@@ -2702,7 +2702,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc
+/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:java_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.2.5/policy/modules/apps/java.if
--- nsaserefpolicy/policy/modules/apps/java.if 2007-10-12 08:56:02.000000000 -0400
-+++ serefpolicy-3.2.5/policy/modules/apps/java.if 2007-12-22 07:16:08.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/apps/java.if 2008-01-13 08:11:05.000000000 -0500
@@ -32,7 +32,7 @@
##
##
@@ -2712,23 +2712,33 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
gen_require(`
type java_exec_t;
')
-@@ -57,7 +57,7 @@
+@@ -57,14 +57,16 @@
# Local policy
#
- allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem };
-+ allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem execstack };
++ allow $1_javaplugin_t self:process { execmem execstack signal_perms getsched ptrace setsched };
allow $1_javaplugin_t self:fifo_file rw_fifo_file_perms;
- allow $1_javaplugin_t self:tcp_socket create_socket_perms;
+- allow $1_javaplugin_t self:tcp_socket create_socket_perms;
++ allow $1_javaplugin_t self:tcp_socket create_stream_socket_perms;
allow $1_javaplugin_t self:udp_socket create_socket_perms;
-@@ -76,13 +76,10 @@
+
++ allow $1_javaplugin_t $1_t:process signull;
++ allow $1_javaplugin_t $1_t:unix_stream_socket connectto;
++ allow $1_t $1_javaplugin_t:unix_stream_socket connectto;
+ allow $1_javaplugin_t $2:unix_stream_socket connectto;
+ allow $1_javaplugin_t $2:unix_stream_socket { read write };
+- userdom_write_user_tmp_sockets($1,$1_javaplugin_t)
+
+ manage_dirs_pattern($1_javaplugin_t,$1_javaplugin_tmp_t,$1_javaplugin_tmp_t)
+ manage_files_pattern($1_javaplugin_t,$1_javaplugin_tmp_t,$1_javaplugin_tmp_t)
+@@ -76,13 +78,9 @@
manage_sock_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t)
fs_tmpfs_filetrans($1_javaplugin_t,$1_javaplugin_tmpfs_t,{ file lnk_file sock_file fifo_file })
- rw_files_pattern($1_javaplugin_t,$1_home_t,$1_home_t)
- read_files_pattern($1_javaplugin_t,$1_home_t,$1_home_t)
-
-+ userdom_manage_unpriv_users_home_content_files($1_javaplugin_t)
can_exec($1_javaplugin_t, java_exec_t)
- # The user role is authorized for this domain.
@@ -2737,11 +2747,65 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
allow $1_javaplugin_t $2:fd use;
# Unrestricted inheritance from the caller.
allow $2 $1_javaplugin_t:process { noatsecure siginh rlimitinh };
-@@ -166,6 +163,62 @@
- optional_policy(`
- xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
- ')
+@@ -94,7 +92,7 @@
+ kernel_read_system_state($1_javaplugin_t)
+
+ # Search bin directory under javaplugin for javaplugin executable
+- corecmd_search_bin($1_javaplugin_t)
++ corecmd_exec_bin($1_javaplugin_t)
+
+ corenet_all_recvfrom_unlabeled($1_javaplugin_t)
+ corenet_all_recvfrom_netlabel($1_javaplugin_t)
+@@ -107,10 +105,12 @@
+ corenet_tcp_connect_all_ports($1_javaplugin_t)
+ corenet_sendrecv_all_client_packets($1_javaplugin_t)
+
++ dev_list_sysfs($1_javaplugin_t)
+ dev_read_sound($1_javaplugin_t)
+ dev_write_sound($1_javaplugin_t)
+ dev_read_urand($1_javaplugin_t)
+ dev_read_rand($1_javaplugin_t)
++ dev_write_rand($1_javaplugin_t)
+
+ files_read_etc_files($1_javaplugin_t)
+ files_read_usr_files($1_javaplugin_t)
+@@ -122,6 +122,9 @@
+
+ fs_getattr_xattr_fs($1_javaplugin_t)
+ fs_dontaudit_rw_tmpfs_files($1_javaplugin_t)
++ fs_getattr_tmpfs($1_javaplugin_t)
+
++ auth_use_nsswitch($1_javaplugin_t)
+
+ libs_use_ld_so($1_javaplugin_t)
+ libs_use_shared_libs($1_javaplugin_t)
+@@ -132,11 +135,14 @@
+ # Read global fonts and font config
+ miscfiles_read_fonts($1_javaplugin_t)
+
+- sysnet_read_config($1_javaplugin_t)
+-
++ userdom_manage_unpriv_users_home_content_files($1_javaplugin_t)
+ userdom_dontaudit_use_user_terminals($1,$1_javaplugin_t)
+ userdom_dontaudit_setattr_user_home_content_files($1,$1_javaplugin_t)
+ userdom_dontaudit_exec_user_home_content_files($1,$1_javaplugin_t)
++ userdom_manage_user_tmp_dirs($1,$1_javaplugin_t)
++ userdom_manage_user_tmp_files($1,$1_javaplugin_t)
++ userdom_manage_user_tmp_sockets($1,$1_javaplugin_t)
++ userdom_read_user_tmpfs_files($1,$1_javaplugin_t)
+ userdom_manage_user_home_content_dirs($1,$1_javaplugin_t)
+ userdom_manage_user_home_content_files($1,$1_javaplugin_t)
+ userdom_manage_user_home_content_symlinks($1,$1_javaplugin_t)
+@@ -156,15 +162,63 @@
+ ')
+
+ optional_policy(`
+- nis_use_ypbind($1_javaplugin_t)
++ xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
+ ')
+
+- optional_policy(`
+- nscd_socket_use($1_javaplugin_t)
+')
+
+#######################################
@@ -2774,8 +2838,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
+template(`java_per_role_template',`
+ gen_require(`
+ type java_exec_t;
-+ ')
-+
+ ')
+
+ type $1_java_t;
+ domain_type($1_java_t)
+ domain_entry_file($1_java_t,java_exec_t)
@@ -2794,13 +2858,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
+
+ fs_dontaudit_rw_tmpfs_files($1_java_t)
+
-+ optional_policy(`
+ optional_policy(`
+- xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
+ xserver_xdm_rw_shm($1_java_t)
-+ ')
+ ')
')
- ########################################
-@@ -219,3 +272,67 @@
+@@ -219,3 +273,67 @@
corecmd_search_bin($1)
domtrans_pattern($1, java_exec_t, java_t)
')
@@ -3073,7 +3137,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
# /bin
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.2.5/policy/modules/apps/mozilla.if
--- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-10-29 07:52:48.000000000 -0400
-+++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if 2008-01-11 13:41:19.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if 2008-01-13 08:06:37.000000000 -0500
@@ -35,7 +35,10 @@
template(`mozilla_per_role_template',`
gen_require(`
@@ -4929,6 +4993,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
')
########################################
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.2.5/policy/modules/kernel/kernel.te
+--- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-12-19 05:32:07.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/kernel/kernel.te 2008-01-11 15:13:01.000000000 -0500
+@@ -363,7 +363,7 @@
+
+ allow kern_unconfined proc_type:{ dir file lnk_file } *;
+
+-allow kern_unconfined sysctl_t:{ dir file } *;
++allow kern_unconfined sysctl_type:{ dir file } *;
+
+ allow kern_unconfined kernel_t:system *;
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.2.5/policy/modules/kernel/selinux.if
--- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-11-16 13:45:14.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/kernel/selinux.if 2007-12-19 05:38:09.000000000 -0500
@@ -16194,7 +16270,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.2.5/policy/modules/system/sysnetwork.if
--- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-07-16 14:09:49.000000000 -0400
-+++ serefpolicy-3.2.5/policy/modules/system/sysnetwork.if 2007-12-19 05:38:09.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/system/sysnetwork.if 2008-01-11 15:56:47.000000000 -0500
@@ -145,6 +145,25 @@
########################################
@@ -16241,7 +16317,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
')
########################################
-@@ -556,3 +581,23 @@
+@@ -556,3 +581,49 @@
files_search_etc($1)
allow $1 net_conf_t:file read_file_perms;
')
@@ -16265,6 +16341,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
+ dontaudit $1 dhcpc_t:fd use;
+')
+
++########################################
++##
++## Execute dhclient script in a specified role
++##
++## No interprocess communication (signals, pipes,
++## etc.) is provided by this interface since
++## the domains are not owned by this module.
++##