- Eliminate mount_ntfs_t policy, merge into mount_t
This commit is contained in:
Daniel J Walsh
parent
47a35fa722
commit
6d2e7d5ebb
|
|
@ -710,7 +710,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc
|
|||
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.0.4/policy/modules/admin/rpm.if
|
||||
--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-30 11:47:29.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/admin/rpm.if 2007-07-25 13:27:51.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/admin/rpm.if 2007-07-31 14:04:42.000000000 -0400
|
||||
@@ -210,6 +210,24 @@
|
||||
|
||||
########################################
|
||||
|
|
@ -767,7 +767,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
|
|||
')
|
||||
|
||||
########################################
|
||||
@@ -289,3 +328,65 @@
|
||||
@@ -289,3 +328,84 @@
|
||||
dontaudit $1 rpm_var_lib_t:file manage_file_perms;
|
||||
dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms;
|
||||
')
|
||||
|
|
@ -833,6 +833,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
|
|||
+
|
||||
+ dontaudit $1 rpm_tmp_t:file rw_file_perms;
|
||||
+')
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Do not audit attempts to read,
|
||||
+## write RPM shm
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain to not audit.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+interface(`rpm_dontaudit_rw_shm',`
|
||||
+ gen_require(`
|
||||
+ type rpm_t;
|
||||
+ ')
|
||||
+
|
||||
+ dontaudit $1 rpm_t:shm rw_shm_perms;
|
||||
+')
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.0.4/policy/modules/admin/rpm.te
|
||||
--- nsaserefpolicy/policy/modules/admin/rpm.te 2007-07-25 10:37:43.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/admin/rpm.te 2007-07-25 13:27:51.000000000 -0400
|
||||
|
|
@ -2697,7 +2716,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
|
|||
# etc_runtime_t is the type of various
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.0.4/policy/modules/kernel/filesystem.if
|
||||
--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-07-03 07:05:38.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/kernel/filesystem.if 2007-07-30 10:20:15.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/kernel/filesystem.if 2007-07-31 16:40:44.000000000 -0400
|
||||
@@ -1192,6 +1192,24 @@
|
||||
|
||||
########################################
|
||||
|
|
@ -2723,9 +2742,61 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
|
|||
## Search inotifyfs filesystem.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
@@ -2219,7 +2237,7 @@
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
-#
|
||||
+
|
||||
interface(`fs_dontaudit_read_ramfs_files',`
|
||||
gen_require(`
|
||||
type ramfs_t;
|
||||
@@ -3476,3 +3494,42 @@
|
||||
relabelfrom_blk_files_pattern($1,noxattrfs,noxattrfs)
|
||||
relabelfrom_chr_files_pattern($1,noxattrfs,noxattrfs)
|
||||
')
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Read files of anon_inodefs file system files.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed access.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+interface(`fs_read_anon_inodefs_files',`
|
||||
+ gen_require(`
|
||||
+ type anon_inodefs_t;
|
||||
+
|
||||
+ ')
|
||||
+
|
||||
+ read_files_pattern($1,anon_inodefs_t,anon_inodefs_t)
|
||||
+')
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Read/wrie files of anon_inodefs file system files.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed access.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+interface(`fs_rw_anon_inodefs_files',`
|
||||
+ gen_require(`
|
||||
+ type anon_inodefs_t;
|
||||
+
|
||||
+ ')
|
||||
+
|
||||
+ rw_files_pattern($1,anon_inodefs_t,anon_inodefs_t)
|
||||
+')
|
||||
+
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.0.4/policy/modules/kernel/filesystem.te
|
||||
--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-07-25 10:37:36.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/kernel/filesystem.te 2007-07-25 13:27:51.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/kernel/filesystem.te 2007-07-31 16:40:53.000000000 -0400
|
||||
@@ -43,6 +43,12 @@
|
||||
#
|
||||
# Non-persistent/pseudo filesystems
|
||||
|
|
@ -2749,7 +2820,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
|
|||
# filesystem SID to label inodes in the following filesystem types,
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.4/policy/modules/kernel/kernel.if
|
||||
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-07-03 07:05:38.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/kernel/kernel.if 2007-07-25 14:26:57.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/kernel/kernel.if 2007-07-31 16:22:36.000000000 -0400
|
||||
@@ -108,6 +108,24 @@
|
||||
|
||||
########################################
|
||||
|
|
@ -3354,7 +3425,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
|||
+')
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.0.4/policy/modules/services/apache.te
|
||||
--- nsaserefpolicy/policy/modules/services/apache.te 2007-07-25 10:37:42.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/services/apache.te 2007-07-26 13:46:18.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/services/apache.te 2007-07-31 16:48:18.000000000 -0400
|
||||
@@ -30,6 +30,13 @@
|
||||
|
||||
## <desc>
|
||||
|
|
@ -3470,22 +3541,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
|||
|
||||
libs_use_ld_so(httpd_t)
|
||||
libs_use_shared_libs(httpd_t)
|
||||
@@ -348,7 +396,13 @@
|
||||
@@ -348,7 +396,9 @@
|
||||
|
||||
userdom_use_unpriv_users_fds(httpd_t)
|
||||
|
||||
-mta_send_mail(httpd_t)
|
||||
+optional_policy(`
|
||||
+ nscd_socket_use(httpd_t)
|
||||
+')
|
||||
+
|
||||
+tunable_policy(`httpd_enable_homedirs',`
|
||||
+ userdom_search_generic_user_home_dirs(httpd_t)
|
||||
+')
|
||||
|
||||
tunable_policy(`allow_httpd_anon_write',`
|
||||
miscfiles_manage_public_files(httpd_t)
|
||||
@@ -360,6 +414,7 @@
|
||||
@@ -360,6 +410,7 @@
|
||||
#
|
||||
tunable_policy(`allow_httpd_mod_auth_pam',`
|
||||
auth_domtrans_chk_passwd(httpd_t)
|
||||
|
|
@ -3493,7 +3560,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
|||
')
|
||||
')
|
||||
|
||||
@@ -367,6 +422,16 @@
|
||||
@@ -367,6 +418,16 @@
|
||||
corenet_tcp_connect_all_ports(httpd_t)
|
||||
')
|
||||
|
||||
|
|
@ -3510,7 +3577,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
|||
tunable_policy(`httpd_can_network_connect_db',`
|
||||
# allow httpd to connect to mysql/posgresql
|
||||
corenet_tcp_connect_postgresql_port(httpd_t)
|
||||
@@ -387,6 +452,17 @@
|
||||
@@ -387,6 +448,17 @@
|
||||
corenet_sendrecv_http_cache_client_packets(httpd_t)
|
||||
')
|
||||
|
||||
|
|
@ -3528,7 +3595,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
|||
tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',`
|
||||
domtrans_pattern(httpd_t, httpdcontent, httpd_sys_script_t)
|
||||
|
||||
@@ -404,11 +480,21 @@
|
||||
@@ -404,11 +476,21 @@
|
||||
fs_read_nfs_symlinks(httpd_t)
|
||||
')
|
||||
|
||||
|
|
@ -3550,7 +3617,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
|||
tunable_policy(`httpd_ssi_exec',`
|
||||
corecmd_shell_domtrans(httpd_t,httpd_sys_script_t)
|
||||
allow httpd_sys_script_t httpd_t:fd use;
|
||||
@@ -430,6 +516,12 @@
|
||||
@@ -430,6 +512,12 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
|
|
@ -3563,7 +3630,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
|||
calamaris_read_www_files(httpd_t)
|
||||
')
|
||||
|
||||
@@ -512,10 +604,16 @@
|
||||
@@ -512,10 +600,16 @@
|
||||
tunable_policy(`httpd_tty_comm',`
|
||||
# cjp: this is redundant:
|
||||
term_use_controlling_term(httpd_helper_t)
|
||||
|
|
@ -3581,7 +3648,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
|||
########################################
|
||||
#
|
||||
# Apache PHP script local policy
|
||||
@@ -606,6 +704,10 @@
|
||||
@@ -567,7 +661,6 @@
|
||||
allow httpd_suexec_t self:capability { setuid setgid };
|
||||
allow httpd_suexec_t self:process signal_perms;
|
||||
allow httpd_suexec_t self:unix_stream_socket create_stream_socket_perms;
|
||||
-allow httpd_suexec_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
|
||||
domtrans_pattern(httpd_t, httpd_suexec_exec_t, httpd_suexec_t)
|
||||
|
||||
@@ -581,6 +674,8 @@
|
||||
manage_files_pattern(httpd_suexec_t,httpd_suexec_tmp_t,httpd_suexec_tmp_t)
|
||||
files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir })
|
||||
|
||||
+auth_use_nsswitch(httpd_suexec_t)
|
||||
+
|
||||
kernel_read_kernel_sysctls(httpd_suexec_t)
|
||||
kernel_list_proc(httpd_suexec_t)
|
||||
kernel_read_proc_symlinks(httpd_suexec_t)
|
||||
@@ -606,6 +701,10 @@
|
||||
|
||||
miscfiles_read_localization(httpd_suexec_t)
|
||||
|
||||
|
|
@ -3592,7 +3676,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
|||
tunable_policy(`httpd_can_network_connect',`
|
||||
allow httpd_suexec_t self:tcp_socket create_stream_socket_perms;
|
||||
allow httpd_suexec_t self:udp_socket create_socket_perms;
|
||||
@@ -620,10 +722,13 @@
|
||||
@@ -620,10 +719,13 @@
|
||||
corenet_udp_sendrecv_all_ports(httpd_suexec_t)
|
||||
corenet_tcp_connect_all_ports(httpd_suexec_t)
|
||||
corenet_sendrecv_all_client_packets(httpd_suexec_t)
|
||||
|
|
@ -3607,7 +3691,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
|||
tunable_policy(`httpd_enable_cgi && httpd_unified',`
|
||||
domtrans_pattern(httpd_suexec_t, httpdcontent, httpd_sys_script_t)
|
||||
')
|
||||
@@ -634,6 +739,12 @@
|
||||
@@ -634,6 +736,12 @@
|
||||
fs_exec_nfs_files(httpd_suexec_t)
|
||||
')
|
||||
|
||||
|
|
@ -3620,7 +3704,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
|||
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
|
||||
fs_read_cifs_files(httpd_suexec_t)
|
||||
fs_read_cifs_symlinks(httpd_suexec_t)
|
||||
@@ -672,7 +783,8 @@
|
||||
@@ -655,14 +763,6 @@
|
||||
nagios_domtrans_cgi(httpd_suexec_t)
|
||||
')
|
||||
|
||||
-optional_policy(`
|
||||
- nis_use_ypbind(httpd_suexec_t)
|
||||
-')
|
||||
-
|
||||
-optional_policy(`
|
||||
- nscd_socket_use(httpd_suexec_t)
|
||||
-')
|
||||
-
|
||||
########################################
|
||||
#
|
||||
# Apache system script local policy
|
||||
@@ -672,7 +772,8 @@
|
||||
|
||||
dontaudit httpd_sys_script_t httpd_config_t:dir search;
|
||||
|
||||
|
|
@ -3630,7 +3729,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
|||
|
||||
allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms;
|
||||
read_files_pattern(httpd_sys_script_t,squirrelmail_spool_t,squirrelmail_spool_t)
|
||||
@@ -686,15 +798,66 @@
|
||||
@@ -686,15 +787,66 @@
|
||||
# Should we add a boolean?
|
||||
apache_domtrans_rotatelogs(httpd_sys_script_t)
|
||||
|
||||
|
|
@ -3646,15 +3745,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
|||
+')
|
||||
+
|
||||
+tunable_policy(`httpd_use_nfs', `
|
||||
+ fs_read_nfs_files(httpd_sys_script_t)
|
||||
+ fs_read_nfs_symlinks(httpd_sys_script_t)
|
||||
+')
|
||||
+
|
||||
+tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs', `
|
||||
fs_read_nfs_files(httpd_sys_script_t)
|
||||
fs_read_nfs_symlinks(httpd_sys_script_t)
|
||||
')
|
||||
|
||||
+tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs', `
|
||||
+ fs_read_nfs_files(httpd_sys_script_t)
|
||||
+ fs_read_nfs_symlinks(httpd_sys_script_t)
|
||||
+')
|
||||
+
|
||||
+tunable_policy(`httpd_enable_cgi && httpd_can_network_connect_db',`
|
||||
+ allow httpd_sys_script_t self:tcp_socket create_stream_socket_perms;
|
||||
+ allow httpd_sys_script_t self:udp_socket create_socket_perms;
|
||||
|
|
@ -3698,7 +3797,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
|||
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
|
||||
fs_read_cifs_files(httpd_sys_script_t)
|
||||
fs_read_cifs_symlinks(httpd_sys_script_t)
|
||||
@@ -711,6 +874,19 @@
|
||||
@@ -711,6 +863,19 @@
|
||||
|
||||
########################################
|
||||
#
|
||||
|
|
@ -3718,7 +3817,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
|||
# httpd_rotatelogs local policy
|
||||
#
|
||||
|
||||
@@ -728,3 +904,26 @@
|
||||
@@ -728,3 +893,26 @@
|
||||
logging_search_logs(httpd_rotatelogs_t)
|
||||
|
||||
miscfiles_read_localization(httpd_rotatelogs_t)
|
||||
|
|
@ -3795,7 +3894,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
|
|||
+')
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.0.4/policy/modules/services/apcupsd.te
|
||||
--- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-07-25 10:37:42.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/services/apcupsd.te 2007-07-30 11:42:36.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/services/apcupsd.te 2007-07-31 14:08:18.000000000 -0400
|
||||
@@ -16,6 +16,9 @@
|
||||
type apcupsd_log_t;
|
||||
logging_log_file(apcupsd_log_t)
|
||||
|
|
@ -3844,7 +3943,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu
|
|||
files_search_locks(apcupsd_t)
|
||||
+# Creates /etc/nologin
|
||||
+files_manage_etc_runtime_files(apcupsd_t)
|
||||
+files_etc_filetrans_etc_runtime(apcuspd_t,file)
|
||||
+files_etc_filetrans_etc_runtime(apcupsd_t,file)
|
||||
+
|
||||
+#apcupsd runs shutdown, probably need a shutdown domain
|
||||
+init_rw_utmp(apcupsd_t)
|
||||
|
|
@ -4572,7 +4671,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
|
|||
+/usr/local/Brother/inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.4/policy/modules/services/cups.te
|
||||
--- nsaserefpolicy/policy/modules/services/cups.te 2007-07-25 10:37:42.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/services/cups.te 2007-07-31 12:58:26.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/services/cups.te 2007-07-31 16:41:22.000000000 -0400
|
||||
@@ -81,12 +81,11 @@
|
||||
# /usr/lib/cups/backend/serial needs sys_admin(?!)
|
||||
allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_resource sys_tty_config };
|
||||
|
|
@ -4596,7 +4695,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
|
|||
allow cupsd_t cupsd_exec_t:lnk_file read;
|
||||
|
||||
manage_files_pattern(cupsd_t,cupsd_log_t,cupsd_log_t)
|
||||
@@ -150,14 +149,17 @@
|
||||
@@ -150,20 +149,24 @@
|
||||
corenet_tcp_bind_reserved_port(cupsd_t)
|
||||
corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t)
|
||||
corenet_tcp_connect_all_ports(cupsd_t)
|
||||
|
|
@ -4615,7 +4714,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
|
|||
dev_getattr_printer_dev(cupsd_t)
|
||||
|
||||
domain_read_all_domains_state(cupsd_t)
|
||||
@@ -176,6 +178,7 @@
|
||||
|
||||
fs_getattr_all_fs(cupsd_t)
|
||||
fs_search_auto_mountpoints(cupsd_t)
|
||||
+fs_read_anon_inodefs_files(cupsd_t)
|
||||
|
||||
mls_fd_use_all_levels(cupsd_t)
|
||||
mls_file_downgrade(cupsd_t)
|
||||
@@ -176,6 +179,7 @@
|
||||
term_search_ptys(cupsd_t)
|
||||
|
||||
auth_domtrans_chk_passwd(cupsd_t)
|
||||
|
|
@ -4623,7 +4729,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
|
|||
auth_dontaudit_read_pam_pid(cupsd_t)
|
||||
|
||||
# Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp
|
||||
@@ -189,7 +192,7 @@
|
||||
@@ -189,7 +193,7 @@
|
||||
# read python modules
|
||||
files_read_usr_files(cupsd_t)
|
||||
# for /var/lib/defoma
|
||||
|
|
@ -4632,7 +4738,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
|
|||
files_list_world_readable(cupsd_t)
|
||||
files_read_world_readable_files(cupsd_t)
|
||||
files_read_world_readable_symlinks(cupsd_t)
|
||||
@@ -223,21 +226,45 @@
|
||||
@@ -223,21 +227,45 @@
|
||||
|
||||
sysnet_read_config(cupsd_t)
|
||||
|
||||
|
|
@ -4678,7 +4784,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
|
|||
cron_system_entry(cupsd_t, cupsd_exec_t)
|
||||
')
|
||||
|
||||
@@ -250,6 +277,10 @@
|
||||
@@ -250,6 +278,10 @@
|
||||
optional_policy(`
|
||||
hal_dbus_chat(cupsd_t)
|
||||
')
|
||||
|
|
@ -4689,7 +4795,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
|
|||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -265,16 +296,16 @@
|
||||
@@ -265,16 +297,16 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
|
|
@ -4710,7 +4816,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
|
|||
seutil_sigchld_newrole(cupsd_t)
|
||||
')
|
||||
|
||||
@@ -379,6 +410,14 @@
|
||||
@@ -379,6 +411,14 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
|
|
@ -4725,7 +4831,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
|
|||
cron_system_entry(cupsd_config_t, cupsd_config_exec_t)
|
||||
')
|
||||
|
||||
@@ -562,7 +601,7 @@
|
||||
@@ -562,7 +602,7 @@
|
||||
dev_read_urand(hplip_t)
|
||||
dev_read_rand(hplip_t)
|
||||
dev_rw_generic_usb_dev(hplip_t)
|
||||
|
|
@ -4734,7 +4840,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
|
|||
|
||||
fs_getattr_all_fs(hplip_t)
|
||||
fs_search_auto_mountpoints(hplip_t)
|
||||
@@ -589,8 +628,6 @@
|
||||
@@ -589,8 +629,6 @@
|
||||
userdom_dontaudit_search_sysadm_home_dirs(hplip_t)
|
||||
userdom_dontaudit_search_all_users_home_content(hplip_t)
|
||||
|
||||
|
|
@ -6225,7 +6331,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
|
|||
/usr/lib/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.0.4/policy/modules/services/postfix.if
|
||||
--- nsaserefpolicy/policy/modules/services/postfix.if 2007-07-03 07:06:27.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/services/postfix.if 2007-07-25 13:27:51.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/services/postfix.if 2007-07-31 15:40:47.000000000 -0400
|
||||
@@ -41,6 +41,8 @@
|
||||
allow postfix_$1_t self:unix_stream_socket connectto;
|
||||
|
||||
|
|
@ -6235,7 +6341,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
|
|||
|
||||
allow postfix_$1_t postfix_etc_t:dir list_dir_perms;
|
||||
read_files_pattern(postfix_$1_t,postfix_etc_t,postfix_etc_t)
|
||||
@@ -132,10 +134,8 @@
|
||||
@@ -66,6 +68,7 @@
|
||||
|
||||
fs_search_auto_mountpoints(postfix_$1_t)
|
||||
fs_getattr_xattr_fs(postfix_$1_t)
|
||||
+ fs_rw_anon_inodefs_files(postfix_$1_t)
|
||||
|
||||
term_dontaudit_use_console(postfix_$1_t)
|
||||
|
||||
@@ -132,10 +135,8 @@
|
||||
corenet_tcp_connect_all_ports(postfix_$1_t)
|
||||
corenet_sendrecv_all_client_packets(postfix_$1_t)
|
||||
|
||||
|
|
@ -6247,7 +6361,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
|
|||
')
|
||||
')
|
||||
|
||||
@@ -269,6 +269,42 @@
|
||||
@@ -269,6 +270,42 @@
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
|
|
@ -6290,7 +6404,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
|
|||
## Do not audit attempts to use
|
||||
## postfix master process file
|
||||
## file descriptors.
|
||||
@@ -434,6 +470,25 @@
|
||||
@@ -434,6 +471,25 @@
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
|
|
@ -6316,7 +6430,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
|
|||
## Execute postfix user mail programs
|
||||
## in their respective domains.
|
||||
## </summary>
|
||||
@@ -450,3 +505,22 @@
|
||||
@@ -450,3 +506,22 @@
|
||||
|
||||
typeattribute $1 postfix_user_domtrans;
|
||||
')
|
||||
|
|
@ -6677,7 +6791,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.
|
|||
fs_search_auto_mountpoints($1_t)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.4/policy/modules/services/rpc.te
|
||||
--- nsaserefpolicy/policy/modules/services/rpc.te 2007-07-25 10:37:42.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/services/rpc.te 2007-07-30 09:46:58.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/services/rpc.te 2007-07-31 14:16:40.000000000 -0400
|
||||
@@ -59,10 +59,13 @@
|
||||
manage_files_pattern(rpcd_t,rpcd_var_run_t,rpcd_var_run_t)
|
||||
files_pid_filetrans(rpcd_t,rpcd_var_run_t,file)
|
||||
|
|
@ -7135,8 +7249,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr
|
|||
+')
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.4/policy/modules/services/setroubleshoot.te
|
||||
--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-07-25 10:37:42.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/services/setroubleshoot.te 2007-07-25 13:27:51.000000000 -0400
|
||||
@@ -76,6 +76,9 @@
|
||||
+++ serefpolicy-3.0.4/policy/modules/services/setroubleshoot.te 2007-07-31 16:16:14.000000000 -0400
|
||||
@@ -33,7 +33,6 @@
|
||||
allow setroubleshootd_t self:tcp_socket create_stream_socket_perms;
|
||||
allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto };
|
||||
allow setroubleshootd_t self:unix_dgram_socket create_socket_perms;
|
||||
-allow setroubleshootd_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
|
||||
# database files
|
||||
allow setroubleshootd_t setroubleshoot_var_lib_t:dir setattr;
|
||||
@@ -51,6 +50,8 @@
|
||||
manage_sock_files_pattern(setroubleshootd_t,setroubleshoot_var_run_t,setroubleshoot_var_run_t)
|
||||
files_pid_filetrans(setroubleshootd_t,setroubleshoot_var_run_t, { file sock_file })
|
||||
|
||||
+auth_use_nsswitch(setroubleshootd_t)
|
||||
+
|
||||
kernel_read_kernel_sysctls(setroubleshootd_t)
|
||||
kernel_read_system_state(setroubleshootd_t)
|
||||
kernel_read_network_state(setroubleshootd_t)
|
||||
@@ -76,6 +77,9 @@
|
||||
files_getattr_all_dirs(setroubleshootd_t)
|
||||
files_getattr_all_files(setroubleshootd_t)
|
||||
|
||||
|
|
@ -7146,6 +7277,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr
|
|||
selinux_get_enforce_mode(setroubleshootd_t)
|
||||
selinux_validate_context(setroubleshootd_t)
|
||||
|
||||
@@ -108,6 +112,3 @@
|
||||
rpm_use_script_fds(setroubleshootd_t)
|
||||
')
|
||||
|
||||
-optional_policy(`
|
||||
- nis_use_ypbind(setroubleshootd_t)
|
||||
-')
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.0.4/policy/modules/services/smartmon.te
|
||||
--- nsaserefpolicy/policy/modules/services/smartmon.te 2007-07-25 10:37:42.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/services/smartmon.te 2007-07-25 13:27:51.000000000 -0400
|
||||
|
|
@ -10115,7 +10253,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
|
|||
########################################
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.4/policy/modules/system/sysnetwork.te
|
||||
--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-07-25 10:37:42.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/system/sysnetwork.te 2007-07-25 13:27:51.000000000 -0400
|
||||
+++ serefpolicy-3.0.4/policy/modules/system/sysnetwork.te 2007-07-31 16:04:09.000000000 -0400
|
||||
@@ -45,7 +45,7 @@
|
||||
dontaudit dhcpc_t self:capability sys_tty_config;
|
||||
# for access("/etc/bashrc", X_OK) on Red Hat
|
||||
dontaudit dhcpc_t self:capability { dac_read_search sys_module };
|
||||
-allow dhcpc_t self:process signal_perms;
|
||||
+allow dhcpc_t self:process { ptrace signal_perms };
|
||||
allow dhcpc_t self:fifo_file rw_file_perms;
|
||||
allow dhcpc_t self:tcp_socket create_stream_socket_perms;
|
||||
allow dhcpc_t self:udp_socket create_socket_perms;
|
||||
@@ -159,6 +159,10 @@
|
||||
dbus_connect_system_bus(dhcpc_t)
|
||||
dbus_send_system_bus(dhcpc_t)
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@
|
|||
%endif
|
||||
%define POLICYVER 21
|
||||
%define libsepolver 2.0.3-2
|
||||
%define POLICYCOREUTILSVER 2.0.21-1
|
||||
%define POLICYCOREUTILSVER 2.0.22-11
|
||||
%define CHECKPOLICYVER 2.0.3-1
|
||||
Summary: SELinux policy configuration
|
||||
Name: selinux-policy
|
||||
|
|
|
|||
Loading…
Reference in New Issue