- default trans rules for Rawhide policy
- Make sure sound_devices controlC* are labeled correctly on creation - sssd now needs sys_admin - Allow snmp to read all proc_type - Allow to setup users homedir with quota.group
This commit is contained in:
parent
bce4ec2b6e
commit
67539d56f8
195
policy-F16.patch
195
policy-F16.patch
@ -226,10 +226,17 @@ index 4705ab6..0f0bb47 100644
|
|||||||
+gen_tunable(allow_console_login,false)
|
+gen_tunable(allow_console_login,false)
|
||||||
+
|
+
|
||||||
diff --git a/policy/mcs b/policy/mcs
|
diff --git a/policy/mcs b/policy/mcs
|
||||||
index df8e0fa..09eea90 100644
|
index df8e0fa..38146ed 100644
|
||||||
--- a/policy/mcs
|
--- a/policy/mcs
|
||||||
+++ b/policy/mcs
|
+++ b/policy/mcs
|
||||||
@@ -69,16 +69,32 @@ gen_levels(1,mcs_num_cats)
|
@@ -1,4 +1,6 @@
|
||||||
|
ifdef(`enable_mcs',`
|
||||||
|
+default_range dir_file_class_set target low;
|
||||||
|
+
|
||||||
|
#
|
||||||
|
# Define sensitivities
|
||||||
|
#
|
||||||
|
@@ -69,16 +71,32 @@ gen_levels(1,mcs_num_cats)
|
||||||
# - /proc/pid operations are not constrained.
|
# - /proc/pid operations are not constrained.
|
||||||
|
|
||||||
mlsconstrain file { read ioctl lock execute execute_no_trans }
|
mlsconstrain file { read ioctl lock execute execute_no_trans }
|
||||||
@ -266,7 +273,7 @@ index df8e0fa..09eea90 100644
|
|||||||
|
|
||||||
# New filesystem object labels must be dominated by the relabeling subject
|
# New filesystem object labels must be dominated by the relabeling subject
|
||||||
# clearance, also the objects are single-level.
|
# clearance, also the objects are single-level.
|
||||||
@@ -87,10 +103,13 @@ mlsconstrain file { create relabelto }
|
@@ -87,10 +105,13 @@ mlsconstrain file { create relabelto }
|
||||||
|
|
||||||
# new file labels must be dominated by the relabeling subject clearance
|
# new file labels must be dominated by the relabeling subject clearance
|
||||||
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }
|
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }
|
||||||
@ -282,7 +289,7 @@ index df8e0fa..09eea90 100644
|
|||||||
|
|
||||||
mlsconstrain process { transition dyntransition }
|
mlsconstrain process { transition dyntransition }
|
||||||
(( h1 dom h2 ) or ( t1 == mcssetcats ));
|
(( h1 dom h2 ) or ( t1 == mcssetcats ));
|
||||||
@@ -101,6 +120,9 @@ mlsconstrain process { ptrace }
|
@@ -101,6 +122,9 @@ mlsconstrain process { ptrace }
|
||||||
mlsconstrain process { sigkill sigstop }
|
mlsconstrain process { sigkill sigstop }
|
||||||
(( h1 dom h2 ) or ( t1 == mcskillall ));
|
(( h1 dom h2 ) or ( t1 == mcskillall ));
|
||||||
|
|
||||||
@ -292,7 +299,7 @@ index df8e0fa..09eea90 100644
|
|||||||
#
|
#
|
||||||
# MCS policy for SELinux-enabled databases
|
# MCS policy for SELinux-enabled databases
|
||||||
#
|
#
|
||||||
@@ -144,4 +166,21 @@ mlsconstrain db_language { drop getattr setattr relabelfrom execute }
|
@@ -144,4 +168,21 @@ mlsconstrain db_language { drop getattr setattr relabelfrom execute }
|
||||||
mlsconstrain db_blob { drop getattr setattr relabelfrom read write import export }
|
mlsconstrain db_blob { drop getattr setattr relabelfrom read write import export }
|
||||||
( h1 dom h2 );
|
( h1 dom h2 );
|
||||||
|
|
||||||
@ -2335,10 +2342,16 @@ index af55369..5d940f8 100644
|
|||||||
+ miscfiles_read_man_pages(prelink_t)
|
+ miscfiles_read_man_pages(prelink_t)
|
||||||
+')
|
+')
|
||||||
diff --git a/policy/modules/admin/quota.fc b/policy/modules/admin/quota.fc
|
diff --git a/policy/modules/admin/quota.fc b/policy/modules/admin/quota.fc
|
||||||
index f387230..98adfd2 100644
|
index f387230..e63f9c6 100644
|
||||||
--- a/policy/modules/admin/quota.fc
|
--- a/policy/modules/admin/quota.fc
|
||||||
+++ b/policy/modules/admin/quota.fc
|
+++ b/policy/modules/admin/quota.fc
|
||||||
@@ -8,12 +8,18 @@ HOME_ROOT/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
|
@@ -1,4 +1,5 @@
|
||||||
|
HOME_ROOT/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
|
||||||
|
+HOME_DIR/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
|
||||||
|
|
||||||
|
/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
|
||||||
|
|
||||||
|
@@ -8,12 +9,18 @@ HOME_ROOT/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
|
||||||
|
|
||||||
/sbin/quota(check|on) -- gen_context(system_u:object_r:quota_exec_t,s0)
|
/sbin/quota(check|on) -- gen_context(system_u:object_r:quota_exec_t,s0)
|
||||||
|
|
||||||
@ -2423,7 +2436,7 @@ index bf75d99..d1af9cf 100644
|
|||||||
+ domtrans_pattern($1, quota_nld_exec_t, quota_nld_t)
|
+ domtrans_pattern($1, quota_nld_exec_t, quota_nld_t)
|
||||||
+')
|
+')
|
||||||
diff --git a/policy/modules/admin/quota.te b/policy/modules/admin/quota.te
|
diff --git a/policy/modules/admin/quota.te b/policy/modules/admin/quota.te
|
||||||
index 5dd42f5..bef4392 100644
|
index 5dd42f5..c0b7cd0 100644
|
||||||
--- a/policy/modules/admin/quota.te
|
--- a/policy/modules/admin/quota.te
|
||||||
+++ b/policy/modules/admin/quota.te
|
+++ b/policy/modules/admin/quota.te
|
||||||
@@ -15,6 +15,13 @@ files_type(quota_db_t)
|
@@ -15,6 +15,13 @@ files_type(quota_db_t)
|
||||||
@ -2440,17 +2453,21 @@ index 5dd42f5..bef4392 100644
|
|||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
# Local policy
|
# Local policy
|
||||||
@@ -34,6 +41,9 @@ files_home_filetrans(quota_t, quota_db_t, file)
|
@@ -34,6 +41,13 @@ files_home_filetrans(quota_t, quota_db_t, file)
|
||||||
files_usr_filetrans(quota_t, quota_db_t, file)
|
files_usr_filetrans(quota_t, quota_db_t, file)
|
||||||
files_var_filetrans(quota_t, quota_db_t, file)
|
files_var_filetrans(quota_t, quota_db_t, file)
|
||||||
files_spool_filetrans(quota_t, quota_db_t, file)
|
files_spool_filetrans(quota_t, quota_db_t, file)
|
||||||
+mta_spool_filetrans(quota_t, quota_db_t, file)
|
+userdom_user_home_dir_filetrans(quota_t, quota_db_t, file)
|
||||||
+mta_spool_filetrans(quota_t, quota_db_t, file)
|
+
|
||||||
+mta_spool_filetrans_queue(quota_t, quota_db_t, file)
|
+optional_policy(`
|
||||||
|
+ mta_spool_filetrans(quota_t, quota_db_t, file)
|
||||||
|
+ mta_spool_filetrans(quota_t, quota_db_t, file)
|
||||||
|
+ mta_spool_filetrans_queue(quota_t, quota_db_t, file)
|
||||||
|
+')
|
||||||
|
|
||||||
kernel_list_proc(quota_t)
|
kernel_list_proc(quota_t)
|
||||||
kernel_read_proc_symlinks(quota_t)
|
kernel_read_proc_symlinks(quota_t)
|
||||||
@@ -72,7 +82,7 @@ init_use_script_ptys(quota_t)
|
@@ -72,7 +86,7 @@ init_use_script_ptys(quota_t)
|
||||||
|
|
||||||
logging_send_syslog_msg(quota_t)
|
logging_send_syslog_msg(quota_t)
|
||||||
|
|
||||||
@ -2459,7 +2476,7 @@ index 5dd42f5..bef4392 100644
|
|||||||
userdom_dontaudit_use_unpriv_user_fds(quota_t)
|
userdom_dontaudit_use_unpriv_user_fds(quota_t)
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -82,3 +92,34 @@ optional_policy(`
|
@@ -82,3 +96,34 @@ optional_policy(`
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
udev_read_db(quota_t)
|
udev_read_db(quota_t)
|
||||||
')
|
')
|
||||||
@ -7904,7 +7921,7 @@ index 0bac996..ca2388d 100644
|
|||||||
+userdom_use_inherited_user_terminals(lockdev_t)
|
+userdom_use_inherited_user_terminals(lockdev_t)
|
||||||
|
|
||||||
diff --git a/policy/modules/apps/mozilla.fc b/policy/modules/apps/mozilla.fc
|
diff --git a/policy/modules/apps/mozilla.fc b/policy/modules/apps/mozilla.fc
|
||||||
index 93ac529..800b5c8 100644
|
index 93ac529..4c0895e 100644
|
||||||
--- a/policy/modules/apps/mozilla.fc
|
--- a/policy/modules/apps/mozilla.fc
|
||||||
+++ b/policy/modules/apps/mozilla.fc
|
+++ b/policy/modules/apps/mozilla.fc
|
||||||
@@ -1,8 +1,14 @@
|
@@ -1,8 +1,14 @@
|
||||||
@ -7922,13 +7939,15 @@ index 93ac529..800b5c8 100644
|
|||||||
|
|
||||||
#
|
#
|
||||||
# /bin
|
# /bin
|
||||||
@@ -14,16 +20,24 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
|
@@ -14,16 +20,28 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
|
||||||
/usr/bin/epiphany -- gen_context(system_u:object_r:mozilla_exec_t,s0)
|
/usr/bin/epiphany -- gen_context(system_u:object_r:mozilla_exec_t,s0)
|
||||||
/usr/bin/mozilla-[0-9].* -- gen_context(system_u:object_r:mozilla_exec_t,s0)
|
/usr/bin/mozilla-[0-9].* -- gen_context(system_u:object_r:mozilla_exec_t,s0)
|
||||||
/usr/bin/mozilla-bin-[0-9].* -- gen_context(system_u:object_r:mozilla_exec_t,s0)
|
/usr/bin/mozilla-bin-[0-9].* -- gen_context(system_u:object_r:mozilla_exec_t,s0)
|
||||||
|
+ifdef(`distro_redhat',`
|
||||||
+/usr/bin/nspluginscan -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
|
+/usr/bin/nspluginscan -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
|
||||||
+/usr/bin/nspluginviewer -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
|
+/usr/bin/nspluginviewer -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
|
||||||
+/usr/lib/nspluginwrapper/npviewer.bin -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
|
+/usr/lib/nspluginwrapper/npviewer.bin -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
|
||||||
|
+')
|
||||||
|
|
||||||
#
|
#
|
||||||
# /lib
|
# /lib
|
||||||
@ -7955,7 +7974,9 @@ index 93ac529..800b5c8 100644
|
|||||||
+
|
+
|
||||||
+/usr/lib/mozilla/plugins-wrapped(/.*)? gen_context(system_u:object_r:mozilla_plugin_rw_t,s0)
|
+/usr/lib/mozilla/plugins-wrapped(/.*)? gen_context(system_u:object_r:mozilla_plugin_rw_t,s0)
|
||||||
+
|
+
|
||||||
|
+ifdef(`distro_redhat',`
|
||||||
+/usr/lib/nspluginwrapper/plugin-config -- gen_context(system_u:object_r:mozilla_plugin_config_exec_t,s0)
|
+/usr/lib/nspluginwrapper/plugin-config -- gen_context(system_u:object_r:mozilla_plugin_config_exec_t,s0)
|
||||||
|
+')
|
||||||
diff --git a/policy/modules/apps/mozilla.if b/policy/modules/apps/mozilla.if
|
diff --git a/policy/modules/apps/mozilla.if b/policy/modules/apps/mozilla.if
|
||||||
index fbb5c5a..ffeec16 100644
|
index fbb5c5a..ffeec16 100644
|
||||||
--- a/policy/modules/apps/mozilla.if
|
--- a/policy/modules/apps/mozilla.if
|
||||||
@ -8176,15 +8197,12 @@ index fbb5c5a..ffeec16 100644
|
|||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
|
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
|
||||||
index 2e9318b..bb90a3b 100644
|
index 2e9318b..04159de 100644
|
||||||
--- a/policy/modules/apps/mozilla.te
|
--- a/policy/modules/apps/mozilla.te
|
||||||
+++ b/policy/modules/apps/mozilla.te
|
+++ b/policy/modules/apps/mozilla.te
|
||||||
@@ -23,8 +23,9 @@ type mozilla_conf_t;
|
@@ -25,6 +25,7 @@ files_config_file(mozilla_conf_t)
|
||||||
files_config_file(mozilla_conf_t)
|
|
||||||
|
|
||||||
type mozilla_home_t;
|
type mozilla_home_t;
|
||||||
-typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t };
|
typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t };
|
||||||
+typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t nsplugin_home_t };
|
|
||||||
typealias mozilla_home_t alias { auditadm_mozilla_home_t secadm_mozilla_home_t };
|
typealias mozilla_home_t alias { auditadm_mozilla_home_t secadm_mozilla_home_t };
|
||||||
+files_poly_member(mozilla_home_t)
|
+files_poly_member(mozilla_home_t)
|
||||||
userdom_user_home_content(mozilla_home_t)
|
userdom_user_home_content(mozilla_home_t)
|
||||||
@ -8203,7 +8221,7 @@ index 2e9318b..bb90a3b 100644
|
|||||||
files_tmpfs_file(mozilla_plugin_tmpfs_t)
|
files_tmpfs_file(mozilla_plugin_tmpfs_t)
|
||||||
ubac_constrained(mozilla_plugin_tmpfs_t)
|
ubac_constrained(mozilla_plugin_tmpfs_t)
|
||||||
|
|
||||||
+type mozilla_plugin_rw_t alias nsplugin_rw_t;
|
+type mozilla_plugin_rw_t;
|
||||||
+files_type(mozilla_plugin_rw_t)
|
+files_type(mozilla_plugin_rw_t)
|
||||||
+
|
+
|
||||||
+type mozilla_plugin_config_t;
|
+type mozilla_plugin_config_t;
|
||||||
@ -8421,7 +8439,7 @@ index 2e9318b..bb90a3b 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -438,18 +460,88 @@ optional_policy(`
|
@@ -438,18 +460,97 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -8513,6 +8531,15 @@ index 2e9318b..bb90a3b 100644
|
|||||||
+
|
+
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
+ xserver_use_user_fonts(mozilla_plugin_config_t)
|
+ xserver_use_user_fonts(mozilla_plugin_config_t)
|
||||||
|
+')
|
||||||
|
+ifdef(`distro_redhat',`
|
||||||
|
+ typealias mozilla_plugin_t alias nsplugin_t;
|
||||||
|
+ typealias mozilla_plugin_exec_t alias nsplugin_exec_t;
|
||||||
|
+ typealias mozilla_plugin_rw_t alias nsplugin_rw_t;
|
||||||
|
+ typealias mozilla_plugin_tmp_t alias nsplugin_tmp_t;
|
||||||
|
+ typealias mozilla_home_t alias nsplugin_home_t;
|
||||||
|
+ typealias mozilla_plugin_config_t alias nsplugin_config_t;
|
||||||
|
+ typealias mozilla_plugin_config_exec_t alias nsplugin_config_exec_t;
|
||||||
')
|
')
|
||||||
diff --git a/policy/modules/apps/mplayer.if b/policy/modules/apps/mplayer.if
|
diff --git a/policy/modules/apps/mplayer.if b/policy/modules/apps/mplayer.if
|
||||||
index d8ea41d..8bdc526 100644
|
index d8ea41d..8bdc526 100644
|
||||||
@ -14858,7 +14885,7 @@ index 6cf8784..2354089 100644
|
|||||||
+/usr/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0)
|
+/usr/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0)
|
||||||
+/usr/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0)
|
+/usr/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0)
|
||||||
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
|
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
|
||||||
index f820f3b..cc3f02e 100644
|
index f820f3b..1082bb5 100644
|
||||||
--- a/policy/modules/kernel/devices.if
|
--- a/policy/modules/kernel/devices.if
|
||||||
+++ b/policy/modules/kernel/devices.if
|
+++ b/policy/modules/kernel/devices.if
|
||||||
@@ -146,14 +146,33 @@ interface(`dev_relabel_all_dev_nodes',`
|
@@ -146,14 +146,33 @@ interface(`dev_relabel_all_dev_nodes',`
|
||||||
@ -15542,7 +15569,7 @@ index f820f3b..cc3f02e 100644
|
|||||||
## Read and write to the zero device (/dev/zero).
|
## Read and write to the zero device (/dev/zero).
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -4784,3 +5174,812 @@ interface(`dev_unconfined',`
|
@@ -4784,3 +5174,822 @@ interface(`dev_unconfined',`
|
||||||
|
|
||||||
typeattribute $1 devices_unconfined_type;
|
typeattribute $1 devices_unconfined_type;
|
||||||
')
|
')
|
||||||
@ -16271,6 +16298,16 @@ index f820f3b..cc3f02e 100644
|
|||||||
+ filetrans_pattern($1, device_t, xen_device_t, chr_file, "blktap9")
|
+ filetrans_pattern($1, device_t, xen_device_t, chr_file, "blktap9")
|
||||||
+ filetrans_pattern($1, device_t, xen_device_t, chr_file, "gntdev")
|
+ filetrans_pattern($1, device_t, xen_device_t, chr_file, "gntdev")
|
||||||
+ filetrans_pattern($1, device_t, xen_device_t, chr_file, "gntalloc")
|
+ filetrans_pattern($1, device_t, xen_device_t, chr_file, "gntalloc")
|
||||||
|
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC0")
|
||||||
|
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC1")
|
||||||
|
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC2")
|
||||||
|
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC3")
|
||||||
|
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC4")
|
||||||
|
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC5")
|
||||||
|
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC6")
|
||||||
|
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC7")
|
||||||
|
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC8")
|
||||||
|
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC9")
|
||||||
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "patmgr0")
|
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "patmgr0")
|
||||||
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "patmgr1")
|
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "patmgr1")
|
||||||
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "srnd0")
|
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "srnd0")
|
||||||
@ -16356,10 +16393,18 @@ index f820f3b..cc3f02e 100644
|
|||||||
+ filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card9")
|
+ filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card9")
|
||||||
+')
|
+')
|
||||||
diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
|
diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
|
||||||
index 08f01e7..8f727be 100644
|
index 08f01e7..d8c1d48 100644
|
||||||
--- a/policy/modules/kernel/devices.te
|
--- a/policy/modules/kernel/devices.te
|
||||||
+++ b/policy/modules/kernel/devices.te
|
+++ b/policy/modules/kernel/devices.te
|
||||||
@@ -108,6 +108,7 @@ dev_node(ksm_device_t)
|
@@ -20,6 +20,7 @@ files_mountpoint(device_t)
|
||||||
|
files_associate_tmp(device_t)
|
||||||
|
fs_type(device_t)
|
||||||
|
fs_use_trans devtmpfs gen_context(system_u:object_r:device_t,s0);
|
||||||
|
+dev_node(device_t)
|
||||||
|
|
||||||
|
#
|
||||||
|
# Type for /dev/agpgart
|
||||||
|
@@ -108,6 +109,7 @@ dev_node(ksm_device_t)
|
||||||
#
|
#
|
||||||
type kvm_device_t;
|
type kvm_device_t;
|
||||||
dev_node(kvm_device_t)
|
dev_node(kvm_device_t)
|
||||||
@ -16367,7 +16412,7 @@ index 08f01e7..8f727be 100644
|
|||||||
|
|
||||||
#
|
#
|
||||||
# Type for /dev/lirc
|
# Type for /dev/lirc
|
||||||
@@ -118,6 +119,12 @@ dev_node(lirc_device_t)
|
@@ -118,6 +120,12 @@ dev_node(lirc_device_t)
|
||||||
#
|
#
|
||||||
# Type for /dev/mapper/control
|
# Type for /dev/mapper/control
|
||||||
#
|
#
|
||||||
@ -16380,7 +16425,7 @@ index 08f01e7..8f727be 100644
|
|||||||
type lvm_control_t;
|
type lvm_control_t;
|
||||||
dev_node(lvm_control_t)
|
dev_node(lvm_control_t)
|
||||||
|
|
||||||
@@ -218,6 +225,10 @@ files_mountpoint(sysfs_t)
|
@@ -218,6 +226,10 @@ files_mountpoint(sysfs_t)
|
||||||
fs_type(sysfs_t)
|
fs_type(sysfs_t)
|
||||||
genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0)
|
genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0)
|
||||||
|
|
||||||
@ -16391,7 +16436,7 @@ index 08f01e7..8f727be 100644
|
|||||||
#
|
#
|
||||||
# Type for /dev/tpm
|
# Type for /dev/tpm
|
||||||
#
|
#
|
||||||
@@ -265,6 +276,7 @@ dev_node(v4l_device_t)
|
@@ -265,6 +277,7 @@ dev_node(v4l_device_t)
|
||||||
#
|
#
|
||||||
type vhost_device_t;
|
type vhost_device_t;
|
||||||
dev_node(vhost_device_t)
|
dev_node(vhost_device_t)
|
||||||
@ -16399,7 +16444,7 @@ index 08f01e7..8f727be 100644
|
|||||||
|
|
||||||
# Type for vmware devices.
|
# Type for vmware devices.
|
||||||
type vmware_device_t;
|
type vmware_device_t;
|
||||||
@@ -310,5 +322,5 @@ files_associate_tmp(device_node)
|
@@ -310,5 +323,5 @@ files_associate_tmp(device_node)
|
||||||
#
|
#
|
||||||
|
|
||||||
allow devices_unconfined_type self:capability sys_rawio;
|
allow devices_unconfined_type self:capability sys_rawio;
|
||||||
@ -19523,7 +19568,7 @@ index 7be4ddf..f7021a0 100644
|
|||||||
+
|
+
|
||||||
+/sys/class/net/ib.* gen_context(system_u:object_r:sysctl_net_t,s0)
|
+/sys/class/net/ib.* gen_context(system_u:object_r:sysctl_net_t,s0)
|
||||||
diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
|
diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
|
||||||
index 6346378..34c6897 100644
|
index 6346378..3bfb1f8 100644
|
||||||
--- a/policy/modules/kernel/kernel.if
|
--- a/policy/modules/kernel/kernel.if
|
||||||
+++ b/policy/modules/kernel/kernel.if
|
+++ b/policy/modules/kernel/kernel.if
|
||||||
@@ -345,13 +345,8 @@ interface(`kernel_load_module',`
|
@@ -345,13 +345,8 @@ interface(`kernel_load_module',`
|
||||||
@ -19540,7 +19585,32 @@ index 6346378..34c6897 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -2072,7 +2067,7 @@ interface(`kernel_dontaudit_list_all_sysctls',`
|
@@ -1464,6 +1459,24 @@ interface(`kernel_dontaudit_list_all_proc',`
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
+## Allow attempts to read all proc types.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`kernel_read_all_proc',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ attribute proc_type;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ read_files_pattern($1, proc_type, proc_type)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
## Do not audit attempts by caller to search
|
||||||
|
## the base directory of sysctls.
|
||||||
|
## </summary>
|
||||||
|
@@ -2072,7 +2085,7 @@ interface(`kernel_dontaudit_list_all_sysctls',`
|
||||||
')
|
')
|
||||||
|
|
||||||
dontaudit $1 sysctl_type:dir list_dir_perms;
|
dontaudit $1 sysctl_type:dir list_dir_perms;
|
||||||
@ -19549,7 +19619,7 @@ index 6346378..34c6897 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -2293,7 +2288,7 @@ interface(`kernel_read_unlabeled_state',`
|
@@ -2293,7 +2306,7 @@ interface(`kernel_read_unlabeled_state',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -19558,7 +19628,7 @@ index 6346378..34c6897 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@@ -2475,6 +2470,24 @@ interface(`kernel_rw_unlabeled_blk_files',`
|
@@ -2475,6 +2488,24 @@ interface(`kernel_rw_unlabeled_blk_files',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -19583,7 +19653,7 @@ index 6346378..34c6897 100644
|
|||||||
## Do not audit attempts by caller to get attributes for
|
## Do not audit attempts by caller to get attributes for
|
||||||
## unlabeled character devices.
|
## unlabeled character devices.
|
||||||
## </summary>
|
## </summary>
|
||||||
@@ -2619,7 +2632,7 @@ interface(`kernel_sendrecv_unlabeled_association',`
|
@@ -2619,7 +2650,7 @@ interface(`kernel_sendrecv_unlabeled_association',`
|
||||||
allow $1 unlabeled_t:association { sendto recvfrom };
|
allow $1 unlabeled_t:association { sendto recvfrom };
|
||||||
|
|
||||||
# temporary hack until labeling on packets is supported
|
# temporary hack until labeling on packets is supported
|
||||||
@ -19592,7 +19662,7 @@ index 6346378..34c6897 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -2657,6 +2670,24 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',`
|
@@ -2657,6 +2688,24 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -19617,7 +19687,7 @@ index 6346378..34c6897 100644
|
|||||||
## Receive TCP packets from an unlabeled connection.
|
## Receive TCP packets from an unlabeled connection.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <desc>
|
## <desc>
|
||||||
@@ -2684,6 +2715,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',`
|
@@ -2684,6 +2733,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -19643,7 +19713,7 @@ index 6346378..34c6897 100644
|
|||||||
## Do not audit attempts to receive TCP packets from an unlabeled
|
## Do not audit attempts to receive TCP packets from an unlabeled
|
||||||
## connection.
|
## connection.
|
||||||
## </summary>
|
## </summary>
|
||||||
@@ -2793,6 +2843,33 @@ interface(`kernel_raw_recvfrom_unlabeled',`
|
@@ -2793,6 +2861,33 @@ interface(`kernel_raw_recvfrom_unlabeled',`
|
||||||
|
|
||||||
allow $1 unlabeled_t:rawip_socket recvfrom;
|
allow $1 unlabeled_t:rawip_socket recvfrom;
|
||||||
')
|
')
|
||||||
@ -19677,7 +19747,7 @@ index 6346378..34c6897 100644
|
|||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -2948,6 +3025,24 @@ interface(`kernel_relabelfrom_unlabeled_database',`
|
@@ -2948,6 +3043,24 @@ interface(`kernel_relabelfrom_unlabeled_database',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -19702,12 +19772,12 @@ index 6346378..34c6897 100644
|
|||||||
## Unconfined access to kernel module resources.
|
## Unconfined access to kernel module resources.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -2962,4 +3057,43 @@ interface(`kernel_unconfined',`
|
@@ -2962,4 +3075,43 @@ interface(`kernel_unconfined',`
|
||||||
')
|
')
|
||||||
|
|
||||||
typeattribute $1 kern_unconfined;
|
typeattribute $1 kern_unconfined;
|
||||||
+ kernel_load_module($1)
|
+ kernel_load_module($1)
|
||||||
')
|
+')
|
||||||
+
|
+
|
||||||
+########################################
|
+########################################
|
||||||
+## <summary>
|
+## <summary>
|
||||||
@ -19744,7 +19814,7 @@ index 6346378..34c6897 100644
|
|||||||
+ ')
|
+ ')
|
||||||
+
|
+
|
||||||
+ typeattribute $1 proc_type;
|
+ typeattribute $1 proc_type;
|
||||||
+')
|
')
|
||||||
+
|
+
|
||||||
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
|
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
|
||||||
index d91c62f..8852535 100644
|
index d91c62f..8852535 100644
|
||||||
@ -54903,16 +54973,18 @@ index 5a9630c..61f0099 100644
|
|||||||
+ allow $1 qpidd_t:shm rw_shm_perms;
|
+ allow $1 qpidd_t:shm rw_shm_perms;
|
||||||
')
|
')
|
||||||
diff --git a/policy/modules/services/qpid.te b/policy/modules/services/qpid.te
|
diff --git a/policy/modules/services/qpid.te b/policy/modules/services/qpid.te
|
||||||
index cb7ecb5..3df1532 100644
|
index cb7ecb5..08d19e6 100644
|
||||||
--- a/policy/modules/services/qpid.te
|
--- a/policy/modules/services/qpid.te
|
||||||
+++ b/policy/modules/services/qpid.te
|
+++ b/policy/modules/services/qpid.te
|
||||||
@@ -12,12 +12,12 @@ init_daemon_domain(qpidd_t, qpidd_exec_t)
|
@@ -12,12 +12,15 @@ init_daemon_domain(qpidd_t, qpidd_exec_t)
|
||||||
type qpidd_initrc_exec_t;
|
type qpidd_initrc_exec_t;
|
||||||
init_script_file(qpidd_initrc_exec_t)
|
init_script_file(qpidd_initrc_exec_t)
|
||||||
|
|
||||||
-type qpidd_var_lib_t;
|
-type qpidd_var_lib_t;
|
||||||
-files_type(qpidd_var_lib_t)
|
-files_type(qpidd_var_lib_t)
|
||||||
-
|
+type qpidd_tmpfs_t;
|
||||||
|
+files_tmpfs_file(qpidd_tmpfs_t)
|
||||||
|
|
||||||
type qpidd_var_run_t;
|
type qpidd_var_run_t;
|
||||||
files_pid_file(qpidd_var_run_t)
|
files_pid_file(qpidd_var_run_t)
|
||||||
|
|
||||||
@ -54922,12 +54994,16 @@ index cb7ecb5..3df1532 100644
|
|||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
# qpidd local policy
|
# qpidd local policy
|
||||||
@@ -30,27 +30,30 @@ allow qpidd_t self:shm create_shm_perms;
|
@@ -30,27 +33,34 @@ allow qpidd_t self:shm create_shm_perms;
|
||||||
allow qpidd_t self:tcp_socket create_stream_socket_perms;
|
allow qpidd_t self:tcp_socket create_stream_socket_perms;
|
||||||
allow qpidd_t self:unix_stream_socket create_stream_socket_perms;
|
allow qpidd_t self:unix_stream_socket create_stream_socket_perms;
|
||||||
|
|
||||||
-manage_dirs_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
|
-manage_dirs_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
|
||||||
-manage_files_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
|
-manage_files_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
|
||||||
|
+manage_dirs_pattern(qpidd_t, qpidd_tmpfs_t, qpidd_tmpfs_t)
|
||||||
|
+manage_files_pattern(qpidd_t, qpidd_tmpfs_t, qpidd_tmpfs_t)
|
||||||
|
+fs_tmpfs_filetrans(qpidd_t, qpidd_tmpfs_t, { dir file })
|
||||||
|
+
|
||||||
+manage_dirs_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
|
+manage_dirs_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
|
||||||
+manage_files_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
|
+manage_files_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
|
||||||
files_var_lib_filetrans(qpidd_t, qpidd_var_lib_t, { file dir })
|
files_var_lib_filetrans(qpidd_t, qpidd_var_lib_t, { file dir })
|
||||||
@ -54958,7 +55034,7 @@ index cb7ecb5..3df1532 100644
|
|||||||
|
|
||||||
logging_send_syslog_msg(qpidd_t)
|
logging_send_syslog_msg(qpidd_t)
|
||||||
|
|
||||||
@@ -61,3 +64,8 @@ sysnet_dns_name_resolve(qpidd_t)
|
@@ -61,3 +71,8 @@ sysnet_dns_name_resolve(qpidd_t)
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
corosync_stream_connect(qpidd_t)
|
corosync_stream_connect(qpidd_t)
|
||||||
')
|
')
|
||||||
@ -60256,7 +60332,7 @@ index 275f9fb..f1343b7 100644
|
|||||||
init_labeled_script_domtrans($1, snmpd_initrc_exec_t)
|
init_labeled_script_domtrans($1, snmpd_initrc_exec_t)
|
||||||
domain_system_change_exemption($1)
|
domain_system_change_exemption($1)
|
||||||
diff --git a/policy/modules/services/snmp.te b/policy/modules/services/snmp.te
|
diff --git a/policy/modules/services/snmp.te b/policy/modules/services/snmp.te
|
||||||
index 3d8d1b3..9c747d4 100644
|
index 3d8d1b3..1d22eed 100644
|
||||||
--- a/policy/modules/services/snmp.te
|
--- a/policy/modules/services/snmp.te
|
||||||
+++ b/policy/modules/services/snmp.te
|
+++ b/policy/modules/services/snmp.te
|
||||||
@@ -4,6 +4,7 @@ policy_module(snmp, 1.11.0)
|
@@ -4,6 +4,7 @@ policy_module(snmp, 1.11.0)
|
||||||
@ -60284,7 +60360,7 @@ index 3d8d1b3..9c747d4 100644
|
|||||||
allow snmpd_t self:tcp_socket create_stream_socket_perms;
|
allow snmpd_t self:tcp_socket create_stream_socket_perms;
|
||||||
allow snmpd_t self:udp_socket connected_stream_socket_perms;
|
allow snmpd_t self:udp_socket connected_stream_socket_perms;
|
||||||
|
|
||||||
@@ -41,10 +44,11 @@ manage_files_pattern(snmpd_t, snmpd_var_lib_t, snmpd_var_lib_t)
|
@@ -41,18 +44,18 @@ manage_files_pattern(snmpd_t, snmpd_var_lib_t, snmpd_var_lib_t)
|
||||||
manage_sock_files_pattern(snmpd_t, snmpd_var_lib_t, snmpd_var_lib_t)
|
manage_sock_files_pattern(snmpd_t, snmpd_var_lib_t, snmpd_var_lib_t)
|
||||||
files_usr_filetrans(snmpd_t, snmpd_var_lib_t, file)
|
files_usr_filetrans(snmpd_t, snmpd_var_lib_t, file)
|
||||||
files_var_filetrans(snmpd_t, snmpd_var_lib_t, { file dir sock_file })
|
files_var_filetrans(snmpd_t, snmpd_var_lib_t, { file dir sock_file })
|
||||||
@ -60298,7 +60374,16 @@ index 3d8d1b3..9c747d4 100644
|
|||||||
|
|
||||||
kernel_read_device_sysctls(snmpd_t)
|
kernel_read_device_sysctls(snmpd_t)
|
||||||
kernel_read_kernel_sysctls(snmpd_t)
|
kernel_read_kernel_sysctls(snmpd_t)
|
||||||
@@ -94,15 +98,19 @@ files_search_home(snmpd_t)
|
kernel_read_fs_sysctls(snmpd_t)
|
||||||
|
kernel_read_net_sysctls(snmpd_t)
|
||||||
|
kernel_read_proc_symlinks(snmpd_t)
|
||||||
|
-kernel_read_system_state(snmpd_t)
|
||||||
|
-kernel_read_network_state(snmpd_t)
|
||||||
|
+kernel_read_all_proc(snmpd_t)
|
||||||
|
|
||||||
|
corecmd_exec_bin(snmpd_t)
|
||||||
|
corecmd_exec_shell(snmpd_t)
|
||||||
|
@@ -94,15 +97,19 @@ files_search_home(snmpd_t)
|
||||||
fs_getattr_all_dirs(snmpd_t)
|
fs_getattr_all_dirs(snmpd_t)
|
||||||
fs_getattr_all_fs(snmpd_t)
|
fs_getattr_all_fs(snmpd_t)
|
||||||
fs_search_auto_mountpoints(snmpd_t)
|
fs_search_auto_mountpoints(snmpd_t)
|
||||||
@ -60319,7 +60404,7 @@ index 3d8d1b3..9c747d4 100644
|
|||||||
|
|
||||||
logging_send_syslog_msg(snmpd_t)
|
logging_send_syslog_msg(snmpd_t)
|
||||||
|
|
||||||
@@ -115,7 +123,7 @@ sysnet_read_config(snmpd_t)
|
@@ -115,7 +122,7 @@ sysnet_read_config(snmpd_t)
|
||||||
userdom_dontaudit_use_unpriv_user_fds(snmpd_t)
|
userdom_dontaudit_use_unpriv_user_fds(snmpd_t)
|
||||||
userdom_dontaudit_search_user_home_dirs(snmpd_t)
|
userdom_dontaudit_search_user_home_dirs(snmpd_t)
|
||||||
|
|
||||||
@ -62424,7 +62509,7 @@ index 941380a..4afc698 100644
|
|||||||
# Allow sssd_t to restart the apache service
|
# Allow sssd_t to restart the apache service
|
||||||
sssd_initrc_domtrans($1)
|
sssd_initrc_domtrans($1)
|
||||||
diff --git a/policy/modules/services/sssd.te b/policy/modules/services/sssd.te
|
diff --git a/policy/modules/services/sssd.te b/policy/modules/services/sssd.te
|
||||||
index 8ffa257..eb8979d 100644
|
index 8ffa257..b698994 100644
|
||||||
--- a/policy/modules/services/sssd.te
|
--- a/policy/modules/services/sssd.te
|
||||||
+++ b/policy/modules/services/sssd.te
|
+++ b/policy/modules/services/sssd.te
|
||||||
@@ -17,6 +17,7 @@ files_pid_file(sssd_public_t)
|
@@ -17,6 +17,7 @@ files_pid_file(sssd_public_t)
|
||||||
@ -62441,7 +62526,7 @@ index 8ffa257..eb8979d 100644
|
|||||||
#
|
#
|
||||||
-allow sssd_t self:capability { dac_read_search dac_override kill sys_nice setgid setuid };
|
-allow sssd_t self:capability { dac_read_search dac_override kill sys_nice setgid setuid };
|
||||||
+
|
+
|
||||||
+allow sssd_t self:capability { chown dac_read_search dac_override kill net_admin sys_nice setgid setuid };
|
+allow sssd_t self:capability { chown dac_read_search dac_override kill net_admin sys_nice setgid setuid sys_admin };
|
||||||
allow sssd_t self:process { setfscreate setsched sigkill signal getsched };
|
allow sssd_t self:process { setfscreate setsched sigkill signal getsched };
|
||||||
-allow sssd_t self:fifo_file rw_file_perms;
|
-allow sssd_t self:fifo_file rw_file_perms;
|
||||||
+allow sssd_t self:fifo_file rw_fifo_file_perms;
|
+allow sssd_t self:fifo_file rw_fifo_file_perms;
|
||||||
|
@ -16,7 +16,7 @@
|
|||||||
Summary: SELinux policy configuration
|
Summary: SELinux policy configuration
|
||||||
Name: selinux-policy
|
Name: selinux-policy
|
||||||
Version: 3.10.0
|
Version: 3.10.0
|
||||||
Release: 70%{?dist}
|
Release: 71%{?dist}
|
||||||
License: GPLv2+
|
License: GPLv2+
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
Source: serefpolicy-%{version}.tgz
|
Source: serefpolicy-%{version}.tgz
|
||||||
@ -471,6 +471,13 @@ SELinux Reference policy mls base module.
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Tue Dec 20 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-71
|
||||||
|
- default trans rules for Rawhide policy
|
||||||
|
- Make sure sound_devices controlC* are labeled correctly on creation
|
||||||
|
- sssd now needs sys_admin
|
||||||
|
- Allow snmp to read all proc_type
|
||||||
|
- Allow to setup users homedir with quota.group
|
||||||
|
|
||||||
* Mon Dec 19 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-70
|
* Mon Dec 19 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-70
|
||||||
- Add httpd_can_connect_ldap() interface
|
- Add httpd_can_connect_ldap() interface
|
||||||
- apcupsd_t needs to use seriel ports connected to usb devices
|
- apcupsd_t needs to use seriel ports connected to usb devices
|
||||||
|
Loading…
Reference in New Issue
Block a user