- Change etc files to config files to allow users to read them

booleans-strict.conf

@@ -1,228 +0,0 @@
-# Allow making anonymous memory executable, e.g.for runtime-code generation or executable stack.
-# 
-allow_execmem = false
-
-# Allow making a modified private filemapping executable (text relocation).
-# 
-allow_execmod = false
-
-# Allow making the stack executable via mprotect.Also requires allow_execmem.
-# 
-allow_execstack = false
-
-# Allow ftp servers to modify public filesused for public file transfer services.
-# 
-allow_ftpd_anon_write = false
-
-# Allow gssd to read temp directory.
-# 
-allow_gssd_read_tmp = false
-
-# Allow Apache to modify public filesused for public file transfer services.
-# 
-allow_httpd_anon_write = false
-
-# Allow system to run with kerberos
-# 
-allow_kerberos = true
-
-# Allow rsync to modify public filesused for public file transfer services.
-# 
-allow_rsync_anon_write = false
-
-# Allow sasl to read shadow
-# 
-allow_saslauthd_read_shadow = false
-
-# Allow samba to modify public filesused for public file transfer services.
-# 
-allow_smbd_anon_write = false
-
-# Allow sysadm to ptrace all processes
-# 
-allow_ptrace = false
-
-# Allow system to run with NIS
-# 
-allow_ypbind = false
-
-# Enable extra rules in the cron domainto support fcron.
-# 
-fcron_crond = false
-
-# Allow ftp to read and write files in the user home directories
-# 
-ftp_home_dir = false
-
-# Allow ftpd to run directly without inetd
-# 
-ftpd_is_daemon = true
-
-# Allow httpd to use built in scripting (usually php)
-# 
-httpd_builtin_scripting = false
-
-# Allow http daemon to tcp connect
-# 
-httpd_can_network_connect = false
-
-# Allow httpd cgi support
-# 
-httpd_enable_cgi = false
-
-# Allow httpd to act as a FTP server bylistening on the ftp port.
-# 
-httpd_enable_ftp_server = false
-
-# Allow httpd to read home directories
-# 
-httpd_enable_homedirs = false
-
-# Run SSI execs in system CGI script domain.
-# 
-httpd_ssi_exec = false
-
-# Allow http daemon to communicate with the TTY
-# 
-httpd_tty_comm = false
-
-# Run CGI in the main httpd domain
-# 
-httpd_unified = false
-
-# Allow BIND to write the master zone files.Generally this is used for dynamic DNS.
-# 
-named_write_master_zones = false
-
-# Allow nfs to be exported read/write.
-# 
-nfs_export_all_rw = false
-
-# Allow nfs to be exported read only
-# 
-nfs_export_all_ro = false
-
-# Allow pppd to load kernel modules for certain modems
-# 
-pppd_can_insmod = false
-
-# Allow reading of default_t files.
-# 
-read_default_t = false
-
-# Allow ssh to run from inetd instead of as a daemon.
-# 
-run_ssh_inetd = false
-
-# Allow samba to export user home directories.
-# 
-samba_enable_home_dirs = false
-
-# Allow squid to connect to all ports, not justHTTP, FTP, and Gopher ports.
-# 
-squid_connect_any = false
-
-# Allow ssh logins as sysadm_r:sysadm_t
-# 
-ssh_sysadm_login = false
-
-# Configure stunnel to be a standalone daemon orinetd service.
-# 
-stunnel_is_daemon = false
-
-# Support NFS home directories
-# 
-use_nfs_home_dirs = false
-
-# Support SAMBA home directories
-# 
-use_samba_home_dirs = false
-
-# Control users use of ping and traceroute
-# 
-user_ping = false
-
-# Allow gpg executable stack
-# 
-allow_gpg_execstack = false
-
-# allow host key based authentication
-# 
-allow_ssh_keysign = false
-
-# Allow users to connect to mysql
-# 
-allow_user_mysql_connect = false
-
-# Allow system cron jobs to relabel filesystemfor restoring file contexts.
-# 
-cron_can_relabel = false
-
-# Allow pppd to be run for a regular user
-# 
-pppd_for_user = false
-
-# Allow applications to read untrusted contentIf this is disallowed, Internet content hasto be manually relabeled for read access to be granted
-# 
-read_untrusted_content = true
-
-# Allow user spamassassin clients to use the network.
-# 
-spamassassin_can_network = false
-
-# Allow staff_r users to search the sysadm homedir and read files (such as ~/.bashrc)
-# 
-staff_read_sysadm_file = false
-
-# Allow regular users direct mouse access
-# 
-user_direct_mouse = false
-
-# Allow users to read system messages.
-# 
-user_dmesg = false
-
-# Allow users to control network interfaces(also needs USERCTL=true)
-# 
-user_net_control = false
-
-# Allow user to r/w files on filesystemsthat do not have extended attributes (FAT, CDROM, FLOPPY)
-# 
-user_rw_noexattrfile = false
-
-# Allow users to rw usb devices
-# 
-user_rw_usb = false
-
-# Allow users to run TCP servers (bind to ports and accept connection fromthe same domain and outside users)  disabling this forces FTP passive modeand may change other protocols.
-# 
-user_tcp_server = false
-
-# Allow w to display everyone
-# 
-user_ttyfile_stat = false
-
-# Allow applications to write untrusted contentIf this is disallowed, no Internet contentwill be stored.
-# 
-write_untrusted_content = true
-
-spamd_enable_home_dirs = false
-
-# Allow login domains to polyinstatiate directories
-# 
-allow_polyinstantiation = false
-
-# Allow sysadm to ptrace all processes
-# 
-allow_ptrace = false
-
-## Control users use of ping and traceroute
-user_ping = true
-
-# Allow unlabeled packets to flow
-# 
-allow_unlabeled_packets = true
-
-# Allow samba to act as the domain controller
-# 
-samba_domain_controller = false

policy-init.patch

@@ -1,11 +0,0 @@
-diff -up serefpolicy-3.3.1/policy/modules/services/rhgb.te.foo serefpolicy-3.3.1/policy/modules/services/rhgb.te
---- serefpolicy-3.3.1/policy/modules/services/rhgb.te.foo	2008-03-11 17:50:18.000000000 -0400
-+++ serefpolicy-3.3.1/policy/modules/services/rhgb.te	2008-03-11 17:50:18.000000000 -0400
-@@ -92,6 +92,7 @@ term_use_ptmx(rhgb_t)
- term_getattr_pty_fs(rhgb_t)
- 
- init_write_initctl(rhgb_t)
-+init_chat(rhgb_t)
- 
- libs_use_ld_so(rhgb_t)
- libs_use_shared_libs(rhgb_t)

policy-udev_tbl.patch

@@ -1,10 +0,0 @@
---- serefpolicy-2.5.9/policy/modules/system/udev.fc.udev_tbl	2007-03-20 09:36:50.000000000 -0400
-+++ serefpolicy-2.5.9/policy/modules/system/udev.fc	2007-03-22 06:36:55.000000000 -0400
-@@ -1,6 +1,6 @@
- # udev
- 
--/dev/\.udev(/.*)?	gen_context(system_u:object_r:udev_tbl_t,s0)
-+/dev/\.udev(/.*)? --	gen_context(system_u:object_r:udev_tbl_t,s0)
- /dev/\.udevdb	--	gen_context(system_u:object_r:udev_tbl_t,s0)
- /dev/udev\.tbl	--	gen_context(system_u:object_r:udev_tbl_t,s0)
- 

securetty_types-strict

@@ -1,3 +0,0 @@
-sysadm_tty_device_t
-user_tty_device_t
-staff_tty_device_t

selinux-policy.spec

@@ -17,7 +17,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.3.1
-Release: 36%{?dist}
+Release: 39%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -303,6 +303,8 @@ exit 0
 
 
 %triggerpostun targeted -- selinux-policy-targeted < 3.2.5-9.fc9
+. /etc/selinux/config
+[ "${SELINUXTYPE}" != "targeted" ] && exit 0
 setsebool -P use_nfs_home_dirs=1
 semanage user -l | grep -s unconfined_u 
 if [ $? -eq 0 ]; then
@@ -311,9 +313,9 @@ else
    semanage user -a -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u  2> /dev/null
 fi
 seuser=`semanage login -l | grep __default__ | awk '{ print $2 }'`
-[ $seuser == "system_u" ]   && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 __default__
+[ "$seuser" != "unconfined_u" ]  && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 __default__
 seuser=`semanage login -l | grep root | awk '{ print $2 }'`
-[ $seuser == "system_u" ]   && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 root
+[ "$seuser" == "system_u" ] && semanage login -m -s "unconfined_u"  -r s0-s0:c0.c1023 root
 restorecon -R /root /etc/selinux/targeted 2> /dev/null
 semodule -r qmail 2> /dev/null
 exit 0
@@ -383,6 +385,12 @@ exit 0
 %endif
 
 %changelog
+* Wed Apr 23 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-39
+- Change etc files to config files to allow users to read them
+
+* Fri Apr 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-37
+- Lots of fixes for confined domains on NFS_t homedir
+
 * Mon Apr 14 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-36
 - dontaudit mrtg reading /proc
 - Allow iscsi to signal itself

setrans-strict.conf

@@ -1,19 +0,0 @@
-#
-# Multi-Category Security translation table for SELinux
-# 
-# Uncomment the following to disable translation libary
-# disable=1
-#
-# Objects can be categorized with 0-1023 categories defined by the admin.
-# Objects can be in more than one category at a time.
-# Categories are stored in the system as c0-c1023.  Users can use this
-# table to translate the categories into a more meaningful output.
-# Examples:
-# s0:c0=CompanyConfidential
-# s0:c1=PatientRecord
-# s0:c2=Unclassified
-# s0:c3=TopSecret
-# s0:c1,c3=CompanyConfidentialRedHat
-s0=
-s0-s0:c0.c1023=SystemLow-SystemHigh
-s0:c0.c1023=SystemHigh

seusers-strict

@@ -1,3 +0,0 @@
-system_u:system_u:s0-s0:c0.c1023
-root:root:s0-s0:c0.c1023
-__default__:user_u:s0

users_extra-strict

@@ -1,4 +0,0 @@
-user root prefix staff;
-user staff_u prefix staff;
-user user_u prefix user;
-user sysadm_u prefix sysadm;

xm.patch

@@ -1,136 +0,0 @@
-diff -ru serefpolicy-2.2.35-orig/policy/modules/system/xen.fc serefpolicy-2.2.35/policy/modules/system/xen.fc
---- serefpolicy-2.2.35-orig/policy/modules/system/xen.fc	2006-04-24 20:14:54.000000000 -0400
-+++ serefpolicy-2.2.35/policy/modules/system/xen.fc	2006-04-25 11:01:03.000000000 -0400
-@@ -14,3 +14,4 @@
- /var/run/xend\.pid	--      gen_context(system_u:object_r:xend_var_run_t,s0)
- /var/run/xenstore\.pid	--	gen_context(system_u:object_r:xenstored_var_run_t,s0)
- /var/run/xenstored(/.*)?	gen_context(system_u:object_r:xenstored_var_run_t,s0)
-+/usr/sbin/xm		--	gen_context(system_u:object_r:xm_exec_t,s0)
---- serefpolicy-2.2.35-orig/policy/modules/system/xen.if	2006-04-25 10:27:36.000000000 -0400
-+++ serefpolicy-2.2.35/policy/modules/system/xen.if	2006-04-25 11:03:07.000000000 -0400
-@@ -83,3 +83,66 @@
- 	allow $1 xenstored_var_run_t:sock_file { getattr write };
- 	allow $1 xenstored_t:unix_stream_socket connectto;
- ')
-+
-+########################################
-+## <summary>
-+##	Connect to xend over an unix stream socket.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`xen_connect',`
-+	gen_require(`
-+		type xend_t, xend_var_run_t;
-+	')
-+
-+	files_search_pids($1)
-+	allow $1 xend_var_run_t:dir search;
-+	allow $1 xend_var_run_t:sock_file getattr;
-+	allow $1 xend_t:unix_stream_socket connectto;
-+')
-+
-+########################################
-+## <summary>
-+##	Write to xend over an unix stream socket.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`xen_writeto',`
-+	gen_require(`
-+		type xend_var_run_t;
-+	')
-+
-+	allow $1 xend_var_run_t:sock_file write;
-+')
-+
-+
-+########################################
-+## <summary>
-+##	Execute a domain transition to run xm.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+##	Domain allowed to transition.
-+## </summary>
-+## </param>
-+#
-+interface(`xm_domtrans',`
-+	gen_requires(`
-+		type xm_t, xm_exec_t;
-+	')
-+
-+	domain_auto_trans($1,xm_exec_t,xm_t)
-+
-+	allow $1 xm_t:fd use;
-+	allow xm_t $1:fd use;
-+	allow xm_t:$1:fifo_file rw_file_perms;
-+	allow xm_t $1:process sigchld;
-+')
-Only in serefpolicy-2.2.35/policy/modules/system: xen.if~
---- serefpolicy-2.2.35-orig/policy/modules/system/xen.te	2006-04-25 10:27:36.000000000 -0400
-+++ serefpolicy-2.2.35/policy/modules/system/xen.te	2006-04-25 11:01:03.000000000 -0400
-@@ -224,3 +224,55 @@
- miscfiles_read_localization(xenstored_t)
- 
- xen_append_log(xenstored_t)
-+
-+########################################
-+#
-+# Declarations
-+#
-+
-+type xm_t;
-+type xm_exec_t;
-+domain_type(xm_t)
-+init_daemon_domain(xm_t, xm_exec_t)
-+
-+########################################
-+#
-+# xm local policy
-+#
-+# Check in /etc/selinux/refpolicy/include for macros to use instead of allow rules.
-+
-+# Some common macros (you might be able to remove some)
-+files_read_etc_files(xm_t)
-+libs_use_ld_so(xm_t)
-+libs_use_shared_libs(xm_t)
-+miscfiles_read_localization(xm_t)
-+# internal communication is often done using fifo and unix sockets.
-+allow xm_t self:fifo_file { read write };
-+allow xm_t self:unix_stream_socket create_stream_socket_perms;
-+
-+
-+# james -- aujdit2allow
-+
-+corecmd_exec_bin(xm_t)
-+corecmd_exec_sbin(xm_t)
-+
-+kernel_read_system_state(xm_t)
-+kernel_read_kernel_sysctls(xm_t)
-+kernel_read_xen_state(xm_t)
-+kernel_write_xen_state(xm_t)
-+term_use_all_terms(xm_t)
-+
-+dev_read_urand(xm_t)
-+
-+xen_append_log(xm_t)
-+xen_connect(xm_t)
-+xen_writeto(xm_t)
-+
-+xen_stream_connect_xenstore(xm_t)
-+allow xm_t self:capability dac_override;
-+
-+
-+# allow xm_t root_t:dir search;
-+# Need to relabel files for xen
-+auth_read_all_files_except_shadow(xm_t)
-+