From 346d2dccfdd832c421683cb60edb219e666306c7 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Mon, 21 May 2007 18:54:40 +0000 Subject: [PATCH] --- .cvsignore | 1 + modules-targeted.conf | 7 + ...cy-20070501.patch => policy-20070518.patch | 1251 ++++++++--------- selinux-policy.spec | 13 +- sources | 2 +- 5 files changed, 627 insertions(+), 647 deletions(-) rename policy-20070501.patch => policy-20070518.patch (86%) diff --git a/.cvsignore b/.cvsignore index 03c8f64d..50a7c15f 100644 --- a/.cvsignore +++ b/.cvsignore @@ -117,3 +117,4 @@ serefpolicy-2.6.1.tgz serefpolicy-2.6.2.tgz serefpolicy-2.6.3.tgz serefpolicy-2.6.4.tgz +serefpolicy-2.6.5.tgz diff --git a/modules-targeted.conf b/modules-targeted.conf index a17d64da..32106a60 100644 --- a/modules-targeted.conf +++ b/modules-targeted.conf @@ -1456,3 +1456,10 @@ aide = base # w3c = module +# Layer: services +# Module: rpcbind +# +# universal addresses to RPC program number mapper +# +rpcbind = module + diff --git a/policy-20070501.patch b/policy-20070518.patch similarity index 86% rename from policy-20070501.patch rename to policy-20070518.patch index 123f5cd6..b9e43e2a 100644 --- a/policy-20070501.patch +++ b/policy-20070518.patch @@ -1,6 +1,6 @@ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-2.6.4/man/man8/ftpd_selinux.8 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-2.6.5/man/man8/ftpd_selinux.8 --- nsaserefpolicy/man/man8/ftpd_selinux.8 2007-04-02 10:58:34.000000000 -0400 -+++ serefpolicy-2.6.4/man/man8/ftpd_selinux.8 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/man/man8/ftpd_selinux.8 2007-05-18 11:59:15.000000000 -0400 @@ -12,7 +12,7 @@ .TP chcon -R -t public_content_t /var/ftp @@ -10,9 +10,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 sere .TP chcon -t public_content_rw_t /var/ftp/incoming .TP -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-2.6.4/policy/flask/access_vectors +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-2.6.5/policy/flask/access_vectors --- nsaserefpolicy/policy/flask/access_vectors 2007-02-26 09:43:33.000000000 -0500 -+++ serefpolicy-2.6.4/policy/flask/access_vectors 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/flask/access_vectors 2007-05-18 11:59:15.000000000 -0400 @@ -598,6 +598,8 @@ shmempwd shmemgrp @@ -31,9 +31,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors } class key -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans serefpolicy-2.6.4/policy/global_booleans +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans serefpolicy-2.6.5/policy/global_booleans --- nsaserefpolicy/policy/global_booleans 2006-11-16 17:15:26.000000000 -0500 -+++ serefpolicy-2.6.4/policy/global_booleans 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/global_booleans 2007-05-18 11:59:15.000000000 -0400 @@ -4,7 +4,6 @@ # file should be used. # @@ -50,9 +50,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_booleans seref ## ##

-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-2.6.4/policy/global_tunables +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-2.6.5/policy/global_tunables --- nsaserefpolicy/policy/global_tunables 2007-03-26 16:24:14.000000000 -0400 -+++ serefpolicy-2.6.4/policy/global_tunables 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/global_tunables 2007-05-18 11:59:15.000000000 -0400 @@ -102,12 +102,6 @@ ## gen_tunable(use_samba_home_dirs,false) @@ -79,9 +79,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref +## +gen_tunable(allow_console_login,false) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.4/policy/mls +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.5/policy/mls --- nsaserefpolicy/policy/mls 2007-03-09 13:02:20.000000000 -0500 -+++ serefpolicy-2.6.4/policy/mls 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/mls 2007-05-18 11:59:15.000000000 -0400 @@ -89,12 +89,14 @@ mlsconstrain { file lnk_file fifo_file dir chr_file blk_file sock_file } { write create setattr relabelfrom append unlink link rename mounton } (( l1 eq l2 ) or @@ -153,9 +153,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-2.6.4 ( t2 == unlabeled_t )); mlsconstrain association { polmatch } -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-2.6.4/policy/modules/admin/acct.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-2.6.5/policy/modules/admin/acct.te --- nsaserefpolicy/policy/modules/admin/acct.te 2007-03-26 10:39:08.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/acct.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/acct.te 2007-05-18 11:59:15.000000000 -0400 @@ -9,6 +9,7 @@ type acct_t; type acct_exec_t; @@ -164,9 +164,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te type acct_data_t; logging_log_file(acct_data_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-2.6.4/policy/modules/admin/alsa.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-2.6.5/policy/modules/admin/alsa.fc --- nsaserefpolicy/policy/modules/admin/alsa.fc 2006-11-16 17:15:26.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/alsa.fc 2007-05-17 12:16:25.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/alsa.fc 2007-05-18 11:59:15.000000000 -0400 @@ -1,4 +1,7 @@ /etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0) @@ -175,9 +175,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc /usr/bin/ainit -- gen_context(system_u:object_r:alsa_exec_t,s0) +/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-2.6.4/policy/modules/admin/alsa.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-2.6.5/policy/modules/admin/alsa.te --- nsaserefpolicy/policy/modules/admin/alsa.te 2007-01-02 12:57:51.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/alsa.te 2007-05-17 11:22:07.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/alsa.te 2007-05-18 11:59:15.000000000 -0400 @@ -20,20 +20,23 @@ # Local policy # @@ -223,16 +223,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te + hal_write_log(alsa_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.fc serefpolicy-2.6.4/policy/modules/admin/amtu.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.fc serefpolicy-2.6.5/policy/modules/admin/amtu.fc --- nsaserefpolicy/policy/modules/admin/amtu.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/amtu.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/amtu.fc 2007-05-18 11:59:15.000000000 -0400 @@ -0,0 +1,3 @@ + +/usr/bin/amtu -- gen_context(system_u:object_r:amtu_exec_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if serefpolicy-2.6.4/policy/modules/admin/amtu.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if serefpolicy-2.6.5/policy/modules/admin/amtu.if --- nsaserefpolicy/policy/modules/admin/amtu.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/amtu.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/amtu.if 2007-05-18 11:59:15.000000000 -0400 @@ -0,0 +1,53 @@ +##

+## abstract Machine Test Utility @@ -287,9 +287,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if + role $2 types amtu_t; + allow amtu_t $3:chr_file rw_term_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te serefpolicy-2.6.4/policy/modules/admin/amtu.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te serefpolicy-2.6.5/policy/modules/admin/amtu.te --- nsaserefpolicy/policy/modules/admin/amtu.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/amtu.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/amtu.te 2007-05-18 11:59:15.000000000 -0400 @@ -0,0 +1,57 @@ +policy_module(amtu,1.0.23) + @@ -348,9 +348,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.te + term_dontaudit_search_ptys(amtu_t) +'); + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-2.6.4/policy/modules/admin/bootloader.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-2.6.5/policy/modules/admin/bootloader.te --- nsaserefpolicy/policy/modules/admin/bootloader.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/bootloader.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/bootloader.te 2007-05-18 11:59:15.000000000 -0400 @@ -65,6 +65,8 @@ files_tmp_filetrans(bootloader_t,bootloader_tmp_t,{ dir file lnk_file chr_file blk_file }) # for tune2fs (cjp: ?) @@ -368,9 +368,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloa ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-2.6.4/policy/modules/admin/consoletype.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-2.6.5/policy/modules/admin/consoletype.te --- nsaserefpolicy/policy/modules/admin/consoletype.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/consoletype.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/consoletype.te 2007-05-18 11:59:15.000000000 -0400 @@ -8,7 +8,12 @@ type consoletype_t; @@ -402,9 +402,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console domain_use_interactive_fds(consoletype_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-2.6.4/policy/modules/admin/dmesg.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-2.6.5/policy/modules/admin/dmesg.te --- nsaserefpolicy/policy/modules/admin/dmesg.te 2006-11-16 17:15:26.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/dmesg.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/dmesg.te 2007-05-18 11:59:15.000000000 -0400 @@ -10,6 +10,7 @@ type dmesg_t; type dmesg_exec_t; @@ -413,9 +413,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.t role system_r types dmesg_t; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-2.6.4/policy/modules/admin/kudzu.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-2.6.5/policy/modules/admin/kudzu.te --- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/kudzu.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/kudzu.te 2007-05-18 11:59:15.000000000 -0400 @@ -21,8 +21,8 @@ # Local policy # @@ -436,9 +436,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t # kudzu will telinit to make init re-read # the inittab after configuring serial consoles init_telinit(kudzu_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-2.6.4/policy/modules/admin/logrotate.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-2.6.5/policy/modules/admin/logrotate.te --- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-03-26 10:39:08.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/logrotate.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/logrotate.te 2007-05-18 11:59:15.000000000 -0400 @@ -75,6 +75,7 @@ mls_file_read_up(logrotate_t) mls_file_write_down(logrotate_t) @@ -447,9 +447,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota selinux_get_fs_mount(logrotate_t) selinux_get_enforce_mode(logrotate_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-2.6.4/policy/modules/admin/logwatch.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-2.6.5/policy/modules/admin/logwatch.te --- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-05-02 15:04:46.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/logwatch.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/logwatch.te 2007-05-18 11:59:15.000000000 -0400 @@ -63,6 +63,8 @@ files_search_mnt(logwatch_t) files_dontaudit_search_home(logwatch_t) @@ -459,9 +459,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc fs_getattr_all_fs(logwatch_t) fs_dontaudit_list_auto_mountpoints(logwatch_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-2.6.4/policy/modules/admin/netutils.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-2.6.5/policy/modules/admin/netutils.te --- nsaserefpolicy/policy/modules/admin/netutils.te 2007-04-30 10:41:38.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/netutils.te 2007-05-16 13:16:15.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/netutils.te 2007-05-18 11:59:15.000000000 -0400 @@ -31,6 +31,7 @@ type traceroute_t; type traceroute_exec_t; @@ -470,9 +470,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil role system_r types traceroute_t; ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-2.6.4/policy/modules/admin/readahead.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-2.6.5/policy/modules/admin/prelink.te +--- nsaserefpolicy/policy/modules/admin/prelink.te 2007-04-23 09:36:02.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/prelink.te 2007-05-21 11:37:45.000000000 -0400 +@@ -26,7 +26,7 @@ + # Local policy + # + +-allow prelink_t self:capability { chown dac_override fowner fsetid }; ++allow prelink_t self:capability { chown dac_override fowner fsetid sys_resource }; + allow prelink_t self:process { execheap execmem execstack signal }; + allow prelink_t self:fifo_file rw_fifo_file_perms; + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-2.6.5/policy/modules/admin/readahead.te --- nsaserefpolicy/policy/modules/admin/readahead.te 2007-01-02 12:57:51.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/readahead.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/readahead.te 2007-05-18 11:59:15.000000000 -0400 @@ -18,7 +18,8 @@ # Local policy # @@ -500,9 +512,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe +optional_policy(` + logging_dontaudit_search_audit_config(readahead_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-2.6.4/policy/modules/admin/rpm.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-2.6.5/policy/modules/admin/rpm.fc --- nsaserefpolicy/policy/modules/admin/rpm.fc 2006-11-16 17:15:26.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/rpm.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/rpm.fc 2007-05-18 11:59:15.000000000 -0400 @@ -21,6 +21,9 @@ /usr/sbin/pup -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/sbin/rhn_check -- gen_context(system_u:object_r:rpm_exec_t,s0) @@ -513,10 +525,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc ') /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-2.6.4/policy/modules/admin/rpm.if ---- nsaserefpolicy/policy/modules/admin/rpm.if 2007-04-11 10:19:43.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/rpm.if 2007-05-08 09:59:33.000000000 -0400 -@@ -225,8 +225,29 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-2.6.5/policy/modules/admin/rpm.if +--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/rpm.if 2007-05-18 11:59:15.000000000 -0400 +@@ -224,8 +224,29 @@ type rpm_script_tmp_t; ') @@ -547,7 +559,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if ') ######################################## -@@ -290,3 +311,46 @@ +@@ -289,3 +310,46 @@ dontaudit $1 rpm_var_lib_t:file manage_file_perms; dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms; ') @@ -594,9 +606,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if + + dontaudit $1 rpm_tmp_t:file rw_file_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-2.6.4/policy/modules/admin/rpm.te ---- nsaserefpolicy/policy/modules/admin/rpm.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/rpm.te 2007-05-08 09:59:33.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-2.6.5/policy/modules/admin/rpm.te +--- nsaserefpolicy/policy/modules/admin/rpm.te 2007-05-18 11:12:44.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/rpm.te 2007-05-18 11:59:15.000000000 -0400 @@ -9,6 +9,8 @@ type rpm_t; type rpm_exec_t; @@ -606,9 +618,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te domain_obj_id_change_exemption(rpm_t) domain_role_change_exemption(rpm_t) domain_system_change_exemption(rpm_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-2.6.4/policy/modules/admin/sudo.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-2.6.5/policy/modules/admin/sudo.if --- nsaserefpolicy/policy/modules/admin/sudo.if 2007-03-26 10:39:08.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/sudo.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/sudo.if 2007-05-18 11:59:15.000000000 -0400 @@ -69,7 +69,6 @@ allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms; allow $1_sudo_t self:unix_dgram_socket sendto; @@ -655,9 +667,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if nis_use_ypbind($1_sudo_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-2.6.4/policy/modules/admin/su.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-2.6.5/policy/modules/admin/su.if --- nsaserefpolicy/policy/modules/admin/su.if 2007-04-30 10:41:38.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/su.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/su.if 2007-05-18 11:59:15.000000000 -0400 @@ -41,12 +41,11 @@ allow $2 $1_su_t:process signal; @@ -730,9 +742,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s ifdef(`TODO',` allow $1_su_t $1_home_t:file manage_file_perms; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-2.6.4/policy/modules/admin/usermanage.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-2.6.5/policy/modules/admin/usermanage.if --- nsaserefpolicy/policy/modules/admin/usermanage.if 2007-03-26 10:39:08.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/usermanage.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/usermanage.if 2007-05-18 11:59:15.000000000 -0400 @@ -278,5 +278,5 @@ type crack_db_t; ') @@ -740,18 +752,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman - allow $1 crack_db_t:file read_file_perms; + read_files_pattern($1,crack_db_t,crack_db_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-2.6.4/policy/modules/admin/usermanage.te ---- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/admin/usermanage.te 2007-05-08 09:59:33.000000000 -0400 -@@ -184,7 +184,7 @@ - # Groupadd local policy - # - --allow groupadd_t self:capability { dac_override chown kill setuid sys_resource audit_write }; -+allow groupadd_t self:capability { dac_override chown kill setuid sys_resource }; - dontaudit groupadd_t self:capability { fsetid sys_tty_config }; - allow groupadd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack }; - allow groupadd_t self:process { setrlimit setfscreate }; +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-2.6.5/policy/modules/admin/usermanage.te +--- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-05-18 11:12:44.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/usermanage.te 2007-05-18 11:59:15.000000000 -0400 @@ -198,7 +198,6 @@ allow groupadd_t self:unix_stream_socket create_stream_socket_perms; allow groupadd_t self:unix_dgram_socket sendto; @@ -815,24 +818,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ') ######################################## -@@ -396,6 +402,8 @@ - auth_relabel_shadow(sysadm_passwd_t) - auth_etc_filetrans_shadow(sysadm_passwd_t) - -+# allow checking if a shell is executable -+corecmd_check_exec_shell(sysadm_passwd_t) - # allow vipw to exec the editor - corecmd_exec_bin(sysadm_passwd_t) - corecmd_exec_shell(sysadm_passwd_t) -@@ -412,6 +420,7 @@ - # /usr/bin/passwd asks for w access to utmp, but it will operate - # correctly without it. Do not audit write denials to utmp. - init_dontaudit_rw_utmp(sysadm_passwd_t) -+init_use_fds(sysadm_passwd_t) - - libs_use_ld_so(sysadm_passwd_t) - libs_use_shared_libs(sysadm_passwd_t) -@@ -433,6 +442,7 @@ +@@ -433,6 +439,7 @@ optional_policy(` nscd_socket_use(sysadm_passwd_t) @@ -840,7 +826,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ') ######################################## -@@ -440,7 +450,7 @@ +@@ -440,7 +447,7 @@ # Useradd local policy # @@ -849,7 +835,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman dontaudit useradd_t self:capability sys_tty_config; allow useradd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow useradd_t self:process setfscreate; -@@ -454,7 +464,6 @@ +@@ -454,7 +461,6 @@ allow useradd_t self:unix_stream_socket create_stream_socket_perms; allow useradd_t self:unix_dgram_socket sendto; allow useradd_t self:unix_stream_socket connectto; @@ -857,7 +843,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman # for getting the number of groups kernel_read_kernel_sysctls(useradd_t) -@@ -500,6 +509,7 @@ +@@ -500,6 +506,7 @@ libs_use_shared_libs(useradd_t) logging_send_syslog_msg(useradd_t) @@ -865,17 +851,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman miscfiles_read_localization(useradd_t) -@@ -508,6 +518,9 @@ +@@ -508,6 +515,9 @@ seutil_read_default_contexts(useradd_t) seutil_domtrans_semanage(useradd_t) - seutil_domtrans_restorecon(useradd_t) + seutil_domtrans_setfiles(useradd_t) +# Required because semanage execs these and hands them useradd_t:fd +seutil_domtrans_setfiles(useradd_t) +seutil_domtrans_loadpolicy(useradd_t) userdom_use_unpriv_users_fds(useradd_t) # for when /root is the cwd -@@ -521,11 +534,26 @@ +@@ -521,11 +531,26 @@ mta_manage_spool(useradd_t) optional_policy(` @@ -902,18 +888,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman rpm_rw_pipes(useradd_t) + rpm_dontaudit_rw_tmp_files(useradd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-2.6.4/policy/modules/admin/vbetool.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-2.6.5/policy/modules/admin/vbetool.te --- nsaserefpolicy/policy/modules/admin/vbetool.te 2006-11-16 17:15:26.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/admin/vbetool.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/admin/vbetool.te 2007-05-18 11:59:15.000000000 -0400 @@ -32,4 +32,5 @@ optional_policy(` hal_rw_pid_files(vbetool_t) + hal_write_log(vbetool_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-2.6.4/policy/modules/apps/gnome.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-2.6.5/policy/modules/apps/gnome.if --- nsaserefpolicy/policy/modules/apps/gnome.if 2007-02-19 11:32:52.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/apps/gnome.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/apps/gnome.if 2007-05-18 11:59:15.000000000 -0400 @@ -35,6 +35,7 @@ template(`gnome_per_role_template',` gen_require(` @@ -967,9 +953,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if ##

##

## This is a templated interface, and should only -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-2.6.4/policy/modules/apps/gpg.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc serefpolicy-2.6.5/policy/modules/apps/gpg.fc --- nsaserefpolicy/policy/modules/apps/gpg.fc 2006-11-16 17:15:07.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/apps/gpg.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/apps/gpg.fc 2007-05-18 11:59:15.000000000 -0400 @@ -7,6 +7,4 @@ /usr/lib/gnupg/.* -- gen_context(system_u:object_r:gpg_exec_t,s0) /usr/lib/gnupg/gpgkeys.* -- gen_context(system_u:object_r:gpg_helper_exec_t,s0) @@ -977,9 +963,48 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.fc s -ifdef(`targeted_policy',`',` HOME_DIR/\.gnupg(/.+)? gen_context(system_u:object_r:ROLE_gpg_secret_t,s0) -') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.if serefpolicy-2.6.4/policy/modules/apps/loadkeys.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-2.6.5/policy/modules/apps/java.if +--- nsaserefpolicy/policy/modules/apps/java.if 2007-02-19 11:32:52.000000000 -0500 ++++ serefpolicy-2.6.5/policy/modules/apps/java.if 2007-05-21 10:46:27.000000000 -0400 +@@ -224,3 +224,35 @@ + refpolicywarn(`$0($1) has no effect in strict policy.') + ') + ') ++ ++######################################## ++##

++## Execute a java in the specified domain ++## ++## ++##

++## Execute the java command in the specified domain. This allows ++## the specified domain to execute any file ++## on these filesystems in the specified ++## domain. ++##

++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++## ++## The type of the new process. ++## ++## ++# ++interface(`java_spec_domtrans',` ++ gen_require(` ++ type java_exec_t; ++ ') ++ ++ domain_trans($1,java_exec_t,$2) ++ type_transition $1 java_exec_t:process $2; ++') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.if serefpolicy-2.6.5/policy/modules/apps/loadkeys.if --- nsaserefpolicy/policy/modules/apps/loadkeys.if 2007-01-02 12:57:22.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/apps/loadkeys.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/apps/loadkeys.if 2007-05-18 11:59:15.000000000 -0400 @@ -11,16 +11,12 @@ ## # @@ -1046,9 +1071,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys ') + can_exec($1,loadkeys_exec_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-2.6.4/policy/modules/apps/mozilla.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-2.6.5/policy/modules/apps/mozilla.if --- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-03-26 16:24:09.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/mozilla.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/apps/mozilla.if 2007-05-18 11:59:15.000000000 -0400 @@ -150,6 +150,7 @@ corenet_dontaudit_tcp_bind_generic_port($1_mozilla_t) @@ -1057,9 +1082,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. dev_write_sound($1_mozilla_t) dev_read_sound($1_mozilla_t) dev_dontaudit_rw_dri($1_mozilla_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-2.6.4/policy/modules/apps/slocate.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-2.6.5/policy/modules/apps/slocate.te --- nsaserefpolicy/policy/modules/apps/slocate.te 2007-04-30 11:25:12.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/slocate.te 2007-05-15 11:05:16.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/apps/slocate.te 2007-05-18 11:59:15.000000000 -0400 @@ -39,11 +39,12 @@ files_list_all(locate_t) @@ -1074,9 +1099,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate. libs_use_shared_libs(locate_t) libs_use_ld_so(locate_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if serefpolicy-2.6.4/policy/modules/apps/uml.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if serefpolicy-2.6.5/policy/modules/apps/uml.if --- nsaserefpolicy/policy/modules/apps/uml.if 2007-03-26 10:38:58.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/apps/uml.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/apps/uml.if 2007-05-18 11:59:15.000000000 -0400 @@ -193,33 +193,6 @@ nis_use_ypbind($1_uml_t) ') @@ -1111,9 +1136,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/uml.if s ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-2.6.4/policy/modules/kernel/corecommands.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-2.6.5/policy/modules/kernel/corecommands.fc --- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-04-11 15:52:53.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/corecommands.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/corecommands.fc 2007-05-18 11:59:15.000000000 -0400 @@ -36,6 +36,11 @@ /etc/cipe/ip-up.* -- gen_context(system_u:object_r:bin_t,s0) /etc/cipe/ip-down.* -- gen_context(system_u:object_r:bin_t,s0) @@ -1132,9 +1157,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco ') +/usr/lib/vmware-tools/sbin32(/.*)? gen_context(system_u:object_r:bin_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-2.6.4/policy/modules/kernel/corecommands.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-2.6.5/policy/modules/kernel/corecommands.if --- nsaserefpolicy/policy/modules/kernel/corecommands.if 2007-03-26 10:38:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/corecommands.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/corecommands.if 2007-05-18 11:59:15.000000000 -0400 @@ -988,3 +988,23 @@ mmap_files_pattern($1,bin_t,exec_type) @@ -1159,9 +1184,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco +') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-2.6.4/policy/modules/kernel/corenetwork.te.in ---- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-05-07 10:32:44.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/corenetwork.te.in 2007-05-08 09:59:33.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-2.6.5/policy/modules/kernel/corenetwork.te.in +--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-05-18 11:12:43.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/corenetwork.te.in 2007-05-18 11:59:15.000000000 -0400 @@ -48,6 +48,11 @@ type reserved_port_t, port_type, reserved_port_type; @@ -1174,15 +1199,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene # server_packet_t is the default type of IPv4 and IPv6 server packets. # type server_packet_t, packet_type, server_packet_type; -@@ -60,6 +65,7 @@ - network_port(amanda, udp,10080,s0, tcp,10080,s0, udp,10081,s0, tcp,10081,s0, tcp,10082,s0, tcp,10083,s0) - network_port(amavisd_recv, tcp,10024,s0) - network_port(amavisd_send, tcp,10025,s0) -+network_port(apcupsd, tcp,3551,s0, udp,3551,s0) - network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0, udp,5060,s0) - network_port(auth, tcp,113,s0) - network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0) -@@ -85,7 +91,7 @@ +@@ -86,7 +91,7 @@ network_port(http_cache, tcp,3128,s0, udp,3130,s0, tcp,8080,s0, tcp,8118,s0) # 8118 is for privoxy network_port(http, tcp,80,s0, tcp,443,s0, tcp,488,s0, tcp,8008,s0, tcp,8009,s0, tcp,8443,s0) #8443 is mod_nss default port network_port(howl, tcp,5335,s0, udp,5353,s0) @@ -1191,7 +1208,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene network_port(i18n_input, tcp,9010,s0) network_port(imaze, tcp,5323,s0, udp,5323,s0) network_port(inetd_child, tcp,7,s0, udp,7,s0, tcp,9,s0, udp,9,s0, tcp,13,s0, udp,13,s0, tcp,19,s0, udp,19,s0, tcp,37,s0, udp,37,s0, tcp,512,s0, tcp,543,s0, tcp,544,s0, tcp,891,s0, udp,891,s0, tcp,892,s0, udp,892,s0, tcp,2105,s0, tcp,5666,s0) -@@ -100,7 +106,7 @@ +@@ -101,7 +106,7 @@ network_port(kerberos_master, tcp,4444,s0, udp,4444,s0) network_port(kerberos, tcp,88,s0, udp,88,s0, tcp,750,s0, udp,750,s0) network_port(ktalkd, udp,517,s0, udp,518,s0) @@ -1200,7 +1217,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene type lrrd_port_t, port_type; dnl network_port(lrrd_port_t) # no defined portcon network_port(lmtp, tcp,24,s0, udp,24,s0) network_port(mail, tcp,2000,s0) -@@ -159,6 +165,9 @@ +@@ -160,6 +165,9 @@ # Defaults for reserved ports. Earlier portcon entries take precedence; # these entries just cover any remaining reserved ports not otherwise declared. @@ -1210,9 +1227,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene portcon tcp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0) portcon udp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-2.6.4/policy/modules/kernel/devices.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-2.6.5/policy/modules/kernel/devices.fc --- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-03-01 10:01:48.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/kernel/devices.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/devices.fc 2007-05-18 11:59:15.000000000 -0400 @@ -19,6 +19,7 @@ /dev/evtchn -c gen_context(system_u:object_r:xen_device_t,s0) /dev/fb[0-9]* -c gen_context(system_u:object_r:framebuf_device_t,s0) @@ -1230,9 +1247,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device /dev/cpu/.* -c gen_context(system_u:object_r:cpu_device_t,s0) /dev/cpu/mtrr -c gen_context(system_u:object_r:mtrr_device_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-2.6.4/policy/modules/kernel/devices.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-2.6.5/policy/modules/kernel/devices.if --- nsaserefpolicy/policy/modules/kernel/devices.if 2007-05-07 14:50:42.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/devices.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/devices.if 2007-05-18 11:59:15.000000000 -0400 @@ -2729,6 +2729,24 @@ ######################################## @@ -1337,9 +1354,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device + manage_chr_files_pattern($1,device_t,smartcard_device_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-2.6.4/policy/modules/kernel/devices.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-2.6.5/policy/modules/kernel/devices.te --- nsaserefpolicy/policy/modules/kernel/devices.te 2007-05-07 14:50:42.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/devices.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/devices.te 2007-05-18 11:59:15.000000000 -0400 @@ -139,6 +139,12 @@ # # Type for sound devices and mixers @@ -1353,9 +1370,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device type sound_device_t; dev_node(sound_device_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-2.6.4/policy/modules/kernel/domain.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-2.6.5/policy/modules/kernel/domain.if --- nsaserefpolicy/policy/modules/kernel/domain.if 2007-02-19 11:32:51.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/kernel/domain.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/domain.if 2007-05-18 11:59:15.000000000 -0400 @@ -1254,3 +1254,21 @@ typeattribute $1 can_change_object_identity; typeattribute $1 set_curr_context; @@ -1378,9 +1395,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain + + allow $1 domain:association { sendto recvfrom }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-2.6.4/policy/modules/kernel/domain.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-2.6.5/policy/modules/kernel/domain.te --- nsaserefpolicy/policy/modules/kernel/domain.te 2007-04-23 09:35:56.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/domain.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/domain.te 2007-05-18 11:59:15.000000000 -0400 @@ -6,6 +6,29 @@ # Declarations # @@ -1438,9 +1455,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain + ipsec_labeled(domain) + ') +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-2.6.4/policy/modules/kernel/files.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-2.6.5/policy/modules/kernel/files.fc --- nsaserefpolicy/policy/modules/kernel/files.fc 2006-11-16 17:15:04.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/kernel/files.fc 2007-05-16 17:44:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/files.fc 2007-05-18 11:59:15.000000000 -0400 @@ -45,7 +45,6 @@ /etc -d gen_context(system_u:object_r:etc_t,s0) /etc/.* gen_context(system_u:object_r:etc_t,s0) @@ -1457,9 +1474,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. /etc/motd -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/nohotplug -- gen_context(system_u:object_r:etc_runtime_t,s0) /etc/nologin.* -- gen_context(system_u:object_r:etc_runtime_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-2.6.4/policy/modules/kernel/files.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-2.6.5/policy/modules/kernel/files.if --- nsaserefpolicy/policy/modules/kernel/files.if 2007-02-26 14:17:21.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/kernel/files.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/files.if 2007-05-18 11:59:15.000000000 -0400 @@ -343,8 +343,7 @@ ######################################## @@ -1636,9 +1653,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. + allow $1 root_t:dir rw_dir_perms; + allow $1 root_t:file { create getattr write }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-2.6.4/policy/modules/kernel/filesystem.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-2.6.5/policy/modules/kernel/files.te +--- nsaserefpolicy/policy/modules/kernel/files.te 2007-04-23 09:35:56.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/files.te 2007-05-18 11:59:15.000000000 -0400 +@@ -54,6 +54,7 @@ + files_type(etc_t) + # compatibility aliases for removed types: + typealias etc_t alias automount_etc_t; ++typealias etc_t alias snmpd_etc_t; + + # + # etc_runtime_t is the type of various +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-2.6.5/policy/modules/kernel/filesystem.if --- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-03-26 16:24:09.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/filesystem.if 2007-05-18 11:59:15.000000000 -0400 @@ -1096,6 +1096,24 @@ ######################################## @@ -1714,9 +1742,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy + + allow $1 fusefs_t:filesystem mount; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-2.6.4/policy/modules/kernel/filesystem.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-2.6.5/policy/modules/kernel/filesystem.te --- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-04-23 09:35:56.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.te 2007-05-16 11:07:59.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/filesystem.te 2007-05-18 11:59:15.000000000 -0400 @@ -54,17 +54,29 @@ type capifs_t; @@ -1771,9 +1799,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy # # tmpfs_t is the type for tmpfs filesystems # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-2.6.4/policy/modules/kernel/kernel.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-2.6.5/policy/modules/kernel/kernel.if --- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-05-02 15:04:46.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/kernel.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/kernel.if 2007-05-18 11:59:15.000000000 -0400 @@ -1848,6 +1848,26 @@ ######################################## @@ -1811,9 +1839,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-2.6.4/policy/modules/kernel/kernel.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-2.6.5/policy/modules/kernel/kernel.te --- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-05-02 15:04:46.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/kernel.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/kernel.te 2007-05-18 11:59:15.000000000 -0400 @@ -146,6 +146,8 @@ type unlabeled_t; sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) @@ -1831,9 +1859,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-2.6.4/policy/modules/kernel/mls.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-2.6.5/policy/modules/kernel/mls.if --- nsaserefpolicy/policy/modules/kernel/mls.if 2006-11-16 17:15:04.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/kernel/mls.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/mls.if 2007-05-18 11:59:15.000000000 -0400 @@ -154,6 +154,26 @@ ######################################## ## @@ -1861,9 +1889,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if ## for writing to sockets at any level. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-2.6.4/policy/modules/kernel/mls.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-2.6.5/policy/modules/kernel/mls.te --- nsaserefpolicy/policy/modules/kernel/mls.te 2007-01-02 12:57:13.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/kernel/mls.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/mls.te 2007-05-18 11:59:15.000000000 -0400 @@ -18,6 +18,7 @@ attribute mlsnetreadtoclr; attribute mlsnetwrite; @@ -1881,9 +1909,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te attribute mlstrustedobject; attribute privrangetrans; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-2.6.4/policy/modules/kernel/selinux.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-2.6.5/policy/modules/kernel/selinux.if --- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-02-27 14:37:10.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/kernel/selinux.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/selinux.if 2007-05-18 11:59:15.000000000 -0400 @@ -51,6 +51,44 @@ ######################################## @@ -1929,9 +1957,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu ## Search selinuxfs. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-2.6.4/policy/modules/kernel/storage.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-2.6.5/policy/modules/kernel/storage.if --- nsaserefpolicy/policy/modules/kernel/storage.if 2007-01-02 12:57:13.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/kernel/storage.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/storage.if 2007-05-18 11:59:15.000000000 -0400 @@ -100,6 +100,7 @@ dev_list_all_dev_nodes($1) @@ -1948,9 +1976,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag typeattribute $1 fixed_disk_raw_write; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-2.6.4/policy/modules/kernel/terminal.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-2.6.5/policy/modules/kernel/terminal.if --- nsaserefpolicy/policy/modules/kernel/terminal.if 2007-02-20 16:35:52.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/kernel/terminal.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/terminal.if 2007-05-18 11:59:15.000000000 -0400 @@ -278,6 +278,25 @@ ######################################## @@ -1986,9 +2014,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-2.6.4/policy/modules/kernel/terminal.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-2.6.5/policy/modules/kernel/terminal.te --- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-04-23 09:35:56.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/kernel/terminal.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/kernel/terminal.te 2007-05-18 11:59:15.000000000 -0400 @@ -28,6 +28,7 @@ type devpts_t; files_mountpoint(devpts_t) @@ -1997,9 +2025,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin fs_type(devpts_t) fs_use_trans devpts gen_context(system_u:object_r:devpts_t,s0); -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.fc serefpolicy-2.6.4/policy/modules/services/aide.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.fc serefpolicy-2.6.5/policy/modules/services/aide.fc --- nsaserefpolicy/policy/modules/services/aide.fc 2007-04-30 11:25:12.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/aide.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/aide.fc 2007-05-18 11:59:15.000000000 -0400 @@ -2,5 +2,5 @@ /var/lib/aide(/.*) gen_context(system_u:object_r:aide_db_t,mls_systemhigh) @@ -2007,9 +2035,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide -/var/log/aide(/.*)? gen_context(system_u:object_r:aide_log_t,mls_systemhigh) /var/log/aide.log -- gen_context(system_u:object_r:aide_log_t,mls_systemhigh) +/var/log/aide(/.*)? gen_context(system_u:object_r:aide_log_t,mls_systemhigh) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.te serefpolicy-2.6.4/policy/modules/services/aide.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide.te serefpolicy-2.6.5/policy/modules/services/aide.te --- nsaserefpolicy/policy/modules/services/aide.te 2007-04-30 11:25:12.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/aide.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/aide.te 2007-05-18 11:59:15.000000000 -0400 @@ -26,7 +26,7 @@ allow aide_t self:capability { dac_override fowner }; @@ -2019,9 +2047,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aide # database actions manage_files_pattern(aide_t,aide_db_t,aide_db_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.if serefpolicy-2.6.4/policy/modules/services/amavis.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.if serefpolicy-2.6.5/policy/modules/services/amavis.if --- nsaserefpolicy/policy/modules/services/amavis.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/amavis.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/amavis.if 2007-05-18 11:59:15.000000000 -0400 @@ -167,3 +167,22 @@ allow $1 amavis_var_run_t:file setattr; files_search_pids($1) @@ -2045,9 +2073,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav + allow $1 amavis_var_run_t:file create_file_perms; + files_search_pids($1) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-2.6.4/policy/modules/services/apache.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-2.6.5/policy/modules/services/apache.fc --- nsaserefpolicy/policy/modules/services/apache.fc 2007-02-23 16:50:01.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/apache.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/apache.fc 2007-05-18 11:59:15.000000000 -0400 @@ -1,10 +1,5 @@ # temporary hack till genhomedircon is fixed -ifdef(`targeted_policy',` @@ -2079,9 +2107,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +#viewvc file context +/var/spool/viewvc(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t, s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-2.6.4/policy/modules/services/apache.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-2.6.5/policy/modules/services/apache.if --- nsaserefpolicy/policy/modules/services/apache.if 2007-04-02 10:58:34.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apache.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/apache.if 2007-05-18 11:59:15.000000000 -0400 @@ -18,10 +18,6 @@ attribute httpd_script_exec_type; type httpd_t, httpd_suexec_t, httpd_log_t; @@ -2300,9 +2328,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + allow $1 httpd_bugzilla_content_t:dir search_dir_perms; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-2.6.4/policy/modules/services/apache.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-2.6.5/policy/modules/services/apache.te --- nsaserefpolicy/policy/modules/services/apache.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apache.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/apache.te 2007-05-18 11:59:15.000000000 -0400 @@ -106,6 +106,27 @@ ## gen_tunable(httpd_unified,false) @@ -2466,9 +2494,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + postgresql_stream_connect(httpd_bugzilla_script_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-2.6.4/policy/modules/services/apcupsd.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-2.6.5/policy/modules/services/apcupsd.fc --- nsaserefpolicy/policy/modules/services/apcupsd.fc 2007-05-07 11:11:55.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apcupsd.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/apcupsd.fc 2007-05-18 11:59:15.000000000 -0400 @@ -3,3 +3,8 @@ /var/log/apcupsd\.events.* -- gen_context(system_u:object_r:apcupsd_log_t,s0) @@ -2478,9 +2506,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu +/var/www/apcupsd/upsfstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) +/var/www/apcupsd/upsimage.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) +/var/www/apcupsd/upsstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-2.6.4/policy/modules/services/apcupsd.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-2.6.5/policy/modules/services/apcupsd.if --- nsaserefpolicy/policy/modules/services/apcupsd.if 2007-05-07 11:11:55.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apcupsd.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/apcupsd.if 2007-05-18 11:59:15.000000000 -0400 @@ -79,3 +79,25 @@ allow $1 apcupsd_log_t:dir list_dir_perms; allow $1 apcupsd_log_t:file { getattr append }; @@ -2507,29 +2535,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu + allow httpd_apcupsd_cgi_script_t $1:fifo_file rw_file_perms; + allow httpd_apcupsd_cgi_script_t $1:process sigchld; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-2.6.4/policy/modules/services/apcupsd.te ---- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-05-07 11:11:55.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/apcupsd.te 2007-05-08 09:59:33.000000000 -0400 -@@ -24,6 +24,7 @@ - # apcupsd local policy - # - -+allow apcupsd_t self:process signal; - allow apcupsd_t self:fifo_file rw_file_perms; - allow apcupsd_t self:unix_stream_socket create_stream_socket_perms; - allow apcupsd_t self:tcp_socket create_stream_socket_perms; -@@ -43,8 +44,8 @@ - corenet_tcp_sendrecv_all_nodes(apcupsd_t) - corenet_tcp_sendrecv_all_ports(apcupsd_t) - corenet_tcp_bind_all_nodes(apcupsd_t) --#corenet_tcp_bind_apcupsd_port(apcupsd_t) --#corenet_sendrecv_apcupsd_server_packets(apcupsd_t) -+corenet_tcp_bind_apcupsd_port(apcupsd_t) -+corenet_sendrecv_apcupsd_server_packets(apcupsd_t) - - dev_rw_generic_usb_dev(apcupsd_t) - -@@ -65,3 +66,26 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-2.6.5/policy/modules/services/apcupsd.te +--- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-05-18 11:12:43.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/apcupsd.te 2007-05-18 11:59:15.000000000 -0400 +@@ -66,3 +66,26 @@ term_dontaudit_use_unallocated_ttys(apcupsd_t) term_dontaudit_use_generic_ptys(apcupsd_t) ') @@ -2556,9 +2565,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu +corenet_udp_sendrecv_all_nodes(httpd_apcupsd_cgi_script_t) +corenet_udp_sendrecv_all_ports(httpd_apcupsd_cgi_script_t) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-2.6.4/policy/modules/services/automount.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-2.6.5/policy/modules/services/automount.te --- nsaserefpolicy/policy/modules/services/automount.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/automount.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/automount.te 2007-05-18 11:59:15.000000000 -0400 @@ -69,6 +69,7 @@ files_mounton_all_mountpoints(automount_t) files_mount_all_file_type_fs(automount_t) @@ -2575,9 +2584,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto dev_read_urand(automount_t) domain_use_interactive_fds(automount_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-2.6.4/policy/modules/services/avahi.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-2.6.5/policy/modules/services/avahi.te --- nsaserefpolicy/policy/modules/services/avahi.te 2007-05-03 08:50:57.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/avahi.te 2007-05-15 11:02:52.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/avahi.te 2007-05-18 11:59:15.000000000 -0400 @@ -18,7 +18,7 @@ # Local policy # @@ -2587,9 +2596,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah dontaudit avahi_t self:capability sys_tty_config; allow avahi_t self:process { setrlimit signal_perms setcap }; allow avahi_t self:fifo_file { read write }; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-2.6.4/policy/modules/services/bind.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-2.6.5/policy/modules/services/bind.te --- nsaserefpolicy/policy/modules/services/bind.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/bind.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/bind.te 2007-05-18 11:59:15.000000000 -0400 @@ -236,6 +236,7 @@ corenet_tcp_sendrecv_all_nodes(ndc_t) corenet_tcp_sendrecv_all_ports(ndc_t) @@ -2598,9 +2607,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind corenet_sendrecv_rndc_client_packets(ndc_t) fs_getattr_xattr_fs(ndc_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-2.6.4/policy/modules/services/clamav.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-2.6.5/policy/modules/services/clamav.te --- nsaserefpolicy/policy/modules/services/clamav.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/clamav.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/clamav.te 2007-05-18 11:59:15.000000000 -0400 @@ -126,6 +126,7 @@ amavis_read_lib_files(clamd_t) amavis_read_spool_files(clamd_t) @@ -2609,9 +2618,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-2.6.4/policy/modules/services/consolekit.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-2.6.5/policy/modules/services/consolekit.te --- nsaserefpolicy/policy/modules/services/consolekit.te 2007-05-04 12:19:22.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/consolekit.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/consolekit.te 2007-05-18 11:59:15.000000000 -0400 @@ -10,7 +10,6 @@ type consolekit_exec_t; init_daemon_domain(consolekit_t, consolekit_exec_t) @@ -2654,17 +2663,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons + unconfined_ptrace(consolekit_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-2.6.4/policy/modules/services/cron.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-2.6.5/policy/modules/services/cron.fc --- nsaserefpolicy/policy/modules/services/cron.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/cron.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/cron.fc 2007-05-18 11:59:15.000000000 -0400 @@ -45,3 +45,4 @@ /var/spool/fcron/systab\.orig -- gen_context(system_u:object_r:system_cron_spool_t,s0) /var/spool/fcron/systab -- gen_context(system_u:object_r:system_cron_spool_t,s0) /var/spool/fcron/new\.systab -- gen_context(system_u:object_r:system_cron_spool_t,s0) +/var/lib/misc(/.*)? gen_context(system_u:object_r:crond_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-2.6.4/policy/modules/services/cron.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-2.6.5/policy/modules/services/cron.if --- nsaserefpolicy/policy/modules/services/cron.if 2007-03-26 10:39:05.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cron.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/cron.if 2007-05-18 11:59:15.000000000 -0400 @@ -35,6 +35,7 @@ # template(`cron_per_role_template',` @@ -2773,9 +2782,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron tunable_policy(`fcron_crond',` # fcron wants an instant update of a crontab change for the administrator -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-2.6.4/policy/modules/services/cron.te ---- nsaserefpolicy/policy/modules/services/cron.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cron.te 2007-05-08 09:59:33.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-2.6.5/policy/modules/services/cron.te +--- nsaserefpolicy/policy/modules/services/cron.te 2007-05-18 11:12:43.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/cron.te 2007-05-18 11:59:15.000000000 -0400 @@ -42,6 +42,9 @@ type cron_log_t; logging_log_file(cron_log_t) @@ -2902,7 +2911,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron libs_use_ld_so(system_crond_t) libs_use_shared_libs(system_crond_t) -@@ -428,6 +456,10 @@ +@@ -427,6 +455,10 @@ ') optional_policy(` @@ -2913,9 +2922,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron mrtg_append_create_logs(system_crond_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-2.6.4/policy/modules/services/cups.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-2.6.5/policy/modules/services/cups.fc --- nsaserefpolicy/policy/modules/services/cups.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/cups.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/cups.fc 2007-05-18 11:59:15.000000000 -0400 @@ -8,6 +8,7 @@ /etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) @@ -2924,9 +2933,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups /etc/cups/certs -d gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/certs/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-2.6.4/policy/modules/services/cups.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-2.6.5/policy/modules/services/cups.te --- nsaserefpolicy/policy/modules/services/cups.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cups.te 2007-05-11 18:40:14.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/cups.te 2007-05-18 11:59:15.000000000 -0400 @@ -93,8 +93,6 @@ # generic socket here until appletalk socket is available in kernels allow cupsd_t self:socket create_socket_perms; @@ -2986,9 +2995,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups seutil_sigchld_newrole(cupsd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-2.6.4/policy/modules/services/cvs.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-2.6.5/policy/modules/services/cvs.te --- nsaserefpolicy/policy/modules/services/cvs.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cvs.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/cvs.te 2007-05-18 11:59:15.000000000 -0400 @@ -16,6 +16,7 @@ type cvs_t; type cvs_exec_t; @@ -2997,9 +3006,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs. role system_r types cvs_t; type cvs_data_t; # customizable -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-2.6.4/policy/modules/services/cyrus.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-2.6.5/policy/modules/services/cyrus.te --- nsaserefpolicy/policy/modules/services/cyrus.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/cyrus.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/cyrus.te 2007-05-18 11:59:15.000000000 -0400 @@ -145,6 +145,7 @@ optional_policy(` @@ -3008,9 +3017,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-2.6.4/policy/modules/services/dbus.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-2.6.5/policy/modules/services/dbus.if --- nsaserefpolicy/policy/modules/services/dbus.if 2007-03-26 10:39:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dbus.if 2007-05-14 15:57:48.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/dbus.if 2007-05-18 11:59:15.000000000 -0400 @@ -49,6 +49,12 @@ ## # @@ -3138,9 +3147,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus +') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-2.6.4/policy/modules/services/dbus.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-2.6.5/policy/modules/services/dbus.te --- nsaserefpolicy/policy/modules/services/dbus.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dbus.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/dbus.te 2007-05-18 11:59:15.000000000 -0400 @@ -40,8 +40,6 @@ # Receive notifications of policy reloads and enforcing status changes. allow system_dbusd_t self:netlink_selinux_socket { create bind read }; @@ -3169,9 +3178,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus sysnet_domtrans_dhcpc(system_dbusd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-2.6.4/policy/modules/services/dhcp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-2.6.5/policy/modules/services/dhcp.te --- nsaserefpolicy/policy/modules/services/dhcp.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dhcp.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/dhcp.te 2007-05-18 11:59:15.000000000 -0400 @@ -119,6 +119,8 @@ dbus_system_bus_client_template(dhcpd,dhcpd_t) dbus_connect_system_bus(dhcpd_t) @@ -3181,9 +3190,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbdns.te serefpolicy-2.6.4/policy/modules/services/djbdns.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbdns.te serefpolicy-2.6.5/policy/modules/services/djbdns.te --- nsaserefpolicy/policy/modules/services/djbdns.te 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/djbdns.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/djbdns.te 2007-05-18 11:59:15.000000000 -0400 @@ -44,4 +44,7 @@ libs_use_ld_so(djbdns_axfrdns_t) libs_use_shared_libs(djbdns_axfrdns_t) @@ -3193,9 +3202,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/djbd + ucspitcp_service_domain(djbdns_axfrdns_t, djbdns_axfrdns_exec_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-2.6.4/policy/modules/services/dovecot.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-2.6.5/policy/modules/services/dovecot.fc --- nsaserefpolicy/policy/modules/services/dovecot.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/dovecot.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/dovecot.fc 2007-05-18 11:59:15.000000000 -0400 @@ -17,10 +17,12 @@ ifdef(`distro_debian', ` @@ -3209,9 +3218,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove ') # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-2.6.4/policy/modules/services/dovecot.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-2.6.5/policy/modules/services/dovecot.if --- nsaserefpolicy/policy/modules/services/dovecot.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/dovecot.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/dovecot.if 2007-05-18 11:59:15.000000000 -0400 @@ -18,3 +18,43 @@ manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t) manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t) @@ -3256,9 +3265,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + domtrans_pattern($1,dovecot_deliver_exec_t,dovecot_deliver_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-2.6.4/policy/modules/services/dovecot.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-2.6.5/policy/modules/services/dovecot.te --- nsaserefpolicy/policy/modules/services/dovecot.te 2007-05-07 10:32:44.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/dovecot.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/dovecot.te 2007-05-18 11:59:15.000000000 -0400 @@ -15,6 +15,12 @@ domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t) role system_r types dovecot_auth_t; @@ -3377,9 +3386,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + term_dontaudit_use_unallocated_ttys(dovecot_deliver_t) + term_dontaudit_use_generic_ptys(dovecot_deliver_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-2.6.4/policy/modules/services/ftp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-2.6.5/policy/modules/services/ftp.te --- nsaserefpolicy/policy/modules/services/ftp.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ftp.te 2007-05-17 13:03:23.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/ftp.te 2007-05-18 11:59:15.000000000 -0400 @@ -168,6 +168,7 @@ libs_use_shared_libs(ftpd_t) @@ -3404,9 +3413,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. ') tunable_policy(`ftp_home_dir && use_nfs_home_dirs',` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-2.6.4/policy/modules/services/hal.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-2.6.5/policy/modules/services/hal.fc --- nsaserefpolicy/policy/modules/services/hal.fc 2007-05-07 14:50:43.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/hal.fc 2007-05-10 16:08:49.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/hal.fc 2007-05-18 11:59:15.000000000 -0400 @@ -2,15 +2,20 @@ /etc/hal/device\.d/printer_remove\.hal -- gen_context(system_u:object_r:hald_exec_t,s0) /etc/hal/capability\.d/printer_update\.hal -- gen_context(system_u:object_r:hald_exec_t,s0) @@ -3433,9 +3442,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. + +/var/log/pm-suspend.log gen_context(system_u:object_r:hald_log_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-2.6.4/policy/modules/services/hal.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-2.6.5/policy/modules/services/hal.if --- nsaserefpolicy/policy/modules/services/hal.if 2007-02-19 11:32:53.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/hal.if 2007-05-16 17:46:44.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/hal.if 2007-05-18 11:59:15.000000000 -0400 @@ -208,3 +208,98 @@ files_search_pids($1) allow $1 hald_var_run_t:file rw_file_perms; @@ -3535,9 +3544,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. + allow $1 hald_t:process ptrace; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-2.6.4/policy/modules/services/hal.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-2.6.5/policy/modules/services/hal.te --- nsaserefpolicy/policy/modules/services/hal.te 2007-05-07 14:50:43.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/hal.te 2007-05-16 18:05:54.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/hal.te 2007-05-18 11:59:15.000000000 -0400 @@ -61,8 +61,6 @@ # For backwards compatibility with older kernels allow hald_t self:netlink_socket create_socket_perms; @@ -3600,9 +3609,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. dev_setattr_sound_dev(hald_acl_t) dev_setattr_generic_usb_dev(hald_acl_t) dev_setattr_usbfs_files(hald_acl_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-2.6.4/policy/modules/services/inetd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-2.6.5/policy/modules/services/inetd.te --- nsaserefpolicy/policy/modules/services/inetd.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/inetd.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/inetd.te 2007-05-18 11:59:15.000000000 -0400 @@ -135,8 +135,8 @@ mls_fd_use_all_levels(inetd_t) mls_fd_share_all_levels(inetd_t) @@ -3623,9 +3632,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet files_search_home(inetd_child_t) manage_dirs_pattern(inetd_child_t,inetd_child_tmp_t,inetd_child_tmp_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-2.6.4/policy/modules/services/kerberos.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-2.6.5/policy/modules/services/kerberos.if --- nsaserefpolicy/policy/modules/services/kerberos.if 2007-04-10 13:21:52.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/kerberos.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/kerberos.if 2007-05-18 11:59:15.000000000 -0400 @@ -33,43 +33,10 @@ # interface(`kerberos_use',` @@ -3772,9 +3781,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb - + allow $1 krb5_keytab_t:file read_file_perms; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-2.6.4/policy/modules/services/kerberos.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-2.6.5/policy/modules/services/kerberos.te --- nsaserefpolicy/policy/modules/services/kerberos.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/kerberos.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/kerberos.te 2007-05-18 11:59:15.000000000 -0400 @@ -5,6 +5,7 @@ # # Declarations @@ -3783,7 +3792,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb ## ##

-@@ -248,3 +249,36 @@ +@@ -126,6 +127,7 @@ + miscfiles_read_localization(kadmind_t) + + sysnet_read_config(kadmind_t) ++sysnet_use_ldap(kadmind_t) + + userdom_dontaudit_use_unpriv_user_fds(kadmind_t) + userdom_dontaudit_search_sysadm_home_dirs(kadmind_t) +@@ -227,6 +229,7 @@ + miscfiles_read_localization(krb5kdc_t) + + sysnet_read_config(krb5kdc_t) ++sysnet_use_ldap(krb5kdc_t) + + userdom_dontaudit_use_unpriv_user_fds(krb5kdc_t) + userdom_dontaudit_search_sysadm_home_dirs(krb5kdc_t) +@@ -248,3 +251,36 @@ optional_policy(` udev_read_db(krb5kdc_t) ') @@ -3820,9 +3845,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb + pcscd_stream_connect(kerberosclient) + ') +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-2.6.4/policy/modules/services/mailman.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-2.6.5/policy/modules/services/mailman.if --- nsaserefpolicy/policy/modules/services/mailman.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/mailman.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/mailman.if 2007-05-18 11:59:15.000000000 -0400 @@ -275,6 +275,25 @@ ####################################### @@ -3849,38 +3874,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail ## Allow domain to read mailman archive files. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-2.6.4/policy/modules/services/mta.if ---- nsaserefpolicy/policy/modules/services/mta.if 2007-03-26 10:39:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/mta.if 2007-05-08 09:59:33.000000000 -0400 -@@ -847,6 +847,25 @@ - manage_files_pattern($1,mqueue_spool_t,mqueue_spool_t) - ') - -+######################################## -+##

-+## search mail queue dirs. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`mta_search_queue',` -+ gen_require(` -+ type mqueue_spool_t; -+ ') -+ -+ files_search_spool($1) -+ allow $1 mqueue_spool_t:dir search_dir_perms; -+') -+ - ####################################### - ## - ## Read sendmail binary. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-2.6.4/policy/modules/services/mta.te ---- nsaserefpolicy/policy/modules/services/mta.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/mta.te 2007-05-08 09:59:33.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-2.6.5/policy/modules/services/mta.te +--- nsaserefpolicy/policy/modules/services/mta.te 2007-05-18 11:12:43.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/mta.te 2007-05-18 11:59:15.000000000 -0400 @@ -27,6 +27,7 @@ type sendmail_exec_t; @@ -3897,9 +3893,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. # apache should set close-on-exec apache_dontaudit_append_log(system_mail_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-2.6.4/policy/modules/services/networkmanager.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-2.6.5/policy/modules/services/networkmanager.if --- nsaserefpolicy/policy/modules/services/networkmanager.if 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/networkmanager.if 2007-05-16 08:30:20.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/networkmanager.if 2007-05-18 11:59:15.000000000 -0400 @@ -78,3 +78,22 @@ allow $1 NetworkManager_t:dbus send_msg; allow NetworkManager_t $1:dbus send_msg; @@ -3923,9 +3919,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw + domtrans_pattern($1,NetworkManager_exec_t,NetworkManager_t) + +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-2.6.4/policy/modules/services/nis.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-2.6.5/policy/modules/services/nis.if --- nsaserefpolicy/policy/modules/services/nis.if 2007-03-26 10:39:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nis.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/nis.if 2007-05-18 11:59:15.000000000 -0400 @@ -48,8 +48,8 @@ corenet_udp_bind_all_nodes($1) corenet_tcp_bind_generic_port($1) @@ -3937,9 +3933,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_dontaudit_tcp_bind_all_ports($1) corenet_dontaudit_udp_bind_all_ports($1) corenet_tcp_connect_portmap_port($1) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-2.6.4/policy/modules/services/nis.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-2.6.5/policy/modules/services/nis.te --- nsaserefpolicy/policy/modules/services/nis.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nis.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/nis.te 2007-05-18 11:59:15.000000000 -0400 @@ -120,6 +120,13 @@ ') @@ -3972,9 +3968,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t) corenet_dontaudit_udp_bind_all_reserved_ports(ypxfr_t) corenet_tcp_connect_all_ports(ypxfr_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-2.6.4/policy/modules/services/nscd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-2.6.5/policy/modules/services/nscd.te --- nsaserefpolicy/policy/modules/services/nscd.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/nscd.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/nscd.te 2007-05-18 11:59:15.000000000 -0400 @@ -28,14 +28,14 @@ # Local policy # @@ -4013,9 +4009,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd + ') +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-2.6.4/policy/modules/services/ntp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-2.6.5/policy/modules/services/ntp.te --- nsaserefpolicy/policy/modules/services/ntp.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ntp.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/ntp.te 2007-05-18 11:59:15.000000000 -0400 @@ -137,6 +137,10 @@ ') @@ -4027,9 +4023,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. seutil_sigchld_newrole(ntpd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-2.6.4/policy/modules/services/oddjob.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-2.6.5/policy/modules/services/oddjob.te --- nsaserefpolicy/policy/modules/services/oddjob.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/oddjob.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/oddjob.te 2007-05-18 11:59:15.000000000 -0400 @@ -27,7 +27,7 @@ # oddjob local policy # @@ -4039,9 +4035,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddj allow oddjob_t self:process { setexec signal }; allow oddjob_t self:fifo_file { read write }; allow oddjob_t self:unix_stream_socket create_stream_socket_perms; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.fc serefpolicy-2.6.4/policy/modules/services/openct.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.fc serefpolicy-2.6.5/policy/modules/services/openct.fc --- nsaserefpolicy/policy/modules/services/openct.fc 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/openct.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/openct.fc 2007-05-18 11:59:15.000000000 -0400 @@ -2,6 +2,7 @@ # /usr # @@ -4050,9 +4046,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open # # /var -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.if serefpolicy-2.6.4/policy/modules/services/openct.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.if serefpolicy-2.6.5/policy/modules/services/openct.if --- nsaserefpolicy/policy/modules/services/openct.if 2006-11-16 17:15:20.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/openct.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/openct.if 2007-05-18 11:59:15.000000000 -0400 @@ -1 +1,83 @@ -## Service for handling smart card readers. + @@ -4138,9 +4134,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open + + allow $1 openct_t:process signull; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.te serefpolicy-2.6.4/policy/modules/services/openct.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.te serefpolicy-2.6.5/policy/modules/services/openct.te --- nsaserefpolicy/policy/modules/services/openct.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/openct.te 2007-05-14 13:25:28.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/openct.te 2007-05-18 11:59:15.000000000 -0400 @@ -24,6 +24,8 @@ manage_files_pattern(openct_t,openct_var_run_t,openct_var_run_t) files_pid_filetrans(openct_t,openct_var_run_t,file) @@ -4159,9 +4155,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open domain_use_interactive_fds(openct_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.fc serefpolicy-2.6.4/policy/modules/services/openvpn.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.fc serefpolicy-2.6.5/policy/modules/services/openvpn.fc --- nsaserefpolicy/policy/modules/services/openvpn.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/openvpn.fc 2007-05-14 11:26:36.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/openvpn.fc 2007-05-18 11:59:15.000000000 -0400 @@ -11,5 +11,5 @@ # # /var @@ -4170,9 +4166,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open -/var/run/openvpn.* -- gen_context(system_u:object_r:openvpn_var_run_t,s0) +/var/log/openvpn(/.*)? gen_context(system_u:object_r:openvpn_var_log_t,s0) +/var/run/openvpn(/.*)? gen_context(system_u:object_r:openvpn_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-2.6.4/policy/modules/services/pcscd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-2.6.5/policy/modules/services/pcscd.te --- nsaserefpolicy/policy/modules/services/pcscd.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/pcscd.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/pcscd.te 2007-05-18 11:59:15.000000000 -0400 @@ -21,6 +21,7 @@ # @@ -4195,9 +4191,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcsc ') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-2.6.4/policy/modules/services/pegasus.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-2.6.5/policy/modules/services/pegasus.if --- nsaserefpolicy/policy/modules/services/pegasus.if 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/pegasus.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/pegasus.if 2007-05-18 11:59:15.000000000 -0400 @@ -1 +1,19 @@ ## The Open Group Pegasus CIM/WBEM Server. + @@ -4218,9 +4214,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega + + domtrans_pattern($1,pegasus_exec_t,pegasus_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-2.6.4/policy/modules/services/pegasus.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-2.6.5/policy/modules/services/pegasus.te --- nsaserefpolicy/policy/modules/services/pegasus.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/pegasus.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/pegasus.te 2007-05-18 11:59:15.000000000 -0400 @@ -38,8 +38,6 @@ allow pegasus_t self:unix_stream_socket create_stream_socket_perms; allow pegasus_t self:tcp_socket create_stream_socket_perms; @@ -4262,9 +4258,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-2.6.4/policy/modules/services/postfix.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-2.6.5/policy/modules/services/postfix.if --- nsaserefpolicy/policy/modules/services/postfix.if 2007-03-26 10:39:04.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/postfix.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/postfix.if 2007-05-18 11:59:15.000000000 -0400 @@ -122,6 +122,7 @@ allow postfix_$1_t postfix_master_t:unix_stream_socket { connectto rw_stream_socket_perms }; allow postfix_$1_t self:tcp_socket create_socket_perms; @@ -4296,9 +4292,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post + allow $1 postfix_private_t:dir list_dir_perms; + create_sock_files_pattern($1,postfix_private_t,postfix_private_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-2.6.4/policy/modules/services/postfix.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-2.6.5/policy/modules/services/postfix.te --- nsaserefpolicy/policy/modules/services/postfix.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/postfix.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/postfix.te 2007-05-18 11:59:15.000000000 -0400 @@ -169,6 +169,8 @@ mta_rw_aliases(postfix_master_t) mta_read_sendmail_bin(postfix_master_t) @@ -4408,9 +4404,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post + dovecot_auth_stream_connect(postfix_smtpd_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-2.6.4/policy/modules/services/ppp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-2.6.5/policy/modules/services/ppp.te --- nsaserefpolicy/policy/modules/services/ppp.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ppp.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/ppp.te 2007-05-18 11:59:15.000000000 -0400 @@ -155,7 +155,7 @@ files_exec_etc_files(pppd_t) @@ -4420,9 +4416,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp. files_dontaudit_write_etc_files(pppd_t) # for scripts -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-2.6.4/policy/modules/services/procmail.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-2.6.5/policy/modules/services/procmail.te --- nsaserefpolicy/policy/modules/services/procmail.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/procmail.te 2007-05-17 12:20:51.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/procmail.te 2007-05-18 11:59:15.000000000 -0400 @@ -10,6 +10,7 @@ type procmail_exec_t; domain_type(procmail_t) @@ -4454,9 +4450,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc ') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-2.6.4/policy/modules/services/pyzor.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-2.6.5/policy/modules/services/pyzor.te --- nsaserefpolicy/policy/modules/services/pyzor.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/pyzor.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/pyzor.te 2007-05-18 11:59:15.000000000 -0400 @@ -54,6 +54,11 @@ corenet_udp_sendrecv_all_nodes(pyzor_t) corenet_udp_sendrecv_all_ports(pyzor_t) @@ -4485,9 +4481,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo spamassassin_read_spamd_tmp_files(pyzor_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-2.6.4/policy/modules/services/radius.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-2.6.5/policy/modules/services/radius.te --- nsaserefpolicy/policy/modules/services/radius.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/radius.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/radius.te 2007-05-18 11:59:15.000000000 -0400 @@ -130,3 +130,7 @@ optional_policy(` udev_read_db(radiusd_t) @@ -4496,9 +4492,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi +optional_policy(` + samba_read_var_files(radiusd_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-2.6.4/policy/modules/services/rlogin.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-2.6.5/policy/modules/services/rlogin.te --- nsaserefpolicy/policy/modules/services/rlogin.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rlogin.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/rlogin.te 2007-05-18 11:59:15.000000000 -0400 @@ -64,6 +64,7 @@ fs_search_auto_mountpoints(rlogind_t) @@ -4507,9 +4503,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog auth_rw_login_records(rlogind_t) auth_use_nsswitch(rlogind_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.fc serefpolicy-2.6.4/policy/modules/services/rpcbind.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.fc serefpolicy-2.6.5/policy/modules/services/rpcbind.fc --- nsaserefpolicy/policy/modules/services/rpcbind.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/rpcbind.fc 2007-05-09 19:47:47.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/rpcbind.fc 2007-05-18 11:59:15.000000000 -0400 @@ -0,0 +1,6 @@ + +/sbin/rpcbind -- gen_context(system_u:object_r:rpcbind_exec_t,s0) @@ -4517,9 +4513,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb +/var/run/rpc.statd.pid -- gen_context(system_u:object_r:rpcbind_var_run_t,s0) +/var/run/rpcbind.sock -s gen_context(system_u:object_r:rpcbind_var_run_t,s0) +/var/lib/rpcbind(/.*)? gen_context(system_u:object_r:rpcbind_var_lib_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-2.6.4/policy/modules/services/rpcbind.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.if serefpolicy-2.6.5/policy/modules/services/rpcbind.if --- nsaserefpolicy/policy/modules/services/rpcbind.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/rpcbind.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/rpcbind.if 2007-05-18 11:59:15.000000000 -0400 @@ -0,0 +1,104 @@ + +## policy for rpcbind @@ -4625,9 +4621,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb + allow $1 rpcbind_var_lib_t:dir rw_dir_perms; + files_search_var_lib($1) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-2.6.4/policy/modules/services/rpcbind.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-2.6.5/policy/modules/services/rpcbind.te --- nsaserefpolicy/policy/modules/services/rpcbind.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/rpcbind.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/rpcbind.te 2007-05-18 11:59:15.000000000 -0400 @@ -0,0 +1,83 @@ +policy_module(rpcbind,1.0.0) + @@ -4712,9 +4708,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcb +') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-2.6.4/policy/modules/services/rpc.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-2.6.5/policy/modules/services/rpc.if --- nsaserefpolicy/policy/modules/services/rpc.if 2007-03-20 23:38:10.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rpc.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/rpc.if 2007-05-18 11:59:15.000000000 -0400 @@ -89,8 +89,11 @@ # bind to arbitary unused ports corenet_tcp_bind_generic_port($1_t) @@ -4728,9 +4724,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. fs_rw_rpc_named_pipes($1_t) fs_search_auto_mountpoints($1_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-2.6.4/policy/modules/services/rpc.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-2.6.5/policy/modules/services/rpc.te --- nsaserefpolicy/policy/modules/services/rpc.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rpc.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/rpc.te 2007-05-18 11:59:15.000000000 -0400 @@ -79,6 +79,7 @@ optional_policy(` @@ -4747,9 +4743,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. ') tunable_policy(`nfs_export_all_ro',` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-2.6.4/policy/modules/services/rsync.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-2.6.5/policy/modules/services/rsync.te --- nsaserefpolicy/policy/modules/services/rsync.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rsync.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/rsync.te 2007-05-18 11:59:15.000000000 -0400 @@ -17,6 +17,7 @@ type rsync_t; type rsync_exec_t; @@ -4758,9 +4754,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn role system_r types rsync_t; type rsync_data_t; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-2.6.4/policy/modules/services/rwho.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-2.6.5/policy/modules/services/rwho.if --- nsaserefpolicy/policy/modules/services/rwho.if 2007-04-30 22:35:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/rwho.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/rwho.if 2007-05-18 11:59:15.000000000 -0400 @@ -1 +1,84 @@ -## Who is logged in on other machines? + @@ -4847,9 +4843,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho + allow $1 rwho_spool_t:dir rw_dir_perms; + files_search_spool($1) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-2.6.4/policy/modules/services/samba.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-2.6.5/policy/modules/services/samba.fc --- nsaserefpolicy/policy/modules/services/samba.fc 2007-02-23 16:50:01.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/samba.fc 2007-05-16 08:24:46.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/samba.fc 2007-05-18 11:59:15.000000000 -0400 @@ -3,6 +3,7 @@ # /etc # @@ -4868,9 +4864,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb /var/log/samba(/.*)? gen_context(system_u:object_r:samba_log_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-2.6.4/policy/modules/services/samba.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-2.6.5/policy/modules/services/samba.if --- nsaserefpolicy/policy/modules/services/samba.if 2007-01-02 12:57:43.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/samba.if 2007-05-17 13:05:00.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/samba.if 2007-05-18 11:59:15.000000000 -0400 @@ -177,6 +177,27 @@ ######################################## @@ -5016,9 +5012,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb + allow smbd_t samba_$1_script_exec_t:file ioctl; + +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-2.6.4/policy/modules/services/samba.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-2.6.5/policy/modules/services/samba.te --- nsaserefpolicy/policy/modules/services/samba.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/samba.te 2007-05-17 13:03:49.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/samba.te 2007-05-18 11:59:15.000000000 -0400 @@ -28,6 +28,35 @@ ## gen_tunable(samba_share_nfs,false) @@ -5255,9 +5251,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-2.6.4/policy/modules/services/sasl.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-2.6.5/policy/modules/services/sasl.te --- nsaserefpolicy/policy/modules/services/sasl.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/sasl.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/sasl.te 2007-05-18 11:59:15.000000000 -0400 @@ -63,6 +63,7 @@ selinux_compute_access_vector(saslauthd_t) @@ -5266,48 +5262,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl auth_use_nsswitch(saslauthd_t) domain_use_interactive_fds(saslauthd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-2.6.4/policy/modules/services/sendmail.if ---- nsaserefpolicy/policy/modules/services/sendmail.if 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/sendmail.if 2007-05-08 09:59:33.000000000 -0400 -@@ -76,6 +76,26 @@ - - ######################################## - ## -+## read sendmail logs. -+## -+## -+## -+## Domain allowed access. -+## -+## -+## -+# -+interface(`sendmail_read_log',` -+ gen_require(` -+ type sendmail_log_t; -+ ') -+ -+ logging_search_logs($1) -+ read_files_pattern($1, sendmail_log_t, sendmail_log_t) -+') -+ -+######################################## -+## - ## Create, read, write, and delete sendmail logs. - ## - ## -@@ -91,7 +111,7 @@ - ') - - logging_search_logs($1) -- allow $1 sendmail_log_t:file manage_file_perms; -+ manage_files_pattern($1, sendmail_log_t, sendmail_log_t) - ') - - ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-2.6.4/policy/modules/services/setroubleshoot.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-2.6.5/policy/modules/services/setroubleshoot.te --- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/setroubleshoot.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/setroubleshoot.te 2007-05-18 11:59:15.000000000 -0400 @@ -28,7 +28,7 @@ # @@ -5317,9 +5274,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr allow setroubleshootd_t self:fifo_file rw_fifo_file_perms; allow setroubleshootd_t self:tcp_socket create_stream_socket_perms; allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto }; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-2.6.4/policy/modules/services/smartmon.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-2.6.5/policy/modules/services/smartmon.te --- nsaserefpolicy/policy/modules/services/smartmon.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/smartmon.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/smartmon.te 2007-05-18 11:59:15.000000000 -0400 @@ -60,6 +60,7 @@ fs_search_auto_mountpoints(fsdaemon_t) @@ -5328,44 +5285,46 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar storage_raw_read_fixed_disk(fsdaemon_t) storage_raw_write_fixed_disk(fsdaemon_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-2.6.4/policy/modules/services/snmp.te ---- nsaserefpolicy/policy/modules/services/snmp.te 2007-05-07 10:32:44.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/snmp.te 2007-05-08 09:59:33.000000000 -0400 -@@ -26,7 +26,7 @@ - # Local policy +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-2.6.5/policy/modules/services/snmp.fc +--- nsaserefpolicy/policy/modules/services/snmp.fc 2006-11-16 17:15:20.000000000 -0500 ++++ serefpolicy-2.6.5/policy/modules/services/snmp.fc 2007-05-18 11:59:15.000000000 -0400 +@@ -1,11 +1,5 @@ + # - allow snmpd_t self:capability { dac_override kill net_admin sys_nice sys_tty_config }; --dontaudit snmpd_t self:capability sys_tty_config; -+dontaudit snmpd_t self:capability { sys_module sys_tty_config }; - allow snmpd_t self:fifo_file rw_fifo_file_perms; - allow snmpd_t self:unix_dgram_socket create_socket_perms; - allow snmpd_t self:unix_stream_socket create_stream_socket_perms; -@@ -135,18 +135,19 @@ +-# /etc +-# +- +-/etc/snmp/snmp(trap)?d\.conf -- gen_context(system_u:object_r:snmpd_etc_t,s0) +- +-# + # /usr + # + /usr/sbin/snmp(trap)?d -- gen_context(system_u:object_r:snmpd_exec_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-2.6.5/policy/modules/services/snmp.te +--- nsaserefpolicy/policy/modules/services/snmp.te 2007-05-18 11:12:43.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/snmp.te 2007-05-18 11:59:15.000000000 -0400 +@@ -9,9 +9,6 @@ + type snmpd_exec_t; + init_daemon_domain(snmpd_t,snmpd_exec_t) - optional_policy(` - mta_read_config(snmpd_t) -+ mta_search_queue(snmpd_t) - ') +-type snmpd_etc_t; +-files_config_file(snmpd_etc_t) +- + type snmpd_log_t; + logging_log_file(snmpd_log_t) - optional_policy(` -- nis_use_ypbind(snmpd_t) -+ auth_use_nsswitch(snmpd_t) - ') +@@ -33,8 +30,6 @@ + allow snmpd_t self:tcp_socket create_stream_socket_perms; + allow snmpd_t self:udp_socket connected_stream_socket_perms; - optional_policy(` -- nscd_socket_use(snmpd_t) -+ rpc_search_nfs_state_data(snmpd_t) - ') +-allow snmpd_t snmpd_etc_t:file { getattr read }; +- + allow snmpd_t snmpd_log_t:file manage_file_perms; + logging_log_filetrans(snmpd_t,snmpd_log_t,file) - optional_policy(` -- rpc_search_nfs_state_data(snmpd_t) -+ sendmail_read_log(snmpd_t) - ') - - optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-2.6.4/policy/modules/services/spamassassin.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-2.6.5/policy/modules/services/spamassassin.te --- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/spamassassin.te 2007-05-14 13:42:25.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/spamassassin.te 2007-05-18 11:59:15.000000000 -0400 @@ -6,14 +6,12 @@ # Declarations # @@ -5419,18 +5378,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam nis_use_ypbind(spamd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-2.6.4/policy/modules/services/squid.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-2.6.5/policy/modules/services/squid.fc --- nsaserefpolicy/policy/modules/services/squid.fc 2006-11-16 17:15:21.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/squid.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/squid.fc 2007-05-18 11:59:15.000000000 -0400 @@ -12,3 +12,5 @@ /var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0) /var/spool/squid(/.*)? gen_context(system_u:object_r:squid_cache_t,s0) +/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) +/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-2.6.4/policy/modules/services/squid.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-2.6.5/policy/modules/services/squid.te --- nsaserefpolicy/policy/modules/services/squid.te 2007-05-07 10:32:44.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/squid.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/squid.te 2007-05-18 11:59:15.000000000 -0400 @@ -185,3 +185,12 @@ #squid requires the following when run in diskd mode, the recommended setting allow squid_t tmpfs_t:file { read write }; @@ -5444,9 +5403,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi + sysnet_read_config(httpd_squid_script_t) + corenet_non_ipsec_sendrecv(httpd_squid_script_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-2.6.4/policy/modules/services/ssh.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-2.6.5/policy/modules/services/ssh.if --- nsaserefpolicy/policy/modules/services/ssh.if 2007-04-30 10:41:38.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ssh.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/ssh.if 2007-05-18 11:59:15.000000000 -0400 @@ -709,3 +709,42 @@ dontaudit $1 sshd_key_t:file { getattr read }; @@ -5490,9 +5449,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. + dontaudit $2 $1_ssh_agent_t:fd use; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-2.6.4/policy/modules/services/ssh.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-2.6.5/policy/modules/services/ssh.te --- nsaserefpolicy/policy/modules/services/ssh.te 2007-04-30 10:41:38.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/ssh.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/ssh.te 2007-05-18 11:59:15.000000000 -0400 @@ -24,11 +24,11 @@ # Type for the ssh-agent executable. @@ -5526,9 +5485,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. ifdef(`TODO',` tunable_policy(`ssh_sysadm_login',` # Relabel and access ptys created by sshd -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-2.6.4/policy/modules/services/tftp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-2.6.5/policy/modules/services/tftp.te --- nsaserefpolicy/policy/modules/services/tftp.te 2007-04-23 09:36:01.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/services/tftp.te 2007-05-14 16:13:37.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/tftp.te 2007-05-18 11:59:15.000000000 -0400 @@ -69,6 +69,7 @@ logging_send_syslog_msg(tftpd_t) @@ -5542,20 +5501,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp udev_read_db(tftpd_t) ') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-2.6.4/policy/modules/services/w3c.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-2.6.5/policy/modules/services/w3c.fc --- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/w3c.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/w3c.fc 2007-05-18 11:59:15.000000000 -0400 @@ -0,0 +1,2 @@ +/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0) +/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-2.6.4/policy/modules/services/w3c.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-2.6.5/policy/modules/services/w3c.if --- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/w3c.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/w3c.if 2007-05-18 11:59:15.000000000 -0400 @@ -0,0 +1 @@ +## W3C -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-2.6.4/policy/modules/services/w3c.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-2.6.5/policy/modules/services/w3c.te --- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/services/w3c.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/services/w3c.te 2007-05-18 11:59:15.000000000 -0400 @@ -0,0 +1,14 @@ +policy_module(w3c,1.2.1) + @@ -5571,14 +5530,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c. +corenet_tcp_sendrecv_http_cache_port(httpd_w3c_validator_script_t) + +miscfiles_read_certs(httpd_w3c_validator_script_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.fc serefpolicy-2.6.4/policy/modules/system/application.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.fc serefpolicy-2.6.5/policy/modules/system/application.fc --- nsaserefpolicy/policy/modules/system/application.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/application.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/application.fc 2007-05-18 11:59:15.000000000 -0400 @@ -0,0 +1 @@ +# No application file contexts. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-2.6.4/policy/modules/system/application.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-2.6.5/policy/modules/system/application.if --- nsaserefpolicy/policy/modules/system/application.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/application.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/application.if 2007-05-18 11:59:15.000000000 -0400 @@ -0,0 +1,104 @@ +## Policy for application domains + @@ -5684,9 +5643,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic + application_executable_file($2) + domain_entry_file($1,$2) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-2.6.4/policy/modules/system/application.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-2.6.5/policy/modules/system/application.te --- nsaserefpolicy/policy/modules/system/application.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/application.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/application.te 2007-05-18 11:59:15.000000000 -0400 @@ -0,0 +1,14 @@ + +policy_module(application,1.0.0) @@ -5702,9 +5661,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic + ssh_rw_stream_sockets(application_domain_type) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-2.6.4/policy/modules/system/authlogin.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-2.6.5/policy/modules/system/authlogin.fc --- nsaserefpolicy/policy/modules/system/authlogin.fc 2006-11-16 17:15:24.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/authlogin.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/authlogin.fc 2007-05-18 11:59:15.000000000 -0400 @@ -14,6 +14,7 @@ /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0) /sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) @@ -5713,9 +5672,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ifdef(`distro_suse', ` /sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-2.6.4/policy/modules/system/authlogin.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-2.6.5/policy/modules/system/authlogin.if --- nsaserefpolicy/policy/modules/system/authlogin.if 2007-03-26 10:39:07.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/authlogin.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/authlogin.if 2007-05-18 11:59:15.000000000 -0400 @@ -27,11 +27,9 @@ domain_type($1_chkpwd_t) domain_entry_file($1_chkpwd_t,chkpwd_exec_t) @@ -5978,9 +5937,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + auth_dontaudit_read_shadow($1) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-2.6.4/policy/modules/system/authlogin.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-2.6.5/policy/modules/system/authlogin.te --- nsaserefpolicy/policy/modules/system/authlogin.te 2007-04-30 10:41:38.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/authlogin.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/authlogin.te 2007-05-18 11:59:15.000000000 -0400 @@ -9,6 +9,13 @@ attribute can_read_shadow_passwords; attribute can_write_shadow_passwords; @@ -6043,9 +6002,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +optional_policy(` + nscd_socket_use(updpwd_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.te serefpolicy-2.6.4/policy/modules/system/clock.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.te serefpolicy-2.6.5/policy/modules/system/clock.te --- nsaserefpolicy/policy/modules/system/clock.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/clock.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/clock.te 2007-05-18 11:59:15.000000000 -0400 @@ -26,8 +26,6 @@ allow hwclock_t self:process signal_perms; allow hwclock_t self:fifo_file { getattr read write }; @@ -6063,9 +6022,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock. miscfiles_read_localization(hwclock_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-2.6.4/policy/modules/system/fstools.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-2.6.5/policy/modules/system/fstools.fc --- nsaserefpolicy/policy/modules/system/fstools.fc 2006-11-16 17:15:24.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/fstools.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/fstools.fc 2007-05-18 11:59:15.000000000 -0400 @@ -19,7 +19,6 @@ /sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0) @@ -6074,9 +6033,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool /sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-2.6.4/policy/modules/system/fstools.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-2.6.5/policy/modules/system/fstools.te --- nsaserefpolicy/policy/modules/system/fstools.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/fstools.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/fstools.te 2007-05-18 11:59:15.000000000 -0400 @@ -9,6 +9,7 @@ type fsadm_t; type fsadm_exec_t; @@ -6085,9 +6044,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool role system_r types fsadm_t; type fsadm_log_t; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-2.6.4/policy/modules/system/fusermount.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-2.6.5/policy/modules/system/fusermount.fc --- nsaserefpolicy/policy/modules/system/fusermount.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/fusermount.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/fusermount.fc 2007-05-18 11:59:15.000000000 -0400 @@ -0,0 +1,6 @@ +# fusermount executable will have: +# label: system_u:object_r:fusermount_exec_t @@ -6095,9 +6054,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm +# MCS categories: + +/usr/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-2.6.4/policy/modules/system/fusermount.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-2.6.5/policy/modules/system/fusermount.if --- nsaserefpolicy/policy/modules/system/fusermount.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/fusermount.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/fusermount.if 2007-05-18 11:59:15.000000000 -0400 @@ -0,0 +1,41 @@ +## policy for fusermount + @@ -6141,9 +6100,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm + allow $1 fusermount_t:fd use; +') \ No newline at end of file -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-2.6.4/policy/modules/system/fusermount.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-2.6.5/policy/modules/system/fusermount.te --- nsaserefpolicy/policy/modules/system/fusermount.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/fusermount.te 2007-05-14 15:36:32.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/fusermount.te 2007-05-18 11:59:15.000000000 -0400 @@ -0,0 +1,51 @@ +policy_module(fusermount,1.0.0) + @@ -6196,9 +6155,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm + term_use_console(fusermount_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-2.6.4/policy/modules/system/getty.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-2.6.5/policy/modules/system/getty.te --- nsaserefpolicy/policy/modules/system/getty.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/getty.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/getty.te 2007-05-18 11:59:15.000000000 -0400 @@ -33,7 +33,8 @@ # @@ -6209,9 +6168,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty. dontaudit getty_t self:capability sys_tty_config; allow getty_t self:process { getpgid setpgid getsession signal_perms }; allow getty_t self:fifo_file rw_fifo_file_perms; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-2.6.4/policy/modules/system/hostname.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-2.6.5/policy/modules/system/hostname.te --- nsaserefpolicy/policy/modules/system/hostname.te 2007-01-02 12:57:49.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/hostname.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/hostname.te 2007-05-18 11:59:15.000000000 -0400 @@ -8,8 +8,12 @@ type hostname_t; @@ -6238,9 +6197,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna +optional_policy(` + unconfined_dontaudit_rw_pipes(hostname_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-2.6.4/policy/modules/system/init.if ---- nsaserefpolicy/policy/modules/system/init.if 2007-04-30 10:41:38.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/init.if 2007-05-08 09:59:33.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-2.6.5/policy/modules/system/init.if +--- nsaserefpolicy/policy/modules/system/init.if 2007-05-18 11:12:44.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/init.if 2007-05-18 11:59:15.000000000 -0400 @@ -194,11 +194,14 @@ gen_require(` type initrc_t; @@ -6256,7 +6215,57 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i role system_r types $1; domtrans_pattern(initrc_t,$2,$1) -@@ -1088,7 +1091,7 @@ +@@ -300,6 +303,9 @@ + interface(`init_getpgid',` + gen_require(` + type init_t; ++ ++ # cjp: remove this when init_t decl is moved back to this module ++ attribute direct_run_init; + ') + + allow $1 init_t:process getpgid; +@@ -318,6 +324,9 @@ + interface(`init_signull',` + gen_require(` + type init_t; ++ ++ # cjp: remove this when init_t decl is moved back to this module ++ attribute direct_run_init; + ') + + allow $1 init_t:process signull; +@@ -336,6 +345,9 @@ + interface(`init_sigchld',` + gen_require(` + type init_t; ++ ++ # cjp: remove this when init_t decl is moved back to this module ++ attribute direct_run_init; + ') + + allow $1 init_t:process sigchld; +@@ -354,6 +366,9 @@ + interface(`init_use_fds',` + gen_require(` + type init_t; ++ ++ # cjp: remove this when init_t decl is moved back to this module ++ attribute direct_run_init; + ') + + allow $1 init_t:fd use; +@@ -373,6 +388,9 @@ + interface(`init_dontaudit_use_fds',` + gen_require(` + type init_t; ++ ++ # cjp: remove this when init_t decl is moved back to this module ++ attribute direct_run_init; + ') + + dontaudit $1 init_t:fd use; +@@ -1073,7 +1091,7 @@ ') files_search_tmp($1) @@ -6265,7 +6274,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## -@@ -1269,3 +1272,42 @@ +@@ -1254,3 +1272,42 @@ files_search_pids($1) allow $1 initrc_var_run_t:file manage_file_perms; ') @@ -6308,9 +6317,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i + + allow $1 init_t:process ptrace; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-2.6.4/policy/modules/system/init.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-2.6.5/policy/modules/system/init.te --- nsaserefpolicy/policy/modules/system/init.te 2007-04-30 10:41:38.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/init.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/init.te 2007-05-18 11:59:15.000000000 -0400 @@ -10,13 +10,20 @@ # Declarations # @@ -6408,9 +6417,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-2.6.4/policy/modules/system/ipsec.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-2.6.5/policy/modules/system/ipsec.if --- nsaserefpolicy/policy/modules/system/ipsec.if 2007-03-26 16:24:13.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/ipsec.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/ipsec.if 2007-05-18 11:59:15.000000000 -0400 @@ -114,6 +114,26 @@ ######################################## @@ -6438,9 +6447,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. ## Execute racoon in the racoon domain. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-2.6.4/policy/modules/system/ipsec.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-2.6.5/policy/modules/system/ipsec.te --- nsaserefpolicy/policy/modules/system/ipsec.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/ipsec.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/ipsec.te 2007-05-18 11:59:15.000000000 -0400 @@ -289,6 +289,7 @@ allow racoon_t self:netlink_selinux_socket { bind create read }; allow racoon_t self:udp_socket create_socket_perms; @@ -6449,9 +6458,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. # manage pid file manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-2.6.4/policy/modules/system/iptables.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-2.6.5/policy/modules/system/iptables.te --- nsaserefpolicy/policy/modules/system/iptables.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/iptables.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/iptables.te 2007-05-18 11:59:15.000000000 -0400 @@ -56,6 +56,7 @@ domain_use_interactive_fds(iptables_t) @@ -6468,9 +6477,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl +optional_policy(` + fail2ban_append_log(iptables_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-2.6.4/policy/modules/system/libraries.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-2.6.5/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2007-05-04 12:19:22.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/libraries.fc 2007-05-14 14:18:52.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/libraries.fc 2007-05-18 11:59:15.000000000 -0400 @@ -81,8 +81,8 @@ /opt/cisco-vpnclient/lib/libvpnapi\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) /opt/netbeans(.*/)?jdk.*/linux/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -6499,9 +6508,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar /usr/lib(64)?/(nvidia/)?libGL(core)?\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/fglrx/libGL\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/libGLU\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-2.6.4/policy/modules/system/libraries.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-2.6.5/policy/modules/system/libraries.te --- nsaserefpolicy/policy/modules/system/libraries.te 2007-05-04 12:19:23.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/libraries.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/libraries.te 2007-05-18 11:59:15.000000000 -0400 @@ -62,7 +62,8 @@ manage_dirs_pattern(ldconfig_t,ldconfig_tmp_t,ldconfig_tmp_t) @@ -6520,9 +6529,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-2.6.4/policy/modules/system/locallogin.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-2.6.5/policy/modules/system/locallogin.te --- nsaserefpolicy/policy/modules/system/locallogin.te 2007-03-26 10:39:07.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/locallogin.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/locallogin.te 2007-05-18 11:59:15.000000000 -0400 @@ -48,6 +48,8 @@ allow local_login_t self:msgq create_msgq_perms; allow local_login_t self:msg { send receive }; @@ -6563,9 +6572,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall gpm_getattr_gpmctl(local_login_t) gpm_setattr_gpmctl(local_login_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-2.6.4/policy/modules/system/logging.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-2.6.5/policy/modules/system/logging.if --- nsaserefpolicy/policy/modules/system/logging.if 2007-03-26 10:39:07.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/logging.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/logging.if 2007-05-18 11:59:15.000000000 -0400 @@ -302,6 +302,25 @@ ######################################## @@ -6732,9 +6741,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin + typeattribute $1 can_send_audit_msg; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-2.6.4/policy/modules/system/logging.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-2.6.5/policy/modules/system/logging.te --- nsaserefpolicy/policy/modules/system/logging.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/logging.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/logging.te 2007-05-18 11:59:15.000000000 -0400 @@ -7,10 +7,15 @@ # @@ -6820,9 +6829,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin files_read_etc_runtime_files(syslogd_t) # /initrd is not umounted before minilog starts files_dontaudit_search_isid_type_dirs(syslogd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-2.6.4/policy/modules/system/lvm.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-2.6.5/policy/modules/system/lvm.fc --- nsaserefpolicy/policy/modules/system/lvm.fc 2007-01-02 12:57:49.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/lvm.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/lvm.fc 2007-05-18 11:59:15.000000000 -0400 @@ -15,6 +15,7 @@ # /etc/lvm(/.*)? gen_context(system_u:object_r:lvm_etc_t,s0) @@ -6831,9 +6840,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc /etc/lvm/archive(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0) /etc/lvm/backup(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0) /etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-2.6.4/policy/modules/system/lvm.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-2.6.5/policy/modules/system/lvm.te --- nsaserefpolicy/policy/modules/system/lvm.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/lvm.te 2007-05-14 13:22:54.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/lvm.te 2007-05-18 11:59:15.000000000 -0400 @@ -16,6 +16,7 @@ type lvm_t; type lvm_exec_t; @@ -6879,9 +6888,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te + xen_append_log(lvm_t) + xen_dontaudit_rw_unix_stream_sockets(lvm_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-2.6.4/policy/modules/system/modutils.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-2.6.5/policy/modules/system/modutils.te --- nsaserefpolicy/policy/modules/system/modutils.te 2007-05-02 15:04:46.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/modutils.te 2007-05-16 17:09:16.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/modutils.te 2007-05-18 11:59:15.000000000 -0400 @@ -102,6 +102,7 @@ init_use_fds(insmod_t) init_use_script_fds(insmod_t) @@ -6921,18 +6930,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti fs_getattr_xattr_fs(depmod_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-2.6.4/policy/modules/system/mount.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-2.6.5/policy/modules/system/mount.fc --- nsaserefpolicy/policy/modules/system/mount.fc 2006-11-16 17:15:24.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/mount.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/mount.fc 2007-05-18 11:59:15.000000000 -0400 @@ -1,4 +1,3 @@ /bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) - -/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) +/sbin/mount.ntfs-3g -- gen_context(system_u:object_r:mount_ntfs_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-2.6.4/policy/modules/system/mount.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-2.6.5/policy/modules/system/mount.if --- nsaserefpolicy/policy/modules/system/mount.if 2007-01-02 12:57:49.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/mount.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/mount.if 2007-05-18 11:59:15.000000000 -0400 @@ -143,3 +143,40 @@ mount_domtrans($1) ') @@ -6974,9 +6983,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. + + allow $1 mount_ntfs_t:unix_stream_socket { read write }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-2.6.4/policy/modules/system/mount.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-2.6.5/policy/modules/system/mount.te --- nsaserefpolicy/policy/modules/system/mount.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/mount.te 2007-05-14 15:36:25.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/mount.te 2007-05-18 11:59:15.000000000 -0400 @@ -9,6 +9,13 @@ ifdef(`targeted_policy',` ## @@ -7085,9 +7094,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. + term_use_generic_ptys(mount_ntfs_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-2.6.4/policy/modules/system/netlabel.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-2.6.5/policy/modules/system/netlabel.te --- nsaserefpolicy/policy/modules/system/netlabel.te 2006-11-16 17:15:24.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/netlabel.te 2007-05-15 21:07:39.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/netlabel.te 2007-05-18 11:59:15.000000000 -0400 @@ -20,6 +20,10 @@ allow netlabel_mgmt_t self:capability net_admin; allow netlabel_mgmt_t self:netlink_socket create_socket_perms; @@ -7099,9 +7108,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlab kernel_read_network_state(netlabel_mgmt_t) libs_use_ld_so(netlabel_mgmt_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-2.6.4/policy/modules/system/raid.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-2.6.5/policy/modules/system/raid.te --- nsaserefpolicy/policy/modules/system/raid.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/raid.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/raid.te 2007-05-21 13:31:21.000000000 -0400 +@@ -19,7 +19,7 @@ + # Local policy + # + +-allow mdadm_t self:capability { dac_override sys_admin ipc_lock }; ++allow mdadm_t self:capability { dac_override mknod sys_admin ipc_lock }; + dontaudit mdadm_t self:capability sys_tty_config; + allow mdadm_t self:process { sigchld sigkill sigstop signull signal }; + allow mdadm_t self:fifo_file rw_fifo_file_perms; @@ -46,6 +46,7 @@ # RAID block device access storage_manage_fixed_disk(mdadm_t) @@ -7110,9 +7128,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t term_dontaudit_list_ptys(mdadm_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-2.6.4/policy/modules/system/selinuxutil.fc ---- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2006-11-16 17:15:24.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.fc 2007-05-08 09:59:33.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-2.6.5/policy/modules/system/selinuxutil.fc +--- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2007-05-18 11:12:44.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/selinuxutil.fc 2007-05-18 11:59:15.000000000 -0400 @@ -40,6 +40,7 @@ /usr/sbin/setfiles.* -- gen_context(system_u:object_r:setfiles_exec_t,s0) /usr/sbin/setsebool -- gen_context(system_u:object_r:semanage_exec_t,s0) @@ -7121,10 +7139,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu /usr/sbin/semodule -- gen_context(system_u:object_r:semanage_exec_t,s0) # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-2.6.4/policy/modules/system/selinuxutil.if ---- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-03-26 10:39:07.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.if 2007-05-08 09:59:33.000000000 -0400 -@@ -445,6 +445,7 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-2.6.5/policy/modules/system/selinuxutil.if +--- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-05-18 11:12:44.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/selinuxutil.if 2007-05-18 11:59:15.000000000 -0400 +@@ -432,6 +432,7 @@ role $2 types run_init_t; allow run_init_t $3:chr_file rw_term_perms; allow $2 system_r; @@ -7132,38 +7150,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ') ######################################## -@@ -616,7 +617,7 @@ - gen_require(` - type selinux_config_t; - ') -- -+ selinux_dontaudit_getattr_fs($1) - dontaudit $1 selinux_config_t:dir search; - dontaudit $1 selinux_config_t:file { getattr read }; - ') -@@ -637,6 +638,8 @@ - type selinux_config_t; - ') - -+ selinux_getattr_fs($1) -+ - files_search_etc($1) - allow $1 selinux_config_t:dir list_dir_perms; - read_files_pattern($1,selinux_config_t,selinux_config_t) -@@ -682,6 +685,7 @@ - ') - - files_search_etc($1) -+ allow $1 selinux_config_t:dir rmdir; - manage_files_pattern($1,selinux_config_t,selinux_config_t) - read_lnk_files_pattern($1,selinux_config_t,selinux_config_t) - ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-2.6.4/policy/modules/system/selinuxutil.te ---- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/selinuxutil.te 2007-05-11 18:23:21.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-2.6.5/policy/modules/system/selinuxutil.te +--- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-05-18 11:12:44.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/selinuxutil.te 2007-05-18 11:59:15.000000000 -0400 @@ -1,10 +1,8 @@ - policy_module(selinuxutil,1.5.0) + policy_module(selinuxutil,1.5.1) -ifdef(`strict_policy',` - gen_require(` @@ -7188,14 +7180,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu # # default_context_t is the type applied to -@@ -83,31 +79,34 @@ - type restorecon_exec_t; - domain_obj_id_change_exemption(restorecon_t) - init_system_domain(restorecon_t,restorecon_exec_t) -+application_domain(restorecon_t,restorecon_exec_t) - role system_r types restorecon_t; - - type restorecond_t; +@@ -83,25 +79,27 @@ type restorecond_exec_t; init_daemon_domain(restorecond_t,restorecond_exec_t) domain_obj_id_change_exemption(restorecond_t) @@ -7230,7 +7215,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu type semanage_store_t; files_type(semanage_store_t) -@@ -195,6 +194,7 @@ +@@ -115,9 +113,12 @@ + files_type(semanage_trans_lock_t) + + type setfiles_t alias restorecon_t, can_relabelto_binary_policy; +-type setfiles_exec_t alias restorecon_exec_t; +-init_system_domain(setfiles_t,setfiles_exec_t) + domain_obj_id_change_exemption(setfiles_t) ++domain_type(setfiles_t) ++role system_r types setfiles_t; ++ ++type setfiles_exec_t; ++domain_entry_file(setfiles_t,setfiles_exec_t) + + ifdef(`distro_redhat',` + init_system_domain(setfiles_t,setfiles_exec_t) +@@ -186,6 +187,7 @@ fs_getattr_xattr_fs(load_policy_t) mls_file_read_up(load_policy_t) @@ -7238,7 +7238,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu selinux_get_fs_mount(load_policy_t) selinux_load_policy(load_policy_t) -@@ -217,7 +217,7 @@ +@@ -208,7 +210,7 @@ # cjp: cover up stray file descriptors. dontaudit load_policy_t selinux_config_t:file write; optional_policy(` @@ -7247,7 +7247,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu ') ') -@@ -243,7 +243,7 @@ +@@ -234,7 +236,7 @@ allow newrole_t self:msg { send receive }; allow newrole_t self:unix_dgram_socket sendto; allow newrole_t self:unix_stream_socket { create_stream_socket_perms connectto }; @@ -7256,7 +7256,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu read_files_pattern(newrole_t,selinux_config_t,selinux_config_t) read_lnk_files_pattern(newrole_t,selinux_config_t,selinux_config_t) -@@ -281,6 +281,7 @@ +@@ -272,6 +274,7 @@ term_dontaudit_use_unallocated_ttys(newrole_t) auth_domtrans_chk_passwd(newrole_t) @@ -7264,7 +7264,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu auth_rw_faillog(newrole_t) corecmd_list_bin(newrole_t) -@@ -310,15 +311,13 @@ +@@ -301,15 +304,13 @@ userdom_dontaudit_search_all_users_home_content(newrole_t) userdom_search_all_users_home_dirs(newrole_t) @@ -7287,22 +7287,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu tunable_policy(`allow_polyinstantiation',` files_polyinstantiate_all(newrole_t) -@@ -426,6 +425,14 @@ - hotplug_use_fds(restorecon_t) - ') - -+optional_policy(` -+ rpm_dontaudit_rw_tmp_files(restorecon_t) -+') -+ -+optional_policy(` -+ xen_dontaudit_use_fds(restorecon_t) -+') -+ - ######################################## - # - # Restorecond local policy -@@ -490,7 +497,7 @@ +@@ -387,7 +388,7 @@ allow run_init_t self:process setexec; allow run_init_t self:capability setuid; allow run_init_t self:fifo_file rw_file_perms; @@ -7311,7 +7296,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu # often the administrator runs such programs from a directory that is owned # by a different user or has restrictive SE permissions, do not want to audit -@@ -504,6 +511,7 @@ +@@ -401,6 +402,7 @@ term_dontaudit_list_ptys(run_init_t) auth_domtrans_chk_passwd(run_init_t) @@ -7319,7 +7304,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu auth_dontaudit_read_shadow(run_init_t) corecmd_exec_bin(run_init_t) -@@ -560,7 +568,7 @@ +@@ -457,7 +459,7 @@ allow semanage_t self:capability { dac_override audit_write }; allow semanage_t self:unix_stream_socket create_stream_socket_perms; allow semanage_t self:unix_dgram_socket create_socket_perms; @@ -7328,7 +7313,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu allow semanage_t policy_config_t:file { read write }; -@@ -571,7 +579,10 @@ +@@ -468,7 +470,10 @@ kernel_read_system_state(semanage_t) kernel_read_kernel_sysctls(semanage_t) @@ -7339,7 +7324,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu dev_read_urand(semanage_t) -@@ -621,6 +632,15 @@ +@@ -518,6 +523,15 @@ userdom_search_sysadm_home_dirs(semanage_t) @@ -7355,19 +7340,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu # cjp: need a more general way to handle this: ifdef(`enable_mls',` # read secadm tmp files -@@ -700,6 +720,8 @@ - ifdef(`hide_broken_symptoms',` - # cjp: cover up stray file descriptors. - optional_policy(` -- unconfined_dontaudit_read_pipes(setfiles_t) -+ unconfined_dontaudit_rw_pipes(setfiles_t) - ') - ') -+ -+ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-2.6.4/policy/modules/system/sysnetwork.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-2.6.5/policy/modules/system/sysnetwork.te --- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/sysnetwork.te 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/sysnetwork.te 2007-05-18 11:59:15.000000000 -0400 @@ -164,6 +164,10 @@ dbus_connect_system_bus(dhcpc_t) dbus_send_system_bus(dhcpc_t) @@ -7383,13 +7358,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet optional_policy(` seutil_sigchld_newrole(dhcpc_t) seutil_dontaudit_search_config(dhcpc_t) -+ seutil_domtrans_restorecon(dhcpc_t) ++ seutil_domtrans_setfiles(dhcpc_t) ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-2.6.4/policy/modules/system/udev.te ---- nsaserefpolicy/policy/modules/system/udev.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/udev.te 2007-05-11 18:19:28.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-2.6.5/policy/modules/system/udev.te +--- nsaserefpolicy/policy/modules/system/udev.te 2007-05-18 11:12:44.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/udev.te 2007-05-18 11:59:15.000000000 -0400 @@ -83,12 +83,19 @@ kernel_dgram_send(udev_t) kernel_signal(udev_t) @@ -7435,18 +7410,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t ') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-2.6.4/policy/modules/system/unconfined.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-2.6.5/policy/modules/system/unconfined.fc --- nsaserefpolicy/policy/modules/system/unconfined.fc 2007-02-19 11:32:53.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/unconfined.fc 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/unconfined.fc 2007-05-18 11:59:15.000000000 -0400 @@ -10,4 +10,5 @@ /usr/bin/valgrind -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) /usr/local/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) /usr/lib/ia32el/ia32x_loader -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) +/usr/bin/vmware.* -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-2.6.4/policy/modules/system/unconfined.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-2.6.5/policy/modules/system/unconfined.if --- nsaserefpolicy/policy/modules/system/unconfined.if 2007-02-19 11:32:53.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/unconfined.if 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/unconfined.if 2007-05-18 11:59:15.000000000 -0400 @@ -18,7 +18,7 @@ ') @@ -7471,15 +7446,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf kernel_unconfined($1) corenet_unconfined($1) -@@ -61,7 +61,6 @@ - # auditallow $1 self:process execstack; - ') - -- - optional_policy(` - auth_unconfined($1) - ') -@@ -78,6 +77,10 @@ +@@ -78,6 +78,10 @@ ') optional_policy(` @@ -7490,7 +7457,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf nscd_unconfined($1) ') -@@ -556,3 +559,22 @@ +@@ -556,3 +560,22 @@ allow $1 unconfined_t:dbus acquire_svc; ') @@ -7513,9 +7480,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf + allow $1 unconfined_t:process ptrace; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-2.6.4/policy/modules/system/unconfined.te ---- nsaserefpolicy/policy/modules/system/unconfined.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/unconfined.te 2007-05-16 08:28:37.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-2.6.5/policy/modules/system/unconfined.te +--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-05-18 11:12:44.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/unconfined.te 2007-05-18 11:59:15.000000000 -0400 @@ -6,6 +6,15 @@ # Declarations # @@ -7598,9 +7565,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf dbus_stub(unconfined_execmem_t) init_dbus_chat_script(unconfined_execmem_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-2.6.4/policy/modules/system/userdomain.if ---- nsaserefpolicy/policy/modules/system/userdomain.if 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/userdomain.if 2007-05-08 09:59:33.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-2.6.5/policy/modules/system/userdomain.if +--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-05-18 11:12:44.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/userdomain.if 2007-05-18 11:59:15.000000000 -0400 @@ -114,6 +114,18 @@ # Allow making the stack executable via mprotect. allow $1_t self:process execstack; @@ -7721,7 +7688,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo kernel_read_software_raid_state($1_t) kernel_getattr_core_if($1_t) kernel_getattr_message_if($1_t) -@@ -1353,11 +1386,7 @@ +@@ -1352,11 +1385,7 @@ ## # template(`userdom_role_change_generic_user',` @@ -7734,7 +7701,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1384,11 +1413,7 @@ +@@ -1383,11 +1412,7 @@ ## # template(`userdom_role_change_from_generic_user',` @@ -7747,7 +7714,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1414,11 +1439,7 @@ +@@ -1413,11 +1438,7 @@ ## # template(`userdom_role_change_staff',` @@ -7760,7 +7727,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1445,11 +1466,7 @@ +@@ -1444,11 +1465,7 @@ ## # template(`userdom_role_change_from_staff',` @@ -7773,7 +7740,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1475,11 +1492,7 @@ +@@ -1474,11 +1491,7 @@ ## # template(`userdom_role_change_sysadm',` @@ -7786,7 +7753,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1506,11 +1519,7 @@ +@@ -1505,11 +1518,7 @@ ## # template(`userdom_role_change_from_sysadm',` @@ -7799,7 +7766,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1698,13 +1707,11 @@ +@@ -1697,13 +1706,11 @@ ## # template(`userdom_setattr_user_ptys',` @@ -7817,7 +7784,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -1733,13 +1740,11 @@ +@@ -1732,13 +1739,11 @@ ## # template(`userdom_create_user_pty',` @@ -7835,7 +7802,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -3624,13 +3629,12 @@ +@@ -3623,13 +3628,12 @@ template(`userdom_setattr_user_ttys',` ifdef(`targeted_policy',` term_setattr_unallocated_ttys($2) @@ -7854,7 +7821,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -3661,13 +3665,12 @@ +@@ -3660,13 +3664,12 @@ template(`userdom_use_user_ttys',` ifdef(`targeted_policy',` term_use_unallocated_ttys($2) @@ -7873,7 +7840,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -3696,18 +3699,13 @@ +@@ -3695,18 +3698,13 @@ ## # template(`userdom_use_user_terminals',` @@ -7898,7 +7865,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5353,14 +5351,13 @@ +@@ -5352,14 +5350,13 @@ interface(`userdom_use_unpriv_users_ptys',` ifdef(`targeted_policy',` term_use_generic_ptys($1) @@ -7919,7 +7886,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5377,13 +5374,13 @@ +@@ -5376,13 +5373,13 @@ interface(`userdom_dontaudit_use_unpriv_users_ptys',` ifdef(`targeted_policy',` term_dontaudit_use_generic_ptys($1) @@ -7938,7 +7905,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5436,13 +5433,12 @@ +@@ -5435,13 +5432,12 @@ interface(`userdom_list_unpriv_users_tmp',` ifdef(`targeted_policy',` files_list_tmp($1) @@ -7957,7 +7924,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5458,13 +5454,12 @@ +@@ -5457,13 +5453,12 @@ interface(`userdom_read_unpriv_users_tmp_files',` ifdef(`targeted_policy',` files_read_generic_tmp_files($1) @@ -7976,7 +7943,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5480,13 +5475,12 @@ +@@ -5479,13 +5474,12 @@ interface(`userdom_read_unpriv_users_tmp_symlinks',` ifdef(`targeted_policy',` files_read_generic_tmp_symlinks($1) @@ -7995,7 +7962,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5520,13 +5514,12 @@ +@@ -5519,13 +5513,12 @@ interface(`userdom_use_unpriv_users_ttys',` ifdef(`targeted_policy',` term_use_unallocated_ttys($1) @@ -8014,7 +7981,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5543,13 +5536,12 @@ +@@ -5542,13 +5535,12 @@ interface(`userdom_dontaudit_use_unpriv_users_ttys',` ifdef(`targeted_policy',` term_dontaudit_use_unallocated_ttys($1) @@ -8033,7 +8000,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5721,3 +5713,112 @@ +@@ -5720,3 +5712,112 @@ allow $1 user_home_dir_t:dir manage_dir_perms; files_home_filetrans($1,user_home_dir_t,dir) ') @@ -8146,9 +8113,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + allow $1 userdomain:process ptrace; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-2.6.4/policy/modules/system/userdomain.te ---- nsaserefpolicy/policy/modules/system/userdomain.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/userdomain.te 2007-05-08 09:59:33.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-2.6.5/policy/modules/system/userdomain.te +--- nsaserefpolicy/policy/modules/system/userdomain.te 2007-05-18 11:12:44.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/userdomain.te 2007-05-18 11:59:15.000000000 -0400 @@ -15,7 +15,6 @@ # Declarations # @@ -8325,9 +8292,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo +tunable_policy(`allow_console_login', ` + term_use_console(userdomain) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-2.6.4/policy/modules/system/xen.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-2.6.5/policy/modules/system/xen.if --- nsaserefpolicy/policy/modules/system/xen.if 2007-01-02 12:57:49.000000000 -0500 -+++ serefpolicy-2.6.4/policy/modules/system/xen.if 2007-05-14 15:38:19.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/xen.if 2007-05-18 11:59:15.000000000 -0400 @@ -72,12 +72,35 @@ ') @@ -8390,9 +8357,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if + read_files_pattern($1,xen_image_t,xen_image_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-2.6.4/policy/modules/system/xen.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-2.6.5/policy/modules/system/xen.te --- nsaserefpolicy/policy/modules/system/xen.te 2007-04-23 09:36:02.000000000 -0400 -+++ serefpolicy-2.6.4/policy/modules/system/xen.te 2007-05-14 15:40:20.000000000 -0400 ++++ serefpolicy-2.6.5/policy/modules/system/xen.te 2007-05-18 11:59:15.000000000 -0400 @@ -25,6 +25,10 @@ domain_type(xend_t) init_daemon_domain(xend_t, xend_exec_t) @@ -8496,9 +8463,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te +fs_read_nfs_files(xend_t) +fs_getattr_all_fs(xend_t) +fs_read_dos_files(xend_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-2.6.4/policy/support/misc_patterns.spt +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns.spt serefpolicy-2.6.5/policy/support/misc_patterns.spt --- nsaserefpolicy/policy/support/misc_patterns.spt 2007-01-02 12:57:51.000000000 -0500 -+++ serefpolicy-2.6.4/policy/support/misc_patterns.spt 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/policy/support/misc_patterns.spt 2007-05-18 11:59:15.000000000 -0400 @@ -41,11 +41,6 @@ # # Other process permissions @@ -8511,9 +8478,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/misc_patterns define(`ps_process_pattern',` allow $1 $2:dir { search getattr read }; allow $1 $2:{ file lnk_file } { read getattr }; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-2.6.4/policy/support/obj_perm_sets.spt +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-2.6.5/policy/support/obj_perm_sets.spt --- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-05-04 12:19:23.000000000 -0400 -+++ serefpolicy-2.6.4/policy/support/obj_perm_sets.spt 2007-05-16 14:13:26.000000000 -0400 ++++ serefpolicy-2.6.5/policy/support/obj_perm_sets.spt 2007-05-18 11:59:15.000000000 -0400 @@ -203,7 +203,6 @@ define(`add_entry_dir_perms',`{ getattr search lock ioctl write add_name }') define(`del_entry_dir_perms',`{ getattr search lock ioctl write remove_name }') @@ -8545,9 +8512,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets +define(`all_association', `{ sendto recvfrom setcontext polmatch } ') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-2.6.4/Rules.modular +diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-2.6.5/Rules.modular --- nsaserefpolicy/Rules.modular 2007-03-22 14:30:10.000000000 -0400 -+++ serefpolicy-2.6.4/Rules.modular 2007-05-08 09:59:33.000000000 -0400 ++++ serefpolicy-2.6.5/Rules.modular 2007-05-18 11:59:15.000000000 -0400 @@ -167,7 +167,7 @@ # these have to run individually because order matters: $(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true diff --git a/selinux-policy.spec b/selinux-policy.spec index e0b3c929..f559dc00 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -16,12 +16,12 @@ %define CHECKPOLICYVER 2.0.1-2 Summary: SELinux policy configuration Name: selinux-policy -Version: 2.6.4 -Release: 6%{?dist} +Version: 2.6.5 +Release: 1%{?dist} License: GPL Group: System Environment/Base Source: serefpolicy-%{version}.tgz -patch: policy-20070501.patch +patch: policy-20070518.patch Source1: modules-targeted.conf Source2: booleans-targeted.conf Source3: Makefile.devel @@ -168,7 +168,7 @@ fi; %description SELinux Reference Policy - modular. -Based off of reference policy: Checked out revision 2282. +Based off of reference policy: Checked out revision 2300. %prep %setup -q -n serefpolicy-%{version} @@ -359,6 +359,11 @@ semodule -b base.pp -r bootloader -r clock -r dpkg -r fstools -r hotplug -r init %endif %changelog +* Fri May 18 2007 Dan Walsh 2.6.5-1 + +* Fri May 18 2007 Dan Walsh 2.6.4-7 +- Allow kerberos servers to use ldap for backing store + * Thu May 17 2007 Dan Walsh 2.6.4-6 - allow alsactl to read kernel state diff --git a/sources b/sources index 190097aa..4ad9163a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -035120385d3629c367967f20db3f9cd6 serefpolicy-2.6.4.tgz +15d095e645523b8d4aa36ee2f4093a2f serefpolicy-2.6.5.tgz