rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

* Tue Aug 15 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-272

Browse Source 
- Allow sssd_t domain to map sssd_var_lib_t files
- allow map permission where needed
- contrib: allow map permission where needed
- Allow syslogd_t to map syslogd_var_run_t files
- allow map permission where needed
This commit is contained in:
Lukas Vrabec 2017-08-15 16:29:24 +02:00
parent c6aaaee231
commit 284401b055
4 changed files with 188 additions and 126 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
container-selinux.tgz
View File

Binary file not shown.

94
policy-rawhide-base.patch
View File

@ -6849,7 +6849,7 @@ index b31c05491..3ad1127cc 100644
+/usr/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0)
+/usr/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0)
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index 76f285ea6..732931f47 100644
index 76f285ea6..917fc3cc5 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -143,13 +143,32 @@ interface(`dev_relabel_all_dev_nodes',`
@ -8135,7 +8135,7 @@ index 76f285ea6..732931f47 100644
')
########################################
@@ -3669,6 +4404,7 @@ interface(`dev_read_sound_mixer',`
@@ -3633,6 +4368,7 @@ interface(`dev_read_sound',`
')
read_chr_files_pattern($1, device_t, sound_device_t)
@ -8143,7 +8143,15 @@ index 76f285ea6..732931f47 100644
')
########################################
@@ -3855,7 +4591,7 @@ interface(`dev_getattr_sysfs_dirs',`
@@ -3669,6 +4405,7 @@ interface(`dev_read_sound_mixer',`
')
read_chr_files_pattern($1, device_t, sound_device_t)
+ allow $1 sound_device_t:chr_file map;
')
########################################
@@ -3855,7 +4592,7 @@ interface(`dev_getattr_sysfs_dirs',`
########################################
## <summary>
@ -8152,7 +8160,7 @@ index 76f285ea6..732931f47 100644
## </summary>
## <param name="domain">
## <summary>
@@ -3863,91 +4599,89 @@ interface(`dev_getattr_sysfs_dirs',`
@@ -3863,91 +4600,89 @@ interface(`dev_getattr_sysfs_dirs',`
## </summary>
## </param>
#
@ -8263,7 +8271,7 @@ index 76f285ea6..732931f47 100644
## </summary>
## <param name="domain">
## <summary>
@@ -3955,60 +4689,215 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
@@ -3955,60 +4690,215 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
## </summary>
## </param>
#
@ -8500,7 +8508,7 @@ index 76f285ea6..732931f47 100644
read_lnk_files_pattern($1, sysfs_t, sysfs_t)
list_dirs_pattern($1, sysfs_t, sysfs_t)
@@ -4016,6 +4905,81 @@ interface(`dev_rw_sysfs',`
@@ -4016,6 +4906,81 @@ interface(`dev_rw_sysfs',`
########################################
## <summary>
@ -8582,7 +8590,7 @@ index 76f285ea6..732931f47 100644
## Read and write the TPM device.
## </summary>
## <param name="domain">
@@ -4113,6 +5077,25 @@ interface(`dev_write_urand',`
@@ -4113,6 +5078,25 @@ interface(`dev_write_urand',`
########################################
## <summary>
@ -8608,7 +8616,7 @@ index 76f285ea6..732931f47 100644
## Getattr generic the USB devices.
## </summary>
## <param name="domain">
@@ -4123,7 +5106,7 @@ interface(`dev_write_urand',`
@@ -4123,7 +5107,7 @@ interface(`dev_write_urand',`
#
interface(`dev_getattr_generic_usb_dev',`
gen_require(`
@ -8617,7 +8625,7 @@ index 76f285ea6..732931f47 100644
')
getattr_chr_files_pattern($1, device_t, usb_device_t)
@@ -4409,9 +5392,9 @@ interface(`dev_rw_usbfs',`
@@ -4409,9 +5393,9 @@ interface(`dev_rw_usbfs',`
read_lnk_files_pattern($1, usbfs_t, usbfs_t)
')
@ -8629,7 +8637,7 @@ index 76f285ea6..732931f47 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4419,17 +5402,17 @@ interface(`dev_rw_usbfs',`
@@ -4419,17 +5403,17 @@ interface(`dev_rw_usbfs',`
## </summary>
## </param>
#
@ -8652,7 +8660,7 @@ index 76f285ea6..732931f47 100644
## </summary>
## <param name="domain">
## <summary>
@@ -4437,12 +5420,12 @@ interface(`dev_getattr_video_dev',`
@@ -4437,12 +5421,12 @@ interface(`dev_getattr_video_dev',`
## </summary>
## </param>
#
@ -8668,7 +8676,7 @@ index 76f285ea6..732931f47 100644
')
########################################
@@ -4539,6 +5522,134 @@ interface(`dev_write_video_dev',`
@@ -4539,6 +5523,134 @@ interface(`dev_write_video_dev',`
########################################
## <summary>
@ -8803,7 +8811,7 @@ index 76f285ea6..732931f47 100644
## Allow read/write the vhost net device
## </summary>
## <param name="domain">
@@ -4557,6 +5668,24 @@ interface(`dev_rw_vhost',`
@@ -4557,6 +5669,24 @@ interface(`dev_rw_vhost',`
########################################
## <summary>
@ -8828,7 +8836,7 @@ index 76f285ea6..732931f47 100644
## Read and write VMWare devices.
## </summary>
## <param name="domain">
@@ -4589,7 +5718,7 @@ interface(`dev_rwx_vmware',`
@@ -4589,7 +5719,7 @@ interface(`dev_rwx_vmware',`
')
dev_rw_vmware($1)
@ -8837,7 +8845,7 @@ index 76f285ea6..732931f47 100644
')
########################################
@@ -4630,6 +5759,24 @@ interface(`dev_write_watchdog',`
@@ -4630,6 +5760,24 @@ interface(`dev_write_watchdog',`
########################################
## <summary>
@ -8862,7 +8870,7 @@ index 76f285ea6..732931f47 100644
## Read and write the the wireless device.
## </summary>
## <param name="domain">
@@ -4762,6 +5909,44 @@ interface(`dev_rw_xserver_misc',`
@@ -4762,6 +5910,44 @@ interface(`dev_rw_xserver_misc',`
########################################
## <summary>
@ -8907,7 +8915,7 @@ index 76f285ea6..732931f47 100644
## Read and write to the zero device (/dev/zero).
## </summary>
## <param name="domain">
@@ -4794,7 +5979,7 @@ interface(`dev_rwx_zero',`
@@ -4794,7 +5980,7 @@ interface(`dev_rwx_zero',`
')
dev_rw_zero($1)
@ -8916,7 +8924,7 @@ index 76f285ea6..732931f47 100644
')
########################################
@@ -4851,3 +6036,1042 @@ interface(`dev_unconfined',`
@@ -4851,3 +6037,1042 @@ interface(`dev_unconfined',`
typeattribute $1 devices_unconfined_type;
')
@ -28908,7 +28916,7 @@ index 8274418c6..a47fd0b4d 100644
+/var/lib/pqsql/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
+
diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if
index 6bf0ecc2d..e6be63aa8 100644
index 6bf0ecc2d..29db5fd25 100644
--- a/policy/modules/services/xserver.if
+++ b/policy/modules/services/xserver.if
@@ -18,100 +18,36 @@
@ -29625,7 +29633,7 @@ index 6bf0ecc2d..e6be63aa8 100644
+ type xdm_var_lib_t;
+ ')
+
+ allow $1 xdm_var_lib_t:file read_inherited_file_perms;
+ allow $1 xdm_var_lib_t:file { read_inherited_file_perms map };
')
########################################
@ -40037,7 +40045,7 @@ index b50c5fe81..9eacd9ba1 100644
+/var/webmin(/.*)? gen_context(system_u:object_r:var_log_t,s0)
+
diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
index 4e9488463..7b395456f 100644
index 4e9488463..5f5045ae1 100644
--- a/policy/modules/system/logging.if
+++ b/policy/modules/system/logging.if
@@ -233,7 +233,7 @@ interface(`logging_run_auditd',`
@ -40361,7 +40369,13 @@ index 4e9488463..7b395456f 100644
')
########################################
@@ -885,6 +1107,63 @@ interface(`logging_read_generic_logs',`
@@ -880,11 +1102,69 @@ interface(`logging_read_generic_logs',`
files_search_var($1)
allow $1 var_log_t:dir list_dir_perms;
+ allow $1 var_log_t:file map;
read_files_pattern($1, var_log_t, var_log_t)
')
########################################
## <summary>
@ -40425,7 +40439,7 @@ index 4e9488463..7b395456f 100644
## Write generic log files.
## </summary>
## <param name="domain">
@@ -905,6 +1184,24 @@ interface(`logging_write_generic_logs',`
@@ -905,6 +1185,24 @@ interface(`logging_write_generic_logs',`
########################################
## <summary>
@ -40450,7 +40464,7 @@ index 4e9488463..7b395456f 100644
## Dontaudit Write generic log files.
## </summary>
## <param name="domain">
@@ -984,11 +1281,16 @@ interface(`logging_admin_audit',`
@@ -984,11 +1282,16 @@ interface(`logging_admin_audit',`
type auditd_t, auditd_etc_t, auditd_log_t;
type auditd_var_run_t;
type auditd_initrc_exec_t;
@ -40468,7 +40482,7 @@ index 4e9488463..7b395456f 100644
manage_dirs_pattern($1, auditd_etc_t, auditd_etc_t)
manage_files_pattern($1, auditd_etc_t, auditd_etc_t)
@@ -1004,6 +1306,55 @@ interface(`logging_admin_audit',`
@@ -1004,6 +1307,55 @@ interface(`logging_admin_audit',`
domain_system_change_exemption($1)
role_transition $2 auditd_initrc_exec_t system_r;
allow $2 system_r;
@ -40524,7 +40538,7 @@ index 4e9488463..7b395456f 100644
')
########################################
@@ -1032,10 +1383,15 @@ interface(`logging_admin_syslog',`
@@ -1032,10 +1384,15 @@ interface(`logging_admin_syslog',`
type syslogd_initrc_exec_t;
')
@ -40542,7 +40556,7 @@ index 4e9488463..7b395456f 100644
manage_dirs_pattern($1, klogd_var_run_t, klogd_var_run_t)
manage_files_pattern($1, klogd_var_run_t, klogd_var_run_t)
@@ -1057,6 +1413,8 @@ interface(`logging_admin_syslog',`
@@ -1057,6 +1414,8 @@ interface(`logging_admin_syslog',`
manage_files_pattern($1, syslogd_var_run_t, syslogd_var_run_t)
logging_manage_all_logs($1)
@ -40551,7 +40565,7 @@ index 4e9488463..7b395456f 100644
init_labeled_script_domtrans($1, syslogd_initrc_exec_t)
domain_system_change_exemption($1)
@@ -1085,3 +1443,110 @@ interface(`logging_admin',`
@@ -1085,3 +1444,110 @@ interface(`logging_admin',`
logging_admin_audit($1, $2)
logging_admin_syslog($1, $2)
')
@ -40663,7 +40677,7 @@ index 4e9488463..7b395456f 100644
+')
+
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 59b04c1a2..2ad89c533 100644
index 59b04c1a2..483fb780e 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -4,6 +4,29 @@ policy_module(logging, 1.20.1)
@ -40947,7 +40961,7 @@ index 59b04c1a2..2ad89c533 100644
rw_fifo_files_pattern(syslogd_t, var_log_t, var_log_t)
files_search_spool(syslogd_t)
@@ -389,30 +456,47 @@ manage_dirs_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
@@ -389,30 +456,48 @@ manage_dirs_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
manage_files_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t)
files_tmp_filetrans(syslogd_t, syslogd_tmp_t, { dir file })
@ -40964,6 +40978,7 @@ index 59b04c1a2..2ad89c533 100644
manage_files_pattern(syslogd_t, syslogd_var_run_t, syslogd_var_run_t)
-files_pid_filetrans(syslogd_t, syslogd_var_run_t, file)
+manage_sock_files_pattern(syslogd_t, syslogd_var_run_t, syslogd_var_run_t)
+mmap_files_pattern(syslogd_t, syslogd_var_run_t, syslogd_var_run_t)
+files_pid_filetrans(syslogd_t, syslogd_var_run_t, { file dir })
+kernel_rw_stream_socket_perms(syslogd_t)
@ -40998,7 +41013,7 @@ index 59b04c1a2..2ad89c533 100644
# syslog-ng can listen and connect on tcp port 514 (rsh)
corenet_tcp_sendrecv_generic_if(syslogd_t)
corenet_tcp_sendrecv_generic_node(syslogd_t)
@@ -422,6 +506,8 @@ corenet_tcp_bind_rsh_port(syslogd_t)
@@ -422,6 +507,8 @@ corenet_tcp_bind_rsh_port(syslogd_t)
corenet_tcp_connect_rsh_port(syslogd_t)
# Allow users to define additional syslog ports to connect to
corenet_tcp_bind_syslogd_port(syslogd_t)
@ -41007,7 +41022,7 @@ index 59b04c1a2..2ad89c533 100644
corenet_tcp_connect_syslogd_port(syslogd_t)
corenet_tcp_connect_postgresql_port(syslogd_t)
corenet_tcp_connect_mysqld_port(syslogd_t)
@@ -432,9 +518,32 @@ corenet_sendrecv_syslogd_server_packets(syslogd_t)
@@ -432,9 +519,32 @@ corenet_sendrecv_syslogd_server_packets(syslogd_t)
corenet_sendrecv_postgresql_client_packets(syslogd_t)
corenet_sendrecv_mysqld_client_packets(syslogd_t)
@ -41041,7 +41056,7 @@ index 59b04c1a2..2ad89c533 100644
domain_use_interactive_fds(syslogd_t)
files_read_etc_files(syslogd_t)
@@ -448,13 +557,17 @@ files_var_lib_filetrans(syslogd_t, syslogd_var_lib_t, { file dir })
@@ -448,13 +558,17 @@ files_var_lib_filetrans(syslogd_t, syslogd_var_lib_t, { file dir })
fs_getattr_all_fs(syslogd_t)
fs_search_auto_mountpoints(syslogd_t)
@ -41059,7 +41074,7 @@ index 59b04c1a2..2ad89c533 100644
# for sending messages to logged in users
init_read_utmp(syslogd_t)
init_dontaudit_write_utmp(syslogd_t)
@@ -466,11 +579,12 @@ init_use_fds(syslogd_t)
@@ -466,11 +580,12 @@ init_use_fds(syslogd_t)
# cjp: this doesnt make sense
logging_send_syslog_msg(syslogd_t)
@ -41075,7 +41090,7 @@ index 59b04c1a2..2ad89c533 100644
ifdef(`distro_gentoo',`
# default gentoo syslog-ng config appends kernel
@@ -497,6 +611,7 @@ optional_policy(`
@@ -497,6 +612,7 @@ optional_policy(`
optional_policy(`
cron_manage_log_files(syslogd_t)
cron_generic_log_filetrans_log(syslogd_t, file, "cron.log")
@ -41083,7 +41098,7 @@ index 59b04c1a2..2ad89c533 100644
')
optional_policy(`
@@ -507,15 +622,44 @@ optional_policy(`
@@ -507,15 +623,44 @@ optional_policy(`
')
optional_policy(`
@ -41128,7 +41143,7 @@ index 59b04c1a2..2ad89c533 100644
')
optional_policy(`
@@ -526,3 +670,29 @@ optional_policy(`
@@ -526,3 +671,29 @@ optional_policy(`
# log to the xconsole
xserver_rw_console(syslogd_t)
')
@ -46632,10 +46647,10 @@ index 000000000..121b42208
+/var/run/initramfs(/.*)? <<none>>
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
new file mode 100644
index 000000000..d1356af89
index 000000000..278a1f69b
--- /dev/null
+++ b/policy/modules/system/systemd.if
@@ -0,0 +1,1842 @@
@@ -0,0 +1,1843 @@
+## <summary>SELinux policy for systemd components</summary>
+
+######################################
@ -48435,6 +48450,7 @@ index 000000000..d1356af89
+
+ files_search_etc($1)
+ manage_files_pattern($1, systemd_hwdb_etc_t, systemd_hwdb_etc_t)
+ mmap_files_pattern($1, systemd_hwdb_etc_t, systemd_hwdb_etc_t)
+ allow $1 systemd_hwdb_etc_t:file {relabelfrom relabelto};
+ files_etc_filetrans($1, systemd_hwdb_etc_t, file)
+')

211
policy-rawhide-contrib.patch
View File

@ -589,7 +589,7 @@ index 058d908e4..ee0c55969 100644
+')
+
diff --git a/abrt.te b/abrt.te
index eb50f070f..4e5a59207 100644
index eb50f070f..53dd1ab4d 100644
--- a/abrt.te
+++ b/abrt.te
@@ -6,11 +6,10 @@ policy_module(abrt, 1.4.1)
@ -738,7 +738,7 @@ index eb50f070f..4e5a59207 100644
manage_files_pattern(abrt_t, abrt_var_log_t, abrt_var_log_t)
logging_log_filetrans(abrt_t, abrt_var_log_t, file)
@@ -125,48 +136,59 @@ manage_dirs_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t)
@@ -125,48 +136,60 @@ manage_dirs_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t)
manage_files_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t)
manage_lnk_files_pattern(abrt_t, abrt_tmp_t, abrt_tmp_t)
files_tmp_filetrans(abrt_t, abrt_tmp_t, { file dir })
@ -748,6 +748,7 @@ index eb50f070f..4e5a59207 100644
manage_files_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
manage_dirs_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
manage_lnk_files_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
+mmap_files_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t)
files_var_filetrans(abrt_t, abrt_var_cache_t, { file dir })
files_spool_filetrans(abrt_t, abrt_var_cache_t, dir)
+files_tmp_filetrans(abrt_t, abrt_var_cache_t, dir, "abrt")
@ -805,7 +806,7 @@ index eb50f070f..4e5a59207 100644
domain_getattr_all_domains(abrt_t)
domain_read_all_domains_state(abrt_t)
@@ -176,29 +198,44 @@ files_getattr_all_files(abrt_t)
@@ -176,29 +199,44 @@ files_getattr_all_files(abrt_t)
files_read_config_files(abrt_t)
files_read_etc_runtime_files(abrt_t)
files_read_var_symlinks(abrt_t)
@ -853,7 +854,7 @@ index eb50f070f..4e5a59207 100644
tunable_policy(`abrt_anon_write',`
miscfiles_manage_public_files(abrt_t)
@@ -206,15 +243,11 @@ tunable_policy(`abrt_anon_write',`
@@ -206,15 +244,11 @@ tunable_policy(`abrt_anon_write',`
optional_policy(`
apache_list_modules(abrt_t)
@ -870,7 +871,7 @@ index eb50f070f..4e5a59207 100644
')
optional_policy(`
@@ -222,6 +255,37 @@ optional_policy(`
@@ -222,6 +256,37 @@ optional_policy(`
')
optional_policy(`
@ -908,7 +909,7 @@ index eb50f070f..4e5a59207 100644
policykit_domtrans_auth(abrt_t)
policykit_read_lib(abrt_t)
policykit_read_reload(abrt_t)
@@ -234,18 +298,25 @@ optional_policy(`
@@ -234,18 +299,25 @@ optional_policy(`
')
optional_policy(`
@ -937,7 +938,7 @@ index eb50f070f..4e5a59207 100644
optional_policy(`
sosreport_domtrans(abrt_t)
@@ -253,9 +324,21 @@ optional_policy(`
@@ -253,9 +325,21 @@ optional_policy(`
sosreport_delete_tmp_files(abrt_t)
')
@ -960,7 +961,7 @@ index eb50f070f..4e5a59207 100644
#
allow abrt_handle_event_t self:fifo_file rw_fifo_file_perms;
@@ -266,9 +349,13 @@ tunable_policy(`abrt_handle_event',`
@@ -266,9 +350,13 @@ tunable_policy(`abrt_handle_event',`
can_exec(abrt_t, abrt_handle_event_exec_t)
')
@ -975,7 +976,7 @@ index eb50f070f..4e5a59207 100644
#
allow abrt_helper_t self:capability { chown setgid sys_nice };
@@ -281,6 +368,7 @@ manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
@@ -281,6 +369,7 @@ manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
manage_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
manage_lnk_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t)
files_var_filetrans(abrt_helper_t, abrt_var_cache_t, { file dir })
@ -983,7 +984,7 @@ index eb50f070f..4e5a59207 100644
read_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t)
read_lnk_files_pattern(abrt_helper_t, abrt_var_run_t, abrt_var_run_t)
@@ -289,15 +377,20 @@ corecmd_read_all_executables(abrt_helper_t)
@@ -289,15 +378,20 @@ corecmd_read_all_executables(abrt_helper_t)
domain_read_all_domains_state(abrt_helper_t)
@ -1004,7 +1005,7 @@ index eb50f070f..4e5a59207 100644
userdom_dontaudit_read_user_home_content_files(abrt_helper_t)
userdom_dontaudit_read_user_tmp_files(abrt_helper_t)
dev_dontaudit_read_all_blk_files(abrt_helper_t)
@@ -305,11 +398,25 @@ ifdef(`hide_broken_symptoms',`
@@ -305,11 +399,25 @@ ifdef(`hide_broken_symptoms',`
dev_dontaudit_write_all_chr_files(abrt_helper_t)
dev_dontaudit_write_all_blk_files(abrt_helper_t)
fs_dontaudit_rw_anon_inodefs_files(abrt_helper_t)
@ -1031,7 +1032,7 @@ index eb50f070f..4e5a59207 100644
#
allow abrt_retrace_coredump_t self:fifo_file rw_fifo_file_perms;
@@ -327,10 +434,12 @@ corecmd_exec_shell(abrt_retrace_coredump_t)
@@ -327,10 +435,12 @@ corecmd_exec_shell(abrt_retrace_coredump_t)
dev_read_urand(abrt_retrace_coredump_t)
@ -1045,7 +1046,7 @@ index eb50f070f..4e5a59207 100644
optional_policy(`
rpm_exec(abrt_retrace_coredump_t)
rpm_dontaudit_manage_db(abrt_retrace_coredump_t)
@@ -343,10 +452,11 @@ optional_policy(`
@@ -343,10 +453,11 @@ optional_policy(`
#######################################
#
@ -1059,7 +1060,7 @@ index eb50f070f..4e5a59207 100644
allow abrt_retrace_worker_t self:fifo_file rw_fifo_file_perms;
domtrans_pattern(abrt_retrace_worker_t, abrt_retrace_coredump_exec_t, abrt_retrace_coredump_t)
@@ -365,38 +475,84 @@ corecmd_exec_shell(abrt_retrace_worker_t)
@@ -365,38 +476,86 @@ corecmd_exec_shell(abrt_retrace_worker_t)
dev_read_urand(abrt_retrace_worker_t)
@ -1135,6 +1136,8 @@ index eb50f070f..4e5a59207 100644
logging_read_generic_logs(abrt_dump_oops_t)
+logging_read_syslog_pid(abrt_dump_oops_t)
+logging_send_syslog_msg(abrt_dump_oops_t)
+logging_mmap_generic_logs(abrt_dump_oops_t)
+logging_mmap_journal(abrt_dump_oops_t)
+
+init_read_var_lib_files(abrt_dump_oops_t)
+
@ -1148,7 +1151,7 @@ index eb50f070f..4e5a59207 100644
#######################################
#
@@ -404,25 +560,60 @@ logging_read_generic_logs(abrt_dump_oops_t)
@@ -404,25 +563,60 @@ logging_read_generic_logs(abrt_dump_oops_t)
#
allow abrt_watch_log_t self:fifo_file rw_fifo_file_perms;
@ -1211,7 +1214,7 @@ index eb50f070f..4e5a59207 100644
')
#######################################
@@ -430,10 +621,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
@@ -430,10 +624,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
# Global local policy
#
@ -10663,7 +10666,7 @@ index c723a0ae0..1c29d21e7 100644
+ allow $1 bluetooth_unit_file_t:service all_service_perms;
')
diff --git a/bluetooth.te b/bluetooth.te
index 851769e55..4b11e9620 100644
index 851769e55..4bb326132 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -49,12 +49,15 @@ files_type(bluetooth_var_lib_t)
@ -10683,7 +10686,7 @@ index 851769e55..4b11e9620 100644
dontaudit bluetooth_t self:capability sys_tty_config;
allow bluetooth_t self:process { getcap setcap getsched signal_perms };
allow bluetooth_t self:fifo_file rw_fifo_file_perms;
@@ -78,7 +81,8 @@ files_lock_filetrans(bluetooth_t, bluetooth_lock_t, file)
@@ -78,10 +81,12 @@ files_lock_filetrans(bluetooth_t, bluetooth_lock_t, file)
manage_dirs_pattern(bluetooth_t, bluetooth_tmp_t, bluetooth_tmp_t)
manage_files_pattern(bluetooth_t, bluetooth_tmp_t, bluetooth_tmp_t)
@ -10693,7 +10696,11 @@ index 851769e55..4b11e9620 100644
manage_dirs_pattern(bluetooth_t, bluetooth_var_lib_t, bluetooth_var_lib_t)
manage_files_pattern(bluetooth_t, bluetooth_var_lib_t, bluetooth_var_lib_t)
@@ -90,27 +94,37 @@ files_pid_filetrans(bluetooth_t, bluetooth_var_run_t, { file sock_file })
+mmap_files_pattern(bluetooth_t, bluetooth_var_lib_t, bluetooth_var_lib_t)
files_var_lib_filetrans(bluetooth_t, bluetooth_var_lib_t, { dir file } )
manage_files_pattern(bluetooth_t, bluetooth_var_run_t, bluetooth_var_run_t)
@@ -90,27 +95,37 @@ files_pid_filetrans(bluetooth_t, bluetooth_var_run_t, { file sock_file })
can_exec(bluetooth_t, bluetooth_helper_exec_t)
@ -10736,7 +10743,7 @@ index 851769e55..4b11e9620 100644
fs_getattr_all_fs(bluetooth_t)
fs_search_auto_mountpoints(bluetooth_t)
@@ -122,7 +136,6 @@ auth_use_nsswitch(bluetooth_t)
@@ -122,7 +137,6 @@ auth_use_nsswitch(bluetooth_t)
logging_send_syslog_msg(bluetooth_t)
@ -10744,7 +10751,7 @@ index 851769e55..4b11e9620 100644
miscfiles_read_fonts(bluetooth_t)
miscfiles_read_hwdata(bluetooth_t)
@@ -130,6 +143,10 @@ userdom_dontaudit_use_unpriv_user_fds(bluetooth_t)
@@ -130,6 +144,10 @@ userdom_dontaudit_use_unpriv_user_fds(bluetooth_t)
userdom_dontaudit_use_user_terminals(bluetooth_t)
userdom_dontaudit_search_user_home_dirs(bluetooth_t)
@ -10755,7 +10762,7 @@ index 851769e55..4b11e9620 100644
optional_policy(`
dbus_system_bus_client(bluetooth_t)
dbus_connect_system_bus(bluetooth_t)
@@ -200,7 +217,6 @@ dev_read_urand(bluetooth_helper_t)
@@ -200,7 +218,6 @@ dev_read_urand(bluetooth_helper_t)
domain_read_all_domains_state(bluetooth_helper_t)
files_read_etc_runtime_files(bluetooth_helper_t)
@ -33889,7 +33896,7 @@ index e39de436a..5edcb8330 100644
+/usr/libexec/gnome-system-monitor-mechanism -- gen_context(system_u:object_r:gnomesystemmm_exec_t,s0)
+/usr/libexec/kde(3|4)/ksysguardprocesslist_helper -- gen_context(system_u:object_r:gnomesystemmm_exec_t,s0)
diff --git a/gnome.if b/gnome.if
index ab09d6195..72d67c2cb 100644
index ab09d6195..0007f00b3 100644
--- a/gnome.if
+++ b/gnome.if
@@ -1,52 +1,76 @@
@ -34307,7 +34314,7 @@ index ab09d6195..72d67c2cb 100644
+ ')
+
+ allow $1 gnome_home_type:dir manage_dir_perms;
+ allow $1 gnome_home_type:file manage_file_perms;
+ allow $1 gnome_home_type:file { manage_file_perms map };
+ allow $1 gnome_home_type:lnk_file manage_lnk_file_perms;
+ allow $1 gnome_home_type:sock_file manage_sock_file_perms;
+ userdom_search_user_home_dirs($1)
@ -34543,7 +34550,7 @@ index ab09d6195..72d67c2cb 100644
## </summary>
## <param name="domain">
## <summary>
@@ -433,17 +519,18 @@ interface(`gnome_home_filetrans',`
@@ -433,17 +519,19 @@ interface(`gnome_home_filetrans',`
## </summary>
## </param>
#
@ -34557,6 +34564,7 @@ index ab09d6195..72d67c2cb 100644
- allow $1 gconf_home_t:dir create_dir_perms;
+ append_files_pattern($1, cache_home_t, cache_home_t)
+ userdom_search_user_home_dirs($1)
+ allow $1 gnome_home_t:file { read_file_perms map };
')
########################################
@ -34566,7 +34574,7 @@ index ab09d6195..72d67c2cb 100644
## </summary>
## <param name="domain">
## <summary>
@@ -451,23 +538,18 @@ interface(`gnome_create_generic_gconf_home_dirs',`
@@ -451,23 +539,18 @@ interface(`gnome_create_generic_gconf_home_dirs',`
## </summary>
## </param>
#
@ -34594,7 +34602,7 @@ index ab09d6195..72d67c2cb 100644
## </summary>
## <param name="domain">
## <summary>
@@ -475,22 +557,18 @@ interface(`gnome_read_generic_gconf_home_content',`
@@ -475,22 +558,18 @@ interface(`gnome_read_generic_gconf_home_content',`
## </summary>
## </param>
#
@ -34621,7 +34629,7 @@ index ab09d6195..72d67c2cb 100644
## </summary>
## <param name="domain">
## <summary>
@@ -498,79 +576,59 @@ interface(`gnome_manage_generic_gconf_home_content',`
@@ -498,79 +577,59 @@ interface(`gnome_manage_generic_gconf_home_content',`
## </summary>
## </param>
#
@ -34719,7 +34727,7 @@ index ab09d6195..72d67c2cb 100644
## </summary>
## <param name="domain">
## <summary>
@@ -579,12 +637,12 @@ interface(`gnome_home_filetrans_gnome_home',`
@@ -579,12 +638,12 @@ interface(`gnome_home_filetrans_gnome_home',`
## </param>
## <param name="private_type">
## <summary>
@ -34734,7 +34742,7 @@ index ab09d6195..72d67c2cb 100644
## </summary>
## </param>
## <param name="name" optional="true">
@@ -593,18 +651,18 @@ interface(`gnome_home_filetrans_gnome_home',`
@@ -593,18 +652,18 @@ interface(`gnome_home_filetrans_gnome_home',`
## </summary>
## </param>
#
@ -34759,7 +34767,7 @@ index ab09d6195..72d67c2cb 100644
## </summary>
## <param name="domain">
## <summary>
@@ -612,46 +670,80 @@ interface(`gnome_gconf_home_filetrans',`
@@ -612,46 +671,81 @@ interface(`gnome_gconf_home_filetrans',`
## </summary>
## </param>
#
@ -34844,6 +34852,7 @@ index ab09d6195..72d67c2cb 100644
- allow $1_gkeyringd_t $2:dbus send_msg;
+ userdom_search_user_home_dirs($1)
+ allow $1 { gconf_home_t data_home_t }:dir search_dir_perms;
+ allow $1 icc_data_home_t:file map;
+ list_dirs_pattern($1, icc_data_home_t, icc_data_home_t)
+ read_files_pattern($1, icc_data_home_t, icc_data_home_t)
+ read_lnk_files_pattern($1, icc_data_home_t, icc_data_home_t)
@ -34857,7 +34866,7 @@ index ab09d6195..72d67c2cb 100644
## </summary>
## <param name="domain">
## <summary>
@@ -659,46 +751,64 @@ interface(`gnome_dbus_chat_gkeyringd',`
@@ -659,46 +753,64 @@ interface(`gnome_dbus_chat_gkeyringd',`
## </summary>
## </param>
#
@ -34939,7 +34948,7 @@ index ab09d6195..72d67c2cb 100644
## </summary>
## <param name="domain">
## <summary>
@@ -706,12 +816,1003 @@ interface(`gnome_stream_connect_gkeyringd',`
@@ -706,12 +818,1003 @@ interface(`gnome_stream_connect_gkeyringd',`
## </summary>
## </param>
#
@ -60092,7 +60101,7 @@ index 94b973407..448a7e836 100644
+/var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
/var/run/wpa_supplicant-global -s gen_context(system_u:object_r:NetworkManager_var_run_t,s0)
diff --git a/networkmanager.if b/networkmanager.if
index 86dc29dfa..c7d9376d5 100644
index 86dc29dfa..cb39739a5 100644
--- a/networkmanager.if
+++ b/networkmanager.if
@@ -2,7 +2,7 @@
@ -60262,10 +60271,21 @@ index 86dc29dfa..c7d9376d5 100644
## </summary>
## <param name="domain">
## <summary>
@@ -211,9 +259,30 @@ interface(`networkmanager_read_lib_files',`
read_files_pattern($1, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
@@ -189,6 +237,7 @@ interface(`networkmanager_manage_lib_files',`
files_search_var_lib($1)
manage_files_pattern($1, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
+ allow $1 NetworkManager_var_lib_t:file map;
')
########################################
@@ -209,11 +258,33 @@ interface(`networkmanager_read_lib_files',`
files_search_var_lib($1)
list_dirs_pattern($1, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
read_files_pattern($1, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
+ allow $1 NetworkManager_var_lib_t:file map;
+')
+
+#######################################
+## <summary>
+## Read NetworkManager conf files.
@ -60285,8 +60305,8 @@ index 86dc29dfa..c7d9376d5 100644
+ allow $1 NetworkManager_etc_t:dir list_dir_perms;
+ read_files_pattern($1,NetworkManager_etc_t,NetworkManager_etc_t)
+ read_files_pattern($1,NetworkManager_etc_rw_t,NetworkManager_etc_rw_t)
+')
+
')
########################################
## <summary>
-## Append networkmanager log files.
@ -60294,7 +60314,7 @@ index 86dc29dfa..c7d9376d5 100644
## </summary>
## <param name="domain">
## <summary>
@@ -221,19 +290,18 @@ interface(`networkmanager_read_lib_files',`
@@ -221,19 +292,18 @@ interface(`networkmanager_read_lib_files',`
## </summary>
## </param>
#
@ -60319,18 +60339,17 @@ index 86dc29dfa..c7d9376d5 100644
## </summary>
## <param name="domain">
## <summary>
@@ -241,13 +309,66 @@ interface(`networkmanager_append_log_files',`
@@ -241,13 +311,66 @@ interface(`networkmanager_append_log_files',`
## </summary>
## </param>
#
-interface(`networkmanager_read_pid_files',`
+interface(`networkmanager_manage_pid_files',`
gen_require(`
type NetworkManager_var_run_t;
')
files_search_pids($1)
- allow $1 NetworkManager_var_run_t:file read_file_perms;
+ gen_require(`
+ type NetworkManager_var_run_t;
+ ')
+
+ files_search_pids($1)
+ manage_files_pattern($1, NetworkManager_var_run_t, NetworkManager_var_run_t)
+')
+
@ -60345,11 +60364,12 @@ index 86dc29dfa..c7d9376d5 100644
+## </param>
+#
+interface(`networkmanager_manage_pid_sock_files',`
+ gen_require(`
+ type NetworkManager_var_run_t;
+ ')
+
+ files_search_pids($1)
gen_require(`
type NetworkManager_var_run_t;
')
files_search_pids($1)
- allow $1 NetworkManager_var_run_t:file read_file_perms;
+ manage_sock_files_pattern($1, NetworkManager_var_run_t, NetworkManager_var_run_t)
+')
+
@ -60388,7 +60408,7 @@ index 86dc29dfa..c7d9376d5 100644
')
####################################
@@ -272,14 +393,33 @@ interface(`networkmanager_stream_connect',`
@@ -272,14 +395,33 @@ interface(`networkmanager_stream_connect',`
########################################
## <summary>
@ -60424,7 +60444,7 @@ index 86dc29dfa..c7d9376d5 100644
## <param name="role">
## <summary>
## Role allowed access.
@@ -287,33 +427,190 @@ interface(`networkmanager_stream_connect',`
@@ -287,33 +429,194 @@ interface(`networkmanager_stream_connect',`
## </param>
## <rolecap/>
#
@ -60470,10 +60490,12 @@ index 86dc29dfa..c7d9376d5 100644
- admin_pattern($1, NetworkManager_log_t)
+ allow $1 NetworkManager_log_t:dir list_dir_perms;
+ append_files_pattern($1, NetworkManager_log_t, NetworkManager_log_t)
+')
+ allow $1 NetworkManager_var_lib_t:file map;
- files_search_var_lib($1)
- admin_pattern($1, NetworkManager_var_lib_t)
+')
+
+#######################################
+## <summary>
+## Allow the specified domain to manage
@ -60491,6 +60513,8 @@ index 86dc29dfa..c7d9376d5 100644
+ ')
+
+ manage_files_pattern($1, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
+ allow $1 NetworkManager_var_lib_t:file map;
+
+')
+
+#######################################
@ -93498,7 +93522,7 @@ index ebe91fc70..6ba4338cb 100644
+/sbin/cpio -- gen_context(system_u:object_r:rpm_exec_t,s0)
')
diff --git a/rpm.if b/rpm.if
index ef3b22507..b15d901a4 100644
index ef3b22507..d2b4c1697 100644
--- a/rpm.if
+++ b/rpm.if
@@ -1,8 +1,8 @@
@ -93903,10 +93927,11 @@ index ef3b22507..b15d901a4 100644
## </summary>
## <param name="domain">
## <summary>
@@ -459,11 +585,12 @@ interface(`rpm_read_db',`
@@ -459,11 +585,13 @@ interface(`rpm_read_db',`
allow $1 rpm_var_lib_t:dir list_dir_perms;
read_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
read_lnk_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
+ allow $1 rpm_var_lib_t:file map;
+ rpm_read_cache($1)
')
@ -93917,7 +93942,7 @@ index ef3b22507..b15d901a4 100644
## </summary>
## <param name="domain">
## <summary>
@@ -482,8 +609,7 @@ interface(`rpm_delete_db',`
@@ -482,8 +610,7 @@ interface(`rpm_delete_db',`
########################################
## <summary>
@ -93927,10 +93952,15 @@ index ef3b22507..b15d901a4 100644
## </summary>
## <param name="domain">
## <summary>
@@ -503,8 +629,28 @@ interface(`rpm_manage_db',`
########################################
## <summary>
@@ -499,12 +626,33 @@ interface(`rpm_manage_db',`
files_search_var_lib($1)
manage_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
manage_lnk_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
+ allow $1 rpm_var_lib_t:file map;
+')
+
+########################################
+## <summary>
+## Do not audit attempts to create, read,the RPM package database.
+## </summary>
+## <param name="domain">
@ -93947,17 +93977,17 @@ index ef3b22507..b15d901a4 100644
+ dontaudit $1 rpm_var_lib_t:dir list_dir_perms;
+ dontaudit $1 rpm_var_lib_t:file read_file_perms;
+ dontaudit $1 rpm_var_lib_t:lnk_file read_lnk_file_perms;
+')
+
+########################################
+## <summary>
')
########################################
## <summary>
## Do not audit attempts to create, read,
-## write, and delete rpm lib content.
+## write, and delete the RPM package database.
## </summary>
## <param name="domain">
## <summary>
@@ -517,7 +663,7 @@ interface(`rpm_dontaudit_manage_db',`
@@ -517,9 +665,10 @@ interface(`rpm_dontaudit_manage_db',`
type rpm_var_lib_t;
')
@ -93965,8 +93995,11 @@ index ef3b22507..b15d901a4 100644
+ dontaudit $1 rpm_var_lib_t:dir manage_dir_perms;
dontaudit $1 rpm_var_lib_t:file manage_file_perms;
dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms;
+ dontaudit $1 rpm_var_lib_t:file map;
')
@@ -543,8 +689,7 @@ interface(`rpm_read_pid_files',`
#####################################
@@ -543,8 +692,7 @@ interface(`rpm_read_pid_files',`
#####################################
## <summary>
@ -93976,7 +94009,7 @@ index ef3b22507..b15d901a4 100644
## </summary>
## <param name="domain">
## <summary>
@@ -563,8 +708,7 @@ interface(`rpm_manage_pid_files',`
@@ -563,8 +711,7 @@ interface(`rpm_manage_pid_files',`
######################################
## <summary>
@ -93986,7 +94019,7 @@ index ef3b22507..b15d901a4 100644
## </summary>
## <param name="domain">
## <summary>
@@ -573,43 +717,54 @@ interface(`rpm_manage_pid_files',`
@@ -573,43 +720,54 @@ interface(`rpm_manage_pid_files',`
## </param>
#
interface(`rpm_pid_filetrans',`
@ -94058,7 +94091,7 @@ index ef3b22507..b15d901a4 100644
## </summary>
## <param name="domain">
## <summary>
@@ -617,22 +772,57 @@ interface(`rpm_pid_filetrans_rpm_pid',`
@@ -617,22 +775,57 @@ interface(`rpm_pid_filetrans_rpm_pid',`
## </summary>
## </param>
## <param name="role">
@ -94127,7 +94160,7 @@ index ef3b22507..b15d901a4 100644
init_labeled_script_domtrans($1, rpm_initrc_exec_t)
domain_system_change_exemption($1)
@@ -641,9 +831,6 @@ interface(`rpm_admin',`
@@ -641,9 +834,6 @@ interface(`rpm_admin',`
admin_pattern($1, rpm_file_t)
@ -106555,7 +106588,7 @@ index dbb005aca..2655c75ab 100644
+/var/run/secrets\.socket -s gen_context(system_u:object_r:sssd_var_run_t,s0)
+/var/run/\.heim_org\.h5l\.kcm-socket -s gen_context(system_u:object_r:sssd_var_run_t,s0)
diff --git a/sssd.if b/sssd.if
index a24045518..aac25848d 100644
index a24045518..8e00992e4 100644
--- a/sssd.if
+++ b/sssd.if
@@ -1,21 +1,21 @@
@ -106736,13 +106769,14 @@ index a24045518..aac25848d 100644
')
########################################
@@ -131,14 +171,13 @@ interface(`sssd_read_public_files',`
@@ -131,14 +171,14 @@ interface(`sssd_read_public_files',`
')
sssd_search_lib($1)
- allow $1 sssd_public_t:dir list_dir_perms;
+ list_dirs_pattern($1, sssd_public_t, sssd_public_t)
read_files_pattern($1, sssd_public_t, sssd_public_t)
+ mmap_files_pattern($1, sssd_public_t, sssd_public_t)
')
-#######################################
@ -106754,7 +106788,7 @@ index a24045518..aac25848d 100644
## </summary>
## <param name="domain">
## <summary>
@@ -146,18 +185,55 @@ interface(`sssd_read_public_files',`
@@ -146,18 +186,55 @@ interface(`sssd_read_public_files',`
## </summary>
## </param>
#
@ -106813,7 +106847,7 @@ index a24045518..aac25848d 100644
## </summary>
## <param name="domain">
## <summary>
@@ -176,8 +252,7 @@ interface(`sssd_read_pid_files',`
@@ -176,8 +253,7 @@ interface(`sssd_read_pid_files',`
########################################
## <summary>
@ -106823,7 +106857,7 @@ index a24045518..aac25848d 100644
## </summary>
## <param name="domain">
## <summary>
@@ -216,8 +291,7 @@ interface(`sssd_search_lib',`
@@ -216,8 +292,7 @@ interface(`sssd_search_lib',`
########################################
## <summary>
@ -106833,7 +106867,7 @@ index a24045518..aac25848d 100644
## </summary>
## <param name="domain">
## <summary>
@@ -235,6 +309,24 @@ interface(`sssd_dontaudit_search_lib',`
@@ -235,6 +310,24 @@ interface(`sssd_dontaudit_search_lib',`
########################################
## <summary>
@ -106858,7 +106892,7 @@ index a24045518..aac25848d 100644
## Read sssd lib files.
## </summary>
## <param name="domain">
@@ -297,8 +389,7 @@ interface(`sssd_dbus_chat',`
@@ -297,8 +390,7 @@ interface(`sssd_dbus_chat',`
########################################
## <summary>
@ -106868,7 +106902,7 @@ index a24045518..aac25848d 100644
## </summary>
## <param name="domain">
## <summary>
@@ -317,8 +408,130 @@ interface(`sssd_stream_connect',`
@@ -317,8 +409,130 @@ interface(`sssd_stream_connect',`
########################################
## <summary>
@ -107001,7 +107035,7 @@ index a24045518..aac25848d 100644
## </summary>
## <param name="domain">
## <summary>
@@ -327,7 +540,7 @@ interface(`sssd_stream_connect',`
@@ -327,7 +541,7 @@ interface(`sssd_stream_connect',`
## </param>
## <param name="role">
## <summary>
@ -107010,7 +107044,7 @@ index a24045518..aac25848d 100644
## </summary>
## </param>
## <rolecap/>
@@ -335,27 +548,29 @@ interface(`sssd_stream_connect',`
@@ -335,27 +549,29 @@ interface(`sssd_stream_connect',`
interface(`sssd_admin',`
gen_require(`
type sssd_t, sssd_public_t, sssd_initrc_exec_t;
@ -107052,10 +107086,10 @@ index a24045518..aac25848d 100644
- admin_pattern($1, sssd_log_t)
')
diff --git a/sssd.te b/sssd.te
index 2d8db1fa3..9b13b3058 100644
index 2d8db1fa3..b4eaeb4cc 100644
--- a/sssd.te
+++ b/sssd.te
@@ -28,19 +28,31 @@ logging_log_file(sssd_var_log_t)
@@ -28,51 +28,65 @@ logging_log_file(sssd_var_log_t)
type sssd_var_run_t;
files_pid_file(sssd_var_run_t)
@ -107091,8 +107125,13 @@ index 2d8db1fa3..9b13b3058 100644
manage_dirs_pattern(sssd_t, sssd_public_t, sssd_public_t)
manage_files_pattern(sssd_t, sssd_public_t, sssd_public_t)
@@ -51,28 +63,28 @@ manage_lnk_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
+mmap_files_pattern(sssd_t, sssd_public_t, sssd_public_t)
manage_dirs_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
manage_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
manage_lnk_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
manage_sock_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
+mmap_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t)
files_var_lib_filetrans(sssd_t, sssd_var_lib_t, { file dir })
-append_files_pattern(sssd_t, sssd_var_log_t, sssd_var_log_t)
@ -107132,7 +107171,7 @@ index 2d8db1fa3..9b13b3058 100644
corecmd_exec_bin(sssd_t)
@@ -83,28 +95,36 @@ domain_read_all_domains_state(sssd_t)
@@ -83,28 +97,36 @@ domain_read_all_domains_state(sssd_t)
domain_obj_id_change_exemption(sssd_t)
files_list_tmp(sssd_t)
@ -107173,7 +107212,7 @@ index 2d8db1fa3..9b13b3058 100644
init_read_utmp(sssd_t)
@@ -112,18 +132,71 @@ logging_send_syslog_msg(sssd_t)
@@ -112,18 +134,71 @@ logging_send_syslog_msg(sssd_t)
logging_send_audit_msgs(sssd_t)
miscfiles_read_generic_certs(sssd_t)

9
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
Release: 271%{?dist}
Release: 272%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@ -681,6 +681,13 @@ exit 0
%endif
%changelog
* Tue Aug 15 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-272
- Allow sssd_t domain to map sssd_var_lib_t files
- allow map permission where needed
- contrib: allow map permission where needed
- Allow syslogd_t to map syslogd_var_run_t files
- allow map permission where needed
* Mon Aug 14 2017 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-271
- Allow tomcat_t domain couple capabilities to make working tomcat-jsvc
- Label /usr/libexec/sudo/sesh as shell_exec_t