rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

fixes from sediff

This commit is contained in:
Chris PeBenito 2005-10-24 00:54:39 +00:00
parent f8964c04ba
commit 2db2c7d099
13 changed files with 43 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
refpolicy/policy/modules/admin/amanda.te
View File

@ -128,7 +128,7 @@ corenet_tcp_sendrecv_all_ports(amanda_t)
corenet_udp_sendrecv_all_ports(amanda_t)
dev_getattr_all_blk_files(amanda_t)
dev_getattr_all_blk_files(amanda_t)
dev_getattr_all_chr_files(amanda_t)
fs_getattr_xattr_fs(amanda_t)
fs_list_all(amanda_t)

2
refpolicy/policy/modules/kernel/corenetwork.if.in
View File

@ -1043,6 +1043,6 @@ interface(`corenet_unconfined',`
# Bind to any network address.
# cjp: rawip_socket doesnt make any sense
allow $1 port_type:{ tcp_socket udp_socket } name_bind;
allow $1 port_type:{ tcp_socket udp_socket rawip_socket } name_bind;
allow $1 node_type:{ tcp_socket udp_socket rawip_socket } node_bind;
')

2
refpolicy/policy/modules/kernel/devices.if
View File

@ -544,7 +544,7 @@ interface(`dev_dontaudit_getattr_all_blk_files',`
attribute device_node;
')
allow $1 device_node:blk_file getattr;
dontaudit $1 device_node:blk_file getattr;
')
########################################

6
refpolicy/policy/modules/kernel/kernel.te
View File

@ -217,11 +217,9 @@ files_read_usr_files(kernel_t)
mls_process_read_up(kernel_t)
mls_process_write_down(kernel_t)
ifdef(`TODO',`
ifdef(`targeted_policy', `
unconfined_domain(kernel_t)
ifdef(`targeted_policy',`
unconfined_domain_template(kernel_t)
')
') dnl end TODO
########################################
#

2
refpolicy/policy/modules/services/comsat.te
View File

@ -48,7 +48,9 @@ corenet_tcp_sendrecv_all_nodes(comsat_t)
corenet_udp_sendrecv_all_nodes(comsat_t)
corenet_raw_sendrecv_all_nodes(comsat_t)
corenet_tcp_sendrecv_all_ports(comsat_t)
corenet_udp_sendrecv_all_ports(comsat_t)
corenet_tcp_bind_all_nodes(comsat_t)
corenet_udp_bind_all_nodes(comsat_t)
dev_read_urand(comsat_t)

6
refpolicy/policy/modules/services/cron.te
View File

@ -35,7 +35,11 @@ files_type(crontab_exec_t)
type system_cron_spool_t, cron_spool_type;
files_type(system_cron_spool_t)
type system_crond_t;
ifdef(`targeted_policy',`
typealias crond_t alias system_crond_t;
',`
type system_crond_t;
')
init_daemon_domain(system_crond_t,anacron_exec_t)
corecmd_shell_entry_type(system_crond_t)
role system_r types system_crond_t;

3
refpolicy/policy/modules/services/inetd.te
View File

@ -194,8 +194,9 @@ corenet_raw_sendrecv_all_if(inetd_child_t)
corenet_tcp_sendrecv_all_nodes(inetd_child_t)
corenet_udp_sendrecv_all_nodes(inetd_child_t)
corenet_raw_sendrecv_all_nodes(inetd_child_t)
corenet_tcp_bind_all_nodes(inetd_child_t)
corenet_tcp_sendrecv_all_ports(inetd_child_t)
corenet_udp_sendrecv_all_ports(inetd_child_t)
corenet_tcp_bind_all_nodes(inetd_child_t)
dev_read_urand(inetd_child_t)

4
refpolicy/policy/modules/services/inn.te
View File

@ -34,7 +34,7 @@ allow innd_t self:process { setsched signal_perms };
allow innd_t self:fifo_file rw_file_perms;
allow innd_t self:tcp_socket create_stream_socket_perms;
allow innd_t self:udp_socket create_socket_perms;
allow innd_t self:unix_dgram_socket create_socket_perms;
allow innd_t self:unix_dgram_socket { sendto create_socket_perms };
allow innd_t self:unix_stream_socket { connectto create_stream_socket_perms };
allow innd_t innd_etc_t:file r_file_perms;
@ -43,7 +43,7 @@ allow innd_t innd_etc_t:lnk_file { getattr read };
can_exec(innd_t, innd_exec_t)
allow innd_t innd_log_t:file { create ra_file_perms };
allow innd_t innd_log_t:file manage_file_perms;
allow innd_t innd_log_t:dir { setattr ra_dir_perms };
logging_create_log(innd_t,innd_log_t)

5
refpolicy/policy/modules/services/pegasus.te
View File

@ -126,10 +126,11 @@ ifdef(`TODO',`
optional_policy(`rhgb.te',`
rhgb_domain(pegasus_t)
')
') dnl end TODO
#type pegasus_conf_exec_t, exec_type;
# bad rules
type pegasus_conf_exec_t, entry_type;
files_type(pegasus_conf_exec_t)
allow pegasus_conf_exec_t pegasus_conf_t:dir rw_dir_perms;
allow pegasus_conf_exec_t pegasus_conf_t:file create_file_perms;
allow pegasus_conf_exec_t pegasus_conf_t:lnk_file create_lnk_perms;
') dnl end TODO

10
refpolicy/policy/modules/system/domain.if
View File

@ -80,11 +80,19 @@ interface(`domain_type',`
ldap_use($1)
')
# this seems highly questionable:
# these 3 seem highly questionable:
optional_policy(`rpm.te',`
rpm_use_fd($1)
rpm_read_pipe($1)
')
optional_policy(`selinux.te',`
selinux_dontaudit_search_fs($1)
')
optional_policy(`selinuxutil.te',`
seutil_dontaudit_read_config($1)
')
')
########################################

4
refpolicy/policy/modules/system/files.te
View File

@ -7,6 +7,10 @@ policy_module(files,1.0)
#
attribute file_type;
# cjp: should handle this different
allow file_type self:filesystem associate;
attribute lockfile;
attribute mountpoint;
attribute pidfile;

10
refpolicy/policy/modules/system/init.if
View File

@ -89,16 +89,16 @@ interface(`init_daemon_domain',`
# _t at the end of the domain type. If there is no _t
# at the end of the type, it returns empty!
bool regexp($1, `\(\w+\)_t', `\1_disable_trans') false;
if(! regexp($1, `\(\w+\)_t', `\1_disable_trans') ) {
if(regexp($1, `\(\w+\)_t', `\1_disable_trans') ) {
can_exec(initrc_t,$2)
can_exec(direct_run_init,$2)
} else {
domain_auto_trans(initrc_t,$2,$1)
allow initrc_t $1:fd use;
allow $1 initrc_t:fd use;
allow $1 initrc_t:fifo_file rw_file_perms;
allow $1 initrc_t:process sigchld;
dontaudit initrc_t $1:process { noatsecure siginh rlimitinh };
} else {
can_exec(initrc_t,$2)
can_exec(direct_run_init,$2)
allow initrc_t $1:process { noatsecure siginh rlimitinh };
}
',`
domain_auto_trans(initrc_t,$2,$1)

7
refpolicy/policy/modules/system/logging.te
View File

@ -78,6 +78,8 @@ init_dontaudit_use_fd(auditctl_t)
locallogin_dontaudit_use_fd(auditctl_t)
logging_send_syslog_msg(auditctl_t)
ifdef(`TODO',`
role secadm_r types auditctl_t;
role sysadm_r types auditctl_t;
@ -110,6 +112,7 @@ allow auditd_t auditd_log_t:file create_file_perms;
allow auditd_t var_log_t:dir search;
allow auditd_t auditd_var_run_t:file create_file_perms;
allow auditd_t auditd_var_run_t:dir rw_dir_perms;
files_create_pid(auditd_t,auditd_var_run_t)
kernel_read_kernel_sysctl(auditd_t)
@ -143,7 +146,9 @@ libs_use_shared_libs(auditd_t)
miscfiles_read_localization(auditd_t)
mls_file_read_up(klogd_t)
mls_file_read_up(auditd_t)
seutil_dontaudit_read_config(auditd_t)
userdom_dontaudit_use_unpriv_user_fd(auditd_t)
userdom_dontaudit_search_sysadm_home_dir(auditd_t)