rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Add cron unconfined role support for uncofined SELinux user 

- Call kernel_rw_usermodehelper_state() in init.te
- Call corenet_udp_bind_all_ports() in milter.te
- Allow fence_virtd to connect to zented port
- Fix header for mirrormanager_admin()
- Allow dkim-milter to bind udp ports
- Allow milter domains to send signull itself
- Allow block_suspend for yum running as mock_t
- Allow beam.smp to manage couchdb files
- Add couchdb_manage_files()
- Add labeling for /var/log/php_errors.log
- Allow bumblebee to stream connect to xserver
- Allow bumblebee to send a signal to xserver
- gnome-thumbnail to stream connect to bumblebee
- Fix calling usermodehelper to use _state in interface name
- Allow xkbcomp running as bumblebee_t to execute  bin_t
- Allow logrotate to read squid.conf
- Additional rules to get docker and lxc to play well with SELinux
- Call kernel_read_usermodhelper/kernel_rw_usermodhelper
- Make rpm_transition_script accept a role
- Added new policy for pcp
- Allow bumbleed to connect to xserver port
- Allow pegasus_openlmi_storage_t to read hwdata
This commit is contained in:
Miroslav Grepl 2014-01-20 11:41:09 +01:00
parent 5dcd635c58
commit 3a0ebd8398
3 changed files with 251 additions and 152 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
policy-rawhide-base.patch
View File

@ -19854,10 +19854,10 @@ index 0000000..cf6582f
+ +
diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
new file mode 100644 new file mode 100644
index 0000000..c212063 index 0000000..ca62aef
--- /dev/null --- /dev/null
+++ b/policy/modules/roles/unconfineduser.te +++ b/policy/modules/roles/unconfineduser.te
@@ -0,0 +1,335 @@ @@ -0,0 +1,339 @@
+policy_module(unconfineduser, 1.0.0) +policy_module(unconfineduser, 1.0.0)
+ +
+######################################## +########################################
@ -20037,6 +20037,10 @@ index 0000000..c212063
+') +')
+ +
+optional_policy(` +optional_policy(`
+ cron_unconfined_role(unconfined_r, unconfined_t)
+')
+
+optional_policy(`
+ chrome_role_notrans(unconfined_r, unconfined_t) + chrome_role_notrans(unconfined_r, unconfined_t)
+ +
+ tunable_policy(`unconfined_chrome_sandbox_transition',` + tunable_policy(`unconfined_chrome_sandbox_transition',`

368
policy-rawhide-contrib.patch
View File

@ -2984,10 +2984,10 @@ index 0000000..8ba9c95
+ spamassassin_read_pid_files(antivirus_domain) + spamassassin_read_pid_files(antivirus_domain)
+') +')
diff --git a/apache.fc b/apache.fc diff --git a/apache.fc b/apache.fc
index 7caefc3..ad4ec67 100644 index 7caefc3..3d2065e 100644
--- a/apache.fc --- a/apache.fc
+++ b/apache.fc +++ b/apache.fc
@@ -1,162 +1,195 @@ @@ -1,162 +1,196 @@
-HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0) -HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0)
-HOME_DIR/((www)|(web)|(public_html))/cgi-bin(/.+)? gen_context(system_u:object_r:httpd_user_script_exec_t,s0) -HOME_DIR/((www)|(web)|(public_html))/cgi-bin(/.+)? gen_context(system_u:object_r:httpd_user_script_exec_t,s0)
+HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0) +HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0)
@ -3241,6 +3241,7 @@ index 7caefc3..ad4ec67 100644
/var/log/roundcubemail(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) /var/log/roundcubemail(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
/var/log/suphp\.log.* -- gen_context(system_u:object_r:httpd_log_t,s0) /var/log/suphp\.log.* -- gen_context(system_u:object_r:httpd_log_t,s0)
-/var/log/z-push(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) -/var/log/z-push(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0)
+/var/log/php_errors\.log.* -- gen_context(system_u:object_r:httpd_log_t,s0)
+/var/log/z-push(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0) +/var/log/z-push(/.*)? gen_context(system_u:object_r:httpd_sys_rw_content_t,s0)
+ifdef(`distro_debian', ` +ifdef(`distro_debian', `
+/var/log/horde2(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) +/var/log/horde2(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
@ -10053,10 +10054,10 @@ index 0000000..de66654
+') +')
diff --git a/bumblebee.te b/bumblebee.te diff --git a/bumblebee.te b/bumblebee.te
new file mode 100644 new file mode 100644
index 0000000..92e9d8b index 0000000..00e1ff2
--- /dev/null --- /dev/null
+++ b/bumblebee.te +++ b/bumblebee.te
@@ -0,0 +1,56 @@ @@ -0,0 +1,58 @@
+policy_module(bumblebee, 1.0.0) +policy_module(bumblebee, 1.0.0)
+ +
+######################################## +########################################
@ -10107,6 +10108,8 @@ index 0000000..92e9d8b
+sysnet_dns_name_resolve(bumblebee_t) +sysnet_dns_name_resolve(bumblebee_t)
+ +
+xserver_domtrans(bumblebee_t) +xserver_domtrans(bumblebee_t)
+xserver_signal(bumblebee_t)
+xserver_stream_connect(bumblebee_t)
+xserver_manage_xkb_libs(bumblebee_t) +xserver_manage_xkb_libs(bumblebee_t)
+corenet_tcp_connect_xserver_port(bumblebee_t) +corenet_tcp_connect_xserver_port(bumblebee_t)
+ +
@ -14660,7 +14663,7 @@ index c086302..4f33119 100644
/etc/rc\.d/init\.d/couchdb -- gen_context(system_u:object_r:couchdb_initrc_exec_t,s0) /etc/rc\.d/init\.d/couchdb -- gen_context(system_u:object_r:couchdb_initrc_exec_t,s0)
diff --git a/couchdb.if b/couchdb.if diff --git a/couchdb.if b/couchdb.if
index 715a826..afa2f78 100644 index 715a826..36d5a7d 100644
--- a/couchdb.if --- a/couchdb.if
+++ b/couchdb.if +++ b/couchdb.if
@@ -2,7 +2,7 @@ @@ -2,7 +2,7 @@
@ -14761,7 +14764,7 @@ index 715a826..afa2f78 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -73,19 +112,63 @@ interface(`couchdb_read_pid_files',` @@ -73,19 +112,85 @@ interface(`couchdb_read_pid_files',`
') ')
files_search_pids($1) files_search_pids($1)
@ -14786,6 +14789,28 @@ index 715a826..afa2f78 100644
+ +
+ files_search_pids($1) + files_search_pids($1)
+ allow $1 couchdb_var_run_t:dir search_dir_perms; + allow $1 couchdb_var_run_t:dir search_dir_perms;
+')
+
+#######################################
+## <summary>
+## Allow domain to manage couchdb content.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`couchdb_manage_files',`
+ gen_require(`
+ type couchdb_var_run_t;
+ type couchdb_log_t;
+ type couchdb_var_lib_t;
+ ')
+
+ manage_files_pattern($1, couchdb_log_t, couchdb_log_t)
+ manage_files_pattern($1, couchdb_var_lib_t, couchdb_var_lib_t)
+ manage_files_pattern($1, couchdb_var_run_t, couchdb_var_run_t)
') ')
######################################## ########################################
@ -14829,7 +14854,7 @@ index 715a826..afa2f78 100644
## <param name="role"> ## <param name="role">
## <summary> ## <summary>
## Role allowed access. ## Role allowed access.
@@ -95,14 +178,19 @@ interface(`couchdb_read_pid_files',` @@ -95,14 +200,19 @@ interface(`couchdb_read_pid_files',`
# #
interface(`couchdb_admin',` interface(`couchdb_admin',`
gen_require(` gen_require(`
@ -14850,7 +14875,7 @@ index 715a826..afa2f78 100644
init_labeled_script_domtrans($1, couchdb_initrc_exec_t) init_labeled_script_domtrans($1, couchdb_initrc_exec_t)
domain_system_change_exemption($1) domain_system_change_exemption($1)
role_transition $2 couchdb_initrc_exec_t system_r; role_transition $2 couchdb_initrc_exec_t system_r;
@@ -122,4 +210,13 @@ interface(`couchdb_admin',` @@ -122,4 +232,13 @@ interface(`couchdb_admin',`
files_search_pids($1) files_search_pids($1)
admin_pattern($1, couchdb_var_run_t) admin_pattern($1, couchdb_var_run_t)
@ -22802,10 +22827,10 @@ index c7bb4e7..e6fe2f40 100644
sysnet_etc_filetrans_config(dnssec_triggerd_t) sysnet_etc_filetrans_config(dnssec_triggerd_t)
diff --git a/docker.fc b/docker.fc diff --git a/docker.fc b/docker.fc
new file mode 100644 new file mode 100644
index 0000000..484dd44 index 0000000..b24266e
--- /dev/null --- /dev/null
+++ b/docker.fc +++ b/docker.fc
@@ -0,0 +1,12 @@ @@ -0,0 +1,14 @@
+/usr/bin/docker -- gen_context(system_u:object_r:docker_exec_t,s0) +/usr/bin/docker -- gen_context(system_u:object_r:docker_exec_t,s0)
+ +
+/usr/lib/systemd/system/docker.service -- gen_context(system_u:object_r:docker_unit_file_t,s0) +/usr/lib/systemd/system/docker.service -- gen_context(system_u:object_r:docker_unit_file_t,s0)
@ -22815,16 +22840,17 @@ index 0000000..484dd44
+/var/run/docker\.pid -- gen_context(system_u:object_r:docker_var_run_t,s0) +/var/run/docker\.pid -- gen_context(system_u:object_r:docker_var_run_t,s0)
+/var/run/docker\.sock -s gen_context(system_u:object_r:docker_var_run_t,s0) +/var/run/docker\.sock -s gen_context(system_u:object_r:docker_var_run_t,s0)
+ +
+/var/lock/lxc(/.*)? gen_context(system_u:object_r:docker_lock_t,s0)
+
+/var/log/lxc(/.*)? gen_context(system_u:object_r:docker_log_t,s0) +/var/log/lxc(/.*)? gen_context(system_u:object_r:docker_log_t,s0)
+ +
+/usr/lib/lxc/rootfs gen_context(system_u:object_r:mnt_t,s0) +
\ No newline at end of file
diff --git a/docker.if b/docker.if diff --git a/docker.if b/docker.if
new file mode 100644 new file mode 100644
index 0000000..543baf1 index 0000000..c77a25f
--- /dev/null --- /dev/null
+++ b/docker.if +++ b/docker.if
@@ -0,0 +1,250 @@ @@ -0,0 +1,257 @@
+ +
+## <summary>The open-source application container engine.</summary> +## <summary>The open-source application container engine.</summary>
+ +
@ -23020,44 +23046,6 @@ index 0000000..543baf1
+ ps_process_pattern($1, docker_t) + ps_process_pattern($1, docker_t)
+') +')
+ +
+
+########################################
+## <summary>
+## All of the rules required to administrate
+## an docker environment
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`docker_admin',`
+ gen_require(`
+ type docker_t;
+ type docker_var_lib_t, docker_var_run_t;
+ type docker_unit_file_t;
+ ')
+
+ allow $1 docker_t:process { ptrace signal_perms };
+ ps_process_pattern($1, docker_t)
+
+ files_search_var_lib($1)
+ admin_pattern($1, docker_var_lib_t)
+
+ files_search_pids($1)
+ admin_pattern($1, docker_var_run_t)
+
+ docker_systemctl($1)
+ admin_pattern($1, docker_unit_file_t)
+ allow $1 docker_unit_file_t:service all_service_perms;
+
+ optional_policy(`
+ systemd_passwd_agent_exec($1)
+ systemd_read_fifo_file_passwd_run($1)
+ ')
+')
+
+######################################## +########################################
+## <summary> +## <summary>
+## Read and write docker shared memory. +## Read and write docker shared memory.
@ -23075,12 +23063,57 @@ index 0000000..543baf1
+ +
+ allow $1 docker_t:sem rw_sem_perms; + allow $1 docker_t:sem rw_sem_perms;
+') +')
+
+########################################
+## <summary>
+## All of the rules required to administrate
+## an docker environment
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`docker_admin',`
+ gen_require(`
+ type docker_t;
+ type docker_var_lib_t, docker_var_run_t;
+ type docker_unit_file_t;
+ type docker_lock_t;
+ type docker_log_t;
+ ')
+
+ allow $1 docker_t:process { ptrace signal_perms };
+ ps_process_pattern($1, docker_t)
+
+ files_search_var_lib($1)
+ admin_pattern($1, docker_var_lib_t)
+
+ files_search_pids($1)
+ admin_pattern($1, docker_var_run_t)
+
+ files_search_locks($1)
+ admin_pattern($1, docker_lock_t)
+
+ logging_search_logs($1)
+ admin_pattern($1, docker_log_t)
+
+ docker_systemctl($1)
+ admin_pattern($1, docker_unit_file_t)
+ allow $1 docker_unit_file_t:service all_service_perms;
+
+ optional_policy(`
+ systemd_passwd_agent_exec($1)
+ systemd_read_fifo_file_passwd_run($1)
+ ')
+')
diff --git a/docker.te b/docker.te diff --git a/docker.te b/docker.te
new file mode 100644 new file mode 100644
index 0000000..5c6eaab index 0000000..68c225c
--- /dev/null --- /dev/null
+++ b/docker.te +++ b/docker.te
@@ -0,0 +1,157 @@ @@ -0,0 +1,172 @@
+policy_module(docker, 1.0.0) +policy_module(docker, 1.0.0)
+ +
+######################################## +########################################
@ -23095,6 +23128,9 @@ index 0000000..5c6eaab
+type docker_var_lib_t; +type docker_var_lib_t;
+files_type(docker_var_lib_t) +files_type(docker_var_lib_t)
+ +
+type docker_lock_t;
+files_lock_file(docker_lock_t)
+
+type docker_log_t; +type docker_log_t;
+logging_log_file(docker_log_t) +logging_log_file(docker_log_t)
+ +
@ -23117,6 +23153,10 @@ index 0000000..5c6eaab
+allow docker_t self:unix_stream_socket create_stream_socket_perms; +allow docker_t self:unix_stream_socket create_stream_socket_perms;
+allow docker_t self:capability2 block_suspend; +allow docker_t self:capability2 block_suspend;
+ +
+manage_dirs_pattern(docker_t, docker_lock_t, docker_lock_t)
+manage_files_pattern(docker_t, docker_lock_t, docker_lock_t)
+files_lock_filetrans(docker_t, docker_lock_t, { dir file }, "lxc")
+
+manage_dirs_pattern(docker_t, docker_log_t, docker_log_t) +manage_dirs_pattern(docker_t, docker_log_t, docker_log_t)
+manage_files_pattern(docker_t, docker_log_t, docker_log_t) +manage_files_pattern(docker_t, docker_log_t, docker_log_t)
+manage_lnk_files_pattern(docker_t, docker_log_t, docker_log_t) +manage_lnk_files_pattern(docker_t, docker_log_t, docker_log_t)
@ -23160,6 +23200,8 @@ index 0000000..5c6eaab
+ +
+auth_use_nsswitch(docker_t) +auth_use_nsswitch(docker_t)
+ +
+init_read_state(docker_t)
+
+logging_send_audit_msgs(docker_t) +logging_send_audit_msgs(docker_t)
+logging_send_syslog_msg(docker_t) +logging_send_syslog_msg(docker_t)
+ +
@ -23183,7 +23225,8 @@ index 0000000..5c6eaab
+# +#
+ +
+allow docker_t self:capability { sys_admin sys_boot dac_override setpcap sys_ptrace }; +allow docker_t self:capability { sys_admin sys_boot dac_override setpcap sys_ptrace };
+allow docker_t self:process { getcap setcap setpgid setsched signal_perms }; +allow docker_t self:process { getcap setcap setexec setpgid setsched signal_perms };
+
+allow docker_t self:netlink_route_socket rw_netlink_socket_perms;; +allow docker_t self:netlink_route_socket rw_netlink_socket_perms;;
+allow docker_t self:netlink_audit_socket create_netlink_socket_perms; +allow docker_t self:netlink_audit_socket create_netlink_socket_perms;
+allow docker_t self:unix_dgram_socket create_socket_perms; +allow docker_t self:unix_dgram_socket create_socket_perms;
@ -23219,10 +23262,12 @@ index 0000000..5c6eaab
+fs_manage_cgroup_dirs(docker_t) +fs_manage_cgroup_dirs(docker_t)
+fs_manage_cgroup_files(docker_t) +fs_manage_cgroup_files(docker_t)
+fs_relabelfrom_xattr_fs(docker_t) +fs_relabelfrom_xattr_fs(docker_t)
+fs_relabelfrom_tmpfs(docker_t)
+ +
+term_use_generic_ptys(docker_t) +term_use_generic_ptys(docker_t)
+term_use_ptmx(docker_t) +term_use_ptmx(docker_t)
+term_getattr_pty_fs(docker_t) +term_getattr_pty_fs(docker_t)
+term_relabel_pty_fs(docker_t)
+ +
+modutils_domtrans_insmod(docker_t) +modutils_domtrans_insmod(docker_t)
+ +
@ -23237,6 +23282,9 @@ index 0000000..5c6eaab
+ virt_stream_connect_sandbox(docker_t) + virt_stream_connect_sandbox(docker_t)
+ virt_manage_sandbox_files(docker_t) + virt_manage_sandbox_files(docker_t)
+ virt_relabel_sandbox_filesystem(docker_t) + virt_relabel_sandbox_filesystem(docker_t)
+ # for lxc
+ virt_transition_svirt_sandbox(docker_t, system_r)
+ virt_mounton_sandbox_file(docker_t)
+') +')
diff --git a/dovecot.fc b/dovecot.fc diff --git a/dovecot.fc b/dovecot.fc
index c880070..4448055 100644 index c880070..4448055 100644
@ -40487,10 +40535,10 @@ index cba62db..562833a 100644
+ delete_files_pattern($1, dkim_milter_data_t, dkim_milter_data_t) + delete_files_pattern($1, dkim_milter_data_t, dkim_milter_data_t)
+') +')
diff --git a/milter.te b/milter.te diff --git a/milter.te b/milter.te
index 4dc99f4..22dbcb9 100644 index 4dc99f4..c11bec2 100644
--- a/milter.te --- a/milter.te
+++ b/milter.te +++ b/milter.te
@@ -5,73 +5,113 @@ policy_module(milter, 1.5.0) @@ -5,73 +5,117 @@ policy_module(milter, 1.5.0)
# Declarations # Declarations
# #
@ -40532,6 +40580,8 @@ index 4dc99f4..22dbcb9 100644
allow milter_domains self:fifo_file rw_fifo_file_perms; allow milter_domains self:fifo_file rw_fifo_file_perms;
-allow milter_domains self:tcp_socket { accept listen }; -allow milter_domains self:tcp_socket { accept listen };
+ +
+allow milter_domains self:process signull;
+
+# Allow communication with MTA over a TCP socket +# Allow communication with MTA over a TCP socket
+allow milter_domains self:tcp_socket create_stream_socket_perms; +allow milter_domains self:tcp_socket create_stream_socket_perms;
@ -40573,6 +40623,8 @@ index 4dc99f4..22dbcb9 100644
+ +
+kernel_read_kernel_sysctls(dkim_milter_t) +kernel_read_kernel_sysctls(dkim_milter_t)
+ +
+corenet_udp_bind_all_ports(dkim_milter_t)
+
+auth_use_nsswitch(dkim_milter_t) +auth_use_nsswitch(dkim_milter_t)
+ +
+sysnet_dns_name_resolve(dkim_milter_t) +sysnet_dns_name_resolve(dkim_milter_t)
@ -40631,7 +40683,7 @@ index 4dc99f4..22dbcb9 100644
optional_policy(` optional_policy(`
mysql_stream_connect(greylist_milter_t) mysql_stream_connect(greylist_milter_t)
@@ -79,30 +119,45 @@ optional_policy(` @@ -79,30 +123,45 @@ optional_policy(`
######################################## ########################################
# #
@ -40846,10 +40898,10 @@ index 0000000..c713b27
+/var/run/mirrormanager(/.*)? gen_context(system_u:object_r:mirrormanager_var_run_t,s0) +/var/run/mirrormanager(/.*)? gen_context(system_u:object_r:mirrormanager_var_run_t,s0)
diff --git a/mirrormanager.if b/mirrormanager.if diff --git a/mirrormanager.if b/mirrormanager.if
new file mode 100644 new file mode 100644
index 0000000..adf2319 index 0000000..fbb831d
--- /dev/null --- /dev/null
+++ b/mirrormanager.if +++ b/mirrormanager.if
@@ -0,0 +1,243 @@ @@ -0,0 +1,237 @@
+ +
+## <summary>policy for mirrormanager</summary> +## <summary>policy for mirrormanager</summary>
+ +
@ -41057,12 +41109,6 @@ index 0000000..adf2319
+## Domain allowed access. +## Domain allowed access.
+## </summary> +## </summary>
+## </param> +## </param>
+## <param name="role">
+## <summary>
+## Role allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+# +#
+interface(`mirrormanager_admin',` +interface(`mirrormanager_admin',`
+ gen_require(` + gen_require(`
@ -41471,10 +41517,10 @@ index 0000000..6568bfe
+') +')
diff --git a/mock.te b/mock.te diff --git a/mock.te b/mock.te
new file mode 100644 new file mode 100644
index 0000000..92c3b35 index 0000000..fc64201
--- /dev/null --- /dev/null
+++ b/mock.te +++ b/mock.te
@@ -0,0 +1,275 @@ @@ -0,0 +1,276 @@
+policy_module(mock,1.0.0) +policy_module(mock,1.0.0)
+ +
+## <desc> +## <desc>
@ -41522,6 +41568,7 @@ index 0000000..92c3b35
+# +#
+ +
+allow mock_t self:capability { sys_admin sys_ptrace setfcap setuid sys_chroot chown audit_write dac_override sys_nice mknod fsetid setgid fowner }; +allow mock_t self:capability { sys_admin sys_ptrace setfcap setuid sys_chroot chown audit_write dac_override sys_nice mknod fsetid setgid fowner };
+allow mock_t self:capability2 block_suspend;
+allow mock_t self:process { siginh noatsecure signal_perms transition rlimitinh setsched setpgid }; +allow mock_t self:process { siginh noatsecure signal_perms transition rlimitinh setsched setpgid };
+# Needed because mock can run java and mono withing build environment +# Needed because mock can run java and mono withing build environment
+allow mock_t self:process { execmem execstack }; +allow mock_t self:process { execmem execstack };
@ -70924,7 +70971,7 @@ index 2c3d338..cf3e5ad 100644
######################################## ########################################
diff --git a/rabbitmq.te b/rabbitmq.te diff --git a/rabbitmq.te b/rabbitmq.te
index dc3b0ed..750df0e 100644 index dc3b0ed..d760e9e 100644
--- a/rabbitmq.te --- a/rabbitmq.te
+++ b/rabbitmq.te +++ b/rabbitmq.te
@@ -19,6 +19,9 @@ init_script_file(rabbitmq_initrc_exec_t) @@ -19,6 +19,9 @@ init_script_file(rabbitmq_initrc_exec_t)
@ -70982,7 +71029,7 @@ index dc3b0ed..750df0e 100644
corenet_sendrecv_amqp_server_packets(rabbitmq_beam_t) corenet_sendrecv_amqp_server_packets(rabbitmq_beam_t)
corenet_tcp_bind_amqp_port(rabbitmq_beam_t) corenet_tcp_bind_amqp_port(rabbitmq_beam_t)
@@ -69,37 +81,50 @@ corenet_sendrecv_epmd_client_packets(rabbitmq_beam_t) @@ -69,37 +81,49 @@ corenet_sendrecv_epmd_client_packets(rabbitmq_beam_t)
corenet_tcp_connect_epmd_port(rabbitmq_beam_t) corenet_tcp_connect_epmd_port(rabbitmq_beam_t)
corenet_tcp_sendrecv_epmd_port(rabbitmq_beam_t) corenet_tcp_sendrecv_epmd_port(rabbitmq_beam_t)
@ -71027,10 +71074,9 @@ index dc3b0ed..750df0e 100644
+logging_send_syslog_msg(rabbitmq_beam_t) +logging_send_syslog_msg(rabbitmq_beam_t)
+ +
+optional_policy(` +optional_policy(`
+ couchdb_manage_files(rabbitmq_beam_t)
+ couchdb_manage_lib_files(rabbitmq_beam_t) + couchdb_manage_lib_files(rabbitmq_beam_t)
+ couchdb_read_conf_files(rabbitmq_beam_t) + couchdb_read_conf_files(rabbitmq_beam_t)
+ couchdb_read_log_files(rabbitmq_beam_t)
+ couchdb_search_pid_dirs(rabbitmq_beam_t)
+') +')
+ +
+optional_policy(` +optional_policy(`
@ -71046,7 +71092,7 @@ index dc3b0ed..750df0e 100644
allow rabbitmq_epmd_t self:process signal; allow rabbitmq_epmd_t self:process signal;
allow rabbitmq_epmd_t self:fifo_file rw_fifo_file_perms; allow rabbitmq_epmd_t self:fifo_file rw_fifo_file_perms;
allow rabbitmq_epmd_t self:tcp_socket create_stream_socket_perms; allow rabbitmq_epmd_t self:tcp_socket create_stream_socket_perms;
@@ -117,8 +142,5 @@ corenet_sendrecv_epmd_server_packets(rabbitmq_epmd_t) @@ -117,8 +141,5 @@ corenet_sendrecv_epmd_server_packets(rabbitmq_epmd_t)
corenet_tcp_bind_epmd_port(rabbitmq_epmd_t) corenet_tcp_bind_epmd_port(rabbitmq_epmd_t)
corenet_tcp_sendrecv_epmd_port(rabbitmq_epmd_t) corenet_tcp_sendrecv_epmd_port(rabbitmq_epmd_t)
@ -74754,7 +74800,7 @@ index c8bdea2..1337d42 100644
+ allow $1 cluster_unit_file_t:service all_service_perms; + allow $1 cluster_unit_file_t:service all_service_perms;
') ')
diff --git a/rhcs.te b/rhcs.te diff --git a/rhcs.te b/rhcs.te
index 6cf79c4..00a6db2 100644 index 6cf79c4..8ee9185 100644
--- a/rhcs.te --- a/rhcs.te
+++ b/rhcs.te +++ b/rhcs.te
@@ -20,6 +20,27 @@ gen_tunable(fenced_can_network_connect, false) @@ -20,6 +20,27 @@ gen_tunable(fenced_can_network_connect, false)
@ -75130,15 +75176,16 @@ index 6cf79c4..00a6db2 100644
corecmd_exec_bin(fenced_t) corecmd_exec_bin(fenced_t)
corecmd_exec_shell(fenced_t) corecmd_exec_shell(fenced_t)
@@ -140,6 +425,7 @@ corenet_udp_sendrecv_ionixnetmon_port(fenced_t) @@ -140,6 +425,8 @@ corenet_udp_sendrecv_ionixnetmon_port(fenced_t)
corenet_sendrecv_zented_server_packets(fenced_t) corenet_sendrecv_zented_server_packets(fenced_t)
corenet_tcp_bind_zented_port(fenced_t) corenet_tcp_bind_zented_port(fenced_t)
+corenet_udp_bind_zented_port(fenced_t) +corenet_udp_bind_zented_port(fenced_t)
+corenet_tcp_connect_zented_port(fenced_t)
corenet_tcp_sendrecv_zented_port(fenced_t) corenet_tcp_sendrecv_zented_port(fenced_t)
corenet_sendrecv_http_client_packets(fenced_t) corenet_sendrecv_http_client_packets(fenced_t)
@@ -148,9 +434,7 @@ corenet_tcp_sendrecv_http_port(fenced_t) @@ -148,9 +435,7 @@ corenet_tcp_sendrecv_http_port(fenced_t)
dev_read_sysfs(fenced_t) dev_read_sysfs(fenced_t)
dev_read_urand(fenced_t) dev_read_urand(fenced_t)
@ -75149,7 +75196,7 @@ index 6cf79c4..00a6db2 100644
storage_raw_read_fixed_disk(fenced_t) storage_raw_read_fixed_disk(fenced_t)
storage_raw_write_fixed_disk(fenced_t) storage_raw_write_fixed_disk(fenced_t)
@@ -160,7 +444,7 @@ term_getattr_pty_fs(fenced_t) @@ -160,7 +445,7 @@ term_getattr_pty_fs(fenced_t)
term_use_generic_ptys(fenced_t) term_use_generic_ptys(fenced_t)
term_use_ptmx(fenced_t) term_use_ptmx(fenced_t)
@ -75158,7 +75205,7 @@ index 6cf79c4..00a6db2 100644
tunable_policy(`fenced_can_network_connect',` tunable_policy(`fenced_can_network_connect',`
corenet_sendrecv_all_client_packets(fenced_t) corenet_sendrecv_all_client_packets(fenced_t)
@@ -182,7 +466,8 @@ optional_policy(` @@ -182,7 +467,8 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -75168,7 +75215,7 @@ index 6cf79c4..00a6db2 100644
') ')
optional_policy(` optional_policy(`
@@ -190,12 +475,12 @@ optional_policy(` @@ -190,12 +476,12 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -75184,7 +75231,7 @@ index 6cf79c4..00a6db2 100644
') ')
optional_policy(` optional_policy(`
@@ -203,6 +488,13 @@ optional_policy(` @@ -203,6 +489,13 @@ optional_policy(`
snmp_manage_var_lib_dirs(fenced_t) snmp_manage_var_lib_dirs(fenced_t)
') ')
@ -75198,7 +75245,7 @@ index 6cf79c4..00a6db2 100644
####################################### #######################################
# #
# foghorn local policy # foghorn local policy
@@ -221,16 +513,18 @@ corenet_sendrecv_agentx_client_packets(foghorn_t) @@ -221,16 +514,18 @@ corenet_sendrecv_agentx_client_packets(foghorn_t)
corenet_tcp_connect_agentx_port(foghorn_t) corenet_tcp_connect_agentx_port(foghorn_t)
corenet_tcp_sendrecv_agentx_port(foghorn_t) corenet_tcp_sendrecv_agentx_port(foghorn_t)
@ -75219,7 +75266,7 @@ index 6cf79c4..00a6db2 100644
snmp_stream_connect(foghorn_t) snmp_stream_connect(foghorn_t)
') ')
@@ -257,6 +551,8 @@ storage_getattr_removable_dev(gfs_controld_t) @@ -257,6 +552,8 @@ storage_getattr_removable_dev(gfs_controld_t)
init_rw_script_tmp_files(gfs_controld_t) init_rw_script_tmp_files(gfs_controld_t)
@ -75228,7 +75275,7 @@ index 6cf79c4..00a6db2 100644
optional_policy(` optional_policy(`
lvm_exec(gfs_controld_t) lvm_exec(gfs_controld_t)
dev_rw_lvm_control(gfs_controld_t) dev_rw_lvm_control(gfs_controld_t)
@@ -275,10 +571,39 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t) @@ -275,10 +572,39 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t)
dev_list_sysfs(groupd_t) dev_list_sysfs(groupd_t)
@ -75270,7 +75317,7 @@ index 6cf79c4..00a6db2 100644
###################################### ######################################
# #
# qdiskd local policy # qdiskd local policy
@@ -321,6 +646,8 @@ storage_raw_write_fixed_disk(qdiskd_t) @@ -321,6 +647,8 @@ storage_raw_write_fixed_disk(qdiskd_t)
auth_use_nsswitch(qdiskd_t) auth_use_nsswitch(qdiskd_t)
@ -92875,10 +92922,10 @@ index 0000000..c1fd8b4
+') +')
diff --git a/thumb.te b/thumb.te diff --git a/thumb.te b/thumb.te
new file mode 100644 new file mode 100644
index 0000000..2ddef5c index 0000000..ed78f6f
--- /dev/null --- /dev/null
+++ b/thumb.te +++ b/thumb.te
@@ -0,0 +1,150 @@ @@ -0,0 +1,154 @@
+policy_module(thumb, 1.0.0) +policy_module(thumb, 1.0.0)
+ +
+######################################## +########################################
@ -92994,6 +93041,10 @@ index 0000000..2ddef5c
+xserver_use_user_fonts(thumb_t) +xserver_use_user_fonts(thumb_t)
+ +
+optional_policy(` +optional_policy(`
+ bumblebee_stream_connect(thumb_t)
+')
+
+optional_policy(`
+ dbus_dontaudit_stream_connect_session_bus(thumb_t) + dbus_dontaudit_stream_connect_session_bus(thumb_t)
+ dbus_dontaudit_chat_session_bus(thumb_t) + dbus_dontaudit_chat_session_bus(thumb_t)
+') +')
@ -95712,7 +95763,7 @@ index a4f20bc..6351bcb 100644
+/var/log/qemu-ga\.log.* -- gen_context(system_u:object_r:virt_qemu_ga_log_t,s0) +/var/log/qemu-ga\.log.* -- gen_context(system_u:object_r:virt_qemu_ga_log_t,s0)
+/var/log/qemu-ga(/.*)? gen_context(system_u:object_r:virt_qemu_ga_log_t,s0) +/var/log/qemu-ga(/.*)? gen_context(system_u:object_r:virt_qemu_ga_log_t,s0)
diff --git a/virt.if b/virt.if diff --git a/virt.if b/virt.if
index facdee8..3ad56e3 100644 index facdee8..09db35b 100644
--- a/virt.if --- a/virt.if
+++ b/virt.if +++ b/virt.if
@@ -1,120 +1,51 @@ @@ -1,120 +1,51 @@
@ -96727,44 +96778,40 @@ index facdee8..3ad56e3 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -860,74 +658,227 @@ interface(`virt_read_lib_files',` @@ -860,74 +658,245 @@ interface(`virt_read_lib_files',`
## </summary> ## </summary>
## </param> ## </param>
# #
-interface(`virt_manage_lib_files',` -interface(`virt_manage_lib_files',`
+interface(`virt_manage_cache',` +interface(`virt_manage_cache',`
gen_require(` + gen_require(`
- type virt_var_lib_t;
+ type virt_cache_t; + type virt_cache_t;
') + ')
+
- files_search_var_lib($1)
- manage_files_pattern($1, virt_var_lib_t, virt_var_lib_t)
+ files_search_var($1) + files_search_var($1)
+ manage_dirs_pattern($1, virt_cache_t, virt_cache_t) + manage_dirs_pattern($1, virt_cache_t, virt_cache_t)
+ manage_files_pattern($1, virt_cache_t, virt_cache_t) + manage_files_pattern($1, virt_cache_t, virt_cache_t)
+ manage_lnk_files_pattern($1, virt_cache_t, virt_cache_t) + manage_lnk_files_pattern($1, virt_cache_t, virt_cache_t)
') +')
+
######################################## +########################################
## <summary> +## <summary>
-## Create objects in virt pid
-## directories with a private type.
+## Allow domain to manage virt image files +## Allow domain to manage virt image files
## </summary> +## </summary>
## <param name="domain"> +## <param name="domain">
## <summary> +## <summary>
## Domain allowed access. +## Domain allowed access.
## </summary> +## </summary>
## </param> +## </param>
-## <param name="private type">
+# +#
+interface(`virt_manage_images',` +interface(`virt_manage_images',`
+ gen_require(` gen_require(`
+ type virt_var_lib_t; type virt_var_lib_t;
+ attribute virt_image_type; + attribute virt_image_type;
+ ') ')
+
- files_search_var_lib($1)
- manage_files_pattern($1, virt_var_lib_t, virt_var_lib_t)
+ virt_search_lib($1) + virt_search_lib($1)
+ allow $1 virt_image_type:dir list_dir_perms; + allow $1 virt_image_type:dir list_dir_perms;
+ manage_dirs_pattern($1, virt_image_type, virt_image_type) + manage_dirs_pattern($1, virt_image_type, virt_image_type)
@ -96794,10 +96841,12 @@ index facdee8..3ad56e3 100644
+ manage_dirs_pattern($1, virt_image_t, virt_image_t) + manage_dirs_pattern($1, virt_image_t, virt_image_t)
+ manage_files_pattern($1, virt_image_t, virt_image_t) + manage_files_pattern($1, virt_image_t, virt_image_t)
+ read_lnk_files_pattern($1, virt_image_t, virt_image_t) + read_lnk_files_pattern($1, virt_image_t, virt_image_t)
+') ')
+
+######################################## ########################################
+## <summary> ## <summary>
-## Create objects in virt pid
-## directories with a private type.
+## Execute virt server in the virt domain. +## Execute virt server in the virt domain.
+## </summary> +## </summary>
+## <param name="domain"> +## <param name="domain">
@ -96824,12 +96873,10 @@ index facdee8..3ad56e3 100644
+## Ptrace the svirt domain +## Ptrace the svirt domain
+## </summary> +## </summary>
+## <param name="domain"> +## <param name="domain">
## <summary> +## <summary>
-## The type of the object to be created.
+## Domain allowed to transition. +## Domain allowed to transition.
## </summary> +## </summary>
## </param> +## </param>
-## <param name="object">
+# +#
+interface(`virt_ptrace',` +interface(`virt_ptrace',`
+ gen_require(` + gen_require(`
@ -96842,14 +96889,13 @@ index facdee8..3ad56e3 100644
+####################################### +#######################################
+## <summary> +## <summary>
+## Manage Sandbox Files +## Manage Sandbox Files
+## </summary> ## </summary>
+## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
-## The object class of the object being created. ## Domain allowed access.
+## Domain allowed access.
## </summary> ## </summary>
## </param> ## </param>
-## <param name="name" optional="true"> -## <param name="private type">
+# +#
+interface(`virt_manage_sandbox_files',` +interface(`virt_manage_sandbox_files',`
+ gen_require(` + gen_require(`
@ -96867,16 +96913,14 @@ index facdee8..3ad56e3 100644
+## </summary> +## </summary>
+## <param name="domain"> +## <param name="domain">
## <summary> ## <summary>
-## The name of the object being created. -## The type of the object to be created.
+## Domain allowed access. +## Domain allowed access.
## </summary> ## </summary>
## </param> ## </param>
-## <infoflow type="write" weight="10"/> -## <param name="object">
# +#
-interface(`virt_pid_filetrans',`
+interface(`virt_relabel_sandbox_filesystem',` +interface(`virt_relabel_sandbox_filesystem',`
gen_require(` + gen_require(`
- type virt_var_run_t;
+ type svirt_sandbox_file_t; + type svirt_sandbox_file_t;
+ ') + ')
+ +
@ -96885,16 +96929,40 @@ index facdee8..3ad56e3 100644
+ +
+####################################### +#######################################
+## <summary> +## <summary>
+## Mounton Sandbox Files
+## </summary>
+## <param name="domain">
## <summary>
-## The object class of the object being created.
+## Domain allowed access.
## </summary>
## </param>
-## <param name="name" optional="true">
+#
+interface(`virt_mounton_sandbox_file',`
+ gen_require(`
+ type svirt_sandbox_file_t;
+ ')
+
+ allow $1 svirt_sandbox_file_t:dir_file_class_set mounton;
+')
+
+#######################################
+## <summary>
+## Connect to virt over a unix domain stream socket. +## Connect to virt over a unix domain stream socket.
+## </summary> +## </summary>
+## <param name="domain"> +## <param name="domain">
+## <summary> ## <summary>
-## The name of the object being created.
+## Domain allowed access. +## Domain allowed access.
+## </summary> ## </summary>
+## </param> ## </param>
+# -## <infoflow type="write" weight="10"/>
#
-interface(`virt_pid_filetrans',`
+interface(`virt_stream_connect_sandbox',` +interface(`virt_stream_connect_sandbox',`
+ gen_require(` gen_require(`
- type virt_var_run_t;
+ attribute svirt_sandbox_domain; + attribute svirt_sandbox_domain;
+ type svirt_sandbox_file_t; + type svirt_sandbox_file_t;
') ')
@ -96978,7 +97046,7 @@ index facdee8..3ad56e3 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -935,19 +886,17 @@ interface(`virt_read_log',` @@ -935,19 +904,17 @@ interface(`virt_read_log',`
## </summary> ## </summary>
## </param> ## </param>
# #
@ -97002,7 +97070,7 @@ index facdee8..3ad56e3 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -955,20 +904,17 @@ interface(`virt_append_log',` @@ -955,20 +922,17 @@ interface(`virt_append_log',`
## </summary> ## </summary>
## </param> ## </param>
# #
@ -97027,7 +97095,7 @@ index facdee8..3ad56e3 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -976,18 +922,17 @@ interface(`virt_manage_log',` @@ -976,18 +940,17 @@ interface(`virt_manage_log',`
## </summary> ## </summary>
## </param> ## </param>
# #
@ -97050,7 +97118,7 @@ index facdee8..3ad56e3 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -995,36 +940,57 @@ interface(`virt_search_images',` @@ -995,36 +958,57 @@ interface(`virt_search_images',`
## </summary> ## </summary>
## </param> ## </param>
# #
@ -97127,7 +97195,7 @@ index facdee8..3ad56e3 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -1032,20 +998,28 @@ interface(`virt_read_images',` @@ -1032,20 +1016,28 @@ interface(`virt_read_images',`
## </summary> ## </summary>
## </param> ## </param>
# #
@ -97163,7 +97231,7 @@ index facdee8..3ad56e3 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -1053,37 +1027,129 @@ interface(`virt_rw_all_image_chr_files',` @@ -1053,37 +1045,131 @@ interface(`virt_rw_all_image_chr_files',`
## </summary> ## </summary>
## </param> ## </param>
# #
@ -97187,7 +97255,7 @@ index facdee8..3ad56e3 100644
## </summary> ## </summary>
-## <param name="domain"> -## <param name="domain">
+## <param name="prefix"> +## <param name="prefix">
## <summary> +## <summary>
+## Prefix for the domain. +## Prefix for the domain.
+## </summary> +## </summary>
+## </param> +## </param>
@ -97212,7 +97280,7 @@ index facdee8..3ad56e3 100644
+## Make the specified type usable as a lxc domain +## Make the specified type usable as a lxc domain
+## </summary> +## </summary>
+## <param name="type"> +## <param name="type">
+## <summary> ## <summary>
+## Type to be used as a lxc domain +## Type to be used as a lxc domain
+## </summary> +## </summary>
+## </param> +## </param>
@ -97298,7 +97366,9 @@ index facdee8..3ad56e3 100644
+ role $2 types svirt_sandbox_domain; + role $2 types svirt_sandbox_domain;
+ allow $1 svirt_sandbox_domain:unix_dgram_socket sendto; + allow $1 svirt_sandbox_domain:unix_dgram_socket sendto;
+ +
+ allow svirt_sandbox_domain $1:fifo_file rw_fifo_file_perms;
+ allow svirt_sandbox_domain $1:process sigchld; + allow svirt_sandbox_domain $1:process sigchld;
+ ps_process_pattern($1, svirt_sandbox_domain)
+') +')
+ +
+######################################## +########################################
@ -97307,7 +97377,7 @@ index facdee8..3ad56e3 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -1091,36 +1157,54 @@ interface(`virt_manage_virt_cache',` @@ -1091,36 +1177,54 @@ interface(`virt_manage_virt_cache',`
## </summary> ## </summary>
## </param> ## </param>
# #
@ -97381,7 +97451,7 @@ index facdee8..3ad56e3 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -1136,50 +1220,36 @@ interface(`virt_manage_images',` @@ -1136,50 +1240,36 @@ interface(`virt_manage_images',`
# #
interface(`virt_admin',` interface(`virt_admin',`
gen_require(` gen_require(`
@ -97423,7 +97493,8 @@ index facdee8..3ad56e3 100644
- -
- files_search_tmp($1) - files_search_tmp($1)
- admin_pattern($1, { virt_tmp_type virt_tmp_t }) - admin_pattern($1, { virt_tmp_type virt_tmp_t })
- + allow $1 virt_domain:process signal_perms;
- files_search_etc($1) - files_search_etc($1)
- admin_pattern($1, { virt_etc_t virt_etc_rw_t virtd_keytab_t }) - admin_pattern($1, { virt_etc_t virt_etc_rw_t virtd_keytab_t })
- -
@ -97432,8 +97503,7 @@ index facdee8..3ad56e3 100644
- -
- files_search_pids($1) - files_search_pids($1)
- admin_pattern($1, { virt_var_run_t virtd_lxc_var_run_t svirt_var_run_t }) - admin_pattern($1, { virt_var_run_t virtd_lxc_var_run_t svirt_var_run_t })
+ allow $1 virt_domain:process signal_perms; -
- files_search_var($1) - files_search_var($1)
- admin_pattern($1, svirt_cache_t) - admin_pattern($1, svirt_cache_t)
- -

27
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.13.1 Version: 3.13.1
Release: 14%{?dist} Release: 15%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -579,6 +579,31 @@ SELinux Reference policy mls base module.
%endif %endif
%changelog %changelog
* Mon Jan 20 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-15
- Add cron unconfined role support for uncofined SELinux user
- Call kernel_rw_usermodehelper_state() in init.te
- Call corenet_udp_bind_all_ports() in milter.te
- Allow fence_virtd to connect to zented port
- Fix header for mirrormanager_admin()
- Allow dkim-milter to bind udp ports
- Allow milter domains to send signull itself
- Allow block_suspend for yum running as mock_t
- Allow beam.smp to manage couchdb files
- Add couchdb_manage_files()
- Add labeling for /var/log/php_errors.log
- Allow bumblebee to stream connect to xserver
- Allow bumblebee to send a signal to xserver
- gnome-thumbnail to stream connect to bumblebee
- Fix calling usermodehelper to use _state in interface name
- Allow xkbcomp running as bumblebee_t to execute bin_t
- Allow logrotate to read squid.conf
- Additional rules to get docker and lxc to play well with SELinux
- Call kernel_read_usermodhelper/kernel_rw_usermodhelper
- Make rpm_transition_script accept a role
- Added new policy for pcp
- Allow bumbleed to connect to xserver port
- Allow pegasus_openlmi_storage_t to read hwdata
* Fri Jan 17 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-14 * Fri Jan 17 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-14
- Make rpm_transition_script accept a role - Make rpm_transition_script accept a role
- Clean up pcp.te - Clean up pcp.te