From 7f5d8f30d0f7a6a4da85a728d02d4f2286b28232 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Tue, 27 Jul 2010 17:28:04 +0000 Subject: [PATCH] - Update boinc policy - Fix sysstat policy to allow sys_admin - Change failsafe_context to unconfined_r:unconfined_t:s0 --- config.tgz | Bin 3007 -> 2987 bytes policy-F14.patch | 113 ++++++++++++++++++++++++++++++++++++-------- selinux-policy.spec | 7 ++- sources | 1 - 4 files changed, 98 insertions(+), 23 deletions(-) diff --git a/config.tgz b/config.tgz index 32fecce0605ae26257995d2fa5e6e5302fd0469f..261918710c1f7eeb2c19a3dc40b614a9e6193c8c 100644 GIT binary patch literal 2987 zcmXX{c{tSj7aq&l!?(bvI*Y*)cN{+8TOGOEJAvRzBG2H96TVVLRwJr3c7r@ zRD)`2))M1d_T_L>A*NMBf`1CTRPLt~xf7ADJ=CB~u2r6ls*xCCxG#%+)VqIm*Vh)2 zWAQbeiKzb3aMR)S<305?z}Q1*-9Cq+Q`jbPy`zBgnL5>=n^FmpYJX_ovV#tp9ch6f zC+{j=iQaR-_^gHe8Ah~p2^DLp;90hPo}sE- z+^lkVM1HQhrCsR-#V5z6M>2TG`1V?zC(Ujdn9C?lZkOJ6E=2|2O>#anbc-lGO6# zVoqaI{4!O9t0!vs;m~WCh}%ndl%=Q|m!%&#Nb$Y|zCNBUFnek2pnB&+1;kxmC@aus zPvW89j{XkiQng1z9r{ND6cP`<*)(6(oBHL`kh~a&QOn%*?bn}XGI@eg>uo33iuj+} z>s<&S6x*wr|v*2 zDQ%<~k=HbJ*Y50?VWgU=XQ>Udk;T?emny4*oEVLOT*Bo$3{SQZ7KnkYt2;C$xiyS% zJO^E01zV=aIMS~4tv37;bM6gxOI8M^Y|pExOq#hEO}1148o9qUQtU)&B= z<(Wc@vC4he_Eldp4EB2#vOp(e&?RIV`q7R+j7|ij@|041pVH0KU}HP#I3vVEc5;%% znVFd>!?NvP|0I8T=g^4~Uv>#{a6BpdV7J^%Gsag{Qk2*y&CZ}0U-(L*?r_#9T`fLX z>e=WK=?!RNrjU<|&Q<|oK~hY-K;OZT;UDyX<2PQ7`H_UQV;bGBjQRDE9>}~)k$JYEo5U&%xqd2T==|*j zw~2t2RST_F#k&FJdF&BB7a15N)fa0VF_{qDj-FzpTO|&FU4;tZ=)>K=AYK3KUpEX} zcha&OV)_DBjIK_F*tu!GwAs9_F_2kcbf2YKmK$sBO2#4%!%B_4Yf}ch1bDiI!&R;3 zlYh2Tdt)L7!G+9R26x8(4kU1xdt2yFhVf#d>dPZ z7YKPr$eB{M}$S}xFKujl8_8an@N4(!(Cg{8b%=N zMpnp0jBG6iZxi?D)w~cwbI1IR7vPY-r%ihI$ALJN<;&>gl=uu#g-WJ-ow&qA-{B_S z94`pS^*jNV$7|us;$DHHK2|?~5?)l@xV=IF)rvzsoJS)cO4BB6`o^|@A^7oMhG32W4ey#MMdpHd3Q#ZJD zPP*gYz;{w}7>bY>fQI>Ra05r6w#&kQ_K2qS%X8x5@IzZlD)y!qrn{ z;*qUv48sR8mu9qUom1$^)gu{>t)qM6*3r7rd+02FuHJf3v7u;fN*FeC9nB-lRe|$F zK7ci^27Bmi%rL~MOIvjr4l*ata&*oFh#qU^Dgv7V(85r?BkBpU90h7g+40#L>aGM<#;|rW~+K+zHU# zOB_q@4vzwhY3*$=^fb2e7kcWBJP0*CQVoXq`+18k`D9GzY8Ds#zEuEyR!G%Wy?cT3 zHgRnJW{?|vJ1NE#J0SX3F70TH19!U{dd};>Brid(rNSbdQT_qY6!e*e&KG%=34XBA z;uDa)muy3giM?*fa7?<*gV=K+JqFuOrj5_C75BXk9N~A5llgC0WqDxzBN0$@aG(T9 zI$zi*H1=qs{JHb?6VvndX9@WuX?CVdD1$9UwFPij9Yx&)?wrsa-f#cY9SAV*i7xU& z&rZ-<0YogLb$Sz77~KrXPHaNWoIt4eI||}8lNna~EGJk-;sG{%`qRpTbeFD;ROE;E zlI&lg(%SsR3UN6C0%ReslA zEnXjBlKgu5A753ceI3M1KsirTBltZ9>LsK`z#^Z)PWE2~Fu0|T5`%NgNSh#r2mA98 zfo&59)3A~gk&N9^K$T|=b;T(0wu^~91{zs3}bIsm@sU(A+5jofLZ*|(5 WZn{Y!{$K8zu#|#+Rv%&wf%qSSvsjb> literal 3007 zcmXX_c|6nqAD>%9`o>7PN}*ypsAMfy$~TM>xt4MygmR28K3J_oj;LJah*A-vM2@W- zbCjv3k+g;77=1T3X134!=llJAUw^({kLTn0dOQ!EGk~*=}e(t5IYFftNRxe+zhyKVFMlLNN|GHtP0;_{>Hqh{R zi_y*JJL)_{b+=;KoTMavwyAteXKK>h2ER9$5byjatVSYhsOU;S-jn9q>VYx4n&;L< zfk~+YZXBll^ih)v3*hi_#|q|_ds0+R#ew6La6(Ki`#>GMKdkSZkg>a}Q*BQdNmX0@ z2Y}qp9feE7Cq5owHD?6={_NJ~bBhITb5+$s+4m zIUM8sHc%_aUMsZSCohoKpLCa+DzCc4Z$02XItZAIQ)*=*|V=4%$8D$^*-? z=h<}`x?PS+ykjoPAD?`EO25_%udF04&!MN&e3%CBZrG$I!Hfpu_QAUD zo7j>lu{>;WqnEvdO~L`w5KTj3UY}vxx>#Ff{)GzRxO3qQ3XrQX+^K= z=eN2uV6)4EEOI)nb~KwS$7ec6I(^^2T-4c3t;hdqxp!K1jGcC=RO<2D^`4E>Z}*Mz z63pU#ztO_cCB*M=jo8#dY*rlx7Dli`Q2W_Q=>AWW6ScsC9BeZ6%g(AAcx}E48-_jQ zG4>1zGTC{^DUxzks{W7D>+c36ZDJ%+DsSfzq{GK`qOzTzATaOMwiErdI#mL1?KlD{u zOgaCUU?|3HoYkQMbbHJZ5M6?XQEeZl-ZG5E;SHgopl4%AbsxnPHL#C^1JeFge(fOg4e=t~F>@{2qD5)QY9bCH5L zmB7y1ccY@}x7!PgFsJ*kWh%Sn3@^Tn@g4ZYeJ^gvJdwywt~3#osF4N1H^H#Ch;dmL z*stsLb-L8&Y{3l7ke8ivy?Jp8tNh`y>xUCIJ1G5T<*6S-3HJ~i%C33?LbD~>`0r+- zD^R*53O`cW|i9Dt%3tgcIl<6DPpS>>%E< zm=aDZ%Z$5q_;oBnZ=oxXN)nBau5BIhABJNNLwI~+uo~%R&Pts4^5f1Cvx;j4f#IpU z@JkD`HdmOF8?AL*H(zTOy%Zb{PfEypQ~o6BYK^8Am(+gbcZXH7!>T2IJccZ&S(BRe zU|%0D=BP?*B|%61xtXcldAiN+~NrzbU+di_^KZ@2!`{ z*=@c|*Doz?y&1F{y{5P6EfHHsYrl0atM<sdE=^CXM@jdniyE3!9M>QVq%(!0 z{jEK7VElrF?x29WyHSuC(k`q)Ml6Dt%8x8#h_MzO8A@^2bQ4yqB71kpDa57;Zf8LnWKg!|qtN;CUmgn2>ClZaH$|%lApvOdr}yjjR^w$Z zan8M)2IdZwK*G**mIMKAGX(+fH&$5$cp6IP)FJ~t0qAVNiEkr!W3Y9 z)Ok3$2^biL*!-Mg)fw+csb5^VVh%jU`kQ*MD#j^1>q@_JS^fOGt3r%6-(G?xg5JFV z!`c%dB;^6HVa`^xd61`6W2`cNRANbw0zX##Tre~ zKm?l+B3Qxv@&oocAV>maA~{^>+p-(=jU1!OmV0`3PpxXrrfdPjgNBo#Ekm;m!1b0I z1D=Ri-nmNu`rx+eLqlf`7*+vaB#C<}ZxFeZj?%X#2TdLfZTldn+Fb6XXO}WWTgSU+ z^%RV|Kx)_-Odkk{?~qJ}*$58gW8T4r%Kq6;lP2RWfx!g0n1WYwYPeSzSY>FGnDHPw z#H_UWM@Fd)>0GK?PZG;>=iOF?a)P4i%_Cxm-3IaZFTTi%>DezvErPNzv2h6xXm0@f z(bTKUBxLs@xHZ(G>iHanD=DR9{~F{wY|Il57fb!C-${u8II~YI#?eEv1vy@1)MXad?-!!Of5jzKTq%t{cN8?JN zc!qqbD$~s>6qqeQO&>(mD5WowD>YK*;2Je580=r8-o2Td9G&Kr*q4kf=jx=3aEcUv z3iMU-7vvd%TyBwsQ7L!L=TXxd)%9KUeE(hle1+QuNYle5Aby|+ME^#inEvv7+##S| z2m%UZtH1?`8W3#tx6}-@af$|oiE!GvAXpOQA~|e~kxH_UiarG^^$y{q)za4yTE7Os&YEJ2d5>8EJE-!J;RKda6`*>01?UsK5h zQ46G|&7e?X5vLfxK;qIe$cQCbT^iWSga{ # @@ -13768,11 +13817,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') role $1 types { cronjob_t crontab_t }; -@@ -116,6 +128,12 @@ +@@ -116,6 +128,13 @@ # Transition from the user domain to the derived domain. domtrans_pattern($2, crontab_exec_t, crontab_t) + allow crond_t $2:process transition; ++ dontaudit crond_t $2:process { noatsecure siginh rlimitinh }; + allow $2 crond_t:process sigchld; + + # needs to be authorized SELinux context for cron @@ -13781,7 +13831,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron # crontab shows up in user ps ps_process_pattern($2, crontab_t) allow $2 crontab_t:process signal; -@@ -154,27 +172,14 @@ +@@ -154,27 +173,14 @@ # interface(`cron_unconfined_role',` gen_require(` @@ -13811,7 +13861,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron optional_policy(` gen_require(` class dbus send_msg; -@@ -408,7 +413,43 @@ +@@ -408,7 +414,43 @@ type crond_t; ') @@ -13856,7 +13906,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') ######################################## -@@ -554,7 +595,7 @@ +@@ -554,7 +596,7 @@ type system_cronjob_t; ') @@ -13865,7 +13915,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') ######################################## -@@ -587,11 +628,14 @@ +@@ -587,11 +629,14 @@ # interface(`cron_read_system_job_tmp_files',` gen_require(` @@ -13881,7 +13931,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') ######################################## -@@ -627,7 +671,48 @@ +@@ -627,7 +672,48 @@ interface(`cron_dontaudit_write_system_job_tmp_files',` gen_require(` type system_cronjob_tmp_t; @@ -23045,8 +23095,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stun kernel_read_system_state(stunnel_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.8.8/policy/modules/services/sysstat.te --- nsaserefpolicy/policy/modules/services/sysstat.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.8/policy/modules/services/sysstat.te 2010-07-20 10:46:11.000000000 -0400 -@@ -68,3 +68,8 @@ ++++ serefpolicy-3.8.8/policy/modules/services/sysstat.te 2010-07-27 09:40:49.000000000 -0400 +@@ -18,8 +18,7 @@ + # Local policy + # + +-allow sysstat_t self:capability { dac_override sys_resource sys_tty_config }; +-dontaudit sysstat_t self:capability sys_admin; ++allow sysstat_t self:capability { dac_override sys_admin sys_resource sys_tty_config }; + allow sysstat_t self:fifo_file rw_fifo_file_perms; + + can_exec(sysstat_t, sysstat_exec_t) +@@ -68,3 +67,8 @@ optional_policy(` logging_send_syslog_msg(sysstat_t) ') @@ -27720,6 +27780,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi. domain_use_interactive_fds(iscsid_t) domain_dontaudit_read_all_domains_state(iscsid_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/kdump.te serefpolicy-3.8.8/policy/modules/system/kdump.te +--- nsaserefpolicy/policy/modules/system/kdump.te 2010-06-18 13:07:19.000000000 -0400 ++++ serefpolicy-3.8.8/policy/modules/system/kdump.te 2010-07-27 11:47:26.000000000 -0400 +@@ -29,6 +29,7 @@ + + kernel_read_system_state(kdump_t) + kernel_read_core_if(kdump_t) ++kernel_read_debugfs(kdump_t) + + dev_read_framebuffer(kdump_t) + dev_read_sysfs(kdump_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.8.8/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2010-03-23 11:19:40.000000000 -0400 +++ serefpolicy-3.8.8/policy/modules/system/libraries.fc 2010-07-22 10:09:46.000000000 -0400 diff --git a/selinux-policy.spec b/selinux-policy.spec index 8ef795b6..4467fc68 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -20,7 +20,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.8.8 -Release: 6%{?dist} +Release: 7%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -469,6 +469,11 @@ exit 0 %endif %changelog +* Tue Jul 27 2010 Dan Walsh 3.8.8-7 +- Update boinc policy +- Fix sysstat policy to allow sys_admin +- Change failsafe_context to unconfined_r:unconfined_t:s0 + * Mon Jul 26 2010 Dan Walsh 3.8.8-6 - New paths for upstart diff --git a/sources b/sources index dd0fbd89..581c4ed9 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -4c7d323036f1662a06a7a4f2a7da57a5 config.tgz 1f8151f0184945098f3cc3ca0b53e861 serefpolicy-3.8.8.tgz