- Allow swift to use tcp/6200 swift port
- ALlow swift to search apache configs - Remove duplicate .fc entry for Grilo plugin bookmarks - Remove duplicate .fc entry for telepathy-gabble - Additional allow rules for docker sandbox processes - Allow keepalived connect to agentx port - Allow neutron-ns-metadata to connectto own unix stream socket - Add support for tcp/6200 port - Remove ability for confined users to run xinit - New tool for managing wireless /usr/sbin/iw
This commit is contained in:
parent
e00cf0abb1
commit
24862fd309
@ -5452,7 +5452,7 @@ index 8e0f9cd..b9f45b9 100644
|
||||
|
||||
define(`create_packet_interfaces',``
|
||||
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
|
||||
index b191055..e19170b 100644
|
||||
index b191055..dab9975 100644
|
||||
--- a/policy/modules/kernel/corenetwork.te.in
|
||||
+++ b/policy/modules/kernel/corenetwork.te.in
|
||||
@@ -5,6 +5,7 @@ policy_module(corenetwork, 1.19.2)
|
||||
@ -5712,7 +5712,7 @@ index b191055..e19170b 100644
|
||||
network_port(portmap, udp,111,s0, tcp,111,s0)
|
||||
network_port(postfix_policyd, tcp,10031,s0)
|
||||
network_port(postgresql, tcp,5432,s0)
|
||||
@@ -213,68 +267,77 @@ network_port(postgrey, tcp,60000,s0)
|
||||
@@ -213,68 +267,78 @@ network_port(postgrey, tcp,60000,s0)
|
||||
network_port(pptp, tcp,1723,s0, udp,1723,s0)
|
||||
network_port(prelude, tcp,4690,s0, udp,4690,s0)
|
||||
network_port(presence, tcp,5298-5299,s0, udp,5298-5299,s0)
|
||||
@ -5770,6 +5770,7 @@ index b191055..e19170b 100644
|
||||
network_port(svn, tcp,3690,s0, udp,3690,s0)
|
||||
network_port(svrloc, tcp,427,s0, udp,427,s0)
|
||||
network_port(swat, tcp,901,s0)
|
||||
+network_port(swift, tcp,6200,s0)
|
||||
network_port(sype_transport, tcp,9911,s0, udp,9911,s0)
|
||||
-network_port(syslogd, udp,514,s0)
|
||||
+network_port(syslogd, udp,514,s0, udp,601,s0, tcp,601,s0)
|
||||
@ -5801,7 +5802,7 @@ index b191055..e19170b 100644
|
||||
network_port(winshadow, tcp,3161,s0, udp,3261,s0)
|
||||
network_port(wsdapi, tcp,5357,s0, udp,5357,s0)
|
||||
network_port(wsicopy, tcp,3378,s0, udp,3378,s0)
|
||||
@@ -288,19 +351,23 @@ network_port(zabbix_agent, tcp,10050,s0)
|
||||
@@ -288,19 +352,23 @@ network_port(zabbix_agent, tcp,10050,s0)
|
||||
network_port(zookeeper_client, tcp,2181,s0)
|
||||
network_port(zookeeper_election, tcp,3888,s0)
|
||||
network_port(zookeeper_leader, tcp,2888,s0)
|
||||
@ -5828,7 +5829,7 @@ index b191055..e19170b 100644
|
||||
|
||||
########################################
|
||||
#
|
||||
@@ -333,6 +400,8 @@ sid netif gen_context(system_u:object_r:netif_t,s0 - mls_systemhigh)
|
||||
@@ -333,6 +401,8 @@ sid netif gen_context(system_u:object_r:netif_t,s0 - mls_systemhigh)
|
||||
|
||||
build_option(`enable_mls',`
|
||||
network_interface(lo, lo, s0 - mls_systemhigh)
|
||||
@ -5837,7 +5838,7 @@ index b191055..e19170b 100644
|
||||
',`
|
||||
typealias netif_t alias { lo_netif_t netif_lo_t };
|
||||
')
|
||||
@@ -345,9 +414,28 @@ typealias netif_t alias { lo_netif_t netif_lo_t };
|
||||
@@ -345,9 +415,28 @@ typealias netif_t alias { lo_netif_t netif_lo_t };
|
||||
allow corenet_unconfined_type node_type:node *;
|
||||
allow corenet_unconfined_type netif_type:netif *;
|
||||
allow corenet_unconfined_type packet_type:packet *;
|
||||
@ -14921,10 +14922,17 @@ index 8416beb..75c7b9d 100644
|
||||
+ fs_tmpfs_filetrans($1, cgroup_t, lnk_file, "cpuacct")
|
||||
+')
|
||||
diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
|
||||
index e7d1738..089cc7a 100644
|
||||
index e7d1738..c0b17f8 100644
|
||||
--- a/policy/modules/kernel/filesystem.te
|
||||
+++ b/policy/modules/kernel/filesystem.te
|
||||
@@ -32,8 +32,11 @@ fs_use_xattr gpfs gen_context(system_u:object_r:fs_t,s0);
|
||||
@@ -26,14 +26,18 @@ fs_use_xattr ext2 gen_context(system_u:object_r:fs_t,s0);
|
||||
fs_use_xattr ext3 gen_context(system_u:object_r:fs_t,s0);
|
||||
fs_use_xattr ext4 gen_context(system_u:object_r:fs_t,s0);
|
||||
fs_use_xattr ext4dev gen_context(system_u:object_r:fs_t,s0);
|
||||
+fs_use_xattr f2fs gen_context(system_u:object_r:fs_t,s0);
|
||||
fs_use_xattr gfs gen_context(system_u:object_r:fs_t,s0);
|
||||
fs_use_xattr gfs2 gen_context(system_u:object_r:fs_t,s0);
|
||||
fs_use_xattr gpfs gen_context(system_u:object_r:fs_t,s0);
|
||||
fs_use_xattr jffs2 gen_context(system_u:object_r:fs_t,s0);
|
||||
fs_use_xattr jfs gen_context(system_u:object_r:fs_t,s0);
|
||||
fs_use_xattr lustre gen_context(system_u:object_r:fs_t,s0);
|
||||
@ -14936,7 +14944,7 @@ index e7d1738..089cc7a 100644
|
||||
|
||||
# Use the allocating task SID to label inodes in the following filesystem
|
||||
# types, and label the filesystem itself with the specified context.
|
||||
@@ -53,6 +56,7 @@ type anon_inodefs_t;
|
||||
@@ -53,6 +57,7 @@ type anon_inodefs_t;
|
||||
fs_type(anon_inodefs_t)
|
||||
files_mountpoint(anon_inodefs_t)
|
||||
genfscon anon_inodefs / gen_context(system_u:object_r:anon_inodefs_t,s0)
|
||||
@ -14944,7 +14952,7 @@ index e7d1738..089cc7a 100644
|
||||
|
||||
type bdev_t;
|
||||
fs_type(bdev_t)
|
||||
@@ -63,12 +67,18 @@ fs_type(binfmt_misc_fs_t)
|
||||
@@ -63,12 +68,18 @@ fs_type(binfmt_misc_fs_t)
|
||||
files_mountpoint(binfmt_misc_fs_t)
|
||||
genfscon binfmt_misc / gen_context(system_u:object_r:binfmt_misc_fs_t,s0)
|
||||
|
||||
@ -14964,7 +14972,7 @@ index e7d1738..089cc7a 100644
|
||||
fs_type(cgroup_t)
|
||||
files_mountpoint(cgroup_t)
|
||||
dev_associate_sysfs(cgroup_t)
|
||||
@@ -88,6 +98,11 @@ fs_noxattr_type(ecryptfs_t)
|
||||
@@ -88,6 +99,11 @@ fs_noxattr_type(ecryptfs_t)
|
||||
files_mountpoint(ecryptfs_t)
|
||||
genfscon ecryptfs / gen_context(system_u:object_r:ecryptfs_t,s0)
|
||||
|
||||
@ -14976,7 +14984,7 @@ index e7d1738..089cc7a 100644
|
||||
type futexfs_t;
|
||||
fs_type(futexfs_t)
|
||||
genfscon futexfs / gen_context(system_u:object_r:futexfs_t,s0)
|
||||
@@ -96,6 +111,7 @@ type hugetlbfs_t;
|
||||
@@ -96,6 +112,7 @@ type hugetlbfs_t;
|
||||
fs_type(hugetlbfs_t)
|
||||
files_mountpoint(hugetlbfs_t)
|
||||
fs_use_trans hugetlbfs gen_context(system_u:object_r:hugetlbfs_t,s0);
|
||||
@ -14984,7 +14992,7 @@ index e7d1738..089cc7a 100644
|
||||
|
||||
type ibmasmfs_t;
|
||||
fs_type(ibmasmfs_t)
|
||||
@@ -118,13 +134,14 @@ genfscon mvfs / gen_context(system_u:object_r:mvfs_t,s0)
|
||||
@@ -118,13 +135,14 @@ genfscon mvfs / gen_context(system_u:object_r:mvfs_t,s0)
|
||||
|
||||
type nfsd_fs_t;
|
||||
fs_type(nfsd_fs_t)
|
||||
@ -15000,7 +15008,7 @@ index e7d1738..089cc7a 100644
|
||||
fs_type(pstore_t)
|
||||
files_mountpoint(pstore_t)
|
||||
dev_associate_sysfs(pstore_t)
|
||||
@@ -150,11 +167,6 @@ fs_type(spufs_t)
|
||||
@@ -150,11 +168,6 @@ fs_type(spufs_t)
|
||||
genfscon spufs / gen_context(system_u:object_r:spufs_t,s0)
|
||||
files_mountpoint(spufs_t)
|
||||
|
||||
@ -15012,7 +15020,7 @@ index e7d1738..089cc7a 100644
|
||||
type sysv_t;
|
||||
fs_noxattr_type(sysv_t)
|
||||
files_mountpoint(sysv_t)
|
||||
@@ -172,6 +184,8 @@ type vxfs_t;
|
||||
@@ -172,6 +185,8 @@ type vxfs_t;
|
||||
fs_noxattr_type(vxfs_t)
|
||||
files_mountpoint(vxfs_t)
|
||||
genfscon vxfs / gen_context(system_u:object_r:vxfs_t,s0)
|
||||
@ -15021,7 +15029,7 @@ index e7d1738..089cc7a 100644
|
||||
|
||||
#
|
||||
# tmpfs_t is the type for tmpfs filesystems
|
||||
@@ -182,6 +196,8 @@ fs_type(tmpfs_t)
|
||||
@@ -182,6 +197,8 @@ fs_type(tmpfs_t)
|
||||
files_type(tmpfs_t)
|
||||
files_mountpoint(tmpfs_t)
|
||||
files_poly_parent(tmpfs_t)
|
||||
@ -15030,7 +15038,7 @@ index e7d1738..089cc7a 100644
|
||||
|
||||
# Use a transition SID based on the allocating task SID and the
|
||||
# filesystem SID to label inodes in the following filesystem types,
|
||||
@@ -261,6 +277,8 @@ genfscon udf / gen_context(system_u:object_r:iso9660_t,s0)
|
||||
@@ -261,6 +278,8 @@ genfscon udf / gen_context(system_u:object_r:iso9660_t,s0)
|
||||
type removable_t;
|
||||
allow removable_t noxattrfs:filesystem associate;
|
||||
fs_noxattr_type(removable_t)
|
||||
@ -15039,7 +15047,7 @@ index e7d1738..089cc7a 100644
|
||||
files_mountpoint(removable_t)
|
||||
|
||||
#
|
||||
@@ -280,6 +298,7 @@ genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0)
|
||||
@@ -280,6 +299,7 @@ genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0)
|
||||
genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0)
|
||||
genfscon panfs / gen_context(system_u:object_r:nfs_t,s0)
|
||||
genfscon gadgetfs / gen_context(system_u:object_r:nfs_t,s0)
|
||||
@ -18603,7 +18611,7 @@ index 234a940..d340f20 100644
|
||||
########################################
|
||||
## <summary>
|
||||
diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
|
||||
index 0fef1fc..46aa66e 100644
|
||||
index 0fef1fc..45ee29f 100644
|
||||
--- a/policy/modules/roles/staff.te
|
||||
+++ b/policy/modules/roles/staff.te
|
||||
@@ -8,12 +8,71 @@ policy_module(staff, 2.4.0)
|
||||
@ -18829,7 +18837,7 @@ index 0fef1fc..46aa66e 100644
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -52,11 +231,61 @@ optional_policy(`
|
||||
@@ -52,11 +231,60 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -18874,6 +18882,7 @@ index 0fef1fc..46aa66e 100644
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
- xserver_role(staff_r, staff_t)
|
||||
+ vmtools_run_helper(staff_t, staff_r)
|
||||
+')
|
||||
+
|
||||
@ -18886,12 +18895,11 @@ index 0fef1fc..46aa66e 100644
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
xserver_role(staff_r, staff_t)
|
||||
+ xserver_read_log(staff_t)
|
||||
')
|
||||
|
||||
ifndef(`distro_redhat',`
|
||||
@@ -65,10 +294,6 @@ ifndef(`distro_redhat',`
|
||||
@@ -65,10 +293,6 @@ ifndef(`distro_redhat',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -18902,7 +18910,7 @@ index 0fef1fc..46aa66e 100644
|
||||
cdrecord_role(staff_r, staff_t)
|
||||
')
|
||||
|
||||
@@ -78,10 +303,6 @@ ifndef(`distro_redhat',`
|
||||
@@ -78,10 +302,6 @@ ifndef(`distro_redhat',`
|
||||
|
||||
optional_policy(`
|
||||
dbus_role_template(staff, staff_r, staff_t)
|
||||
@ -18913,7 +18921,7 @@ index 0fef1fc..46aa66e 100644
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -101,10 +322,6 @@ ifndef(`distro_redhat',`
|
||||
@@ -101,10 +321,6 @@ ifndef(`distro_redhat',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -18924,7 +18932,7 @@ index 0fef1fc..46aa66e 100644
|
||||
java_role(staff_r, staff_t)
|
||||
')
|
||||
|
||||
@@ -125,10 +342,6 @@ ifndef(`distro_redhat',`
|
||||
@@ -125,10 +341,6 @@ ifndef(`distro_redhat',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -18935,7 +18943,7 @@ index 0fef1fc..46aa66e 100644
|
||||
pyzor_role(staff_r, staff_t)
|
||||
')
|
||||
|
||||
@@ -141,10 +354,6 @@ ifndef(`distro_redhat',`
|
||||
@@ -141,10 +353,6 @@ ifndef(`distro_redhat',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -18946,7 +18954,7 @@ index 0fef1fc..46aa66e 100644
|
||||
spamassassin_role(staff_r, staff_t)
|
||||
')
|
||||
|
||||
@@ -176,3 +385,22 @@ ifndef(`distro_redhat',`
|
||||
@@ -176,3 +384,22 @@ ifndef(`distro_redhat',`
|
||||
wireshark_role(staff_r, staff_t)
|
||||
')
|
||||
')
|
||||
@ -20645,7 +20653,7 @@ index 3835596..fbca2be 100644
|
||||
########################################
|
||||
## <summary>
|
||||
diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
|
||||
index 6d77e81..c175ba4 100644
|
||||
index 6d77e81..79ee03d 100644
|
||||
--- a/policy/modules/roles/unprivuser.te
|
||||
+++ b/policy/modules/roles/unprivuser.te
|
||||
@@ -1,5 +1,12 @@
|
||||
@ -20761,10 +20769,11 @@ index 6d77e81..c175ba4 100644
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -25,6 +118,18 @@ optional_policy(`
|
||||
@@ -25,11 +118,19 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
- vlock_run(user_t, user_r)
|
||||
+ setroubleshoot_dontaudit_stream_connect(user_t)
|
||||
+')
|
||||
+
|
||||
@ -20774,13 +20783,15 @@ index 6d77e81..c175ba4 100644
|
||||
+
|
||||
+optional_policy(`
|
||||
+ usbmuxd_stream_connect(user_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
vlock_run(user_t, user_r)
|
||||
')
|
||||
|
||||
@@ -102,10 +207,6 @@ ifndef(`distro_redhat',`
|
||||
optional_policy(`
|
||||
- xserver_role(user_r, user_t)
|
||||
+ vlock_run(user_t, user_r)
|
||||
')
|
||||
|
||||
ifndef(`distro_redhat',`
|
||||
@@ -102,10 +203,6 @@ ifndef(`distro_redhat',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -20791,7 +20802,7 @@ index 6d77e81..c175ba4 100644
|
||||
postgresql_role(user_r, user_t)
|
||||
')
|
||||
|
||||
@@ -128,7 +229,6 @@ ifndef(`distro_redhat',`
|
||||
@@ -128,7 +225,6 @@ ifndef(`distro_redhat',`
|
||||
optional_policy(`
|
||||
ssh_role_template(user, user_r, user_t)
|
||||
')
|
||||
@ -20799,7 +20810,7 @@ index 6d77e81..c175ba4 100644
|
||||
optional_policy(`
|
||||
su_role_template(user, user_r, user_t)
|
||||
')
|
||||
@@ -161,3 +261,19 @@ ifndef(`distro_redhat',`
|
||||
@@ -161,3 +257,19 @@ ifndef(`distro_redhat',`
|
||||
wireshark_role(user_r, user_t)
|
||||
')
|
||||
')
|
||||
@ -22959,10 +22970,10 @@ index 8274418..4eee56a 100644
|
||||
+/var/lib/pqsql/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
|
||||
+
|
||||
diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if
|
||||
index 6bf0ecc..2469c27 100644
|
||||
index 6bf0ecc..44be5f2 100644
|
||||
--- a/policy/modules/services/xserver.if
|
||||
+++ b/policy/modules/services/xserver.if
|
||||
@@ -18,100 +18,37 @@
|
||||
@@ -18,100 +18,36 @@
|
||||
#
|
||||
interface(`xserver_restricted_role',`
|
||||
gen_require(`
|
||||
@ -22970,13 +22981,12 @@ index 6bf0ecc..2469c27 100644
|
||||
- type user_fonts_t, user_fonts_cache_t, user_fonts_config_t;
|
||||
- type iceauth_t, iceauth_exec_t, iceauth_home_t;
|
||||
- type xauth_t, xauth_exec_t, xauth_home_t;
|
||||
+ type xserver_t, xauth_t, iceauth_t;
|
||||
+ type xauth_t, iceauth_t;
|
||||
+ attribute dridomain, x_userdomain;
|
||||
')
|
||||
|
||||
role $1 types { xserver_t xauth_t iceauth_t };
|
||||
+ typeattribute $2 x_userdomain, dridomain;
|
||||
|
||||
- role $1 types { xserver_t xauth_t iceauth_t };
|
||||
-
|
||||
- # Xserver read/write client shm
|
||||
- allow xserver_t $2:fd use;
|
||||
- allow xserver_t $2:shm rw_shm_perms;
|
||||
@ -23044,30 +23054,31 @@ index 6bf0ecc..2469c27 100644
|
||||
- dev_rw_usbfs($2)
|
||||
-
|
||||
- miscfiles_read_fonts($2)
|
||||
+ xserver_common_x_domain_template(user,$2)
|
||||
+ xserver_stream_connect_xdm($2)
|
||||
+ xserver_xdm_append_log($2)
|
||||
+ role $1 types { xauth_t iceauth_t };
|
||||
+ typeattribute $2 x_userdomain, dridomain;
|
||||
|
||||
- xserver_common_x_domain_template(user, $2)
|
||||
- xserver_domtrans($2)
|
||||
- xserver_unconfined($2)
|
||||
- xserver_xsession_entry_type($2)
|
||||
- xserver_dontaudit_write_log($2)
|
||||
- xserver_stream_connect_xdm($2)
|
||||
+ xserver_common_x_domain_template(user,$2)
|
||||
xserver_stream_connect_xdm($2)
|
||||
- # certain apps want to read xdm.pid file
|
||||
- xserver_read_xdm_pid($2)
|
||||
- # gnome-session creates socket under /tmp/.ICE-unix/
|
||||
- xserver_create_xdm_tmp_sockets($2)
|
||||
- # Needed for escd, remove if we get escd policy
|
||||
- xserver_manage_xdm_tmp_files($2)
|
||||
+ modutils_run_insmod(xserver_t, $1)
|
||||
+ xserver_dri_domain($2)
|
||||
+')
|
||||
+ xserver_xdm_append_log($2)
|
||||
|
||||
- # Client write xserver shm
|
||||
- tunable_policy(`allow_write_xshm',`
|
||||
- allow $2 xserver_t:shm rw_shm_perms;
|
||||
- allow $2 xserver_tmpfs_t:file rw_file_perms;
|
||||
+ xserver_dri_domain($2)
|
||||
+')
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Domain wants to use direct io devices
|
||||
@ -23087,7 +23098,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -143,13 +80,15 @@ interface(`xserver_role',`
|
||||
@@ -143,13 +79,15 @@ interface(`xserver_role',`
|
||||
allow $2 xserver_tmpfs_t:file rw_file_perms;
|
||||
|
||||
allow $2 iceauth_home_t:file manage_file_perms;
|
||||
@ -23105,7 +23116,7 @@ index 6bf0ecc..2469c27 100644
|
||||
relabel_dirs_pattern($2, user_fonts_t, user_fonts_t)
|
||||
relabel_files_pattern($2, user_fonts_t, user_fonts_t)
|
||||
|
||||
@@ -162,7 +101,6 @@ interface(`xserver_role',`
|
||||
@@ -162,7 +100,6 @@ interface(`xserver_role',`
|
||||
manage_files_pattern($2, user_fonts_config_t, user_fonts_config_t)
|
||||
relabel_dirs_pattern($2, user_fonts_config_t, user_fonts_config_t)
|
||||
relabel_files_pattern($2, user_fonts_config_t, user_fonts_config_t)
|
||||
@ -23113,7 +23124,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
#######################################
|
||||
@@ -197,7 +135,7 @@ interface(`xserver_ro_session',`
|
||||
@@ -197,7 +134,7 @@ interface(`xserver_ro_session',`
|
||||
allow $1 xserver_t:process signal;
|
||||
|
||||
# Read /tmp/.X0-lock
|
||||
@ -23122,7 +23133,7 @@ index 6bf0ecc..2469c27 100644
|
||||
|
||||
# Client read xserver shm
|
||||
allow $1 xserver_t:fd use;
|
||||
@@ -227,7 +165,7 @@ interface(`xserver_rw_session',`
|
||||
@@ -227,7 +164,7 @@ interface(`xserver_rw_session',`
|
||||
type xserver_t, xserver_tmpfs_t;
|
||||
')
|
||||
|
||||
@ -23131,7 +23142,7 @@ index 6bf0ecc..2469c27 100644
|
||||
allow $1 xserver_t:shm rw_shm_perms;
|
||||
allow $1 xserver_tmpfs_t:file rw_file_perms;
|
||||
')
|
||||
@@ -255,7 +193,7 @@ interface(`xserver_non_drawing_client',`
|
||||
@@ -255,7 +192,7 @@ interface(`xserver_non_drawing_client',`
|
||||
|
||||
allow $1 self:x_gc { create setattr };
|
||||
|
||||
@ -23140,7 +23151,7 @@ index 6bf0ecc..2469c27 100644
|
||||
allow $1 xserver_t:unix_stream_socket connectto;
|
||||
|
||||
allow $1 xextension_t:x_extension { query use };
|
||||
@@ -282,7 +220,7 @@ interface(`xserver_non_drawing_client',`
|
||||
@@ -282,7 +219,7 @@ interface(`xserver_non_drawing_client',`
|
||||
interface(`xserver_user_client',`
|
||||
refpolicywarn(`$0() has been deprecated, please use xserver_user_x_domain_template instead.')
|
||||
gen_require(`
|
||||
@ -23149,7 +23160,7 @@ index 6bf0ecc..2469c27 100644
|
||||
type xauth_home_t, iceauth_home_t, xserver_t, xserver_tmpfs_t;
|
||||
')
|
||||
|
||||
@@ -291,14 +229,14 @@ interface(`xserver_user_client',`
|
||||
@@ -291,14 +228,14 @@ interface(`xserver_user_client',`
|
||||
allow $1 self:unix_stream_socket { connectto create_stream_socket_perms };
|
||||
|
||||
# Read .Xauthority file
|
||||
@ -23169,7 +23180,7 @@ index 6bf0ecc..2469c27 100644
|
||||
dontaudit $1 xdm_t:tcp_socket { read write };
|
||||
|
||||
# Allow connections to X server.
|
||||
@@ -316,7 +254,7 @@ interface(`xserver_user_client',`
|
||||
@@ -316,7 +253,7 @@ interface(`xserver_user_client',`
|
||||
xserver_read_xdm_tmp_files($1)
|
||||
|
||||
# Client write xserver shm
|
||||
@ -23178,7 +23189,7 @@ index 6bf0ecc..2469c27 100644
|
||||
allow $1 xserver_t:shm rw_shm_perms;
|
||||
allow $1 xserver_tmpfs_t:file rw_file_perms;
|
||||
')
|
||||
@@ -342,19 +280,23 @@ interface(`xserver_user_client',`
|
||||
@@ -342,19 +279,23 @@ interface(`xserver_user_client',`
|
||||
#
|
||||
template(`xserver_common_x_domain_template',`
|
||||
gen_require(`
|
||||
@ -23205,7 +23216,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
##############################
|
||||
@@ -383,9 +325,18 @@ template(`xserver_common_x_domain_template',`
|
||||
@@ -383,9 +324,18 @@ template(`xserver_common_x_domain_template',`
|
||||
allow $2 $1_input_xevent_t:{ x_event x_synthetic_event } receive;
|
||||
# can receive default events
|
||||
allow $2 client_xevent_t:{ x_event x_synthetic_event } receive;
|
||||
@ -23225,7 +23236,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
#######################################
|
||||
@@ -444,8 +395,9 @@ template(`xserver_object_types_template',`
|
||||
@@ -444,8 +394,9 @@ template(`xserver_object_types_template',`
|
||||
#
|
||||
template(`xserver_user_x_domain_template',`
|
||||
gen_require(`
|
||||
@ -23237,7 +23248,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
allow $2 self:shm create_shm_perms;
|
||||
@@ -456,11 +408,13 @@ template(`xserver_user_x_domain_template',`
|
||||
@@ -456,11 +407,13 @@ template(`xserver_user_x_domain_template',`
|
||||
allow $2 xauth_home_t:file read_file_perms;
|
||||
allow $2 iceauth_home_t:file read_file_perms;
|
||||
|
||||
@ -23254,7 +23265,7 @@ index 6bf0ecc..2469c27 100644
|
||||
dontaudit $2 xdm_t:tcp_socket { read write };
|
||||
|
||||
# Allow connections to X server.
|
||||
@@ -472,20 +426,26 @@ template(`xserver_user_x_domain_template',`
|
||||
@@ -472,20 +425,26 @@ template(`xserver_user_x_domain_template',`
|
||||
# for .xsession-errors
|
||||
userdom_dontaudit_write_user_home_content_files($2)
|
||||
|
||||
@ -23285,7 +23296,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -517,6 +477,7 @@ interface(`xserver_use_user_fonts',`
|
||||
@@ -517,6 +476,7 @@ interface(`xserver_use_user_fonts',`
|
||||
# Read per user fonts
|
||||
allow $1 user_fonts_t:dir list_dir_perms;
|
||||
allow $1 user_fonts_t:file read_file_perms;
|
||||
@ -23293,7 +23304,7 @@ index 6bf0ecc..2469c27 100644
|
||||
|
||||
# Manipulate the global font cache
|
||||
manage_dirs_pattern($1, user_fonts_cache_t, user_fonts_cache_t)
|
||||
@@ -547,6 +508,42 @@ interface(`xserver_domtrans_xauth',`
|
||||
@@ -547,6 +507,42 @@ interface(`xserver_domtrans_xauth',`
|
||||
domtrans_pattern($1, xauth_exec_t, xauth_t)
|
||||
')
|
||||
|
||||
@ -23336,7 +23347,7 @@ index 6bf0ecc..2469c27 100644
|
||||
########################################
|
||||
## <summary>
|
||||
## Create a Xauthority file in the user home directory.
|
||||
@@ -567,6 +564,24 @@ interface(`xserver_user_home_dir_filetrans_user_xauth',`
|
||||
@@ -567,6 +563,24 @@ interface(`xserver_user_home_dir_filetrans_user_xauth',`
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
@ -23361,7 +23372,7 @@ index 6bf0ecc..2469c27 100644
|
||||
## Read all users fonts, user font configurations,
|
||||
## and manage all users font caches.
|
||||
## </summary>
|
||||
@@ -598,6 +613,25 @@ interface(`xserver_read_user_xauth',`
|
||||
@@ -598,6 +612,25 @@ interface(`xserver_read_user_xauth',`
|
||||
|
||||
allow $1 xauth_home_t:file read_file_perms;
|
||||
userdom_search_user_home_dirs($1)
|
||||
@ -23387,7 +23398,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -615,7 +649,7 @@ interface(`xserver_setattr_console_pipes',`
|
||||
@@ -615,7 +648,7 @@ interface(`xserver_setattr_console_pipes',`
|
||||
type xconsole_device_t;
|
||||
')
|
||||
|
||||
@ -23396,7 +23407,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -638,6 +672,25 @@ interface(`xserver_rw_console',`
|
||||
@@ -638,6 +671,25 @@ interface(`xserver_rw_console',`
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
@ -23422,7 +23433,7 @@ index 6bf0ecc..2469c27 100644
|
||||
## Use file descriptors for xdm.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
@@ -651,7 +704,7 @@ interface(`xserver_use_xdm_fds',`
|
||||
@@ -651,7 +703,7 @@ interface(`xserver_use_xdm_fds',`
|
||||
type xdm_t;
|
||||
')
|
||||
|
||||
@ -23431,7 +23442,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -670,7 +723,7 @@ interface(`xserver_dontaudit_use_xdm_fds',`
|
||||
@@ -670,7 +722,7 @@ interface(`xserver_dontaudit_use_xdm_fds',`
|
||||
type xdm_t;
|
||||
')
|
||||
|
||||
@ -23440,7 +23451,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -688,7 +741,7 @@ interface(`xserver_rw_xdm_pipes',`
|
||||
@@ -688,7 +740,7 @@ interface(`xserver_rw_xdm_pipes',`
|
||||
type xdm_t;
|
||||
')
|
||||
|
||||
@ -23449,7 +23460,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -703,12 +756,11 @@ interface(`xserver_rw_xdm_pipes',`
|
||||
@@ -703,12 +755,11 @@ interface(`xserver_rw_xdm_pipes',`
|
||||
## </param>
|
||||
#
|
||||
interface(`xserver_dontaudit_rw_xdm_pipes',`
|
||||
@ -23463,7 +23474,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -765,11 +817,92 @@ interface(`xserver_manage_xdm_spool_files',`
|
||||
@@ -765,11 +816,92 @@ interface(`xserver_manage_xdm_spool_files',`
|
||||
#
|
||||
interface(`xserver_stream_connect_xdm',`
|
||||
gen_require(`
|
||||
@ -23558,7 +23569,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -793,6 +926,21 @@ interface(`xserver_read_xdm_rw_config',`
|
||||
@@ -793,6 +925,21 @@ interface(`xserver_read_xdm_rw_config',`
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
@ -23580,7 +23591,7 @@ index 6bf0ecc..2469c27 100644
|
||||
## Set the attributes of XDM temporary directories.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
@@ -802,11 +950,23 @@ interface(`xserver_read_xdm_rw_config',`
|
||||
@@ -802,11 +949,23 @@ interface(`xserver_read_xdm_rw_config',`
|
||||
## </param>
|
||||
#
|
||||
interface(`xserver_setattr_xdm_tmp_dirs',`
|
||||
@ -23608,7 +23619,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -821,13 +981,8 @@ interface(`xserver_setattr_xdm_tmp_dirs',`
|
||||
@@ -821,13 +980,8 @@ interface(`xserver_setattr_xdm_tmp_dirs',`
|
||||
## </param>
|
||||
#
|
||||
interface(`xserver_create_xdm_tmp_sockets',`
|
||||
@ -23624,7 +23635,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -846,7 +1001,26 @@ interface(`xserver_read_xdm_pid',`
|
||||
@@ -846,7 +1000,26 @@ interface(`xserver_read_xdm_pid',`
|
||||
')
|
||||
|
||||
files_search_pids($1)
|
||||
@ -23652,7 +23663,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -864,7 +1038,26 @@ interface(`xserver_read_xdm_lib_files',`
|
||||
@@ -864,7 +1037,26 @@ interface(`xserver_read_xdm_lib_files',`
|
||||
type xdm_var_lib_t;
|
||||
')
|
||||
|
||||
@ -23680,7 +23691,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -938,26 +1131,45 @@ interface(`xserver_getattr_log',`
|
||||
@@ -938,17 +1130,36 @@ interface(`xserver_getattr_log',`
|
||||
')
|
||||
|
||||
logging_search_logs($1)
|
||||
@ -23698,13 +23709,11 @@ index 6bf0ecc..2469c27 100644
|
||||
## <param name="domain">
|
||||
-## <summary>
|
||||
-## Domain to not audit.
|
||||
-## </summary>
|
||||
+## <summary>
|
||||
+## Domain allowed access.
|
||||
+## </summary>
|
||||
## </param>
|
||||
#
|
||||
-interface(`xserver_dontaudit_write_log',`
|
||||
+## </param>
|
||||
+#
|
||||
+interface(`xserver_read_log',`
|
||||
+ gen_require(`
|
||||
+ type xserver_log_t;
|
||||
@ -23722,11 +23731,10 @@ index 6bf0ecc..2469c27 100644
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain to not audit.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+interface(`xserver_dontaudit_write_log',`
|
||||
gen_require(`
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
@@ -957,7 +1168,7 @@ interface(`xserver_dontaudit_write_log',`
|
||||
type xserver_log_t;
|
||||
')
|
||||
|
||||
@ -23735,7 +23743,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1004,7 +1216,7 @@ interface(`xserver_read_xkb_libs',`
|
||||
@@ -1004,7 +1215,7 @@ interface(`xserver_read_xkb_libs',`
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
@ -23744,7 +23752,7 @@ index 6bf0ecc..2469c27 100644
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
@@ -1012,51 +1224,117 @@ interface(`xserver_read_xkb_libs',`
|
||||
@@ -1012,51 +1223,117 @@ interface(`xserver_read_xkb_libs',`
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
@ -23878,7 +23886,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1070,11 +1348,38 @@ interface(`xserver_rw_xdm_tmp_files',`
|
||||
@@ -1070,11 +1347,38 @@ interface(`xserver_rw_xdm_tmp_files',`
|
||||
## </param>
|
||||
#
|
||||
interface(`xserver_manage_xdm_tmp_files',`
|
||||
@ -23921,7 +23929,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1089,11 +1394,8 @@ interface(`xserver_manage_xdm_tmp_files',`
|
||||
@@ -1089,11 +1393,8 @@ interface(`xserver_manage_xdm_tmp_files',`
|
||||
## </param>
|
||||
#
|
||||
interface(`xserver_dontaudit_getattr_xdm_tmp_sockets',`
|
||||
@ -23935,7 +23943,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1111,8 +1413,10 @@ interface(`xserver_domtrans',`
|
||||
@@ -1111,8 +1412,10 @@ interface(`xserver_domtrans',`
|
||||
type xserver_t, xserver_exec_t;
|
||||
')
|
||||
|
||||
@ -23947,7 +23955,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1210,6 +1514,25 @@ interface(`xserver_dontaudit_rw_stream_sockets',`
|
||||
@@ -1210,6 +1513,25 @@ interface(`xserver_dontaudit_rw_stream_sockets',`
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
@ -23973,7 +23981,7 @@ index 6bf0ecc..2469c27 100644
|
||||
## Connect to the X server over a unix domain
|
||||
## stream socket.
|
||||
## </summary>
|
||||
@@ -1226,6 +1549,26 @@ interface(`xserver_stream_connect',`
|
||||
@@ -1226,6 +1548,26 @@ interface(`xserver_stream_connect',`
|
||||
|
||||
files_search_tmp($1)
|
||||
stream_connect_pattern($1, xserver_tmp_t, xserver_tmp_t, xserver_t)
|
||||
@ -24000,7 +24008,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1251,7 +1594,7 @@ interface(`xserver_read_tmp_files',`
|
||||
@@ -1251,7 +1593,7 @@ interface(`xserver_read_tmp_files',`
|
||||
## <summary>
|
||||
## Interface to provide X object permissions on a given X server to
|
||||
## an X client domain. Gives the domain permission to read the
|
||||
@ -24009,7 +24017,7 @@ index 6bf0ecc..2469c27 100644
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
@@ -1261,13 +1604,27 @@ interface(`xserver_read_tmp_files',`
|
||||
@@ -1261,13 +1603,27 @@ interface(`xserver_read_tmp_files',`
|
||||
#
|
||||
interface(`xserver_manage_core_devices',`
|
||||
gen_require(`
|
||||
@ -24038,7 +24046,7 @@ index 6bf0ecc..2469c27 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1284,10 +1641,657 @@ interface(`xserver_manage_core_devices',`
|
||||
@@ -1284,10 +1640,657 @@ interface(`xserver_manage_core_devices',`
|
||||
#
|
||||
interface(`xserver_unconfined',`
|
||||
gen_require(`
|
||||
@ -24699,7 +24707,7 @@ index 6bf0ecc..2469c27 100644
|
||||
+')
|
||||
+
|
||||
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
|
||||
index 8b40377..e3f28af 100644
|
||||
index 8b40377..0777a7f 100644
|
||||
--- a/policy/modules/services/xserver.te
|
||||
+++ b/policy/modules/services/xserver.te
|
||||
@@ -26,28 +26,59 @@ gen_require(`
|
||||
@ -26141,9 +26149,9 @@ index 8b40377..e3f28af 100644
|
||||
+miscfiles_read_hwdata(x_userdomain)
|
||||
+
|
||||
+#xserver_common_x_domain_template(user, x_userdomain)
|
||||
+xserver_domtrans(x_userdomain)
|
||||
+#xserver_domtrans(x_userdomain)
|
||||
+#xserver_unconfined(x_userdomain)
|
||||
+xserver_xsession_entry_type(x_userdomain)
|
||||
+#xserver_xsession_entry_type(x_userdomain)
|
||||
+xserver_dontaudit_write_log(x_userdomain)
|
||||
+#xserver_stream_connect_xdm(x_userdomain)
|
||||
+# certain apps want to read xdm.pid file
|
||||
@ -37748,7 +37756,7 @@ index 1447687..d5e6fb9 100644
|
||||
seutil_read_config(setrans_t)
|
||||
|
||||
diff --git a/policy/modules/system/sysnetwork.fc b/policy/modules/system/sysnetwork.fc
|
||||
index 40edc18..a072ac2 100644
|
||||
index 40edc18..b39e137 100644
|
||||
--- a/policy/modules/system/sysnetwork.fc
|
||||
+++ b/policy/modules/system/sysnetwork.fc
|
||||
@@ -17,22 +17,24 @@ ifdef(`distro_debian',`
|
||||
@ -37780,7 +37788,7 @@ index 40edc18..a072ac2 100644
|
||||
')
|
||||
|
||||
#
|
||||
@@ -55,6 +57,20 @@ ifdef(`distro_redhat',`
|
||||
@@ -55,6 +57,21 @@ ifdef(`distro_redhat',`
|
||||
#
|
||||
# /usr
|
||||
#
|
||||
@ -37792,6 +37800,7 @@ index 40edc18..a072ac2 100644
|
||||
+/usr/sbin/ethtool -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
|
||||
+/usr/sbin/ifconfig -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
|
||||
+/usr/sbin/ip -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
|
||||
+/usr/sbin/iw -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
|
||||
+/usr/sbin/ipx_configure -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
|
||||
+/usr/sbin/ipx_interface -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
|
||||
+/usr/sbin/ipx_internal_net -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
|
||||
@ -37801,7 +37810,7 @@ index 40edc18..a072ac2 100644
|
||||
/usr/sbin/tc -- gen_context(system_u:object_r:ifconfig_exec_t,s0)
|
||||
|
||||
#
|
||||
@@ -77,3 +93,6 @@ ifdef(`distro_debian',`
|
||||
@@ -77,3 +94,6 @@ ifdef(`distro_debian',`
|
||||
/var/run/network(/.*)? gen_context(system_u:object_r:net_conf_t,s0)
|
||||
')
|
||||
|
||||
|
@ -29868,10 +29868,10 @@ index 4e95c7e..0000000
|
||||
-
|
||||
-miscfiles_read_localization(glusterd_t)
|
||||
diff --git a/gnome.fc b/gnome.fc
|
||||
index e39de43..6a6db28 100644
|
||||
index e39de43..5edcb83 100644
|
||||
--- a/gnome.fc
|
||||
+++ b/gnome.fc
|
||||
@@ -1,15 +1,61 @@
|
||||
@@ -1,15 +1,60 @@
|
||||
-HOME_DIR/\.gconf(/.*)? gen_context(system_u:object_r:gconf_home_t,s0)
|
||||
-HOME_DIR/\.gconfd(/.*)? gen_context(system_u:object_r:gconf_home_t,s0)
|
||||
-HOME_DIR/\.gnome(/.*)? gen_context(system_u:object_r:gnome_home_t,s0)
|
||||
@ -29889,7 +29889,6 @@ index e39de43..6a6db28 100644
|
||||
+HOME_DIR/\.gconf(d)?(/.*)? gen_context(system_u:object_r:gconf_home_t,s0)
|
||||
+HOME_DIR/\.gnome2(/.*)? gen_context(system_u:object_r:gnome_home_t,s0)
|
||||
+HOME_DIR/\.gnome2/keyrings(/.*)? gen_context(system_u:object_r:gkeyringd_gnome_home_t,s0)
|
||||
+HOME_DIR/\.grl-bookmarks gen_context(system_u:object_r:gstreamer_home_t,s0)
|
||||
+HOME_DIR/\.grl-metadata-store gen_context(system_u:object_r:gstreamer_home_t,s0)
|
||||
+HOME_DIR/\.grl-bookmarks gen_context(system_u:object_r:gstreamer_home_t,s0)
|
||||
+HOME_DIR/\.gstreamer-.* gen_context(system_u:object_r:gstreamer_home_t,s0)
|
||||
@ -37198,7 +37197,7 @@ index 0000000..0d61849
|
||||
+')
|
||||
diff --git a/keepalived.te b/keepalived.te
|
||||
new file mode 100644
|
||||
index 0000000..2c08717
|
||||
index 0000000..879ab65
|
||||
--- /dev/null
|
||||
+++ b/keepalived.te
|
||||
@@ -0,0 +1,55 @@
|
||||
@ -37237,16 +37236,16 @@ index 0000000..2c08717
|
||||
+kernel_read_system_state(keepalived_t)
|
||||
+kernel_read_network_state(keepalived_t)
|
||||
+
|
||||
+auth_use_nsswitch(keepalived_t)
|
||||
+
|
||||
+corecmd_exec_bin(keepalived_t)
|
||||
+corecmd_exec_shell(keepalived_t)
|
||||
+
|
||||
+corenet_tcp_connect_snmp_port(keepalived_t)
|
||||
+
|
||||
+auth_use_nsswitch(keepalived_t)
|
||||
+
|
||||
+corenet_tcp_connect_connlcli_port(keepalived_t)
|
||||
+corenet_tcp_connect_http_port(keepalived_t)
|
||||
+corenet_tcp_connect_smtp_port(keepalived_t)
|
||||
+corenet_tcp_connect_snmp_port(keepalived_t)
|
||||
+corenet_tcp_connect_agentx_port(keepalived_t)
|
||||
+
|
||||
+dev_read_urand(keepalived_t)
|
||||
+
|
||||
@ -73994,7 +73993,7 @@ index afc0068..3105104 100644
|
||||
+ ')
|
||||
')
|
||||
diff --git a/quantum.te b/quantum.te
|
||||
index 8644d8b..e815665 100644
|
||||
index 8644d8b..ddc4c31 100644
|
||||
--- a/quantum.te
|
||||
+++ b/quantum.te
|
||||
@@ -5,92 +5,146 @@ policy_module(quantum, 1.1.0)
|
||||
@ -74049,7 +74048,7 @@ index 8644d8b..e815665 100644
|
||||
+allow neutron_t self:fifo_file rw_fifo_file_perms;
|
||||
+allow neutron_t self:key manage_key_perms;
|
||||
+allow neutron_t self:tcp_socket { accept listen };
|
||||
+allow neutron_t self:unix_stream_socket { accept listen };
|
||||
+allow neutron_t self:unix_stream_socket { accept listen connectto };
|
||||
+allow neutron_t self:netlink_route_socket rw_netlink_socket_perms;
|
||||
+allow neutron_t self:rawip_socket create_socket_perms;
|
||||
+allow neutron_t self:packet_socket create_socket_perms;
|
||||
@ -94752,10 +94751,10 @@ index 0000000..6a1f575
|
||||
+')
|
||||
diff --git a/swift.te b/swift.te
|
||||
new file mode 100644
|
||||
index 0000000..d3fe02a
|
||||
index 0000000..3d21c49
|
||||
--- /dev/null
|
||||
+++ b/swift.te
|
||||
@@ -0,0 +1,119 @@
|
||||
@@ -0,0 +1,126 @@
|
||||
+policy_module(swift, 1.0.0)
|
||||
+
|
||||
+########################################
|
||||
@ -94842,9 +94841,12 @@ index 0000000..d3fe02a
|
||||
+
|
||||
+# bug in swift
|
||||
+corenet_tcp_bind_xserver_port(swift_t)
|
||||
+
|
||||
+corenet_tcp_bind_swift_port(swift_t)
|
||||
+corenet_tcp_bind_http_cache_port(swift_t)
|
||||
+
|
||||
+corenet_tcp_connect_xserver_port(swift_t)
|
||||
+corenet_tcp_connect_swift_port(swift_t)
|
||||
+
|
||||
+corecmd_exec_shell(swift_t)
|
||||
+corecmd_exec_bin(swift_t)
|
||||
@ -94872,6 +94874,10 @@ index 0000000..d3fe02a
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ apache_search_config(swift_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ rpm_exec(swift_t)
|
||||
+ rpm_dontaudit_manage_db(swift_t)
|
||||
+')
|
||||
@ -95242,14 +95248,14 @@ index b26d44a..5ab05dc 100644
|
||||
-
|
||||
-miscfiles_read_localization(tcsd_t)
|
||||
diff --git a/telepathy.fc b/telepathy.fc
|
||||
index 6c7f8f8..107300a 100644
|
||||
index 6c7f8f8..03fc880 100644
|
||||
--- a/telepathy.fc
|
||||
+++ b/telepathy.fc
|
||||
@@ -1,35 +1,24 @@
|
||||
@@ -1,35 +1,23 @@
|
||||
-HOME_DIR/\.cache/\.mc_connections -- gen_context(system_u:object_r:telepathy_mission_control_cache_home_t,s0)
|
||||
+HOME_DIR/\.cache/\.mc_connections -- gen_context(system_u:object_r:telepathy_mission_control_cache_home_t, s0)
|
||||
HOME_DIR/\.cache/telepathy(/.*)? gen_context(system_u:object_r:telepathy_cache_home_t, s0)
|
||||
HOME_DIR/\.cache/telepathy/avatars/gabble(/.*)? gen_context(system_u:object_r:telepathy_gabble_cache_home_t, s0)
|
||||
-HOME_DIR/\.cache/telepathy/avatars/gabble(/.*)? gen_context(system_u:object_r:telepathy_gabble_cache_home_t, s0)
|
||||
HOME_DIR/\.cache/telepathy/logger(/.*)? gen_context(system_u:object_r:telepathy_logger_cache_home_t,s0)
|
||||
-HOME_DIR/\.cache/telepathy/gabble(/.*)? gen_context(system_u:object_r:telepathy_gabble_cache_home_t,s0)
|
||||
-HOME_DIR/\.cache/wocky(/.*)? gen_context(system_u:object_r:telepathy_gabble_cache_home_t,s0)
|
||||
@ -101923,7 +101929,7 @@ index facdee8..88dcafb 100644
|
||||
+ virt_stream_connect($1)
|
||||
')
|
||||
diff --git a/virt.te b/virt.te
|
||||
index f03dcf5..f74be5f 100644
|
||||
index f03dcf5..d3fb1c1 100644
|
||||
--- a/virt.te
|
||||
+++ b/virt.te
|
||||
@@ -1,150 +1,212 @@
|
||||
@ -103387,7 +103393,7 @@ index f03dcf5..f74be5f 100644
|
||||
selinux_get_enforce_mode(virtd_lxc_t)
|
||||
selinux_get_fs_mount(virtd_lxc_t)
|
||||
selinux_validate_context(virtd_lxc_t)
|
||||
@@ -974,194 +1133,303 @@ selinux_compute_create_context(virtd_lxc_t)
|
||||
@@ -974,194 +1133,307 @@ selinux_compute_create_context(virtd_lxc_t)
|
||||
selinux_compute_relabel_context(virtd_lxc_t)
|
||||
selinux_compute_user_contexts(virtd_lxc_t)
|
||||
|
||||
@ -103500,6 +103506,7 @@ index f03dcf5..f74be5f 100644
|
||||
+fs_list_inotifyfs(svirt_sandbox_domain)
|
||||
+fs_rw_inherited_tmpfs_files(svirt_sandbox_domain)
|
||||
+fs_read_fusefs_files(svirt_sandbox_domain)
|
||||
+fs_read_hugetlbfs_files(svirt_sandbox_domain)
|
||||
+
|
||||
+auth_dontaudit_read_passwd(svirt_sandbox_domain)
|
||||
+auth_dontaudit_read_login_records(svirt_sandbox_domain)
|
||||
@ -103646,13 +103653,15 @@ index f03dcf5..f74be5f 100644
|
||||
+tunable_policy(`virt_use_nfs',`
|
||||
+ fs_manage_nfs_dirs(svirt_sandbox_domain)
|
||||
+ fs_manage_nfs_files(svirt_sandbox_domain)
|
||||
+ fs_read_nfs_symlinks(svirt_sandbox_domain)
|
||||
+ fs_manage_nfs_named_sockets(svirt_sandbox_domain)
|
||||
+ fs_manage_nfs_symlinks(svirt_sandbox_domain)
|
||||
+')
|
||||
+
|
||||
+tunable_policy(`virt_use_samba',`
|
||||
+ fs_manage_cifs_files(svirt_sandbox_domain)
|
||||
+ fs_manage_cifs_dirs(svirt_sandbox_domain)
|
||||
+ fs_read_cifs_symlinks(svirt_sandbox_domain)
|
||||
+ fs_manage_cifs_named_sockets(svirt_sandbox_domain)
|
||||
+ fs_manage_cifs_symlinks(svirt_sandbox_domain)
|
||||
')
|
||||
|
||||
########################################
|
||||
@ -103711,6 +103720,7 @@ index f03dcf5..f74be5f 100644
|
||||
-corenet_sendrecv_all_client_packets(svirt_lxc_net_t)
|
||||
-corenet_tcp_connect_all_ports(svirt_lxc_net_t)
|
||||
+kernel_read_irq_sysctls(svirt_lxc_net_t)
|
||||
+kernel_read_messages(svirt_lxc_net_t)
|
||||
|
||||
+dev_read_sysfs(svirt_lxc_net_t)
|
||||
dev_getattr_mtrr_dev(svirt_lxc_net_t)
|
||||
@ -103828,7 +103838,7 @@ index f03dcf5..f74be5f 100644
|
||||
allow virt_qmf_t self:tcp_socket create_stream_socket_perms;
|
||||
allow virt_qmf_t self:netlink_route_socket create_netlink_socket_perms;
|
||||
|
||||
@@ -1174,12 +1442,12 @@ dev_read_sysfs(virt_qmf_t)
|
||||
@@ -1174,12 +1446,12 @@ dev_read_sysfs(virt_qmf_t)
|
||||
dev_read_rand(virt_qmf_t)
|
||||
dev_read_urand(virt_qmf_t)
|
||||
|
||||
@ -103843,7 +103853,7 @@ index f03dcf5..f74be5f 100644
|
||||
sysnet_read_config(virt_qmf_t)
|
||||
|
||||
optional_policy(`
|
||||
@@ -1192,9 +1460,8 @@ optional_policy(`
|
||||
@@ -1192,9 +1464,8 @@ optional_policy(`
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -103854,7 +103864,7 @@ index f03dcf5..f74be5f 100644
|
||||
allow virt_bridgehelper_t self:process { setcap getcap };
|
||||
allow virt_bridgehelper_t self:capability { setpcap setgid setuid net_admin };
|
||||
allow virt_bridgehelper_t self:tcp_socket create_stream_socket_perms;
|
||||
@@ -1207,5 +1474,216 @@ kernel_read_network_state(virt_bridgehelper_t)
|
||||
@@ -1207,5 +1478,216 @@ kernel_read_network_state(virt_bridgehelper_t)
|
||||
|
||||
corenet_rw_tun_tap_dev(virt_bridgehelper_t)
|
||||
|
||||
|
@ -19,7 +19,7 @@
|
||||
Summary: SELinux policy configuration
|
||||
Name: selinux-policy
|
||||
Version: 3.13.1
|
||||
Release: 61%{?dist}
|
||||
Release: 62%{?dist}
|
||||
License: GPLv2+
|
||||
Group: System Environment/Base
|
||||
Source: serefpolicy-%{version}.tgz
|
||||
@ -600,6 +600,18 @@ SELinux Reference policy mls base module.
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Wed Jun 25 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-62
|
||||
- Allow swift to use tcp/6200 swift port
|
||||
- ALlow swift to search apache configs
|
||||
- Remove duplicate .fc entry for Grilo plugin bookmarks
|
||||
- Remove duplicate .fc entry for telepathy-gabble
|
||||
- Additional allow rules for docker sandbox processes
|
||||
- Allow keepalived connect to agentx port
|
||||
- Allow neutron-ns-metadata to connectto own unix stream socket
|
||||
- Add support for tcp/6200 port
|
||||
- Remove ability for confined users to run xinit
|
||||
- New tool for managing wireless /usr/sbin/iw
|
||||
|
||||
* Fri Jun 20 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-61
|
||||
- Add back MLS policy
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user