- Update boinc policy
- Fix sysstat policy to allow sys_admin - Change failsafe_context to unconfined_r:unconfined_t:s0
This commit is contained in:
Daniel J Walsh
parent
a1ef703492
commit
7f5d8f30d0
BIN
config.tgz
BIN
config.tgz
Binary file not shown.
107
policy-F14.patch
107
policy-F14.patch
@ -7898,7 +7898,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
|
||||
#
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.8.8/policy/modules/kernel/kernel.if
|
||||
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2010-06-08 10:35:48.000000000 -0400
|
||||
+++ serefpolicy-3.8.8/policy/modules/kernel/kernel.if 2010-07-20 10:46:10.000000000 -0400
|
||||
+++ serefpolicy-3.8.8/policy/modules/kernel/kernel.if 2010-07-27 11:47:12.000000000 -0400
|
||||
@@ -1977,7 +1977,7 @@
|
||||
')
|
||||
|
||||
@ -11831,14 +11831,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue
|
||||
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.fc serefpolicy-3.8.8/policy/modules/services/boinc.fc
|
||||
--- nsaserefpolicy/policy/modules/services/boinc.fc 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ serefpolicy-3.8.8/policy/modules/services/boinc.fc 2010-07-20 10:46:10.000000000 -0400
|
||||
@@ -0,0 +1,6 @@
|
||||
+++ serefpolicy-3.8.8/policy/modules/services/boinc.fc 2010-07-27 09:18:03.000000000 -0400
|
||||
@@ -0,0 +1,8 @@
|
||||
+
|
||||
+/etc/rc\.d/init\.d/boinc_client -- gen_context(system_u:object_r:boinc_initrc_exec_t,s0)
|
||||
+
|
||||
+/usr/bin/boinc_client -- gen_context(system_u:object_r:boinc_exec_t,s0)
|
||||
+
|
||||
+/var/lib/boinc(/.*)? gen_context(system_u:object_r:boinc_var_lib_t,s0)
|
||||
+/var/lib/boinc/projects(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
|
||||
+/var/lib/boinc/slots(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.if serefpolicy-3.8.8/policy/modules/services/boinc.if
|
||||
--- nsaserefpolicy/policy/modules/services/boinc.if 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ serefpolicy-3.8.8/policy/modules/services/boinc.if 2010-07-20 10:46:10.000000000 -0400
|
||||
@ -11996,8 +11998,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
|
||||
+')
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.te serefpolicy-3.8.8/policy/modules/services/boinc.te
|
||||
--- nsaserefpolicy/policy/modules/services/boinc.te 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ serefpolicy-3.8.8/policy/modules/services/boinc.te 2010-07-20 10:46:10.000000000 -0400
|
||||
@@ -0,0 +1,96 @@
|
||||
+++ serefpolicy-3.8.8/policy/modules/services/boinc.te 2010-07-27 09:18:03.000000000 -0400
|
||||
@@ -0,0 +1,143 @@
|
||||
+policy_module(boinc,1.0.0)
|
||||
+
|
||||
+########################################
|
||||
@ -12021,13 +12023,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
|
||||
+type boinc_var_lib_t;
|
||||
+files_type(boinc_var_lib_t)
|
||||
+
|
||||
+type boinc_project_t;
|
||||
+domain_type(boinc_project_t)
|
||||
+role system_r types boinc_project_t;
|
||||
+
|
||||
+permissive boinc_project_t;
|
||||
+
|
||||
+type boinc_project_var_lib_t;
|
||||
+files_type(boinc_project_var_lib_t)
|
||||
+
|
||||
+########################################
|
||||
+#
|
||||
+# boinc local policy
|
||||
+#
|
||||
+
|
||||
+allow boinc_t self:capability { kill };
|
||||
+allow boinc_t self:process { execmem ptrace setsched signal signull sigstop sigkill };
|
||||
+allow boinc_t self:process { setsched };
|
||||
+
|
||||
+allow boinc_t self:fifo_file rw_fifo_file_perms;
|
||||
+allow boinc_t self:unix_stream_socket create_stream_socket_perms;
|
||||
@ -12047,10 +12058,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
|
||||
+manage_files_pattern(boinc_t, boinc_var_lib_t, boinc_var_lib_t)
|
||||
+files_var_lib_filetrans(boinc_t, boinc_var_lib_t, { file dir } )
|
||||
+
|
||||
+manage_dirs_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
|
||||
+manage_files_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
|
||||
+
|
||||
+kernel_read_system_state(boinc_t)
|
||||
+kernel_read_network_state(boinc_t)
|
||||
+kernel_read_kernel_sysctls(boinc_t)
|
||||
+kernel_search_vm_sysctl(boinc_t)
|
||||
+
|
||||
+files_getattr_all_dirs(boinc_t)
|
||||
+files_getattr_all_files(boinc_t)
|
||||
+
|
||||
+corecmd_exec_bin(boinc_t)
|
||||
+corecmd_exec_shell(boinc_t)
|
||||
@ -12094,6 +12108,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin
|
||||
+sysnet_dns_name_resolve(boinc_t)
|
||||
+
|
||||
+mta_send_mail(boinc_t)
|
||||
+
|
||||
+########################################
|
||||
+#
|
||||
+# boinc-projects local policy
|
||||
+#
|
||||
+
|
||||
+domtrans_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_t)
|
||||
+
|
||||
+allow boinc_project_t self:process { ptrace setsched signal signull sigkill sigstop };
|
||||
+allow boinc_project_t self:process { execmem execstack };
|
||||
+
|
||||
+allow boinc_project_t boinc_project_var_lib_t:file entrypoint;
|
||||
+exec_files_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
|
||||
+manage_dirs_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
|
||||
+manage_files_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
|
||||
+files_var_lib_filetrans(boinc_project_t, boinc_project_var_lib_t, { file dir })
|
||||
+
|
||||
+allow boinc_project_t boinc_project_var_lib_t:file execmod;
|
||||
+
|
||||
+allow boinc_project_t boinc_t:shm rw_shm_perms;
|
||||
+allow boinc_project_t boinc_tmpfs_t:file { read write };
|
||||
+
|
||||
+rw_files_pattern(boinc_project_t, boinc_var_lib_t, boinc_var_lib_t)
|
||||
+
|
||||
+kernel_read_system_state(boinc_project_t)
|
||||
+kernel_read_kernel_sysctls(boinc_project_t)
|
||||
+kernel_search_vm_sysctl(boinc_project_t)
|
||||
+kernel_read_network_state(boinc_project_t)
|
||||
+
|
||||
+corenet_tcp_connect_boinc_port(boinc_project_t)
|
||||
+
|
||||
+dev_rw_xserver_misc(boinc_project_t)
|
||||
+
|
||||
+miscfiles_read_localization(boinc_project_t)
|
||||
+
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.fc serefpolicy-3.8.8/policy/modules/services/bugzilla.fc
|
||||
--- nsaserefpolicy/policy/modules/services/bugzilla.fc 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ serefpolicy-3.8.8/policy/modules/services/bugzilla.fc 2010-07-20 10:46:10.000000000 -0400
|
||||
@ -13716,7 +13765,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
+/var/log/mcelog.* -- gen_context(system_u:object_r:cron_log_t,s0)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.8.8/policy/modules/services/cron.if
|
||||
--- nsaserefpolicy/policy/modules/services/cron.if 2009-09-16 09:09:20.000000000 -0400
|
||||
+++ serefpolicy-3.8.8/policy/modules/services/cron.if 2010-07-23 08:29:53.000000000 -0400
|
||||
+++ serefpolicy-3.8.8/policy/modules/services/cron.if 2010-07-27 11:02:51.000000000 -0400
|
||||
@@ -12,6 +12,10 @@
|
||||
## </param>
|
||||
#
|
||||
@ -13768,11 +13817,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
')
|
||||
|
||||
role $1 types { cronjob_t crontab_t };
|
||||
@@ -116,6 +128,12 @@
|
||||
@@ -116,6 +128,13 @@
|
||||
# Transition from the user domain to the derived domain.
|
||||
domtrans_pattern($2, crontab_exec_t, crontab_t)
|
||||
|
||||
+ allow crond_t $2:process transition;
|
||||
+ dontaudit crond_t $2:process { noatsecure siginh rlimitinh };
|
||||
+ allow $2 crond_t:process sigchld;
|
||||
+
|
||||
+ # needs to be authorized SELinux context for cron
|
||||
@ -13781,7 +13831,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
# crontab shows up in user ps
|
||||
ps_process_pattern($2, crontab_t)
|
||||
allow $2 crontab_t:process signal;
|
||||
@@ -154,27 +172,14 @@
|
||||
@@ -154,27 +173,14 @@
|
||||
#
|
||||
interface(`cron_unconfined_role',`
|
||||
gen_require(`
|
||||
@ -13811,7 +13861,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
optional_policy(`
|
||||
gen_require(`
|
||||
class dbus send_msg;
|
||||
@@ -408,7 +413,43 @@
|
||||
@@ -408,7 +414,43 @@
|
||||
type crond_t;
|
||||
')
|
||||
|
||||
@ -13856,7 +13906,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -554,7 +595,7 @@
|
||||
@@ -554,7 +596,7 @@
|
||||
type system_cronjob_t;
|
||||
')
|
||||
|
||||
@ -13865,7 +13915,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -587,11 +628,14 @@
|
||||
@@ -587,11 +629,14 @@
|
||||
#
|
||||
interface(`cron_read_system_job_tmp_files',`
|
||||
gen_require(`
|
||||
@ -13881,7 +13931,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -627,7 +671,48 @@
|
||||
@@ -627,7 +672,48 @@
|
||||
interface(`cron_dontaudit_write_system_job_tmp_files',`
|
||||
gen_require(`
|
||||
type system_cronjob_tmp_t;
|
||||
@ -23045,8 +23095,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stun
|
||||
kernel_read_system_state(stunnel_t)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.8.8/policy/modules/services/sysstat.te
|
||||
--- nsaserefpolicy/policy/modules/services/sysstat.te 2010-06-18 13:07:19.000000000 -0400
|
||||
+++ serefpolicy-3.8.8/policy/modules/services/sysstat.te 2010-07-20 10:46:11.000000000 -0400
|
||||
@@ -68,3 +68,8 @@
|
||||
+++ serefpolicy-3.8.8/policy/modules/services/sysstat.te 2010-07-27 09:40:49.000000000 -0400
|
||||
@@ -18,8 +18,7 @@
|
||||
# Local policy
|
||||
#
|
||||
|
||||
-allow sysstat_t self:capability { dac_override sys_resource sys_tty_config };
|
||||
-dontaudit sysstat_t self:capability sys_admin;
|
||||
+allow sysstat_t self:capability { dac_override sys_admin sys_resource sys_tty_config };
|
||||
allow sysstat_t self:fifo_file rw_fifo_file_perms;
|
||||
|
||||
can_exec(sysstat_t, sysstat_exec_t)
|
||||
@@ -68,3 +67,8 @@
|
||||
optional_policy(`
|
||||
logging_send_syslog_msg(sysstat_t)
|
||||
')
|
||||
@ -27720,6 +27780,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.
|
||||
|
||||
domain_use_interactive_fds(iscsid_t)
|
||||
domain_dontaudit_read_all_domains_state(iscsid_t)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/kdump.te serefpolicy-3.8.8/policy/modules/system/kdump.te
|
||||
--- nsaserefpolicy/policy/modules/system/kdump.te 2010-06-18 13:07:19.000000000 -0400
|
||||
+++ serefpolicy-3.8.8/policy/modules/system/kdump.te 2010-07-27 11:47:26.000000000 -0400
|
||||
@@ -29,6 +29,7 @@
|
||||
|
||||
kernel_read_system_state(kdump_t)
|
||||
kernel_read_core_if(kdump_t)
|
||||
+kernel_read_debugfs(kdump_t)
|
||||
|
||||
dev_read_framebuffer(kdump_t)
|
||||
dev_read_sysfs(kdump_t)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.8.8/policy/modules/system/libraries.fc
|
||||
--- nsaserefpolicy/policy/modules/system/libraries.fc 2010-03-23 11:19:40.000000000 -0400
|
||||
+++ serefpolicy-3.8.8/policy/modules/system/libraries.fc 2010-07-22 10:09:46.000000000 -0400
|
||||
|
||||
@ -20,7 +20,7 @@
|
||||
Summary: SELinux policy configuration
|
||||
Name: selinux-policy
|
||||
Version: 3.8.8
|
||||
Release: 6%{?dist}
|
||||
Release: 7%{?dist}
|
||||
License: GPLv2+
|
||||
Group: System Environment/Base
|
||||
Source: serefpolicy-%{version}.tgz
|
||||
@ -469,6 +469,11 @@ exit 0
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Tue Jul 27 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-7
|
||||
- Update boinc policy
|
||||
- Fix sysstat policy to allow sys_admin
|
||||
- Change failsafe_context to unconfined_r:unconfined_t:s0
|
||||
|
||||
* Mon Jul 26 2010 Dan Walsh <dwalsh@redhat.com> 3.8.8-6
|
||||
- New paths for upstart
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user