- Fix role transition fro unconfined_r to system_r when running rpm
This commit is contained in:
parent
0ec33db4ff
commit
5d13344539
@ -925,7 +925,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc
|
|||||||
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
|
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.2.5/policy/modules/admin/rpm.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.2.5/policy/modules/admin/rpm.if
|
||||||
--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400
|
--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400
|
||||||
+++ serefpolicy-3.2.5/policy/modules/admin/rpm.if 2007-12-20 08:55:42.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/admin/rpm.if 2007-12-24 06:06:53.000000000 -0500
|
||||||
@@ -152,6 +152,24 @@
|
@@ -152,6 +152,24 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -1140,10 +1140,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
|
|||||||
+## </param>
|
+## </param>
|
||||||
+interface(`rpm_role_transition',`
|
+interface(`rpm_role_transition',`
|
||||||
+ gen_require(`
|
+ gen_require(`
|
||||||
+ type rpm_t;
|
+ type rpm_exec_t;
|
||||||
+ ')
|
+ ')
|
||||||
+
|
+
|
||||||
+ role_transition $1 rpm_t system_r;
|
+ role_transition $1 rpm_exec_t system_r;
|
||||||
+')
|
+')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.2.5/policy/modules/admin/rpm.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.2.5/policy/modules/admin/rpm.te
|
||||||
--- nsaserefpolicy/policy/modules/admin/rpm.te 2007-12-19 05:32:18.000000000 -0500
|
--- nsaserefpolicy/policy/modules/admin/rpm.te 2007-12-19 05:32:18.000000000 -0500
|
||||||
@ -2066,7 +2066,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc
|
|||||||
+/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:java_exec_t,s0)
|
+/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:java_exec_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.2.5/policy/modules/apps/java.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.2.5/policy/modules/apps/java.if
|
||||||
--- nsaserefpolicy/policy/modules/apps/java.if 2007-10-12 08:56:02.000000000 -0400
|
--- nsaserefpolicy/policy/modules/apps/java.if 2007-10-12 08:56:02.000000000 -0400
|
||||||
+++ serefpolicy-3.2.5/policy/modules/apps/java.if 2007-12-19 16:29:03.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/apps/java.if 2007-12-22 07:16:08.000000000 -0500
|
||||||
@@ -32,7 +32,7 @@
|
@@ -32,7 +32,7 @@
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
@ -2076,6 +2076,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
|
|||||||
gen_require(`
|
gen_require(`
|
||||||
type java_exec_t;
|
type java_exec_t;
|
||||||
')
|
')
|
||||||
|
@@ -57,7 +57,7 @@
|
||||||
|
# Local policy
|
||||||
|
#
|
||||||
|
|
||||||
|
- allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem };
|
||||||
|
+ allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem execstack };
|
||||||
|
allow $1_javaplugin_t self:fifo_file rw_fifo_file_perms;
|
||||||
|
allow $1_javaplugin_t self:tcp_socket create_socket_perms;
|
||||||
|
allow $1_javaplugin_t self:udp_socket create_socket_perms;
|
||||||
@@ -76,13 +76,10 @@
|
@@ -76,13 +76,10 @@
|
||||||
manage_sock_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t)
|
manage_sock_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t)
|
||||||
fs_tmpfs_filetrans($1_javaplugin_t,$1_javaplugin_tmpfs_t,{ file lnk_file sock_file fifo_file })
|
fs_tmpfs_filetrans($1_javaplugin_t,$1_javaplugin_tmpfs_t,{ file lnk_file sock_file fifo_file })
|
||||||
@ -2428,7 +2437,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
|
|||||||
# /bin
|
# /bin
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.2.5/policy/modules/apps/mozilla.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.2.5/policy/modules/apps/mozilla.if
|
||||||
--- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-10-29 07:52:48.000000000 -0400
|
--- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-10-29 07:52:48.000000000 -0400
|
||||||
+++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if 2007-12-19 05:38:08.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if 2007-12-24 06:47:25.000000000 -0500
|
||||||
@@ -35,7 +35,10 @@
|
@@ -35,7 +35,10 @@
|
||||||
template(`mozilla_per_role_template',`
|
template(`mozilla_per_role_template',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -2491,7 +2500,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
|
|||||||
userdom_search_user_home_dirs($1,$1_mozilla_t)
|
userdom_search_user_home_dirs($1,$1_mozilla_t)
|
||||||
|
|
||||||
# Mozpluggerrc
|
# Mozpluggerrc
|
||||||
@@ -89,22 +103,44 @@
|
@@ -89,22 +103,48 @@
|
||||||
allow $2 $1_mozilla_t:unix_stream_socket connectto;
|
allow $2 $1_mozilla_t:unix_stream_socket connectto;
|
||||||
|
|
||||||
# X access, Home files
|
# X access, Home files
|
||||||
@ -2531,6 +2540,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
|
|||||||
+ userdom_manage_user_tmp_files($1,$1_mozilla_t)
|
+ userdom_manage_user_tmp_files($1,$1_mozilla_t)
|
||||||
+ userdom_manage_user_tmp_sockets($1,$1_mozilla_t)
|
+ userdom_manage_user_tmp_sockets($1,$1_mozilla_t)
|
||||||
+ userdom_tmp_filetrans_user_tmp($1,$1_mozilla_t, { file dir sock_file })
|
+ userdom_tmp_filetrans_user_tmp($1,$1_mozilla_t, { file dir sock_file })
|
||||||
|
+ userdom_read_user_tmpfs_files($1,$1_mozilla_t)
|
||||||
+
|
+
|
||||||
+ ifdef(`enable_mls',`',`
|
+ ifdef(`enable_mls',`',`
|
||||||
+ fs_search_removable($1_mozilla_t)
|
+ fs_search_removable($1_mozilla_t)
|
||||||
@ -2542,14 +2552,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
|
|||||||
+ userdom_manage_user_home_content_dirs($1,$1_mozilla_t)
|
+ userdom_manage_user_home_content_dirs($1,$1_mozilla_t)
|
||||||
+ userdom_manage_user_home_content_files($1,$1_mozilla_t)
|
+ userdom_manage_user_home_content_files($1,$1_mozilla_t)
|
||||||
+ userdom_read_user_home_content_symlinks($1,$1_mozilla_t)
|
+ userdom_read_user_home_content_symlinks($1,$1_mozilla_t)
|
||||||
|
+ userdom_manage_user_home_content_pipes($1,$1_mozilla_t)
|
||||||
|
+ userdom_user_home_dir_filetrans_user_home_content($1,$1_mozilla_t, { file dir })
|
||||||
+ ', `
|
+ ', `
|
||||||
+ # helper apps will try to create .files
|
+ # helper apps will try to create .files
|
||||||
+ userdom_dontaudit_create_user_home_content_files($1,$1_mozilla_t)
|
+ userdom_dontaudit_create_user_home_content_files($1,$1_mozilla_t)
|
||||||
|
+ userdom_user_home_dir_filetrans($1,$1_mozilla_t, $1_mozilla_home_t,dir)
|
||||||
+ ')
|
+ ')
|
||||||
# Unrestricted inheritance from the caller.
|
# Unrestricted inheritance from the caller.
|
||||||
allow $2 $1_mozilla_t:process { noatsecure siginh rlimitinh };
|
allow $2 $1_mozilla_t:process { noatsecure siginh rlimitinh };
|
||||||
|
|
||||||
@@ -115,8 +151,9 @@
|
@@ -112,11 +152,13 @@
|
||||||
|
ps_process_pattern($2,$1_mozilla_t)
|
||||||
|
allow $2 $1_mozilla_t:process signal_perms;
|
||||||
|
|
||||||
|
+ kernel_read_fs_sysctls($1_mozilla_t)
|
||||||
kernel_read_kernel_sysctls($1_mozilla_t)
|
kernel_read_kernel_sysctls($1_mozilla_t)
|
||||||
kernel_read_network_state($1_mozilla_t)
|
kernel_read_network_state($1_mozilla_t)
|
||||||
# Access /proc, sysctl
|
# Access /proc, sysctl
|
||||||
@ -2561,7 +2578,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
|
|||||||
|
|
||||||
# Look for plugins
|
# Look for plugins
|
||||||
corecmd_list_bin($1_mozilla_t)
|
corecmd_list_bin($1_mozilla_t)
|
||||||
@@ -165,11 +202,23 @@
|
@@ -165,10 +207,23 @@
|
||||||
files_read_var_files($1_mozilla_t)
|
files_read_var_files($1_mozilla_t)
|
||||||
files_read_var_symlinks($1_mozilla_t)
|
files_read_var_symlinks($1_mozilla_t)
|
||||||
files_dontaudit_getattr_boot_dirs($1_mozilla_t)
|
files_dontaudit_getattr_boot_dirs($1_mozilla_t)
|
||||||
@ -2579,13 +2596,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
|
|||||||
+ fs_manage_dos_dirs($1_mozilla_t)
|
+ fs_manage_dos_dirs($1_mozilla_t)
|
||||||
+ fs_manage_dos_files($1_mozilla_t)
|
+ fs_manage_dos_files($1_mozilla_t)
|
||||||
fs_rw_tmpfs_files($1_mozilla_t)
|
fs_rw_tmpfs_files($1_mozilla_t)
|
||||||
|
+ fs_read_noxattr_fs_files($1_mozilla_t)
|
||||||
+ selinux_dontaudit_getattr_fs($1_mozilla_t)
|
|
||||||
+
|
+
|
||||||
|
+ selinux_dontaudit_getattr_fs($1_mozilla_t)
|
||||||
|
|
||||||
term_dontaudit_getattr_pty_dirs($1_mozilla_t)
|
term_dontaudit_getattr_pty_dirs($1_mozilla_t)
|
||||||
|
|
||||||
libs_use_ld_so($1_mozilla_t)
|
@@ -184,12 +239,8 @@
|
||||||
@@ -184,12 +233,9 @@
|
|
||||||
sysnet_dns_name_resolve($1_mozilla_t)
|
sysnet_dns_name_resolve($1_mozilla_t)
|
||||||
sysnet_read_config($1_mozilla_t)
|
sysnet_read_config($1_mozilla_t)
|
||||||
|
|
||||||
@ -2597,11 +2614,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
|
|||||||
- userdom_manage_user_tmp_sockets($1,$1_mozilla_t)
|
- userdom_manage_user_tmp_sockets($1,$1_mozilla_t)
|
||||||
+ userdom_dontaudit_read_user_tmp_files($1,$1_mozilla_t)
|
+ userdom_dontaudit_read_user_tmp_files($1,$1_mozilla_t)
|
||||||
+ userdom_dontaudit_use_user_terminals($1,$1_mozilla_t)
|
+ userdom_dontaudit_use_user_terminals($1,$1_mozilla_t)
|
||||||
+ userdom_user_home_dir_filetrans($1,$1_mozilla_t, user_mozilla_home_t,dir)
|
|
||||||
|
|
||||||
xserver_user_client_template($1,$1_mozilla_t,$1_mozilla_tmpfs_t)
|
xserver_user_client_template($1,$1_mozilla_t,$1_mozilla_tmpfs_t)
|
||||||
xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t)
|
xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t)
|
||||||
@@ -211,131 +257,8 @@
|
@@ -211,131 +262,8 @@
|
||||||
fs_manage_cifs_symlinks($1_mozilla_t)
|
fs_manage_cifs_symlinks($1_mozilla_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -2735,7 +2751,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -350,19 +273,26 @@
|
@@ -350,19 +278,27 @@
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
cups_read_rw_config($1_mozilla_t)
|
cups_read_rw_config($1_mozilla_t)
|
||||||
cups_dbus_chat($1_mozilla_t)
|
cups_dbus_chat($1_mozilla_t)
|
||||||
@ -2746,6 +2762,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
|
|||||||
dbus_system_bus_client_template($1_mozilla,$1_mozilla_t)
|
dbus_system_bus_client_template($1_mozilla,$1_mozilla_t)
|
||||||
- dbus_user_bus_client_template($1,$1_mozilla,$1_mozilla_t)
|
- dbus_user_bus_client_template($1,$1_mozilla,$1_mozilla_t)
|
||||||
+# dbus_user_bus_client_template($1,$1_mozilla,$1_mozilla_t)
|
+# dbus_user_bus_client_template($1,$1_mozilla,$1_mozilla_t)
|
||||||
|
+# dbus_connectto_user_bus($1,$1_mozilla_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -2764,7 +2781,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -382,25 +312,6 @@
|
@@ -382,25 +318,6 @@
|
||||||
thunderbird_domtrans_user_thunderbird($1, $1_mozilla_t)
|
thunderbird_domtrans_user_thunderbird($1, $1_mozilla_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -2790,7 +2807,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -430,11 +341,11 @@
|
@@ -430,11 +347,11 @@
|
||||||
#
|
#
|
||||||
template(`mozilla_read_user_home_files',`
|
template(`mozilla_read_user_home_files',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -2805,7 +2822,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -464,11 +375,11 @@
|
@@ -464,11 +381,11 @@
|
||||||
#
|
#
|
||||||
template(`mozilla_write_user_home_files',`
|
template(`mozilla_write_user_home_files',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -2820,7 +2837,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -573,3 +484,27 @@
|
@@ -573,3 +490,27 @@
|
||||||
|
|
||||||
allow $2 $1_mozilla_t:tcp_socket rw_socket_perms;
|
allow $2 $1_mozilla_t:tcp_socket rw_socket_perms;
|
||||||
')
|
')
|
||||||
@ -4031,6 +4048,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu
|
|||||||
neverallow ~{ selinux_unconfined_type can_load_policy } security_t:security load_policy;
|
neverallow ~{ selinux_unconfined_type can_load_policy } security_t:security load_policy;
|
||||||
neverallow ~{ selinux_unconfined_type can_setenforce } security_t:security setenforce;
|
neverallow ~{ selinux_unconfined_type can_setenforce } security_t:security setenforce;
|
||||||
neverallow ~{ selinux_unconfined_type can_setsecparam } security_t:security setsecparam;
|
neverallow ~{ selinux_unconfined_type can_setsecparam } security_t:security setsecparam;
|
||||||
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.2.5/policy/modules/kernel/storage.fc
|
||||||
|
--- nsaserefpolicy/policy/modules/kernel/storage.fc 2007-10-29 18:02:31.000000000 -0400
|
||||||
|
+++ serefpolicy-3.2.5/policy/modules/kernel/storage.fc 2007-12-21 10:02:13.000000000 -0500
|
||||||
|
@@ -13,6 +13,7 @@
|
||||||
|
/dev/cm20.* -b gen_context(system_u:object_r:removable_device_t,s0)
|
||||||
|
/dev/dasd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
|
||||||
|
/dev/dm-[0-9]+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
|
||||||
|
+/dev/drbd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
|
||||||
|
/dev/fd[^/]+ -b gen_context(system_u:object_r:removable_device_t,s0)
|
||||||
|
/dev/flash[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
|
||||||
|
/dev/gscd -b gen_context(system_u:object_r:removable_device_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.2.5/policy/modules/kernel/terminal.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.2.5/policy/modules/kernel/terminal.if
|
||||||
--- nsaserefpolicy/policy/modules/kernel/terminal.if 2007-09-12 10:34:17.000000000 -0400
|
--- nsaserefpolicy/policy/modules/kernel/terminal.if 2007-09-12 10:34:17.000000000 -0400
|
||||||
+++ serefpolicy-3.2.5/policy/modules/kernel/terminal.if 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/kernel/terminal.if 2007-12-19 05:38:09.000000000 -0500
|
||||||
@ -6003,17 +6031,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.
|
|||||||
-')
|
-')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.5/policy/modules/services/dbus.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.5/policy/modules/services/dbus.if
|
||||||
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/dbus.if 2007-12-21 02:47:15.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/dbus.if 2007-12-24 06:16:06.000000000 -0500
|
||||||
@@ -91,7 +91,7 @@
|
@@ -91,7 +91,9 @@
|
||||||
# SE-DBus specific permissions
|
# SE-DBus specific permissions
|
||||||
allow $1_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg;
|
allow $1_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg;
|
||||||
allow $2 $1_dbusd_t:dbus { send_msg acquire_svc };
|
allow $2 $1_dbusd_t:dbus { send_msg acquire_svc };
|
||||||
- allow $1_t system_dbusd_t:dbus { send_msg acquire_svc };
|
- allow $1_t system_dbusd_t:dbus { send_msg acquire_svc };
|
||||||
|
+ allow $1_dbusd_t $2:dbus send_msg;
|
||||||
|
+ allow $2 $2:dbus send_msg;
|
||||||
+ allow $2 system_dbusd_t:dbus { send_msg acquire_svc };
|
+ allow $2 system_dbusd_t:dbus { send_msg acquire_svc };
|
||||||
|
|
||||||
allow $1_dbusd_t dbusd_etc_t:dir list_dir_perms;
|
allow $1_dbusd_t dbusd_etc_t:dir list_dir_perms;
|
||||||
read_files_pattern($1_dbusd_t,dbusd_etc_t,dbusd_etc_t)
|
read_files_pattern($1_dbusd_t,dbusd_etc_t,dbusd_etc_t)
|
||||||
@@ -104,8 +104,7 @@
|
@@ -104,8 +106,7 @@
|
||||||
domtrans_pattern($2, system_dbusd_exec_t, $1_dbusd_t)
|
domtrans_pattern($2, system_dbusd_exec_t, $1_dbusd_t)
|
||||||
allow $2 $1_dbusd_t:process { sigkill signal };
|
allow $2 $1_dbusd_t:process { sigkill signal };
|
||||||
|
|
||||||
@ -6023,7 +6053,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
|||||||
allow $1_dbusd_t $2:process sigkill;
|
allow $1_dbusd_t $2:process sigkill;
|
||||||
allow $2 $1_dbusd_t:fd use;
|
allow $2 $1_dbusd_t:fd use;
|
||||||
allow $2 $1_dbusd_t:fifo_file rw_fifo_file_perms;
|
allow $2 $1_dbusd_t:fifo_file rw_fifo_file_perms;
|
||||||
@@ -161,7 +160,9 @@
|
@@ -161,7 +162,9 @@
|
||||||
seutil_read_config($1_dbusd_t)
|
seutil_read_config($1_dbusd_t)
|
||||||
seutil_read_default_contexts($1_dbusd_t)
|
seutil_read_default_contexts($1_dbusd_t)
|
||||||
|
|
||||||
@ -6034,7 +6064,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
|||||||
|
|
||||||
ifdef(`hide_broken_symptoms', `
|
ifdef(`hide_broken_symptoms', `
|
||||||
dontaudit $2 $1_dbusd_t:netlink_selinux_socket { read write };
|
dontaudit $2 $1_dbusd_t:netlink_selinux_socket { read write };
|
||||||
@@ -214,7 +215,7 @@
|
@@ -214,7 +217,7 @@
|
||||||
|
|
||||||
# SE-DBus specific permissions
|
# SE-DBus specific permissions
|
||||||
# allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg;
|
# allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg;
|
||||||
@ -6043,7 +6073,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
|||||||
|
|
||||||
read_files_pattern($2, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
|
read_files_pattern($2, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
|
||||||
files_search_var_lib($2)
|
files_search_var_lib($2)
|
||||||
@@ -263,6 +264,7 @@
|
@@ -263,6 +266,7 @@
|
||||||
|
|
||||||
# For connecting to the bus
|
# For connecting to the bus
|
||||||
allow $3 $1_dbusd_t:unix_stream_socket connectto;
|
allow $3 $1_dbusd_t:unix_stream_socket connectto;
|
||||||
@ -6051,7 +6081,67 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -366,3 +368,53 @@
|
@@ -292,6 +296,59 @@
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
+## connectto a message on user/application specific DBUS.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain_prefix">
|
||||||
|
+## <summary>
|
||||||
|
+## The prefix of the domain (e.g., user
|
||||||
|
+## is the prefix for user_t).
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+template(`dbus_connectto_user_bus',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type $1_dbusd_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ allow $2 $1_dbusd_t:unix_stream_socket connectto;
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Chat on user/application specific DBUS.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain_prefix">
|
||||||
|
+## <summary>
|
||||||
|
+## The prefix of the domain (e.g., user
|
||||||
|
+## is the prefix for user_t).
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+template(`dbus_chat_user_bus',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type $1_t;
|
||||||
|
+ type $1_dbusd_t;
|
||||||
|
+ class dbus send_msg;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ allow $2 $1_dbusd_t:dbus send_msg;
|
||||||
|
+ allow $1_dbusd_t $2:dbus send_msg;
|
||||||
|
+ allow $2 $1_t:dbus send_msg;
|
||||||
|
+ allow $1_t $2:dbus send_msg;
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
## Read dbus configuration.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
@@ -366,3 +423,53 @@
|
||||||
|
|
||||||
allow $1 system_dbusd_t:dbus *;
|
allow $1 system_dbusd_t:dbus *;
|
||||||
')
|
')
|
||||||
@ -14420,7 +14510,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
+/root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
|
+/root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.2.5/policy/modules/system/userdomain.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.2.5/policy/modules/system/userdomain.if
|
||||||
--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-11-29 13:29:35.000000000 -0500
|
--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-11-29 13:29:35.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/system/userdomain.if 2007-12-20 14:54:51.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/system/userdomain.if 2007-12-24 06:19:27.000000000 -0500
|
||||||
@@ -29,8 +29,9 @@
|
@@ -29,8 +29,9 @@
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -15875,7 +15965,50 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -4225,11 +4268,11 @@
|
@@ -3248,6 +3291,42 @@
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
+template(`userdom_read_user_tmpfs_files',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type $1_tmpfs_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ fs_search_tmpfs($2)
|
||||||
|
+ allow $2 $1_tmpfs_t:dir list_dir_perms;
|
||||||
|
+ read_files_pattern($2,$1_tmpfs_t,$1_tmpfs_t)
|
||||||
|
+ read_lnk_files_pattern($2,$1_tmpfs_t,$1_tmpfs_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Read/write user tmpfs files.
|
||||||
|
+## </summary>
|
||||||
|
+## <desc>
|
||||||
|
+## <p>
|
||||||
|
+## Read/write user tmpfs files.
|
||||||
|
+## </p>
|
||||||
|
+## <p>
|
||||||
|
+## This is a templated interface, and should only
|
||||||
|
+## be called from a per-userdomain template.
|
||||||
|
+## </p>
|
||||||
|
+## </desc>
|
||||||
|
+## <param name="userdomain_prefix">
|
||||||
|
+## <summary>
|
||||||
|
+## The prefix of the user domain (e.g., user
|
||||||
|
+## is the prefix for user_t).
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
template(`userdom_rw_user_tmpfs_files',`
|
||||||
|
gen_require(`
|
||||||
|
type $1_tmpfs_t;
|
||||||
|
@@ -4225,11 +4304,11 @@
|
||||||
#
|
#
|
||||||
interface(`userdom_search_staff_home_dirs',`
|
interface(`userdom_search_staff_home_dirs',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -15889,7 +16022,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -4245,10 +4288,10 @@
|
@@ -4245,10 +4324,10 @@
|
||||||
#
|
#
|
||||||
interface(`userdom_dontaudit_search_staff_home_dirs',`
|
interface(`userdom_dontaudit_search_staff_home_dirs',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -15902,7 +16035,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -4264,11 +4307,11 @@
|
@@ -4264,11 +4343,11 @@
|
||||||
#
|
#
|
||||||
interface(`userdom_manage_staff_home_dirs',`
|
interface(`userdom_manage_staff_home_dirs',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -15916,7 +16049,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -4283,16 +4326,16 @@
|
@@ -4283,16 +4362,16 @@
|
||||||
#
|
#
|
||||||
interface(`userdom_relabelto_staff_home_dirs',`
|
interface(`userdom_relabelto_staff_home_dirs',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -15936,7 +16069,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
## users home directory.
|
## users home directory.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -4301,12 +4344,27 @@
|
@@ -4301,33 +4380,48 @@
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -15949,29 +16082,40 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
|
|
||||||
- dontaudit $1 staff_home_t:file append;
|
- dontaudit $1 staff_home_t:file append;
|
||||||
+ dontaudit $1 user_home_t:file append_file_perms;
|
+ dontaudit $1 user_home_t:file append_file_perms;
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
-## Read files in the staff users home directory.
|
||||||
|
+## Do not audit attempts to append to the staff
|
||||||
|
+## users home directory.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
-## Domain allowed access.
|
||||||
|
+## Domain to not audit.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
-interface(`userdom_read_staff_home_content_files',`
|
||||||
|
- gen_require(`
|
||||||
|
- type staff_home_dir_t, staff_home_t;
|
||||||
|
+interface(`userdom_dontaudit_append_staff_home_content_files',`
|
||||||
|
+ userdom_dontaudit_append_unpriv_home_content_files($1)
|
||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
+########################################
|
+########################################
|
||||||
+## <summary>
|
+## <summary>
|
||||||
+## Do not audit attempts to append to the staff
|
+## Read files in the staff users home directory.
|
||||||
+## users home directory.
|
|
||||||
+## </summary>
|
+## </summary>
|
||||||
+## <param name="domain">
|
+## <param name="domain">
|
||||||
+## <summary>
|
+## <summary>
|
||||||
+## Domain to not audit.
|
+## Domain allowed access.
|
||||||
+## </summary>
|
+## </summary>
|
||||||
+## </param>
|
+## </param>
|
||||||
+#
|
+#
|
||||||
+interface(`userdom_dontaudit_append_staff_home_content_files',`
|
+interface(`userdom_read_staff_home_content_files',`
|
||||||
+ userdom_dontaudit_append_unpriv_home_content_files($1)
|
+ gen_require(`
|
||||||
')
|
|
||||||
|
|
||||||
########################################
|
|
||||||
@@ -4321,13 +4379,13 @@
|
|
||||||
#
|
|
||||||
interface(`userdom_read_staff_home_content_files',`
|
|
||||||
gen_require(`
|
|
||||||
- type staff_home_dir_t, staff_home_t;
|
|
||||||
+ type user_home_dir_t, user_home_t;
|
+ type user_home_dir_t, user_home_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -15985,7 +16129,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -4525,10 +4583,10 @@
|
@@ -4525,10 +4619,10 @@
|
||||||
#
|
#
|
||||||
interface(`userdom_getattr_sysadm_home_dirs',`
|
interface(`userdom_getattr_sysadm_home_dirs',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -15998,7 +16142,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -4545,10 +4603,10 @@
|
@@ -4545,10 +4639,10 @@
|
||||||
#
|
#
|
||||||
interface(`userdom_dontaudit_getattr_sysadm_home_dirs',`
|
interface(`userdom_dontaudit_getattr_sysadm_home_dirs',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -16011,7 +16155,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -4563,10 +4621,10 @@
|
@@ -4563,10 +4657,10 @@
|
||||||
#
|
#
|
||||||
interface(`userdom_search_sysadm_home_dirs',`
|
interface(`userdom_search_sysadm_home_dirs',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -16024,7 +16168,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -4582,10 +4640,10 @@
|
@@ -4582,10 +4676,10 @@
|
||||||
#
|
#
|
||||||
interface(`userdom_dontaudit_search_sysadm_home_dirs',`
|
interface(`userdom_dontaudit_search_sysadm_home_dirs',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -16037,7 +16181,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -4600,10 +4658,10 @@
|
@@ -4600,10 +4694,10 @@
|
||||||
#
|
#
|
||||||
interface(`userdom_list_sysadm_home_dirs',`
|
interface(`userdom_list_sysadm_home_dirs',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -16050,7 +16194,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -4619,10 +4677,10 @@
|
@@ -4619,10 +4713,10 @@
|
||||||
#
|
#
|
||||||
interface(`userdom_dontaudit_list_sysadm_home_dirs',`
|
interface(`userdom_dontaudit_list_sysadm_home_dirs',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -16063,7 +16207,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -4638,12 +4696,11 @@
|
@@ -4638,12 +4732,11 @@
|
||||||
#
|
#
|
||||||
interface(`userdom_dontaudit_read_sysadm_home_content_files',`
|
interface(`userdom_dontaudit_read_sysadm_home_content_files',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -16079,7 +16223,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -4670,10 +4727,10 @@
|
@@ -4670,10 +4763,10 @@
|
||||||
#
|
#
|
||||||
interface(`userdom_sysadm_home_dir_filetrans',`
|
interface(`userdom_sysadm_home_dir_filetrans',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -16092,7 +16236,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -4688,10 +4745,10 @@
|
@@ -4688,10 +4781,10 @@
|
||||||
#
|
#
|
||||||
interface(`userdom_search_sysadm_home_content_dirs',`
|
interface(`userdom_search_sysadm_home_content_dirs',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -16105,7 +16249,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -4706,13 +4763,13 @@
|
@@ -4706,13 +4799,13 @@
|
||||||
#
|
#
|
||||||
interface(`userdom_read_sysadm_home_content_files',`
|
interface(`userdom_read_sysadm_home_content_files',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -16123,88 +16267,60 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -4748,16 +4805,15 @@
|
@@ -4748,11 +4841,48 @@
|
||||||
#
|
#
|
||||||
interface(`userdom_search_all_users_home_dirs',`
|
interface(`userdom_search_all_users_home_dirs',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
- attribute home_dir_type;
|
|
||||||
+ attribute user_home_dir_type;
|
+ attribute user_home_dir_type;
|
||||||
')
|
+ ')
|
||||||
|
+
|
||||||
files_list_home($1)
|
+ files_list_home($1)
|
||||||
- allow $1 home_dir_type:dir search_dir_perms;
|
|
||||||
+ allow $1 user_home_dir_type:dir search_dir_perms;
|
+ allow $1 user_home_dir_type:dir search_dir_perms;
|
||||||
')
|
+')
|
||||||
-
|
+########################################
|
||||||
########################################
|
+## <summary>
|
||||||
## <summary>
|
|
||||||
-## List all users home directories.
|
|
||||||
+## Read all users home directories symlinks.
|
+## Read all users home directories symlinks.
|
||||||
## </summary>
|
+## </summary>
|
||||||
## <param name="domain">
|
+## <param name="domain">
|
||||||
## <summary>
|
+## <summary>
|
||||||
@@ -4765,18 +4821,18 @@
|
+## Domain allowed access.
|
||||||
## </summary>
|
+## </summary>
|
||||||
## </param>
|
+## </param>
|
||||||
#
|
+#
|
||||||
-interface(`userdom_list_all_users_home_dirs',`
|
|
||||||
+interface(`userdom_read_all_users_home_dirs_symlinks',`
|
+interface(`userdom_read_all_users_home_dirs_symlinks',`
|
||||||
gen_require(`
|
+ gen_require(`
|
||||||
attribute home_dir_type;
|
attribute home_dir_type;
|
||||||
')
|
')
|
||||||
|
|
||||||
files_list_home($1)
|
files_list_home($1)
|
||||||
- allow $1 home_dir_type:dir list_dir_perms;
|
- allow $1 home_dir_type:dir search_dir_perms;
|
||||||
+ allow $1 home_dir_type:lnk_file read_lnk_file_perms;
|
+ allow $1 home_dir_type:lnk_file read_lnk_file_perms;
|
||||||
')
|
+')
|
||||||
|
+
|
||||||
########################################
|
+########################################
|
||||||
## <summary>
|
+## <summary>
|
||||||
-## Search all users home directories.
|
|
||||||
+## Read all users home directories symlinks.
|
+## Read all users home directories symlinks.
|
||||||
## </summary>
|
+## </summary>
|
||||||
## <param name="domain">
|
+## <param name="domain">
|
||||||
## <summary>
|
+## <summary>
|
||||||
@@ -4784,33 +4840,79 @@
|
+## Domain allowed access.
|
||||||
## </summary>
|
+## </summary>
|
||||||
## </param>
|
+## </param>
|
||||||
#
|
+#
|
||||||
-interface(`userdom_search_all_users_home_content',`
|
|
||||||
+interface(`userdom_read_all_users_home_content_symlinks',`
|
+interface(`userdom_read_all_users_home_content_symlinks',`
|
||||||
gen_require(`
|
+ gen_require(`
|
||||||
- attribute home_dir_type, home_type;
|
|
||||||
+ type user_home_t;
|
+ type user_home_t;
|
||||||
')
|
+ ')
|
||||||
|
+
|
||||||
files_list_home($1)
|
+ files_list_home($1)
|
||||||
- allow $1 { home_dir_type home_type }:dir search_dir_perms;
|
|
||||||
+ allow $1 user_home_t:lnk_file read_lnk_file_perms;
|
+ allow $1 user_home_t:lnk_file read_lnk_file_perms;
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
@@ -4772,6 +4902,14 @@
|
||||||
-## Do not audit attempts to search all users home directories.
|
|
||||||
+## List all users home directories.
|
|
||||||
## </summary>
|
|
||||||
## <param name="domain">
|
|
||||||
## <summary>
|
|
||||||
-## Domain to not audit.
|
|
||||||
+## Domain allowed access.
|
|
||||||
## </summary>
|
|
||||||
## </param>
|
|
||||||
#
|
|
||||||
-interface(`userdom_dontaudit_search_all_users_home_content',`
|
|
||||||
+interface(`userdom_list_all_users_home_dirs',`
|
|
||||||
gen_require(`
|
|
||||||
- attribute home_dir_type, home_type;
|
|
||||||
+ attribute home_dir_type;
|
|
||||||
')
|
|
||||||
|
|
||||||
- dontaudit $1 { home_dir_type home_type }:dir search_dir_perms;
|
files_list_home($1)
|
||||||
-')
|
allow $1 home_dir_type:dir list_dir_perms;
|
||||||
-
|
|
||||||
+ files_list_home($1)
|
|
||||||
+ allow $1 home_dir_type:dir list_dir_perms;
|
|
||||||
+
|
+
|
||||||
+ tunable_policy(`use_nfs_home_dirs',`
|
+ tunable_policy(`use_nfs_home_dirs',`
|
||||||
+ fs_list_nfs(crond_t)
|
+ fs_list_nfs(crond_t)
|
||||||
@ -16213,49 +16329,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
+ tunable_policy(`use_samba_home_dirs',`
|
+ tunable_policy(`use_samba_home_dirs',`
|
||||||
+ fs_list_cifs(crond_t)
|
+ fs_list_cifs(crond_t)
|
||||||
+ ')
|
+ ')
|
||||||
+')
|
')
|
||||||
+
|
|
||||||
+########################################
|
|
||||||
+## <summary>
|
|
||||||
+## Search all users home directories.
|
|
||||||
+## </summary>
|
|
||||||
+## <param name="domain">
|
|
||||||
+## <summary>
|
|
||||||
+## Domain allowed access.
|
|
||||||
+## </summary>
|
|
||||||
+## </param>
|
|
||||||
+#
|
|
||||||
+interface(`userdom_search_all_users_home_content',`
|
|
||||||
+ gen_require(`
|
|
||||||
+ attribute home_dir_type, home_type;
|
|
||||||
+ ')
|
|
||||||
+
|
|
||||||
+ files_list_home($1)
|
|
||||||
+ allow $1 { home_dir_type home_type }:dir search_dir_perms;
|
|
||||||
+')
|
|
||||||
+
|
|
||||||
+########################################
|
|
||||||
+## <summary>
|
|
||||||
+## Do not audit attempts to search all users home directories.
|
|
||||||
+## </summary>
|
|
||||||
+## <param name="domain">
|
|
||||||
+## <summary>
|
|
||||||
+## Domain to not audit.
|
|
||||||
+## </summary>
|
|
||||||
+## </param>
|
|
||||||
+#
|
|
||||||
+interface(`userdom_dontaudit_search_all_users_home_content',`
|
|
||||||
+ gen_require(`
|
|
||||||
+ attribute home_dir_type, home_type;
|
|
||||||
+ ')
|
|
||||||
+
|
|
||||||
+ dontaudit $1 { home_dir_type home_type }:dir search_dir_perms;
|
|
||||||
+')
|
|
||||||
+
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
@@ -5109,7 +5247,7 @@
|
||||||
## Read all files in all users home directories.
|
|
||||||
@@ -5109,7 +5211,7 @@
|
|
||||||
#
|
#
|
||||||
interface(`userdom_relabelto_generic_user_home_dirs',`
|
interface(`userdom_relabelto_generic_user_home_dirs',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -16264,7 +16341,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
')
|
')
|
||||||
|
|
||||||
files_search_home($1)
|
files_search_home($1)
|
||||||
@@ -5298,6 +5400,49 @@
|
@@ -5298,6 +5436,49 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -16314,7 +16391,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
## Create, read, write, and delete directories in
|
## Create, read, write, and delete directories in
|
||||||
## unprivileged users home directories.
|
## unprivileged users home directories.
|
||||||
## </summary>
|
## </summary>
|
||||||
@@ -5503,6 +5648,24 @@
|
@@ -5503,6 +5684,24 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -16339,7 +16416,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
## Read and write unprivileged user ttys.
|
## Read and write unprivileged user ttys.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -5668,6 +5831,42 @@
|
@@ -5668,6 +5867,42 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -16382,7 +16459,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
## Send a dbus message to all user domains.
|
## Send a dbus message to all user domains.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -5698,3 +5897,277 @@
|
@@ -5698,3 +5933,277 @@
|
||||||
interface(`userdom_unconfined',`
|
interface(`userdom_unconfined',`
|
||||||
refpolicywarn(`$0($*) has been deprecated.')
|
refpolicywarn(`$0($*) has been deprecated.')
|
||||||
')
|
')
|
||||||
@ -17157,8 +17234,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.i
|
|||||||
+## <summary>Policy for guest user</summary>
|
+## <summary>Policy for guest user</summary>
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.2.5/policy/modules/users/guest.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.2.5/policy/modules/users/guest.te
|
||||||
--- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500
|
--- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/users/guest.te 2007-12-19 16:37:00.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/users/guest.te 2007-12-22 07:19:26.000000000 -0500
|
||||||
@@ -0,0 +1,12 @@
|
@@ -0,0 +1,21 @@
|
||||||
+policy_module(guest,1.0.1)
|
+policy_module(guest,1.0.1)
|
||||||
+userdom_restricted_user_template(guest)
|
+userdom_restricted_user_template(guest)
|
||||||
+
|
+
|
||||||
@ -17171,6 +17248,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.t
|
|||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
+userdom_restricted_user_template(gadmin)
|
+userdom_restricted_user_template(gadmin)
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type xguest_mozilla_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ dbus_chat_user_bus(xguest,xguest_mozilla_t)
|
||||||
|
+ dbus_connectto_user_bus(xguest,xguest_mozilla_t)
|
||||||
|
+')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.2.5/policy/modules/users/logadm.fc
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.2.5/policy/modules/users/logadm.fc
|
||||||
--- nsaserefpolicy/policy/modules/users/logadm.fc 1969-12-31 19:00:00.000000000 -0500
|
--- nsaserefpolicy/policy/modules/users/logadm.fc 1969-12-31 19:00:00.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/users/logadm.fc 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/users/logadm.fc 2007-12-19 05:38:09.000000000 -0500
|
||||||
@ -17365,7 +17451,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets
|
|||||||
+define(`manage_key_perms', `{ create link read search setattr view write } ')
|
+define(`manage_key_perms', `{ create link read search setattr view write } ')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.2.5/policy/users
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.2.5/policy/users
|
||||||
--- nsaserefpolicy/policy/users 2007-10-12 08:56:09.000000000 -0400
|
--- nsaserefpolicy/policy/users 2007-10-12 08:56:09.000000000 -0400
|
||||||
+++ serefpolicy-3.2.5/policy/users 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/users 2007-12-21 12:52:51.000000000 -0500
|
||||||
@@ -16,7 +16,7 @@
|
@@ -16,7 +16,7 @@
|
||||||
# and a user process should never be assigned the system user
|
# and a user process should never be assigned the system user
|
||||||
# identity.
|
# identity.
|
||||||
@ -17399,7 +17485,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.2
|
|||||||
-',`
|
-',`
|
||||||
- gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
|
- gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
-')
|
-')
|
||||||
+gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
+gen_user(root, unconfined, unconfined_r sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.2.5/Rules.modular
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.2.5/Rules.modular
|
||||||
--- nsaserefpolicy/Rules.modular 2007-12-19 05:32:18.000000000 -0500
|
--- nsaserefpolicy/Rules.modular 2007-12-19 05:32:18.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/Rules.modular 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/Rules.modular 2007-12-19 05:38:09.000000000 -0500
|
||||||
|
@ -17,7 +17,7 @@
|
|||||||
Summary: SELinux policy configuration
|
Summary: SELinux policy configuration
|
||||||
Name: selinux-policy
|
Name: selinux-policy
|
||||||
Version: 3.2.5
|
Version: 3.2.5
|
||||||
Release: 4%{?dist}
|
Release: 5%{?dist}
|
||||||
License: GPLv2+
|
License: GPLv2+
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
Source: serefpolicy-%{version}.tgz
|
Source: serefpolicy-%{version}.tgz
|
||||||
@ -386,6 +386,12 @@ exit 0
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Mon Dec 24 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-6
|
||||||
|
- Fix role transition fro unconfined_r to system_r when running rpm
|
||||||
|
|
||||||
|
* Sat Dec 21 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-5
|
||||||
|
- Fixes for xguest
|
||||||
|
|
||||||
* Thu Dec 20 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-4
|
* Thu Dec 20 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-4
|
||||||
- Let all uncofined domains communicate with dbus unconfined
|
- Let all uncofined domains communicate with dbus unconfined
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user