- Remove polkit_auth on upgrades
This commit is contained in:
Daniel J Walsh
parent
42f9effee7
commit
38d427a08f
@ -8860,7 +8860,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.6.28/policy/modules/services/apache.fc
|
||||
--- nsaserefpolicy/policy/modules/services/apache.fc 2009-07-14 14:19:57.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/apache.fc 2009-08-21 18:56:07.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/apache.fc 2009-08-28 09:13:49.000000000 -0400
|
||||
@@ -1,12 +1,13 @@
|
||||
-HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0)
|
||||
+HOME_DIR/((www)|(web)|(public_html)|(public_git))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0)
|
||||
@ -8923,15 +8923,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
/var/log/apache(2)?(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
|
||||
/var/log/apache-ssl(2)?(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
|
||||
/var/log/cacti(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
|
||||
@@ -64,11 +74,30 @@
|
||||
@@ -64,11 +74,32 @@
|
||||
/var/run/apache.* gen_context(system_u:object_r:httpd_var_run_t,s0)
|
||||
/var/run/gcache_port -s gen_context(system_u:object_r:httpd_var_run_t,s0)
|
||||
/var/run/httpd.* gen_context(system_u:object_r:httpd_var_run_t,s0)
|
||||
+/var/run/lighttpd(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0)
|
||||
+/var/run/mod_.* gen_context(system_u:object_r:httpd_var_run_t,s0)
|
||||
+/var/run/wsgi.* -s gen_context(system_u:object_r:httpd_var_run_t,s0)
|
||||
|
||||
/var/spool/gosa(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t,s0)
|
||||
/var/spool/squirrelmail(/.*)? gen_context(system_u:object_r:squirrelmail_spool_t,s0)
|
||||
+/var/spool/viewvc(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t, s0)
|
||||
|
||||
/var/www(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
|
||||
/var/www/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0)
|
||||
@ -9458,7 +9460,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
')
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.6.28/policy/modules/services/apache.te
|
||||
--- nsaserefpolicy/policy/modules/services/apache.te 2009-08-14 16:14:31.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/apache.te 2009-08-21 18:56:07.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/apache.te 2009-08-28 09:18:45.000000000 -0400
|
||||
@@ -19,6 +19,8 @@
|
||||
# Declarations
|
||||
#
|
||||
@ -12397,7 +12399,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+')
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.6.28/policy/modules/services/hal.te
|
||||
--- nsaserefpolicy/policy/modules/services/hal.te 2009-08-14 16:14:31.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/hal.te 2009-08-21 18:56:07.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/hal.te 2009-08-27 09:10:31.000000000 -0400
|
||||
@@ -55,6 +55,9 @@
|
||||
type hald_var_lib_t;
|
||||
files_type(hald_var_lib_t)
|
||||
@ -12428,18 +12430,19 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
files_getattr_all_mountpoints(hald_t)
|
||||
|
||||
mls_file_read_all_levels(hald_t)
|
||||
@@ -202,8 +211,9 @@
|
||||
@@ -202,8 +211,10 @@
|
||||
seutil_read_default_contexts(hald_t)
|
||||
seutil_read_file_contexts(hald_t)
|
||||
|
||||
-sysnet_read_config(hald_t)
|
||||
sysnet_domtrans_dhcpc(hald_t)
|
||||
+sysnet_domtrans_ifconfig(hald_t)
|
||||
+sysnet_read_config(hald_t)
|
||||
+sysnet_read_dhcp_config(hald_t)
|
||||
|
||||
userdom_dontaudit_use_unpriv_user_fds(hald_t)
|
||||
userdom_dontaudit_search_user_home_dirs(hald_t)
|
||||
@@ -290,6 +300,7 @@
|
||||
@@ -290,6 +301,7 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -12447,7 +12450,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
policykit_domtrans_auth(hald_t)
|
||||
policykit_domtrans_resolve(hald_t)
|
||||
policykit_read_lib(hald_t)
|
||||
@@ -321,6 +332,10 @@
|
||||
@@ -321,6 +333,10 @@
|
||||
virt_manage_images(hald_t)
|
||||
')
|
||||
|
||||
@ -12458,7 +12461,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
########################################
|
||||
#
|
||||
# Hal acl local policy
|
||||
@@ -341,6 +356,7 @@
|
||||
@@ -341,6 +357,7 @@
|
||||
manage_dirs_pattern(hald_acl_t, hald_var_run_t, hald_var_run_t)
|
||||
manage_files_pattern(hald_acl_t, hald_var_run_t, hald_var_run_t)
|
||||
files_pid_filetrans(hald_acl_t, hald_var_run_t, { dir file })
|
||||
@ -12466,7 +12469,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
corecmd_exec_bin(hald_acl_t)
|
||||
|
||||
@@ -357,6 +373,8 @@
|
||||
@@ -357,6 +374,8 @@
|
||||
files_read_usr_files(hald_acl_t)
|
||||
files_read_etc_files(hald_acl_t)
|
||||
|
||||
@ -12475,7 +12478,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
storage_getattr_removable_dev(hald_acl_t)
|
||||
storage_setattr_removable_dev(hald_acl_t)
|
||||
storage_getattr_fixed_disk_dev(hald_acl_t)
|
||||
@@ -369,6 +387,7 @@
|
||||
@@ -369,6 +388,7 @@
|
||||
miscfiles_read_localization(hald_acl_t)
|
||||
|
||||
optional_policy(`
|
||||
@ -12483,7 +12486,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
policykit_domtrans_auth(hald_acl_t)
|
||||
policykit_read_lib(hald_acl_t)
|
||||
policykit_read_reload(hald_acl_t)
|
||||
@@ -450,12 +469,16 @@
|
||||
@@ -450,12 +470,16 @@
|
||||
|
||||
miscfiles_read_localization(hald_keymap_t)
|
||||
|
||||
@ -12502,7 +12505,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
allow hald_dccm_t self:process getsched;
|
||||
allow hald_dccm_t self:tcp_socket create_stream_socket_perms;
|
||||
allow hald_dccm_t self:udp_socket create_socket_perms;
|
||||
@@ -469,10 +492,22 @@
|
||||
@@ -469,10 +493,22 @@
|
||||
manage_files_pattern(hald_dccm_t, hald_var_lib_t, hald_var_lib_t)
|
||||
files_search_var_lib(hald_dccm_t)
|
||||
|
||||
@ -12525,7 +12528,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
corenet_all_recvfrom_unlabeled(hald_dccm_t)
|
||||
corenet_all_recvfrom_netlabel(hald_dccm_t)
|
||||
corenet_tcp_sendrecv_generic_if(hald_dccm_t)
|
||||
@@ -484,6 +519,7 @@
|
||||
@@ -484,6 +520,7 @@
|
||||
corenet_tcp_bind_generic_node(hald_dccm_t)
|
||||
corenet_udp_bind_generic_node(hald_dccm_t)
|
||||
corenet_udp_bind_dhcpc_port(hald_dccm_t)
|
||||
@ -12533,7 +12536,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
corenet_tcp_bind_dccm_port(hald_dccm_t)
|
||||
|
||||
logging_send_syslog_msg(hald_dccm_t)
|
||||
@@ -491,3 +527,7 @@
|
||||
@@ -491,3 +528,7 @@
|
||||
files_read_usr_files(hald_dccm_t)
|
||||
|
||||
miscfiles_read_localization(hald_dccm_t)
|
||||
@ -17395,8 +17398,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+')
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.6.28/policy/modules/services/smartmon.te
|
||||
--- nsaserefpolicy/policy/modules/services/smartmon.te 2009-08-14 16:14:31.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/smartmon.te 2009-08-23 09:52:51.000000000 -0400
|
||||
@@ -19,6 +19,10 @@
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/smartmon.te 2009-08-27 15:54:54.000000000 -0400
|
||||
@@ -19,14 +19,18 @@
|
||||
type fsdaemon_tmp_t;
|
||||
files_tmp_file(fsdaemon_tmp_t)
|
||||
|
||||
@ -17407,9 +17410,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
########################################
|
||||
#
|
||||
# Local policy
|
||||
@@ -26,7 +30,7 @@
|
||||
#
|
||||
|
||||
allow fsdaemon_t self:capability { setgid sys_rawio sys_admin };
|
||||
-allow fsdaemon_t self:capability { setgid sys_rawio sys_admin };
|
||||
+allow fsdaemon_t self:capability { setpcap setgid sys_rawio sys_admin };
|
||||
dontaudit fsdaemon_t self:capability sys_tty_config;
|
||||
-allow fsdaemon_t self:process signal_perms;
|
||||
+allow fsdaemon_t self:process { getcap setcap signal_perms setfscreate };
|
||||
@ -17424,9 +17428,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
dev_read_sysfs(fsdaemon_t)
|
||||
dev_read_urand(fsdaemon_t)
|
||||
|
||||
@@ -67,9 +72,11 @@
|
||||
@@ -66,10 +71,13 @@
|
||||
fs_search_auto_mountpoints(fsdaemon_t)
|
||||
|
||||
mls_file_read_all_levels(fsdaemon_t)
|
||||
+mls_rangetrans_target(fsdaemon_t)
|
||||
|
||||
+storage_dev_filetrans_fixed_disk(fsdaemon_t)
|
||||
storage_raw_read_fixed_disk(fsdaemon_t)
|
||||
@ -17436,7 +17442,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
term_dontaudit_search_ptys(fsdaemon_t)
|
||||
|
||||
@@ -80,6 +87,8 @@
|
||||
@@ -80,6 +88,8 @@
|
||||
|
||||
miscfiles_read_localization(fsdaemon_t)
|
||||
|
||||
@ -17445,7 +17451,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
sysnet_dns_name_resolve(fsdaemon_t)
|
||||
|
||||
userdom_dontaudit_use_unpriv_user_fds(fsdaemon_t)
|
||||
@@ -91,6 +100,7 @@
|
||||
@@ -91,6 +101,7 @@
|
||||
|
||||
optional_policy(`
|
||||
seutil_sigchld_newrole(fsdaemon_t)
|
||||
@ -22759,7 +22765,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.6.28/policy/modules/system/libraries.fc
|
||||
--- nsaserefpolicy/policy/modules/system/libraries.fc 2009-08-14 16:14:31.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/system/libraries.fc 2009-08-21 18:56:07.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/system/libraries.fc 2009-08-27 09:35:29.000000000 -0400
|
||||
@@ -60,12 +60,15 @@
|
||||
#
|
||||
# /opt
|
||||
@ -22809,7 +22815,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
/usr/(.*/)?java/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/(.*/)?java/.+\.jar -- gen_context(system_u:object_r:lib_t,s0)
|
||||
@@ -115,27 +120,30 @@
|
||||
@@ -115,27 +120,31 @@
|
||||
|
||||
/usr/(.*/)?nvidia/.+\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
|
||||
@ -22822,6 +22828,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+/usr/lib64/vlc/codec/libdmo_plugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
+/usr/lib64/vlc/codec/librealaudio_plugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
+/usr/lib(64)?/libGL\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
+/usr/lib(64)?/catalyst/libGL\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
+
|
||||
/usr/(.*/)?lib(64)?(/.*)?/nvidia/.+\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?(/.*)?/nvidia/.+\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
@ -22848,7 +22855,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
/usr/(local/)?.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:lib_t,s0)
|
||||
/usr/(local/)?lib(64)?/wine/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
@@ -143,11 +151,8 @@
|
||||
@@ -143,11 +152,8 @@
|
||||
/usr/NX/lib/libXcomp\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/NX/lib/libjpeg\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
|
||||
@ -22860,7 +22867,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
/usr/lib(64)?/xorg/modules/drivers/fglrx_drv\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/xorg/modules/drivers/nvidia_drv\.o -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/xorg/modules/extensions/nvidia(-[^/]*)?/libglx\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
@@ -168,12 +173,12 @@
|
||||
@@ -168,12 +174,12 @@
|
||||
|
||||
# Fedora Core packages: gstreamer-plugins, compat-libstdc++, Glide3, libdv
|
||||
# HelixPlayer, SDL, xorg-x11, xorg-x11-libs, Hermes, valgrind, openoffice.org-libs, httpd - php
|
||||
@ -22875,7 +22882,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
/usr/lib/maxima/[^/]+/binary-gcl/maxima -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/mozilla/plugins/libvlcplugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/nx/libXcomp\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
@@ -185,15 +190,10 @@
|
||||
@@ -185,15 +191,10 @@
|
||||
/usr/lib(64)?/libg\+\+\.so\.2\.7\.2\.8 -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/libglide3\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/libglide3-v[0-9]*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
@ -22892,7 +22899,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
/usr/lib(64)?/libHermes\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/valgrind/hp2ps -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/valgrind/stage2 -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
@@ -228,31 +228,17 @@
|
||||
@@ -228,31 +229,17 @@
|
||||
/usr/lib(64)?/ladspa/sc3_1427\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/ladspa/sc4_1882\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/ladspa/se4_1883\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
@ -22928,7 +22935,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
# Jai, Sun Microsystems (Jpackage SPRM)
|
||||
/usr/lib(64)?/libmlib_jai\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
@@ -268,8 +254,8 @@
|
||||
@@ -268,8 +255,8 @@
|
||||
/usr/lib(64)?/vmware/lib(/.*)?/HConfig\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/vmware/(.*/)?VmPerl\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
|
||||
@ -22939,7 +22946,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
# Java, Sun Microsystems (JPackage SRPM)
|
||||
/usr/(.*/)?jre.*/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
@@ -295,6 +281,8 @@
|
||||
@@ -295,6 +282,8 @@
|
||||
/usr/lib/acroread/(.*/)?lib/[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/acroread/.+\.api -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib/acroread/(.*/)?ADMPlugin\.apl -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
@ -22948,7 +22955,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
') dnl end distro_redhat
|
||||
|
||||
#
|
||||
@@ -307,10 +295,91 @@
|
||||
@@ -307,10 +296,91 @@
|
||||
|
||||
/var/mailman/pythonlib(/.*)?/.+\.so(\..*)? -- gen_context(system_u:object_r:lib_t,s0)
|
||||
|
||||
@ -23566,8 +23573,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
## <param name="domain">
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.6.28/policy/modules/system/modutils.te
|
||||
--- nsaserefpolicy/policy/modules/system/modutils.te 2009-08-14 16:14:31.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/system/modutils.te 2009-08-21 18:56:07.000000000 -0400
|
||||
@@ -39,59 +39,10 @@
|
||||
+++ serefpolicy-3.6.28/policy/modules/system/modutils.te 2009-08-27 15:55:30.000000000 -0400
|
||||
@@ -19,6 +19,7 @@
|
||||
type insmod_exec_t;
|
||||
application_domain(insmod_t, insmod_exec_t)
|
||||
mls_file_write_all_levels(insmod_t)
|
||||
+mls_process_write_down(insmod_t)
|
||||
role system_r types insmod_t;
|
||||
|
||||
# module loading config
|
||||
@@ -39,59 +40,10 @@
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -23628,7 +23643,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
allow insmod_t self:process { execmem sigchld sigkill sigstop signull signal };
|
||||
|
||||
allow insmod_t self:udp_socket create_socket_perms;
|
||||
@@ -104,6 +55,7 @@
|
||||
@@ -104,6 +56,7 @@
|
||||
|
||||
kernel_load_module(insmod_t)
|
||||
kernel_read_system_state(insmod_t)
|
||||
@ -23636,7 +23651,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
kernel_write_proc_files(insmod_t)
|
||||
kernel_mount_debugfs(insmod_t)
|
||||
kernel_mount_kvmfs(insmod_t)
|
||||
@@ -112,9 +64,11 @@
|
||||
@@ -112,9 +65,11 @@
|
||||
kernel_read_kernel_sysctls(insmod_t)
|
||||
kernel_rw_kernel_sysctl(insmod_t)
|
||||
kernel_read_hotplug_sysctls(insmod_t)
|
||||
@ -23650,7 +23665,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
dev_rw_sysfs(insmod_t)
|
||||
dev_search_usbfs(insmod_t)
|
||||
@@ -124,14 +78,17 @@
|
||||
@@ -124,14 +79,17 @@
|
||||
dev_read_sound(insmod_t)
|
||||
dev_write_sound(insmod_t)
|
||||
dev_rw_apm_bios(insmod_t)
|
||||
@ -23672,7 +23687,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
files_read_etc_runtime_files(insmod_t)
|
||||
files_read_etc_files(insmod_t)
|
||||
files_read_usr_files(insmod_t)
|
||||
@@ -140,15 +97,13 @@
|
||||
@@ -140,15 +98,13 @@
|
||||
files_dontaudit_search_pids(insmod_t)
|
||||
# for when /var is not mounted early in the boot:
|
||||
files_dontaudit_search_isid_type_dirs(insmod_t)
|
||||
@ -23690,7 +23705,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
logging_send_syslog_msg(insmod_t)
|
||||
logging_search_logs(insmod_t)
|
||||
@@ -157,19 +112,30 @@
|
||||
@@ -157,19 +113,30 @@
|
||||
|
||||
seutil_read_file_contexts(insmod_t)
|
||||
|
||||
@ -23724,7 +23739,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
hotplug_search_config(insmod_t)
|
||||
')
|
||||
|
||||
@@ -215,6 +181,63 @@
|
||||
@@ -215,6 +182,63 @@
|
||||
xserver_getattr_log(insmod_t)
|
||||
')
|
||||
|
||||
@ -23788,7 +23803,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
#################################
|
||||
#
|
||||
# update-modules local policy
|
||||
@@ -246,17 +269,8 @@
|
||||
@@ -246,17 +270,8 @@
|
||||
kernel_read_kernel_sysctls(update_modules_t)
|
||||
kernel_read_system_state(update_modules_t)
|
||||
|
||||
@ -23806,7 +23821,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
fs_getattr_xattr_fs(update_modules_t)
|
||||
|
||||
term_use_console(update_modules_t)
|
||||
@@ -265,6 +279,15 @@
|
||||
@@ -265,6 +280,15 @@
|
||||
init_use_script_fds(update_modules_t)
|
||||
init_use_script_ptys(update_modules_t)
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@
|
||||
Summary: SELinux policy configuration
|
||||
Name: selinux-policy
|
||||
Version: 3.6.28
|
||||
Release: 8%{?dist}
|
||||
Release: 9%{?dist}
|
||||
License: GPLv2+
|
||||
Group: System Environment/Base
|
||||
Source: serefpolicy-%{version}.tgz
|
||||
@ -315,7 +315,7 @@ if [ $1 -eq 1 ]; then
|
||||
%loadpolicy targeted $packages
|
||||
restorecon -R /root /var/log /var/run 2> /dev/null
|
||||
else
|
||||
semodule -n -s targeted -r moilscanner -r mailscanner -r gamin -r audio_entropy -r iscsid -r polkit 2>/dev/null
|
||||
semodule -n -s targeted -r moilscanner -r mailscanner -r gamin -r audio_entropy -r iscsid -r polkit_auth -r polkit 2>/dev/null
|
||||
packages="%{expand:%%moduleList targeted}"
|
||||
%loadpolicy targeted $packages
|
||||
%relabel targeted
|
||||
@ -441,6 +441,9 @@ exit 0
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Fri Aug 28 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-9
|
||||
- Remove polkit_auth on upgrades
|
||||
|
||||
* Wed Aug 26 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-8
|
||||
- Add back in unconfined.pp and unconfineduser.pp
|
||||
- Add Sandbox unshare
|
||||
|
||||
Loading…
Reference in New Issue
Block a user