rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Add capability setting to dhcpc and gpm

Browse Source
This commit is contained in:
Daniel J Walsh 2009-08-24 13:09:08 +00:00
parent d6f79017f2
commit 7078554d07
1 changed files with 136 additions and 88 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

224
policy-F12.patch
View File

@ -4933,7 +4933,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/dev/usb/mdc800.* -c gen_context(system_u:object_r:scanner_device_t,s0) /dev/usb/mdc800.* -c gen_context(system_u:object_r:scanner_device_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.6.28/policy/modules/kernel/devices.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.6.28/policy/modules/kernel/devices.if
--- nsaserefpolicy/policy/modules/kernel/devices.if 2009-07-14 14:19:57.000000000 -0400 --- nsaserefpolicy/policy/modules/kernel/devices.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/kernel/devices.if 2009-08-21 18:56:07.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/kernel/devices.if 2009-08-24 08:40:29.000000000 -0400
@@ -1655,6 +1655,78 @@ @@ -1655,6 +1655,78 @@
######################################## ########################################
@ -5954,7 +5954,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/dev/shm -d gen_context(system_u:object_r:tmpfs_t,s0) +/dev/shm -d gen_context(system_u:object_r:tmpfs_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.6.28/policy/modules/kernel/filesystem.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.6.28/policy/modules/kernel/filesystem.if
--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2009-07-14 14:19:57.000000000 -0400 --- nsaserefpolicy/policy/modules/kernel/filesystem.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/kernel/filesystem.if 2009-08-21 18:56:07.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/kernel/filesystem.if 2009-08-24 08:48:26.000000000 -0400
@@ -1537,6 +1537,24 @@ @@ -1537,6 +1537,24 @@
######################################## ########################################
@ -5980,10 +5980,28 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Search inotifyfs filesystem. ## Search inotifyfs filesystem.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -2542,6 +2560,24 @@ @@ -2542,6 +2560,42 @@
######################################## ########################################
## <summary> ## <summary>
+## List NFS server directories.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`fs_list_nfsd_fs',`
+ gen_require(`
+ type nfsd_fs_t;
+ ')
+
+ allow $1 nfsd_fs_t:dir list_dir_perms;
+')
+
+########################################
+## <summary>
+## Getattr files on an nfsd filesystem +## Getattr files on an nfsd filesystem
+## </summary> +## </summary>
+## <param name="domain"> +## <param name="domain">
@ -6005,7 +6023,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Read and write NFS server files. ## Read and write NFS server files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -3971,3 +4007,122 @@ @@ -3971,3 +4025,122 @@
relabelfrom_blk_files_pattern($1, noxattrfs, noxattrfs) relabelfrom_blk_files_pattern($1, noxattrfs, noxattrfs)
relabelfrom_chr_files_pattern($1, noxattrfs, noxattrfs) relabelfrom_chr_files_pattern($1, noxattrfs, noxattrfs)
') ')
@ -11930,11 +11948,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpm.te serefpolicy-3.6.28/policy/modules/services/gpm.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpm.te serefpolicy-3.6.28/policy/modules/services/gpm.te
--- nsaserefpolicy/policy/modules/services/gpm.te 2009-08-14 16:14:31.000000000 -0400 --- nsaserefpolicy/policy/modules/services/gpm.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/gpm.te 2009-08-22 09:46:40.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/services/gpm.te 2009-08-24 08:51:22.000000000 -0400
@@ -28,6 +28,7 @@ @@ -27,7 +27,8 @@
# Local policy
# #
allow gpm_t self:capability { setuid dac_override sys_admin sys_tty_config }; -allow gpm_t self:capability { setuid dac_override sys_admin sys_tty_config };
+allow gpm_t self:capability { setpcap setuid dac_override sys_admin sys_tty_config };
+allow gpm_t self:process { getcap setcap }; +allow gpm_t self:process { getcap setcap };
allow gpm_t self:unix_stream_socket create_stream_socket_perms; allow gpm_t self:unix_stream_socket create_stream_socket_perms;
@ -14116,7 +14136,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.if serefpolicy-3.6.28/policy/modules/services/policykit.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.if serefpolicy-3.6.28/policy/modules/services/policykit.if
--- nsaserefpolicy/policy/modules/services/policykit.if 2009-08-18 18:39:50.000000000 -0400 --- nsaserefpolicy/policy/modules/services/policykit.if 2009-08-18 18:39:50.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/policykit.if 2009-08-21 18:56:07.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/services/policykit.if 2009-08-24 08:45:46.000000000 -0400
@@ -17,6 +17,8 @@ @@ -17,6 +17,8 @@
class dbus send_msg; class dbus send_msg;
') ')
@ -14134,7 +14154,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## allow the specified role the policy_auth domain, ## allow the specified role the policy_auth domain,
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -206,4 +207,47 @@ @@ -62,6 +63,9 @@
policykit_domtrans_auth($1)
role $2 types policykit_auth_t;
+
+ allow $1 policykit_auth_t:process signal;
+ ps_process_pattern(policykit_auth_t, $1)
')
########################################
@@ -206,4 +209,47 @@
files_search_var_lib($1) files_search_var_lib($1)
read_files_pattern($1, policykit_var_lib_t, policykit_var_lib_t) read_files_pattern($1, policykit_var_lib_t, policykit_var_lib_t)
@ -14184,7 +14214,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.6.28/policy/modules/services/policykit.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.6.28/policy/modules/services/policykit.te
--- nsaserefpolicy/policy/modules/services/policykit.te 2009-08-18 11:41:14.000000000 -0400 --- nsaserefpolicy/policy/modules/services/policykit.te 2009-08-18 11:41:14.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/policykit.te 2009-08-21 18:56:07.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/services/policykit.te 2009-08-24 08:38:20.000000000 -0400
@@ -36,11 +36,12 @@ @@ -36,11 +36,12 @@
# policykit local policy # policykit local policy
# #
@ -14201,7 +14231,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
policykit_domtrans_auth(policykit_t) policykit_domtrans_auth(policykit_t)
@@ -62,13 +63,25 @@ @@ -62,27 +63,46 @@
files_read_etc_files(policykit_t) files_read_etc_files(policykit_t)
files_read_usr_files(policykit_t) files_read_usr_files(policykit_t)
@ -14223,16 +14253,21 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ optional_policy(` + optional_policy(`
+ consolekit_dbus_chat(policykit_t) + consolekit_dbus_chat(policykit_t)
+ ') + ')
+
+ optional_policy(`
+ rpm_dbus_chat(policykit_t)
+ ')
+') +')
######################################## ########################################
# #
@@ -76,13 +89,16 @@ # polkit_auth local policy
# #
allow policykit_auth_t self:capability setgid; -allow policykit_auth_t self:capability setgid;
-allow policykit_auth_t self:process getattr; -allow policykit_auth_t self:process getattr;
-allow policykit_auth_t self:fifo_file rw_file_perms; -allow policykit_auth_t self:fifo_file rw_file_perms;
+allow policykit_auth_t self:capability { setgid setuid };
+allow policykit_auth_t self:process { getattr getsched }; +allow policykit_auth_t self:process { getattr getsched };
+allow policykit_auth_t self:fifo_file rw_fifo_file_perms; +allow policykit_auth_t self:fifo_file rw_fifo_file_perms;
+ +
@ -14247,7 +14282,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
rw_files_pattern(policykit_auth_t, policykit_reload_t, policykit_reload_t) rw_files_pattern(policykit_auth_t, policykit_reload_t, policykit_reload_t)
@@ -92,12 +108,13 @@ @@ -92,12 +112,13 @@
manage_files_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t) manage_files_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t)
files_pid_filetrans(policykit_auth_t, policykit_var_run_t, { file dir }) files_pid_filetrans(policykit_auth_t, policykit_var_run_t, { file dir })
@ -14263,7 +14298,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
logging_send_syslog_msg(policykit_auth_t) logging_send_syslog_msg(policykit_auth_t)
@@ -106,7 +123,7 @@ @@ -106,7 +127,7 @@
userdom_dontaudit_read_user_home_content_files(policykit_auth_t) userdom_dontaudit_read_user_home_content_files(policykit_auth_t)
optional_policy(` optional_policy(`
@ -14272,7 +14307,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dbus_session_bus_client(policykit_auth_t) dbus_session_bus_client(policykit_auth_t)
optional_policy(` optional_policy(`
@@ -119,6 +136,14 @@ @@ -119,6 +140,14 @@
hal_read_state(policykit_auth_t) hal_read_state(policykit_auth_t)
') ')
@ -14287,7 +14322,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
######################################## ########################################
# #
# polkit_grant local policy # polkit_grant local policy
@@ -126,7 +151,8 @@ @@ -126,7 +155,8 @@
allow policykit_grant_t self:capability setuid; allow policykit_grant_t self:capability setuid;
allow policykit_grant_t self:process getattr; allow policykit_grant_t self:process getattr;
@ -14297,7 +14332,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow policykit_grant_t self:unix_dgram_socket create_socket_perms; allow policykit_grant_t self:unix_dgram_socket create_socket_perms;
allow policykit_grant_t self:unix_stream_socket create_stream_socket_perms; allow policykit_grant_t self:unix_stream_socket create_stream_socket_perms;
@@ -156,9 +182,12 @@ @@ -156,9 +186,12 @@
userdom_read_all_users_state(policykit_grant_t) userdom_read_all_users_state(policykit_grant_t)
optional_policy(` optional_policy(`
@ -14311,7 +14346,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
consolekit_dbus_chat(policykit_grant_t) consolekit_dbus_chat(policykit_grant_t)
') ')
') ')
@@ -170,7 +199,8 @@ @@ -170,7 +203,8 @@
allow policykit_resolve_t self:capability { setuid sys_nice sys_ptrace }; allow policykit_resolve_t self:capability { setuid sys_nice sys_ptrace };
allow policykit_resolve_t self:process getattr; allow policykit_resolve_t self:process getattr;
@ -22967,7 +23002,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
######################################## ########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.6.28/policy/modules/system/logging.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.6.28/policy/modules/system/logging.te
--- nsaserefpolicy/policy/modules/system/logging.te 2009-08-14 16:14:31.000000000 -0400 --- nsaserefpolicy/policy/modules/system/logging.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/logging.te 2009-08-23 09:54:54.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/system/logging.te 2009-08-24 08:36:53.000000000 -0400
@@ -123,10 +123,10 @@ @@ -123,10 +123,10 @@
allow auditd_t self:capability { chown fsetid sys_nice sys_resource }; allow auditd_t self:capability { chown fsetid sys_nice sys_resource };
@ -22997,7 +23032,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-allow audisp_t self:capability sys_nice; -allow audisp_t self:capability sys_nice;
-allow audisp_t self:process setsched; -allow audisp_t self:process setsched;
-allow audisp_t self:fifo_file rw_file_perms; -allow audisp_t self:fifo_file rw_file_perms;
+allow audisp_t self:capability { dac_override sys_nice }; +allow audisp_t self:capability { dac_override setpcap sys_nice };
+allow audisp_t self:process { getcap signal_perms setcap setsched }; +allow audisp_t self:process { getcap signal_perms setcap setsched };
+allow audisp_t self:fifo_file rw_fifo_file_perms; +allow audisp_t self:fifo_file rw_fifo_file_perms;
allow audisp_t self:unix_stream_socket create_stream_socket_perms; allow audisp_t self:unix_stream_socket create_stream_socket_perms;
@ -24801,7 +24836,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.6.28/policy/modules/system/sysnetwork.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.6.28/policy/modules/system/sysnetwork.te
--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2009-08-14 16:14:31.000000000 -0400 --- nsaserefpolicy/policy/modules/system/sysnetwork.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/sysnetwork.te 2009-08-22 09:47:05.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/system/sysnetwork.te 2009-08-24 08:37:08.000000000 -0400
@@ -20,6 +20,9 @@ @@ -20,6 +20,9 @@
init_daemon_domain(dhcpc_t, dhcpc_exec_t) init_daemon_domain(dhcpc_t, dhcpc_exec_t)
role system_r types dhcpc_t; role system_r types dhcpc_t;
@ -24818,7 +24853,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# #
-allow dhcpc_t self:capability { dac_override fsetid net_admin net_raw net_bind_service sys_resource sys_tty_config }; -allow dhcpc_t self:capability { dac_override fsetid net_admin net_raw net_bind_service sys_resource sys_tty_config };
-dontaudit dhcpc_t self:capability sys_tty_config; -dontaudit dhcpc_t self:capability sys_tty_config;
+allow dhcpc_t self:capability { dac_override fsetid net_admin net_raw net_bind_service sys_nice sys_resource sys_tty_config }; +allow dhcpc_t self:capability { dac_override fsetid net_admin net_raw net_bind_service setpcap sys_nice sys_resource sys_tty_config };
+dontaudit dhcpc_t self:capability { sys_tty_config sys_ptrace }; +dontaudit dhcpc_t self:capability { sys_tty_config sys_ptrace };
# for access("/etc/bashrc", X_OK) on Red Hat # for access("/etc/bashrc", X_OK) on Red Hat
dontaudit dhcpc_t self:capability { dac_read_search sys_module }; dontaudit dhcpc_t self:capability { dac_read_search sys_module };
@ -25063,7 +25098,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/sbin/udev -- gen_context(system_u:object_r:udev_exec_t,s0) /sbin/udev -- gen_context(system_u:object_r:udev_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.if serefpolicy-3.6.28/policy/modules/system/udev.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.if serefpolicy-3.6.28/policy/modules/system/udev.if
--- nsaserefpolicy/policy/modules/system/udev.if 2009-07-14 14:19:57.000000000 -0400 --- nsaserefpolicy/policy/modules/system/udev.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/udev.if 2009-08-23 12:54:42.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/system/udev.if 2009-08-24 08:41:52.000000000 -0400
@@ -168,4 +168,25 @@ @@ -168,4 +168,25 @@
dev_list_all_dev_nodes($1) dev_list_all_dev_nodes($1)
@ -25977,7 +26012,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+HOME_DIR/\.gvfs(/.*)? <<none>> +HOME_DIR/\.gvfs(/.*)? <<none>>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.28/policy/modules/system/userdomain.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.28/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-07-28 13:28:33.000000000 -0400 --- nsaserefpolicy/policy/modules/system/userdomain.if 2009-07-28 13:28:33.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-23 13:00:14.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-24 08:49:32.000000000 -0400
@@ -30,8 +30,9 @@ @@ -30,8 +30,9 @@
') ')
@ -26342,7 +26377,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
####################################### #######################################
@@ -420,34 +424,43 @@ @@ -420,34 +424,48 @@
## is the prefix for user_t). ## is the prefix for user_t).
## </summary> ## </summary>
## </param> ## </param>
@ -26378,13 +26413,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ dev_rw_generic_usb_dev($1) + dev_rw_generic_usb_dev($1)
+ dev_read_video_dev($1) + dev_read_video_dev($1)
+ dev_write_video_dev($1) + dev_write_video_dev($1)
+ dev_rw_wireless($1)
+
+ miscfiles_dontaudit_write_fonts($1)
+
+ optional_policy(`
+ udev_read_db($1)
+ ')
- xserver_user_client($1_t, user_tmpfs_t) - xserver_user_client($1_t, user_tmpfs_t)
- xserver_xsession_entry_type($1_t) - xserver_xsession_entry_type($1_t)
- xserver_dontaudit_write_log($1_t) - xserver_dontaudit_write_log($1_t)
- xserver_stream_connect_xdm($1_t) - xserver_stream_connect_xdm($1_t)
+ miscfiles_dontaudit_write_fonts($1)
+
+ optional_policy(` + optional_policy(`
+ xserver_user_client($1, user_tmpfs_t) + xserver_user_client($1, user_tmpfs_t)
+ xserver_xsession_entry_type($1) + xserver_xsession_entry_type($1)
@ -26404,7 +26444,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
####################################### #######################################
@@ -497,11 +510,7 @@ @@ -497,11 +515,7 @@
attribute unpriv_userdomain; attribute unpriv_userdomain;
') ')
@ -26417,7 +26457,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
############################## ##############################
# #
@@ -511,182 +520,195 @@ @@ -511,182 +525,195 @@
# evolution and gnome-session try to create a netlink socket # evolution and gnome-session try to create a netlink socket
dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown }; dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write }; dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
@ -26438,26 +26478,26 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ kernel_get_sysvipc_info($1_usertype) + kernel_get_sysvipc_info($1_usertype)
# Find CDROM devices: # Find CDROM devices:
- kernel_read_device_sysctls($1_t) - kernel_read_device_sysctls($1_t)
+ kernel_read_device_sysctls($1_usertype) -
- corecmd_exec_bin($1_t) - corecmd_exec_bin($1_t)
+ corenet_udp_bind_generic_node($1_usertype) + kernel_read_device_sysctls($1_usertype)
+ corenet_udp_bind_generic_port($1_usertype)
- corenet_udp_bind_generic_node($1_t) - corenet_udp_bind_generic_node($1_t)
- corenet_udp_bind_generic_port($1_t) - corenet_udp_bind_generic_port($1_t)
+ dev_read_rand($1_usertype) + corenet_udp_bind_generic_node($1_usertype)
+ dev_write_sound($1_usertype) + corenet_udp_bind_generic_port($1_usertype)
+ dev_read_sound($1_usertype)
+ dev_read_sound_mixer($1_usertype)
+ dev_write_sound_mixer($1_usertype)
- dev_read_rand($1_t) - dev_read_rand($1_t)
- dev_write_sound($1_t) - dev_write_sound($1_t)
- dev_read_sound($1_t) - dev_read_sound($1_t)
- dev_read_sound_mixer($1_t) - dev_read_sound_mixer($1_t)
- dev_write_sound_mixer($1_t) - dev_write_sound_mixer($1_t)
- + dev_read_rand($1_usertype)
+ dev_write_sound($1_usertype)
+ dev_read_sound($1_usertype)
+ dev_read_sound_mixer($1_usertype)
+ dev_write_sound_mixer($1_usertype)
- files_exec_etc_files($1_t) - files_exec_etc_files($1_t)
- files_search_locks($1_t) - files_search_locks($1_t)
+ files_exec_etc_files($1_usertype) + files_exec_etc_files($1_usertype)
@ -26650,16 +26690,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
- postgresql_stream_connect($1_t) - postgresql_stream_connect($1_t)
- postgresql_tcp_connect($1_t) - postgresql_tcp_connect($1_t)
+ postgresql_stream_connect($1_usertype) + postgresql_stream_connect($1_usertype)
+ ')
') ')
+
+ optional_policy(`
+ # to allow monitoring of pcmcia status
+ pcmcia_read_pid($1_usertype)
') ')
optional_policy(` optional_policy(`
- resmgr_stream_connect($1_t) - resmgr_stream_connect($1_t)
+ # to allow monitoring of pcmcia status
+ pcmcia_read_pid($1_usertype)
+ ')
+
+ optional_policy(`
+ pcscd_read_pub_files($1_usertype) + pcscd_read_pub_files($1_usertype)
+ pcscd_stream_connect($1_usertype) + pcscd_stream_connect($1_usertype)
') ')
@ -26689,18 +26729,20 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
####################################### #######################################
@@ -714,13 +736,26 @@ @@ -714,13 +741,26 @@
userdom_base_user_template($1) userdom_base_user_template($1)
- userdom_manage_home_role($1_r, $1_t) - userdom_manage_home_role($1_r, $1_t)
+ userdom_manage_home_role($1_r, $1_usertype) + userdom_manage_home_role($1_r, $1_usertype)
+
+ userdom_manage_tmp_role($1_r, $1_usertype)
+ userdom_manage_tmpfs_role($1_r, $1_usertype)
- userdom_manage_tmp_role($1_r, $1_t) - userdom_manage_tmp_role($1_r, $1_t)
- userdom_manage_tmpfs_role($1_r, $1_t) - userdom_manage_tmpfs_role($1_r, $1_t)
+ userdom_manage_tmp_role($1_r, $1_usertype)
+ userdom_manage_tmpfs_role($1_r, $1_usertype)
- userdom_exec_user_tmp_files($1_t)
- userdom_exec_user_home_content_files($1_t)
+ ifelse(`$1',`unconfined',`',` + ifelse(`$1',`unconfined',`',`
+ gen_tunable(allow_$1_exec_content, true) + gen_tunable(allow_$1_exec_content, true)
+ +
@ -26711,9 +26753,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',` + tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
+ fs_exec_nfs_files($1_usertype) + fs_exec_nfs_files($1_usertype)
+ ') + ')
+
- userdom_exec_user_tmp_files($1_t)
- userdom_exec_user_home_content_files($1_t)
+ tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',` + tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
+ fs_exec_cifs_files($1_usertype) + fs_exec_cifs_files($1_usertype)
+ ') + ')
@ -26721,7 +26761,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_change_password_template($1) userdom_change_password_template($1)
@@ -738,70 +773,71 @@ @@ -738,70 +778,71 @@
allow $1_t self:context contains; allow $1_t self:context contains;
@ -26826,7 +26866,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
') ')
@@ -838,6 +874,28 @@ @@ -838,6 +879,28 @@
# Local policy # Local policy
# #
@ -26855,7 +26895,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(` optional_policy(`
loadkeys_run($1_t,$1_r) loadkeys_run($1_t,$1_r)
') ')
@@ -868,7 +926,10 @@ @@ -868,7 +931,10 @@
userdom_restricted_user_template($1) userdom_restricted_user_template($1)
@ -26867,18 +26907,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
############################## ##############################
# #
@@ -876,14 +937,19 @@ @@ -876,14 +942,19 @@
# #
auth_role($1_r, $1_t) auth_role($1_r, $1_t)
- auth_search_pam_console_data($1_t) - auth_search_pam_console_data($1_t)
+ auth_search_pam_console_data($1_usertype) + auth_search_pam_console_data($1_usertype)
+
+ xserver_role($1_r, $1_t)
+ xserver_communicate($1_usertype, $1_usertype)
- dev_read_sound($1_t) - dev_read_sound($1_t)
- dev_write_sound($1_t) - dev_write_sound($1_t)
+ xserver_role($1_r, $1_t)
+ xserver_communicate($1_usertype, $1_usertype)
+
+ dev_read_sound($1_usertype) + dev_read_sound($1_usertype)
+ dev_write_sound($1_usertype) + dev_write_sound($1_usertype)
# gnome keyring wants to read this. # gnome keyring wants to read this.
@ -26892,7 +26932,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
logging_dontaudit_send_audit_msgs($1_t) logging_dontaudit_send_audit_msgs($1_t)
# Need to to this just so screensaver will work. Should be moved to screensaver domain # Need to to this just so screensaver will work. Should be moved to screensaver domain
@@ -891,28 +957,47 @@ @@ -891,28 +962,47 @@
selinux_get_enforce_mode($1_t) selinux_get_enforce_mode($1_t)
optional_policy(` optional_policy(`
@ -26908,15 +26948,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ devicekit_dbus_chat($1_usertype) + devicekit_dbus_chat($1_usertype)
+ devicekit_dbus_chat_disk($1_usertype) + devicekit_dbus_chat_disk($1_usertype)
+ devicekit_dbus_chat_power($1_usertype) + devicekit_dbus_chat_power($1_usertype)
+ ')
+
+ optional_policy(`
+ fprintd_dbus_chat($1_t)
') ')
optional_policy(` optional_policy(`
- dbus_role_template($1, $1_r, $1_t) - dbus_role_template($1, $1_r, $1_t)
- dbus_system_bus_client($1_t) - dbus_system_bus_client($1_t)
+ fprintd_dbus_chat($1_t)
+ ')
+
+ optional_policy(`
+ gnomeclock_dbus_chat($1_t) + gnomeclock_dbus_chat($1_t)
+ ') + ')
@ -26947,7 +26987,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
') ')
@@ -946,8 +1031,8 @@ @@ -946,8 +1036,8 @@
# Declarations # Declarations
# #
@ -26957,7 +26997,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_common_user_template($1) userdom_common_user_template($1)
############################## ##############################
@@ -956,11 +1041,12 @@ @@ -956,11 +1046,12 @@
# #
# port access is audited even if dac would not have allowed it, so dontaudit it here # port access is audited even if dac would not have allowed it, so dontaudit it here
@ -26972,7 +27012,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# cjp: why? # cjp: why?
files_read_kernel_symbol_table($1_t) files_read_kernel_symbol_table($1_t)
@@ -978,36 +1064,53 @@ @@ -978,36 +1069,53 @@
') ')
') ')
@ -27040,7 +27080,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
') ')
@@ -1042,7 +1145,7 @@ @@ -1042,7 +1150,7 @@
# #
template(`userdom_admin_user_template',` template(`userdom_admin_user_template',`
gen_require(` gen_require(`
@ -27049,7 +27089,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
############################## ##############################
@@ -1051,8 +1154,7 @@ @@ -1051,8 +1159,7 @@
# #
# Inherit rules for ordinary users. # Inherit rules for ordinary users.
@ -27059,7 +27099,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
domain_obj_id_change_exemption($1_t) domain_obj_id_change_exemption($1_t)
role system_r types $1_t; role system_r types $1_t;
@@ -1075,7 +1177,8 @@ @@ -1075,7 +1182,8 @@
# Skip authentication when pam_rootok is specified. # Skip authentication when pam_rootok is specified.
allow $1_t self:passwd rootok; allow $1_t self:passwd rootok;
@ -27069,7 +27109,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_software_raid_state($1_t) kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t) kernel_getattr_core_if($1_t)
@@ -1091,6 +1194,7 @@ @@ -1091,6 +1199,7 @@
kernel_sigstop_unlabeled($1_t) kernel_sigstop_unlabeled($1_t)
kernel_signull_unlabeled($1_t) kernel_signull_unlabeled($1_t)
kernel_sigchld_unlabeled($1_t) kernel_sigchld_unlabeled($1_t)
@ -27077,7 +27117,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_tcp_bind_generic_port($1_t) corenet_tcp_bind_generic_port($1_t)
# allow setting up tunnels # allow setting up tunnels
@@ -1098,8 +1202,6 @@ @@ -1098,8 +1207,6 @@
dev_getattr_generic_blk_files($1_t) dev_getattr_generic_blk_files($1_t)
dev_getattr_generic_chr_files($1_t) dev_getattr_generic_chr_files($1_t)
@ -27086,7 +27126,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Allow MAKEDEV to work # Allow MAKEDEV to work
dev_create_all_blk_files($1_t) dev_create_all_blk_files($1_t)
dev_create_all_chr_files($1_t) dev_create_all_chr_files($1_t)
@@ -1154,20 +1256,6 @@ @@ -1126,6 +1233,7 @@
files_exec_usr_src_files($1_t)
fs_getattr_all_fs($1_t)
+ fs_list_all($1_t)
fs_set_all_quotas($1_t)
fs_exec_noxattr($1_t)
@@ -1154,20 +1262,6 @@
# But presently necessary for installing the file_contexts file. # But presently necessary for installing the file_contexts file.
seutil_manage_bin_policy($1_t) seutil_manage_bin_policy($1_t)
@ -27107,7 +27155,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(` optional_policy(`
postgresql_unconfined($1_t) postgresql_unconfined($1_t)
') ')
@@ -1213,6 +1301,7 @@ @@ -1213,6 +1307,7 @@
dev_relabel_all_dev_nodes($1) dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1) files_create_boot_flag($1)
@ -27115,7 +27163,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Necessary for managing /boot/efi # Necessary for managing /boot/efi
fs_manage_dos_files($1) fs_manage_dos_files($1)
@@ -1278,11 +1367,15 @@ @@ -1278,11 +1373,15 @@
interface(`userdom_user_home_content',` interface(`userdom_user_home_content',`
gen_require(` gen_require(`
type user_home_t; type user_home_t;
@ -27131,7 +27179,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1374,12 +1467,13 @@ @@ -1374,12 +1473,13 @@
') ')
allow $1 user_home_dir_t:dir search_dir_perms; allow $1 user_home_dir_t:dir search_dir_perms;
@ -27146,7 +27194,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -1412,6 +1506,14 @@ @@ -1412,6 +1512,14 @@
allow $1 user_home_dir_t:dir list_dir_perms; allow $1 user_home_dir_t:dir list_dir_perms;
files_search_home($1) files_search_home($1)
@ -27161,7 +27209,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1427,9 +1529,11 @@ @@ -1427,9 +1535,11 @@
interface(`userdom_dontaudit_list_user_home_dirs',` interface(`userdom_dontaudit_list_user_home_dirs',`
gen_require(` gen_require(`
type user_home_dir_t; type user_home_dir_t;
@ -27173,7 +27221,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1486,6 +1590,25 @@ @@ -1486,6 +1596,25 @@
allow $1 user_home_dir_t:dir relabelto; allow $1 user_home_dir_t:dir relabelto;
') ')
@ -27199,7 +27247,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
######################################## ########################################
## <summary> ## <summary>
## Create directories in the home dir root with ## Create directories in the home dir root with
@@ -1560,6 +1683,8 @@ @@ -1560,6 +1689,8 @@
') ')
dontaudit $1 user_home_t:dir search_dir_perms; dontaudit $1 user_home_t:dir search_dir_perms;
@ -27208,7 +27256,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1653,6 +1778,7 @@ @@ -1653,6 +1784,7 @@
type user_home_dir_t, user_home_t; type user_home_dir_t, user_home_t;
') ')
@ -27216,7 +27264,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t) read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
files_search_home($1) files_search_home($1)
') ')
@@ -1780,19 +1906,32 @@ @@ -1780,19 +1912,32 @@
# #
interface(`userdom_exec_user_home_content_files',` interface(`userdom_exec_user_home_content_files',`
gen_require(` gen_require(`
@ -27256,7 +27304,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1827,6 +1966,7 @@ @@ -1827,6 +1972,7 @@
interface(`userdom_manage_user_home_content_files',` interface(`userdom_manage_user_home_content_files',`
gen_require(` gen_require(`
type user_home_dir_t, user_home_t; type user_home_dir_t, user_home_t;
@ -27264,7 +27312,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
manage_files_pattern($1, user_home_t, user_home_t) manage_files_pattern($1, user_home_t, user_home_t)
@@ -2374,7 +2514,7 @@ @@ -2374,7 +2520,7 @@
######################################## ########################################
## <summary> ## <summary>
@ -27273,7 +27321,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -2728,11 +2868,32 @@ @@ -2728,11 +2874,32 @@
# #
interface(`userdom_search_user_home_content',` interface(`userdom_search_user_home_content',`
gen_require(` gen_require(`
@ -27308,7 +27356,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -2860,7 +3021,25 @@ @@ -2860,7 +3027,25 @@
type user_tmp_t; type user_tmp_t;
') ')
@ -27335,7 +27383,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -2897,6 +3076,7 @@ @@ -2897,6 +3082,7 @@
') ')
read_files_pattern($1, userdomain, userdomain) read_files_pattern($1, userdomain, userdomain)
@ -27343,7 +27391,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_search_proc($1) kernel_search_proc($1)
') ')
@@ -3027,3 +3207,559 @@ @@ -3027,3 +3213,559 @@
allow $1 userdomain:dbus send_msg; allow $1 userdomain:dbus send_msg;
') ')