rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Update boinc policy 

- Fix sysstat policy to allow sys_admin
- Change failsafe_context to unconfined_r:unconfined_t:s0
This commit is contained in:
Daniel J Walsh 2010-07-27 17:28:04 +00:00
parent a1ef703492
commit 7f5d8f30d0
4 changed files with 98 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
config.tgz
View File

Binary file not shown.

113
policy-F14.patch
View File

@ -7898,7 +7898,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
#
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.8.8/policy/modules/kernel/kernel.if
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2010-06-08 10:35:48.000000000 -0400
+++ serefpolicy-3.8.8/policy/modules/kernel/kernel.if 2010-07-20 10:46:10.000000000 -0400
+++ serefpolicy-3.8.8/policy/modules/kernel/kernel.if 2010-07-27 11:47:12.000000000 -0400
@@ -1977,7 +1977,7 @@
')
@ -11831,14 +11831,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.fc serefpolicy-3.8.8/policy/modules/services/boinc.fc
--- nsaserefpolicy/policy/modules/services/boinc.fc 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.8.8/policy/modules/services/boinc.fc 2010-07-20 10:46:10.000000000 -0400
@@ -0,0 +1,6 @@
+++ serefpolicy-3.8.8/policy/modules/services/boinc.fc 2010-07-27 09:18:03.000000000 -0400
@@ -0,0 +1,8 @@
+
+/etc/rc\.d/init\.d/boinc_client -- gen_context(system_u:object_r:boinc_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/boinc_client -- gen_context(system_u:object_r:boinc_initrc_exec_t,s0)
+
+/usr/bin/boinc_client -- gen_context(system_u:object_r:boinc_exec_t,s0)
+/usr/bin/boinc_client -- gen_context(system_u:object_r:boinc_exec_t,s0)
+
+/var/lib/boinc(/.*)? gen_context(system_u:object_r:boinc_var_lib_t,s0)
+/var/lib/boinc(/.*)? gen_context(system_u:object_r:boinc_var_lib_t,s0)
+/var/lib/boinc/projects(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
+/var/lib/boinc/slots(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.if serefpolicy-3.8.8/policy/modules/services/boinc.if
--- nsaserefpolicy/policy/modules/services/boinc.if 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.8.8/policy/modules/services/boinc.if 2010-07-20 10:46:10.000000000 -0400
@ -11996,8 +11998,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.te serefpolicy-3.8.8/policy/modules/services/boinc.te
--- nsaserefpolicy/policy/modules/services/boinc.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.8.8/policy/modules/services/boinc.te 2010-07-20 10:46:10.000000000 -0400
@@ -0,0 +1,96 @@
+++ serefpolicy-3.8.8/policy/modules/services/boinc.te 2010-07-27 09:18:03.000000000 -0400
@@ -0,0 +1,143 @@
+policy_module(boinc,1.0.0)
+
+########################################
@ -12021,13 +12023,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
+type boinc_var_lib_t;
+files_type(boinc_var_lib_t)
+
+type boinc_project_t;
+domain_type(boinc_project_t)
+role system_r types boinc_project_t;
+
+permissive boinc_project_t;
+
+type boinc_project_var_lib_t;
+files_type(boinc_project_var_lib_t)
+
+########################################
+#
+# boinc local policy
+#
+
+allow boinc_t self:capability { kill };
+allow boinc_t self:process { execmem ptrace setsched signal signull sigstop sigkill };
+allow boinc_t self:process { setsched };
+
+allow boinc_t self:fifo_file rw_fifo_file_perms;
+allow boinc_t self:unix_stream_socket create_stream_socket_perms;
@ -12047,10 +12058,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
+manage_files_pattern(boinc_t, boinc_var_lib_t, boinc_var_lib_t)
+files_var_lib_filetrans(boinc_t, boinc_var_lib_t, { file dir } )
+
+manage_dirs_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
+manage_files_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
+
+kernel_read_system_state(boinc_t)
+kernel_read_network_state(boinc_t)
+kernel_read_kernel_sysctls(boinc_t)
+kernel_search_vm_sysctl(boinc_t)
+
+files_getattr_all_dirs(boinc_t)
+files_getattr_all_files(boinc_t)
+
+corecmd_exec_bin(boinc_t)
+corecmd_exec_shell(boinc_t)
@ -12094,6 +12108,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
+sysnet_dns_name_resolve(boinc_t)
+
+mta_send_mail(boinc_t)
+
+########################################
+#
+# boinc-projects local policy
+#
+
+domtrans_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_t)
+
+allow boinc_project_t self:process { ptrace setsched signal signull sigkill sigstop };
+allow boinc_project_t self:process { execmem execstack };
+
+allow boinc_project_t boinc_project_var_lib_t:file entrypoint;
+exec_files_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
+manage_dirs_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
+manage_files_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
+files_var_lib_filetrans(boinc_project_t, boinc_project_var_lib_t, { file dir })
+
+allow boinc_project_t boinc_project_var_lib_t:file execmod;
+
+allow boinc_project_t boinc_t:shm rw_shm_perms;
+allow boinc_project_t boinc_tmpfs_t:file { read write };
+
+rw_files_pattern(boinc_project_t, boinc_var_lib_t, boinc_var_lib_t)
+
+kernel_read_system_state(boinc_project_t)
+kernel_read_kernel_sysctls(boinc_project_t)
+kernel_search_vm_sysctl(boinc_project_t)
+kernel_read_network_state(boinc_project_t)
+
+corenet_tcp_connect_boinc_port(boinc_project_t)
+
+dev_rw_xserver_misc(boinc_project_t)
+
+miscfiles_read_localization(boinc_project_t)
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.fc serefpolicy-3.8.8/policy/modules/services/bugzilla.fc
--- nsaserefpolicy/policy/modules/services/bugzilla.fc 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.8.8/policy/modules/services/bugzilla.fc 2010-07-20 10:46:10.000000000 -0400
@ -13716,7 +13765,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
+/var/log/mcelog.* -- gen_context(system_u:object_r:cron_log_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.8.8/policy/modules/services/cron.if
--- nsaserefpolicy/policy/modules/services/cron.if 2009-09-16 09:09:20.000000000 -0400
+++ serefpolicy-3.8.8/policy/modules/services/cron.if 2010-07-23 08:29:53.000000000 -0400
+++ serefpolicy-3.8.8/policy/modules/services/cron.if 2010-07-27 11:02:51.000000000 -0400
@@ -12,6 +12,10 @@
## </param>
#
@ -13768,11 +13817,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
')
role $1 types { cronjob_t crontab_t };
@@ -116,6 +128,12 @@
@@ -116,6 +128,13 @@
# Transition from the user domain to the derived domain.
domtrans_pattern($2, crontab_exec_t, crontab_t)
+ allow crond_t $2:process transition;
+ dontaudit crond_t $2:process { noatsecure siginh rlimitinh };
+ allow $2 crond_t:process sigchld;
+
+ # needs to be authorized SELinux context for cron
@ -13781,7 +13831,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
# crontab shows up in user ps
ps_process_pattern($2, crontab_t)
allow $2 crontab_t:process signal;
@@ -154,27 +172,14 @@
@@ -154,27 +173,14 @@
#
interface(`cron_unconfined_role',`
gen_require(`
@ -13811,7 +13861,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
optional_policy(`
gen_require(`
class dbus send_msg;
@@ -408,7 +413,43 @@
@@ -408,7 +414,43 @@
type crond_t;
')
@ -13856,7 +13906,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
')
########################################
@@ -554,7 +595,7 @@
@@ -554,7 +596,7 @@
type system_cronjob_t;
')
@ -13865,7 +13915,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
')
########################################
@@ -587,11 +628,14 @@
@@ -587,11 +629,14 @@
#
interface(`cron_read_system_job_tmp_files',`
gen_require(`
@ -13881,7 +13931,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
')
########################################
@@ -627,7 +671,48 @@
@@ -627,7 +672,48 @@
interface(`cron_dontaudit_write_system_job_tmp_files',`
gen_require(`
type system_cronjob_tmp_t;
@ -23045,8 +23095,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stun
kernel_read_system_state(stunnel_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.8.8/policy/modules/services/sysstat.te
--- nsaserefpolicy/policy/modules/services/sysstat.te 2010-06-18 13:07:19.000000000 -0400
+++ serefpolicy-3.8.8/policy/modules/services/sysstat.te 2010-07-20 10:46:11.000000000 -0400
@@ -68,3 +68,8 @@
+++ serefpolicy-3.8.8/policy/modules/services/sysstat.te 2010-07-27 09:40:49.000000000 -0400
@@ -18,8 +18,7 @@
# Local policy
#
-allow sysstat_t self:capability { dac_override sys_resource sys_tty_config };
-dontaudit sysstat_t self:capability sys_admin;
+allow sysstat_t self:capability { dac_override sys_admin sys_resource sys_tty_config };
allow sysstat_t self:fifo_file rw_fifo_file_perms;
can_exec(sysstat_t, sysstat_exec_t)
@@ -68,3 +67,8 @@
optional_policy(`
logging_send_syslog_msg(sysstat_t)
')
@ -27720,6 +27780,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.
domain_use_interactive_fds(iscsid_t)
domain_dontaudit_read_all_domains_state(iscsid_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/kdump.te serefpolicy-3.8.8/policy/modules/system/kdump.te
--- nsaserefpolicy/policy/modules/system/kdump.te 2010-06-18 13:07:19.000000000 -0400
+++ serefpolicy-3.8.8/policy/modules/system/kdump.te 2010-07-27 11:47:26.000000000 -0400
@@ -29,6 +29,7 @@
kernel_read_system_state(kdump_t)
kernel_read_core_if(kdump_t)
+kernel_read_debugfs(kdump_t)
dev_read_framebuffer(kdump_t)
dev_read_sysfs(kdump_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.8.8/policy/modules/system/libraries.fc
--- nsaserefpolicy/policy/modules/system/libraries.fc 2010-03-23 11:19:40.000000000 -0400
+++ serefpolicy-3.8.8/policy/modules/system/libraries.fc 2010-07-22 10:09:46.000000000 -0400

7
selinux-policy.spec
View File

@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.8.8
Release: 6%{?dist}
Release: 7%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@ -469,6 +469,11 @@ exit 0
%endif
%changelog
* Tue Jul 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-7
- Update boinc policy
- Fix sysstat policy to allow sys_admin
- Change failsafe_context to unconfined_r:unconfined_t:s0
* Mon Jul 26 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-6
- New paths for upstart

1
sources
View File

@ -1,2 +1 @@
4c7d323036f1662a06a7a4f2a7da57a5 config.tgz
1f8151f0184945098f3cc3ca0b53e861 serefpolicy-3.8.8.tgz