- Apply unconfined_execmem_exec_t to haskell programs
This commit is contained in:
parent
6959e0bb76
commit
547aa2a382
@ -2904,7 +2904,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc
|
|||||||
+/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:java_exec_t,s0)
|
+/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:java_exec_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.4.2/policy/modules/apps/java.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.4.2/policy/modules/apps/java.if
|
||||||
--- nsaserefpolicy/policy/modules/apps/java.if 2008-06-12 23:25:03.000000000 -0400
|
--- nsaserefpolicy/policy/modules/apps/java.if 2008-06-12 23:25:03.000000000 -0400
|
||||||
+++ serefpolicy-3.4.2/policy/modules/apps/java.if 2008-06-12 23:37:51.000000000 -0400
|
+++ serefpolicy-3.4.2/policy/modules/apps/java.if 2008-06-23 06:21:38.000000000 -0400
|
||||||
@@ -32,7 +32,7 @@
|
@@ -32,7 +32,7 @@
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
@ -21027,7 +21027,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prel
|
|||||||
+/etc/rc\.d/init\.d/prelude-lml -- gen_context(system_u:object_r:prelude_lml_script_exec_t,s0)
|
+/etc/rc\.d/init\.d/prelude-lml -- gen_context(system_u:object_r:prelude_lml_script_exec_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.if serefpolicy-3.4.2/policy/modules/services/prelude.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.if serefpolicy-3.4.2/policy/modules/services/prelude.if
|
||||||
--- nsaserefpolicy/policy/modules/services/prelude.if 2008-06-12 23:25:06.000000000 -0400
|
--- nsaserefpolicy/policy/modules/services/prelude.if 2008-06-12 23:25:06.000000000 -0400
|
||||||
+++ serefpolicy-3.4.2/policy/modules/services/prelude.if 2008-06-12 23:37:52.000000000 -0400
|
+++ serefpolicy-3.4.2/policy/modules/services/prelude.if 2008-06-23 08:18:26.000000000 -0400
|
||||||
@@ -42,7 +42,7 @@
|
@@ -42,7 +42,7 @@
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@ -21037,10 +21037,48 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prel
|
|||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@@ -56,6 +56,24 @@
|
@@ -56,6 +56,80 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
|
+## Read the prelude spool files
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`prelude_read_spool',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type prelude_spool_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ files_search_spool($1)
|
||||||
|
+ read_files_pattern($1, prelude_spool_t, prelude_spool_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Read/Write to prelude-manager spool files.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed to transition.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`prelude_rw_spool',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type prelude_spool_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ files_search_spool($1)
|
||||||
|
+ rw_files_pattern($1, prelude_spool_t, prelude_spool_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
+## Execute prelude server in the prelude domain.
|
+## Execute prelude server in the prelude domain.
|
||||||
+## </summary>
|
+## </summary>
|
||||||
+## <param name="domain">
|
+## <param name="domain">
|
||||||
@ -21058,11 +21096,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prel
|
|||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
+########################################
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Execute prelude lml server in the prelude lml domain.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## The type of the process performing this action.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`prelude_lml_script_domtrans',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type prelude_lml_script_exec_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ init_script_domtrans_spec($1,prelude_lml_script_exec_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
+## <summary>
|
+## <summary>
|
||||||
## All of the rules required to administrate
|
## All of the rules required to administrate
|
||||||
## an prelude environment
|
## an prelude environment
|
||||||
## </summary>
|
## </summary>
|
||||||
@@ -64,6 +82,16 @@
|
@@ -64,6 +138,16 @@
|
||||||
## Domain allowed access.
|
## Domain allowed access.
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
@ -21079,15 +21135,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prel
|
|||||||
## <rolecap/>
|
## <rolecap/>
|
||||||
#
|
#
|
||||||
interface(`prelude_admin',`
|
interface(`prelude_admin',`
|
||||||
@@ -71,6 +99,7 @@
|
@@ -71,6 +155,11 @@
|
||||||
type prelude_t, prelude_spool_t;
|
type prelude_t, prelude_spool_t;
|
||||||
type prelude_var_run_t, prelude_var_lib_t;
|
type prelude_var_run_t, prelude_var_lib_t;
|
||||||
type prelude_audisp_t, prelude_audisp_var_run_t;
|
type prelude_audisp_t, prelude_audisp_var_run_t;
|
||||||
+ type prelude_script_exec_t;
|
+ type prelude_script_exec_t;
|
||||||
|
+
|
||||||
|
+ type prelude_lml_t, prelude_lml_tmp_t;
|
||||||
|
+ type prelude_lml_var_run_t;
|
||||||
|
+ type prelude_lml_script_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
allow $1 prelude_t:process { ptrace signal_perms };
|
allow $1 prelude_t:process { ptrace signal_perms };
|
||||||
@@ -79,11 +108,14 @@
|
@@ -79,11 +168,23 @@
|
||||||
allow $1 prelude_audisp_t:process { ptrace signal_perms };
|
allow $1 prelude_audisp_t:process { ptrace signal_perms };
|
||||||
ps_process_pattern($1, prelude_audisp_t)
|
ps_process_pattern($1, prelude_audisp_t)
|
||||||
|
|
||||||
@ -21096,7 +21156,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prel
|
|||||||
- manage_files_pattern($1, prelude_var_lib_t, prelude_var_lib_t)
|
- manage_files_pattern($1, prelude_var_lib_t, prelude_var_lib_t)
|
||||||
-
|
-
|
||||||
- manage_files_pattern($1, prelude_var_run_t, prelude_var_run_t)
|
- manage_files_pattern($1, prelude_var_run_t, prelude_var_run_t)
|
||||||
-
|
+ allow $1 prelude_lml_t:process { ptrace signal_perms };
|
||||||
|
+ ps_process_pattern($1, prelude_lml_t)
|
||||||
|
|
||||||
- manage_files_pattern($1, prelude_audisp_var_run_t, prelude_audisp_var_run_t)
|
- manage_files_pattern($1, prelude_audisp_var_run_t, prelude_audisp_var_run_t)
|
||||||
+ # Allow prelude_t to restart the apache service
|
+ # Allow prelude_t to restart the apache service
|
||||||
+ prelude_script_domtrans($1)
|
+ prelude_script_domtrans($1)
|
||||||
@ -21104,14 +21166,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prel
|
|||||||
+ role_transition $2 prelude_script_exec_t system_r;
|
+ role_transition $2 prelude_script_exec_t system_r;
|
||||||
+ allow $2 system_r;
|
+ allow $2 system_r;
|
||||||
+
|
+
|
||||||
|
+ # Allow prelude_t to restart the apache service
|
||||||
|
+ prelude_lml_script_domtrans($1)
|
||||||
|
+ role_transition $2 prelude_lml_script_exec_t system_r;
|
||||||
|
+
|
||||||
+ manage_all_pattern($1, prelude_spool_t)
|
+ manage_all_pattern($1, prelude_spool_t)
|
||||||
+ manage_all_pattern($1, prelude_var_lib_t)
|
+ manage_all_pattern($1, prelude_var_lib_t)
|
||||||
+ manage_all_pattern($1, prelude_var_run_t)
|
+ manage_all_pattern($1, prelude_var_run_t)
|
||||||
+ manage_all_pattern($1, prelude_audisp_var_run_t)
|
+ manage_all_pattern($1, prelude_audisp_var_run_t)
|
||||||
|
+ manage_all_pattern($1, prelude_lml_tmp_t)
|
||||||
|
+ manage_all_pattern($1, prelude_lml_var_run_t)
|
||||||
')
|
')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.te serefpolicy-3.4.2/policy/modules/services/prelude.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.te serefpolicy-3.4.2/policy/modules/services/prelude.te
|
||||||
--- nsaserefpolicy/policy/modules/services/prelude.te 2008-06-12 23:25:06.000000000 -0400
|
--- nsaserefpolicy/policy/modules/services/prelude.te 2008-06-12 23:25:06.000000000 -0400
|
||||||
+++ serefpolicy-3.4.2/policy/modules/services/prelude.te 2008-06-22 07:53:36.000000000 -0400
|
+++ serefpolicy-3.4.2/policy/modules/services/prelude.te 2008-06-23 08:09:53.000000000 -0400
|
||||||
@@ -19,12 +19,31 @@
|
@@ -19,12 +19,31 @@
|
||||||
type prelude_var_lib_t;
|
type prelude_var_lib_t;
|
||||||
files_type(prelude_var_lib_t)
|
files_type(prelude_var_lib_t)
|
||||||
@ -24165,11 +24233,135 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp
|
|||||||
|
|
||||||
fs_getattr_all_dirs(snmpd_t)
|
fs_getattr_all_dirs(snmpd_t)
|
||||||
fs_getattr_all_fs(snmpd_t)
|
fs_getattr_all_fs(snmpd_t)
|
||||||
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snort.fc serefpolicy-3.4.2/policy/modules/services/snort.fc
|
||||||
|
--- nsaserefpolicy/policy/modules/services/snort.fc 2008-06-12 23:25:05.000000000 -0400
|
||||||
|
+++ serefpolicy-3.4.2/policy/modules/services/snort.fc 2008-06-23 07:53:28.000000000 -0400
|
||||||
|
@@ -1,6 +1,10 @@
|
||||||
|
+/usr/s?bin/snort -- gen_context(system_u:object_r:snort_exec_t,s0)
|
||||||
|
+/usr/sbin/snort-plain -- gen_context(system_u:object_r:snort_exec_t,s0)
|
||||||
|
|
||||||
|
-/etc/snort(/.*)? gen_context(system_u:object_r:snort_etc_t,s0)
|
||||||
|
+/etc/snort(/.*)? gen_context(system_u:object_r:snort_etc_t,s0)
|
||||||
|
|
||||||
|
-/usr/s?bin/snort -- gen_context(system_u:object_r:snort_exec_t,s0)
|
||||||
|
+/var/run/snort.* -- gen_context(system_u:object_r:snort_var_run_t,s0)
|
||||||
|
|
||||||
|
-/var/log/snort(/.*)? gen_context(system_u:object_r:snort_log_t,s0)
|
||||||
|
+/var/log/snort(/.*)? gen_context(system_u:object_r:snort_log_t,s0)
|
||||||
|
+
|
||||||
|
+/etc/rc\.d/init\.d/snortd -- gen_context(system_u:object_r:snort_script_exec_t,s0)
|
||||||
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snort.if serefpolicy-3.4.2/policy/modules/services/snort.if
|
||||||
|
--- nsaserefpolicy/policy/modules/services/snort.if 2008-06-12 23:25:05.000000000 -0400
|
||||||
|
+++ serefpolicy-3.4.2/policy/modules/services/snort.if 2008-06-23 07:54:05.000000000 -0400
|
||||||
|
@@ -1 +1,95 @@
|
||||||
|
-## <summary>Snort network intrusion detection system</summary>
|
||||||
|
+## <summary>SELinux policy for Snort IDS</summary>
|
||||||
|
+## <desc>
|
||||||
|
+## <p>
|
||||||
|
+## Applies SELinux security to Snort IDS
|
||||||
|
+## </p>
|
||||||
|
+## </desc>
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Execute a domain transition to run snort.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed to transition.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`snort_domtrans',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type snort_t, snort_exec_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ domtrans_pattern($1, snort_exec_t, snort_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Execute snort IDS in the snort domain.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## The type of the process performing this action.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`snort_script_domtrans',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type snort_script_exec_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ init_script_domtrans_spec($1, snort_script_exec_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## All of the rules required to administrate
|
||||||
|
+## an snort environment
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+## <param name="role">
|
||||||
|
+## <summary>
|
||||||
|
+## The role to be allowed to manage the syslog domain.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+## <param name="terminal">
|
||||||
|
+## <summary>
|
||||||
|
+## The type of the user terminal.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+## <rolecap/>
|
||||||
|
+#
|
||||||
|
+interface(`snort_admin',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type snort_t, snort_var_run_t, snort_script_exec_t, snort_etc_t, snort_log_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ allow $1 snort_t:process { ptrace signal_perms getattr };
|
||||||
|
+ read_files_pattern($1, snort_t, snort_t)
|
||||||
|
+
|
||||||
|
+ manage_all_pattern($1, snort_etc_t)
|
||||||
|
+ manage_all_pattern($1, snort_var_run_t)
|
||||||
|
+ manage_all_pattern($1, snort_log_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Signal the snort domain.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed to transition.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`snort_signal',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type snort_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ allow $1 snort_t:process signal;
|
||||||
|
+')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snort.te serefpolicy-3.4.2/policy/modules/services/snort.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snort.te serefpolicy-3.4.2/policy/modules/services/snort.te
|
||||||
--- nsaserefpolicy/policy/modules/services/snort.te 2008-06-12 23:25:05.000000000 -0400
|
--- nsaserefpolicy/policy/modules/services/snort.te 2008-06-12 23:25:05.000000000 -0400
|
||||||
+++ serefpolicy-3.4.2/policy/modules/services/snort.te 2008-06-12 23:37:51.000000000 -0400
|
+++ serefpolicy-3.4.2/policy/modules/services/snort.te 2008-06-23 08:17:03.000000000 -0400
|
||||||
@@ -11,7 +11,7 @@
|
@@ -8,10 +8,13 @@
|
||||||
init_daemon_domain(snort_t,snort_exec_t)
|
|
||||||
|
type snort_t;
|
||||||
|
type snort_exec_t;
|
||||||
|
-init_daemon_domain(snort_t,snort_exec_t)
|
||||||
|
+init_daemon_domain(snort_t, snort_exec_t)
|
||||||
|
+
|
||||||
|
+type snort_script_exec_t;
|
||||||
|
+init_script_type(snort_script_exec_t)
|
||||||
|
|
||||||
type snort_etc_t;
|
type snort_etc_t;
|
||||||
-files_type(snort_etc_t)
|
-files_type(snort_etc_t)
|
||||||
@ -24177,6 +24369,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snor
|
|||||||
|
|
||||||
type snort_log_t;
|
type snort_log_t;
|
||||||
logging_log_file(snort_log_t)
|
logging_log_file(snort_log_t)
|
||||||
|
@@ -65,8 +68,11 @@
|
||||||
|
corenet_raw_sendrecv_all_nodes(snort_t)
|
||||||
|
corenet_tcp_sendrecv_all_ports(snort_t)
|
||||||
|
corenet_udp_sendrecv_all_ports(snort_t)
|
||||||
|
+corenet_tcp_connect_prelude_port(snort_t)
|
||||||
|
|
||||||
|
dev_read_sysfs(snort_t)
|
||||||
|
+dev_read_rand(snort_t)
|
||||||
|
+dev_read_urand(snort_t)
|
||||||
|
|
||||||
|
domain_use_interactive_fds(snort_t)
|
||||||
|
|
||||||
|
@@ -79,6 +85,8 @@
|
||||||
|
libs_use_ld_so(snort_t)
|
||||||
|
libs_use_shared_libs(snort_t)
|
||||||
|
|
||||||
|
+init_read_utmp(snort_t)
|
||||||
|
+
|
||||||
|
logging_send_syslog_msg(snort_t)
|
||||||
|
|
||||||
|
miscfiles_read_localization(snort_t)
|
||||||
|
@@ -90,6 +98,10 @@
|
||||||
|
sysadm_dontaudit_search_home_dirs(snort_t)
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
+ prelude_rw_spool(snort_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
|
seutil_sigchld_newrole(snort_t)
|
||||||
|
')
|
||||||
|
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.fc serefpolicy-3.4.2/policy/modules/services/soundserver.fc
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.fc serefpolicy-3.4.2/policy/modules/services/soundserver.fc
|
||||||
--- nsaserefpolicy/policy/modules/services/soundserver.fc 2008-06-12 23:25:05.000000000 -0400
|
--- nsaserefpolicy/policy/modules/services/soundserver.fc 2008-06-12 23:25:05.000000000 -0400
|
||||||
+++ serefpolicy-3.4.2/policy/modules/services/soundserver.fc 2008-06-12 23:37:51.000000000 -0400
|
+++ serefpolicy-3.4.2/policy/modules/services/soundserver.fc 2008-06-12 23:37:51.000000000 -0400
|
||||||
@ -26115,7 +26339,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.4.2/policy/modules/services/xserver.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.4.2/policy/modules/services/xserver.if
|
||||||
--- nsaserefpolicy/policy/modules/services/xserver.if 2008-06-12 23:25:06.000000000 -0400
|
--- nsaserefpolicy/policy/modules/services/xserver.if 2008-06-12 23:25:06.000000000 -0400
|
||||||
+++ serefpolicy-3.4.2/policy/modules/services/xserver.if 2008-06-12 23:37:52.000000000 -0400
|
+++ serefpolicy-3.4.2/policy/modules/services/xserver.if 2008-06-23 07:38:27.000000000 -0400
|
||||||
@@ -16,7 +16,8 @@
|
@@ -16,7 +16,8 @@
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type xkb_var_lib_t, xserver_exec_t, xserver_log_t;
|
type xkb_var_lib_t, xserver_exec_t, xserver_log_t;
|
||||||
@ -26282,7 +26506,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
userdom_search_user_home_dirs($1,$1_xserver_t)
|
userdom_search_user_home_dirs($1,$1_xserver_t)
|
||||||
userdom_use_user_ttys($1,$1_xserver_t)
|
userdom_use_user_ttys($1,$1_xserver_t)
|
||||||
userdom_setattr_user_ttys($1,$1_xserver_t)
|
userdom_setattr_user_ttys($1,$1_xserver_t)
|
||||||
@@ -360,13 +369,6 @@
|
@@ -355,18 +364,12 @@
|
||||||
|
|
||||||
|
xserver_use_user_fonts($1,$1_xserver_t)
|
||||||
|
xserver_rw_xdm_tmp_files($1_xauth_t)
|
||||||
|
+ xserver_read_xdm_xserver_tmp_files($2)
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
userhelper_search_config($1_xserver_t)
|
userhelper_search_config($1_xserver_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -26296,7 +26526,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
##############################
|
##############################
|
||||||
#
|
#
|
||||||
# $1_xauth_t Local policy
|
# $1_xauth_t Local policy
|
||||||
@@ -375,12 +377,12 @@
|
@@ -375,12 +378,12 @@
|
||||||
allow $1_xauth_t self:process signal;
|
allow $1_xauth_t self:process signal;
|
||||||
allow $1_xauth_t self:unix_stream_socket create_stream_socket_perms;
|
allow $1_xauth_t self:unix_stream_socket create_stream_socket_perms;
|
||||||
|
|
||||||
@ -26314,7 +26544,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
|
|
||||||
domtrans_pattern($2, xauth_exec_t, $1_xauth_t)
|
domtrans_pattern($2, xauth_exec_t, $1_xauth_t)
|
||||||
|
|
||||||
@@ -389,11 +391,11 @@
|
@@ -389,11 +392,11 @@
|
||||||
# allow ps to show xauth
|
# allow ps to show xauth
|
||||||
ps_process_pattern($2,$1_xauth_t)
|
ps_process_pattern($2,$1_xauth_t)
|
||||||
|
|
||||||
@ -26330,7 +26560,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
|
|
||||||
domain_use_interactive_fds($1_xauth_t)
|
domain_use_interactive_fds($1_xauth_t)
|
||||||
|
|
||||||
@@ -435,16 +437,16 @@
|
@@ -435,16 +438,16 @@
|
||||||
|
|
||||||
domtrans_pattern($2, iceauth_exec_t, $1_iceauth_t)
|
domtrans_pattern($2, iceauth_exec_t, $1_iceauth_t)
|
||||||
|
|
||||||
@ -26352,7 +26582,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
|
|
||||||
fs_search_auto_mountpoints($1_iceauth_t)
|
fs_search_auto_mountpoints($1_iceauth_t)
|
||||||
|
|
||||||
@@ -467,34 +469,12 @@
|
@@ -467,34 +470,12 @@
|
||||||
#
|
#
|
||||||
|
|
||||||
# Device rules
|
# Device rules
|
||||||
@ -26389,7 +26619,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
# xrdb X11:ChangeProperty prop=RESOURCE_MANAGER
|
# xrdb X11:ChangeProperty prop=RESOURCE_MANAGER
|
||||||
allow $2 info_xproperty_t:x_property { create write append };
|
allow $2 info_xproperty_t:x_property { create write append };
|
||||||
|
|
||||||
@@ -610,7 +590,7 @@
|
@@ -610,7 +591,7 @@
|
||||||
# refpolicywarn(`$0() has been deprecated, please use xserver_user_x_domain_template instead.')
|
# refpolicywarn(`$0() has been deprecated, please use xserver_user_x_domain_template instead.')
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type xdm_t, xdm_tmp_t;
|
type xdm_t, xdm_tmp_t;
|
||||||
@ -26398,7 +26628,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
')
|
')
|
||||||
|
|
||||||
allow $2 self:shm create_shm_perms;
|
allow $2 self:shm create_shm_perms;
|
||||||
@@ -618,8 +598,8 @@
|
@@ -618,8 +599,8 @@
|
||||||
allow $2 self:unix_stream_socket { connectto create_stream_socket_perms };
|
allow $2 self:unix_stream_socket { connectto create_stream_socket_perms };
|
||||||
|
|
||||||
# Read .Xauthority file
|
# Read .Xauthority file
|
||||||
@ -26409,7 +26639,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
|
|
||||||
# for when /tmp/.X11-unix is created by the system
|
# for when /tmp/.X11-unix is created by the system
|
||||||
allow $2 xdm_t:fd use;
|
allow $2 xdm_t:fd use;
|
||||||
@@ -643,13 +623,175 @@
|
@@ -643,13 +624,175 @@
|
||||||
|
|
||||||
xserver_read_xdm_tmp_files($2)
|
xserver_read_xdm_tmp_files($2)
|
||||||
|
|
||||||
@ -26589,7 +26819,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
#######################################
|
#######################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Interface to provide X object permissions on a given X server to
|
## Interface to provide X object permissions on a given X server to
|
||||||
@@ -676,7 +818,7 @@
|
@@ -676,7 +819,7 @@
|
||||||
#
|
#
|
||||||
template(`xserver_common_x_domain_template',`
|
template(`xserver_common_x_domain_template',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -26598,7 +26828,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
type xproperty_t, info_xproperty_t, clipboard_xproperty_t;
|
type xproperty_t, info_xproperty_t, clipboard_xproperty_t;
|
||||||
type input_xevent_t, focus_xevent_t, property_xevent_t, manage_xevent_t;
|
type input_xevent_t, focus_xevent_t, property_xevent_t, manage_xevent_t;
|
||||||
type xevent_t, client_xevent_t;
|
type xevent_t, client_xevent_t;
|
||||||
@@ -685,7 +827,6 @@
|
@@ -685,7 +828,6 @@
|
||||||
attribute x_server_domain, x_domain;
|
attribute x_server_domain, x_domain;
|
||||||
attribute xproperty_type;
|
attribute xproperty_type;
|
||||||
attribute xevent_type, xextension_type;
|
attribute xevent_type, xextension_type;
|
||||||
@ -26606,7 +26836,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
|
|
||||||
class x_drawable all_x_drawable_perms;
|
class x_drawable all_x_drawable_perms;
|
||||||
class x_screen all_x_screen_perms;
|
class x_screen all_x_screen_perms;
|
||||||
@@ -709,20 +850,22 @@
|
@@ -709,20 +851,22 @@
|
||||||
# Declarations
|
# Declarations
|
||||||
#
|
#
|
||||||
|
|
||||||
@ -26632,7 +26862,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
##############################
|
##############################
|
||||||
#
|
#
|
||||||
# Local Policy
|
# Local Policy
|
||||||
@@ -740,7 +883,7 @@
|
@@ -740,7 +884,7 @@
|
||||||
allow $3 x_server_domain:x_server getattr;
|
allow $3 x_server_domain:x_server getattr;
|
||||||
# everyone can do override-redirect windows.
|
# everyone can do override-redirect windows.
|
||||||
# this could be used to spoof labels
|
# this could be used to spoof labels
|
||||||
@ -26641,7 +26871,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
# everyone can receive management events on the root window
|
# everyone can receive management events on the root window
|
||||||
# allows to know when new windows appear, among other things
|
# allows to know when new windows appear, among other things
|
||||||
allow $3 manage_xevent_t:x_event receive;
|
allow $3 manage_xevent_t:x_event receive;
|
||||||
@@ -749,7 +892,7 @@
|
@@ -749,7 +893,7 @@
|
||||||
# can read server-owned resources
|
# can read server-owned resources
|
||||||
allow $3 x_server_domain:x_resource read;
|
allow $3 x_server_domain:x_resource read;
|
||||||
# can mess with own clients
|
# can mess with own clients
|
||||||
@ -26650,7 +26880,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
|
|
||||||
# X Protocol Extensions
|
# X Protocol Extensions
|
||||||
allow $3 std_xext_t:x_extension { query use };
|
allow $3 std_xext_t:x_extension { query use };
|
||||||
@@ -758,27 +901,17 @@
|
@@ -758,27 +902,17 @@
|
||||||
|
|
||||||
# X Properties
|
# X Properties
|
||||||
# can read and write client properties
|
# can read and write client properties
|
||||||
@ -26683,7 +26913,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
|
|
||||||
# X Input
|
# X Input
|
||||||
# can receive own events
|
# can receive own events
|
||||||
@@ -805,6 +938,12 @@
|
@@ -805,6 +939,12 @@
|
||||||
allow $3 manage_xevent_t:x_synthetic_event send;
|
allow $3 manage_xevent_t:x_synthetic_event send;
|
||||||
allow $3 client_xevent_t:x_synthetic_event send;
|
allow $3 client_xevent_t:x_synthetic_event send;
|
||||||
|
|
||||||
@ -26696,7 +26926,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
# X Selections
|
# X Selections
|
||||||
# can use the clipboard
|
# can use the clipboard
|
||||||
allow $3 clipboard_xselection_t:x_selection { getattr setattr read };
|
allow $3 clipboard_xselection_t:x_selection { getattr setattr read };
|
||||||
@@ -813,13 +952,15 @@
|
@@ -813,13 +953,15 @@
|
||||||
|
|
||||||
# Other X Objects
|
# Other X Objects
|
||||||
# can create and use cursors
|
# can create and use cursors
|
||||||
@ -26716,7 +26946,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
|
|
||||||
tunable_policy(`! xserver_object_manager',`
|
tunable_policy(`! xserver_object_manager',`
|
||||||
# should be xserver_unconfined($3),
|
# should be xserver_unconfined($3),
|
||||||
@@ -879,17 +1020,17 @@
|
@@ -879,17 +1021,17 @@
|
||||||
#
|
#
|
||||||
template(`xserver_user_x_domain_template',`
|
template(`xserver_user_x_domain_template',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -26741,7 +26971,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
|
|
||||||
# for when /tmp/.X11-unix is created by the system
|
# for when /tmp/.X11-unix is created by the system
|
||||||
allow $3 xdm_t:fd use;
|
allow $3 xdm_t:fd use;
|
||||||
@@ -916,11 +1057,9 @@
|
@@ -916,11 +1058,9 @@
|
||||||
# X object manager
|
# X object manager
|
||||||
xserver_common_x_domain_template($1,$2,$3)
|
xserver_common_x_domain_template($1,$2,$3)
|
||||||
|
|
||||||
@ -26756,7 +26986,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -952,26 +1091,43 @@
|
@@ -952,26 +1092,43 @@
|
||||||
#
|
#
|
||||||
template(`xserver_use_user_fonts',`
|
template(`xserver_use_user_fonts',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -26807,7 +27037,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
## Transition to a user Xauthority domain.
|
## Transition to a user Xauthority domain.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <desc>
|
## <desc>
|
||||||
@@ -1005,6 +1161,73 @@
|
@@ -1005,6 +1162,73 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -26881,7 +27111,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
## Transition to a user Xauthority domain.
|
## Transition to a user Xauthority domain.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <desc>
|
## <desc>
|
||||||
@@ -1030,10 +1253,10 @@
|
@@ -1030,10 +1254,10 @@
|
||||||
#
|
#
|
||||||
template(`xserver_user_home_dir_filetrans_user_xauth',`
|
template(`xserver_user_home_dir_filetrans_user_xauth',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -26894,7 +27124,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1219,6 +1442,25 @@
|
@@ -1219,6 +1443,25 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -26920,7 +27150,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
## Read xdm-writable configuration files.
|
## Read xdm-writable configuration files.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -1273,6 +1515,7 @@
|
@@ -1273,6 +1516,7 @@
|
||||||
files_search_tmp($1)
|
files_search_tmp($1)
|
||||||
allow $1 xdm_tmp_t:dir list_dir_perms;
|
allow $1 xdm_tmp_t:dir list_dir_perms;
|
||||||
create_sock_files_pattern($1,xdm_tmp_t,xdm_tmp_t)
|
create_sock_files_pattern($1,xdm_tmp_t,xdm_tmp_t)
|
||||||
@ -26928,7 +27158,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1291,7 +1534,7 @@
|
@@ -1291,7 +1535,7 @@
|
||||||
')
|
')
|
||||||
|
|
||||||
files_search_pids($1)
|
files_search_pids($1)
|
||||||
@ -26937,7 +27167,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1314,6 +1557,24 @@
|
@@ -1314,6 +1558,24 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -26962,7 +27192,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
## Execute the X server in the XDM X server domain.
|
## Execute the X server in the XDM X server domain.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -1324,15 +1585,47 @@
|
@@ -1324,15 +1586,47 @@
|
||||||
#
|
#
|
||||||
interface(`xserver_domtrans_xdm_xserver',`
|
interface(`xserver_domtrans_xdm_xserver',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -27011,7 +27241,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
## Make an X session script an entrypoint for the specified domain.
|
## Make an X session script an entrypoint for the specified domain.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -1482,7 +1775,7 @@
|
@@ -1482,7 +1776,7 @@
|
||||||
type xdm_xserver_tmp_t;
|
type xdm_xserver_tmp_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -27020,7 +27250,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1674,6 +1967,65 @@
|
@@ -1674,6 +1968,65 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -27086,7 +27316,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
## Interface to provide X object permissions on a given X server to
|
## Interface to provide X object permissions on a given X server to
|
||||||
## an X client domain. Gives the domain complete control over the
|
## an X client domain. Gives the domain complete control over the
|
||||||
## display.
|
## display.
|
||||||
@@ -1686,8 +2038,87 @@
|
@@ -1686,8 +2039,87 @@
|
||||||
#
|
#
|
||||||
interface(`xserver_unconfined',`
|
interface(`xserver_unconfined',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -32116,8 +32346,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
|
|||||||
')
|
')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.4.2/policy/modules/system/unconfined.fc
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.4.2/policy/modules/system/unconfined.fc
|
||||||
--- nsaserefpolicy/policy/modules/system/unconfined.fc 2008-06-12 23:25:07.000000000 -0400
|
--- nsaserefpolicy/policy/modules/system/unconfined.fc 2008-06-12 23:25:07.000000000 -0400
|
||||||
+++ serefpolicy-3.4.2/policy/modules/system/unconfined.fc 2008-06-12 23:37:52.000000000 -0400
|
+++ serefpolicy-3.4.2/policy/modules/system/unconfined.fc 2008-06-23 06:28:00.000000000 -0400
|
||||||
@@ -2,15 +2,19 @@
|
@@ -2,15 +2,26 @@
|
||||||
# e.g.:
|
# e.g.:
|
||||||
# /usr/local/bin/appsrv -- gen_context(system_u:object_r:unconfined_exec_t,s0)
|
# /usr/local/bin/appsrv -- gen_context(system_u:object_r:unconfined_exec_t,s0)
|
||||||
# For the time being until someone writes a sane policy, we need initrc to transition to unconfined_t
|
# For the time being until someone writes a sane policy, we need initrc to transition to unconfined_t
|
||||||
@ -32141,6 +32371,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
+
|
+
|
||||||
+/usr/lib64/erlang/erts-[^/]+/bin/beam.smp -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
|
+/usr/lib64/erlang/erts-[^/]+/bin/beam.smp -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
|
||||||
+/usr/lib/erlang/erts-[^/]+/bin/beam.smp -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
|
+/usr/lib/erlang/erts-[^/]+/bin/beam.smp -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
|
||||||
|
+
|
||||||
|
+/usr/bin/haddock.* -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
|
||||||
|
+/usr/bin/hasktags -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
|
||||||
|
+/usr/bin/runghc -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
|
||||||
|
+/usr/bin/runhaskell -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
|
||||||
|
+/usr/libexec/ghc-[^/]+/.*bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
|
||||||
|
+/usr/libexec/ghc-[^/]+/ghc-.* -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.4.2/policy/modules/system/unconfined.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.4.2/policy/modules/system/unconfined.if
|
||||||
--- nsaserefpolicy/policy/modules/system/unconfined.if 2008-06-12 23:25:07.000000000 -0400
|
--- nsaserefpolicy/policy/modules/system/unconfined.if 2008-06-12 23:25:07.000000000 -0400
|
||||||
+++ serefpolicy-3.4.2/policy/modules/system/unconfined.if 2008-06-22 20:50:34.000000000 -0400
|
+++ serefpolicy-3.4.2/policy/modules/system/unconfined.if 2008-06-22 20:50:34.000000000 -0400
|
||||||
|
@ -17,7 +17,7 @@
|
|||||||
Summary: SELinux policy configuration
|
Summary: SELinux policy configuration
|
||||||
Name: selinux-policy
|
Name: selinux-policy
|
||||||
Version: 3.4.2
|
Version: 3.4.2
|
||||||
Release: 5%{?dist}
|
Release: 6%{?dist}
|
||||||
License: GPLv2+
|
License: GPLv2+
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
Source: serefpolicy-%{version}.tgz
|
Source: serefpolicy-%{version}.tgz
|
||||||
@ -375,6 +375,9 @@ exit 0
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Mon Jun 23 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-6
|
||||||
|
- Apply unconfined_execmem_exec_t to haskell programs
|
||||||
|
|
||||||
* Sun Jun 22 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-5
|
* Sun Jun 22 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-5
|
||||||
- Fix prelude file context
|
- Fix prelude file context
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user