* Thu Jul 11 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-63
- Add mdadm fixes
This commit is contained in:
parent
faa2916cd9
commit
21e8b675d4
@ -19416,7 +19416,7 @@ index 76d9f66..21c96cf 100644
|
|||||||
+/root/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
|
+/root/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
|
||||||
+/root/\.shosts gen_context(system_u:object_r:ssh_home_t,s0)
|
+/root/\.shosts gen_context(system_u:object_r:ssh_home_t,s0)
|
||||||
diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
|
diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
|
||||||
index fe0c682..871b8fd 100644
|
index fe0c682..95ae197 100644
|
||||||
--- a/policy/modules/services/ssh.if
|
--- a/policy/modules/services/ssh.if
|
||||||
+++ b/policy/modules/services/ssh.if
|
+++ b/policy/modules/services/ssh.if
|
||||||
@@ -32,10 +32,11 @@
|
@@ -32,10 +32,11 @@
|
||||||
@ -19868,7 +19868,7 @@ index fe0c682..871b8fd 100644
|
|||||||
+## </summary>
|
+## </summary>
|
||||||
+## <param name="domain">
|
+## <param name="domain">
|
||||||
+## <summary>
|
+## <summary>
|
||||||
+## Domain allowed access.
|
+## Domain to not audit.
|
||||||
+## </summary>
|
+## </summary>
|
||||||
+## </param>
|
+## </param>
|
||||||
+#
|
+#
|
||||||
@ -20831,7 +20831,7 @@ index d1f64a0..8f50bb9 100644
|
|||||||
+/var/lib/pqsql/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
|
+/var/lib/pqsql/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
|
||||||
+
|
+
|
||||||
diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if
|
diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if
|
||||||
index 6bf0ecc..8715521 100644
|
index 6bf0ecc..266289c 100644
|
||||||
--- a/policy/modules/services/xserver.if
|
--- a/policy/modules/services/xserver.if
|
||||||
+++ b/policy/modules/services/xserver.if
|
+++ b/policy/modules/services/xserver.if
|
||||||
@@ -18,100 +18,37 @@
|
@@ -18,100 +18,37 @@
|
||||||
@ -21785,7 +21785,7 @@ index 6bf0ecc..8715521 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1284,10 +1655,604 @@ interface(`xserver_manage_core_devices',`
|
@@ -1284,10 +1655,622 @@ interface(`xserver_manage_core_devices',`
|
||||||
#
|
#
|
||||||
interface(`xserver_unconfined',`
|
interface(`xserver_unconfined',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -22392,6 +22392,24 @@ index 6bf0ecc..8715521 100644
|
|||||||
+ filetrans_pattern($1, xdm_tmp_t, $2, $3, $4)
|
+ filetrans_pattern($1, xdm_tmp_t, $2, $3, $4)
|
||||||
+ files_search_tmp($1)
|
+ files_search_tmp($1)
|
||||||
+')
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Dontaudit search ssh home directory
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain to not audit.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`xserver_dontaudit_search_log',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type xserver_log_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ dontaudit $1 xserver_log_t:dir search_dir_perms;
|
||||||
|
+')
|
||||||
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
|
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
|
||||||
index 2696452..fcf58c6 100644
|
index 2696452..fcf58c6 100644
|
||||||
--- a/policy/modules/services/xserver.te
|
--- a/policy/modules/services/xserver.te
|
||||||
|
@ -10927,7 +10927,7 @@ index 32e8265..0de4af3 100644
|
|||||||
+ allow $1 chronyd_unit_file_t:service all_service_perms;
|
+ allow $1 chronyd_unit_file_t:service all_service_perms;
|
||||||
')
|
')
|
||||||
diff --git a/chronyd.te b/chronyd.te
|
diff --git a/chronyd.te b/chronyd.te
|
||||||
index 914ee2d..72fab35 100644
|
index 914ee2d..7d723c0 100644
|
||||||
--- a/chronyd.te
|
--- a/chronyd.te
|
||||||
+++ b/chronyd.te
|
+++ b/chronyd.te
|
||||||
@@ -18,6 +18,9 @@ files_type(chronyd_keys_t)
|
@@ -18,6 +18,9 @@ files_type(chronyd_keys_t)
|
||||||
@ -10945,8 +10945,9 @@ index 914ee2d..72fab35 100644
|
|||||||
#
|
#
|
||||||
|
|
||||||
-allow chronyd_t self:capability { dac_override ipc_lock setuid setgid sys_resource sys_time };
|
-allow chronyd_t self:capability { dac_override ipc_lock setuid setgid sys_resource sys_time };
|
||||||
|
-allow chronyd_t self:process { getcap setcap setrlimit signal };
|
||||||
+allow chronyd_t self:capability { dac_override ipc_lock fsetid setuid setgid sys_nice sys_resource sys_time };
|
+allow chronyd_t self:capability { dac_override ipc_lock fsetid setuid setgid sys_nice sys_resource sys_time };
|
||||||
allow chronyd_t self:process { getcap setcap setrlimit signal };
|
+allow chronyd_t self:process { getsched setsched getcap setcap setrlimit signal };
|
||||||
allow chronyd_t self:shm create_shm_perms;
|
allow chronyd_t self:shm create_shm_perms;
|
||||||
+allow chronyd_t self:udp_socket create_socket_perms;
|
+allow chronyd_t self:udp_socket create_socket_perms;
|
||||||
+allow chronyd_t self:unix_dgram_socket create_socket_perms;
|
+allow chronyd_t self:unix_dgram_socket create_socket_perms;
|
||||||
@ -50974,6 +50975,16 @@ index 0000000..c1eed44
|
|||||||
+ ssh_exec_keygen(openshift_cron_t)
|
+ ssh_exec_keygen(openshift_cron_t)
|
||||||
+ ssh_dontaudit_read_server_keys(openshift_cron_t)
|
+ ssh_dontaudit_read_server_keys(openshift_cron_t)
|
||||||
+')
|
+')
|
||||||
|
diff --git a/openvpn.fc b/openvpn.fc
|
||||||
|
index 300213f..6f0d2e4 100644
|
||||||
|
--- a/openvpn.fc
|
||||||
|
+++ b/openvpn.fc
|
||||||
|
@@ -1,4 +1,5 @@
|
||||||
|
/etc/openvpn(/.*)? gen_context(system_u:object_r:openvpn_etc_t,s0)
|
||||||
|
+/etc/openvpn/scripts(/.*)? gen_context(system_u:object_r:openvpn_unconfined_script_exec_t,s0)
|
||||||
|
/etc/openvpn/ipp\.txt -- gen_context(system_u:object_r:openvpn_etc_rw_t,s0)
|
||||||
|
|
||||||
|
/etc/rc\.d/init\.d/openvpn -- gen_context(system_u:object_r:openvpn_initrc_exec_t,s0)
|
||||||
diff --git a/openvpn.if b/openvpn.if
|
diff --git a/openvpn.if b/openvpn.if
|
||||||
index 6837e9a..af8f9d0 100644
|
index 6837e9a..af8f9d0 100644
|
||||||
--- a/openvpn.if
|
--- a/openvpn.if
|
||||||
@ -50994,10 +51005,24 @@ index 6837e9a..af8f9d0 100644
|
|||||||
domain_system_change_exemption($1)
|
domain_system_change_exemption($1)
|
||||||
role_transition $2 openvpn_initrc_exec_t system_r;
|
role_transition $2 openvpn_initrc_exec_t system_r;
|
||||||
diff --git a/openvpn.te b/openvpn.te
|
diff --git a/openvpn.te b/openvpn.te
|
||||||
index 3270ff9..67da060 100644
|
index 3270ff9..8e252e4 100644
|
||||||
--- a/openvpn.te
|
--- a/openvpn.te
|
||||||
+++ b/openvpn.te
|
+++ b/openvpn.te
|
||||||
@@ -26,6 +26,9 @@ files_config_file(openvpn_etc_t)
|
@@ -6,6 +6,13 @@ policy_module(openvpn, 1.11.3)
|
||||||
|
#
|
||||||
|
|
||||||
|
## <desc>
|
||||||
|
+## <p>
|
||||||
|
+## Allow openvpn to run unconfined scripts
|
||||||
|
+## </p>
|
||||||
|
+## </desc>
|
||||||
|
+gen_tunable(openvpn_run_unconfined, false)
|
||||||
|
+
|
||||||
|
+## <desc>
|
||||||
|
## <p>
|
||||||
|
## Determine whether openvpn can
|
||||||
|
## read generic user home content files.
|
||||||
|
@@ -26,6 +33,9 @@ files_config_file(openvpn_etc_t)
|
||||||
type openvpn_etc_rw_t;
|
type openvpn_etc_rw_t;
|
||||||
files_config_file(openvpn_etc_rw_t)
|
files_config_file(openvpn_etc_rw_t)
|
||||||
|
|
||||||
@ -51007,7 +51032,7 @@ index 3270ff9..67da060 100644
|
|||||||
type openvpn_initrc_exec_t;
|
type openvpn_initrc_exec_t;
|
||||||
init_script_file(openvpn_initrc_exec_t)
|
init_script_file(openvpn_initrc_exec_t)
|
||||||
|
|
||||||
@@ -43,7 +46,7 @@ files_pid_file(openvpn_var_run_t)
|
@@ -43,7 +53,7 @@ files_pid_file(openvpn_var_run_t)
|
||||||
# Local policy
|
# Local policy
|
||||||
#
|
#
|
||||||
|
|
||||||
@ -51016,7 +51041,7 @@ index 3270ff9..67da060 100644
|
|||||||
allow openvpn_t self:process { signal getsched setsched };
|
allow openvpn_t self:process { signal getsched setsched };
|
||||||
allow openvpn_t self:fifo_file rw_fifo_file_perms;
|
allow openvpn_t self:fifo_file rw_fifo_file_perms;
|
||||||
allow openvpn_t self:unix_dgram_socket sendto;
|
allow openvpn_t self:unix_dgram_socket sendto;
|
||||||
@@ -62,6 +65,9 @@ filetrans_pattern(openvpn_t, openvpn_etc_t, openvpn_etc_rw_t, file)
|
@@ -62,6 +72,9 @@ filetrans_pattern(openvpn_t, openvpn_etc_t, openvpn_etc_rw_t, file)
|
||||||
allow openvpn_t openvpn_status_t:file manage_file_perms;
|
allow openvpn_t openvpn_status_t:file manage_file_perms;
|
||||||
logging_log_filetrans(openvpn_t, openvpn_status_t, file, "openvpn-status.log")
|
logging_log_filetrans(openvpn_t, openvpn_status_t, file, "openvpn-status.log")
|
||||||
|
|
||||||
@ -51026,7 +51051,7 @@ index 3270ff9..67da060 100644
|
|||||||
manage_dirs_pattern(openvpn_t, openvpn_var_log_t, openvpn_var_log_t)
|
manage_dirs_pattern(openvpn_t, openvpn_var_log_t, openvpn_var_log_t)
|
||||||
append_files_pattern(openvpn_t, openvpn_var_log_t, openvpn_var_log_t)
|
append_files_pattern(openvpn_t, openvpn_var_log_t, openvpn_var_log_t)
|
||||||
create_files_pattern(openvpn_t, openvpn_var_log_t, openvpn_var_log_t)
|
create_files_pattern(openvpn_t, openvpn_var_log_t, openvpn_var_log_t)
|
||||||
@@ -83,7 +89,6 @@ kernel_request_load_module(openvpn_t)
|
@@ -83,7 +96,6 @@ kernel_request_load_module(openvpn_t)
|
||||||
corecmd_exec_bin(openvpn_t)
|
corecmd_exec_bin(openvpn_t)
|
||||||
corecmd_exec_shell(openvpn_t)
|
corecmd_exec_shell(openvpn_t)
|
||||||
|
|
||||||
@ -51034,7 +51059,7 @@ index 3270ff9..67da060 100644
|
|||||||
corenet_all_recvfrom_netlabel(openvpn_t)
|
corenet_all_recvfrom_netlabel(openvpn_t)
|
||||||
corenet_tcp_sendrecv_generic_if(openvpn_t)
|
corenet_tcp_sendrecv_generic_if(openvpn_t)
|
||||||
corenet_udp_sendrecv_generic_if(openvpn_t)
|
corenet_udp_sendrecv_generic_if(openvpn_t)
|
||||||
@@ -105,11 +110,12 @@ corenet_tcp_bind_http_port(openvpn_t)
|
@@ -105,11 +117,12 @@ corenet_tcp_bind_http_port(openvpn_t)
|
||||||
corenet_sendrecv_http_client_packets(openvpn_t)
|
corenet_sendrecv_http_client_packets(openvpn_t)
|
||||||
corenet_tcp_connect_http_port(openvpn_t)
|
corenet_tcp_connect_http_port(openvpn_t)
|
||||||
corenet_tcp_sendrecv_http_port(openvpn_t)
|
corenet_tcp_sendrecv_http_port(openvpn_t)
|
||||||
@ -51048,7 +51073,7 @@ index 3270ff9..67da060 100644
|
|||||||
corenet_rw_tun_tap_dev(openvpn_t)
|
corenet_rw_tun_tap_dev(openvpn_t)
|
||||||
|
|
||||||
dev_read_rand(openvpn_t)
|
dev_read_rand(openvpn_t)
|
||||||
@@ -121,18 +127,24 @@ fs_search_auto_mountpoints(openvpn_t)
|
@@ -121,18 +134,24 @@ fs_search_auto_mountpoints(openvpn_t)
|
||||||
|
|
||||||
auth_use_pam(openvpn_t)
|
auth_use_pam(openvpn_t)
|
||||||
|
|
||||||
@ -51076,7 +51101,7 @@ index 3270ff9..67da060 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
tunable_policy(`openvpn_enable_homedirs && use_nfs_home_dirs',`
|
tunable_policy(`openvpn_enable_homedirs && use_nfs_home_dirs',`
|
||||||
@@ -155,3 +167,7 @@ optional_policy(`
|
@@ -155,3 +174,27 @@ optional_policy(`
|
||||||
networkmanager_dbus_chat(openvpn_t)
|
networkmanager_dbus_chat(openvpn_t)
|
||||||
')
|
')
|
||||||
')
|
')
|
||||||
@ -51084,11 +51109,31 @@ index 3270ff9..67da060 100644
|
|||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
+ unconfined_attach_tun_iface(openvpn_t)
|
+ unconfined_attach_tun_iface(openvpn_t)
|
||||||
+')
|
+')
|
||||||
|
+
|
||||||
|
+type openvpn_unconfined_script_t;
|
||||||
|
+type openvpn_unconfined_script_exec_t;
|
||||||
|
+domain_type(openvpn_unconfined_script_t)
|
||||||
|
+domain_entry_file(openvpn_unconfined_script_t, openvpn_unconfined_script_exec_t)
|
||||||
|
+corecmd_shell_entry_type(openvpn_unconfined_script_t)
|
||||||
|
+role system_r types openvpn_unconfined_script_t;
|
||||||
|
+
|
||||||
|
+allow openvpn_t openvpn_unconfined_script_exec_t:dir search_dir_perms;
|
||||||
|
+allow openvpn_t openvpn_unconfined_script_exec_t:file ioctl;
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
|
+ unconfined_domain(openvpn_unconfined_script_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+tunable_policy(`openvpn_run_unconfined',`
|
||||||
|
+ domtrans_pattern(openvpn_t, openvpn_unconfined_script_exec_t, openvpn_unconfined_script_t)
|
||||||
|
+',`
|
||||||
|
+ can_exec(openvpn_t, openvpn_unconfined_script_exec_t)
|
||||||
|
+')
|
||||||
diff --git a/openvswitch.fc b/openvswitch.fc
|
diff --git a/openvswitch.fc b/openvswitch.fc
|
||||||
index 45d7cc5..baf8d21 100644
|
index 45d7cc5..c5b9607 100644
|
||||||
--- a/openvswitch.fc
|
--- a/openvswitch.fc
|
||||||
+++ b/openvswitch.fc
|
+++ b/openvswitch.fc
|
||||||
@@ -1,12 +1,15 @@
|
@@ -1,12 +1,16 @@
|
||||||
-/etc/rc\.d/init\.d/openvswitch -- gen_context(system_u:object_r:openvswitch_initrc_exec_t,s0)
|
-/etc/rc\.d/init\.d/openvswitch -- gen_context(system_u:object_r:openvswitch_initrc_exec_t,s0)
|
||||||
+/usr/lib/systemd/system/openvswitch.service -- gen_context(system_u:object_r:openvswitch_unit_file_t,s0)
|
+/usr/lib/systemd/system/openvswitch.service -- gen_context(system_u:object_r:openvswitch_unit_file_t,s0)
|
||||||
|
|
||||||
@ -51098,6 +51143,7 @@ index 45d7cc5..baf8d21 100644
|
|||||||
+/usr/sbin/ovsdb-ctl -- gen_context(system_u:object_r:openvswitch_exec_t,s0)
|
+/usr/sbin/ovsdb-ctl -- gen_context(system_u:object_r:openvswitch_exec_t,s0)
|
||||||
+/usr/sbin/ovsdb-server -- gen_context(system_u:object_r:openvswitch_exec_t,s0)
|
+/usr/sbin/ovsdb-server -- gen_context(system_u:object_r:openvswitch_exec_t,s0)
|
||||||
+/usr/sbin/ovs-vswitchd -- gen_context(system_u:object_r:openvswitch_exec_t,s0)
|
+/usr/sbin/ovs-vswitchd -- gen_context(system_u:object_r:openvswitch_exec_t,s0)
|
||||||
|
+/usr/bin/ovs-appctl -- gen_context(system_u:object_r:openvswitch_exec_t,s0)
|
||||||
|
|
||||||
-/usr/share/openvswitch/scripts/ovs-ctl -- gen_context(system_u:object_r:openvswitch_exec_t,s0)
|
-/usr/share/openvswitch/scripts/ovs-ctl -- gen_context(system_u:object_r:openvswitch_exec_t,s0)
|
||||||
-/usr/share/openvswitch/scripts/openvswitch\.init -- gen_context(system_u:object_r:openvswitch_exec_t,s0)
|
-/usr/share/openvswitch/scripts/openvswitch\.init -- gen_context(system_u:object_r:openvswitch_exec_t,s0)
|
||||||
@ -52389,7 +52435,7 @@ index d2fc677..ded726f 100644
|
|||||||
')
|
')
|
||||||
+
|
+
|
||||||
diff --git a/pegasus.te b/pegasus.te
|
diff --git a/pegasus.te b/pegasus.te
|
||||||
index 7bcf327..c1035d4 100644
|
index 7bcf327..04b62f4 100644
|
||||||
--- a/pegasus.te
|
--- a/pegasus.te
|
||||||
+++ b/pegasus.te
|
+++ b/pegasus.te
|
||||||
@@ -1,17 +1,16 @@
|
@@ -1,17 +1,16 @@
|
||||||
@ -52638,7 +52684,7 @@ index 7bcf327..c1035d4 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -151,16 +247,23 @@ optional_policy(`
|
@@ -151,16 +247,24 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -52655,6 +52701,7 @@ index 7bcf327..c1035d4 100644
|
|||||||
- seutil_sigchld_newrole(pegasus_t)
|
- seutil_sigchld_newrole(pegasus_t)
|
||||||
- seutil_dontaudit_read_config(pegasus_t)
|
- seutil_dontaudit_read_config(pegasus_t)
|
||||||
+ rpc_read_exports(pegasus_t)
|
+ rpc_read_exports(pegasus_t)
|
||||||
|
+ rpc_read_nfs_state_data(pegasus_t)
|
||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
@ -52666,7 +52713,7 @@ index 7bcf327..c1035d4 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -168,7 +271,7 @@ optional_policy(`
|
@@ -168,7 +272,7 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -55187,7 +55234,7 @@ index 032a84d..be00a65 100644
|
|||||||
+ allow $1 policykit_auth_t:process signal;
|
+ allow $1 policykit_auth_t:process signal;
|
||||||
')
|
')
|
||||||
diff --git a/policykit.te b/policykit.te
|
diff --git a/policykit.te b/policykit.te
|
||||||
index 49694e8..d14cc7d 100644
|
index 49694e8..ad46f29 100644
|
||||||
--- a/policykit.te
|
--- a/policykit.te
|
||||||
+++ b/policykit.te
|
+++ b/policykit.te
|
||||||
@@ -1,4 +1,4 @@
|
@@ -1,4 +1,4 @@
|
||||||
@ -55219,7 +55266,7 @@ index 49694e8..d14cc7d 100644
|
|||||||
|
|
||||||
type policykit_resolve_t, policykit_domain;
|
type policykit_resolve_t, policykit_domain;
|
||||||
type policykit_resolve_exec_t;
|
type policykit_resolve_exec_t;
|
||||||
@@ -42,63 +37,66 @@ files_pid_file(policykit_var_run_t)
|
@@ -42,63 +37,68 @@ files_pid_file(policykit_var_run_t)
|
||||||
|
|
||||||
#######################################
|
#######################################
|
||||||
#
|
#
|
||||||
@ -55291,6 +55338,8 @@ index 49694e8..d14cc7d 100644
|
|||||||
|
|
||||||
auth_use_nsswitch(policykit_t)
|
auth_use_nsswitch(policykit_t)
|
||||||
|
|
||||||
|
+init_list_pid_dirs(policykit_t)
|
||||||
|
+
|
||||||
+logging_send_syslog_msg(policykit_t)
|
+logging_send_syslog_msg(policykit_t)
|
||||||
+
|
+
|
||||||
userdom_getattr_all_users(policykit_t)
|
userdom_getattr_all_users(policykit_t)
|
||||||
@ -55305,7 +55354,7 @@ index 49694e8..d14cc7d 100644
|
|||||||
optional_policy(`
|
optional_policy(`
|
||||||
consolekit_dbus_chat(policykit_t)
|
consolekit_dbus_chat(policykit_t)
|
||||||
')
|
')
|
||||||
@@ -109,29 +107,43 @@ optional_policy(`
|
@@ -109,29 +109,43 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -55357,7 +55406,7 @@ index 49694e8..d14cc7d 100644
|
|||||||
|
|
||||||
rw_files_pattern(policykit_auth_t, policykit_reload_t, policykit_reload_t)
|
rw_files_pattern(policykit_auth_t, policykit_reload_t, policykit_reload_t)
|
||||||
|
|
||||||
@@ -145,9 +157,6 @@ manage_dirs_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t)
|
@@ -145,9 +159,6 @@ manage_dirs_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t)
|
||||||
manage_files_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t)
|
manage_files_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t)
|
||||||
files_pid_filetrans(policykit_auth_t, policykit_var_run_t, { file dir })
|
files_pid_filetrans(policykit_auth_t, policykit_var_run_t, { file dir })
|
||||||
|
|
||||||
@ -55367,7 +55416,7 @@ index 49694e8..d14cc7d 100644
|
|||||||
kernel_dontaudit_search_kernel_sysctl(policykit_auth_t)
|
kernel_dontaudit_search_kernel_sysctl(policykit_auth_t)
|
||||||
|
|
||||||
dev_read_video_dev(policykit_auth_t)
|
dev_read_video_dev(policykit_auth_t)
|
||||||
@@ -157,53 +166,64 @@ files_search_home(policykit_auth_t)
|
@@ -157,53 +168,64 @@ files_search_home(policykit_auth_t)
|
||||||
|
|
||||||
fs_getattr_all_fs(policykit_auth_t)
|
fs_getattr_all_fs(policykit_auth_t)
|
||||||
fs_search_tmpfs(policykit_auth_t)
|
fs_search_tmpfs(policykit_auth_t)
|
||||||
@ -55442,7 +55491,7 @@ index 49694e8..d14cc7d 100644
|
|||||||
|
|
||||||
rw_files_pattern(policykit_grant_t, policykit_reload_t, policykit_reload_t)
|
rw_files_pattern(policykit_grant_t, policykit_reload_t, policykit_reload_t)
|
||||||
|
|
||||||
@@ -211,23 +231,20 @@ manage_files_pattern(policykit_grant_t, policykit_var_run_t, policykit_var_run_t
|
@@ -211,23 +233,20 @@ manage_files_pattern(policykit_grant_t, policykit_var_run_t, policykit_var_run_t
|
||||||
|
|
||||||
manage_files_pattern(policykit_grant_t, policykit_var_lib_t, policykit_var_lib_t)
|
manage_files_pattern(policykit_grant_t, policykit_var_lib_t, policykit_var_lib_t)
|
||||||
|
|
||||||
@ -55469,7 +55518,7 @@ index 49694e8..d14cc7d 100644
|
|||||||
optional_policy(`
|
optional_policy(`
|
||||||
consolekit_dbus_chat(policykit_grant_t)
|
consolekit_dbus_chat(policykit_grant_t)
|
||||||
')
|
')
|
||||||
@@ -235,26 +252,28 @@ optional_policy(`
|
@@ -235,26 +254,28 @@ optional_policy(`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -55504,7 +55553,7 @@ index 49694e8..d14cc7d 100644
|
|||||||
userdom_read_all_users_state(policykit_resolve_t)
|
userdom_read_all_users_state(policykit_resolve_t)
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -266,6 +285,7 @@ optional_policy(`
|
@@ -266,6 +287,7 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -65420,10 +65469,20 @@ index b31f2d7..046f5b8 100644
|
|||||||
userdom_dontaudit_search_user_home_dirs(radvd_t)
|
userdom_dontaudit_search_user_home_dirs(radvd_t)
|
||||||
|
|
||||||
diff --git a/raid.fc b/raid.fc
|
diff --git a/raid.fc b/raid.fc
|
||||||
index 5806046..01ca7cb 100644
|
index 5806046..5578653 100644
|
||||||
--- a/raid.fc
|
--- a/raid.fc
|
||||||
+++ b/raid.fc
|
+++ b/raid.fc
|
||||||
@@ -16,6 +16,7 @@
|
@@ -3,6 +3,9 @@
|
||||||
|
|
||||||
|
/etc/rc\.d/init\.d/mdmonitor -- gen_context(system_u:object_r:mdadm_initrc_exec_t,s0)
|
||||||
|
|
||||||
|
+/usr/lib/systemd/system/mdmon@.* -- gen_context(system_u:object_r:mdadm_unit_file_t,s0)
|
||||||
|
+/usr/lib/systemd/system/mdmonitor.* -- gen_context(system_u:object_r:mdadm_unit_file_t,s0)
|
||||||
|
+
|
||||||
|
/sbin/iprdump -- gen_context(system_u:object_r:mdadm_exec_t,s0)
|
||||||
|
/sbin/iprinit -- gen_context(system_u:object_r:mdadm_exec_t,s0)
|
||||||
|
/sbin/iprupdate -- gen_context(system_u:object_r:mdadm_exec_t,s0)
|
||||||
|
@@ -16,6 +19,7 @@
|
||||||
/usr/sbin/iprupdate -- gen_context(system_u:object_r:mdadm_exec_t,s0)
|
/usr/sbin/iprupdate -- gen_context(system_u:object_r:mdadm_exec_t,s0)
|
||||||
/usr/sbin/mdadm -- gen_context(system_u:object_r:mdadm_exec_t,s0)
|
/usr/sbin/mdadm -- gen_context(system_u:object_r:mdadm_exec_t,s0)
|
||||||
/usr/sbin/mdmpd -- gen_context(system_u:object_r:mdadm_exec_t,s0)
|
/usr/sbin/mdmpd -- gen_context(system_u:object_r:mdadm_exec_t,s0)
|
||||||
@ -65432,7 +65491,7 @@ index 5806046..01ca7cb 100644
|
|||||||
|
|
||||||
/var/run/mdadm(/.*)? gen_context(system_u:object_r:mdadm_var_run_t,s0)
|
/var/run/mdadm(/.*)? gen_context(system_u:object_r:mdadm_var_run_t,s0)
|
||||||
diff --git a/raid.if b/raid.if
|
diff --git a/raid.if b/raid.if
|
||||||
index 951db7f..6d6ec1d 100644
|
index 951db7f..7736755 100644
|
||||||
--- a/raid.if
|
--- a/raid.if
|
||||||
+++ b/raid.if
|
+++ b/raid.if
|
||||||
@@ -1,9 +1,8 @@
|
@@ -1,9 +1,8 @@
|
||||||
@ -65447,7 +65506,7 @@ index 951db7f..6d6ec1d 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -22,34 +21,33 @@ interface(`raid_domtrans_mdadm',`
|
@@ -22,82 +21,115 @@ interface(`raid_domtrans_mdadm',`
|
||||||
|
|
||||||
######################################
|
######################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -65482,35 +65541,62 @@ index 951db7f..6d6ec1d 100644
|
|||||||
- roleattribute $1 mdadm_roles;
|
- roleattribute $1 mdadm_roles;
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
-########################################
|
||||||
|
+######################################
|
||||||
## <summary>
|
## <summary>
|
||||||
-## Create, read, write, and delete
|
-## Create, read, write, and delete
|
||||||
-## mdadm pid files.
|
-## mdadm pid files.
|
||||||
+## read the mdadm pid files.
|
+## Execute mdadm server in the mdadm domain.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -57,47 +55,58 @@ interface(`raid_run_mdadm',`
|
-## Domain allowed access.
|
||||||
|
+## Domain allowed to transition.
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
-interface(`raid_manage_mdadm_pid',`
|
-interface(`raid_manage_mdadm_pid',`
|
||||||
+interface(`raid_read_mdadm_pid',`
|
+interface(`mdadm_systemctl',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type mdadm_var_run_t;
|
- type mdadm_var_run_t;
|
||||||
|
+ type mdadm_t;
|
||||||
|
+ type mdadm_unit_file_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
- files_search_pids($1)
|
- files_search_pids($1)
|
||||||
- allow $1 mdadm_var_run_t:file manage_file_perms;
|
- allow $1 mdadm_var_run_t:file manage_file_perms;
|
||||||
+ read_files_pattern($1, mdadm_var_run_t, mdadm_var_run_t)
|
+ systemd_exec_systemctl($1)
|
||||||
|
+ allow $1 mdadm_unit_file_t:file read_file_perms;
|
||||||
|
+ allow $1 mdadm_unit_file_t:service manage_service_perms;
|
||||||
|
+
|
||||||
|
+ ps_process_pattern($1, mdadm_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
-## All of the rules required to
|
-## All of the rules required to
|
||||||
-## administrate an mdadm environment.
|
-## administrate an mdadm environment.
|
||||||
+## Create, read, write, and delete the mdadm pid files.
|
+## read the mdadm pid files.
|
||||||
## </summary>
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
-## <param name="role">
|
||||||
|
+#
|
||||||
|
+interface(`raid_read_mdadm_pid',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type mdadm_var_run_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ read_files_pattern($1, mdadm_var_run_t, mdadm_var_run_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Create, read, write, and delete the mdadm pid files.
|
||||||
|
+## </summary>
|
||||||
+## <desc>
|
+## <desc>
|
||||||
+## <p>
|
+## <p>
|
||||||
+## Create, read, write, and delete the mdadm pid files.
|
+## Create, read, write, and delete the mdadm pid files.
|
||||||
@ -65519,16 +65605,12 @@ index 951db7f..6d6ec1d 100644
|
|||||||
+## Added for use in the init module.
|
+## Added for use in the init module.
|
||||||
+## </p>
|
+## </p>
|
||||||
+## </desc>
|
+## </desc>
|
||||||
## <param name="domain">
|
+## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
## Domain allowed access.
|
-## Role allowed access.
|
||||||
|
+## Domain allowed access.
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
-## <param name="role">
|
|
||||||
-## <summary>
|
|
||||||
-## Role allowed access.
|
|
||||||
-## </summary>
|
|
||||||
-## </param>
|
|
||||||
-## <rolecap/>
|
-## <rolecap/>
|
||||||
#
|
#
|
||||||
-interface(`raid_admin_mdadm',`
|
-interface(`raid_admin_mdadm',`
|
||||||
@ -65573,20 +65655,23 @@ index 951db7f..6d6ec1d 100644
|
|||||||
+ allow $1 mdadm_exec_t:file { getattr_file_perms execute };
|
+ allow $1 mdadm_exec_t:file { getattr_file_perms execute };
|
||||||
')
|
')
|
||||||
diff --git a/raid.te b/raid.te
|
diff --git a/raid.te b/raid.te
|
||||||
index 2c1730b..e9c20b8 100644
|
index 2c1730b..f60c494 100644
|
||||||
--- a/raid.te
|
--- a/raid.te
|
||||||
+++ b/raid.te
|
+++ b/raid.te
|
||||||
@@ -15,6 +15,9 @@ role mdadm_roles types mdadm_t;
|
@@ -15,6 +15,12 @@ role mdadm_roles types mdadm_t;
|
||||||
type mdadm_initrc_exec_t;
|
type mdadm_initrc_exec_t;
|
||||||
init_script_file(mdadm_initrc_exec_t)
|
init_script_file(mdadm_initrc_exec_t)
|
||||||
|
|
||||||
|
+type mdadm_unit_file_t;
|
||||||
|
+systemd_unit_file(mdadm_unit_file_t)
|
||||||
|
+
|
||||||
+type mdadm_tmp_t;
|
+type mdadm_tmp_t;
|
||||||
+files_tmpfs_file(mdadm_tmp_t)
|
+files_tmpfs_file(mdadm_tmp_t)
|
||||||
+
|
+
|
||||||
type mdadm_var_run_t alias mdadm_map_t;
|
type mdadm_var_run_t alias mdadm_map_t;
|
||||||
files_pid_file(mdadm_var_run_t)
|
files_pid_file(mdadm_var_run_t)
|
||||||
dev_associate(mdadm_var_run_t)
|
dev_associate(mdadm_var_run_t)
|
||||||
@@ -25,23 +28,31 @@ dev_associate(mdadm_var_run_t)
|
@@ -25,23 +31,31 @@ dev_associate(mdadm_var_run_t)
|
||||||
#
|
#
|
||||||
|
|
||||||
allow mdadm_t self:capability { dac_override sys_admin ipc_lock };
|
allow mdadm_t self:capability { dac_override sys_admin ipc_lock };
|
||||||
@ -65622,7 +65707,7 @@ index 2c1730b..e9c20b8 100644
|
|||||||
|
|
||||||
corecmd_exec_bin(mdadm_t)
|
corecmd_exec_bin(mdadm_t)
|
||||||
corecmd_exec_shell(mdadm_t)
|
corecmd_exec_shell(mdadm_t)
|
||||||
@@ -49,19 +60,25 @@ corecmd_exec_shell(mdadm_t)
|
@@ -49,19 +63,25 @@ corecmd_exec_shell(mdadm_t)
|
||||||
dev_rw_sysfs(mdadm_t)
|
dev_rw_sysfs(mdadm_t)
|
||||||
dev_dontaudit_getattr_all_blk_files(mdadm_t)
|
dev_dontaudit_getattr_all_blk_files(mdadm_t)
|
||||||
dev_dontaudit_getattr_all_chr_files(mdadm_t)
|
dev_dontaudit_getattr_all_chr_files(mdadm_t)
|
||||||
@ -65650,7 +65735,7 @@ index 2c1730b..e9c20b8 100644
|
|||||||
|
|
||||||
mls_file_read_all_levels(mdadm_t)
|
mls_file_read_all_levels(mdadm_t)
|
||||||
mls_file_write_all_levels(mdadm_t)
|
mls_file_write_all_levels(mdadm_t)
|
||||||
@@ -70,15 +87,19 @@ storage_dev_filetrans_fixed_disk(mdadm_t)
|
@@ -70,15 +90,19 @@ storage_dev_filetrans_fixed_disk(mdadm_t)
|
||||||
storage_manage_fixed_disk(mdadm_t)
|
storage_manage_fixed_disk(mdadm_t)
|
||||||
storage_read_scsi_generic(mdadm_t)
|
storage_read_scsi_generic(mdadm_t)
|
||||||
storage_write_scsi_generic(mdadm_t)
|
storage_write_scsi_generic(mdadm_t)
|
||||||
@ -65671,6 +65756,24 @@ index 2c1730b..e9c20b8 100644
|
|||||||
|
|
||||||
userdom_dontaudit_use_unpriv_user_fds(mdadm_t)
|
userdom_dontaudit_use_unpriv_user_fds(mdadm_t)
|
||||||
userdom_dontaudit_search_user_home_content(mdadm_t)
|
userdom_dontaudit_search_user_home_content(mdadm_t)
|
||||||
|
@@ -97,9 +121,17 @@ optional_policy(`
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
+ mdadm_systemctl(mdadm_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
|
seutil_sigchld_newrole(mdadm_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
udev_read_db(mdadm_t)
|
||||||
|
')
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
|
+ xserver_dontaudit_search_log(mdadm_t)
|
||||||
|
+')
|
||||||
diff --git a/razor.fc b/razor.fc
|
diff --git a/razor.fc b/razor.fc
|
||||||
index 6723f4d..6e26673 100644
|
index 6723f4d..6e26673 100644
|
||||||
--- a/razor.fc
|
--- a/razor.fc
|
||||||
@ -85096,10 +85199,11 @@ index 0000000..dda7934
|
|||||||
+files_pid_filetrans(thin_aeolus_configserver_t, thin_aeolus_configserver_var_run_t, { dir file })
|
+files_pid_filetrans(thin_aeolus_configserver_t, thin_aeolus_configserver_var_run_t, { dir file })
|
||||||
diff --git a/thumb.fc b/thumb.fc
|
diff --git a/thumb.fc b/thumb.fc
|
||||||
new file mode 100644
|
new file mode 100644
|
||||||
index 0000000..601aea3
|
index 0000000..92b6843
|
||||||
--- /dev/null
|
--- /dev/null
|
||||||
+++ b/thumb.fc
|
+++ b/thumb.fc
|
||||||
@@ -0,0 +1,17 @@
|
@@ -0,0 +1,18 @@
|
||||||
|
+HOME_DIR/\.texlive2012(/.*)? gen_context(system_u:object_r:thumb_home_t,s0)
|
||||||
+HOME_DIR/\.thumbnails(/.*)? gen_context(system_u:object_r:thumb_home_t,s0)
|
+HOME_DIR/\.thumbnails(/.*)? gen_context(system_u:object_r:thumb_home_t,s0)
|
||||||
+HOME_DIR/\.cache/thumbnails(/.*)? gen_context(system_u:object_r:thumb_home_t,s0)
|
+HOME_DIR/\.cache/thumbnails(/.*)? gen_context(system_u:object_r:thumb_home_t,s0)
|
||||||
+HOME_DIR/missfont\.log.* gen_context(system_u:object_r:thumb_home_t,s0)
|
+HOME_DIR/missfont\.log.* gen_context(system_u:object_r:thumb_home_t,s0)
|
||||||
@ -89728,7 +89832,7 @@ index 9dec06c..378880d 100644
|
|||||||
+ allow $1 svirt_image_t:chr_file rw_file_perms;
|
+ allow $1 svirt_image_t:chr_file rw_file_perms;
|
||||||
')
|
')
|
||||||
diff --git a/virt.te b/virt.te
|
diff --git a/virt.te b/virt.te
|
||||||
index 1f22fba..7a305c4 100644
|
index 1f22fba..99dd3a5 100644
|
||||||
--- a/virt.te
|
--- a/virt.te
|
||||||
+++ b/virt.te
|
+++ b/virt.te
|
||||||
@@ -1,94 +1,98 @@
|
@@ -1,94 +1,98 @@
|
||||||
@ -90873,7 +90977,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
|
|
||||||
manage_files_pattern(virsh_t, virt_image_type, virt_image_type)
|
manage_files_pattern(virsh_t, virt_image_type, virt_image_type)
|
||||||
manage_blk_files_pattern(virsh_t, virt_image_type, virt_image_type)
|
manage_blk_files_pattern(virsh_t, virt_image_type, virt_image_type)
|
||||||
@@ -758,23 +826,15 @@ manage_chr_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t)
|
@@ -758,23 +826,16 @@ manage_chr_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t)
|
||||||
manage_lnk_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t)
|
manage_lnk_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t)
|
||||||
manage_sock_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t)
|
manage_sock_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t)
|
||||||
manage_fifo_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t)
|
manage_fifo_files_pattern(virsh_t, svirt_lxc_file_t, svirt_lxc_file_t)
|
||||||
@ -90889,6 +90993,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
+manage_dirs_pattern(virsh_t, virt_lxc_var_run_t, virt_lxc_var_run_t)
|
+manage_dirs_pattern(virsh_t, virt_lxc_var_run_t, virt_lxc_var_run_t)
|
||||||
+manage_files_pattern(virsh_t, virt_lxc_var_run_t, virt_lxc_var_run_t)
|
+manage_files_pattern(virsh_t, virt_lxc_var_run_t, virt_lxc_var_run_t)
|
||||||
+virt_filetrans_named_content(virsh_t)
|
+virt_filetrans_named_content(virsh_t)
|
||||||
|
+filetrans_pattern(virsh_t, virt_var_run_t, virt_lxc_var_run_t, dir, "lxc")
|
||||||
|
|
||||||
-can_exec(virsh_t, virsh_exec_t)
|
-can_exec(virsh_t, virsh_exec_t)
|
||||||
-
|
-
|
||||||
@ -90903,7 +91008,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
kernel_read_system_state(virsh_t)
|
kernel_read_system_state(virsh_t)
|
||||||
kernel_read_network_state(virsh_t)
|
kernel_read_network_state(virsh_t)
|
||||||
kernel_read_kernel_sysctls(virsh_t)
|
kernel_read_kernel_sysctls(virsh_t)
|
||||||
@@ -785,25 +845,18 @@ kernel_write_xen_state(virsh_t)
|
@@ -785,25 +846,18 @@ kernel_write_xen_state(virsh_t)
|
||||||
corecmd_exec_bin(virsh_t)
|
corecmd_exec_bin(virsh_t)
|
||||||
corecmd_exec_shell(virsh_t)
|
corecmd_exec_shell(virsh_t)
|
||||||
|
|
||||||
@ -90930,7 +91035,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
|
|
||||||
fs_getattr_all_fs(virsh_t)
|
fs_getattr_all_fs(virsh_t)
|
||||||
fs_manage_xenfs_dirs(virsh_t)
|
fs_manage_xenfs_dirs(virsh_t)
|
||||||
@@ -812,24 +865,22 @@ fs_search_auto_mountpoints(virsh_t)
|
@@ -812,24 +866,22 @@ fs_search_auto_mountpoints(virsh_t)
|
||||||
|
|
||||||
storage_raw_read_fixed_disk(virsh_t)
|
storage_raw_read_fixed_disk(virsh_t)
|
||||||
|
|
||||||
@ -90962,7 +91067,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
tunable_policy(`virt_use_nfs',`
|
tunable_policy(`virt_use_nfs',`
|
||||||
fs_manage_nfs_dirs(virsh_t)
|
fs_manage_nfs_dirs(virsh_t)
|
||||||
fs_manage_nfs_files(virsh_t)
|
fs_manage_nfs_files(virsh_t)
|
||||||
@@ -847,14 +898,20 @@ optional_policy(`
|
@@ -847,14 +899,20 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -90984,7 +91089,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
xen_stream_connect(virsh_t)
|
xen_stream_connect(virsh_t)
|
||||||
xen_stream_connect_xenstore(virsh_t)
|
xen_stream_connect_xenstore(virsh_t)
|
||||||
')
|
')
|
||||||
@@ -879,34 +936,44 @@ optional_policy(`
|
@@ -879,34 +937,45 @@ optional_policy(`
|
||||||
kernel_read_xen_state(virsh_ssh_t)
|
kernel_read_xen_state(virsh_ssh_t)
|
||||||
kernel_write_xen_state(virsh_ssh_t)
|
kernel_write_xen_state(virsh_ssh_t)
|
||||||
|
|
||||||
@ -91035,10 +91140,11 @@ index 1f22fba..7a305c4 100644
|
|||||||
+manage_files_pattern(virtd_lxc_t, virt_lxc_var_run_t, virt_lxc_var_run_t)
|
+manage_files_pattern(virtd_lxc_t, virt_lxc_var_run_t, virt_lxc_var_run_t)
|
||||||
+manage_sock_files_pattern(virtd_lxc_t, virt_lxc_var_run_t, virt_lxc_var_run_t)
|
+manage_sock_files_pattern(virtd_lxc_t, virt_lxc_var_run_t, virt_lxc_var_run_t)
|
||||||
+files_pid_filetrans(virtd_lxc_t, virt_lxc_var_run_t, { file dir })
|
+files_pid_filetrans(virtd_lxc_t, virt_lxc_var_run_t, { file dir })
|
||||||
|
+filetrans_pattern(virtd_lxc_t, virt_var_run_t, virt_lxc_var_run_t, dir, "lxc")
|
||||||
|
|
||||||
manage_dirs_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t)
|
manage_dirs_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t)
|
||||||
manage_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t)
|
manage_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t)
|
||||||
@@ -916,12 +983,17 @@ manage_sock_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t)
|
@@ -916,12 +985,17 @@ manage_sock_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t)
|
||||||
manage_fifo_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t)
|
manage_fifo_files_pattern(virtd_lxc_t, svirt_lxc_file_t, svirt_lxc_file_t)
|
||||||
allow virtd_lxc_t svirt_lxc_file_t:dir_file_class_set { relabelto relabelfrom };
|
allow virtd_lxc_t svirt_lxc_file_t:dir_file_class_set { relabelto relabelfrom };
|
||||||
allow virtd_lxc_t svirt_lxc_file_t:filesystem { relabelto relabelfrom };
|
allow virtd_lxc_t svirt_lxc_file_t:filesystem { relabelto relabelfrom };
|
||||||
@ -91056,7 +91162,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
|
|
||||||
corecmd_exec_bin(virtd_lxc_t)
|
corecmd_exec_bin(virtd_lxc_t)
|
||||||
corecmd_exec_shell(virtd_lxc_t)
|
corecmd_exec_shell(virtd_lxc_t)
|
||||||
@@ -933,10 +1005,8 @@ dev_read_urand(virtd_lxc_t)
|
@@ -933,10 +1007,8 @@ dev_read_urand(virtd_lxc_t)
|
||||||
|
|
||||||
domain_use_interactive_fds(virtd_lxc_t)
|
domain_use_interactive_fds(virtd_lxc_t)
|
||||||
|
|
||||||
@ -91067,7 +91173,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
files_relabel_rootfs(virtd_lxc_t)
|
files_relabel_rootfs(virtd_lxc_t)
|
||||||
files_mounton_non_security(virtd_lxc_t)
|
files_mounton_non_security(virtd_lxc_t)
|
||||||
files_mount_all_file_type_fs(virtd_lxc_t)
|
files_mount_all_file_type_fs(virtd_lxc_t)
|
||||||
@@ -944,6 +1014,7 @@ files_unmount_all_file_type_fs(virtd_lxc_t)
|
@@ -944,6 +1016,7 @@ files_unmount_all_file_type_fs(virtd_lxc_t)
|
||||||
files_list_isid_type_dirs(virtd_lxc_t)
|
files_list_isid_type_dirs(virtd_lxc_t)
|
||||||
files_root_filetrans(virtd_lxc_t, svirt_lxc_file_t, dir_file_class_set)
|
files_root_filetrans(virtd_lxc_t, svirt_lxc_file_t, dir_file_class_set)
|
||||||
|
|
||||||
@ -91075,7 +91181,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
fs_getattr_all_fs(virtd_lxc_t)
|
fs_getattr_all_fs(virtd_lxc_t)
|
||||||
fs_manage_tmpfs_dirs(virtd_lxc_t)
|
fs_manage_tmpfs_dirs(virtd_lxc_t)
|
||||||
fs_manage_tmpfs_chr_files(virtd_lxc_t)
|
fs_manage_tmpfs_chr_files(virtd_lxc_t)
|
||||||
@@ -955,15 +1026,11 @@ fs_rw_cgroup_files(virtd_lxc_t)
|
@@ -955,15 +1028,11 @@ fs_rw_cgroup_files(virtd_lxc_t)
|
||||||
fs_unmount_all_fs(virtd_lxc_t)
|
fs_unmount_all_fs(virtd_lxc_t)
|
||||||
fs_relabelfrom_tmpfs(virtd_lxc_t)
|
fs_relabelfrom_tmpfs(virtd_lxc_t)
|
||||||
|
|
||||||
@ -91094,7 +91200,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
|
|
||||||
term_use_generic_ptys(virtd_lxc_t)
|
term_use_generic_ptys(virtd_lxc_t)
|
||||||
term_use_ptmx(virtd_lxc_t)
|
term_use_ptmx(virtd_lxc_t)
|
||||||
@@ -973,21 +1040,40 @@ auth_use_nsswitch(virtd_lxc_t)
|
@@ -973,21 +1042,40 @@ auth_use_nsswitch(virtd_lxc_t)
|
||||||
|
|
||||||
logging_send_syslog_msg(virtd_lxc_t)
|
logging_send_syslog_msg(virtd_lxc_t)
|
||||||
|
|
||||||
@ -91143,7 +91249,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
allow svirt_lxc_domain self:fifo_file manage_file_perms;
|
allow svirt_lxc_domain self:fifo_file manage_file_perms;
|
||||||
allow svirt_lxc_domain self:sem create_sem_perms;
|
allow svirt_lxc_domain self:sem create_sem_perms;
|
||||||
allow svirt_lxc_domain self:shm create_shm_perms;
|
allow svirt_lxc_domain self:shm create_shm_perms;
|
||||||
@@ -995,18 +1081,16 @@ allow svirt_lxc_domain self:msgq create_msgq_perms;
|
@@ -995,18 +1083,16 @@ allow svirt_lxc_domain self:msgq create_msgq_perms;
|
||||||
allow svirt_lxc_domain self:unix_stream_socket { create_stream_socket_perms connectto };
|
allow svirt_lxc_domain self:unix_stream_socket { create_stream_socket_perms connectto };
|
||||||
allow svirt_lxc_domain self:unix_dgram_socket { sendto create_socket_perms };
|
allow svirt_lxc_domain self:unix_dgram_socket { sendto create_socket_perms };
|
||||||
|
|
||||||
@ -91170,7 +91276,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
|
|
||||||
manage_dirs_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
|
manage_dirs_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
|
||||||
manage_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
|
manage_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
|
||||||
@@ -1015,17 +1099,14 @@ manage_sock_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
|
@@ -1015,17 +1101,14 @@ manage_sock_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
|
||||||
manage_fifo_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
|
manage_fifo_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
|
||||||
rw_chr_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
|
rw_chr_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
|
||||||
rw_blk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
|
rw_blk_files_pattern(svirt_lxc_domain, svirt_lxc_file_t, svirt_lxc_file_t)
|
||||||
@ -91189,7 +91295,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
kernel_dontaudit_search_kernel_sysctl(svirt_lxc_domain)
|
kernel_dontaudit_search_kernel_sysctl(svirt_lxc_domain)
|
||||||
|
|
||||||
corecmd_exec_all_executables(svirt_lxc_domain)
|
corecmd_exec_all_executables(svirt_lxc_domain)
|
||||||
@@ -1037,21 +1118,20 @@ files_dontaudit_getattr_all_pipes(svirt_lxc_domain)
|
@@ -1037,21 +1120,20 @@ files_dontaudit_getattr_all_pipes(svirt_lxc_domain)
|
||||||
files_dontaudit_getattr_all_sockets(svirt_lxc_domain)
|
files_dontaudit_getattr_all_sockets(svirt_lxc_domain)
|
||||||
files_dontaudit_list_all_mountpoints(svirt_lxc_domain)
|
files_dontaudit_list_all_mountpoints(svirt_lxc_domain)
|
||||||
files_dontaudit_write_etc_runtime_files(svirt_lxc_domain)
|
files_dontaudit_write_etc_runtime_files(svirt_lxc_domain)
|
||||||
@ -91216,7 +91322,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
auth_dontaudit_read_login_records(svirt_lxc_domain)
|
auth_dontaudit_read_login_records(svirt_lxc_domain)
|
||||||
auth_dontaudit_write_login_records(svirt_lxc_domain)
|
auth_dontaudit_write_login_records(svirt_lxc_domain)
|
||||||
auth_search_pam_console_data(svirt_lxc_domain)
|
auth_search_pam_console_data(svirt_lxc_domain)
|
||||||
@@ -1063,96 +1143,92 @@ init_dontaudit_write_utmp(svirt_lxc_domain)
|
@@ -1063,96 +1145,92 @@ init_dontaudit_write_utmp(svirt_lxc_domain)
|
||||||
|
|
||||||
libs_dontaudit_setattr_lib_files(svirt_lxc_domain)
|
libs_dontaudit_setattr_lib_files(svirt_lxc_domain)
|
||||||
|
|
||||||
@ -91355,7 +91461,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
allow virt_qmf_t self:tcp_socket create_stream_socket_perms;
|
allow virt_qmf_t self:tcp_socket create_stream_socket_perms;
|
||||||
allow virt_qmf_t self:netlink_route_socket create_netlink_socket_perms;
|
allow virt_qmf_t self:netlink_route_socket create_netlink_socket_perms;
|
||||||
|
|
||||||
@@ -1165,12 +1241,12 @@ dev_read_sysfs(virt_qmf_t)
|
@@ -1165,12 +1243,12 @@ dev_read_sysfs(virt_qmf_t)
|
||||||
dev_read_rand(virt_qmf_t)
|
dev_read_rand(virt_qmf_t)
|
||||||
dev_read_urand(virt_qmf_t)
|
dev_read_urand(virt_qmf_t)
|
||||||
|
|
||||||
@ -91370,7 +91476,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
sysnet_read_config(virt_qmf_t)
|
sysnet_read_config(virt_qmf_t)
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -1183,9 +1259,8 @@ optional_policy(`
|
@@ -1183,9 +1261,8 @@ optional_policy(`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
@ -91381,7 +91487,7 @@ index 1f22fba..7a305c4 100644
|
|||||||
allow virt_bridgehelper_t self:process { setcap getcap };
|
allow virt_bridgehelper_t self:process { setcap getcap };
|
||||||
allow virt_bridgehelper_t self:capability { setpcap setgid setuid net_admin };
|
allow virt_bridgehelper_t self:capability { setpcap setgid setuid net_admin };
|
||||||
allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
|
allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
|
||||||
@@ -1198,5 +1273,114 @@ kernel_read_network_state(virt_bridgehelper_t)
|
@@ -1198,5 +1275,114 @@ kernel_read_network_state(virt_bridgehelper_t)
|
||||||
|
|
||||||
corenet_rw_tun_tap_dev(virt_bridgehelper_t)
|
corenet_rw_tun_tap_dev(virt_bridgehelper_t)
|
||||||
|
|
||||||
|
@ -19,7 +19,7 @@
|
|||||||
Summary: SELinux policy configuration
|
Summary: SELinux policy configuration
|
||||||
Name: selinux-policy
|
Name: selinux-policy
|
||||||
Version: 3.12.1
|
Version: 3.12.1
|
||||||
Release: 62%{?dist}
|
Release: 63%{?dist}
|
||||||
License: GPLv2+
|
License: GPLv2+
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
Source: serefpolicy-%{version}.tgz
|
Source: serefpolicy-%{version}.tgz
|
||||||
@ -539,6 +539,9 @@ SELinux Reference policy mls base module.
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Thu Jul 11 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-63
|
||||||
|
- Add mdadm fixes
|
||||||
|
|
||||||
* Tue Jul 9 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-62
|
* Tue Jul 9 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-62
|
||||||
- Fix definition of sandbox.disabled to sandbox.pp.disabled
|
- Fix definition of sandbox.disabled to sandbox.pp.disabled
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user