- Run rpm in system_r
This commit is contained in:
parent
5615fe1b3d
commit
673eaaeafb
@ -206,7 +206,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.if
|
|||||||
+')
|
+')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.2.5/policy/modules/admin/alsa.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.2.5/policy/modules/admin/alsa.te
|
||||||
--- nsaserefpolicy/policy/modules/admin/alsa.te 2007-12-19 05:32:18.000000000 -0500
|
--- nsaserefpolicy/policy/modules/admin/alsa.te 2007-12-19 05:32:18.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/admin/alsa.te 2007-12-19 05:38:08.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/admin/alsa.te 2007-12-20 08:55:02.000000000 -0500
|
||||||
@@ -8,12 +8,15 @@
|
@@ -8,12 +8,15 @@
|
||||||
|
|
||||||
type alsa_t;
|
type alsa_t;
|
||||||
@ -224,7 +224,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te
|
|||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
# Local policy
|
# Local policy
|
||||||
@@ -30,11 +33,18 @@
|
@@ -30,14 +33,23 @@
|
||||||
manage_lnk_files_pattern(alsa_t,alsa_etc_rw_t,alsa_etc_rw_t)
|
manage_lnk_files_pattern(alsa_t,alsa_etc_rw_t,alsa_etc_rw_t)
|
||||||
files_etc_filetrans(alsa_t, alsa_etc_rw_t, file)
|
files_etc_filetrans(alsa_t, alsa_etc_rw_t, file)
|
||||||
|
|
||||||
@ -243,7 +243,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te
|
|||||||
files_search_home(alsa_t)
|
files_search_home(alsa_t)
|
||||||
files_read_etc_files(alsa_t)
|
files_read_etc_files(alsa_t)
|
||||||
|
|
||||||
@@ -48,10 +58,7 @@
|
+auth_use_nsswitch(alsa_t)
|
||||||
|
+
|
||||||
|
libs_use_ld_so(alsa_t)
|
||||||
|
libs_use_shared_libs(alsa_t)
|
||||||
|
|
||||||
|
@@ -48,10 +60,7 @@
|
||||||
userdom_manage_unpriv_user_semaphores(alsa_t)
|
userdom_manage_unpriv_user_semaphores(alsa_t)
|
||||||
userdom_manage_unpriv_user_shared_mem(alsa_t)
|
userdom_manage_unpriv_user_shared_mem(alsa_t)
|
||||||
userdom_search_generic_user_home_dirs(alsa_t)
|
userdom_search_generic_user_home_dirs(alsa_t)
|
||||||
@ -920,7 +925,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc
|
|||||||
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
|
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.2.5/policy/modules/admin/rpm.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.2.5/policy/modules/admin/rpm.if
|
||||||
--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400
|
--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400
|
||||||
+++ serefpolicy-3.2.5/policy/modules/admin/rpm.if 2007-12-19 05:38:08.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/admin/rpm.if 2007-12-20 08:55:42.000000000 -0500
|
||||||
@@ -152,6 +152,24 @@
|
@@ -152,6 +152,24 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -1002,7 +1007,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -289,3 +346,111 @@
|
@@ -289,3 +346,137 @@
|
||||||
dontaudit $1 rpm_var_lib_t:file manage_file_perms;
|
dontaudit $1 rpm_var_lib_t:file manage_file_perms;
|
||||||
dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms;
|
dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms;
|
||||||
')
|
')
|
||||||
@ -1114,6 +1119,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
|
|||||||
+ read_lnk_files_pattern($1,rpm_tmpfs_t,rpm_tmpfs_t)
|
+ read_lnk_files_pattern($1,rpm_tmpfs_t,rpm_tmpfs_t)
|
||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Transition to system_r when execute an init script
|
||||||
|
+## </summary>
|
||||||
|
+## <desc>
|
||||||
|
+## <p>
|
||||||
|
+## Execute rpm script in a specified role
|
||||||
|
+## </p>
|
||||||
|
+## <p>
|
||||||
|
+## No interprocess communication (signals, pipes,
|
||||||
|
+## etc.) is provided by this interface since
|
||||||
|
+## the domains are not owned by this module.
|
||||||
|
+## </p>
|
||||||
|
+## </desc>
|
||||||
|
+## <param name="source_role">
|
||||||
|
+## <summary>
|
||||||
|
+## Role to transition from.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+interface(`rpm_role_transition',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type rpm_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ role_transition $1 rpm_t system_r;
|
||||||
|
+')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.2.5/policy/modules/admin/rpm.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.2.5/policy/modules/admin/rpm.te
|
||||||
--- nsaserefpolicy/policy/modules/admin/rpm.te 2007-12-19 05:32:18.000000000 -0500
|
--- nsaserefpolicy/policy/modules/admin/rpm.te 2007-12-19 05:32:18.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/admin/rpm.te 2007-12-19 05:38:08.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/admin/rpm.te 2007-12-19 05:38:08.000000000 -0500
|
||||||
@ -3699,7 +3730,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain
|
|||||||
+')
|
+')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.2.5/policy/modules/kernel/files.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.2.5/policy/modules/kernel/files.if
|
||||||
--- nsaserefpolicy/policy/modules/kernel/files.if 2007-10-29 18:02:31.000000000 -0400
|
--- nsaserefpolicy/policy/modules/kernel/files.if 2007-10-29 18:02:31.000000000 -0400
|
||||||
+++ serefpolicy-3.2.5/policy/modules/kernel/files.if 2007-12-19 05:38:08.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/kernel/files.if 2007-12-20 16:15:45.000000000 -0500
|
||||||
@@ -1266,6 +1266,24 @@
|
@@ -1266,6 +1266,24 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -5138,7 +5169,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
|||||||
+/var/lib/misc(/.*)? gen_context(system_u:object_r:system_crond_var_lib_t,s0)
|
+/var/lib/misc(/.*)? gen_context(system_u:object_r:system_crond_var_lib_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.2.5/policy/modules/services/cron.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.2.5/policy/modules/services/cron.if
|
||||||
--- nsaserefpolicy/policy/modules/services/cron.if 2007-10-12 08:56:07.000000000 -0400
|
--- nsaserefpolicy/policy/modules/services/cron.if 2007-10-12 08:56:07.000000000 -0400
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/cron.if 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/cron.if 2007-12-20 14:02:12.000000000 -0500
|
||||||
@@ -35,38 +35,23 @@
|
@@ -35,38 +35,23 @@
|
||||||
#
|
#
|
||||||
template(`cron_per_role_template',`
|
template(`cron_per_role_template',`
|
||||||
@ -5388,6 +5419,30 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
|||||||
## Read, and write cron daemon TCP sockets.
|
## Read, and write cron daemon TCP sockets.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
|
@@ -583,3 +495,23 @@
|
||||||
|
|
||||||
|
dontaudit $1 system_crond_tmp_t:file append;
|
||||||
|
')
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Read temporary files from the system cron jobs.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`cron_read_system_job_lib_files',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type system_crond_var_lib_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+ read_files_pattern($1, system_crond_var_lib_t, system_crond_var_lib_t)
|
||||||
|
+')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.2.5/policy/modules/services/cron.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.2.5/policy/modules/services/cron.te
|
||||||
--- nsaserefpolicy/policy/modules/services/cron.te 2007-12-19 05:32:17.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/cron.te 2007-12-19 05:32:17.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/cron.te 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/cron.te 2007-12-19 05:38:09.000000000 -0500
|
||||||
@ -6698,7 +6753,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
|
|||||||
+')
|
+')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.2.5/policy/modules/services/hal.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.2.5/policy/modules/services/hal.te
|
||||||
--- nsaserefpolicy/policy/modules/services/hal.te 2007-12-19 05:32:17.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/hal.te 2007-12-19 05:32:17.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/hal.te 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/hal.te 2007-12-20 14:02:58.000000000 -0500
|
||||||
@@ -49,6 +49,9 @@
|
@@ -49,6 +49,9 @@
|
||||||
type hald_var_lib_t;
|
type hald_var_lib_t;
|
||||||
files_type(hald_var_lib_t)
|
files_type(hald_var_lib_t)
|
||||||
@ -6782,11 +6837,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
|
|||||||
libs_use_ld_so(hald_mac_t)
|
libs_use_ld_so(hald_mac_t)
|
||||||
libs_use_shared_libs(hald_mac_t)
|
libs_use_shared_libs(hald_mac_t)
|
||||||
|
|
||||||
@@ -391,3 +412,4 @@
|
@@ -391,3 +412,7 @@
|
||||||
libs_use_shared_libs(hald_keymap_t)
|
libs_use_shared_libs(hald_keymap_t)
|
||||||
|
|
||||||
miscfiles_read_localization(hald_keymap_t)
|
miscfiles_read_localization(hald_keymap_t)
|
||||||
+
|
+
|
||||||
|
+# This is caused by a bug in hald and PolicyKit.
|
||||||
|
+# Should be removed when this is fixed
|
||||||
|
+cron_read_system_job_lib_files(hald_t)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.2.5/policy/modules/services/inetd.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.2.5/policy/modules/services/inetd.te
|
||||||
--- nsaserefpolicy/policy/modules/services/inetd.te 2007-12-19 05:32:17.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/inetd.te 2007-12-19 05:32:17.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/services/inetd.te 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/services/inetd.te 2007-12-19 05:38:09.000000000 -0500
|
||||||
@ -11742,7 +11800,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
|
|||||||
+')
|
+')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.2.5/policy/modules/system/fstools.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.2.5/policy/modules/system/fstools.te
|
||||||
--- nsaserefpolicy/policy/modules/system/fstools.te 2007-12-19 05:32:17.000000000 -0500
|
--- nsaserefpolicy/policy/modules/system/fstools.te 2007-12-19 05:32:17.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/system/fstools.te 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/system/fstools.te 2007-12-20 16:16:24.000000000 -0500
|
||||||
@@ -109,8 +109,7 @@
|
@@ -109,8 +109,7 @@
|
||||||
|
|
||||||
term_use_console(fsadm_t)
|
term_use_console(fsadm_t)
|
||||||
@ -11753,7 +11811,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool
|
|||||||
#RedHat bug #201164
|
#RedHat bug #201164
|
||||||
corecmd_exec_shell(fsadm_t)
|
corecmd_exec_shell(fsadm_t)
|
||||||
|
|
||||||
@@ -183,4 +182,5 @@
|
@@ -132,6 +131,8 @@
|
||||||
|
# Access to /initrd devices
|
||||||
|
files_rw_isid_type_dirs(fsadm_t)
|
||||||
|
files_rw_isid_type_blk_files(fsadm_t)
|
||||||
|
+files_read_isid_type_files(fsadm_t)
|
||||||
|
+
|
||||||
|
# Recreate /mnt/cdrom.
|
||||||
|
files_manage_mnt_dirs(fsadm_t)
|
||||||
|
# for tune2fs
|
||||||
|
@@ -183,4 +184,5 @@
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
xen_append_log(fsadm_t)
|
xen_append_log(fsadm_t)
|
||||||
@ -11811,7 +11878,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplu
|
|||||||
optional_policy(`
|
optional_policy(`
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.2.5/policy/modules/system/init.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.2.5/policy/modules/system/init.if
|
||||||
--- nsaserefpolicy/policy/modules/system/init.if 2007-10-29 18:02:31.000000000 -0400
|
--- nsaserefpolicy/policy/modules/system/init.if 2007-10-29 18:02:31.000000000 -0400
|
||||||
+++ serefpolicy-3.2.5/policy/modules/system/init.if 2007-12-19 05:38:09.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/system/init.if 2007-12-20 08:48:00.000000000 -0500
|
||||||
@@ -211,6 +211,13 @@
|
@@ -211,6 +211,13 @@
|
||||||
kernel_dontaudit_use_fds($1)
|
kernel_dontaudit_use_fds($1)
|
||||||
')
|
')
|
||||||
@ -14034,8 +14101,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
')
|
')
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.2.5/policy/modules/system/unconfined.te
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.2.5/policy/modules/system/unconfined.te
|
||||||
--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-12-19 05:32:17.000000000 -0500
|
--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-12-19 05:32:17.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/system/unconfined.te 2007-12-19 16:35:02.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/system/unconfined.te 2007-12-20 09:13:54.000000000 -0500
|
||||||
@@ -9,32 +9,48 @@
|
@@ -9,32 +9,49 @@
|
||||||
# usage in this module of types created by these
|
# usage in this module of types created by these
|
||||||
# calls is not correct, however we dont currently
|
# calls is not correct, however we dont currently
|
||||||
# have another method to add access to these types
|
# have another method to add access to these types
|
||||||
@ -14054,6 +14121,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
+allow system_r unconfined_r;
|
+allow system_r unconfined_r;
|
||||||
+allow unconfined_r system_r;
|
+allow unconfined_r system_r;
|
||||||
+init_script_role_transition(unconfined_r)
|
+init_script_role_transition(unconfined_r)
|
||||||
|
+rpm_role_transition(unconfined_r)
|
||||||
|
|
||||||
type unconfined_execmem_t;
|
type unconfined_execmem_t;
|
||||||
type unconfined_execmem_exec_t;
|
type unconfined_execmem_exec_t;
|
||||||
@ -14088,7 +14156,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
|
|
||||||
libs_run_ldconfig(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
|
libs_run_ldconfig(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
|
||||||
|
|
||||||
@@ -42,7 +58,10 @@
|
@@ -42,7 +59,10 @@
|
||||||
logging_run_auditctl(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
|
logging_run_auditctl(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
|
||||||
|
|
||||||
mount_run_unconfined(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
|
mount_run_unconfined(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
|
||||||
@ -14099,7 +14167,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
seutil_run_setfiles(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
|
seutil_run_setfiles(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
|
||||||
seutil_run_semanage(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
|
seutil_run_semanage(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
|
||||||
|
|
||||||
@@ -51,13 +70,13 @@
|
@@ -51,13 +71,13 @@
|
||||||
userdom_priveleged_home_dir_manager(unconfined_t)
|
userdom_priveleged_home_dir_manager(unconfined_t)
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -14115,7 +14183,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
unconfined_domain(httpd_unconfined_script_t)
|
unconfined_domain(httpd_unconfined_script_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -69,11 +88,11 @@
|
@@ -69,11 +89,11 @@
|
||||||
bootloader_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
|
bootloader_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -14132,7 +14200,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
init_dbus_chat_script(unconfined_t)
|
init_dbus_chat_script(unconfined_t)
|
||||||
@@ -107,6 +126,10 @@
|
@@ -107,6 +127,10 @@
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
oddjob_dbus_chat(unconfined_t)
|
oddjob_dbus_chat(unconfined_t)
|
||||||
')
|
')
|
||||||
@ -14143,7 +14211,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -118,11 +141,7 @@
|
@@ -118,11 +142,7 @@
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -14156,7 +14224,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -134,14 +153,6 @@
|
@@ -134,14 +154,6 @@
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -14171,7 +14239,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
oddjob_domtrans_mkhomedir(unconfined_t)
|
oddjob_domtrans_mkhomedir(unconfined_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -154,33 +165,20 @@
|
@@ -154,33 +166,20 @@
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -14209,7 +14277,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -205,11 +203,30 @@
|
@@ -205,11 +204,30 @@
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -14242,34 +14310,34 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -219,14 +236,36 @@
|
@@ -219,14 +237,32 @@
|
||||||
|
|
||||||
allow unconfined_execmem_t self:process { execstack execmem };
|
allow unconfined_execmem_t self:process { execstack execmem };
|
||||||
unconfined_domain_noaudit(unconfined_execmem_t)
|
unconfined_domain_noaudit(unconfined_execmem_t)
|
||||||
+allow unconfined_execmem_t unconfined_t:process transition;
|
+allow unconfined_execmem_t unconfined_t:process transition;
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
+ init_dbus_chat_script(unconfined_execmem_t)
|
- dbus_stub(unconfined_execmem_t)
|
||||||
+
|
-
|
||||||
dbus_stub(unconfined_execmem_t)
|
init_dbus_chat_script(unconfined_execmem_t)
|
||||||
|
+ dbus_system_bus_client_template(unconfined_execmem, unconfined_execmem_t)
|
||||||
- init_dbus_chat_script(unconfined_execmem_t)
|
|
||||||
+ dbus_connect_system_bus(unconfined_execmem_t)
|
|
||||||
+ unconfined_dbus_connect(unconfined_execmem_t)
|
|
||||||
unconfined_dbus_chat(unconfined_execmem_t)
|
unconfined_dbus_chat(unconfined_execmem_t)
|
||||||
|
+ unconfined_dbus_connect(unconfined_execmem_t)
|
||||||
|
+')
|
||||||
|
|
||||||
optional_policy(`
|
- optional_policy(`
|
||||||
+ avahi_dbus_chat(unconfined_execmem_t)
|
- hal_dbus_chat(unconfined_execmem_t)
|
||||||
+ ')
|
- ')
|
||||||
|
+optional_policy(`
|
||||||
|
+ avahi_dbus_chat(unconfined_execmem_t)
|
||||||
|
+')
|
||||||
+
|
+
|
||||||
+ optional_policy(`
|
+optional_policy(`
|
||||||
hal_dbus_chat(unconfined_execmem_t)
|
+ hal_dbus_chat(unconfined_execmem_t)
|
||||||
')
|
+')
|
||||||
+
|
+
|
||||||
+ optional_policy(`
|
+optional_policy(`
|
||||||
+ xserver_xdm_rw_shm(unconfined_execmem_t)
|
+ xserver_xdm_rw_shm(unconfined_execmem_t)
|
||||||
+
|
|
||||||
+ ')
|
|
||||||
')
|
')
|
||||||
+
|
+
|
||||||
+########################################
|
+########################################
|
||||||
@ -14295,7 +14363,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
|
|||||||
+/root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
|
+/root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
|
||||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.2.5/policy/modules/system/userdomain.if
|
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.2.5/policy/modules/system/userdomain.if
|
||||||
--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-11-29 13:29:35.000000000 -0500
|
--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-11-29 13:29:35.000000000 -0500
|
||||||
+++ serefpolicy-3.2.5/policy/modules/system/userdomain.if 2007-12-19 16:35:24.000000000 -0500
|
+++ serefpolicy-3.2.5/policy/modules/system/userdomain.if 2007-12-20 14:54:51.000000000 -0500
|
||||||
@@ -29,8 +29,9 @@
|
@@ -29,8 +29,9 @@
|
||||||
')
|
')
|
||||||
|
|
||||||
|
@ -17,7 +17,7 @@
|
|||||||
Summary: SELinux policy configuration
|
Summary: SELinux policy configuration
|
||||||
Name: selinux-policy
|
Name: selinux-policy
|
||||||
Version: 3.2.5
|
Version: 3.2.5
|
||||||
Release: 2%{?dist}
|
Release: 3%{?dist}
|
||||||
License: GPLv2+
|
License: GPLv2+
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
Source: serefpolicy-%{version}.tgz
|
Source: serefpolicy-%{version}.tgz
|
||||||
@ -73,6 +73,9 @@ SELinux Policy development package
|
|||||||
%{_usr}/share/selinux/devel/policy.*
|
%{_usr}/share/selinux/devel/policy.*
|
||||||
%attr(755,root,root) %{_usr}/share/selinux/devel/policyhelp
|
%attr(755,root,root) %{_usr}/share/selinux/devel/policyhelp
|
||||||
|
|
||||||
|
%check devel
|
||||||
|
/usr/bin/sepolgen-ifgen -i %{buildroot}%{_usr}/share/selinux/devel/include -o /dev/null
|
||||||
|
|
||||||
%post devel
|
%post devel
|
||||||
[ -x /usr/bin/sepolgen-ifgen ] && /usr/bin/sepolgen-ifgen
|
[ -x /usr/bin/sepolgen-ifgen ] && /usr/bin/sepolgen-ifgen
|
||||||
exit 0
|
exit 0
|
||||||
@ -383,6 +386,9 @@ exit 0
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Thu Dec 20 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-3
|
||||||
|
- Run rpm in system_r
|
||||||
|
|
||||||
* Wed Dec 19 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-2
|
* Wed Dec 19 2007 Dan Walsh <dwalsh@redhat.com> 3.2.5-2
|
||||||
- Zero out customizable types
|
- Zero out customizable types
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user