- Fix dnsmasq
- Allow rshd full login privs
This commit is contained in:
parent
6455c9d6b5
commit
3375c34d9a
@ -2198,7 +2198,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.if
|
|||||||
+
|
+
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te serefpolicy-3.0.8/policy/modules/admin/vpn.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te serefpolicy-3.0.8/policy/modules/admin/vpn.te
|
||||||
--- nsaserefpolicy/policy/modules/admin/vpn.te 2007-07-25 10:37:43.000000000 -0400
|
--- nsaserefpolicy/policy/modules/admin/vpn.te 2007-07-25 10:37:43.000000000 -0400
|
||||||
+++ serefpolicy-3.0.8/policy/modules/admin/vpn.te 2007-10-18 13:19:26.000000000 -0400
|
+++ serefpolicy-3.0.8/policy/modules/admin/vpn.te 2007-10-19 10:15:22.000000000 -0400
|
||||||
@@ -22,7 +22,7 @@
|
@@ -22,7 +22,7 @@
|
||||||
# Local policy
|
# Local policy
|
||||||
#
|
#
|
||||||
@ -3650,7 +3650,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
|
|||||||
+')
|
+')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.0.8/policy/modules/kernel/domain.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.0.8/policy/modules/kernel/domain.te
|
||||||
--- nsaserefpolicy/policy/modules/kernel/domain.te 2007-07-25 10:37:36.000000000 -0400
|
--- nsaserefpolicy/policy/modules/kernel/domain.te 2007-07-25 10:37:36.000000000 -0400
|
||||||
+++ serefpolicy-3.0.8/policy/modules/kernel/domain.te 2007-10-03 11:10:24.000000000 -0400
|
+++ serefpolicy-3.0.8/policy/modules/kernel/domain.te 2007-10-19 11:01:04.000000000 -0400
|
||||||
@@ -6,6 +6,22 @@
|
@@ -6,6 +6,22 @@
|
||||||
# Declarations
|
# Declarations
|
||||||
#
|
#
|
||||||
@ -3674,7 +3674,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
|
|||||||
# Mark process types as domains
|
# Mark process types as domains
|
||||||
attribute domain;
|
attribute domain;
|
||||||
|
|
||||||
@@ -134,3 +150,22 @@
|
@@ -80,6 +96,8 @@
|
||||||
|
allow domain self:lnk_file r_file_perms;
|
||||||
|
allow domain self:file rw_file_perms;
|
||||||
|
kernel_read_proc_symlinks(domain)
|
||||||
|
+# Every domain gets the key ring, so we should default to no one allowed to look at it
|
||||||
|
+kernel_dontaudit_search_key(domain)
|
||||||
|
|
||||||
|
# create child processes in the domain
|
||||||
|
allow domain self:process { fork sigchld };
|
||||||
|
@@ -134,3 +152,22 @@
|
||||||
|
|
||||||
# act on all domains keys
|
# act on all domains keys
|
||||||
allow unconfined_domain_type domain:key *;
|
allow unconfined_domain_type domain:key *;
|
||||||
@ -4264,8 +4273,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
|
|||||||
+
|
+
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.0.8/policy/modules/kernel/filesystem.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.0.8/policy/modules/kernel/filesystem.te
|
||||||
--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-09-12 10:34:49.000000000 -0400
|
--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-09-12 10:34:49.000000000 -0400
|
||||||
+++ serefpolicy-3.0.8/policy/modules/kernel/filesystem.te 2007-10-08 11:25:43.000000000 -0400
|
+++ serefpolicy-3.0.8/policy/modules/kernel/filesystem.te 2007-10-19 10:04:10.000000000 -0400
|
||||||
@@ -80,6 +80,7 @@
|
@@ -29,6 +29,7 @@
|
||||||
|
fs_use_xattr jffs2 gen_context(system_u:object_r:fs_t,s0);
|
||||||
|
fs_use_xattr jfs gen_context(system_u:object_r:fs_t,s0);
|
||||||
|
fs_use_xattr xfs gen_context(system_u:object_r:fs_t,s0);
|
||||||
|
+fs_use_xattr lustre gen_context(system_u:object_r:fs_t,s0);
|
||||||
|
|
||||||
|
# Use the allocating task SID to label inodes in the following filesystem
|
||||||
|
# types, and label the filesystem itself with the specified context.
|
||||||
|
@@ -80,6 +81,7 @@
|
||||||
type fusefs_t;
|
type fusefs_t;
|
||||||
fs_noxattr_type(fusefs_t)
|
fs_noxattr_type(fusefs_t)
|
||||||
allow fusefs_t self:filesystem associate;
|
allow fusefs_t self:filesystem associate;
|
||||||
@ -4273,7 +4290,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
|
|||||||
genfscon fuse / gen_context(system_u:object_r:fusefs_t,s0)
|
genfscon fuse / gen_context(system_u:object_r:fusefs_t,s0)
|
||||||
genfscon fuseblk / gen_context(system_u:object_r:fusefs_t,s0)
|
genfscon fuseblk / gen_context(system_u:object_r:fusefs_t,s0)
|
||||||
|
|
||||||
@@ -116,6 +117,7 @@
|
@@ -116,6 +118,7 @@
|
||||||
|
|
||||||
type ramfs_t;
|
type ramfs_t;
|
||||||
fs_type(ramfs_t)
|
fs_type(ramfs_t)
|
||||||
@ -4281,7 +4298,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
|
|||||||
genfscon ramfs / gen_context(system_u:object_r:ramfs_t,s0)
|
genfscon ramfs / gen_context(system_u:object_r:ramfs_t,s0)
|
||||||
|
|
||||||
type romfs_t;
|
type romfs_t;
|
||||||
@@ -133,6 +135,11 @@
|
@@ -133,6 +136,11 @@
|
||||||
genfscon spufs / gen_context(system_u:object_r:spufs_t,s0)
|
genfscon spufs / gen_context(system_u:object_r:spufs_t,s0)
|
||||||
files_mountpoint(spufs_t)
|
files_mountpoint(spufs_t)
|
||||||
|
|
||||||
@ -4295,7 +4312,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
|
|||||||
files_mountpoint(vxfs_t)
|
files_mountpoint(vxfs_t)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.8/policy/modules/kernel/kernel.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.8/policy/modules/kernel/kernel.if
|
||||||
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-08-22 07:14:06.000000000 -0400
|
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-08-22 07:14:06.000000000 -0400
|
||||||
+++ serefpolicy-3.0.8/policy/modules/kernel/kernel.if 2007-10-03 11:10:24.000000000 -0400
|
+++ serefpolicy-3.0.8/policy/modules/kernel/kernel.if 2007-10-19 11:00:20.000000000 -0400
|
||||||
@@ -352,6 +352,24 @@
|
@@ -352,6 +352,24 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -6882,14 +6899,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
|||||||
+
|
+
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.0.8/policy/modules/services/dnsmasq.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.0.8/policy/modules/services/dnsmasq.te
|
||||||
--- nsaserefpolicy/policy/modules/services/dnsmasq.te 2007-07-25 10:37:42.000000000 -0400
|
--- nsaserefpolicy/policy/modules/services/dnsmasq.te 2007-07-25 10:37:42.000000000 -0400
|
||||||
+++ serefpolicy-3.0.8/policy/modules/services/dnsmasq.te 2007-10-03 11:10:24.000000000 -0400
|
+++ serefpolicy-3.0.8/policy/modules/services/dnsmasq.te 2007-10-19 10:47:35.000000000 -0400
|
||||||
@@ -94,3 +94,7 @@
|
@@ -94,3 +94,7 @@
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
udev_read_db(dnsmasq_t)
|
udev_read_db(dnsmasq_t)
|
||||||
')
|
')
|
||||||
+
|
+
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
+ virt_rw_lib_files(dnsmasq_t)
|
+ virt_manage_lib_files(dnsmasq_t)
|
||||||
+')
|
+')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.0.8/policy/modules/services/dovecot.fc
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.0.8/policy/modules/services/dovecot.fc
|
||||||
--- nsaserefpolicy/policy/modules/services/dovecot.fc 2007-05-29 14:10:57.000000000 -0400
|
--- nsaserefpolicy/policy/modules/services/dovecot.fc 2007-05-29 14:10:57.000000000 -0400
|
||||||
@ -7703,7 +7720,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
|
|||||||
|
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.8/policy/modules/services/inetd.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.8/policy/modules/services/inetd.te
|
||||||
--- nsaserefpolicy/policy/modules/services/inetd.te 2007-09-12 10:34:50.000000000 -0400
|
--- nsaserefpolicy/policy/modules/services/inetd.te 2007-09-12 10:34:50.000000000 -0400
|
||||||
+++ serefpolicy-3.0.8/policy/modules/services/inetd.te 2007-10-10 09:28:59.000000000 -0400
|
+++ serefpolicy-3.0.8/policy/modules/services/inetd.te 2007-10-19 10:51:35.000000000 -0400
|
||||||
@@ -53,6 +53,8 @@
|
@@ -53,6 +53,8 @@
|
||||||
allow inetd_t inetd_var_run_t:file manage_file_perms;
|
allow inetd_t inetd_var_run_t:file manage_file_perms;
|
||||||
files_pid_filetrans(inetd_t,inetd_var_run_t,file)
|
files_pid_filetrans(inetd_t,inetd_var_run_t,file)
|
||||||
@ -7713,7 +7730,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet
|
|||||||
kernel_read_kernel_sysctls(inetd_t)
|
kernel_read_kernel_sysctls(inetd_t)
|
||||||
kernel_list_proc(inetd_t)
|
kernel_list_proc(inetd_t)
|
||||||
kernel_read_proc_symlinks(inetd_t)
|
kernel_read_proc_symlinks(inetd_t)
|
||||||
@@ -80,16 +82,21 @@
|
@@ -80,16 +82,22 @@
|
||||||
corenet_udp_bind_comsat_port(inetd_t)
|
corenet_udp_bind_comsat_port(inetd_t)
|
||||||
corenet_tcp_bind_dbskkd_port(inetd_t)
|
corenet_tcp_bind_dbskkd_port(inetd_t)
|
||||||
corenet_udp_bind_dbskkd_port(inetd_t)
|
corenet_udp_bind_dbskkd_port(inetd_t)
|
||||||
@ -7721,6 +7738,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet
|
|||||||
corenet_udp_bind_ftp_port(inetd_t)
|
corenet_udp_bind_ftp_port(inetd_t)
|
||||||
corenet_tcp_bind_inetd_child_port(inetd_t)
|
corenet_tcp_bind_inetd_child_port(inetd_t)
|
||||||
+corenet_udp_bind_inetd_child_port(inetd_t)
|
+corenet_udp_bind_inetd_child_port(inetd_t)
|
||||||
|
+corenet_tcp_bind_ircd_port(inetd_t)
|
||||||
corenet_udp_bind_ktalkd_port(inetd_t)
|
corenet_udp_bind_ktalkd_port(inetd_t)
|
||||||
corenet_tcp_bind_printer_port(inetd_t)
|
corenet_tcp_bind_printer_port(inetd_t)
|
||||||
+corenet_udp_bind_rlogind_port(inetd_t)
|
+corenet_udp_bind_rlogind_port(inetd_t)
|
||||||
@ -7735,7 +7753,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet
|
|||||||
corenet_udp_bind_tftp_port(inetd_t)
|
corenet_udp_bind_tftp_port(inetd_t)
|
||||||
corenet_tcp_bind_ssh_port(inetd_t)
|
corenet_tcp_bind_ssh_port(inetd_t)
|
||||||
|
|
||||||
@@ -132,8 +139,10 @@
|
@@ -132,8 +140,10 @@
|
||||||
miscfiles_read_localization(inetd_t)
|
miscfiles_read_localization(inetd_t)
|
||||||
|
|
||||||
# xinetd needs MLS override privileges to work
|
# xinetd needs MLS override privileges to work
|
||||||
@ -7746,19 +7764,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet
|
|||||||
mls_process_set_level(inetd_t)
|
mls_process_set_level(inetd_t)
|
||||||
|
|
||||||
sysnet_read_config(inetd_t)
|
sysnet_read_config(inetd_t)
|
||||||
@@ -141,6 +150,11 @@
|
@@ -141,6 +151,11 @@
|
||||||
userdom_dontaudit_use_unpriv_user_fds(inetd_t)
|
userdom_dontaudit_use_unpriv_user_fds(inetd_t)
|
||||||
userdom_dontaudit_search_sysadm_home_dirs(inetd_t)
|
userdom_dontaudit_search_sysadm_home_dirs(inetd_t)
|
||||||
|
|
||||||
+ifdef(`enable_mls',`
|
+ifdef(`enable_mls',`
|
||||||
+ corenet_tcp_recv_netlabel(inetd_t)
|
+ corenet_tcp_recvfrom_netlabel(inetd_t)
|
||||||
+ corenet_udp_recv_netlabel(inetd_t)
|
+ corenet_udp_recvfrom_netlabel(inetd_t)
|
||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
amanda_search_lib(inetd_t)
|
amanda_search_lib(inetd_t)
|
||||||
')
|
')
|
||||||
@@ -170,6 +184,9 @@
|
@@ -170,6 +185,9 @@
|
||||||
# for identd
|
# for identd
|
||||||
allow inetd_child_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
|
allow inetd_child_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
|
||||||
allow inetd_child_t self:capability { setuid setgid };
|
allow inetd_child_t self:capability { setuid setgid };
|
||||||
@ -7768,7 +7786,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet
|
|||||||
files_search_home(inetd_child_t)
|
files_search_home(inetd_child_t)
|
||||||
|
|
||||||
manage_dirs_pattern(inetd_child_t,inetd_child_tmp_t,inetd_child_tmp_t)
|
manage_dirs_pattern(inetd_child_t,inetd_child_tmp_t,inetd_child_tmp_t)
|
||||||
@@ -212,13 +229,10 @@
|
@@ -212,13 +230,10 @@
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -9999,7 +10017,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
|
|||||||
userdom_read_unpriv_users_tmp_files(gssd_t)
|
userdom_read_unpriv_users_tmp_files(gssd_t)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.0.8/policy/modules/services/rshd.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.0.8/policy/modules/services/rshd.te
|
||||||
--- nsaserefpolicy/policy/modules/services/rshd.te 2007-09-12 10:34:50.000000000 -0400
|
--- nsaserefpolicy/policy/modules/services/rshd.te 2007-09-12 10:34:50.000000000 -0400
|
||||||
+++ serefpolicy-3.0.8/policy/modules/services/rshd.te 2007-10-18 18:33:05.000000000 -0400
|
+++ serefpolicy-3.0.8/policy/modules/services/rshd.te 2007-10-19 10:15:23.000000000 -0400
|
||||||
@@ -16,10 +16,11 @@
|
@@ -16,10 +16,11 @@
|
||||||
#
|
#
|
||||||
# Local policy
|
# Local policy
|
||||||
@ -10023,13 +10041,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd
|
|||||||
corenet_sendrecv_rsh_server_packets(rshd_t)
|
corenet_sendrecv_rsh_server_packets(rshd_t)
|
||||||
|
|
||||||
dev_read_urand(rshd_t)
|
dev_read_urand(rshd_t)
|
||||||
@@ -44,28 +48,44 @@
|
@@ -44,28 +48,42 @@
|
||||||
selinux_compute_relabel_context(rshd_t)
|
selinux_compute_relabel_context(rshd_t)
|
||||||
selinux_compute_user_contexts(rshd_t)
|
selinux_compute_user_contexts(rshd_t)
|
||||||
|
|
||||||
+auth_use_nsswitch(rshd_t)
|
-auth_domtrans_chk_passwd(rshd_t)
|
||||||
auth_domtrans_chk_passwd(rshd_t)
|
+auth_login_pgm_domain(rshd_t)
|
||||||
+auth_domtrans_upd_passwd_chk(rshd_t)
|
|
||||||
+auth_search_key(rshd_t)
|
+auth_search_key(rshd_t)
|
||||||
+auth_write_login_records(rshd_t)
|
+auth_write_login_records(rshd_t)
|
||||||
|
|
||||||
@ -10071,7 +10088,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd
|
|||||||
tunable_policy(`use_nfs_home_dirs',`
|
tunable_policy(`use_nfs_home_dirs',`
|
||||||
fs_read_nfs_files(rshd_t)
|
fs_read_nfs_files(rshd_t)
|
||||||
fs_read_nfs_symlinks(rshd_t)
|
fs_read_nfs_symlinks(rshd_t)
|
||||||
@@ -76,15 +96,3 @@
|
@@ -76,15 +94,3 @@
|
||||||
fs_read_cifs_symlinks(rshd_t)
|
fs_read_cifs_symlinks(rshd_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -12190,7 +12207,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
|
|||||||
+/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0)
|
+/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.8/policy/modules/system/authlogin.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.8/policy/modules/system/authlogin.if
|
||||||
--- nsaserefpolicy/policy/modules/system/authlogin.if 2007-08-22 07:14:13.000000000 -0400
|
--- nsaserefpolicy/policy/modules/system/authlogin.if 2007-08-22 07:14:13.000000000 -0400
|
||||||
+++ serefpolicy-3.0.8/policy/modules/system/authlogin.if 2007-10-18 17:06:56.000000000 -0400
|
+++ serefpolicy-3.0.8/policy/modules/system/authlogin.if 2007-10-19 08:20:05.000000000 -0400
|
||||||
@@ -26,7 +26,8 @@
|
@@ -26,7 +26,8 @@
|
||||||
type $1_chkpwd_t, can_read_shadow_passwords;
|
type $1_chkpwd_t, can_read_shadow_passwords;
|
||||||
application_domain($1_chkpwd_t,chkpwd_exec_t)
|
application_domain($1_chkpwd_t,chkpwd_exec_t)
|
||||||
@ -12222,14 +12239,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
|
|||||||
|
|
||||||
domain_type($1)
|
domain_type($1)
|
||||||
domain_subj_id_change_exemption($1)
|
domain_subj_id_change_exemption($1)
|
||||||
@@ -176,11 +178,32 @@
|
@@ -176,11 +178,31 @@
|
||||||
domain_obj_id_change_exemption($1)
|
domain_obj_id_change_exemption($1)
|
||||||
role system_r types $1;
|
role system_r types $1;
|
||||||
|
|
||||||
+ # needed for afs - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=253321
|
+ # needed for afs - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=253321
|
||||||
+ kernel_write_proc_files($1)
|
+ kernel_write_proc_files($1)
|
||||||
+
|
+
|
||||||
+
|
|
||||||
+ auth_keyring_domain($1)
|
+ auth_keyring_domain($1)
|
||||||
+ allow $1 keyring_type:key { search link };
|
+ allow $1 keyring_type:key { search link };
|
||||||
+
|
+
|
||||||
@ -12255,7 +12271,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
|
|||||||
selinux_get_fs_mount($1)
|
selinux_get_fs_mount($1)
|
||||||
selinux_validate_context($1)
|
selinux_validate_context($1)
|
||||||
selinux_compute_access_vector($1)
|
selinux_compute_access_vector($1)
|
||||||
@@ -196,22 +219,40 @@
|
@@ -196,22 +218,40 @@
|
||||||
mls_fd_share_all_levels($1)
|
mls_fd_share_all_levels($1)
|
||||||
|
|
||||||
auth_domtrans_chk_passwd($1)
|
auth_domtrans_chk_passwd($1)
|
||||||
@ -12297,7 +12313,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
|
|||||||
')
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -309,9 +350,6 @@
|
@@ -309,9 +349,6 @@
|
||||||
type system_chkpwd_t, chkpwd_exec_t, shadow_t;
|
type system_chkpwd_t, chkpwd_exec_t, shadow_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -12307,7 +12323,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
|
|||||||
corecmd_search_bin($1)
|
corecmd_search_bin($1)
|
||||||
domtrans_pattern($1,chkpwd_exec_t,system_chkpwd_t)
|
domtrans_pattern($1,chkpwd_exec_t,system_chkpwd_t)
|
||||||
|
|
||||||
@@ -329,6 +367,8 @@
|
@@ -329,6 +366,8 @@
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
kerberos_use($1)
|
kerberos_use($1)
|
||||||
@ -12316,7 +12332,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -347,6 +387,37 @@
|
@@ -347,6 +386,37 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -12354,7 +12370,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
|
|||||||
## Get the attributes of the shadow passwords file.
|
## Get the attributes of the shadow passwords file.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -695,6 +766,24 @@
|
@@ -695,6 +765,24 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -12379,7 +12395,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
|
|||||||
## Execute pam programs in the PAM domain.
|
## Execute pam programs in the PAM domain.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -1318,16 +1407,14 @@
|
@@ -1318,16 +1406,14 @@
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
interface(`auth_use_nsswitch',`
|
interface(`auth_use_nsswitch',`
|
||||||
@ -12399,7 +12415,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
|
|||||||
miscfiles_read_certs($1)
|
miscfiles_read_certs($1)
|
||||||
|
|
||||||
sysnet_dns_name_resolve($1)
|
sysnet_dns_name_resolve($1)
|
||||||
@@ -1347,6 +1434,8 @@
|
@@ -1347,6 +1433,8 @@
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
samba_stream_connect_winbind($1)
|
samba_stream_connect_winbind($1)
|
||||||
@ -12408,7 +12424,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
|
|||||||
')
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -1381,3 +1470,163 @@
|
@@ -1381,3 +1469,163 @@
|
||||||
typeattribute $1 can_write_shadow_passwords;
|
typeattribute $1 can_write_shadow_passwords;
|
||||||
typeattribute $1 can_relabelto_shadow_passwords;
|
typeattribute $1 can_relabelto_shadow_passwords;
|
||||||
')
|
')
|
||||||
@ -15668,7 +15684,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
+
|
+
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.8/policy/modules/system/unconfined.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.8/policy/modules/system/unconfined.te
|
||||||
--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-07-25 10:37:42.000000000 -0400
|
--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-07-25 10:37:42.000000000 -0400
|
||||||
+++ serefpolicy-3.0.8/policy/modules/system/unconfined.te 2007-10-18 16:48:24.000000000 -0400
|
+++ serefpolicy-3.0.8/policy/modules/system/unconfined.te 2007-10-19 10:29:16.000000000 -0400
|
||||||
@@ -5,36 +5,48 @@
|
@@ -5,36 +5,48 @@
|
||||||
#
|
#
|
||||||
# Declarations
|
# Declarations
|
||||||
@ -15725,7 +15741,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
|
|
||||||
libs_run_ldconfig(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
|
libs_run_ldconfig(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
|
||||||
|
|
||||||
@@ -42,37 +54,30 @@
|
@@ -42,37 +54,29 @@
|
||||||
logging_run_auditctl(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
|
logging_run_auditctl(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
|
||||||
|
|
||||||
mount_run_unconfined(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
|
mount_run_unconfined(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
|
||||||
@ -15738,7 +15754,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
|
|
||||||
-unconfined_domain(unconfined_t)
|
-unconfined_domain(unconfined_t)
|
||||||
-
|
-
|
||||||
+userdom_unconfined(unconfined_t)
|
|
||||||
userdom_priveleged_home_dir_manager(unconfined_t)
|
userdom_priveleged_home_dir_manager(unconfined_t)
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -15771,7 +15786,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -107,6 +112,10 @@
|
@@ -107,6 +111,10 @@
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
oddjob_dbus_chat(unconfined_t)
|
oddjob_dbus_chat(unconfined_t)
|
||||||
')
|
')
|
||||||
@ -15782,7 +15797,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -118,11 +127,11 @@
|
@@ -118,11 +126,11 @@
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -15796,7 +15811,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -134,11 +143,7 @@
|
@@ -134,11 +142,7 @@
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -15809,7 +15824,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -155,32 +160,23 @@
|
@@ -155,32 +159,23 @@
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
postfix_run_map(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
|
postfix_run_map(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
|
||||||
@ -15846,7 +15861,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -205,11 +201,22 @@
|
@@ -205,11 +200,22 @@
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -15871,7 +15886,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -225,8 +232,21 @@
|
@@ -225,8 +231,21 @@
|
||||||
|
|
||||||
init_dbus_chat_script(unconfined_execmem_t)
|
init_dbus_chat_script(unconfined_execmem_t)
|
||||||
unconfined_dbus_chat(unconfined_execmem_t)
|
unconfined_dbus_chat(unconfined_execmem_t)
|
||||||
@ -17456,8 +17471,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.f
|
|||||||
+/var/lib/libvirt(/.*)? gen_context(system_u:object_r:virt_var_lib_t,s0)
|
+/var/lib/libvirt(/.*)? gen_context(system_u:object_r:virt_var_lib_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.if serefpolicy-3.0.8/policy/modules/system/virt.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.if serefpolicy-3.0.8/policy/modules/system/virt.if
|
||||||
--- nsaserefpolicy/policy/modules/system/virt.if 1969-12-31 19:00:00.000000000 -0500
|
--- nsaserefpolicy/policy/modules/system/virt.if 1969-12-31 19:00:00.000000000 -0500
|
||||||
+++ serefpolicy-3.0.8/policy/modules/system/virt.if 2007-10-03 11:10:25.000000000 -0400
|
+++ serefpolicy-3.0.8/policy/modules/system/virt.if 2007-10-19 10:47:26.000000000 -0400
|
||||||
@@ -0,0 +1,58 @@
|
@@ -0,0 +1,78 @@
|
||||||
+## <summary>Virtualization </summary>
|
+## <summary>Virtualization </summary>
|
||||||
+
|
+
|
||||||
+########################################
|
+########################################
|
||||||
@ -17516,6 +17531,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.i
|
|||||||
+ files_list_var_lib($1)
|
+ files_list_var_lib($1)
|
||||||
+ rw_files_pattern($1,virt_var_lib_t,virt_var_lib_t)
|
+ rw_files_pattern($1,virt_var_lib_t,virt_var_lib_t)
|
||||||
+')
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Allow the specified domain to manage
|
||||||
|
+## virt library files.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed to transition.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`virt_manage_lib_files',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type virt_var_lib_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ files_list_var_lib($1)
|
||||||
|
+ manage_files_pattern($1,virt_var_lib_t,virt_var_lib_t)
|
||||||
|
+')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.te serefpolicy-3.0.8/policy/modules/system/virt.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.te serefpolicy-3.0.8/policy/modules/system/virt.te
|
||||||
--- nsaserefpolicy/policy/modules/system/virt.te 1969-12-31 19:00:00.000000000 -0500
|
--- nsaserefpolicy/policy/modules/system/virt.te 1969-12-31 19:00:00.000000000 -0500
|
||||||
+++ serefpolicy-3.0.8/policy/modules/system/virt.te 2007-10-03 11:10:25.000000000 -0400
|
+++ serefpolicy-3.0.8/policy/modules/system/virt.te 2007-10-03 11:10:25.000000000 -0400
|
||||||
@ -17775,7 +17810,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.
|
|||||||
+## <summary>Policy for webadm user</summary>
|
+## <summary>Policy for webadm user</summary>
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.8/policy/modules/users/webadm.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.8/policy/modules/users/webadm.te
|
||||||
--- nsaserefpolicy/policy/modules/users/webadm.te 1969-12-31 19:00:00.000000000 -0500
|
--- nsaserefpolicy/policy/modules/users/webadm.te 1969-12-31 19:00:00.000000000 -0500
|
||||||
+++ serefpolicy-3.0.8/policy/modules/users/webadm.te 2007-10-03 11:10:25.000000000 -0400
|
+++ serefpolicy-3.0.8/policy/modules/users/webadm.te 2007-10-19 10:27:46.000000000 -0400
|
||||||
@@ -0,0 +1,42 @@
|
@@ -0,0 +1,42 @@
|
||||||
+policy_module(webadm,1.0.0)
|
+policy_module(webadm,1.0.0)
|
||||||
+
|
+
|
||||||
@ -17805,7 +17840,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.
|
|||||||
+files_manage_generic_locks(webadm_t)
|
+files_manage_generic_locks(webadm_t)
|
||||||
+files_list_var(webadm_t)
|
+files_list_var(webadm_t)
|
||||||
+selinux_get_enforce_mode(webadm_t)
|
+selinux_get_enforce_mode(webadm_t)
|
||||||
+seutil_domtrans_restorecon(webadm_t)
|
+seutil_domtrans_setfiles(webadm_t)
|
||||||
+
|
+
|
||||||
+logging_send_syslog_msg(webadm_t)
|
+logging_send_syslog_msg(webadm_t)
|
||||||
+
|
+
|
||||||
|
@ -17,7 +17,7 @@
|
|||||||
Summary: SELinux policy configuration
|
Summary: SELinux policy configuration
|
||||||
Name: selinux-policy
|
Name: selinux-policy
|
||||||
Version: 3.0.8
|
Version: 3.0.8
|
||||||
Release: 26%{?dist}
|
Release: 27%{?dist}
|
||||||
License: GPLv2+
|
License: GPLv2+
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
Source: serefpolicy-%{version}.tgz
|
Source: serefpolicy-%{version}.tgz
|
||||||
@ -373,6 +373,10 @@ exit 0
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Fri Oct 17 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-27
|
||||||
|
- Fix dnsmasq
|
||||||
|
- Allow rshd full login privs
|
||||||
|
|
||||||
* Thu Oct 16 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-26
|
* Thu Oct 16 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-26
|
||||||
- Allow rshd to connect to ports > 1023
|
- Allow rshd to connect to ports > 1023
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user