rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Update boinc policy

Browse Source 
- Fix sysstat policy to allow sys_admin
- Change failsafe_context to unconfined_r:unconfined_t:s0
This commit is contained in:
Daniel J Walsh 2010-07-27 17:28:04 +00:00
parent a1ef703492
commit 7f5d8f30d0
4 changed files with 98 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
config.tgz
View File

Binary file not shown.

107
policy-F14.patch
View File

@ -7898,7 +7898,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
# #
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.8.8/policy/modules/kernel/kernel.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.8.8/policy/modules/kernel/kernel.if
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2010-06-08 10:35:48.000000000 -0400 --- nsaserefpolicy/policy/modules/kernel/kernel.if 2010-06-08 10:35:48.000000000 -0400
+++ serefpolicy-3.8.8/policy/modules/kernel/kernel.if 2010-07-20 10:46:10.000000000 -0400 +++ serefpolicy-3.8.8/policy/modules/kernel/kernel.if 2010-07-27 11:47:12.000000000 -0400
@@ -1977,7 +1977,7 @@ @@ -1977,7 +1977,7 @@
') ')
@ -11831,14 +11831,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.fc serefpolicy-3.8.8/policy/modules/services/boinc.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.fc serefpolicy-3.8.8/policy/modules/services/boinc.fc
--- nsaserefpolicy/policy/modules/services/boinc.fc 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/services/boinc.fc 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.8.8/policy/modules/services/boinc.fc 2010-07-20 10:46:10.000000000 -0400 +++ serefpolicy-3.8.8/policy/modules/services/boinc.fc 2010-07-27 09:18:03.000000000 -0400
@@ -0,0 +1,6 @@ @@ -0,0 +1,8 @@
+ +
+/etc/rc\.d/init\.d/boinc_client -- gen_context(system_u:object_r:boinc_initrc_exec_t,s0) +/etc/rc\.d/init\.d/boinc_client -- gen_context(system_u:object_r:boinc_initrc_exec_t,s0)
+ +
+/usr/bin/boinc_client -- gen_context(system_u:object_r:boinc_exec_t,s0) +/usr/bin/boinc_client -- gen_context(system_u:object_r:boinc_exec_t,s0)
+ +
+/var/lib/boinc(/.*)? gen_context(system_u:object_r:boinc_var_lib_t,s0) +/var/lib/boinc(/.*)? gen_context(system_u:object_r:boinc_var_lib_t,s0)
+/var/lib/boinc/projects(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
+/var/lib/boinc/slots(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.if serefpolicy-3.8.8/policy/modules/services/boinc.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.if serefpolicy-3.8.8/policy/modules/services/boinc.if
--- nsaserefpolicy/policy/modules/services/boinc.if 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/services/boinc.if 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.8.8/policy/modules/services/boinc.if 2010-07-20 10:46:10.000000000 -0400 +++ serefpolicy-3.8.8/policy/modules/services/boinc.if 2010-07-20 10:46:10.000000000 -0400
@ -11996,8 +11998,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.te serefpolicy-3.8.8/policy/modules/services/boinc.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.te serefpolicy-3.8.8/policy/modules/services/boinc.te
--- nsaserefpolicy/policy/modules/services/boinc.te 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/services/boinc.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.8.8/policy/modules/services/boinc.te 2010-07-20 10:46:10.000000000 -0400 +++ serefpolicy-3.8.8/policy/modules/services/boinc.te 2010-07-27 09:18:03.000000000 -0400
@@ -0,0 +1,96 @@ @@ -0,0 +1,143 @@
+policy_module(boinc,1.0.0) +policy_module(boinc,1.0.0)
+ +
+######################################## +########################################
@ -12021,13 +12023,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
+type boinc_var_lib_t; +type boinc_var_lib_t;
+files_type(boinc_var_lib_t) +files_type(boinc_var_lib_t)
+ +
+type boinc_project_t;
+domain_type(boinc_project_t)
+role system_r types boinc_project_t;
+
+permissive boinc_project_t;
+
+type boinc_project_var_lib_t;
+files_type(boinc_project_var_lib_t)
+
+######################################## +########################################
+# +#
+# boinc local policy +# boinc local policy
+# +#
+ +
+allow boinc_t self:capability { kill }; +allow boinc_t self:capability { kill };
+allow boinc_t self:process { execmem ptrace setsched signal signull sigstop sigkill }; +allow boinc_t self:process { setsched };
+ +
+allow boinc_t self:fifo_file rw_fifo_file_perms; +allow boinc_t self:fifo_file rw_fifo_file_perms;
+allow boinc_t self:unix_stream_socket create_stream_socket_perms; +allow boinc_t self:unix_stream_socket create_stream_socket_perms;
@ -12047,10 +12058,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
+manage_files_pattern(boinc_t, boinc_var_lib_t, boinc_var_lib_t) +manage_files_pattern(boinc_t, boinc_var_lib_t, boinc_var_lib_t)
+files_var_lib_filetrans(boinc_t, boinc_var_lib_t, { file dir } ) +files_var_lib_filetrans(boinc_t, boinc_var_lib_t, { file dir } )
+ +
+manage_dirs_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
+manage_files_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
+
+kernel_read_system_state(boinc_t) +kernel_read_system_state(boinc_t)
+kernel_read_network_state(boinc_t) +
+kernel_read_kernel_sysctls(boinc_t) +files_getattr_all_dirs(boinc_t)
+kernel_search_vm_sysctl(boinc_t) +files_getattr_all_files(boinc_t)
+ +
+corecmd_exec_bin(boinc_t) +corecmd_exec_bin(boinc_t)
+corecmd_exec_shell(boinc_t) +corecmd_exec_shell(boinc_t)
@ -12094,6 +12108,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
+sysnet_dns_name_resolve(boinc_t) +sysnet_dns_name_resolve(boinc_t)
+ +
+mta_send_mail(boinc_t) +mta_send_mail(boinc_t)
+
+########################################
+#
+# boinc-projects local policy
+#
+
+domtrans_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_t)
+
+allow boinc_project_t self:process { ptrace setsched signal signull sigkill sigstop };
+allow boinc_project_t self:process { execmem execstack };
+
+allow boinc_project_t boinc_project_var_lib_t:file entrypoint;
+exec_files_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
+manage_dirs_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
+manage_files_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
+files_var_lib_filetrans(boinc_project_t, boinc_project_var_lib_t, { file dir })
+
+allow boinc_project_t boinc_project_var_lib_t:file execmod;
+
+allow boinc_project_t boinc_t:shm rw_shm_perms;
+allow boinc_project_t boinc_tmpfs_t:file { read write };
+
+rw_files_pattern(boinc_project_t, boinc_var_lib_t, boinc_var_lib_t)
+
+kernel_read_system_state(boinc_project_t)
+kernel_read_kernel_sysctls(boinc_project_t)
+kernel_search_vm_sysctl(boinc_project_t)
+kernel_read_network_state(boinc_project_t)
+
+corenet_tcp_connect_boinc_port(boinc_project_t)
+
+dev_rw_xserver_misc(boinc_project_t)
+
+miscfiles_read_localization(boinc_project_t)
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.fc serefpolicy-3.8.8/policy/modules/services/bugzilla.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.fc serefpolicy-3.8.8/policy/modules/services/bugzilla.fc
--- nsaserefpolicy/policy/modules/services/bugzilla.fc 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/services/bugzilla.fc 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.8.8/policy/modules/services/bugzilla.fc 2010-07-20 10:46:10.000000000 -0400 +++ serefpolicy-3.8.8/policy/modules/services/bugzilla.fc 2010-07-20 10:46:10.000000000 -0400
@ -13716,7 +13765,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
+/var/log/mcelog.* -- gen_context(system_u:object_r:cron_log_t,s0) +/var/log/mcelog.* -- gen_context(system_u:object_r:cron_log_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.8.8/policy/modules/services/cron.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.8.8/policy/modules/services/cron.if
--- nsaserefpolicy/policy/modules/services/cron.if 2009-09-16 09:09:20.000000000 -0400 --- nsaserefpolicy/policy/modules/services/cron.if 2009-09-16 09:09:20.000000000 -0400
+++ serefpolicy-3.8.8/policy/modules/services/cron.if 2010-07-23 08:29:53.000000000 -0400 +++ serefpolicy-3.8.8/policy/modules/services/cron.if 2010-07-27 11:02:51.000000000 -0400
@@ -12,6 +12,10 @@ @@ -12,6 +12,10 @@
## </param> ## </param>
# #
@ -13768,11 +13817,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
') ')
role $1 types { cronjob_t crontab_t }; role $1 types { cronjob_t crontab_t };
@@ -116,6 +128,12 @@ @@ -116,6 +128,13 @@
# Transition from the user domain to the derived domain. # Transition from the user domain to the derived domain.
domtrans_pattern($2, crontab_exec_t, crontab_t) domtrans_pattern($2, crontab_exec_t, crontab_t)
+ allow crond_t $2:process transition; + allow crond_t $2:process transition;
+ dontaudit crond_t $2:process { noatsecure siginh rlimitinh };
+ allow $2 crond_t:process sigchld; + allow $2 crond_t:process sigchld;
+ +
+ # needs to be authorized SELinux context for cron + # needs to be authorized SELinux context for cron
@ -13781,7 +13831,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
# crontab shows up in user ps # crontab shows up in user ps
ps_process_pattern($2, crontab_t) ps_process_pattern($2, crontab_t)
allow $2 crontab_t:process signal; allow $2 crontab_t:process signal;
@@ -154,27 +172,14 @@ @@ -154,27 +173,14 @@
# #
interface(`cron_unconfined_role',` interface(`cron_unconfined_role',`
gen_require(` gen_require(`
@ -13811,7 +13861,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
optional_policy(` optional_policy(`
gen_require(` gen_require(`
class dbus send_msg; class dbus send_msg;
@@ -408,7 +413,43 @@ @@ -408,7 +414,43 @@
type crond_t; type crond_t;
') ')
@ -13856,7 +13906,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
') ')
######################################## ########################################
@@ -554,7 +595,7 @@ @@ -554,7 +596,7 @@
type system_cronjob_t; type system_cronjob_t;
') ')
@ -13865,7 +13915,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
') ')
######################################## ########################################
@@ -587,11 +628,14 @@ @@ -587,11 +629,14 @@
# #
interface(`cron_read_system_job_tmp_files',` interface(`cron_read_system_job_tmp_files',`
gen_require(` gen_require(`
@ -13881,7 +13931,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
') ')
######################################## ########################################
@@ -627,7 +671,48 @@ @@ -627,7 +672,48 @@
interface(`cron_dontaudit_write_system_job_tmp_files',` interface(`cron_dontaudit_write_system_job_tmp_files',`
gen_require(` gen_require(`
type system_cronjob_tmp_t; type system_cronjob_tmp_t;
@ -23045,8 +23095,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stun
kernel_read_system_state(stunnel_t) kernel_read_system_state(stunnel_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.8.8/policy/modules/services/sysstat.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.8.8/policy/modules/services/sysstat.te
--- nsaserefpolicy/policy/modules/services/sysstat.te 2010-06-18 13:07:19.000000000 -0400 --- nsaserefpolicy/policy/modules/services/sysstat.te 2010-06-18 13:07:19.000000000 -0400
+++ serefpolicy-3.8.8/policy/modules/services/sysstat.te 2010-07-20 10:46:11.000000000 -0400 +++ serefpolicy-3.8.8/policy/modules/services/sysstat.te 2010-07-27 09:40:49.000000000 -0400
@@ -68,3 +68,8 @@ @@ -18,8 +18,7 @@
# Local policy
#
-allow sysstat_t self:capability { dac_override sys_resource sys_tty_config };
-dontaudit sysstat_t self:capability sys_admin;
+allow sysstat_t self:capability { dac_override sys_admin sys_resource sys_tty_config };
allow sysstat_t self:fifo_file rw_fifo_file_perms;
can_exec(sysstat_t, sysstat_exec_t)
@@ -68,3 +67,8 @@
optional_policy(` optional_policy(`
logging_send_syslog_msg(sysstat_t) logging_send_syslog_msg(sysstat_t)
') ')
@ -27720,6 +27780,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.
domain_use_interactive_fds(iscsid_t) domain_use_interactive_fds(iscsid_t)
domain_dontaudit_read_all_domains_state(iscsid_t) domain_dontaudit_read_all_domains_state(iscsid_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/kdump.te serefpolicy-3.8.8/policy/modules/system/kdump.te
--- nsaserefpolicy/policy/modules/system/kdump.te 2010-06-18 13:07:19.000000000 -0400
+++ serefpolicy-3.8.8/policy/modules/system/kdump.te 2010-07-27 11:47:26.000000000 -0400
@@ -29,6 +29,7 @@
kernel_read_system_state(kdump_t)
kernel_read_core_if(kdump_t)
+kernel_read_debugfs(kdump_t)
dev_read_framebuffer(kdump_t)
dev_read_sysfs(kdump_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.8.8/policy/modules/system/libraries.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.8.8/policy/modules/system/libraries.fc
--- nsaserefpolicy/policy/modules/system/libraries.fc 2010-03-23 11:19:40.000000000 -0400 --- nsaserefpolicy/policy/modules/system/libraries.fc 2010-03-23 11:19:40.000000000 -0400
+++ serefpolicy-3.8.8/policy/modules/system/libraries.fc 2010-07-22 10:09:46.000000000 -0400 +++ serefpolicy-3.8.8/policy/modules/system/libraries.fc 2010-07-22 10:09:46.000000000 -0400

7
selinux-policy.spec
View File

@ -20,7 +20,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.8.8 Version: 3.8.8
Release: 6%{?dist} Release: 7%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -469,6 +469,11 @@ exit 0
%endif %endif
%changelog %changelog
* Tue Jul 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-7
- Update boinc policy
- Fix sysstat policy to allow sys_admin
- Change failsafe_context to unconfined_r:unconfined_t:s0
* Mon Jul 26 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-6 * Mon Jul 26 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-6
- New paths for upstart - New paths for upstart

1
sources
View File

@ -1,2 +1 @@
4c7d323036f1662a06a7a4f2a7da57a5 config.tgz
1f8151f0184945098f3cc3ca0b53e861 serefpolicy-3.8.8.tgz 1f8151f0184945098f3cc3ca0b53e861 serefpolicy-3.8.8.tgz