- Don't audit access checks by sandbox xserver on xdb var_lib
- Allow ntop to read usbmon devices - Add labeling for new polcykit authorizor - Dontaudit access checks from fail2ban_client - Don't audit access checks by sandbox xserver on xdb var_lib - Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream - Fix labeling for all /usr/bim/razor-lightdm-* binaries - Add filename trans for /dev/md126p1
This commit is contained in:
parent
859a101f23
commit
82acdf3079
@ -15142,7 +15142,7 @@ index 54f1827..cc2de1a 100644
|
|||||||
+/usr/lib/udev/devices/loop.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
|
+/usr/lib/udev/devices/loop.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
|
||||||
+/usr/lib/udev/devices/fuse -c gen_context(system_u:object_r:fuse_device_t,s0)
|
+/usr/lib/udev/devices/fuse -c gen_context(system_u:object_r:fuse_device_t,s0)
|
||||||
diff --git a/policy/modules/kernel/storage.if b/policy/modules/kernel/storage.if
|
diff --git a/policy/modules/kernel/storage.if b/policy/modules/kernel/storage.if
|
||||||
index 1700ef2..f8f6456 100644
|
index 1700ef2..38b597e 100644
|
||||||
--- a/policy/modules/kernel/storage.if
|
--- a/policy/modules/kernel/storage.if
|
||||||
+++ b/policy/modules/kernel/storage.if
|
+++ b/policy/modules/kernel/storage.if
|
||||||
@@ -22,6 +22,26 @@ interface(`storage_getattr_fixed_disk_dev',`
|
@@ -22,6 +22,26 @@ interface(`storage_getattr_fixed_disk_dev',`
|
||||||
@ -15181,7 +15181,15 @@ index 1700ef2..f8f6456 100644
|
|||||||
typeattribute $1 fixed_disk_raw_read;
|
typeattribute $1 fixed_disk_raw_read;
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -205,6 +227,7 @@ interface(`storage_create_fixed_disk_dev',`
|
@@ -186,6 +208,7 @@ interface(`storage_dontaudit_write_fixed_disk',`
|
||||||
|
interface(`storage_raw_rw_fixed_disk',`
|
||||||
|
storage_raw_read_fixed_disk($1)
|
||||||
|
storage_raw_write_fixed_disk($1)
|
||||||
|
+ dev_rw_generic_blk_files($1)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
@@ -205,6 +228,7 @@ interface(`storage_create_fixed_disk_dev',`
|
||||||
|
|
||||||
allow $1 self:capability mknod;
|
allow $1 self:capability mknod;
|
||||||
allow $1 fixed_disk_device_t:blk_file create_blk_file_perms;
|
allow $1 fixed_disk_device_t:blk_file create_blk_file_perms;
|
||||||
@ -15189,7 +15197,7 @@ index 1700ef2..f8f6456 100644
|
|||||||
dev_add_entry_generic_dirs($1)
|
dev_add_entry_generic_dirs($1)
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -269,6 +292,48 @@ interface(`storage_dev_filetrans_fixed_disk',`
|
@@ -269,6 +293,48 @@ interface(`storage_dev_filetrans_fixed_disk',`
|
||||||
dev_filetrans($1, fixed_disk_device_t, blk_file)
|
dev_filetrans($1, fixed_disk_device_t, blk_file)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -15238,7 +15246,7 @@ index 1700ef2..f8f6456 100644
|
|||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Create block devices in on a tmpfs filesystem with the
|
## Create block devices in on a tmpfs filesystem with the
|
||||||
@@ -711,6 +776,24 @@ interface(`storage_dontaudit_raw_write_removable_device',`
|
@@ -711,6 +777,24 @@ interface(`storage_dontaudit_raw_write_removable_device',`
|
||||||
dontaudit $1 removable_device_t:blk_file write_blk_file_perms;
|
dontaudit $1 removable_device_t:blk_file write_blk_file_perms;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -15263,7 +15271,7 @@ index 1700ef2..f8f6456 100644
|
|||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Allow the caller to directly read
|
## Allow the caller to directly read
|
||||||
@@ -808,3 +891,400 @@ interface(`storage_unconfined',`
|
@@ -808,3 +892,401 @@ interface(`storage_unconfined',`
|
||||||
|
|
||||||
typeattribute $1 storage_unconfined_type;
|
typeattribute $1 storage_unconfined_type;
|
||||||
')
|
')
|
||||||
@ -15374,6 +15382,7 @@ index 1700ef2..f8f6456 100644
|
|||||||
+ dev_filetrans($1, fixed_disk_device_t, blk_file, "md7")
|
+ dev_filetrans($1, fixed_disk_device_t, blk_file, "md7")
|
||||||
+ dev_filetrans($1, fixed_disk_device_t, blk_file, "md8")
|
+ dev_filetrans($1, fixed_disk_device_t, blk_file, "md8")
|
||||||
+ dev_filetrans($1, fixed_disk_device_t, blk_file, "md9")
|
+ dev_filetrans($1, fixed_disk_device_t, blk_file, "md9")
|
||||||
|
+ dev_filetrans($1, fixed_disk_device_t, blk_file, "md126p1")
|
||||||
+ dev_filetrans($1, fixed_disk_device_t, blk_file, "sda")
|
+ dev_filetrans($1, fixed_disk_device_t, blk_file, "sda")
|
||||||
+ dev_filetrans($1, fixed_disk_device_t, blk_file, "sda0")
|
+ dev_filetrans($1, fixed_disk_device_t, blk_file, "sda0")
|
||||||
+ dev_filetrans($1, fixed_disk_device_t, blk_file, "sda1")
|
+ dev_filetrans($1, fixed_disk_device_t, blk_file, "sda1")
|
||||||
@ -20595,7 +20604,7 @@ index 5fc0391..994eec2 100644
|
|||||||
+ xserver_rw_xdm_pipes(ssh_agent_type)
|
+ xserver_rw_xdm_pipes(ssh_agent_type)
|
||||||
+')
|
+')
|
||||||
diff --git a/policy/modules/services/xserver.fc b/policy/modules/services/xserver.fc
|
diff --git a/policy/modules/services/xserver.fc b/policy/modules/services/xserver.fc
|
||||||
index d1f64a0..97140ee 100644
|
index d1f64a0..156a29f 100644
|
||||||
--- a/policy/modules/services/xserver.fc
|
--- a/policy/modules/services/xserver.fc
|
||||||
+++ b/policy/modules/services/xserver.fc
|
+++ b/policy/modules/services/xserver.fc
|
||||||
@@ -2,13 +2,35 @@
|
@@ -2,13 +2,35 @@
|
||||||
@ -20685,7 +20694,7 @@ index d1f64a0..97140ee 100644
|
|||||||
+
|
+
|
||||||
/usr/bin/gpe-dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
/usr/bin/gpe-dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
||||||
/usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0)
|
/usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0)
|
||||||
+/usr/bin/razor-lightdm-greeter -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
+/usr/bin/razor-lightdm-* -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
||||||
/usr/bin/slim -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
/usr/bin/slim -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
||||||
/usr/bin/Xair -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
/usr/bin/Xair -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
||||||
+/usr/bin/Xephyr -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
+/usr/bin/Xephyr -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
||||||
@ -20752,7 +20761,7 @@ index d1f64a0..97140ee 100644
|
|||||||
+/var/lib/pqsql/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
|
+/var/lib/pqsql/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
|
||||||
+
|
+
|
||||||
diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if
|
diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if
|
||||||
index 6bf0ecc..18223e7 100644
|
index 6bf0ecc..9388756 100644
|
||||||
--- a/policy/modules/services/xserver.if
|
--- a/policy/modules/services/xserver.if
|
||||||
+++ b/policy/modules/services/xserver.if
|
+++ b/policy/modules/services/xserver.if
|
||||||
@@ -19,9 +19,10 @@
|
@@ -19,9 +19,10 @@
|
||||||
@ -21224,18 +21233,19 @@ index 6bf0ecc..18223e7 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -765,11 +904,91 @@ interface(`xserver_manage_xdm_spool_files',`
|
@@ -765,11 +904,92 @@ interface(`xserver_manage_xdm_spool_files',`
|
||||||
#
|
#
|
||||||
interface(`xserver_stream_connect_xdm',`
|
interface(`xserver_stream_connect_xdm',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
- type xdm_t, xdm_tmp_t;
|
- type xdm_t, xdm_tmp_t;
|
||||||
+ type xdm_t, xdm_tmp_t, xdm_var_run_t;
|
+ type xdm_t, xdm_tmp_t, xdm_var_run_t;
|
||||||
|
+ type xdm_dbusd_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
files_search_tmp($1)
|
files_search_tmp($1)
|
||||||
- stream_connect_pattern($1, xdm_tmp_t, xdm_tmp_t, xdm_t)
|
- stream_connect_pattern($1, xdm_tmp_t, xdm_tmp_t, xdm_t)
|
||||||
+ files_search_pids($1)
|
+ files_search_pids($1)
|
||||||
+ stream_connect_pattern($1, { xdm_tmp_t xdm_var_run_t }, { xdm_tmp_t xdm_var_run_t }, xdm_t)
|
+ stream_connect_pattern($1, { xdm_tmp_t xdm_var_run_t }, { xdm_tmp_t xdm_var_run_t }, { xdm_t xdm_dbusd_t } )
|
||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
+########################################
|
+########################################
|
||||||
@ -21318,7 +21328,7 @@ index 6bf0ecc..18223e7 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -793,6 +1012,25 @@ interface(`xserver_read_xdm_rw_config',`
|
@@ -793,6 +1013,25 @@ interface(`xserver_read_xdm_rw_config',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -21344,7 +21354,7 @@ index 6bf0ecc..18223e7 100644
|
|||||||
## Set the attributes of XDM temporary directories.
|
## Set the attributes of XDM temporary directories.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -806,7 +1044,25 @@ interface(`xserver_setattr_xdm_tmp_dirs',`
|
@@ -806,7 +1045,25 @@ interface(`xserver_setattr_xdm_tmp_dirs',`
|
||||||
type xdm_tmp_t;
|
type xdm_tmp_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -21371,7 +21381,7 @@ index 6bf0ecc..18223e7 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -846,7 +1102,26 @@ interface(`xserver_read_xdm_pid',`
|
@@ -846,7 +1103,26 @@ interface(`xserver_read_xdm_pid',`
|
||||||
')
|
')
|
||||||
|
|
||||||
files_search_pids($1)
|
files_search_pids($1)
|
||||||
@ -21399,7 +21409,7 @@ index 6bf0ecc..18223e7 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -869,6 +1144,24 @@ interface(`xserver_read_xdm_lib_files',`
|
@@ -869,6 +1145,24 @@ interface(`xserver_read_xdm_lib_files',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -21424,7 +21434,7 @@ index 6bf0ecc..18223e7 100644
|
|||||||
## Make an X session script an entrypoint for the specified domain.
|
## Make an X session script an entrypoint for the specified domain.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -938,7 +1231,26 @@ interface(`xserver_getattr_log',`
|
@@ -938,7 +1232,26 @@ interface(`xserver_getattr_log',`
|
||||||
')
|
')
|
||||||
|
|
||||||
logging_search_logs($1)
|
logging_search_logs($1)
|
||||||
@ -21452,7 +21462,7 @@ index 6bf0ecc..18223e7 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -957,7 +1269,7 @@ interface(`xserver_dontaudit_write_log',`
|
@@ -957,7 +1270,7 @@ interface(`xserver_dontaudit_write_log',`
|
||||||
type xserver_log_t;
|
type xserver_log_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -21461,66 +21471,167 @@ index 6bf0ecc..18223e7 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1004,6 +1316,45 @@ interface(`xserver_read_xkb_libs',`
|
@@ -1004,7 +1317,7 @@ interface(`xserver_read_xkb_libs',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
+## Read xdm config files.
|
-## Read xdm temporary files.
|
||||||
+## </summary>
|
+## dontaudit access checks X keyboard extension libraries.
|
||||||
+## <param name="domain">
|
|
||||||
+## <summary>
|
|
||||||
+## Domain to not audit
|
|
||||||
+## </summary>
|
|
||||||
+## </param>
|
|
||||||
+#
|
|
||||||
+interface(`xserver_read_xdm_etc_files',`
|
|
||||||
+ gen_require(`
|
|
||||||
+ type xdm_etc_t;
|
|
||||||
+ ')
|
|
||||||
+
|
|
||||||
+ files_search_etc($1)
|
|
||||||
+ read_files_pattern($1, xdm_etc_t, xdm_etc_t)
|
|
||||||
+ read_lnk_files_pattern($1, xdm_etc_t, xdm_etc_t)
|
|
||||||
+')
|
|
||||||
+
|
|
||||||
+########################################
|
|
||||||
+## <summary>
|
|
||||||
+## Manage xdm config files.
|
|
||||||
+## </summary>
|
|
||||||
+## <param name="domain">
|
|
||||||
+## <summary>
|
|
||||||
+## Domain to not audit
|
|
||||||
+## </summary>
|
|
||||||
+## </param>
|
|
||||||
+#
|
|
||||||
+interface(`xserver_manage_xdm_etc_files',`
|
|
||||||
+ gen_require(`
|
|
||||||
+ type xdm_etc_t;
|
|
||||||
+ ')
|
|
||||||
+
|
|
||||||
+ files_search_etc($1)
|
|
||||||
+ manage_files_pattern($1, xdm_etc_t, xdm_etc_t)
|
|
||||||
+')
|
|
||||||
+
|
|
||||||
+########################################
|
|
||||||
+## <summary>
|
|
||||||
## Read xdm temporary files.
|
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -1017,7 +1368,7 @@ interface(`xserver_read_xdm_tmp_files',`
|
## <summary>
|
||||||
type xdm_tmp_t;
|
@@ -1012,56 +1325,57 @@ interface(`xserver_read_xkb_libs',`
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
-interface(`xserver_read_xdm_tmp_files',`
|
||||||
|
+interface(`xserver_dontaudit_xkb_libs_access',`
|
||||||
|
gen_require(`
|
||||||
|
- type xdm_tmp_t;
|
||||||
|
+ type xkb_var_lib_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
- files_search_tmp($1)
|
- files_search_tmp($1)
|
||||||
+ files_search_tmp($1)
|
- read_files_pattern($1, xdm_tmp_t, xdm_tmp_t)
|
||||||
read_files_pattern($1, xdm_tmp_t, xdm_tmp_t)
|
+ dontaudit $1 xkb_var_lib_t:dir audit_access;
|
||||||
|
+ dontaudit $1 xkb_var_lib_t:file audit_access;
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -1079,7 +1430,43 @@ interface(`xserver_manage_xdm_tmp_files',`
|
########################################
|
||||||
|
## <summary>
|
||||||
|
-## Do not audit attempts to read xdm temporary files.
|
||||||
|
+## Read xdm config files.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
-## Domain to not audit.
|
||||||
|
+## Domain to not audit
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
-interface(`xserver_dontaudit_read_xdm_tmp_files',`
|
||||||
|
+interface(`xserver_read_xdm_etc_files',`
|
||||||
|
gen_require(`
|
||||||
|
- type xdm_tmp_t;
|
||||||
|
+ type xdm_etc_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
- dontaudit $1 xdm_tmp_t:dir search_dir_perms;
|
||||||
|
- dontaudit $1 xdm_tmp_t:file read_file_perms;
|
||||||
|
+ files_search_etc($1)
|
||||||
|
+ read_files_pattern($1, xdm_etc_t, xdm_etc_t)
|
||||||
|
+ read_lnk_files_pattern($1, xdm_etc_t, xdm_etc_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
-## Read write xdm temporary files.
|
||||||
|
+## Manage xdm config files.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
-## Domain allowed access.
|
||||||
|
+## Domain to not audit
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
-interface(`xserver_rw_xdm_tmp_files',`
|
||||||
|
+interface(`xserver_manage_xdm_etc_files',`
|
||||||
|
gen_require(`
|
||||||
|
- type xdm_tmp_t;
|
||||||
|
+ type xdm_etc_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
- allow $1 xdm_tmp_t:dir search_dir_perms;
|
||||||
|
- allow $1 xdm_tmp_t:file rw_file_perms;
|
||||||
|
+ files_search_etc($1)
|
||||||
|
+ manage_files_pattern($1, xdm_etc_t, xdm_etc_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
-## Create, read, write, and delete xdm temporary files.
|
||||||
|
+## Read xdm temporary files.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
@@ -1069,18 +1383,18 @@ interface(`xserver_rw_xdm_tmp_files',`
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
-interface(`xserver_manage_xdm_tmp_files',`
|
||||||
|
+interface(`xserver_read_xdm_tmp_files',`
|
||||||
|
gen_require(`
|
||||||
|
type xdm_tmp_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
- manage_files_pattern($1, xdm_tmp_t, xdm_tmp_t)
|
||||||
|
+ files_search_tmp($1)
|
||||||
|
+ read_files_pattern($1, xdm_tmp_t, xdm_tmp_t)
|
||||||
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
-## Do not audit attempts to get the attributes of
|
-## Do not audit attempts to get the attributes of
|
||||||
|
-## xdm temporary named sockets.
|
||||||
|
+## Do not audit attempts to read xdm temporary files.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
@@ -1088,12 +1402,105 @@ interface(`xserver_manage_xdm_tmp_files',`
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
-interface(`xserver_dontaudit_getattr_xdm_tmp_sockets',`
|
||||||
|
+interface(`xserver_dontaudit_read_xdm_tmp_files',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type xdm_tmp_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ dontaudit $1 xdm_tmp_t:dir search_dir_perms;
|
||||||
|
+ dontaudit $1 xdm_tmp_t:file read_file_perms;
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Read write xdm temporary files.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`xserver_rw_xdm_tmp_files',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type xdm_tmp_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ allow $1 xdm_tmp_t:dir search_dir_perms;
|
||||||
|
+ allow $1 xdm_tmp_t:file rw_file_perms;
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Create, read, write, and delete xdm temporary files.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`xserver_manage_xdm_tmp_files',`
|
||||||
|
gen_require(`
|
||||||
|
type xdm_tmp_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
- dontaudit $1 xdm_tmp_t:sock_file getattr;
|
||||||
|
+ manage_files_pattern($1, xdm_tmp_t, xdm_tmp_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
+## Create, read, write, and delete xdm temporary dirs.
|
+## Create, read, write, and delete xdm temporary dirs.
|
||||||
+## </summary>
|
+## </summary>
|
||||||
+## <param name="domain">
|
+## <param name="domain">
|
||||||
@ -21558,19 +21669,24 @@ index 6bf0ecc..18223e7 100644
|
|||||||
+########################################
|
+########################################
|
||||||
+## <summary>
|
+## <summary>
|
||||||
+## Do not audit attempts to get the attributes of
|
+## Do not audit attempts to get the attributes of
|
||||||
## xdm temporary named sockets.
|
+## xdm temporary named sockets.
|
||||||
## </summary>
|
+## </summary>
|
||||||
## <param name="domain">
|
+## <param name="domain">
|
||||||
@@ -1093,7 +1480,7 @@ interface(`xserver_dontaudit_getattr_xdm_tmp_sockets',`
|
+## <summary>
|
||||||
type xdm_tmp_t;
|
+## Domain to not audit.
|
||||||
')
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
- dontaudit $1 xdm_tmp_t:sock_file getattr;
|
+#
|
||||||
|
+interface(`xserver_dontaudit_getattr_xdm_tmp_sockets',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type xdm_tmp_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
+ dontaudit $1 xdm_tmp_t:sock_file getattr_sock_file_perms;
|
+ dontaudit $1 xdm_tmp_t:sock_file getattr_sock_file_perms;
|
||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1111,8 +1498,10 @@ interface(`xserver_domtrans',`
|
@@ -1111,8 +1518,10 @@ interface(`xserver_domtrans',`
|
||||||
type xserver_t, xserver_exec_t;
|
type xserver_t, xserver_exec_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -21582,7 +21698,7 @@ index 6bf0ecc..18223e7 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1210,6 +1599,25 @@ interface(`xserver_dontaudit_rw_stream_sockets',`
|
@@ -1210,6 +1619,25 @@ interface(`xserver_dontaudit_rw_stream_sockets',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -21608,7 +21724,7 @@ index 6bf0ecc..18223e7 100644
|
|||||||
## Connect to the X server over a unix domain
|
## Connect to the X server over a unix domain
|
||||||
## stream socket.
|
## stream socket.
|
||||||
## </summary>
|
## </summary>
|
||||||
@@ -1226,6 +1634,26 @@ interface(`xserver_stream_connect',`
|
@@ -1226,6 +1654,26 @@ interface(`xserver_stream_connect',`
|
||||||
|
|
||||||
files_search_tmp($1)
|
files_search_tmp($1)
|
||||||
stream_connect_pattern($1, xserver_tmp_t, xserver_tmp_t, xserver_t)
|
stream_connect_pattern($1, xserver_tmp_t, xserver_tmp_t, xserver_t)
|
||||||
@ -21635,7 +21751,7 @@ index 6bf0ecc..18223e7 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1251,7 +1679,7 @@ interface(`xserver_read_tmp_files',`
|
@@ -1251,7 +1699,7 @@ interface(`xserver_read_tmp_files',`
|
||||||
## <summary>
|
## <summary>
|
||||||
## Interface to provide X object permissions on a given X server to
|
## Interface to provide X object permissions on a given X server to
|
||||||
## an X client domain. Gives the domain permission to read the
|
## an X client domain. Gives the domain permission to read the
|
||||||
@ -21644,7 +21760,7 @@ index 6bf0ecc..18223e7 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -1261,13 +1689,23 @@ interface(`xserver_read_tmp_files',`
|
@@ -1261,13 +1709,23 @@ interface(`xserver_read_tmp_files',`
|
||||||
#
|
#
|
||||||
interface(`xserver_manage_core_devices',`
|
interface(`xserver_manage_core_devices',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -21669,7 +21785,7 @@ index 6bf0ecc..18223e7 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1284,10 +1722,604 @@ interface(`xserver_manage_core_devices',`
|
@@ -1284,10 +1742,604 @@ interface(`xserver_manage_core_devices',`
|
||||||
#
|
#
|
||||||
interface(`xserver_unconfined',`
|
interface(`xserver_unconfined',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -23864,7 +23980,7 @@ index 28ad538..ebe81bf 100644
|
|||||||
-/var/run/user(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
|
-/var/run/user(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
|
||||||
/var/(db|lib|adm)/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
|
/var/(db|lib|adm)/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
|
||||||
diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
|
diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
|
||||||
index 3efd5b6..c7f52c2 100644
|
index 3efd5b6..2f6ba05 100644
|
||||||
--- a/policy/modules/system/authlogin.if
|
--- a/policy/modules/system/authlogin.if
|
||||||
+++ b/policy/modules/system/authlogin.if
|
+++ b/policy/modules/system/authlogin.if
|
||||||
@@ -23,11 +23,17 @@ interface(`auth_role',`
|
@@ -23,11 +23,17 @@ interface(`auth_role',`
|
||||||
@ -24054,16 +24170,7 @@ index 3efd5b6..c7f52c2 100644
|
|||||||
## Execute a login_program in the target domain,
|
## Execute a login_program in the target domain,
|
||||||
## with a range transition.
|
## with a range transition.
|
||||||
## </summary>
|
## </summary>
|
||||||
@@ -395,6 +432,8 @@ interface(`auth_domtrans_chk_passwd',`
|
@@ -402,6 +439,8 @@ interface(`auth_domtrans_chk_passwd',`
|
||||||
')
|
|
||||||
|
|
||||||
optional_policy(`
|
|
||||||
+ pcscd_manage_pub_files($1)
|
|
||||||
+ pcscd_manage_pub_pipes($1)
|
|
||||||
pcscd_read_pid_files($1)
|
|
||||||
pcscd_stream_connect($1)
|
|
||||||
')
|
|
||||||
@@ -402,6 +441,8 @@ interface(`auth_domtrans_chk_passwd',`
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
samba_stream_connect_winbind($1)
|
samba_stream_connect_winbind($1)
|
||||||
')
|
')
|
||||||
@ -24072,7 +24179,7 @@ index 3efd5b6..c7f52c2 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -448,6 +489,25 @@ interface(`auth_run_chk_passwd',`
|
@@ -448,6 +487,25 @@ interface(`auth_run_chk_passwd',`
|
||||||
|
|
||||||
auth_domtrans_chk_passwd($1)
|
auth_domtrans_chk_passwd($1)
|
||||||
role $2 types chkpwd_t;
|
role $2 types chkpwd_t;
|
||||||
@ -24098,7 +24205,7 @@ index 3efd5b6..c7f52c2 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -467,7 +527,6 @@ interface(`auth_domtrans_upd_passwd',`
|
@@ -467,7 +525,6 @@ interface(`auth_domtrans_upd_passwd',`
|
||||||
|
|
||||||
domtrans_pattern($1, updpwd_exec_t, updpwd_t)
|
domtrans_pattern($1, updpwd_exec_t, updpwd_t)
|
||||||
auth_dontaudit_read_shadow($1)
|
auth_dontaudit_read_shadow($1)
|
||||||
@ -24106,7 +24213,7 @@ index 3efd5b6..c7f52c2 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -664,6 +723,10 @@ interface(`auth_manage_shadow',`
|
@@ -664,6 +721,10 @@ interface(`auth_manage_shadow',`
|
||||||
|
|
||||||
allow $1 shadow_t:file manage_file_perms;
|
allow $1 shadow_t:file manage_file_perms;
|
||||||
typeattribute $1 can_read_shadow_passwords, can_write_shadow_passwords;
|
typeattribute $1 can_read_shadow_passwords, can_write_shadow_passwords;
|
||||||
@ -24117,7 +24224,7 @@ index 3efd5b6..c7f52c2 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
#######################################
|
#######################################
|
||||||
@@ -763,7 +826,50 @@ interface(`auth_rw_faillog',`
|
@@ -763,7 +824,50 @@ interface(`auth_rw_faillog',`
|
||||||
')
|
')
|
||||||
|
|
||||||
logging_search_logs($1)
|
logging_search_logs($1)
|
||||||
@ -24169,7 +24276,7 @@ index 3efd5b6..c7f52c2 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
#######################################
|
#######################################
|
||||||
@@ -824,9 +930,29 @@ interface(`auth_rw_lastlog',`
|
@@ -824,9 +928,29 @@ interface(`auth_rw_lastlog',`
|
||||||
allow $1 lastlog_t:file { rw_file_perms lock setattr };
|
allow $1 lastlog_t:file { rw_file_perms lock setattr };
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -24200,7 +24307,7 @@ index 3efd5b6..c7f52c2 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -834,12 +960,27 @@ interface(`auth_rw_lastlog',`
|
@@ -834,12 +958,27 @@ interface(`auth_rw_lastlog',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -24231,7 +24338,7 @@ index 3efd5b6..c7f52c2 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -854,15 +995,15 @@ interface(`auth_domtrans_pam',`
|
@@ -854,15 +993,15 @@ interface(`auth_domtrans_pam',`
|
||||||
#
|
#
|
||||||
interface(`auth_signal_pam',`
|
interface(`auth_signal_pam',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -24250,7 +24357,7 @@ index 3efd5b6..c7f52c2 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -875,13 +1016,33 @@ interface(`auth_signal_pam',`
|
@@ -875,13 +1014,33 @@ interface(`auth_signal_pam',`
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -24288,7 +24395,7 @@ index 3efd5b6..c7f52c2 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -959,9 +1120,30 @@ interface(`auth_manage_var_auth',`
|
@@ -959,9 +1118,30 @@ interface(`auth_manage_var_auth',`
|
||||||
')
|
')
|
||||||
|
|
||||||
files_search_var($1)
|
files_search_var($1)
|
||||||
@ -24322,7 +24429,7 @@ index 3efd5b6..c7f52c2 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1040,6 +1222,10 @@ interface(`auth_manage_pam_pid',`
|
@@ -1040,6 +1220,10 @@ interface(`auth_manage_pam_pid',`
|
||||||
files_search_pids($1)
|
files_search_pids($1)
|
||||||
allow $1 pam_var_run_t:dir manage_dir_perms;
|
allow $1 pam_var_run_t:dir manage_dir_perms;
|
||||||
allow $1 pam_var_run_t:file manage_file_perms;
|
allow $1 pam_var_run_t:file manage_file_perms;
|
||||||
@ -24333,7 +24440,7 @@ index 3efd5b6..c7f52c2 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1176,6 +1362,7 @@ interface(`auth_manage_pam_console_data',`
|
@@ -1176,6 +1360,7 @@ interface(`auth_manage_pam_console_data',`
|
||||||
files_search_pids($1)
|
files_search_pids($1)
|
||||||
manage_files_pattern($1, pam_var_console_t, pam_var_console_t)
|
manage_files_pattern($1, pam_var_console_t, pam_var_console_t)
|
||||||
manage_lnk_files_pattern($1, pam_var_console_t, pam_var_console_t)
|
manage_lnk_files_pattern($1, pam_var_console_t, pam_var_console_t)
|
||||||
@ -24341,7 +24448,7 @@ index 3efd5b6..c7f52c2 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
#######################################
|
#######################################
|
||||||
@@ -1576,6 +1763,25 @@ interface(`auth_setattr_login_records',`
|
@@ -1576,6 +1761,25 @@ interface(`auth_setattr_login_records',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -24367,7 +24474,7 @@ index 3efd5b6..c7f52c2 100644
|
|||||||
## Read login records files (/var/log/wtmp).
|
## Read login records files (/var/log/wtmp).
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -1726,24 +1932,7 @@ interface(`auth_manage_login_records',`
|
@@ -1726,24 +1930,7 @@ interface(`auth_manage_login_records',`
|
||||||
|
|
||||||
logging_rw_generic_log_dirs($1)
|
logging_rw_generic_log_dirs($1)
|
||||||
allow $1 wtmp_t:file manage_file_perms;
|
allow $1 wtmp_t:file manage_file_perms;
|
||||||
@ -24393,7 +24500,7 @@ index 3efd5b6..c7f52c2 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1767,11 +1956,13 @@ interface(`auth_relabel_login_records',`
|
@@ -1767,11 +1954,13 @@ interface(`auth_relabel_login_records',`
|
||||||
## <infoflow type="both" weight="10"/>
|
## <infoflow type="both" weight="10"/>
|
||||||
#
|
#
|
||||||
interface(`auth_use_nsswitch',`
|
interface(`auth_use_nsswitch',`
|
||||||
@ -24410,7 +24517,7 @@ index 3efd5b6..c7f52c2 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1805,3 +1996,219 @@ interface(`auth_unconfined',`
|
@@ -1805,3 +1994,219 @@ interface(`auth_unconfined',`
|
||||||
typeattribute $1 can_write_shadow_passwords;
|
typeattribute $1 can_write_shadow_passwords;
|
||||||
typeattribute $1 can_relabelto_shadow_passwords;
|
typeattribute $1 can_relabelto_shadow_passwords;
|
||||||
')
|
')
|
||||||
@ -28821,7 +28928,7 @@ index 5dfa44b..2502d06 100644
|
|||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc
|
diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc
|
||||||
index 73bb3c0..dc79c6f 100644
|
index 73bb3c0..6e848de 100644
|
||||||
--- a/policy/modules/system/libraries.fc
|
--- a/policy/modules/system/libraries.fc
|
||||||
+++ b/policy/modules/system/libraries.fc
|
+++ b/policy/modules/system/libraries.fc
|
||||||
@@ -1,3 +1,4 @@
|
@@ -1,3 +1,4 @@
|
||||||
@ -28983,7 +29090,7 @@ index 73bb3c0..dc79c6f 100644
|
|||||||
|
|
||||||
/usr/(.*/)?intellinux/SPPlugins/ADMPlugin\.apl -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
/usr/(.*/)?intellinux/SPPlugins/ADMPlugin\.apl -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||||
|
|
||||||
@@ -299,17 +310,153 @@ HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:te
|
@@ -299,17 +310,155 @@ HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:te
|
||||||
#
|
#
|
||||||
/var/cache/ldconfig(/.*)? gen_context(system_u:object_r:ldconfig_cache_t,s0)
|
/var/cache/ldconfig(/.*)? gen_context(system_u:object_r:ldconfig_cache_t,s0)
|
||||||
|
|
||||||
@ -29141,6 +29248,8 @@ index 73bb3c0..dc79c6f 100644
|
|||||||
+/opt/google/picasa/.*\.dll -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
+/opt/google/picasa/.*\.dll -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||||
+/opt/google/picasa/.*\.yti -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
+/opt/google/picasa/.*\.yti -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||||
+/opt/google/chrome/.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
+/opt/google/chrome/.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||||
|
+/opt/google/talkplugin/.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||||
|
+/opt/google/[^/]*/.*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||||
+
|
+
|
||||||
+/usr/sbin/ldconfig -- gen_context(system_u:object_r:ldconfig_exec_t,s0)
|
+/usr/sbin/ldconfig -- gen_context(system_u:object_r:ldconfig_exec_t,s0)
|
||||||
diff --git a/policy/modules/system/libraries.if b/policy/modules/system/libraries.if
|
diff --git a/policy/modules/system/libraries.if b/policy/modules/system/libraries.if
|
||||||
@ -30183,7 +30292,7 @@ index 4e94884..5481f47 100644
|
|||||||
+ init_named_pid_filetrans($1, syslogd_var_run_t, dir, "journal")
|
+ init_named_pid_filetrans($1, syslogd_var_run_t, dir, "journal")
|
||||||
+')
|
+')
|
||||||
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
|
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
|
||||||
index 39ea221..4dd92d4 100644
|
index 39ea221..7094526 100644
|
||||||
--- a/policy/modules/system/logging.te
|
--- a/policy/modules/system/logging.te
|
||||||
+++ b/policy/modules/system/logging.te
|
+++ b/policy/modules/system/logging.te
|
||||||
@@ -4,6 +4,21 @@ policy_module(logging, 1.19.6)
|
@@ -4,6 +4,21 @@ policy_module(logging, 1.19.6)
|
||||||
@ -30371,7 +30480,7 @@ index 39ea221..4dd92d4 100644
|
|||||||
# sys_admin for the integrated klog of syslog-ng and metalog
|
# sys_admin for the integrated klog of syslog-ng and metalog
|
||||||
# cjp: why net_admin!
|
# cjp: why net_admin!
|
||||||
-allow syslogd_t self:capability { dac_override sys_resource sys_tty_config net_admin sys_admin chown fsetid };
|
-allow syslogd_t self:capability { dac_override sys_resource sys_tty_config net_admin sys_admin chown fsetid };
|
||||||
+allow syslogd_t self:capability { sys_ptrace dac_override sys_resource sys_tty_config ipc_lock net_admin sys_admin sys_nice chown fsetid setuid setgid };
|
+allow syslogd_t self:capability { sys_ptrace dac_override sys_resource sys_tty_config ipc_lock net_admin setgid setuid sys_admin sys_nice chown fsetid setuid setgid };
|
||||||
dontaudit syslogd_t self:capability sys_tty_config;
|
dontaudit syslogd_t self:capability sys_tty_config;
|
||||||
+allow syslogd_t self:capability2 { syslog block_suspend };
|
+allow syslogd_t self:capability2 { syslog block_suspend };
|
||||||
# setpgid for metalog
|
# setpgid for metalog
|
||||||
@ -36903,10 +37012,10 @@ index 0f64692..d7e8a01 100644
|
|||||||
|
|
||||||
########################################
|
########################################
|
||||||
diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
|
diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
|
||||||
index a5ec88b..1749342 100644
|
index a5ec88b..e7663f3 100644
|
||||||
--- a/policy/modules/system/udev.te
|
--- a/policy/modules/system/udev.te
|
||||||
+++ b/policy/modules/system/udev.te
|
+++ b/policy/modules/system/udev.te
|
||||||
@@ -17,14 +17,12 @@ init_daemon_domain(udev_t, udev_exec_t)
|
@@ -17,16 +17,17 @@ init_daemon_domain(udev_t, udev_exec_t)
|
||||||
type udev_etc_t alias etc_udev_t;
|
type udev_etc_t alias etc_udev_t;
|
||||||
files_config_file(udev_etc_t)
|
files_config_file(udev_etc_t)
|
||||||
|
|
||||||
@ -36921,8 +37030,13 @@ index a5ec88b..1749342 100644
|
|||||||
+typealias udev_var_run_t alias udev_tbl_t;
|
+typealias udev_var_run_t alias udev_tbl_t;
|
||||||
init_daemon_run_dir(udev_var_run_t, "udev")
|
init_daemon_run_dir(udev_var_run_t, "udev")
|
||||||
|
|
||||||
|
+type udev_tmp_t;
|
||||||
|
+files_tmp_file(udev_tmp_t)
|
||||||
|
+
|
||||||
ifdef(`enable_mcs',`
|
ifdef(`enable_mcs',`
|
||||||
@@ -37,9 +35,11 @@ ifdef(`enable_mcs',`
|
kernel_ranged_domtrans_to(udev_t, udev_exec_t, s0 - mcs_systemhigh)
|
||||||
|
init_ranged_daemon_domain(udev_t, udev_exec_t, s0 - mcs_systemhigh)
|
||||||
|
@@ -37,9 +38,11 @@ ifdef(`enable_mcs',`
|
||||||
# Local policy
|
# Local policy
|
||||||
#
|
#
|
||||||
|
|
||||||
@ -36936,7 +37050,7 @@ index a5ec88b..1749342 100644
|
|||||||
allow udev_t self:process { execmem setfscreate };
|
allow udev_t self:process { execmem setfscreate };
|
||||||
allow udev_t self:fd use;
|
allow udev_t self:fd use;
|
||||||
allow udev_t self:fifo_file rw_fifo_file_perms;
|
allow udev_t self:fifo_file rw_fifo_file_perms;
|
||||||
@@ -53,6 +53,7 @@ allow udev_t self:unix_dgram_socket sendto;
|
@@ -53,6 +56,7 @@ allow udev_t self:unix_dgram_socket sendto;
|
||||||
allow udev_t self:unix_stream_socket connectto;
|
allow udev_t self:unix_stream_socket connectto;
|
||||||
allow udev_t self:netlink_kobject_uevent_socket create_socket_perms;
|
allow udev_t self:netlink_kobject_uevent_socket create_socket_perms;
|
||||||
allow udev_t self:rawip_socket create_socket_perms;
|
allow udev_t self:rawip_socket create_socket_perms;
|
||||||
@ -36944,14 +37058,17 @@ index a5ec88b..1749342 100644
|
|||||||
|
|
||||||
allow udev_t udev_exec_t:file write;
|
allow udev_t udev_exec_t:file write;
|
||||||
can_exec(udev_t, udev_exec_t)
|
can_exec(udev_t, udev_exec_t)
|
||||||
@@ -63,31 +64,36 @@ can_exec(udev_t, udev_helper_exec_t)
|
@@ -63,31 +67,40 @@ can_exec(udev_t, udev_helper_exec_t)
|
||||||
# read udev config
|
# read udev config
|
||||||
allow udev_t udev_etc_t:file read_file_perms;
|
allow udev_t udev_etc_t:file read_file_perms;
|
||||||
|
|
||||||
-# create udev database in /dev/.udevdb
|
-# create udev database in /dev/.udevdb
|
||||||
-allow udev_t udev_tbl_t:file manage_file_perms;
|
-allow udev_t udev_tbl_t:file manage_file_perms;
|
||||||
-dev_filetrans(udev_t, udev_tbl_t, file)
|
-dev_filetrans(udev_t, udev_tbl_t, file)
|
||||||
-
|
+allow udev_t udev_tmp_t:dir manage_dir_perms;
|
||||||
|
+allow udev_t udev_tmp_t:file manage_file_perms;
|
||||||
|
+files_tmp_filetrans(udev_t, udev_tmp_t, { file dir })
|
||||||
|
|
||||||
list_dirs_pattern(udev_t, udev_rules_t, udev_rules_t)
|
list_dirs_pattern(udev_t, udev_rules_t, udev_rules_t)
|
||||||
-read_files_pattern(udev_t, udev_rules_t, udev_rules_t)
|
-read_files_pattern(udev_t, udev_rules_t, udev_rules_t)
|
||||||
+manage_files_pattern(udev_t, udev_rules_t, udev_rules_t)
|
+manage_files_pattern(udev_t, udev_rules_t, udev_rules_t)
|
||||||
@ -36988,7 +37105,7 @@ index a5ec88b..1749342 100644
|
|||||||
|
|
||||||
#https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235182
|
#https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235182
|
||||||
kernel_rw_net_sysctls(udev_t)
|
kernel_rw_net_sysctls(udev_t)
|
||||||
@@ -98,6 +104,7 @@ corecmd_exec_all_executables(udev_t)
|
@@ -98,6 +111,7 @@ corecmd_exec_all_executables(udev_t)
|
||||||
|
|
||||||
dev_rw_sysfs(udev_t)
|
dev_rw_sysfs(udev_t)
|
||||||
dev_manage_all_dev_nodes(udev_t)
|
dev_manage_all_dev_nodes(udev_t)
|
||||||
@ -36996,7 +37113,7 @@ index a5ec88b..1749342 100644
|
|||||||
dev_rw_generic_files(udev_t)
|
dev_rw_generic_files(udev_t)
|
||||||
dev_delete_generic_files(udev_t)
|
dev_delete_generic_files(udev_t)
|
||||||
dev_search_usbfs(udev_t)
|
dev_search_usbfs(udev_t)
|
||||||
@@ -106,23 +113,31 @@ dev_relabel_all_dev_nodes(udev_t)
|
@@ -106,23 +120,31 @@ dev_relabel_all_dev_nodes(udev_t)
|
||||||
# preserved, instead of short circuiting the relabel
|
# preserved, instead of short circuiting the relabel
|
||||||
dev_relabel_generic_symlinks(udev_t)
|
dev_relabel_generic_symlinks(udev_t)
|
||||||
dev_manage_generic_symlinks(udev_t)
|
dev_manage_generic_symlinks(udev_t)
|
||||||
@ -37032,7 +37149,7 @@ index a5ec88b..1749342 100644
|
|||||||
|
|
||||||
mls_file_read_all_levels(udev_t)
|
mls_file_read_all_levels(udev_t)
|
||||||
mls_file_write_all_levels(udev_t)
|
mls_file_write_all_levels(udev_t)
|
||||||
@@ -144,17 +159,20 @@ auth_use_nsswitch(udev_t)
|
@@ -144,17 +166,20 @@ auth_use_nsswitch(udev_t)
|
||||||
init_read_utmp(udev_t)
|
init_read_utmp(udev_t)
|
||||||
init_dontaudit_write_utmp(udev_t)
|
init_dontaudit_write_utmp(udev_t)
|
||||||
init_getattr_initctl(udev_t)
|
init_getattr_initctl(udev_t)
|
||||||
@ -37054,7 +37171,7 @@ index a5ec88b..1749342 100644
|
|||||||
|
|
||||||
seutil_read_config(udev_t)
|
seutil_read_config(udev_t)
|
||||||
seutil_read_default_contexts(udev_t)
|
seutil_read_default_contexts(udev_t)
|
||||||
@@ -170,6 +188,9 @@ sysnet_signal_dhcpc(udev_t)
|
@@ -170,6 +195,9 @@ sysnet_signal_dhcpc(udev_t)
|
||||||
sysnet_manage_config(udev_t)
|
sysnet_manage_config(udev_t)
|
||||||
sysnet_etc_filetrans_config(udev_t)
|
sysnet_etc_filetrans_config(udev_t)
|
||||||
|
|
||||||
@ -37064,7 +37181,7 @@ index a5ec88b..1749342 100644
|
|||||||
userdom_dontaudit_search_user_home_content(udev_t)
|
userdom_dontaudit_search_user_home_content(udev_t)
|
||||||
|
|
||||||
ifdef(`distro_gentoo',`
|
ifdef(`distro_gentoo',`
|
||||||
@@ -179,16 +200,9 @@ ifdef(`distro_gentoo',`
|
@@ -179,16 +207,9 @@ ifdef(`distro_gentoo',`
|
||||||
')
|
')
|
||||||
|
|
||||||
ifdef(`distro_redhat',`
|
ifdef(`distro_redhat',`
|
||||||
@ -37083,7 +37200,7 @@ index a5ec88b..1749342 100644
|
|||||||
|
|
||||||
# for arping used for static IP addresses on PCMCIA ethernet
|
# for arping used for static IP addresses on PCMCIA ethernet
|
||||||
netutils_domtrans(udev_t)
|
netutils_domtrans(udev_t)
|
||||||
@@ -226,19 +240,34 @@ optional_policy(`
|
@@ -226,19 +247,34 @@ optional_policy(`
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
cups_domtrans_config(udev_t)
|
cups_domtrans_config(udev_t)
|
||||||
@ -37118,7 +37235,7 @@ index a5ec88b..1749342 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -264,6 +293,10 @@ optional_policy(`
|
@@ -264,6 +300,10 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -37129,7 +37246,7 @@ index a5ec88b..1749342 100644
|
|||||||
openct_read_pid_files(udev_t)
|
openct_read_pid_files(udev_t)
|
||||||
openct_domtrans(udev_t)
|
openct_domtrans(udev_t)
|
||||||
')
|
')
|
||||||
@@ -278,6 +311,15 @@ optional_policy(`
|
@@ -278,6 +318,15 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -37145,7 +37262,7 @@ index a5ec88b..1749342 100644
|
|||||||
unconfined_signal(udev_t)
|
unconfined_signal(udev_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -290,6 +332,7 @@ optional_policy(`
|
@@ -290,6 +339,7 @@ optional_policy(`
|
||||||
kernel_read_xen_state(udev_t)
|
kernel_read_xen_state(udev_t)
|
||||||
xen_manage_log(udev_t)
|
xen_manage_log(udev_t)
|
||||||
xen_read_image_files(udev_t)
|
xen_read_image_files(udev_t)
|
||||||
|
@ -10904,7 +10904,7 @@ index 32e8265..0de4af3 100644
|
|||||||
+ allow $1 chronyd_unit_file_t:service all_service_perms;
|
+ allow $1 chronyd_unit_file_t:service all_service_perms;
|
||||||
')
|
')
|
||||||
diff --git a/chronyd.te b/chronyd.te
|
diff --git a/chronyd.te b/chronyd.te
|
||||||
index 914ee2d..770ae51 100644
|
index 914ee2d..1544e9b 100644
|
||||||
--- a/chronyd.te
|
--- a/chronyd.te
|
||||||
+++ b/chronyd.te
|
+++ b/chronyd.te
|
||||||
@@ -18,6 +18,9 @@ files_type(chronyd_keys_t)
|
@@ -18,6 +18,9 @@ files_type(chronyd_keys_t)
|
||||||
@ -10934,10 +10934,12 @@ index 914ee2d..770ae51 100644
|
|||||||
allow chronyd_t chronyd_keys_t:file read_file_perms;
|
allow chronyd_t chronyd_keys_t:file read_file_perms;
|
||||||
|
|
||||||
manage_dirs_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t)
|
manage_dirs_pattern(chronyd_t, chronyd_tmpfs_t, chronyd_tmpfs_t)
|
||||||
@@ -76,18 +83,17 @@ corenet_sendrecv_chronyd_server_packets(chronyd_t)
|
@@ -76,18 +83,19 @@ corenet_sendrecv_chronyd_server_packets(chronyd_t)
|
||||||
corenet_udp_bind_chronyd_port(chronyd_t)
|
corenet_udp_bind_chronyd_port(chronyd_t)
|
||||||
corenet_udp_sendrecv_chronyd_port(chronyd_t)
|
corenet_udp_sendrecv_chronyd_port(chronyd_t)
|
||||||
|
|
||||||
|
+domain_dontaudit_getsession_all_domains(chronyd_t)
|
||||||
|
+
|
||||||
+dev_read_rand(chronyd_t)
|
+dev_read_rand(chronyd_t)
|
||||||
+dev_read_urand(chronyd_t)
|
+dev_read_urand(chronyd_t)
|
||||||
+
|
+
|
||||||
@ -23011,7 +23013,7 @@ index 50d0084..6565422 100644
|
|||||||
|
|
||||||
fail2ban_run_client($1, $2)
|
fail2ban_run_client($1, $2)
|
||||||
diff --git a/fail2ban.te b/fail2ban.te
|
diff --git a/fail2ban.te b/fail2ban.te
|
||||||
index 0872e50..5d49b4f 100644
|
index 0872e50..d336d7f 100644
|
||||||
--- a/fail2ban.te
|
--- a/fail2ban.te
|
||||||
+++ b/fail2ban.te
|
+++ b/fail2ban.te
|
||||||
@@ -65,7 +65,6 @@ kernel_read_system_state(fail2ban_t)
|
@@ -65,7 +65,6 @@ kernel_read_system_state(fail2ban_t)
|
||||||
@ -23056,7 +23058,15 @@ index 0872e50..5d49b4f 100644
|
|||||||
iptables_domtrans(fail2ban_t)
|
iptables_domtrans(fail2ban_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -137,14 +137,12 @@ corecmd_exec_bin(fail2ban_client_t)
|
@@ -129,6 +129,7 @@ allow fail2ban_client_t self:unix_stream_socket { create connect write read };
|
||||||
|
|
||||||
|
domtrans_pattern(fail2ban_client_t, fail2ban_exec_t, fail2ban_t)
|
||||||
|
|
||||||
|
+dontaudit fail2ban_client_t fail2ban_var_run_t:dir_file_class_set audit_access;
|
||||||
|
stream_connect_pattern(fail2ban_client_t, fail2ban_var_run_t, fail2ban_var_run_t, fail2ban_t)
|
||||||
|
|
||||||
|
kernel_read_system_state(fail2ban_client_t)
|
||||||
|
@@ -137,14 +138,12 @@ corecmd_exec_bin(fail2ban_client_t)
|
||||||
|
|
||||||
domain_use_interactive_fds(fail2ban_client_t)
|
domain_use_interactive_fds(fail2ban_client_t)
|
||||||
|
|
||||||
@ -27140,7 +27150,7 @@ index d03fd43..26023f7 100644
|
|||||||
+ type_transition $1 gkeyringd_exec_t:process $2;
|
+ type_transition $1 gkeyringd_exec_t:process $2;
|
||||||
')
|
')
|
||||||
diff --git a/gnome.te b/gnome.te
|
diff --git a/gnome.te b/gnome.te
|
||||||
index 20f726b..6af4e62 100644
|
index 20f726b..8e905be 100644
|
||||||
--- a/gnome.te
|
--- a/gnome.te
|
||||||
+++ b/gnome.te
|
+++ b/gnome.te
|
||||||
@@ -1,18 +1,36 @@
|
@@ -1,18 +1,36 @@
|
||||||
@ -27368,7 +27378,7 @@ index 20f726b..6af4e62 100644
|
|||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
+ gnome_read_home_config(gnomesystemmm_t)
|
+ gnome_manage_home_config(gnomesystemmm_t)
|
||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
@ -37396,11 +37406,104 @@ index 0000000..67b8b3d
|
|||||||
+tunable_policy(`mock_enable_homedirs',`
|
+tunable_policy(`mock_enable_homedirs',`
|
||||||
+ userdom_read_user_home_content_files(mock_build_t)
|
+ userdom_read_user_home_content_files(mock_build_t)
|
||||||
+')
|
+')
|
||||||
|
diff --git a/modemmanager.fc b/modemmanager.fc
|
||||||
|
index a83894c..481dca3 100644
|
||||||
|
--- a/modemmanager.fc
|
||||||
|
+++ b/modemmanager.fc
|
||||||
|
@@ -1 +1,4 @@
|
||||||
|
/usr/sbin/modem-manager -- gen_context(system_u:object_r:modemmanager_exec_t,s0)
|
||||||
|
+/usr/sbin/ModemManager -- gen_context(system_u:object_r:modemmanager_exec_t,s0)
|
||||||
|
+
|
||||||
|
+/usr/lib/systemd/system/ModemManager.service -- gen_context(system_u:object_r:modemmanager_unit_file_t,s0)
|
||||||
|
diff --git a/modemmanager.if b/modemmanager.if
|
||||||
|
index b1ac8b5..90ca430 100644
|
||||||
|
--- a/modemmanager.if
|
||||||
|
+++ b/modemmanager.if
|
||||||
|
@@ -21,6 +21,30 @@ interface(`modemmanager_domtrans',`
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
+## Execute modemmanager server in the modemmanager domain.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`modemmanager_systemctl',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type modemmanager_t;
|
||||||
|
+ type modemmanager_unit_file_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ systemd_exec_systemctl($1)
|
||||||
|
+ systemd_read_fifo_file_password_run($1)
|
||||||
|
+ allow $1 modemmanager_unit_file_t:file read_file_perms;
|
||||||
|
+ allow $1 modemmanager_unit_file_t:service manage_service_perms;
|
||||||
|
+
|
||||||
|
+ ps_process_pattern($1, modemmanager_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
## Send and receive messages from
|
||||||
|
## modemmanager over dbus.
|
||||||
|
## </summary>
|
||||||
|
@@ -39,3 +63,38 @@ interface(`modemmanager_dbus_chat',`
|
||||||
|
allow $1 modemmanager_t:dbus send_msg;
|
||||||
|
allow modemmanager_t $1:dbus send_msg;
|
||||||
|
')
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## All of the rules required to administrate
|
||||||
|
+## an modemmanager environment
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+## <param name="role">
|
||||||
|
+## <summary>
|
||||||
|
+## Role allowed access.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+## <rolecap/>
|
||||||
|
+#
|
||||||
|
+interface(`modemmanager_admin',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ type modemmanager_t;
|
||||||
|
+ type modemmanager_unit_file_t;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ allow $1 modemmanager_t:process { ptrace signal_perms };
|
||||||
|
+ ps_process_pattern($1, modemmanager_t)
|
||||||
|
+
|
||||||
|
+ modemmanager_systemctl($1)
|
||||||
|
+ admin_pattern($1, modemmanager_unit_file_t)
|
||||||
|
+ allow $1 modemmanager_unit_file_t:service all_service_perms;
|
||||||
|
+ optional_policy(`
|
||||||
|
+ systemd_passwd_agent_exec($1)
|
||||||
|
+ systemd_read_fifo_file_passwd_run($1)
|
||||||
|
+ ')
|
||||||
|
+')
|
||||||
diff --git a/modemmanager.te b/modemmanager.te
|
diff --git a/modemmanager.te b/modemmanager.te
|
||||||
index cb4c13d..d744144 100644
|
index cb4c13d..ab6fb25 100644
|
||||||
--- a/modemmanager.te
|
--- a/modemmanager.te
|
||||||
+++ b/modemmanager.te
|
+++ b/modemmanager.te
|
||||||
@@ -27,12 +27,12 @@ kernel_read_system_state(modemmanager_t)
|
@@ -11,6 +11,9 @@ init_daemon_domain(modemmanager_t, modemmanager_exec_t)
|
||||||
|
typealias modemmanager_t alias ModemManager_t;
|
||||||
|
typealias modemmanager_exec_t alias ModemManager_exec_t;
|
||||||
|
|
||||||
|
+type modemmanager_unit_file_t;
|
||||||
|
+systemd_unit_file(modemmanager_unit_file_t)
|
||||||
|
+
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# Local policy
|
||||||
|
@@ -27,12 +30,12 @@ kernel_read_system_state(modemmanager_t)
|
||||||
dev_read_sysfs(modemmanager_t)
|
dev_read_sysfs(modemmanager_t)
|
||||||
dev_rw_modem(modemmanager_t)
|
dev_rw_modem(modemmanager_t)
|
||||||
|
|
||||||
@ -47550,7 +47653,7 @@ index 0000000..7d839fe
|
|||||||
+ pulseaudio_setattr_home_dir(nsplugin_t)
|
+ pulseaudio_setattr_home_dir(nsplugin_t)
|
||||||
+')
|
+')
|
||||||
diff --git a/ntop.te b/ntop.te
|
diff --git a/ntop.te b/ntop.te
|
||||||
index 52757d8..638c3d2 100644
|
index 52757d8..6ce5c69 100644
|
||||||
--- a/ntop.te
|
--- a/ntop.te
|
||||||
+++ b/ntop.te
|
+++ b/ntop.te
|
||||||
@@ -58,7 +58,6 @@ kernel_read_system_state(ntop_t)
|
@@ -58,7 +58,6 @@ kernel_read_system_state(ntop_t)
|
||||||
@ -47561,7 +47664,12 @@ index 52757d8..638c3d2 100644
|
|||||||
corenet_all_recvfrom_netlabel(ntop_t)
|
corenet_all_recvfrom_netlabel(ntop_t)
|
||||||
corenet_tcp_sendrecv_generic_if(ntop_t)
|
corenet_tcp_sendrecv_generic_if(ntop_t)
|
||||||
corenet_raw_sendrecv_generic_if(ntop_t)
|
corenet_raw_sendrecv_generic_if(ntop_t)
|
||||||
@@ -81,7 +80,6 @@ dev_rw_generic_usb_dev(ntop_t)
|
@@ -78,10 +77,11 @@ corenet_tcp_sendrecv_http_port(ntop_t)
|
||||||
|
|
||||||
|
dev_read_sysfs(ntop_t)
|
||||||
|
dev_rw_generic_usb_dev(ntop_t)
|
||||||
|
+dev_read_usbmon_dev(ntop_t)
|
||||||
|
+dev_write_usbmon_dev(ntop_t)
|
||||||
|
|
||||||
domain_use_interactive_fds(ntop_t)
|
domain_use_interactive_fds(ntop_t)
|
||||||
|
|
||||||
@ -49990,10 +50098,10 @@ index 0000000..bddd4b3
|
|||||||
+')
|
+')
|
||||||
diff --git a/openshift.te b/openshift.te
|
diff --git a/openshift.te b/openshift.te
|
||||||
new file mode 100644
|
new file mode 100644
|
||||||
index 0000000..877c71a
|
index 0000000..35f9df0
|
||||||
--- /dev/null
|
--- /dev/null
|
||||||
+++ b/openshift.te
|
+++ b/openshift.te
|
||||||
@@ -0,0 +1,546 @@
|
@@ -0,0 +1,547 @@
|
||||||
+policy_module(openshift,1.0.0)
|
+policy_module(openshift,1.0.0)
|
||||||
+
|
+
|
||||||
+gen_require(`
|
+gen_require(`
|
||||||
@ -50041,6 +50149,7 @@ index 0000000..877c71a
|
|||||||
+files_pid_file(openshift_var_run_t)
|
+files_pid_file(openshift_var_run_t)
|
||||||
+
|
+
|
||||||
+type openshift_var_lib_t, openshift_file_type;
|
+type openshift_var_lib_t, openshift_file_type;
|
||||||
|
+userdom_user_home_content(openshift_var_lib_t)
|
||||||
+files_poly(openshift_var_lib_t)
|
+files_poly(openshift_var_lib_t)
|
||||||
+files_poly_parent(openshift_var_lib_t)
|
+files_poly_parent(openshift_var_lib_t)
|
||||||
+files_mountpoint(openshift_var_lib_t)
|
+files_mountpoint(openshift_var_lib_t)
|
||||||
@ -54227,10 +54336,10 @@ index a14b3bc..b196183 100644
|
|||||||
|
|
||||||
userdom_signal_unpriv_users(podsleuth_t)
|
userdom_signal_unpriv_users(podsleuth_t)
|
||||||
diff --git a/policykit.fc b/policykit.fc
|
diff --git a/policykit.fc b/policykit.fc
|
||||||
index 1d76c72..4718a93 100644
|
index 1d76c72..eeb33d9 100644
|
||||||
--- a/policykit.fc
|
--- a/policykit.fc
|
||||||
+++ b/policykit.fc
|
+++ b/policykit.fc
|
||||||
@@ -1,23 +1,20 @@
|
@@ -1,23 +1,21 @@
|
||||||
-/usr/lib/polkit-1/polkitd -- gen_context(system_u:object_r:policykit_exec_t,s0)
|
-/usr/lib/polkit-1/polkitd -- gen_context(system_u:object_r:policykit_exec_t,s0)
|
||||||
-/usr/lib/polkit-1/polkit-agent-helper-1 -- gen_context(system_u:object_r:policykit_auth_exec_t,s0)
|
-/usr/lib/polkit-1/polkit-agent-helper-1 -- gen_context(system_u:object_r:policykit_auth_exec_t,s0)
|
||||||
-
|
-
|
||||||
@ -54241,6 +54350,7 @@ index 1d76c72..4718a93 100644
|
|||||||
-/usr/lib/policykit-1/polkit-agent-helper-1 -- gen_context(system_u:object_r:policykit_auth_exec_t,s0)
|
-/usr/lib/policykit-1/polkit-agent-helper-1 -- gen_context(system_u:object_r:policykit_auth_exec_t,s0)
|
||||||
-/usr/lib/policykit-1/polkitd -- gen_context(system_u:object_r:policykit_exec_t,s0)
|
-/usr/lib/policykit-1/polkitd -- gen_context(system_u:object_r:policykit_exec_t,s0)
|
||||||
+/usr/lib/policykit/polkit-read-auth-helper -- gen_context(system_u:object_r:policykit_auth_exec_t,s0)
|
+/usr/lib/policykit/polkit-read-auth-helper -- gen_context(system_u:object_r:policykit_auth_exec_t,s0)
|
||||||
|
+/usr/bin/pkla-check-authorization -- gen_context(system_u:object_r:policykit_auth_exec_t,s0)
|
||||||
+/usr/lib/policykit/polkit-grant-helper.* -- gen_context(system_u:object_r:policykit_grant_exec_t,s0)
|
+/usr/lib/policykit/polkit-grant-helper.* -- gen_context(system_u:object_r:policykit_grant_exec_t,s0)
|
||||||
+/usr/lib/policykit/polkit-resolve-exe-helper.* -- gen_context(system_u:object_r:policykit_resolve_exec_t,s0)
|
+/usr/lib/policykit/polkit-resolve-exe-helper.* -- gen_context(system_u:object_r:policykit_resolve_exec_t,s0)
|
||||||
+/usr/lib/policykit/polkitd -- gen_context(system_u:object_r:policykit_exec_t,s0)
|
+/usr/lib/policykit/polkitd -- gen_context(system_u:object_r:policykit_exec_t,s0)
|
||||||
@ -74663,10 +74773,10 @@ index 0000000..5da5bff
|
|||||||
+')
|
+')
|
||||||
diff --git a/sandboxX.te b/sandboxX.te
|
diff --git a/sandboxX.te b/sandboxX.te
|
||||||
new file mode 100644
|
new file mode 100644
|
||||||
index 0000000..81198c3
|
index 0000000..cb720ee
|
||||||
--- /dev/null
|
--- /dev/null
|
||||||
+++ b/sandboxX.te
|
+++ b/sandboxX.te
|
||||||
@@ -0,0 +1,463 @@
|
@@ -0,0 +1,465 @@
|
||||||
+policy_module(sandboxX,1.0.0)
|
+policy_module(sandboxX,1.0.0)
|
||||||
+
|
+
|
||||||
+dbus_stub()
|
+dbus_stub()
|
||||||
@ -74774,6 +74884,8 @@ index 0000000..81198c3
|
|||||||
+userdom_dontaudit_search_user_home_content(sandbox_xserver_t)
|
+userdom_dontaudit_search_user_home_content(sandbox_xserver_t)
|
||||||
+userdom_dontaudit_rw_user_tmp_pipes(sandbox_xserver_t)
|
+userdom_dontaudit_rw_user_tmp_pipes(sandbox_xserver_t)
|
||||||
+
|
+
|
||||||
|
+xserver_read_xkb_libs(sandbox_xserver_t)
|
||||||
|
+xserver_dontaudit_xkb_libs_access(sandbox_xserver_t)
|
||||||
+xserver_entry_type(sandbox_xserver_t)
|
+xserver_entry_type(sandbox_xserver_t)
|
||||||
+
|
+
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
|
@ -19,7 +19,7 @@
|
|||||||
Summary: SELinux policy configuration
|
Summary: SELinux policy configuration
|
||||||
Name: selinux-policy
|
Name: selinux-policy
|
||||||
Version: 3.12.1
|
Version: 3.12.1
|
||||||
Release: 53%{?dist}
|
Release: 54%{?dist}
|
||||||
License: GPLv2+
|
License: GPLv2+
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
Source: serefpolicy-%{version}.tgz
|
Source: serefpolicy-%{version}.tgz
|
||||||
@ -535,6 +535,16 @@ SELinux Reference policy mls base module.
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Jun 19 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-54
|
||||||
|
- Don't audit access checks by sandbox xserver on xdb var_lib
|
||||||
|
- Allow ntop to read usbmon devices
|
||||||
|
- Add labeling for new polcykit authorizor
|
||||||
|
- Dontaudit access checks from fail2ban_client
|
||||||
|
- Don't audit access checks by sandbox xserver on xdb var_lib
|
||||||
|
- Allow apps that connect to xdm stream to conenct to xdm_dbusd_t stream
|
||||||
|
- Fix labeling for all /usr/bim/razor-lightdm-* binaries
|
||||||
|
- Add filename trans for /dev/md126p1
|
||||||
|
|
||||||
* Tue Jun 18 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-53
|
* Tue Jun 18 2013 Miroslav Grepl <mgrepl@redhat.com> 3.12.1-53
|
||||||
- Make vdagent able to request loading kernel module
|
- Make vdagent able to request loading kernel module
|
||||||
- Add support for cloud-init make it as unconfined domain
|
- Add support for cloud-init make it as unconfined domain
|
||||||
|
Loading…
Reference in New Issue
Block a user