rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Fix role transition fro unconfined_r to system_r when running rpm

This commit is contained in:
Daniel J Walsh 2007-12-24 12:01:17 +00:00
parent 0ec33db4ff
commit 5d13344539
2 changed files with 260 additions and 168 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

420
policy-20071130.patch
View File

@ -925,7 +925,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.2.5/policy/modules/admin/rpm.if
--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400
+++ serefpolicy-3.2.5/policy/modules/admin/rpm.if 2007-12-20 08:55:42.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/admin/rpm.if 2007-12-24 06:06:53.000000000 -0500
@@ -152,6 +152,24 @@
########################################
@ -1140,10 +1140,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
+## </param>
+interface(`rpm_role_transition',`
+ gen_require(`
+ type rpm_t;
+ type rpm_exec_t;
+ ')
+
+ role_transition $1 rpm_t system_r;
+ role_transition $1 rpm_exec_t system_r;
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.2.5/policy/modules/admin/rpm.te
--- nsaserefpolicy/policy/modules/admin/rpm.te 2007-12-19 05:32:18.000000000 -0500
@ -2066,7 +2066,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc
+/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:java_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.2.5/policy/modules/apps/java.if
--- nsaserefpolicy/policy/modules/apps/java.if 2007-10-12 08:56:02.000000000 -0400
+++ serefpolicy-3.2.5/policy/modules/apps/java.if 2007-12-19 16:29:03.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/apps/java.if 2007-12-22 07:16:08.000000000 -0500
@@ -32,7 +32,7 @@
## </summary>
## </param>
@ -2076,6 +2076,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
gen_require(`
type java_exec_t;
')
@@ -57,7 +57,7 @@
# Local policy
#
- allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem };
+ allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem execstack };
allow $1_javaplugin_t self:fifo_file rw_fifo_file_perms;
allow $1_javaplugin_t self:tcp_socket create_socket_perms;
allow $1_javaplugin_t self:udp_socket create_socket_perms;
@@ -76,13 +76,10 @@
manage_sock_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t)
fs_tmpfs_filetrans($1_javaplugin_t,$1_javaplugin_tmpfs_t,{ file lnk_file sock_file fifo_file })
@ -2428,7 +2437,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
# /bin
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.2.5/policy/modules/apps/mozilla.if
--- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-10-29 07:52:48.000000000 -0400
+++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if 2007-12-19 05:38:08.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if 2007-12-24 06:47:25.000000000 -0500
@@ -35,7 +35,10 @@
template(`mozilla_per_role_template',`
gen_require(`
@ -2491,7 +2500,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
userdom_search_user_home_dirs($1,$1_mozilla_t)
# Mozpluggerrc
@@ -89,22 +103,44 @@
@@ -89,22 +103,48 @@
allow $2 $1_mozilla_t:unix_stream_socket connectto;
# X access, Home files
@ -2531,6 +2540,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
+ userdom_manage_user_tmp_files($1,$1_mozilla_t)
+ userdom_manage_user_tmp_sockets($1,$1_mozilla_t)
+ userdom_tmp_filetrans_user_tmp($1,$1_mozilla_t, { file dir sock_file })
+ userdom_read_user_tmpfs_files($1,$1_mozilla_t)
+
+ ifdef(`enable_mls',`',`
+ fs_search_removable($1_mozilla_t)
@ -2542,14 +2552,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
+ userdom_manage_user_home_content_dirs($1,$1_mozilla_t)
+ userdom_manage_user_home_content_files($1,$1_mozilla_t)
+ userdom_read_user_home_content_symlinks($1,$1_mozilla_t)
+ userdom_manage_user_home_content_pipes($1,$1_mozilla_t)
+ userdom_user_home_dir_filetrans_user_home_content($1,$1_mozilla_t, { file dir })
+ ', `
+ # helper apps will try to create .files
+ userdom_dontaudit_create_user_home_content_files($1,$1_mozilla_t)
+ userdom_user_home_dir_filetrans($1,$1_mozilla_t, $1_mozilla_home_t,dir)
+ ')
# Unrestricted inheritance from the caller.
allow $2 $1_mozilla_t:process { noatsecure siginh rlimitinh };
@@ -115,8 +151,9 @@
@@ -112,11 +152,13 @@
ps_process_pattern($2,$1_mozilla_t)
allow $2 $1_mozilla_t:process signal_perms;
+ kernel_read_fs_sysctls($1_mozilla_t)
kernel_read_kernel_sysctls($1_mozilla_t)
kernel_read_network_state($1_mozilla_t)
# Access /proc, sysctl
@ -2561,7 +2578,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
# Look for plugins
corecmd_list_bin($1_mozilla_t)
@@ -165,11 +202,23 @@
@@ -165,10 +207,23 @@
files_read_var_files($1_mozilla_t)
files_read_var_symlinks($1_mozilla_t)
files_dontaudit_getattr_boot_dirs($1_mozilla_t)
@ -2579,13 +2596,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
+ fs_manage_dos_dirs($1_mozilla_t)
+ fs_manage_dos_files($1_mozilla_t)
fs_rw_tmpfs_files($1_mozilla_t)
+ selinux_dontaudit_getattr_fs($1_mozilla_t)
+ fs_read_noxattr_fs_files($1_mozilla_t)
+
+ selinux_dontaudit_getattr_fs($1_mozilla_t)
term_dontaudit_getattr_pty_dirs($1_mozilla_t)
libs_use_ld_so($1_mozilla_t)
@@ -184,12 +233,9 @@
@@ -184,12 +239,8 @@
sysnet_dns_name_resolve($1_mozilla_t)
sysnet_read_config($1_mozilla_t)
@ -2597,11 +2614,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
- userdom_manage_user_tmp_sockets($1,$1_mozilla_t)
+ userdom_dontaudit_read_user_tmp_files($1,$1_mozilla_t)
+ userdom_dontaudit_use_user_terminals($1,$1_mozilla_t)
+ userdom_user_home_dir_filetrans($1,$1_mozilla_t, user_mozilla_home_t,dir)
xserver_user_client_template($1,$1_mozilla_t,$1_mozilla_tmpfs_t)
xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t)
@@ -211,131 +257,8 @@
@@ -211,131 +262,8 @@
fs_manage_cifs_symlinks($1_mozilla_t)
')
@ -2735,7 +2751,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
')
optional_policy(`
@@ -350,19 +273,26 @@
@@ -350,19 +278,27 @@
optional_policy(`
cups_read_rw_config($1_mozilla_t)
cups_dbus_chat($1_mozilla_t)
@ -2746,6 +2762,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
dbus_system_bus_client_template($1_mozilla,$1_mozilla_t)
- dbus_user_bus_client_template($1,$1_mozilla,$1_mozilla_t)
+# dbus_user_bus_client_template($1,$1_mozilla,$1_mozilla_t)
+# dbus_connectto_user_bus($1,$1_mozilla_t)
')
optional_policy(`
@ -2764,7 +2781,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
')
optional_policy(`
@@ -382,25 +312,6 @@
@@ -382,25 +318,6 @@
thunderbird_domtrans_user_thunderbird($1, $1_mozilla_t)
')
@ -2790,7 +2807,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
')
########################################
@@ -430,11 +341,11 @@
@@ -430,11 +347,11 @@
#
template(`mozilla_read_user_home_files',`
gen_require(`
@ -2805,7 +2822,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
')
########################################
@@ -464,11 +375,11 @@
@@ -464,11 +381,11 @@
#
template(`mozilla_write_user_home_files',`
gen_require(`
@ -2820,7 +2837,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
')
########################################
@@ -573,3 +484,27 @@
@@ -573,3 +490,27 @@
allow $2 $1_mozilla_t:tcp_socket rw_socket_perms;
')
@ -4031,6 +4048,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu
neverallow ~{ selinux_unconfined_type can_load_policy } security_t:security load_policy;
neverallow ~{ selinux_unconfined_type can_setenforce } security_t:security setenforce;
neverallow ~{ selinux_unconfined_type can_setsecparam } security_t:security setsecparam;
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.2.5/policy/modules/kernel/storage.fc
--- nsaserefpolicy/policy/modules/kernel/storage.fc 2007-10-29 18:02:31.000000000 -0400
+++ serefpolicy-3.2.5/policy/modules/kernel/storage.fc 2007-12-21 10:02:13.000000000 -0500
@@ -13,6 +13,7 @@
/dev/cm20.* -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/dasd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
/dev/dm-[0-9]+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+/dev/drbd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
/dev/fd[^/]+ -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/flash[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
/dev/gscd -b gen_context(system_u:object_r:removable_device_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.2.5/policy/modules/kernel/terminal.if
--- nsaserefpolicy/policy/modules/kernel/terminal.if 2007-09-12 10:34:17.000000000 -0400
+++ serefpolicy-3.2.5/policy/modules/kernel/terminal.if 2007-12-19 05:38:09.000000000 -0500
@ -6003,17 +6031,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.
-')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.5/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/services/dbus.if 2007-12-21 02:47:15.000000000 -0500
@@ -91,7 +91,7 @@
+++ serefpolicy-3.2.5/policy/modules/services/dbus.if 2007-12-24 06:16:06.000000000 -0500
@@ -91,7 +91,9 @@
# SE-DBus specific permissions
allow $1_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg;
allow $2 $1_dbusd_t:dbus { send_msg acquire_svc };
- allow $1_t system_dbusd_t:dbus { send_msg acquire_svc };
+ allow $1_dbusd_t $2:dbus send_msg;
+ allow $2 $2:dbus send_msg;
+ allow $2 system_dbusd_t:dbus { send_msg acquire_svc };
allow $1_dbusd_t dbusd_etc_t:dir list_dir_perms;
read_files_pattern($1_dbusd_t,dbusd_etc_t,dbusd_etc_t)
@@ -104,8 +104,7 @@
@@ -104,8 +106,7 @@
domtrans_pattern($2, system_dbusd_exec_t, $1_dbusd_t)
allow $2 $1_dbusd_t:process { sigkill signal };
@ -6023,7 +6053,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
allow $1_dbusd_t $2:process sigkill;
allow $2 $1_dbusd_t:fd use;
allow $2 $1_dbusd_t:fifo_file rw_fifo_file_perms;
@@ -161,7 +160,9 @@
@@ -161,7 +162,9 @@
seutil_read_config($1_dbusd_t)
seutil_read_default_contexts($1_dbusd_t)
@ -6034,7 +6064,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
ifdef(`hide_broken_symptoms', `
dontaudit $2 $1_dbusd_t:netlink_selinux_socket { read write };
@@ -214,7 +215,7 @@
@@ -214,7 +217,7 @@
# SE-DBus specific permissions
# allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg;
@ -6043,7 +6073,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
read_files_pattern($2, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
files_search_var_lib($2)
@@ -263,6 +264,7 @@
@@ -263,6 +266,7 @@
# For connecting to the bus
allow $3 $1_dbusd_t:unix_stream_socket connectto;
@ -6051,7 +6081,67 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
')
########################################
@@ -366,3 +368,53 @@
@@ -292,6 +296,59 @@
########################################
## <summary>
+## connectto a message on user/application specific DBUS.
+## </summary>
+## <param name="domain_prefix">
+## <summary>
+## The prefix of the domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+template(`dbus_connectto_user_bus',`
+ gen_require(`
+ type $1_dbusd_t;
+ ')
+
+ allow $2 $1_dbusd_t:unix_stream_socket connectto;
+')
+
+########################################
+## <summary>
+## Chat on user/application specific DBUS.
+## </summary>
+## <param name="domain_prefix">
+## <summary>
+## The prefix of the domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+template(`dbus_chat_user_bus',`
+ gen_require(`
+ type $1_t;
+ type $1_dbusd_t;
+ class dbus send_msg;
+ ')
+
+ allow $2 $1_dbusd_t:dbus send_msg;
+ allow $1_dbusd_t $2:dbus send_msg;
+ allow $2 $1_t:dbus send_msg;
+ allow $1_t $2:dbus send_msg;
+')
+
+########################################
+## <summary>
## Read dbus configuration.
## </summary>
## <param name="domain">
@@ -366,3 +423,53 @@
allow $1 system_dbusd_t:dbus *;
')
@ -14420,7 +14510,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+/root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.2.5/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-11-29 13:29:35.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/system/userdomain.if 2007-12-20 14:54:51.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/system/userdomain.if 2007-12-24 06:19:27.000000000 -0500
@@ -29,8 +29,9 @@
')
@ -15875,7 +15965,50 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
@@ -4225,11 +4268,11 @@
@@ -3248,6 +3291,42 @@
## </summary>
## </param>
#
+template(`userdom_read_user_tmpfs_files',`
+ gen_require(`
+ type $1_tmpfs_t;
+ ')
+
+ fs_search_tmpfs($2)
+ allow $2 $1_tmpfs_t:dir list_dir_perms;
+ read_files_pattern($2,$1_tmpfs_t,$1_tmpfs_t)
+ read_lnk_files_pattern($2,$1_tmpfs_t,$1_tmpfs_t)
+')
+
+########################################
+## <summary>
+## Read/write user tmpfs files.
+## </summary>
+## <desc>
+## <p>
+## Read/write user tmpfs files.
+## </p>
+## <p>
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+## </p>
+## </desc>
+## <param name="userdomain_prefix">
+## <summary>
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
template(`userdom_rw_user_tmpfs_files',`
gen_require(`
type $1_tmpfs_t;
@@ -4225,11 +4304,11 @@
#
interface(`userdom_search_staff_home_dirs',`
gen_require(`
@ -15889,7 +16022,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
@@ -4245,10 +4288,10 @@
@@ -4245,10 +4324,10 @@
#
interface(`userdom_dontaudit_search_staff_home_dirs',`
gen_require(`
@ -15902,7 +16035,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
@@ -4264,11 +4307,11 @@
@@ -4264,11 +4343,11 @@
#
interface(`userdom_manage_staff_home_dirs',`
gen_require(`
@ -15916,7 +16049,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
@@ -4283,16 +4326,16 @@
@@ -4283,16 +4362,16 @@
#
interface(`userdom_relabelto_staff_home_dirs',`
gen_require(`
@ -15936,7 +16069,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## users home directory.
## </summary>
## <param name="domain">
@@ -4301,12 +4344,27 @@
@@ -4301,33 +4380,48 @@
## </summary>
## </param>
#
@ -15949,29 +16082,40 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
- dontaudit $1 staff_home_t:file append;
+ dontaudit $1 user_home_t:file append_file_perms;
')
########################################
## <summary>
-## Read files in the staff users home directory.
+## Do not audit attempts to append to the staff
+## users home directory.
## </summary>
## <param name="domain">
## <summary>
-## Domain allowed access.
+## Domain to not audit.
## </summary>
## </param>
#
-interface(`userdom_read_staff_home_content_files',`
- gen_require(`
- type staff_home_dir_t, staff_home_t;
+interface(`userdom_dontaudit_append_staff_home_content_files',`
+ userdom_dontaudit_append_unpriv_home_content_files($1)
+')
+
+########################################
+## <summary>
+## Do not audit attempts to append to the staff
+## users home directory.
+## Read files in the staff users home directory.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain to not audit.
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`userdom_dontaudit_append_staff_home_content_files',`
+ userdom_dontaudit_append_unpriv_home_content_files($1)
')
########################################
@@ -4321,13 +4379,13 @@
#
interface(`userdom_read_staff_home_content_files',`
gen_require(`
- type staff_home_dir_t, staff_home_t;
+interface(`userdom_read_staff_home_content_files',`
+ gen_require(`
+ type user_home_dir_t, user_home_t;
')
@ -15985,7 +16129,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
@@ -4525,10 +4583,10 @@
@@ -4525,10 +4619,10 @@
#
interface(`userdom_getattr_sysadm_home_dirs',`
gen_require(`
@ -15998,7 +16142,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
@@ -4545,10 +4603,10 @@
@@ -4545,10 +4639,10 @@
#
interface(`userdom_dontaudit_getattr_sysadm_home_dirs',`
gen_require(`
@ -16011,7 +16155,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
@@ -4563,10 +4621,10 @@
@@ -4563,10 +4657,10 @@
#
interface(`userdom_search_sysadm_home_dirs',`
gen_require(`
@ -16024,7 +16168,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
@@ -4582,10 +4640,10 @@
@@ -4582,10 +4676,10 @@
#
interface(`userdom_dontaudit_search_sysadm_home_dirs',`
gen_require(`
@ -16037,7 +16181,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
@@ -4600,10 +4658,10 @@
@@ -4600,10 +4694,10 @@
#
interface(`userdom_list_sysadm_home_dirs',`
gen_require(`
@ -16050,7 +16194,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
@@ -4619,10 +4677,10 @@
@@ -4619,10 +4713,10 @@
#
interface(`userdom_dontaudit_list_sysadm_home_dirs',`
gen_require(`
@ -16063,7 +16207,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
@@ -4638,12 +4696,11 @@
@@ -4638,12 +4732,11 @@
#
interface(`userdom_dontaudit_read_sysadm_home_content_files',`
gen_require(`
@ -16079,7 +16223,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
@@ -4670,10 +4727,10 @@
@@ -4670,10 +4763,10 @@
#
interface(`userdom_sysadm_home_dir_filetrans',`
gen_require(`
@ -16092,7 +16236,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
@@ -4688,10 +4745,10 @@
@@ -4688,10 +4781,10 @@
#
interface(`userdom_search_sysadm_home_content_dirs',`
gen_require(`
@ -16105,7 +16249,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
@@ -4706,13 +4763,13 @@
@@ -4706,13 +4799,13 @@
#
interface(`userdom_read_sysadm_home_content_files',`
gen_require(`
@ -16123,88 +16267,60 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
@@ -4748,16 +4805,15 @@
@@ -4748,11 +4841,48 @@
#
interface(`userdom_search_all_users_home_dirs',`
gen_require(`
- attribute home_dir_type;
+ attribute user_home_dir_type;
')
files_list_home($1)
- allow $1 home_dir_type:dir search_dir_perms;
+ ')
+
+ files_list_home($1)
+ allow $1 user_home_dir_type:dir search_dir_perms;
')
-
########################################
## <summary>
-## List all users home directories.
+')
+########################################
+## <summary>
+## Read all users home directories symlinks.
## </summary>
## <param name="domain">
## <summary>
@@ -4765,18 +4821,18 @@
## </summary>
## </param>
#
-interface(`userdom_list_all_users_home_dirs',`
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`userdom_read_all_users_home_dirs_symlinks',`
gen_require(`
+ gen_require(`
attribute home_dir_type;
')
files_list_home($1)
- allow $1 home_dir_type:dir list_dir_perms;
- allow $1 home_dir_type:dir search_dir_perms;
+ allow $1 home_dir_type:lnk_file read_lnk_file_perms;
')
########################################
## <summary>
-## Search all users home directories.
+')
+
+########################################
+## <summary>
+## Read all users home directories symlinks.
## </summary>
## <param name="domain">
## <summary>
@@ -4784,33 +4840,79 @@
## </summary>
## </param>
#
-interface(`userdom_search_all_users_home_content',`
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`userdom_read_all_users_home_content_symlinks',`
gen_require(`
- attribute home_dir_type, home_type;
+ gen_require(`
+ type user_home_t;
')
files_list_home($1)
- allow $1 { home_dir_type home_type }:dir search_dir_perms;
+ ')
+
+ files_list_home($1)
+ allow $1 user_home_t:lnk_file read_lnk_file_perms;
')
########################################
## <summary>
-## Do not audit attempts to search all users home directories.
+## List all users home directories.
## </summary>
## <param name="domain">
## <summary>
-## Domain to not audit.
+## Domain allowed access.
## </summary>
## </param>
#
-interface(`userdom_dontaudit_search_all_users_home_content',`
+interface(`userdom_list_all_users_home_dirs',`
gen_require(`
- attribute home_dir_type, home_type;
+ attribute home_dir_type;
')
@@ -4772,6 +4902,14 @@
- dontaudit $1 { home_dir_type home_type }:dir search_dir_perms;
-')
-
+ files_list_home($1)
+ allow $1 home_dir_type:dir list_dir_perms;
files_list_home($1)
allow $1 home_dir_type:dir list_dir_perms;
+
+ tunable_policy(`use_nfs_home_dirs',`
+ fs_list_nfs(crond_t)
@ -16213,49 +16329,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ tunable_policy(`use_samba_home_dirs',`
+ fs_list_cifs(crond_t)
+ ')
+')
+
+########################################
+## <summary>
+## Search all users home directories.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`userdom_search_all_users_home_content',`
+ gen_require(`
+ attribute home_dir_type, home_type;
+ ')
+
+ files_list_home($1)
+ allow $1 { home_dir_type home_type }:dir search_dir_perms;
+')
+
+########################################
+## <summary>
+## Do not audit attempts to search all users home directories.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain to not audit.
+## </summary>
+## </param>
+#
+interface(`userdom_dontaudit_search_all_users_home_content',`
+ gen_require(`
+ attribute home_dir_type, home_type;
+ ')
+
+ dontaudit $1 { home_dir_type home_type }:dir search_dir_perms;
+')
+
')
########################################
## <summary>
## Read all files in all users home directories.
@@ -5109,7 +5211,7 @@
@@ -5109,7 +5247,7 @@
#
interface(`userdom_relabelto_generic_user_home_dirs',`
gen_require(`
@ -16264,7 +16341,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
files_search_home($1)
@@ -5298,6 +5400,49 @@
@@ -5298,6 +5436,49 @@
########################################
## <summary>
@ -16314,7 +16391,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## Create, read, write, and delete directories in
## unprivileged users home directories.
## </summary>
@@ -5503,6 +5648,24 @@
@@ -5503,6 +5684,24 @@
########################################
## <summary>
@ -16339,7 +16416,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## Read and write unprivileged user ttys.
## </summary>
## <param name="domain">
@@ -5668,6 +5831,42 @@
@@ -5668,6 +5867,42 @@
########################################
## <summary>
@ -16382,7 +16459,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## Send a dbus message to all user domains.
## </summary>
## <param name="domain">
@@ -5698,3 +5897,277 @@
@@ -5698,3 +5933,277 @@
interface(`userdom_unconfined',`
refpolicywarn(`$0($*) has been deprecated.')
')
@ -17157,8 +17234,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.i
+## <summary>Policy for guest user</summary>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.2.5/policy/modules/users/guest.te
--- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/users/guest.te 2007-12-19 16:37:00.000000000 -0500
@@ -0,0 +1,12 @@
+++ serefpolicy-3.2.5/policy/modules/users/guest.te 2007-12-22 07:19:26.000000000 -0500
@@ -0,0 +1,21 @@
+policy_module(guest,1.0.1)
+userdom_restricted_user_template(guest)
+
@ -17171,6 +17248,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.t
+')
+
+userdom_restricted_user_template(gadmin)
+
+optional_policy(`
+ gen_require(`
+ type xguest_mozilla_t;
+ ')
+
+ dbus_chat_user_bus(xguest,xguest_mozilla_t)
+ dbus_connectto_user_bus(xguest,xguest_mozilla_t)
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.2.5/policy/modules/users/logadm.fc
--- nsaserefpolicy/policy/modules/users/logadm.fc 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/users/logadm.fc 2007-12-19 05:38:09.000000000 -0500
@ -17365,7 +17451,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets
+define(`manage_key_perms', `{ create link read search setattr view write } ')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.2.5/policy/users
--- nsaserefpolicy/policy/users 2007-10-12 08:56:09.000000000 -0400
+++ serefpolicy-3.2.5/policy/users 2007-12-19 05:38:09.000000000 -0500
+++ serefpolicy-3.2.5/policy/users 2007-12-21 12:52:51.000000000 -0500
@@ -16,7 +16,7 @@
# and a user process should never be assigned the system user
# identity.
@ -17399,7 +17485,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.2
-',`
- gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
-')
+gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)
+gen_user(root, unconfined, unconfined_r sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.2.5/Rules.modular
--- nsaserefpolicy/Rules.modular 2007-12-19 05:32:18.000000000 -0500
+++ serefpolicy-3.2.5/Rules.modular 2007-12-19 05:38:09.000000000 -0500

8
selinux-policy.spec
View File

@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.2.5
Release: 4%{?dist}
Release: 5%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@ -386,6 +386,12 @@ exit 0
%endif
%changelog
* Mon Dec 24 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-6
- Fix role transition fro unconfined_r to system_r when running rpm
* Sat Dec 21 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-5
- Fixes for xguest
* Thu Dec 20 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-4
- Let all uncofined domains communicate with dbus unconfined