_redhat',`
miscfiles_rw_localization(initrc_t) miscfiles_rw_localization(initrc_t)
miscfiles_setattr_localization(initrc_t) miscfiles_setattr_localization(initrc_t)
miscfiles_relabel_localization(initrc_t) miscfiles_relabel_localization(initrc_t)
@ -30709,7 +30712,7 @@ index 17eda24..fc94c2a 100644
miscfiles_read_fonts(initrc_t) miscfiles_read_fonts(initrc_t)
miscfiles_read_hwdata(initrc_t) miscfiles_read_hwdata(initrc_t)
@@ -550,8 +932,44 @@ ifdef(`distro_redhat',` @@ -550,8 +933,44 @@ ifdef(`distro_redhat',`
') ')
optional_policy(` optional_policy(`
@ -30754,7 +30757,7 @@ index 17eda24..fc94c2a 100644
') ')
optional_policy(` optional_policy(`
@@ -559,14 +977,31 @@ ifdef(`distro_redhat',` @@ -559,14 +978,31 @@ ifdef(`distro_redhat',`
rpc_write_exports(initrc_t) rpc_write_exports(initrc_t)
rpc_manage_nfs_state_data(initrc_t) rpc_manage_nfs_state_data(initrc_t)
') ')
@ -30786,7 +30789,7 @@ index 17eda24..fc94c2a 100644
') ')
') ')
@@ -577,6 +1012,39 @@ ifdef(`distro_suse',` @@ -577,6 +1013,39 @@ ifdef(`distro_suse',`
') ')
') ')
@ -30826,7 +30829,7 @@ index 17eda24..fc94c2a 100644
optional_policy(` optional_policy(`
amavis_search_lib(initrc_t) amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t) amavis_setattr_pid_files(initrc_t)
@@ -589,6 +1057,8 @@ optional_policy(` @@ -589,6 +1058,8 @@ optional_policy(`
optional_policy(` optional_policy(`
apache_read_config(initrc_t) apache_read_config(initrc_t)
apache_list_modules(initrc_t) apache_list_modules(initrc_t)
@ -30835,7 +30838,7 @@ index 17eda24..fc94c2a 100644
') ')
optional_policy(` optional_policy(`
@@ -610,6 +1080,7 @@ optional_policy(` @@ -610,6 +1081,7 @@ optional_policy(`
optional_policy(` optional_policy(`
cgroup_stream_connect_cgred(initrc_t) cgroup_stream_connect_cgred(initrc_t)
@ -30843,7 +30846,7 @@ index 17eda24..fc94c2a 100644
') ')
optional_policy(` optional_policy(`
@@ -626,6 +1097,17 @@ optional_policy(` @@ -626,6 +1098,17 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30861,7 +30864,7 @@ index 17eda24..fc94c2a 100644
dev_getattr_printer_dev(initrc_t) dev_getattr_printer_dev(initrc_t)
cups_read_log(initrc_t) cups_read_log(initrc_t)
@@ -642,9 +1124,13 @@ optional_policy(` @@ -642,9 +1125,13 @@ optional_policy(`
dbus_connect_system_bus(initrc_t) dbus_connect_system_bus(initrc_t)
dbus_system_bus_client(initrc_t) dbus_system_bus_client(initrc_t)
dbus_read_config(initrc_t) dbus_read_config(initrc_t)
@ -30875,7 +30878,7 @@ index 17eda24..fc94c2a 100644
') ')
optional_policy(` optional_policy(`
@@ -657,15 +1143,11 @@ optional_policy(` @@ -657,15 +1144,11 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30893,7 +30896,7 @@ index 17eda24..fc94c2a 100644
') ')
optional_policy(` optional_policy(`
@@ -686,6 +1168,15 @@ optional_policy(` @@ -686,6 +1169,15 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30909,7 +30912,7 @@ index 17eda24..fc94c2a 100644
inn_exec_config(initrc_t) inn_exec_config(initrc_t)
') ')
@@ -726,6 +1217,7 @@ optional_policy(` @@ -726,6 +1218,7 @@ optional_policy(`
lpd_list_spool(initrc_t) lpd_list_spool(initrc_t)
lpd_read_config(initrc_t) lpd_read_config(initrc_t)
@ -30917,7 +30920,7 @@ index 17eda24..fc94c2a 100644
') ')
optional_policy(` optional_policy(`
@@ -743,7 +1235,13 @@ optional_policy(` @@ -743,7 +1236,13 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30932,7 +30935,7 @@ index 17eda24..fc94c2a 100644
mta_dontaudit_read_spool_symlinks(initrc_t) mta_dontaudit_read_spool_symlinks(initrc_t)
') ')
@@ -766,6 +1264,10 @@ optional_policy(` @@ -766,6 +1265,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30943,7 +30946,7 @@ index 17eda24..fc94c2a 100644
postgresql_manage_db(initrc_t) postgresql_manage_db(initrc_t)
postgresql_read_config(initrc_t) postgresql_read_config(initrc_t)
') ')
@@ -775,10 +1277,20 @@ optional_policy(` @@ -775,10 +1278,20 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30964,7 +30967,7 @@ index 17eda24..fc94c2a 100644
quota_manage_flags(initrc_t) quota_manage_flags(initrc_t)
') ')
@@ -787,6 +1299,10 @@ optional_policy(` @@ -787,6 +1300,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30975,7 +30978,7 @@ index 17eda24..fc94c2a 100644
fs_write_ramfs_sockets(initrc_t) fs_write_ramfs_sockets(initrc_t)
fs_search_ramfs(initrc_t) fs_search_ramfs(initrc_t)
@@ -808,8 +1324,6 @@ optional_policy(` @@ -808,8 +1325,6 @@ optional_policy(`
# bash tries ioctl for some reason # bash tries ioctl for some reason
files_dontaudit_ioctl_all_pids(initrc_t) files_dontaudit_ioctl_all_pids(initrc_t)
@ -30984,7 +30987,7 @@ index 17eda24..fc94c2a 100644
') ')
optional_policy(` optional_policy(`
@@ -818,6 +1332,10 @@ optional_policy(` @@ -818,6 +1333,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30995,7 +30998,7 @@ index 17eda24..fc94c2a 100644
# shorewall-init script run /var/lib/shorewall/firewall # shorewall-init script run /var/lib/shorewall/firewall
shorewall_lib_domtrans(initrc_t) shorewall_lib_domtrans(initrc_t)
') ')
@@ -827,10 +1345,12 @@ optional_policy(` @@ -827,10 +1346,12 @@ optional_policy(`
squid_manage_logs(initrc_t) squid_manage_logs(initrc_t)
') ')
@ -31008,7 +31011,7 @@ index 17eda24..fc94c2a 100644
optional_policy(` optional_policy(`
ssh_dontaudit_read_server_keys(initrc_t) ssh_dontaudit_read_server_keys(initrc_t)
@@ -857,21 +1377,60 @@ optional_policy(` @@ -857,21 +1378,60 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -31070,7 +31073,7 @@ index 17eda24..fc94c2a 100644
') ')
optional_policy(` optional_policy(`
@@ -887,6 +1446,10 @@ optional_policy(` @@ -887,6 +1447,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -31081,7 +31084,7 @@ index 17eda24..fc94c2a 100644
# Set device ownerships/modes. # Set device ownerships/modes.
xserver_setattr_console_pipes(initrc_t) xserver_setattr_console_pipes(initrc_t)
@@ -897,3 +1460,218 @@ optional_policy(` @@ -897,3 +1461,218 @@ optional_policy(`
optional_policy(` optional_policy(`
zebra_read_config(initrc_t) zebra_read_config(initrc_t)
') ')
@ -40196,10 +40199,10 @@ index 0000000..d2a8fc7
+') +')
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644 new file mode 100644
index 0000000..898464f index 0000000..8af0084
--- /dev/null --- /dev/null
+++ b/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te
@@ -0,0 +1,679 @@ @@ -0,0 +1,681 @@
+policy_module(systemd, 1.0.0) +policy_module(systemd, 1.0.0)
+ +
+####################################### +#######################################
@ -40298,6 +40301,8 @@ index 0000000..898464f
+ +
+fs_mount_tmpfs(systemd_logind_t) +fs_mount_tmpfs(systemd_logind_t)
+fs_unmount_tmpfs(systemd_logind_t) +fs_unmount_tmpfs(systemd_logind_t)
+fs_manage_fusefs_dirs(systemd_logind_t)
+fs_manage_fusefs_files(systemd_logind_t)
+ +
+manage_dirs_pattern(systemd_logind_t, systemd_logind_var_lib_t, systemd_logind_var_lib_t) +manage_dirs_pattern(systemd_logind_t, systemd_logind_var_lib_t, systemd_logind_var_lib_t)
+manage_files_pattern(systemd_logind_t, systemd_logind_var_lib_t, systemd_logind_var_lib_t) +manage_files_pattern(systemd_logind_t, systemd_logind_var_lib_t, systemd_logind_var_lib_t)
@ -42270,7 +42275,7 @@ index db75976..8f5380f 100644
+/var/tmp/hsperfdata_root gen_context(system_u:object_r:user_tmp_t,s0) +/var/tmp/hsperfdata_root gen_context(system_u:object_r:user_tmp_t,s0)
+ +
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 9dc60c6..9464dee 100644 index 9dc60c6..d193211 100644
--- a/policy/modules/system/userdomain.if --- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if
@@ -30,9 +30,11 @@ template(`userdom_base_user_template',` @@ -30,9 +30,11 @@ template(`userdom_base_user_template',`
@ -43653,7 +43658,7 @@ index 9dc60c6..9464dee 100644
+ ') + ')
+ +
+ optional_policy(` + optional_policy(`
+ games_rw_data($1_usertype) + games_manage_data_files($1_usertype)
+ ') + ')
+ +
+ optional_policy(` + optional_policy(`

67
policy-rawhide-contrib.patch
View File

@ -7486,7 +7486,7 @@ index f3c0aba..2b3352b 100644
+ files_etc_filetrans(apcupsd_t, apcupsd_power_t, file, "powerfail") + files_etc_filetrans(apcupsd_t, apcupsd_power_t, file, "powerfail")
') ')
diff --git a/apcupsd.te b/apcupsd.te diff --git a/apcupsd.te b/apcupsd.te
index 080bc4d..0b6be35 100644 index 080bc4d..d49f4ef 100644
--- a/apcupsd.te --- a/apcupsd.te
+++ b/apcupsd.te +++ b/apcupsd.te
@@ -24,6 +24,12 @@ files_tmp_file(apcupsd_tmp_t) @@ -24,6 +24,12 @@ files_tmp_file(apcupsd_tmp_t)
@ -7533,7 +7533,7 @@ index 080bc4d..0b6be35 100644
corenet_udp_bind_snmp_port(apcupsd_t) corenet_udp_bind_snmp_port(apcupsd_t)
corenet_sendrecv_snmp_server_packets(apcupsd_t) corenet_sendrecv_snmp_server_packets(apcupsd_t)
@@ -74,19 +82,25 @@ corenet_udp_sendrecv_snmp_port(apcupsd_t) @@ -74,19 +82,24 @@ corenet_udp_sendrecv_snmp_port(apcupsd_t)
dev_rw_generic_usb_dev(apcupsd_t) dev_rw_generic_usb_dev(apcupsd_t)
@ -7543,8 +7543,8 @@ index 080bc4d..0b6be35 100644
files_manage_etc_runtime_files(apcupsd_t) files_manage_etc_runtime_files(apcupsd_t)
files_etc_filetrans_etc_runtime(apcupsd_t, file, "nologin") files_etc_filetrans_etc_runtime(apcupsd_t, file, "nologin")
term_use_unallocated_ttys(apcupsd_t) -term_use_unallocated_ttys(apcupsd_t)
+term_use_usb_ttys(apcupsd_t) +term_use_all_terms(apcupsd_t)
-logging_send_syslog_msg(apcupsd_t) -logging_send_syslog_msg(apcupsd_t)
+#apcupsd runs shutdown, probably need a shutdown domain +#apcupsd runs shutdown, probably need a shutdown domain
@ -7563,7 +7563,7 @@ index 080bc4d..0b6be35 100644
optional_policy(` optional_policy(`
hostname_exec(apcupsd_t) hostname_exec(apcupsd_t)
@@ -101,6 +115,11 @@ optional_policy(` @@ -101,6 +114,11 @@ optional_policy(`
shutdown_domtrans(apcupsd_t) shutdown_domtrans(apcupsd_t)
') ')
@ -7575,7 +7575,7 @@ index 080bc4d..0b6be35 100644
######################################## ########################################
# #
# CGI local policy # CGI local policy
@@ -108,20 +127,20 @@ optional_policy(` @@ -108,20 +126,20 @@ optional_policy(`
optional_policy(` optional_policy(`
apache_content_template(apcupsd_cgi) apache_content_template(apcupsd_cgi)
@ -13159,7 +13159,7 @@ index c223f81..8b567c1 100644
- admin_pattern($1, { httpd_cobbler_content_t httpd_cobbler_content_ra_t httpd_cobbler_content_rw_t }) - admin_pattern($1, { httpd_cobbler_content_t httpd_cobbler_content_ra_t httpd_cobbler_content_rw_t })
') ')
diff --git a/cobbler.te b/cobbler.te diff --git a/cobbler.te b/cobbler.te
index 5f306dd..1543aec 100644 index 5f306dd..e01156f 100644
--- a/cobbler.te --- a/cobbler.te
+++ b/cobbler.te +++ b/cobbler.te
@@ -81,6 +81,7 @@ manage_dirs_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t) @@ -81,6 +81,7 @@ manage_dirs_pattern(cobblerd_t, cobbler_var_lib_t, cobbler_var_lib_t)
@ -13220,7 +13220,7 @@ index 5f306dd..1543aec 100644
') ')
optional_policy(` optional_policy(`
@@ -179,12 +183,26 @@ optional_policy(` @@ -179,12 +183,22 @@ optional_policy(`
optional_policy(` optional_policy(`
dhcpd_domtrans(cobblerd_t) dhcpd_domtrans(cobblerd_t)
dhcpd_initrc_domtrans(cobblerd_t) dhcpd_initrc_domtrans(cobblerd_t)
@ -13235,10 +13235,6 @@ index 5f306dd..1543aec 100644
+') +')
+ +
+optional_policy(` +optional_policy(`
+ gnome_dontaudit_search_config(cobblerd_t)
+')
+
+optional_policy(`
+ libs_exec_ldconfig(cobblerd_t) + libs_exec_ldconfig(cobblerd_t)
+') +')
+ +
@ -13247,7 +13243,7 @@ index 5f306dd..1543aec 100644
') ')
optional_policy(` optional_policy(`
@@ -192,13 +210,13 @@ optional_policy(` @@ -192,13 +206,13 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -27988,6 +27984,34 @@ index 36838c2..a09e8b2 100644
- fs_read_nfs_files(sftpd_t) - fs_read_nfs_files(sftpd_t)
- fs_read_nfs_symlinks(ftpd_t) - fs_read_nfs_symlinks(ftpd_t)
-') -')
diff --git a/games.if b/games.if
index e2a3e0d..50ebd40 100644
--- a/games.if
+++ b/games.if
@@ -58,3 +58,23 @@ interface(`games_rw_data',`
files_search_var_lib($1)
rw_files_pattern($1, games_data_t, games_data_t)
')
+
+########################################
+## <summary>
+## Manage games data files.
+## games data.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`games_manage_data_files',`
+ gen_require(`
+ type games_data_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_files_pattern($1, games_data_t, games_data_t)
+')
diff --git a/games.te b/games.te diff --git a/games.te b/games.te
index e5b15fb..220622e 100644 index e5b15fb..220622e 100644
--- a/games.te --- a/games.te
@ -28372,10 +28396,10 @@ index 0000000..04e159f
+') +')
diff --git a/gear.te b/gear.te diff --git a/gear.te b/gear.te
new file mode 100644 new file mode 100644
index 0000000..91ed5f4 index 0000000..7a27337
--- /dev/null --- /dev/null
+++ b/gear.te +++ b/gear.te
@@ -0,0 +1,134 @@ @@ -0,0 +1,140 @@
+policy_module(gear, 1.0.0) +policy_module(gear, 1.0.0)
+ +
+######################################## +########################################
@ -28483,7 +28507,10 @@ index 0000000..91ed5f4
+ +
+mount_domtrans(gear_t) +mount_domtrans(gear_t)
+ +
+selinux_validate_context(gear_t)
+
+seutil_read_default_contexts(gear_t) +seutil_read_default_contexts(gear_t)
+seutil_read_config(gear_t)
+ +
+sysnet_dns_name_resolve(gear_t) +sysnet_dns_name_resolve(gear_t)
+ +
@ -28493,6 +28520,9 @@ index 0000000..91ed5f4
+systemd_manage_all_unit_files(gear_t) +systemd_manage_all_unit_files(gear_t)
+systemd_exec_systemctl(gear_t) +systemd_exec_systemctl(gear_t)
+ +
+usermanage_domtrans_useradd(gear_t)
+usermanage_domtrans_passwd(gear_t)
+
+optional_policy(` +optional_policy(`
+ hostname_exec(gear_t) + hostname_exec(gear_t)
+') +')
@ -73606,10 +73636,10 @@ index 83eb09e..b48c931 100644
+') +')
+ +
diff --git a/quantum.fc b/quantum.fc diff --git a/quantum.fc b/quantum.fc
index 70ab68b..32dec67 100644 index 70ab68b..2a8e41b 100644
--- a/quantum.fc --- a/quantum.fc
+++ b/quantum.fc +++ b/quantum.fc
@@ -1,10 +1,28 @@ @@ -1,10 +1,31 @@
-/etc/rc\.d/init\.d/quantum.* -- gen_context(system_u:object_r:quantum_initrc_exec_t,s0) -/etc/rc\.d/init\.d/quantum.* -- gen_context(system_u:object_r:quantum_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/neutron.* -- gen_context(system_u:object_r:neutron_initrc_exec_t,s0) +/etc/rc\.d/init\.d/neutron.* -- gen_context(system_u:object_r:neutron_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/quantum.* -- gen_context(system_u:object_r:neutron_initrc_exec_t,s0) +/etc/rc\.d/init\.d/quantum.* -- gen_context(system_u:object_r:neutron_initrc_exec_t,s0)
@ -73621,6 +73651,9 @@ index 70ab68b..32dec67 100644
+/usr/bin/neutron-dhcp-agent -- gen_context(system_u:object_r:neutron_exec_t,s0) +/usr/bin/neutron-dhcp-agent -- gen_context(system_u:object_r:neutron_exec_t,s0)
+/usr/bin/neutron-l3-agent -- gen_context(system_u:object_r:neutron_exec_t,s0) +/usr/bin/neutron-l3-agent -- gen_context(system_u:object_r:neutron_exec_t,s0)
+/usr/bin/neutron-lbaas-agent -- gen_context(system_u:object_r:neutron_exec_t,s0) +/usr/bin/neutron-lbaas-agent -- gen_context(system_u:object_r:neutron_exec_t,s0)
+/usr/bin/neutron-metadata-agent -- gen_context(system_u:object_r:neutron_exec_t,s0)
+/usr/bin/neutron-netns-cleanup -- gen_context(system_u:object_r:neutron_exec_t,s0)
+/usr/bin/neutron-ns-metadata-proxy -- gen_context(system_u:object_r:neutron_exec_t,s0)
+/usr/bin/neutron-rootwrap -- gen_context(system_u:object_r:neutron_exec_t,s0) +/usr/bin/neutron-rootwrap -- gen_context(system_u:object_r:neutron_exec_t,s0)
+/usr/bin/neutron-linuxbridge-agent -- gen_context(system_u:object_r:neutron_exec_t,s0) +/usr/bin/neutron-linuxbridge-agent -- gen_context(system_u:object_r:neutron_exec_t,s0)
+/usr/bin/neutron-openvswitch-agent -- gen_context(system_u:object_r:neutron_exec_t,s0) +/usr/bin/neutron-openvswitch-agent -- gen_context(system_u:object_r:neutron_exec_t,s0)

7
selinux-policy.spec
View File

@ -11,7 +11,7 @@
%define BUILD_MINIMUM 1 %define BUILD_MINIMUM 1
%endif %endif
%if %{?BUILD_MLS:0}%{!?BUILD_MLS:1} %if %{?BUILD_MLS:0}%{!?BUILD_MLS:1}
%define BUILD_MLS 0 %define BUILD_MLS 1
%endif %endif
%define POLICYVER 29 %define POLICYVER 29
%define POLICYCOREUTILSVER 2.1.14-74 %define POLICYCOREUTILSVER 2.1.14-74
@ -19,7 +19,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.13.1 Version: 3.13.1
Release: 60%{?dist} Release: 61%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -600,6 +600,9 @@ SELinux Reference policy mls base module.
%endif %endif
%changelog %changelog
* Fri Jun 20 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-61
- Add back MLS policy
* Thu Jun 19 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-60 * Thu Jun 19 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-60
- Implement new spec file handling for *.pp modules which allows us to move a policy module out of the policy - Implement new spec file handling for *.pp modules which allows us to move a policy module out of the policy