- Update gpg to allow reading of inotify
This commit is contained in:
parent
3648b64bcb
commit
5baf53aabd
@ -957,7 +957,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc
|
|||||||
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
|
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.2.5/policy/modules/admin/rpm.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.2.5/policy/modules/admin/rpm.if
|
||||||
--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400
|
--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400
|
||||||
+++ serefpolicy-3.2.5/policy/modules/admin/rpm.if 2008-01-03 11:32:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/admin/rpm.if 2008-01-08 08:11:14.000000000 -0500
|
||||||
@@ -152,6 +152,24 @@
|
@@ -152,6 +152,24 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -983,7 +983,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
|
|||||||
## Send and receive messages from
|
## Send and receive messages from
|
||||||
## rpm over dbus.
|
## rpm over dbus.
|
||||||
## </summary>
|
## </summary>
|
||||||
@@ -210,6 +228,24 @@
|
@@ -173,6 +191,27 @@
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
+## Send and receive messages from
|
||||||
|
+## rpm_script over dbus.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`rpm_script_dbus_chat',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type rpm_script_t;
|
||||||
|
+ class dbus send_msg;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ allow $1 rpm_script_t:dbus send_msg;
|
||||||
|
+ allow rpm_script_t $1:dbus send_msg;
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
## Create, read, write, and delete the RPM log.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
@@ -210,6 +249,24 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -1008,7 +1036,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
|
|||||||
## Create, read, write, and delete RPM
|
## Create, read, write, and delete RPM
|
||||||
## script temporary files.
|
## script temporary files.
|
||||||
## </summary>
|
## </summary>
|
||||||
@@ -225,7 +261,29 @@
|
@@ -225,7 +282,29 @@
|
||||||
')
|
')
|
||||||
|
|
||||||
files_search_tmp($1)
|
files_search_tmp($1)
|
||||||
@ -1038,7 +1066,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -289,3 +347,137 @@
|
@@ -289,3 +368,137 @@
|
||||||
dontaudit $1 rpm_var_lib_t:file manage_file_perms;
|
dontaudit $1 rpm_var_lib_t:file manage_file_perms;
|
||||||
dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms;
|
dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms;
|
||||||
')
|
')
|
||||||
@ -1304,7 +1332,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if
|
|||||||
')
|
')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.2.5/policy/modules/admin/su.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.2.5/policy/modules/admin/su.if
|
||||||
--- nsaserefpolicy/policy/modules/admin/su.if 2007-10-12 08:56:09.000000000 -0400
|
--- nsaserefpolicy/policy/modules/admin/su.if 2007-10-12 08:56:09.000000000 -0400
|
||||||
+++ serefpolicy-3.2.5/policy/modules/admin/su.if 2008-01-03 13:47:22.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/admin/su.if 2008-01-08 05:34:26.000000000 -0500
|
||||||
@@ -41,15 +41,13 @@
|
@@ -41,15 +41,13 @@
|
||||||
|
|
||||||
allow $2 $1_su_t:process signal;
|
allow $2 $1_su_t:process signal;
|
||||||
@ -1330,7 +1358,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s
|
|||||||
logging_send_syslog_msg($1_su_t)
|
logging_send_syslog_msg($1_su_t)
|
||||||
|
|
||||||
miscfiles_read_localization($1_su_t)
|
miscfiles_read_localization($1_su_t)
|
||||||
@@ -172,13 +171,12 @@
|
@@ -119,11 +118,6 @@
|
||||||
|
optional_policy(`
|
||||||
|
kerberos_use($1_su_t)
|
||||||
|
')
|
||||||
|
-
|
||||||
|
- ifdef(`TODO',`
|
||||||
|
- # Caused by su - init scripts
|
||||||
|
- dontaudit $1_su_t initrc_devpts_t:chr_file { getattr ioctl };
|
||||||
|
- ') dnl end TODO
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
@@ -172,13 +166,12 @@
|
||||||
domain_interactive_fd($1_su_t)
|
domain_interactive_fd($1_su_t)
|
||||||
role $3 types $1_su_t;
|
role $3 types $1_su_t;
|
||||||
|
|
||||||
@ -1347,7 +1387,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s
|
|||||||
allow $1_su_t self:key { search write };
|
allow $1_su_t self:key { search write };
|
||||||
|
|
||||||
# Transition from the user domain to this domain.
|
# Transition from the user domain to this domain.
|
||||||
@@ -188,7 +186,7 @@
|
@@ -188,7 +181,7 @@
|
||||||
corecmd_shell_domtrans($1_su_t,$2)
|
corecmd_shell_domtrans($1_su_t,$2)
|
||||||
allow $2 $1_su_t:fd use;
|
allow $2 $1_su_t:fd use;
|
||||||
allow $2 $1_su_t:fifo_file rw_file_perms;
|
allow $2 $1_su_t:fifo_file rw_file_perms;
|
||||||
@ -1356,7 +1396,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s
|
|||||||
|
|
||||||
kernel_read_system_state($1_su_t)
|
kernel_read_system_state($1_su_t)
|
||||||
kernel_read_kernel_sysctls($1_su_t)
|
kernel_read_kernel_sysctls($1_su_t)
|
||||||
@@ -203,15 +201,15 @@
|
@@ -203,15 +196,15 @@
|
||||||
# needed for pam_rootok
|
# needed for pam_rootok
|
||||||
selinux_compute_access_vector($1_su_t)
|
selinux_compute_access_vector($1_su_t)
|
||||||
|
|
||||||
@ -1375,7 +1415,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s
|
|||||||
files_read_etc_files($1_su_t)
|
files_read_etc_files($1_su_t)
|
||||||
files_read_etc_runtime_files($1_su_t)
|
files_read_etc_runtime_files($1_su_t)
|
||||||
files_search_var_lib($1_su_t)
|
files_search_var_lib($1_su_t)
|
||||||
@@ -226,12 +224,14 @@
|
@@ -226,12 +219,14 @@
|
||||||
libs_use_ld_so($1_su_t)
|
libs_use_ld_so($1_su_t)
|
||||||
libs_use_shared_libs($1_su_t)
|
libs_use_shared_libs($1_su_t)
|
||||||
|
|
||||||
@ -1391,7 +1431,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s
|
|||||||
|
|
||||||
ifdef(`distro_rhel4',`
|
ifdef(`distro_rhel4',`
|
||||||
domain_role_change_exemption($1_su_t)
|
domain_role_change_exemption($1_su_t)
|
||||||
@@ -295,13 +295,7 @@
|
@@ -295,13 +290,7 @@
|
||||||
xserver_domtrans_user_xauth($1, $1_su_t)
|
xserver_domtrans_user_xauth($1, $1_su_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -2327,8 +2367,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.if s
|
|||||||
########################################
|
########################################
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.2.5/policy/modules/apps/gpg.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.2.5/policy/modules/apps/gpg.te
|
||||||
--- nsaserefpolicy/policy/modules/apps/gpg.te 2007-12-19 05:32:09.000000000 -0500
|
--- nsaserefpolicy/policy/modules/apps/gpg.te 2007-12-19 05:32:09.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/apps/gpg.te 2008-01-03 17:11:59.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/apps/gpg.te 2008-01-08 05:15:21.000000000 -0500
|
||||||
@@ -7,15 +7,223 @@
|
@@ -7,15 +7,225 @@
|
||||||
#
|
#
|
||||||
|
|
||||||
# Type for gpg or pgp executables.
|
# Type for gpg or pgp executables.
|
||||||
@ -2378,6 +2418,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te s
|
|||||||
+allow gpg_t user_gpg_secret_t:dir create_dir_perms;
|
+allow gpg_t user_gpg_secret_t:dir create_dir_perms;
|
||||||
+userdom_user_home_dir_filetrans(user, gpg_t, user_gpg_secret_t, dir)
|
+userdom_user_home_dir_filetrans(user, gpg_t, user_gpg_secret_t, dir)
|
||||||
+userdom_manage_user_home_content_files(user,gpg_t)
|
+userdom_manage_user_home_content_files(user,gpg_t)
|
||||||
|
+userdom_manage_user_tmp_files(user,gpg_t)
|
||||||
+
|
+
|
||||||
+# transition from the gpg domain to the helper domain
|
+# transition from the gpg domain to the helper domain
|
||||||
+domtrans_pattern(gpg_t,gpg_helper_exec_t,gpg_helper_t)
|
+domtrans_pattern(gpg_t,gpg_helper_exec_t,gpg_helper_t)
|
||||||
@ -2397,6 +2438,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te s
|
|||||||
+dev_read_urand(gpg_t)
|
+dev_read_urand(gpg_t)
|
||||||
+
|
+
|
||||||
+fs_getattr_xattr_fs(gpg_t)
|
+fs_getattr_xattr_fs(gpg_t)
|
||||||
|
+fs_list_inotifyfs(gpg_t)
|
||||||
+
|
+
|
||||||
+domain_use_interactive_fds(gpg_t)
|
+domain_use_interactive_fds(gpg_t)
|
||||||
+
|
+
|
||||||
@ -4364,8 +4406,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te
|
|||||||
')
|
')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.2.5/policy/modules/kernel/corecommands.fc
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.2.5/policy/modules/kernel/corecommands.fc
|
||||||
--- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-12-12 11:35:27.000000000 -0500
|
--- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-12-12 11:35:27.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/kernel/corecommands.fc 2008-01-03 14:26:07.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/kernel/corecommands.fc 2008-01-07 11:08:14.000000000 -0500
|
||||||
@@ -7,6 +7,7 @@
|
@@ -7,11 +7,11 @@
|
||||||
/bin/d?ash -- gen_context(system_u:object_r:shell_exec_t,s0)
|
/bin/d?ash -- gen_context(system_u:object_r:shell_exec_t,s0)
|
||||||
/bin/bash -- gen_context(system_u:object_r:shell_exec_t,s0)
|
/bin/bash -- gen_context(system_u:object_r:shell_exec_t,s0)
|
||||||
/bin/bash2 -- gen_context(system_u:object_r:shell_exec_t,s0)
|
/bin/bash2 -- gen_context(system_u:object_r:shell_exec_t,s0)
|
||||||
@ -4373,7 +4415,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
|
|||||||
/bin/ksh.* -- gen_context(system_u:object_r:shell_exec_t,s0)
|
/bin/ksh.* -- gen_context(system_u:object_r:shell_exec_t,s0)
|
||||||
/bin/sash -- gen_context(system_u:object_r:shell_exec_t,s0)
|
/bin/sash -- gen_context(system_u:object_r:shell_exec_t,s0)
|
||||||
/bin/tcsh -- gen_context(system_u:object_r:shell_exec_t,s0)
|
/bin/tcsh -- gen_context(system_u:object_r:shell_exec_t,s0)
|
||||||
@@ -58,6 +59,8 @@
|
/bin/zsh.* -- gen_context(system_u:object_r:shell_exec_t,s0)
|
||||||
|
-
|
||||||
|
#
|
||||||
|
# /dev
|
||||||
|
#
|
||||||
|
@@ -58,6 +58,8 @@
|
||||||
|
|
||||||
/etc/netplug\.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
/etc/netplug\.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||||
|
|
||||||
@ -4382,7 +4429,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
|
|||||||
/etc/ppp/ip-down\..* -- gen_context(system_u:object_r:bin_t,s0)
|
/etc/ppp/ip-down\..* -- gen_context(system_u:object_r:bin_t,s0)
|
||||||
/etc/ppp/ip-up\..* -- gen_context(system_u:object_r:bin_t,s0)
|
/etc/ppp/ip-up\..* -- gen_context(system_u:object_r:bin_t,s0)
|
||||||
/etc/ppp/ipv6-up\..* -- gen_context(system_u:object_r:bin_t,s0)
|
/etc/ppp/ipv6-up\..* -- gen_context(system_u:object_r:bin_t,s0)
|
||||||
@@ -127,6 +130,8 @@
|
@@ -127,6 +129,8 @@
|
||||||
/opt/vmware/workstation/lib/lib/wrapper-gtk24\.sh -- gen_context(system_u:object_r:bin_t,s0)
|
/opt/vmware/workstation/lib/lib/wrapper-gtk24\.sh -- gen_context(system_u:object_r:bin_t,s0)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -4391,7 +4438,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
|
|||||||
#
|
#
|
||||||
# /usr
|
# /usr
|
||||||
#
|
#
|
||||||
@@ -147,7 +152,7 @@
|
@@ -147,7 +151,7 @@
|
||||||
/usr/lib(64)?/cups/backend(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
/usr/lib(64)?/cups/backend(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||||
/usr/lib(64)?/cups/cgi-bin/.* -- gen_context(system_u:object_r:bin_t,s0)
|
/usr/lib(64)?/cups/cgi-bin/.* -- gen_context(system_u:object_r:bin_t,s0)
|
||||||
/usr/lib(64)?/cups/daemon(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
/usr/lib(64)?/cups/daemon(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||||
@ -4400,15 +4447,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
|
|||||||
|
|
||||||
/usr/lib(64)?/cyrus-imapd/.* -- gen_context(system_u:object_r:bin_t,s0)
|
/usr/lib(64)?/cyrus-imapd/.* -- gen_context(system_u:object_r:bin_t,s0)
|
||||||
/usr/lib(64)?/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0)
|
/usr/lib(64)?/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0)
|
||||||
@@ -186,6 +191,8 @@
|
@@ -186,7 +190,10 @@
|
||||||
/usr/local/Printer/[^/]*/cupswrapper(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
/usr/local/Printer/[^/]*/cupswrapper(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||||
/usr/local/Printer/[^/]*/lpd(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
/usr/local/Printer/[^/]*/lpd(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||||
|
|
||||||
+/usr/bin/scponly -- gen_context(system_u:object_r:shell_exec_t,s0)
|
+/usr/bin/scponly -- gen_context(system_u:object_r:shell_exec_t,s0)
|
||||||
+/usr/sbin/scponlyc -- gen_context(system_u:object_r:shell_exec_t,s0)
|
+/usr/sbin/scponlyc -- gen_context(system_u:object_r:shell_exec_t,s0)
|
||||||
/usr/sbin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0)
|
/usr/sbin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0)
|
||||||
|
+/usr/sbin/smrsh -- gen_context(system_u:object_r:shell_exec_t,s0)
|
||||||
|
|
||||||
/usr/share/apr-0/build/[^/]+\.sh -- gen_context(system_u:object_r:bin_t,s0)
|
/usr/share/apr-0/build/[^/]+\.sh -- gen_context(system_u:object_r:bin_t,s0)
|
||||||
|
/usr/share/apr-0/build/libtool -- gen_context(system_u:object_r:bin_t,s0)
|
||||||
@@ -284,3 +291,6 @@
|
@@ -284,3 +291,6 @@
|
||||||
ifdef(`distro_suse',`
|
ifdef(`distro_suse',`
|
||||||
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
|
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
|
||||||
@ -5003,6 +5052,36 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag
|
|||||||
/dev/fd[^/]+ -b gen_context(system_u:object_r:removable_device_t,s0)
|
/dev/fd[^/]+ -b gen_context(system_u:object_r:removable_device_t,s0)
|
||||||
/dev/flash[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
|
/dev/flash[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
|
||||||
/dev/gscd -b gen_context(system_u:object_r:removable_device_t,s0)
|
/dev/gscd -b gen_context(system_u:object_r:removable_device_t,s0)
|
||||||
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.2.5/policy/modules/kernel/storage.if
|
||||||
|
--- nsaserefpolicy/policy/modules/kernel/storage.if 2007-10-29 18:02:31.000000000 -0400
|
||||||
|
+++ serefpolicy-3.2.5/policy/modules/kernel/storage.if 2008-01-08 06:26:10.000000000 -0500
|
||||||
|
@@ -81,6 +81,26 @@
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
+## dontaudit the caller attempts to read from a fixed disk.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## The type of the process performing this action.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`storage_dontaudit_raw_read_fixed_disk',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ attribute fixed_disk_raw_read;
|
||||||
|
+ type fixed_disk_device_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ dontaudit $1 fixed_disk_device_t:blk_file read_blk_file_perms;
|
||||||
|
+ dontaudit $1 fixed_disk_device_t:chr_file read_chr_file_perms;
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
## Allow the caller to directly read from a fixed disk.
|
||||||
|
## This is extremly dangerous as it can bypass the
|
||||||
|
## SELinux protections for filesystem objects, and
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.2.5/policy/modules/kernel/terminal.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.2.5/policy/modules/kernel/terminal.if
|
||||||
--- nsaserefpolicy/policy/modules/kernel/terminal.if 2007-09-12 10:34:17.000000000 -0400
|
--- nsaserefpolicy/policy/modules/kernel/terminal.if 2007-09-12 10:34:17.000000000 -0400
|
||||||
+++ serefpolicy-3.2.5/policy/modules/kernel/terminal.if 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/kernel/terminal.if 2007-12-19 05:38:09.000000000 -0500
|
||||||
@ -7012,7 +7091,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.
|
|||||||
-')
|
-')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.5/policy/modules/services/dbus.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.5/policy/modules/services/dbus.if
|
||||||
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/dbus.if 2007-12-30 09:53:47.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/dbus.if 2008-01-08 10:52:45.000000000 -0500
|
||||||
@@ -53,6 +53,7 @@
|
@@ -53,6 +53,7 @@
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type system_dbusd_exec_t, system_dbusd_t, dbusd_etc_t;
|
type system_dbusd_exec_t, system_dbusd_t, dbusd_etc_t;
|
||||||
@ -7063,7 +7142,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
|||||||
|
|
||||||
ifdef(`hide_broken_symptoms', `
|
ifdef(`hide_broken_symptoms', `
|
||||||
dontaudit $2 $1_dbusd_t:netlink_selinux_socket { read write };
|
dontaudit $2 $1_dbusd_t:netlink_selinux_socket { read write };
|
||||||
@@ -214,7 +221,7 @@
|
@@ -182,6 +189,7 @@
|
||||||
|
optional_policy(`
|
||||||
|
xserver_use_xdm_fds($1_dbusd_t)
|
||||||
|
xserver_rw_xdm_pipes($1_dbusd_t)
|
||||||
|
+ xserver_dontaudit_xdm_lib_search($1_dbusd_t)
|
||||||
|
')
|
||||||
|
')
|
||||||
|
|
||||||
|
@@ -214,7 +222,7 @@
|
||||||
|
|
||||||
# SE-DBus specific permissions
|
# SE-DBus specific permissions
|
||||||
# allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg;
|
# allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg;
|
||||||
@ -7072,7 +7159,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
|||||||
|
|
||||||
read_files_pattern($2, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
|
read_files_pattern($2, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
|
||||||
files_search_var_lib($2)
|
files_search_var_lib($2)
|
||||||
@@ -251,6 +258,7 @@
|
@@ -223,6 +231,10 @@
|
||||||
|
files_search_pids($2)
|
||||||
|
stream_connect_pattern($2,system_dbusd_var_run_t,system_dbusd_var_run_t,system_dbusd_t)
|
||||||
|
dbus_read_config($2)
|
||||||
|
+
|
||||||
|
+ optional_policy(`
|
||||||
|
+ rpm_script_dbus_chat($2)
|
||||||
|
+ ')
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
@@ -251,6 +263,7 @@
|
||||||
template(`dbus_user_bus_client_template',`
|
template(`dbus_user_bus_client_template',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
type $1_dbusd_t;
|
type $1_dbusd_t;
|
||||||
@ -7080,7 +7178,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
|||||||
class dbus send_msg;
|
class dbus send_msg;
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -263,6 +271,7 @@
|
@@ -263,6 +276,7 @@
|
||||||
|
|
||||||
# For connecting to the bus
|
# For connecting to the bus
|
||||||
allow $3 $1_dbusd_t:unix_stream_socket connectto;
|
allow $3 $1_dbusd_t:unix_stream_socket connectto;
|
||||||
@ -7088,7 +7186,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -292,6 +301,59 @@
|
@@ -292,6 +306,59 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -7148,7 +7246,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
|||||||
## Read dbus configuration.
|
## Read dbus configuration.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -366,3 +428,53 @@
|
@@ -366,3 +433,53 @@
|
||||||
|
|
||||||
allow $1 system_dbusd_t:dbus *;
|
allow $1 system_dbusd_t:dbus *;
|
||||||
')
|
')
|
||||||
@ -7243,7 +7341,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.
|
|||||||
## </summary>
|
## </summary>
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.te serefpolicy-3.2.5/policy/modules/services/dcc.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.te serefpolicy-3.2.5/policy/modules/services/dcc.te
|
||||||
--- nsaserefpolicy/policy/modules/services/dcc.te 2007-12-19 05:32:17.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/dcc.te 2007-12-19 05:32:17.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/dcc.te 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/dcc.te 2008-01-04 09:52:10.000000000 -0500
|
||||||
@@ -124,7 +124,7 @@
|
@@ -124,7 +124,7 @@
|
||||||
# dcc procmail interface local policy
|
# dcc procmail interface local policy
|
||||||
#
|
#
|
||||||
@ -7253,15 +7351,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.
|
|||||||
allow dcc_client_t self:unix_dgram_socket create_socket_perms;
|
allow dcc_client_t self:unix_dgram_socket create_socket_perms;
|
||||||
allow dcc_client_t self:udp_socket create_socket_perms;
|
allow dcc_client_t self:udp_socket create_socket_perms;
|
||||||
|
|
||||||
@@ -148,6 +148,8 @@
|
@@ -148,6 +148,10 @@
|
||||||
files_read_etc_files(dcc_client_t)
|
files_read_etc_files(dcc_client_t)
|
||||||
files_read_etc_runtime_files(dcc_client_t)
|
files_read_etc_runtime_files(dcc_client_t)
|
||||||
|
|
||||||
+kernel_read_system_state(dcc_client_t)
|
+kernel_read_system_state(dcc_client_t)
|
||||||
|
+
|
||||||
|
+auth_use_nsswitch(dcc_client_t)
|
||||||
+
|
+
|
||||||
libs_use_ld_so(dcc_client_t)
|
libs_use_ld_so(dcc_client_t)
|
||||||
libs_use_shared_libs(dcc_client_t)
|
libs_use_shared_libs(dcc_client_t)
|
||||||
|
|
||||||
|
@@ -155,11 +159,8 @@
|
||||||
|
|
||||||
|
miscfiles_read_localization(dcc_client_t)
|
||||||
|
|
||||||
|
-sysnet_read_config(dcc_client_t)
|
||||||
|
-sysnet_dns_name_resolve(dcc_client_t)
|
||||||
|
-
|
||||||
|
optional_policy(`
|
||||||
|
- nscd_socket_use(dcc_client_t)
|
||||||
|
+ spamassassin_read_spamd_tmp_files(dcc_client_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
@@ -275,9 +276,7 @@
|
||||||
|
userdom_dontaudit_use_unpriv_user_fds(dccd_t)
|
||||||
|
userdom_dontaudit_search_sysadm_home_dirs(dccd_t)
|
||||||
|
|
||||||
|
-optional_policy(`
|
||||||
|
- nscd_socket_use(dccd_t)
|
||||||
|
-')
|
||||||
|
+auth_use_nsswitch(dccd_t)
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
seutil_sigchld_newrole(dccd_t)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dictd.fc serefpolicy-3.2.5/policy/modules/services/dictd.fc
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dictd.fc serefpolicy-3.2.5/policy/modules/services/dictd.fc
|
||||||
--- nsaserefpolicy/policy/modules/services/dictd.fc 2006-11-16 17:15:20.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/dictd.fc 2006-11-16 17:15:20.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/dictd.fc 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/dictd.fc 2007-12-19 05:38:09.000000000 -0500
|
||||||
@ -7730,7 +7854,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim
|
|||||||
+
|
+
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.fc serefpolicy-3.2.5/policy/modules/services/fail2ban.fc
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.fc serefpolicy-3.2.5/policy/modules/services/fail2ban.fc
|
||||||
--- nsaserefpolicy/policy/modules/services/fail2ban.fc 2007-10-12 08:56:07.000000000 -0400
|
--- nsaserefpolicy/policy/modules/services/fail2ban.fc 2007-10-12 08:56:07.000000000 -0400
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/fail2ban.fc 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/fail2ban.fc 2008-01-08 13:32:00.000000000 -0500
|
||||||
@@ -1,3 +1,4 @@
|
@@ -1,3 +1,4 @@
|
||||||
/usr/bin/fail2ban -- gen_context(system_u:object_r:fail2ban_exec_t,s0)
|
/usr/bin/fail2ban -- gen_context(system_u:object_r:fail2ban_exec_t,s0)
|
||||||
+/usr/bin/fail2ban-server -- gen_context(system_u:object_r:fail2ban_exec_t,s0)
|
+/usr/bin/fail2ban-server -- gen_context(system_u:object_r:fail2ban_exec_t,s0)
|
||||||
@ -7887,7 +8011,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
|
|||||||
+')
|
+')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.2.5/policy/modules/services/hal.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.2.5/policy/modules/services/hal.te
|
||||||
--- nsaserefpolicy/policy/modules/services/hal.te 2007-12-19 05:32:17.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/hal.te 2007-12-19 05:32:17.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/hal.te 2007-12-20 14:02:58.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/hal.te 2008-01-08 09:48:17.000000000 -0500
|
||||||
@@ -49,6 +49,9 @@
|
@@ -49,6 +49,9 @@
|
||||||
type hald_var_lib_t;
|
type hald_var_lib_t;
|
||||||
files_type(hald_var_lib_t)
|
files_type(hald_var_lib_t)
|
||||||
@ -7940,7 +8064,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
|
|||||||
#
|
#
|
||||||
|
|
||||||
allow hald_acl_t self:capability { dac_override fowner };
|
allow hald_acl_t self:capability { dac_override fowner };
|
||||||
+allow hald_acl_t self:process signal;
|
+allow hald_acl_t self:process { getattr signal };
|
||||||
allow hald_acl_t self:fifo_file read_fifo_file_perms;
|
allow hald_acl_t self:fifo_file read_fifo_file_perms;
|
||||||
|
|
||||||
domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t)
|
domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t)
|
||||||
@ -8376,7 +8500,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail
|
|||||||
+files_type(mailscanner_spool_t)
|
+files_type(mailscanner_spool_t)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.2.5/policy/modules/services/mta.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.2.5/policy/modules/services/mta.if
|
||||||
--- nsaserefpolicy/policy/modules/services/mta.if 2007-12-06 13:12:03.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/mta.if 2007-12-06 13:12:03.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/mta.if 2007-12-27 11:44:00.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/mta.if 2008-01-04 10:12:33.000000000 -0500
|
||||||
@@ -133,6 +133,12 @@
|
@@ -133,6 +133,12 @@
|
||||||
sendmail_create_log($1_mail_t)
|
sendmail_create_log($1_mail_t)
|
||||||
')
|
')
|
||||||
@ -9437,6 +9561,60 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.
|
|||||||
logrotate_exec(ntpd_t)
|
logrotate_exec(ntpd_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-3.2.5/policy/modules/services/oddjob.te
|
||||||
|
--- nsaserefpolicy/policy/modules/services/oddjob.te 2007-12-19 05:32:17.000000000 -0500
|
||||||
|
+++ serefpolicy-3.2.5/policy/modules/services/oddjob.te 2008-01-04 12:24:30.000000000 -0500
|
||||||
|
@@ -15,6 +15,7 @@
|
||||||
|
type oddjob_mkhomedir_t;
|
||||||
|
type oddjob_mkhomedir_exec_t;
|
||||||
|
domain_type(oddjob_mkhomedir_t)
|
||||||
|
+domain_obj_id_change_exemption(oddjob_mkhomedir_t)
|
||||||
|
init_daemon_domain(oddjob_mkhomedir_t, oddjob_mkhomedir_exec_t)
|
||||||
|
oddjob_system_entry(oddjob_mkhomedir_t, oddjob_mkhomedir_exec_t)
|
||||||
|
|
||||||
|
@@ -68,20 +69,38 @@
|
||||||
|
# oddjob_mkhomedir local policy
|
||||||
|
#
|
||||||
|
|
||||||
|
+allow oddjob_mkhomedir_t self:capability { chown fowner fsetid dac_override };
|
||||||
|
+allow oddjob_mkhomedir_t self:process setfscreate;
|
||||||
|
allow oddjob_mkhomedir_t self:fifo_file { read write };
|
||||||
|
allow oddjob_mkhomedir_t self:unix_stream_socket create_stream_socket_perms;
|
||||||
|
|
||||||
|
files_read_etc_files(oddjob_mkhomedir_t)
|
||||||
|
|
||||||
|
+kernel_read_system_state(oddjob_mkhomedir_t)
|
||||||
|
+
|
||||||
|
+auth_use_nsswitch(oddjob_mkhomedir_t)
|
||||||
|
+
|
||||||
|
libs_use_ld_so(oddjob_mkhomedir_t)
|
||||||
|
libs_use_shared_libs(oddjob_mkhomedir_t)
|
||||||
|
|
||||||
|
+logging_send_syslog_msg(oddjob_mkhomedir_t)
|
||||||
|
+
|
||||||
|
miscfiles_read_localization(oddjob_mkhomedir_t)
|
||||||
|
|
||||||
|
+selinux_get_fs_mount(oddjob_mkhomedir_t)
|
||||||
|
+selinux_validate_context(oddjob_mkhomedir_t)
|
||||||
|
+selinux_compute_access_vector(oddjob_mkhomedir_t)
|
||||||
|
+selinux_compute_create_context(oddjob_mkhomedir_t)
|
||||||
|
+selinux_compute_relabel_context(oddjob_mkhomedir_t)
|
||||||
|
+selinux_compute_user_contexts(oddjob_mkhomedir_t)
|
||||||
|
+
|
||||||
|
+seutil_read_config(oddjob_mkhomedir_t)
|
||||||
|
+seutil_read_file_contexts(oddjob_mkhomedir_t)
|
||||||
|
+seutil_read_default_contexts(oddjob_mkhomedir_t)
|
||||||
|
+
|
||||||
|
# Add/remove user home directories
|
||||||
|
+userdom_manage_unpriv_users_home_content_dirs(oddjob_mkhomedir_t)
|
||||||
|
userdom_home_filetrans_generic_user_home_dir(oddjob_mkhomedir_t)
|
||||||
|
-userdom_manage_generic_user_home_content_dirs(oddjob_mkhomedir_t)
|
||||||
|
-userdom_manage_generic_user_home_content_files(oddjob_mkhomedir_t)
|
||||||
|
-userdom_manage_generic_user_home_dirs(oddjob_mkhomedir_t)
|
||||||
|
-userdom_manage_staff_home_dirs(oddjob_mkhomedir_t)
|
||||||
|
+userdom_manage_all_users_home_content_dirs(oddjob_mkhomedir_t)
|
||||||
|
+userdom_manage_all_users_home_content_files(oddjob_mkhomedir_t)
|
||||||
|
userdom_generic_user_home_dir_filetrans_generic_user_home_content(oddjob_mkhomedir_t,notdevfile_class_set)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.te serefpolicy-3.2.5/policy/modules/services/openct.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.te serefpolicy-3.2.5/policy/modules/services/openct.te
|
||||||
--- nsaserefpolicy/policy/modules/services/openct.te 2007-12-19 05:32:17.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/openct.te 2007-12-19 05:32:17.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/openct.te 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/openct.te 2007-12-19 05:38:09.000000000 -0500
|
||||||
@ -9460,7 +9638,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
|
|||||||
/var/run/openvpn(/.*)? gen_context(system_u:object_r:openvpn_var_run_t,s0)
|
/var/run/openvpn(/.*)? gen_context(system_u:object_r:openvpn_var_run_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.2.5/policy/modules/services/openvpn.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.2.5/policy/modules/services/openvpn.te
|
||||||
--- nsaserefpolicy/policy/modules/services/openvpn.te 2007-12-19 05:32:17.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/openvpn.te 2007-12-19 05:32:17.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/openvpn.te 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/openvpn.te 2008-01-08 13:31:47.000000000 -0500
|
||||||
@@ -8,7 +8,7 @@
|
@@ -8,7 +8,7 @@
|
||||||
|
|
||||||
## <desc>
|
## <desc>
|
||||||
@ -9479,7 +9657,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open
|
|||||||
allow openvpn_t self:process { signal getsched };
|
allow openvpn_t self:process { signal getsched };
|
||||||
|
|
||||||
allow openvpn_t self:unix_dgram_socket { create_socket_perms sendto };
|
allow openvpn_t self:unix_dgram_socket { create_socket_perms sendto };
|
||||||
@@ -110,3 +110,12 @@
|
@@ -47,6 +47,7 @@
|
||||||
|
allow openvpn_t openvpn_etc_t:dir list_dir_perms;
|
||||||
|
read_files_pattern(openvpn_t,openvpn_etc_t,openvpn_etc_t)
|
||||||
|
read_lnk_files_pattern(openvpn_t,openvpn_etc_t,openvpn_etc_t)
|
||||||
|
+can_exec(openvpn_t,openvpn_etc_t)
|
||||||
|
|
||||||
|
allow openvpn_t openvpn_var_log_t:file manage_file_perms;
|
||||||
|
logging_log_filetrans(openvpn_t,openvpn_var_log_t,file)
|
||||||
|
@@ -77,6 +78,7 @@
|
||||||
|
corenet_sendrecv_openvpn_server_packets(openvpn_t)
|
||||||
|
corenet_rw_tun_tap_dev(openvpn_t)
|
||||||
|
corenet_tcp_connect_openvpn_port(openvpn_t)
|
||||||
|
+corenet_tcp_connect_http_port(openvpn_t)
|
||||||
|
|
||||||
|
dev_search_sysfs(openvpn_t)
|
||||||
|
dev_read_rand(openvpn_t)
|
||||||
|
@@ -110,3 +112,12 @@
|
||||||
|
|
||||||
networkmanager_dbus_chat(openvpn_t)
|
networkmanager_dbus_chat(openvpn_t)
|
||||||
')
|
')
|
||||||
@ -10077,8 +10271,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc
|
|||||||
+')
|
+')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.2.5/policy/modules/services/procmail.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.2.5/policy/modules/services/procmail.te
|
||||||
--- nsaserefpolicy/policy/modules/services/procmail.te 2007-12-19 05:32:17.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/procmail.te 2007-12-19 05:32:17.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/procmail.te 2008-01-03 10:56:43.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/procmail.te 2008-01-08 11:05:41.000000000 -0500
|
||||||
@@ -129,7 +129,9 @@
|
@@ -102,6 +102,10 @@
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
+ cron_read_pipes(procmail_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
|
munin_dontaudit_search_lib(procmail_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
@@ -129,7 +133,9 @@
|
||||||
corenet_udp_bind_generic_port(procmail_t)
|
corenet_udp_bind_generic_port(procmail_t)
|
||||||
corenet_dontaudit_udp_bind_all_ports(procmail_t)
|
corenet_dontaudit_udp_bind_all_ports(procmail_t)
|
||||||
|
|
||||||
@ -10167,6 +10372,55 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/qmail.te serefpolicy-3.2.5/policy/modules/services/qmail.te
|
||||||
|
--- nsaserefpolicy/policy/modules/services/qmail.te 2007-10-02 09:54:52.000000000 -0400
|
||||||
|
+++ serefpolicy-3.2.5/policy/modules/services/qmail.te 2008-01-07 16:36:33.000000000 -0500
|
||||||
|
@@ -85,6 +85,8 @@
|
||||||
|
libs_use_ld_so(qmail_inject_t)
|
||||||
|
libs_use_shared_libs(qmail_inject_t)
|
||||||
|
|
||||||
|
+miscfiles_read_localization(qmail_inject_t)
|
||||||
|
+
|
||||||
|
qmail_read_config(qmail_inject_t)
|
||||||
|
|
||||||
|
########################################
|
||||||
|
@@ -106,15 +108,25 @@
|
||||||
|
|
||||||
|
kernel_read_system_state(qmail_local_t)
|
||||||
|
|
||||||
|
+corecmd_exec_bin(qmail_local_t)
|
||||||
|
corecmd_exec_shell(qmail_local_t)
|
||||||
|
+can_exec(qmail_local_t, qmail_local_exec_t)
|
||||||
|
|
||||||
|
files_read_etc_files(qmail_local_t)
|
||||||
|
files_read_etc_runtime_files(qmail_local_t)
|
||||||
|
|
||||||
|
+auth_use_nsswitch(qmail_local_t)
|
||||||
|
+
|
||||||
|
+logging_send_syslog(qmail_local_t)
|
||||||
|
+
|
||||||
|
mta_append_spool(qmail_local_t)
|
||||||
|
|
||||||
|
qmail_domtrans_queue(qmail_local_t)
|
||||||
|
|
||||||
|
+optional_policy(`
|
||||||
|
+ spamassassin_domtrans_spamc(qmail_local_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# qmail-lspawn local policy
|
||||||
|
@@ -155,6 +167,10 @@
|
||||||
|
manage_files_pattern(qmail_queue_t,qmail_spool_t,qmail_spool_t)
|
||||||
|
rw_fifo_files_pattern(qmail_queue_t,qmail_spool_t,qmail_spool_t)
|
||||||
|
|
||||||
|
+corecmd_exec_bin(qmail_queue_t)
|
||||||
|
+
|
||||||
|
+logging_send_syslog(qmail_queue_t)
|
||||||
|
+
|
||||||
|
optional_policy(`
|
||||||
|
daemontools_ipc_domain(qmail_queue_t)
|
||||||
|
')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.fc serefpolicy-3.2.5/policy/modules/services/razor.fc
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.fc serefpolicy-3.2.5/policy/modules/services/razor.fc
|
||||||
--- nsaserefpolicy/policy/modules/services/razor.fc 2007-10-12 08:56:07.000000000 -0400
|
--- nsaserefpolicy/policy/modules/services/razor.fc 2007-10-12 08:56:07.000000000 -0400
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/razor.fc 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/razor.fc 2007-12-19 05:38:09.000000000 -0500
|
||||||
@ -10364,7 +10618,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
|
|||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.2.5/policy/modules/services/rpc.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.2.5/policy/modules/services/rpc.te
|
||||||
--- nsaserefpolicy/policy/modules/services/rpc.te 2007-12-19 05:32:17.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/rpc.te 2007-12-19 05:32:17.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/rpc.te 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/rpc.te 2008-01-08 06:24:04.000000000 -0500
|
||||||
@@ -60,10 +60,14 @@
|
@@ -60,10 +60,14 @@
|
||||||
manage_files_pattern(rpcd_t,rpcd_var_run_t,rpcd_var_run_t)
|
manage_files_pattern(rpcd_t,rpcd_var_run_t,rpcd_var_run_t)
|
||||||
files_pid_filetrans(rpcd_t,rpcd_var_run_t,file)
|
files_pid_filetrans(rpcd_t,rpcd_var_run_t,file)
|
||||||
@ -10399,12 +10653,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
|
|||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
# NFSD local policy
|
# NFSD local policy
|
||||||
@@ -92,9 +102,13 @@
|
@@ -92,9 +102,16 @@
|
||||||
allow nfsd_t exports_t:file { getattr read };
|
allow nfsd_t exports_t:file { getattr read };
|
||||||
allow nfsd_t { nfsd_rw_t nfsd_ro_t }:dir list_dir_perms;
|
allow nfsd_t { nfsd_rw_t nfsd_ro_t }:dir list_dir_perms;
|
||||||
|
|
||||||
+dev_dontaudit_getattr_all_blk_files(nfsd_t)
|
+dev_dontaudit_getattr_all_blk_files(nfsd_t)
|
||||||
+dev_dontaudit_getattr_all_chr_files(nfsd_t)
|
+dev_dontaudit_getattr_all_chr_files(nfsd_t)
|
||||||
|
+
|
||||||
|
+dev_read_lvm_control(nfsd_t)
|
||||||
|
+storage_dontaudit_raw_read_fixed_disk(nfsd_t)
|
||||||
+
|
+
|
||||||
# for /proc/fs/nfs/exports - should we have a new type?
|
# for /proc/fs/nfs/exports - should we have a new type?
|
||||||
kernel_read_system_state(nfsd_t)
|
kernel_read_system_state(nfsd_t)
|
||||||
@ -10413,7 +10670,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
|
|||||||
|
|
||||||
corenet_tcp_bind_all_rpc_ports(nfsd_t)
|
corenet_tcp_bind_all_rpc_ports(nfsd_t)
|
||||||
corenet_udp_bind_all_rpc_ports(nfsd_t)
|
corenet_udp_bind_all_rpc_ports(nfsd_t)
|
||||||
@@ -124,6 +138,7 @@
|
@@ -124,6 +141,7 @@
|
||||||
tunable_policy(`nfs_export_all_rw',`
|
tunable_policy(`nfs_export_all_rw',`
|
||||||
fs_read_noxattr_fs_files(nfsd_t)
|
fs_read_noxattr_fs_files(nfsd_t)
|
||||||
auth_manage_all_files_except_shadow(nfsd_t)
|
auth_manage_all_files_except_shadow(nfsd_t)
|
||||||
@ -10421,7 +10678,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
|
|||||||
')
|
')
|
||||||
|
|
||||||
tunable_policy(`nfs_export_all_ro',`
|
tunable_policy(`nfs_export_all_ro',`
|
||||||
@@ -144,6 +159,7 @@
|
@@ -144,6 +162,7 @@
|
||||||
manage_files_pattern(gssd_t,gssd_tmp_t,gssd_tmp_t)
|
manage_files_pattern(gssd_t,gssd_tmp_t,gssd_tmp_t)
|
||||||
files_tmp_filetrans(gssd_t, gssd_tmp_t, { file dir })
|
files_tmp_filetrans(gssd_t, gssd_tmp_t, { file dir })
|
||||||
|
|
||||||
@ -10429,7 +10686,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
|
|||||||
kernel_read_network_state(gssd_t)
|
kernel_read_network_state(gssd_t)
|
||||||
kernel_read_network_state_symlinks(gssd_t)
|
kernel_read_network_state_symlinks(gssd_t)
|
||||||
kernel_search_network_sysctl(gssd_t)
|
kernel_search_network_sysctl(gssd_t)
|
||||||
@@ -157,8 +173,13 @@
|
@@ -157,8 +176,13 @@
|
||||||
files_list_tmp(gssd_t)
|
files_list_tmp(gssd_t)
|
||||||
files_read_usr_symlinks(gssd_t)
|
files_read_usr_symlinks(gssd_t)
|
||||||
|
|
||||||
@ -10584,7 +10841,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
/var/run/samba/brlock\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0)
|
/var/run/samba/brlock\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.2.5/policy/modules/services/samba.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.2.5/policy/modules/services/samba.if
|
||||||
--- nsaserefpolicy/policy/modules/services/samba.if 2007-10-12 08:56:07.000000000 -0400
|
--- nsaserefpolicy/policy/modules/services/samba.if 2007-10-12 08:56:07.000000000 -0400
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/samba.if 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/samba.if 2008-01-08 13:39:02.000000000 -0500
|
||||||
@@ -331,6 +331,25 @@
|
@@ -331,6 +331,25 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -10619,7 +10876,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -492,3 +512,102 @@
|
@@ -492,3 +512,103 @@
|
||||||
allow $1 samba_var_t:dir search_dir_perms;
|
allow $1 samba_var_t:dir search_dir_perms;
|
||||||
stream_connect_pattern($1,winbind_var_run_t,winbind_var_run_t,winbind_t)
|
stream_connect_pattern($1,winbind_var_run_t,winbind_var_run_t,winbind_t)
|
||||||
')
|
')
|
||||||
@ -10669,6 +10926,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
+ type samba_share_t;
|
+ type samba_share_t;
|
||||||
+ ')
|
+ ')
|
||||||
+
|
+
|
||||||
|
+ allow $1 samba_share_t:filesystem getattr;
|
||||||
+ read_files_pattern($1, samba_share_t, samba_share_t)
|
+ read_files_pattern($1, samba_share_t, samba_share_t)
|
||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
@ -10724,7 +10982,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
+')
|
+')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.2.5/policy/modules/services/samba.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.2.5/policy/modules/services/samba.te
|
||||||
--- nsaserefpolicy/policy/modules/services/samba.te 2007-12-19 05:32:17.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/samba.te 2007-12-19 05:32:17.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/samba.te 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/samba.te 2008-01-08 13:40:20.000000000 -0500
|
||||||
@@ -26,28 +26,28 @@
|
@@ -26,28 +26,28 @@
|
||||||
|
|
||||||
## <desc>
|
## <desc>
|
||||||
@ -10801,7 +11059,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
|
|
||||||
allow smbd_t samba_net_tmp_t:file getattr;
|
allow smbd_t samba_net_tmp_t:file getattr;
|
||||||
|
|
||||||
@@ -251,7 +256,7 @@
|
@@ -234,6 +239,7 @@
|
||||||
|
manage_dirs_pattern(smbd_t,samba_share_t,samba_share_t)
|
||||||
|
manage_files_pattern(smbd_t,samba_share_t,samba_share_t)
|
||||||
|
manage_lnk_files_pattern(smbd_t,samba_share_t,samba_share_t)
|
||||||
|
+allow smbd_t samba_share_t:filesystem getattr;
|
||||||
|
|
||||||
|
manage_dirs_pattern(smbd_t,samba_var_t,samba_var_t)
|
||||||
|
manage_files_pattern(smbd_t,samba_var_t,samba_var_t)
|
||||||
|
@@ -251,7 +257,7 @@
|
||||||
manage_sock_files_pattern(smbd_t,smbd_var_run_t,smbd_var_run_t)
|
manage_sock_files_pattern(smbd_t,smbd_var_run_t,smbd_var_run_t)
|
||||||
files_pid_filetrans(smbd_t,smbd_var_run_t,file)
|
files_pid_filetrans(smbd_t,smbd_var_run_t,file)
|
||||||
|
|
||||||
@ -10810,7 +11076,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
|
|
||||||
kernel_getattr_core_if(smbd_t)
|
kernel_getattr_core_if(smbd_t)
|
||||||
kernel_getattr_message_if(smbd_t)
|
kernel_getattr_message_if(smbd_t)
|
||||||
@@ -340,6 +345,17 @@
|
@@ -340,6 +346,17 @@
|
||||||
tunable_policy(`samba_share_nfs',`
|
tunable_policy(`samba_share_nfs',`
|
||||||
fs_manage_nfs_dirs(smbd_t)
|
fs_manage_nfs_dirs(smbd_t)
|
||||||
fs_manage_nfs_files(smbd_t)
|
fs_manage_nfs_files(smbd_t)
|
||||||
@ -10828,7 +11094,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -391,7 +407,7 @@
|
@@ -391,7 +408,7 @@
|
||||||
allow nmbd_t self:msgq create_msgq_perms;
|
allow nmbd_t self:msgq create_msgq_perms;
|
||||||
allow nmbd_t self:sem create_sem_perms;
|
allow nmbd_t self:sem create_sem_perms;
|
||||||
allow nmbd_t self:shm create_shm_perms;
|
allow nmbd_t self:shm create_shm_perms;
|
||||||
@ -10837,7 +11103,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
allow nmbd_t self:tcp_socket create_stream_socket_perms;
|
allow nmbd_t self:tcp_socket create_stream_socket_perms;
|
||||||
allow nmbd_t self:udp_socket create_socket_perms;
|
allow nmbd_t self:udp_socket create_socket_perms;
|
||||||
allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto };
|
allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto };
|
||||||
@@ -403,8 +419,7 @@
|
@@ -403,8 +420,7 @@
|
||||||
read_files_pattern(nmbd_t,samba_etc_t,samba_etc_t)
|
read_files_pattern(nmbd_t,samba_etc_t,samba_etc_t)
|
||||||
|
|
||||||
manage_dirs_pattern(nmbd_t,samba_log_t,samba_log_t)
|
manage_dirs_pattern(nmbd_t,samba_log_t,samba_log_t)
|
||||||
@ -10847,7 +11113,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
|
|
||||||
read_files_pattern(nmbd_t,samba_log_t,samba_log_t)
|
read_files_pattern(nmbd_t,samba_log_t,samba_log_t)
|
||||||
create_files_pattern(nmbd_t,samba_log_t,samba_log_t)
|
create_files_pattern(nmbd_t,samba_log_t,samba_log_t)
|
||||||
@@ -439,6 +454,7 @@
|
@@ -439,6 +455,7 @@
|
||||||
dev_getattr_mtrr_dev(nmbd_t)
|
dev_getattr_mtrr_dev(nmbd_t)
|
||||||
|
|
||||||
fs_getattr_all_fs(nmbd_t)
|
fs_getattr_all_fs(nmbd_t)
|
||||||
@ -10855,7 +11121,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
fs_search_auto_mountpoints(nmbd_t)
|
fs_search_auto_mountpoints(nmbd_t)
|
||||||
|
|
||||||
domain_use_interactive_fds(nmbd_t)
|
domain_use_interactive_fds(nmbd_t)
|
||||||
@@ -522,6 +538,7 @@
|
@@ -522,6 +539,7 @@
|
||||||
storage_raw_write_fixed_disk(smbmount_t)
|
storage_raw_write_fixed_disk(smbmount_t)
|
||||||
|
|
||||||
term_list_ptys(smbmount_t)
|
term_list_ptys(smbmount_t)
|
||||||
@ -10863,7 +11129,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
|
|
||||||
corecmd_list_bin(smbmount_t)
|
corecmd_list_bin(smbmount_t)
|
||||||
|
|
||||||
@@ -546,28 +563,37 @@
|
@@ -546,28 +564,37 @@
|
||||||
|
|
||||||
userdom_use_all_users_fds(smbmount_t)
|
userdom_use_all_users_fds(smbmount_t)
|
||||||
|
|
||||||
@ -10908,7 +11174,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
allow swat_t smbd_var_run_t:file read;
|
allow swat_t smbd_var_run_t:file read;
|
||||||
|
|
||||||
manage_dirs_pattern(swat_t,swat_tmp_t,swat_tmp_t)
|
manage_dirs_pattern(swat_t,swat_tmp_t,swat_tmp_t)
|
||||||
@@ -577,7 +603,9 @@
|
@@ -577,7 +604,9 @@
|
||||||
manage_files_pattern(swat_t,swat_var_run_t,swat_var_run_t)
|
manage_files_pattern(swat_t,swat_var_run_t,swat_var_run_t)
|
||||||
files_pid_filetrans(swat_t,swat_var_run_t,file)
|
files_pid_filetrans(swat_t,swat_var_run_t,file)
|
||||||
|
|
||||||
@ -10919,7 +11185,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
|
|
||||||
kernel_read_kernel_sysctls(swat_t)
|
kernel_read_kernel_sysctls(swat_t)
|
||||||
kernel_read_system_state(swat_t)
|
kernel_read_system_state(swat_t)
|
||||||
@@ -602,6 +630,7 @@
|
@@ -602,6 +631,7 @@
|
||||||
|
|
||||||
dev_read_urand(swat_t)
|
dev_read_urand(swat_t)
|
||||||
|
|
||||||
@ -10927,7 +11193,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
files_read_etc_files(swat_t)
|
files_read_etc_files(swat_t)
|
||||||
files_search_home(swat_t)
|
files_search_home(swat_t)
|
||||||
files_read_usr_files(swat_t)
|
files_read_usr_files(swat_t)
|
||||||
@@ -614,6 +643,7 @@
|
@@ -614,6 +644,7 @@
|
||||||
libs_use_shared_libs(swat_t)
|
libs_use_shared_libs(swat_t)
|
||||||
|
|
||||||
logging_send_syslog_msg(swat_t)
|
logging_send_syslog_msg(swat_t)
|
||||||
@ -10935,7 +11201,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
logging_search_logs(swat_t)
|
logging_search_logs(swat_t)
|
||||||
|
|
||||||
miscfiles_read_localization(swat_t)
|
miscfiles_read_localization(swat_t)
|
||||||
@@ -631,6 +661,17 @@
|
@@ -631,6 +662,17 @@
|
||||||
kerberos_use(swat_t)
|
kerberos_use(swat_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -10953,7 +11219,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
# Winbind local policy
|
# Winbind local policy
|
||||||
@@ -679,6 +720,8 @@
|
@@ -679,6 +721,8 @@
|
||||||
manage_sock_files_pattern(winbind_t,winbind_var_run_t,winbind_var_run_t)
|
manage_sock_files_pattern(winbind_t,winbind_var_run_t,winbind_var_run_t)
|
||||||
files_pid_filetrans(winbind_t,winbind_var_run_t,file)
|
files_pid_filetrans(winbind_t,winbind_var_run_t,file)
|
||||||
|
|
||||||
@ -10962,7 +11228,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
kernel_read_kernel_sysctls(winbind_t)
|
kernel_read_kernel_sysctls(winbind_t)
|
||||||
kernel_list_proc(winbind_t)
|
kernel_list_proc(winbind_t)
|
||||||
kernel_read_proc_symlinks(winbind_t)
|
kernel_read_proc_symlinks(winbind_t)
|
||||||
@@ -766,6 +809,7 @@
|
@@ -766,6 +810,7 @@
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
squid_read_log(winbind_helper_t)
|
squid_read_log(winbind_helper_t)
|
||||||
squid_append_log(winbind_helper_t)
|
squid_append_log(winbind_helper_t)
|
||||||
@ -10970,7 +11236,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -790,3 +834,37 @@
|
@@ -790,3 +835,37 @@
|
||||||
domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t)
|
domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t)
|
||||||
')
|
')
|
||||||
')
|
')
|
||||||
@ -11223,7 +11489,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send
|
|||||||
-') dnl end TODO
|
-') dnl end TODO
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.2.5/policy/modules/services/setroubleshoot.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.2.5/policy/modules/services/setroubleshoot.te
|
||||||
--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-12-19 05:32:17.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-12-19 05:32:17.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/setroubleshoot.te 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/setroubleshoot.te 2008-01-08 06:17:24.000000000 -0500
|
||||||
@@ -27,8 +27,8 @@
|
@@ -27,8 +27,8 @@
|
||||||
# setroubleshootd local policy
|
# setroubleshootd local policy
|
||||||
#
|
#
|
||||||
@ -11245,16 +11511,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr
|
|||||||
|
|
||||||
corecmd_exec_bin(setroubleshootd_t)
|
corecmd_exec_bin(setroubleshootd_t)
|
||||||
corecmd_exec_shell(setroubleshootd_t)
|
corecmd_exec_shell(setroubleshootd_t)
|
||||||
@@ -73,7 +75,7 @@
|
@@ -68,13 +70,17 @@
|
||||||
|
|
||||||
|
dev_read_urand(setroubleshootd_t)
|
||||||
|
dev_read_sysfs(setroubleshootd_t)
|
||||||
|
+dev_getattr_all_blk_files(setroubleshootd_t)
|
||||||
|
+dev_getattr_all_chr_files(setroubleshootd_t)
|
||||||
|
|
||||||
|
domain_dontaudit_search_all_domains_state(setroubleshootd_t)
|
||||||
|
|
||||||
files_read_usr_files(setroubleshootd_t)
|
files_read_usr_files(setroubleshootd_t)
|
||||||
files_read_etc_files(setroubleshootd_t)
|
files_read_etc_files(setroubleshootd_t)
|
||||||
-files_getattr_all_dirs(setroubleshootd_t)
|
-files_getattr_all_dirs(setroubleshootd_t)
|
||||||
+files_list_all(setroubleshootd_t)
|
+files_list_all(setroubleshootd_t)
|
||||||
files_getattr_all_files(setroubleshootd_t)
|
files_getattr_all_files(setroubleshootd_t)
|
||||||
|
+files_getattr_all_pipes(setroubleshootd_t)
|
||||||
|
+files_getattr_all_sockets(setroubleshootd_t)
|
||||||
|
|
||||||
fs_getattr_all_dirs(setroubleshootd_t)
|
fs_getattr_all_dirs(setroubleshootd_t)
|
||||||
@@ -110,6 +112,7 @@
|
fs_getattr_all_files(setroubleshootd_t)
|
||||||
|
@@ -110,6 +116,7 @@
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
dbus_system_bus_client_template(setroubleshootd, setroubleshootd_t)
|
dbus_system_bus_client_template(setroubleshootd, setroubleshootd_t)
|
||||||
dbus_connect_system_bus(setroubleshootd_t)
|
dbus_connect_system_bus(setroubleshootd_t)
|
||||||
@ -12584,7 +12860,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.2.5/policy/modules/services/xserver.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.2.5/policy/modules/services/xserver.if
|
||||||
--- nsaserefpolicy/policy/modules/services/xserver.if 2007-12-04 11:02:50.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/xserver.if 2007-12-04 11:02:50.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/xserver.if 2008-01-03 16:24:11.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/xserver.if 2008-01-08 11:18:17.000000000 -0500
|
||||||
@@ -15,6 +15,7 @@
|
@@ -15,6 +15,7 @@
|
||||||
template(`xserver_common_domain_template',`
|
template(`xserver_common_domain_template',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -13158,7 +13434,42 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -974,6 +1041,37 @@
|
@@ -937,7 +1004,7 @@
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
-## Read XDM var lib files.
|
||||||
|
+## dontaudit search of XDM var lib directories.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
@@ -945,12 +1012,12 @@
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
-interface(`xserver_read_xdm_lib_files',`
|
||||||
|
+interface(`xserver_dontaudit_xdm_lib_search',`
|
||||||
|
gen_require(`
|
||||||
|
type xdm_var_lib_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
- allow $1 xdm_var_lib_t:file { getattr read };
|
||||||
|
+ dontaudit $1 xdm_var_lib_t:dir search_dir_perms;
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
@@ -965,15 +1032,47 @@
|
||||||
|
#
|
||||||
|
interface(`xserver_domtrans_xdm_xserver',`
|
||||||
|
gen_require(`
|
||||||
|
- type xdm_xserver_t, xserver_exec_t;
|
||||||
|
+ type xdm_xserver_t, xserver_exec_t, xdm_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
allow $1 xdm_xserver_t:process siginh;
|
||||||
|
+ allow xdm_t $1:process sigchld;
|
||||||
|
domtrans_pattern($1,xserver_exec_t,xdm_xserver_t)
|
||||||
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -13196,7 +13507,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
## Make an X session script an entrypoint for the specified domain.
|
## Make an X session script an entrypoint for the specified domain.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -1123,7 +1221,7 @@
|
@@ -1123,7 +1222,7 @@
|
||||||
type xdm_xserver_tmp_t;
|
type xdm_xserver_tmp_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -13205,7 +13516,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1312,3 +1410,45 @@
|
@@ -1312,3 +1411,45 @@
|
||||||
files_search_tmp($1)
|
files_search_tmp($1)
|
||||||
stream_connect_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t,xdm_xserver_t)
|
stream_connect_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t,xdm_xserver_t)
|
||||||
')
|
')
|
||||||
@ -14276,7 +14587,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
|
|||||||
+')
|
+')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.2.5/policy/modules/system/init.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.2.5/policy/modules/system/init.te
|
||||||
--- nsaserefpolicy/policy/modules/system/init.te 2007-12-19 05:32:17.000000000 -0500
|
--- nsaserefpolicy/policy/modules/system/init.te 2007-12-19 05:32:17.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/system/init.te 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/system/init.te 2008-01-08 13:52:56.000000000 -0500
|
||||||
@@ -10,6 +10,20 @@
|
@@ -10,6 +10,20 @@
|
||||||
# Declarations
|
# Declarations
|
||||||
#
|
#
|
||||||
@ -14430,7 +14741,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -729,6 +765,11 @@
|
@@ -708,9 +744,11 @@
|
||||||
|
squid_manage_logs(initrc_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
-optional_policy(`
|
||||||
|
- # allow init scripts to su
|
||||||
|
- su_restricted_domain_template(initrc,initrc_t,system_r)
|
||||||
|
+ifndef(`targeted_policy',`
|
||||||
|
+ optional_policy(`
|
||||||
|
+ # allow init scripts to su
|
||||||
|
+ su_restricted_domain_template(initrc,initrc_t,system_r)
|
||||||
|
+ ')
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
@@ -729,6 +767,11 @@
|
||||||
uml_setattr_util_sockets(initrc_t)
|
uml_setattr_util_sockets(initrc_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -14442,7 +14768,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
|
|||||||
optional_policy(`
|
optional_policy(`
|
||||||
unconfined_domain(initrc_t)
|
unconfined_domain(initrc_t)
|
||||||
|
|
||||||
@@ -743,6 +784,10 @@
|
@@ -743,6 +786,10 @@
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -16552,7 +16878,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
+/root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
|
+/root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.2.5/policy/modules/system/userdomain.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.2.5/policy/modules/system/userdomain.if
|
||||||
--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-11-29 13:29:35.000000000 -0500
|
--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-11-29 13:29:35.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/system/userdomain.if 2008-01-03 16:34:20.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/system/userdomain.if 2008-01-08 05:05:58.000000000 -0500
|
||||||
@@ -29,8 +29,9 @@
|
@@ -29,8 +29,9 @@
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -19565,8 +19891,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.i
|
|||||||
+## <summary>Policy for staff user</summary>
|
+## <summary>Policy for staff user</summary>
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.te serefpolicy-3.2.5/policy/modules/users/staff.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.te serefpolicy-3.2.5/policy/modules/users/staff.te
|
||||||
--- nsaserefpolicy/policy/modules/users/staff.te 1969-12-31 19:00:00.000000000 -0500
|
--- nsaserefpolicy/policy/modules/users/staff.te 1969-12-31 19:00:00.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/users/staff.te 2008-01-03 17:06:13.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/users/staff.te 2008-01-08 05:06:18.000000000 -0500
|
||||||
@@ -0,0 +1,31 @@
|
@@ -0,0 +1,34 @@
|
||||||
+policy_module(staff,1.0.1)
|
+policy_module(staff,1.0.1)
|
||||||
+userdom_unpriv_user_template(staff)
|
+userdom_unpriv_user_template(staff)
|
||||||
+
|
+
|
||||||
@ -19574,6 +19900,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.t
|
|||||||
+userdom_role_change_template(staff, sysadm)
|
+userdom_role_change_template(staff, sysadm)
|
||||||
+userdom_dontaudit_use_sysadm_terms(staff_t)
|
+userdom_dontaudit_use_sysadm_terms(staff_t)
|
||||||
+
|
+
|
||||||
|
+domain_read_all_domains_state(staff_t)
|
||||||
|
+domain_getattr_all_domains(staff_t)
|
||||||
|
+
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
+ xserver_per_role_template(staff, staff_t, staff_r)
|
+ xserver_per_role_template(staff, staff_t, staff_r)
|
||||||
+')
|
+')
|
||||||
|
@ -17,7 +17,7 @@
|
|||||||
Summary: SELinux policy configuration
|
Summary: SELinux policy configuration
|
||||||
Name: selinux-policy
|
Name: selinux-policy
|
||||||
Version: 3.2.5
|
Version: 3.2.5
|
||||||
Release: 8%{?dist}
|
Release: 9%{?dist}
|
||||||
License: GPLv2+
|
License: GPLv2+
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
Source: serefpolicy-%{version}.tgz
|
Source: serefpolicy-%{version}.tgz
|
||||||
@ -306,19 +306,20 @@ fi
|
|||||||
exit 0
|
exit 0
|
||||||
|
|
||||||
|
|
||||||
%triggerpostun targeted -- selinux-policy-targeted < 3.2.4-3.fc9
|
%triggerpostun targeted -- selinux-policy-targeted < 3.2.5-9.fc9
|
||||||
setsebool -P use_nfs_home_dirs=1
|
setsebool -P use_nfs_home_dirs=1
|
||||||
semanage user -l | grep -s unconfined_u
|
semanage user -l | grep -s unconfined_u
|
||||||
if [ $? == 0 ]; then
|
if [ $? == 0 ]; then
|
||||||
semanage user -m -P unconfined -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u 2> /dev/null
|
semanage user -m -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u 2> /dev/null
|
||||||
else
|
else
|
||||||
semanage user -a -P unconfined -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u 2> /dev/null
|
semanage user -a -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u 2> /dev/null
|
||||||
fi
|
fi
|
||||||
seuser=`semanage login -l | grep __default__ | awk '{ print $2 }'`
|
seuser=`semanage login -l | grep __default__ | awk '{ print $2 }'`
|
||||||
[ $seuser == "system_u" ] && semanage login -m -s "unconfined_u" -r s0-s0:c0.c1023 __default__
|
[ $seuser == "system_u" ] && semanage login -m -s "unconfined_u" -r s0-s0:c0.c1023 __default__
|
||||||
seuser=`semanage login -l | grep root | awk '{ print $2 }'`
|
seuser=`semanage login -l | grep root | awk '{ print $2 }'`
|
||||||
[ $seuser == "system_u" ] && semanage login -m -s "unconfined_u" -r s0-s0:c0.c1023 root
|
[ $seuser == "system_u" ] && semanage login -m -s "unconfined_u" -r s0-s0:c0.c1023 root
|
||||||
restorecon -R /root /etc/selinux/targeted 2> /dev/null
|
restorecon -R /root /etc/selinux/targeted 2> /dev/null
|
||||||
|
semodule -r qmail 2> /dev/null
|
||||||
exit 0
|
exit 0
|
||||||
|
|
||||||
%files targeted
|
%files targeted
|
||||||
@ -386,6 +387,9 @@ exit 0
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Mon Jan 7 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-9
|
||||||
|
- Update gpg to allow reading of inotify
|
||||||
|
|
||||||
* Wed Jan 2 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-8
|
* Wed Jan 2 2008 Dan Walsh <dwalsh@redhat.com> 3.2.5-8
|
||||||
- Change user and staff roles to work correctly with varied perms
|
- Change user and staff roles to work correctly with varied perms
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user