rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Add policy for kerneloops

Browse Source 
- Add policy for gnomeclock
This commit is contained in:
Daniel J Walsh 2008-02-05 18:25:42 +00:00
parent 881d64a16e
commit 7483cf9369
1 changed files with 503 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

544
policy-20071130.patch
View File

@ -6429,7 +6429,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.2.6/policy/modules/services/apache.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.2.6/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2007-12-19 05:32:17.000000000 -0500 --- nsaserefpolicy/policy/modules/services/apache.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/apache.te 2008-02-01 16:01:42.000000000 -0500 +++ serefpolicy-3.2.6/policy/modules/services/apache.te 2008-02-05 13:01:09.000000000 -0500
@@ -20,6 +20,8 @@ @@ -20,6 +20,8 @@
# Declarations # Declarations
# #
@ -7516,7 +7516,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.2.6/policy/modules/services/avahi.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.2.6/policy/modules/services/avahi.te
--- nsaserefpolicy/policy/modules/services/avahi.te 2007-12-19 05:32:17.000000000 -0500 --- nsaserefpolicy/policy/modules/services/avahi.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/avahi.te 2008-02-01 16:01:42.000000000 -0500 +++ serefpolicy-3.2.6/policy/modules/services/avahi.te 2008-02-05 13:17:08.000000000 -0500
@@ -13,6 +13,9 @@ @@ -13,6 +13,9 @@
type avahi_var_run_t; type avahi_var_run_t;
files_pid_file(avahi_var_run_t) files_pid_file(avahi_var_run_t)
@ -8223,7 +8223,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons
Binary files nsaserefpolicy/policy/modules/services/consolekit.pp and serefpolicy-3.2.6/policy/modules/services/consolekit.pp differ Binary files nsaserefpolicy/policy/modules/services/consolekit.pp and serefpolicy-3.2.6/policy/modules/services/consolekit.pp differ
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.2.6/policy/modules/services/consolekit.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.2.6/policy/modules/services/consolekit.te
--- nsaserefpolicy/policy/modules/services/consolekit.te 2007-12-19 05:32:17.000000000 -0500 --- nsaserefpolicy/policy/modules/services/consolekit.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/consolekit.te 2008-02-04 11:52:57.000000000 -0500 +++ serefpolicy-3.2.6/policy/modules/services/consolekit.te 2008-02-05 13:20:29.000000000 -0500
@@ -13,6 +13,9 @@ @@ -13,6 +13,9 @@
type consolekit_var_run_t; type consolekit_var_run_t;
files_pid_file(consolekit_var_run_t) files_pid_file(consolekit_var_run_t)
@ -8261,7 +8261,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons
# needs to read /var/lib/dbus/machine-id # needs to read /var/lib/dbus/machine-id
files_read_var_lib_files(consolekit_t) files_read_var_lib_files(consolekit_t)
@@ -47,15 +56,31 @@ @@ -47,16 +56,32 @@
auth_use_nsswitch(consolekit_t) auth_use_nsswitch(consolekit_t)
@ -8282,18 +8282,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons
+hal_ptrace(consolekit_t) +hal_ptrace(consolekit_t)
+mcs_ptrace_all(consolekit_t) +mcs_ptrace_all(consolekit_t)
+ +
+optional_policy(` optional_policy(`
- dbus_system_bus_client_template(consolekit, consolekit_t)
- dbus_connect_system_bus(consolekit_t)
+ cron_read_system_job_lib_files(consolekit_t) + cron_read_system_job_lib_files(consolekit_t)
+') +')
+
optional_policy(` - hal_dbus_chat(consolekit_t)
dbus_system_bus_client_template(consolekit, consolekit_t) +optional_policy(`
dbus_connect_system_bus(consolekit_t)
-
+ dbus_system_domain(consolekit_t, consolekit_exec_t) + dbus_system_domain(consolekit_t, consolekit_exec_t)
hal_dbus_chat(consolekit_t) + optional_policy(`
+ hal_dbus_chat(consolekit_t)
+ ')
optional_policy(` optional_policy(`
unconfined_dbus_chat(consolekit_t)
@@ -64,6 +89,33 @@ @@ -64,6 +89,33 @@
') ')
@ -9659,7 +9662,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru
# Local policy # Local policy
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.6/policy/modules/services/dbus.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.6/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500 --- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/dbus.if 2008-02-01 16:01:42.000000000 -0500 +++ serefpolicy-3.2.6/policy/modules/services/dbus.if 2008-02-05 13:18:08.000000000 -0500
@@ -53,6 +53,7 @@ @@ -53,6 +53,7 @@
gen_require(` gen_require(`
type system_dbusd_exec_t, system_dbusd_t, dbusd_etc_t; type system_dbusd_exec_t, system_dbusd_t, dbusd_etc_t;
@ -9840,7 +9843,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
## Read dbus configuration. ## Read dbus configuration.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -366,3 +443,52 @@ @@ -366,3 +443,55 @@
allow $1 system_dbusd_t:dbus *; allow $1 system_dbusd_t:dbus *;
') ')
@ -9892,10 +9895,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
+ +
+ domtrans_pattern(system_dbusd_t,$2,$1) + domtrans_pattern(system_dbusd_t,$2,$1)
+ +
+ dbus_system_bus_client_template($1,$1)
+ dbus_connect_system_bus($1)
+
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.2.6/policy/modules/services/dbus.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.2.6/policy/modules/services/dbus.te
--- nsaserefpolicy/policy/modules/services/dbus.te 2007-12-19 05:32:17.000000000 -0500 --- nsaserefpolicy/policy/modules/services/dbus.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/dbus.te 2008-02-01 16:01:42.000000000 -0500 +++ serefpolicy-3.2.6/policy/modules/services/dbus.te 2008-02-05 13:15:48.000000000 -0500
@@ -9,6 +9,7 @@ @@ -9,6 +9,7 @@
# #
# Delcarations # Delcarations
@ -9921,6 +9927,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
selinux_get_fs_mount(system_dbusd_t) selinux_get_fs_mount(system_dbusd_t)
selinux_validate_context(system_dbusd_t) selinux_validate_context(system_dbusd_t)
@@ -121,9 +123,20 @@
')
optional_policy(`
+ polkit_domtrans_auth(system_dbusd_t)
+ polkit_search_lib(system_dbusd_t)
+')
+
+optional_policy(`
sysnet_domtrans_dhcpc(system_dbusd_t)
')
optional_policy(`
udev_read_db(system_dbusd_t)
')
+
+optional_policy(`
+ consolekit_dbus_chat(system_dbusd_t)
+')
+
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.if serefpolicy-3.2.6/policy/modules/services/dcc.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.if serefpolicy-3.2.6/policy/modules/services/dcc.if
--- nsaserefpolicy/policy/modules/services/dcc.if 2007-03-26 10:39:05.000000000 -0400 --- nsaserefpolicy/policy/modules/services/dcc.if 2007-03-26 10:39:05.000000000 -0400
+++ serefpolicy-3.2.6/policy/modules/services/dcc.if 2008-02-01 16:01:42.000000000 -0500 +++ serefpolicy-3.2.6/policy/modules/services/dcc.if 2008-02-01 16:01:42.000000000 -0500
@ -11510,6 +11537,146 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
') ')
optional_policy(` optional_policy(`
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.fc serefpolicy-3.2.6/policy/modules/services/gnomeclock.fc
--- nsaserefpolicy/policy/modules/services/gnomeclock.fc 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/gnomeclock.fc 2008-02-05 13:14:26.000000000 -0500
@@ -0,0 +1,2 @@
+
+/usr/libexec/gnome-clock-applet-mechanism -- gen_context(system_u:object_r:gnomeclock_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.if serefpolicy-3.2.6/policy/modules/services/gnomeclock.if
--- nsaserefpolicy/policy/modules/services/gnomeclock.if 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/gnomeclock.if 2008-02-05 13:14:26.000000000 -0500
@@ -0,0 +1,75 @@
+
+## <summary>policy for gnomeclock</summary>
+
+########################################
+## <summary>
+## Execute a domain transition to run gnomeclock.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`gnomeclock_domtrans',`
+ gen_require(`
+ type gnomeclock_t;
+ type gnomeclock_exec_t;
+ ')
+
+ domtrans_pattern($1,gnomeclock_exec_t,gnomeclock_t)
+')
+
+
+########################################
+## <summary>
+## Execute gnomeclock in the gnomeclock domain, and
+## allow the specified role the gnomeclock domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## The role to be allowed the gnomeclock domain.
+## </summary>
+## </param>
+## <param name="terminal">
+## <summary>
+## The type of the role's terminal.
+## </summary>
+## </param>
+#
+interface(`gnomeclock_run',`
+ gen_require(`
+ type gnomeclock_t;
+ ')
+
+ gnomeclock_domtrans($1)
+ role $2 types gnomeclock_t;
+ dontaudit gnomeclock_t $3:chr_file rw_term_perms;
+')
+
+
+########################################
+## <summary>
+## Send and receive messages from
+## gnomeclock over dbus.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`gnomeclock_dbus_chat',`
+ gen_require(`
+ type gnomeclock_t;
+ class dbus send_msg;
+ ')
+
+ allow $1 gnomeclock_t:dbus send_msg;
+ allow gnomeclock_t $1:dbus send_msg;
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.te serefpolicy-3.2.6/policy/modules/services/gnomeclock.te
--- nsaserefpolicy/policy/modules/services/gnomeclock.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/gnomeclock.te 2008-02-05 13:21:34.000000000 -0500
@@ -0,0 +1,51 @@
+policy_module(gnomeclock,1.0.0)
+########################################
+#
+# Declarations
+#
+
+type gnomeclock_t;
+type gnomeclock_exec_t;
+dbus_system_domain(gnomeclock_t, gnomeclock_exec_t)
+
+
+########################################
+#
+# gnomeclock local policy
+#
+allow gnomeclock_t self:capability sys_time;
+allow gnomeclock_t self:process getsched;
+
+## internal communication is often done using fifo and unix sockets.
+allow gnomeclock_t self:fifo_file rw_file_perms;
+allow gnomeclock_t self:unix_stream_socket create_stream_socket_perms;
+
+corecmd_search_bin(gnomeclock_t)
+
+files_read_etc_files(gnomeclock_t)
+files_read_usr_files(gnomeclock_t)
+
+fs_list_inotifyfs(gnomeclock_t)
+
+auth_use_nsswitch(gnomeclock_t)
+
+libs_use_ld_so(gnomeclock_t)
+libs_use_shared_libs(gnomeclock_t)
+
+miscfiles_read_localization(gnomeclock_t)
+
+userdom_read_all_users_state(gnomeclock_t)
+
+optional_policy(`
+ consolekit_dbus_chat(gnomeclock_t)
+')
+
+optional_policy(`
+ clock_domtrans(gnomeclock_t)
+')
+
+optional_policy(`
+ polkit_domtrans_auth(gnomeclock_t)
+ polkit_read_lib(gnomeclock_t)
+')
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.2.6/policy/modules/services/hal.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.2.6/policy/modules/services/hal.fc
--- nsaserefpolicy/policy/modules/services/hal.fc 2007-11-14 08:17:58.000000000 -0500 --- nsaserefpolicy/policy/modules/services/hal.fc 2007-11-14 08:17:58.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/hal.fc 2008-02-01 16:01:42.000000000 -0500 +++ serefpolicy-3.2.6/policy/modules/services/hal.fc 2008-02-01 16:01:42.000000000 -0500
@ -12154,7 +12321,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
+ +
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.2.6/policy/modules/services/kerberos.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.2.6/policy/modules/services/kerberos.te
--- nsaserefpolicy/policy/modules/services/kerberos.te 2007-12-19 05:32:17.000000000 -0500 --- nsaserefpolicy/policy/modules/services/kerberos.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/kerberos.te 2008-02-01 16:01:42.000000000 -0500 +++ serefpolicy-3.2.6/policy/modules/services/kerberos.te 2008-02-05 11:26:22.000000000 -0500
@@ -54,6 +54,12 @@ @@ -54,6 +54,12 @@
type krb5kdc_var_run_t; type krb5kdc_var_run_t;
files_pid_file(krb5kdc_var_run_t) files_pid_file(krb5kdc_var_run_t)
@ -12228,7 +12395,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
userdom_dontaudit_use_unpriv_user_fds(krb5kdc_t) userdom_dontaudit_use_unpriv_user_fds(krb5kdc_t)
userdom_dontaudit_search_sysadm_home_dirs(krb5kdc_t) userdom_dontaudit_search_sysadm_home_dirs(krb5kdc_t)
@@ -233,6 +246,7 @@ @@ -233,8 +246,10 @@
optional_policy(` optional_policy(`
seutil_sigchld_newrole(krb5kdc_t) seutil_sigchld_newrole(krb5kdc_t)
@ -12236,6 +12403,185 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb
') ')
optional_policy(` optional_policy(`
udev_read_db(krb5kdc_t)
')
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.fc serefpolicy-3.2.6/policy/modules/services/kerneloops.fc
--- nsaserefpolicy/policy/modules/services/kerneloops.fc 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/kerneloops.fc 2008-02-05 13:14:34.000000000 -0500
@@ -0,0 +1,4 @@
+
+/usr/sbin/kerneloops -- gen_context(system_u:object_r:kerneloops_exec_t,s0)
+
+/etc/rc.d/init.d/kerneloops -- gen_context(system_u:object_r:kerneloops_script_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.if serefpolicy-3.2.6/policy/modules/services/kerneloops.if
--- nsaserefpolicy/policy/modules/services/kerneloops.if 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/kerneloops.if 2008-02-05 13:14:34.000000000 -0500
@@ -0,0 +1,104 @@
+
+## <summary>policy for kerneloops</summary>
+
+########################################
+## <summary>
+## Execute a domain transition to run kerneloops.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`kerneloops_domtrans',`
+ gen_require(`
+ type kerneloops_t;
+ type kerneloops_exec_t;
+ ')
+
+ domtrans_pattern($1,kerneloops_exec_t,kerneloops_t)
+')
+
+
+########################################
+## <summary>
+## Execute kerneloops server in the kerneloops domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## The type of the process performing this action.
+## </summary>
+## </param>
+#
+interface(`kerneloops_script_domtrans',`
+ gen_require(`
+ type kerneloops_script_exec_t;
+ ')
+
+ init_script_domtrans_spec($1,kerneloops_script_exec_t)
+')
+
+########################################
+## <summary>
+## Send and receive messages from
+## kerneloops over dbus.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`kerneloops_dbus_chat',`
+ gen_require(`
+ type kerneloops_t;
+ class dbus send_msg;
+ ')
+
+ allow $1 kerneloops_t:dbus send_msg;
+ allow kerneloops_t $1:dbus send_msg;
+')
+
+########################################
+## <summary>
+## All of the rules required to administrate
+## an kerneloops environment
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## The role to be allowed to manage the kerneloops domain.
+## </summary>
+## </param>
+## <param name="terminal">
+## <summary>
+## The type of the user terminal.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`kerneloops_admin',`
+ gen_require(`
+ type kerneloops_t;
+ ')
+
+ allow $1 kerneloops_t:process { ptrace signal_perms getattr };
+ read_files_pattern($1, kerneloops_t, kerneloops_t)
+
+
+ gen_require(`
+ type kerneloops_script_exec_t;
+ ')
+
+ # Allow kerneloops_t to restart the apache service
+ kerneloops_script_domtrans($1)
+ domain_system_change_exemption($1)
+ role_transition $2 kerneloops_script_exec_t system_r;
+ allow $2 system_r;
+
+')
Binary files nsaserefpolicy/policy/modules/services/kerneloops.pp and serefpolicy-3.2.6/policy/modules/services/kerneloops.pp differ
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.te serefpolicy-3.2.6/policy/modules/services/kerneloops.te
--- nsaserefpolicy/policy/modules/services/kerneloops.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/kerneloops.te 2008-02-05 13:14:35.000000000 -0500
@@ -0,0 +1,55 @@
+policy_module(kerneloops,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type kerneloops_t;
+type kerneloops_exec_t;
+domain_type(kerneloops_t)
+init_daemon_domain(kerneloops_t, kerneloops_exec_t)
+
+type kerneloops_script_exec_t;
+init_script_type(kerneloops_script_exec_t)
+
+########################################
+#
+# kerneloops local policy
+#
+allow kerneloops_t self:capability sys_nice;
+allow kerneloops_t self:process { setsched getsched };
+
+# Init script handling
+domain_use_interactive_fds(kerneloops_t)
+
+## internal communication is often done using fifo and unix sockets.
+allow kerneloops_t self:fifo_file rw_file_perms;
+allow kerneloops_t self:unix_stream_socket create_stream_socket_perms;
+
+corenet_all_recvfrom_unlabeled(kerneloops_t)
+corenet_all_recvfrom_netlabel(kerneloops_t)
+corenet_tcp_sendrecv_all_if(kerneloops_t)
+corenet_tcp_sendrecv_all_nodes(kerneloops_t)
+corenet_tcp_sendrecv_all_ports(kerneloops_t)
+corenet_tcp_bind_http_port(kerneloops_t)
+
+files_read_etc_files(kerneloops_t)
+
+kernel_read_ring_buffer(kerneloops_t)
+
+libs_use_ld_so(kerneloops_t)
+libs_use_shared_libs(kerneloops_t)
+
+logging_send_syslog_msg(kerneloops_t)
+logging_read_generic_logs(kerneloops_t)
+
+miscfiles_read_localization(kerneloops_t)
+
+sysnet_dns_name_resolve(kerneloops_t)
+
+optional_policy(`
+ dbus_system_bus_client_template(kerneloops,kerneloops_t)
+ dbus_connect_system_bus(kerneloops_t)
+')
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.fc serefpolicy-3.2.6/policy/modules/services/ldap.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.fc serefpolicy-3.2.6/policy/modules/services/ldap.fc
--- nsaserefpolicy/policy/modules/services/ldap.fc 2006-11-16 17:15:20.000000000 -0500 --- nsaserefpolicy/policy/modules/services/ldap.fc 2006-11-16 17:15:20.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/ldap.fc 2008-02-01 16:01:42.000000000 -0500 +++ serefpolicy-3.2.6/policy/modules/services/ldap.fc 2008-02-01 16:01:42.000000000 -0500
@ -14390,10 +14736,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.fc serefpolicy-3.2.6/policy/modules/services/polkit.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.fc serefpolicy-3.2.6/policy/modules/services/polkit.fc
--- nsaserefpolicy/policy/modules/services/polkit.fc 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/services/polkit.fc 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/polkit.fc 2008-02-01 16:01:42.000000000 -0500 +++ serefpolicy-3.2.6/policy/modules/services/polkit.fc 2008-02-05 13:14:51.000000000 -0500
@@ -0,0 +1,7 @@ @@ -0,0 +1,8 @@
+ +
+/usr/libexec/polkit-read-auth-helper -- gen_context(system_u:object_r:polkit_auth_exec_t,s0) +/usr/libexec/polkit-read-auth-helper -- gen_context(system_u:object_r:polkit_auth_exec_t,s0)
+/usr/libexec/polkit-grant-helper.* -- gen_context(system_u:object_r:polkit_grant_exec_t,s0)
+/usr/libexec/polkitd -- gen_context(system_u:object_r:polkit_exec_t,s0) +/usr/libexec/polkitd -- gen_context(system_u:object_r:polkit_exec_t,s0)
+ +
+/var/lib/PolicyKit(/.*)? gen_context(system_u:object_r:polkit_var_lib_t,s0) +/var/lib/PolicyKit(/.*)? gen_context(system_u:object_r:polkit_var_lib_t,s0)
@ -14401,8 +14748,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polk
+/var/lib/PolicyKit-public(/.*)? gen_context(system_u:object_r:polkit_var_lib_t,s0) +/var/lib/PolicyKit-public(/.*)? gen_context(system_u:object_r:polkit_var_lib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.if serefpolicy-3.2.6/policy/modules/services/polkit.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.if serefpolicy-3.2.6/policy/modules/services/polkit.if
--- nsaserefpolicy/policy/modules/services/polkit.if 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/services/polkit.if 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/polkit.if 2008-02-04 11:48:36.000000000 -0500 +++ serefpolicy-3.2.6/policy/modules/services/polkit.if 2008-02-05 13:14:52.000000000 -0500
@@ -0,0 +1,62 @@ @@ -0,0 +1,119 @@
+ +
+## <summary>policy for polkit_auth</summary> +## <summary>policy for polkit_auth</summary>
+ +
@ -14465,10 +14812,67 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polk
+ # Broken placement + # Broken placement
+ cron_read_system_job_lib_files($1) + cron_read_system_job_lib_files($1)
+') +')
+
+########################################
+## <summary>
+## Execute a domain transition to run polkit_grant.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`polkit_domtrans_grant',`
+ gen_require(`
+ type polkit_grant_t;
+ type polkit_grant_exec_t;
+ ')
+
+ domtrans_pattern($1,polkit_grant_exec_t,polkit_grant_t)
+')
+
+########################################
+## <summary>
+## Execute a policy_grant in the policy_grant domain, and
+## allow the specified role the policy_grant domain,
+## and use the caller's terminal.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## The role to be allowed the load_policy domain.
+## </summary>
+## </param>
+## <param name="terminal">
+## <summary>
+## The type of the terminal allow the load_policy domain to use.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`polkit_run_grant',`
+ gen_require(`
+ type polkit_grant_t;
+ type polkit_auth_t;
+ ')
+
+ polkit_domtrans_grant($1)
+ role $2 types polkit_grant_t;
+ role $2 types polkit_auth_t;
+ allow polkit_grant_t $3:chr_file rw_term_perms;
+ allow $1 polkit_grant_t:process signal;
+ read_files_pattern(polkit_grant_t, $1, $1)
+ allow polkit_grant_t $1:process getattr;
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.te serefpolicy-3.2.6/policy/modules/services/polkit.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.te serefpolicy-3.2.6/policy/modules/services/polkit.te
--- nsaserefpolicy/policy/modules/services/polkit.te 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/services/polkit.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/polkit.te 2008-02-01 16:01:42.000000000 -0500 +++ serefpolicy-3.2.6/policy/modules/services/polkit.te 2008-02-05 13:20:13.000000000 -0500
@@ -0,0 +1,110 @@ @@ -0,0 +1,154 @@
+policy_module(polkit_auth,1.0.0) +policy_module(polkit_auth,1.0.0)
+ +
+######################################## +########################################
@ -14478,12 +14882,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polk
+ +
+type polkit_t; +type polkit_t;
+type polkit_exec_t; +type polkit_exec_t;
+domain_type(polkit_t)
+init_daemon_domain(polkit_t, polkit_exec_t) +init_daemon_domain(polkit_t, polkit_exec_t)
+ +
+type polkit_grant_t;
+type polkit_grant_exec_t;
+init_system_domain(polkit_grant_t, polkit_grant_exec_t)
+
+type polkit_auth_t; +type polkit_auth_t;
+type polkit_auth_exec_t; +type polkit_auth_exec_t;
+domain_type(polkit_auth_t)
+init_daemon_domain(polkit_auth_t, polkit_auth_exec_t) +init_daemon_domain(polkit_auth_t, polkit_auth_exec_t)
+ +
+type polkit_var_lib_t; +type polkit_var_lib_t;
@ -14528,9 +14934,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polk
+files_pid_filetrans(polkit_t,polkit_var_run_t, { file dir }) +files_pid_filetrans(polkit_t,polkit_var_run_t, { file dir })
+ +
+optional_policy(` +optional_policy(`
+ dbus_system_bus_client_template(polkit, polkit_t)
+ consolekit_dbus_chat(polkit_t)
+ dbus_system_domain(polkit_t, polkit_exec_t) + dbus_system_domain(polkit_t, polkit_exec_t)
+ optional_policy(`
+ consolekit_dbus_chat(polkit_t)
+ ')
+') +')
+ +
+######################################## +########################################
@ -14579,6 +14986,47 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polk
+ hal_read_state(polkit_auth_t) + hal_read_state(polkit_auth_t)
+') +')
+ +
+########################################
+#
+# polkit_grant local policy
+#
+
+allow polkit_grant_t self:capability setuid;
+allow polkit_grant_t self:process getattr;
+
+allow polkit_grant_t self:unix_dgram_socket create_socket_perms;
+allow polkit_grant_t self:fifo_file rw_file_perms;
+allow polkit_grant_t self:unix_stream_socket create_stream_socket_perms;
+
+can_exec(polkit_grant_t, polkit_grant_exec_t)
+corecmd_search_bin(polkit_grant_t)
+
+files_read_etc_files(polkit_grant_t)
+files_read_usr_files(polkit_grant_t)
+
+auth_use_nsswitch(polkit_grant_t)
+auth_domtrans_chk_passwd(polkit_grant_t)
+
+libs_use_ld_so(polkit_grant_t)
+libs_use_shared_libs(polkit_grant_t)
+
+miscfiles_read_localization(polkit_grant_t)
+
+logging_send_syslog_msg(polkit_grant_t)
+
+polkit_domtrans_auth(polkit_grant_t)
+
+manage_files_pattern(polkit_grant_t, polkit_var_lib_t, polkit_var_lib_t)
+
+optional_policy(`
+ dbus_system_bus_client_template(polkit_grant, polkit_grant_t)
+ consolekit_dbus_chat(polkit_grant_t)
+')
+
+gen_require(`
+ type system_crond_var_lib_t;
+')
+manage_files_pattern(polkit_grant_t, system_crond_var_lib_t, system_crond_var_lib_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.2.6/policy/modules/services/postfix.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.2.6/policy/modules/services/postfix.fc
--- nsaserefpolicy/policy/modules/services/postfix.fc 2007-09-12 10:34:18.000000000 -0400 --- nsaserefpolicy/policy/modules/services/postfix.fc 2007-09-12 10:34:18.000000000 -0400
+++ serefpolicy-3.2.6/policy/modules/services/postfix.fc 2008-02-01 16:01:42.000000000 -0500 +++ serefpolicy-3.2.6/policy/modules/services/postfix.fc 2008-02-01 16:01:42.000000000 -0500
@ -24828,7 +25276,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
') ')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.2.6/policy/modules/system/unconfined.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.2.6/policy/modules/system/unconfined.te
--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-12-19 05:32:17.000000000 -0500 --- nsaserefpolicy/policy/modules/system/unconfined.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/system/unconfined.te 2008-02-02 00:21:41.000000000 -0500 +++ serefpolicy-3.2.6/policy/modules/system/unconfined.te 2008-02-05 09:47:51.000000000 -0500
@@ -6,35 +6,59 @@ @@ -6,35 +6,59 @@
# Declarations # Declarations
# #
@ -24949,7 +25397,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
optional_policy(` optional_policy(`
init_dbus_chat_script(unconfined_t) init_dbus_chat_script(unconfined_t)
@@ -107,6 +146,10 @@ @@ -101,12 +140,20 @@
')
optional_policy(`
+ kerneloops_dbus_chat(unconfined_t)
+ ')
+
+ optional_policy(`
networkmanager_dbus_chat(unconfined_t)
')
optional_policy(` optional_policy(`
oddjob_dbus_chat(unconfined_t) oddjob_dbus_chat(unconfined_t)
') ')
@ -24960,7 +25418,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
') ')
optional_policy(` optional_policy(`
@@ -118,11 +161,7 @@ @@ -118,11 +165,7 @@
') ')
optional_policy(` optional_policy(`
@ -24973,7 +25431,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
') ')
optional_policy(` optional_policy(`
@@ -134,14 +173,6 @@ @@ -134,14 +177,6 @@
') ')
optional_policy(` optional_policy(`
@ -24988,7 +25446,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
oddjob_domtrans_mkhomedir(unconfined_t) oddjob_domtrans_mkhomedir(unconfined_t)
') ')
@@ -154,38 +185,32 @@ @@ -154,38 +189,32 @@
') ')
optional_policy(` optional_policy(`
@ -25034,7 +25492,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
') ')
optional_policy(` optional_policy(`
@@ -205,11 +230,30 @@ @@ -205,11 +234,30 @@
') ')
optional_policy(` optional_policy(`
@ -25044,14 +25502,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
+ +
+optional_policy(` +optional_policy(`
+ java_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) + java_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
+')
+
+optional_policy(`
+ mono_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
') ')
optional_policy(` optional_policy(`
- xserver_domtrans_xdm_xserver(unconfined_t) - xserver_domtrans_xdm_xserver(unconfined_t)
+ mono_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
+')
+
+optional_policy(`
+ mozilla_per_role_template(unconfined, unconfined_t, unconfined_r) + mozilla_per_role_template(unconfined, unconfined_t, unconfined_r)
+ unconfined_domain(unconfined_mozilla_t) + unconfined_domain(unconfined_mozilla_t)
+ allow unconfined_mozilla_t self:process { execstack execmem }; + allow unconfined_mozilla_t self:process { execstack execmem };
@ -25067,7 +25525,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
') ')
######################################## ########################################
@@ -219,14 +263,34 @@ @@ -219,14 +267,34 @@
allow unconfined_execmem_t self:process { execstack execmem }; allow unconfined_execmem_t self:process { execstack execmem };
unconfined_domain_noaudit(unconfined_execmem_t) unconfined_domain_noaudit(unconfined_execmem_t)
@ -25087,7 +25545,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
- ') - ')
+optional_policy(` +optional_policy(`
+ avahi_dbus_chat(unconfined_execmem_t) + avahi_dbus_chat(unconfined_execmem_t)
+') ')
+ +
+optional_policy(` +optional_policy(`
+ hal_dbus_chat(unconfined_execmem_t) + hal_dbus_chat(unconfined_execmem_t)
@ -25095,7 +25553,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
+ +
+optional_policy(` +optional_policy(`
+ xserver_xdm_rw_shm(unconfined_execmem_t) + xserver_xdm_rw_shm(unconfined_execmem_t)
') +')
+ +
+######################################## +########################################
+# +#
@ -28810,8 +29268,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.i
+## <summary>Policy for staff user</summary> +## <summary>Policy for staff user</summary>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.te serefpolicy-3.2.6/policy/modules/users/staff.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.te serefpolicy-3.2.6/policy/modules/users/staff.te
--- nsaserefpolicy/policy/modules/users/staff.te 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/users/staff.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/users/staff.te 2008-02-04 08:26:47.000000000 -0500 +++ serefpolicy-3.2.6/policy/modules/users/staff.te 2008-02-05 09:47:25.000000000 -0500
@@ -0,0 +1,51 @@ @@ -0,0 +1,55 @@
+policy_module(staff,1.0.1) +policy_module(staff,1.0.1)
+userdom_unpriv_user_template(staff) +userdom_unpriv_user_template(staff)
+ +
@ -28843,6 +29301,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.t
+') +')
+ +
+optional_policy(` +optional_policy(`
+ kerneloops_dbus_chat(staff_t)
+')
+
+optional_policy(`
+ mono_per_role_template(staff, staff_t, staff_r) + mono_per_role_template(staff, staff_t, staff_r)
+') +')
+ +