rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- More fixes for sandbox_web_t

Browse Source
This commit is contained in:
Daniel J Walsh 2009-09-19 02:03:03 +00:00
parent 2bf7d82f60
commit 8323d545c4
2 changed files with 205 additions and 110 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

310
policy-F12.patch
View File

@ -3629,8 +3629,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+# No types are sandbox_exec_t +# No types are sandbox_exec_t
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.if serefpolicy-3.6.32/policy/modules/apps/sandbox.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.if serefpolicy-3.6.32/policy/modules/apps/sandbox.if
--- nsaserefpolicy/policy/modules/apps/sandbox.if 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/apps/sandbox.if 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.32/policy/modules/apps/sandbox.if 2009-09-18 11:27:41.000000000 -0400 +++ serefpolicy-3.6.32/policy/modules/apps/sandbox.if 2009-09-18 22:01:56.000000000 -0400
@@ -0,0 +1,177 @@ @@ -0,0 +1,179 @@
+ +
+## <summary>policy for sandbox</summary> +## <summary>policy for sandbox</summary>
+ +
@ -3663,10 +3663,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ role $2 types sandbox_domain; + role $2 types sandbox_domain;
+ allow sandbox_domain $1:process sigchld; + allow sandbox_domain $1:process sigchld;
+ +
+ allow $1 sandbox_x_domain:process transition; + allow $1 sandbox_x_domain:process { signal_perms transition };
+ dontaudit $1 sandbox_x_domain:process { noatsecure siginh rlimitinh }; + dontaudit $1 sandbox_x_domain:process { noatsecure siginh rlimitinh };
+ role $2 types sandbox_x_domain; + role $2 types sandbox_x_domain;
+ role $2 types sandbox_xserver_t; + role $2 types sandbox_xserver_t;
+ allow $1 sandbox_xserver_t:process signal_perms;
+
+ allow sandbox_x_domain $1:process sigchld; + allow sandbox_x_domain $1:process sigchld;
+ # Dontaudit leaked file descriptors + # Dontaudit leaked file descriptors
+ dontaudit sandbox_x_domain $1:fifo_file rw_fifo_file_perms; + dontaudit sandbox_x_domain $1:fifo_file rw_fifo_file_perms;
@ -3810,7 +3812,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.te serefpolicy-3.6.32/policy/modules/apps/sandbox.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.te serefpolicy-3.6.32/policy/modules/apps/sandbox.te
--- nsaserefpolicy/policy/modules/apps/sandbox.te 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/apps/sandbox.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.32/policy/modules/apps/sandbox.te 2009-09-18 21:31:34.000000000 -0400 +++ serefpolicy-3.6.32/policy/modules/apps/sandbox.te 2009-09-18 21:55:28.000000000 -0400
@@ -0,0 +1,324 @@ @@ -0,0 +1,324 @@
+policy_module(sandbox,1.0.0) +policy_module(sandbox,1.0.0)
+dbus_stub() +dbus_stub()
@ -4062,7 +4064,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+corenet_tcp_connect_ftp_port(sandbox_web_client_t) +corenet_tcp_connect_ftp_port(sandbox_web_client_t)
+corenet_tcp_connect_ipp_port(sandbox_web_client_t) +corenet_tcp_connect_ipp_port(sandbox_web_client_t)
+corenet_tcp_connect_generic_port(sandbox_web_client_t) +corenet_tcp_connect_generic_port(sandbox_web_client_t)
+corenet_tcp_connect_sound_port(sandbox_web_client_t) +corenet_tcp_connect_soundd_port(sandbox_web_client_t)
+corenet_sendrecv_http_client_packets(sandbox_web_client_t) +corenet_sendrecv_http_client_packets(sandbox_web_client_t)
+corenet_sendrecv_http_cache_client_packets(sandbox_web_client_t) +corenet_sendrecv_http_cache_client_packets(sandbox_web_client_t)
+corenet_sendrecv_ftp_client_packets(sandbox_web_client_t) +corenet_sendrecv_ftp_client_packets(sandbox_web_client_t)
@ -4159,8 +4161,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/usr/sbin/seunshare -- gen_context(system_u:object_r:seunshare_exec_t,s0) +/usr/sbin/seunshare -- gen_context(system_u:object_r:seunshare_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshare.if serefpolicy-3.6.32/policy/modules/apps/seunshare.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshare.if serefpolicy-3.6.32/policy/modules/apps/seunshare.if
--- nsaserefpolicy/policy/modules/apps/seunshare.if 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/apps/seunshare.if 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.32/policy/modules/apps/seunshare.if 2009-09-18 11:41:50.000000000 -0400 +++ serefpolicy-3.6.32/policy/modules/apps/seunshare.if 2009-09-18 21:59:52.000000000 -0400
@@ -0,0 +1,79 @@ @@ -0,0 +1,80 @@
+ +
+## <summary>policy for seunshare</summary> +## <summary>policy for seunshare</summary>
+ +
@ -4181,6 +4183,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ ') + ')
+ +
+ domtrans_pattern($1,seunshare_exec_t,seunshare_t) + domtrans_pattern($1,seunshare_exec_t,seunshare_t)
+ allow $1 seunshare_t:process signal_perms;
+') +')
+ +
+ +
@ -6024,8 +6027,34 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Rules for all filesystem types # Rules for all filesystem types
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.6.32/policy/modules/kernel/kernel.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.6.32/policy/modules/kernel/kernel.if
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2009-07-14 14:19:57.000000000 -0400 --- nsaserefpolicy/policy/modules/kernel/kernel.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/kernel/kernel.if 2009-09-16 10:03:09.000000000 -0400 +++ serefpolicy-3.6.32/policy/modules/kernel/kernel.if 2009-09-18 21:46:09.000000000 -0400
@@ -1807,7 +1807,7 @@ @@ -485,6 +485,25 @@
########################################
## <summary>
+## Allows caller to request the kernel to load a module
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`kernel_load_module_request',`
+ gen_require(`
+ type kernel_t;
+ ')
+
+ allow $1 kernel_t:system module_request;
+')
+
+########################################
+## <summary>
## Get information on all System V IPC objects.
## </summary>
## <param name="domain">
@@ -1807,7 +1826,7 @@
') ')
dontaudit $1 sysctl_type:dir list_dir_perms; dontaudit $1 sysctl_type:dir list_dir_perms;
@ -6034,7 +6063,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -2621,6 +2621,24 @@ @@ -2621,6 +2640,24 @@
######################################## ########################################
## <summary> ## <summary>
@ -6059,7 +6088,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Unconfined access to kernel module resources. ## Unconfined access to kernel module resources.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -2636,3 +2654,22 @@ @@ -2636,3 +2673,22 @@
typeattribute $1 kern_unconfined; typeattribute $1 kern_unconfined;
') ')
@ -9810,7 +9839,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## </summary> ## </summary>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.6.32/policy/modules/services/bluetooth.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.6.32/policy/modules/services/bluetooth.te
--- nsaserefpolicy/policy/modules/services/bluetooth.te 2009-08-14 16:14:31.000000000 -0400 --- nsaserefpolicy/policy/modules/services/bluetooth.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/bluetooth.te 2009-09-16 10:03:09.000000000 -0400 +++ serefpolicy-3.6.32/policy/modules/services/bluetooth.te 2009-09-18 21:49:49.000000000 -0400
@@ -56,7 +56,7 @@ @@ -56,7 +56,7 @@
allow bluetooth_t self:capability { dac_override net_bind_service net_admin net_raw sys_tty_config ipc_lock }; allow bluetooth_t self:capability { dac_override net_bind_service net_admin net_raw sys_tty_config ipc_lock };
@ -9828,7 +9857,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
read_files_pattern(bluetooth_t, bluetooth_conf_t, bluetooth_conf_t) read_files_pattern(bluetooth_t, bluetooth_conf_t, bluetooth_conf_t)
@@ -111,6 +112,7 @@ @@ -91,6 +92,7 @@
manage_sock_files_pattern(bluetooth_t, bluetooth_var_run_t, bluetooth_var_run_t)
files_pid_filetrans(bluetooth_t, bluetooth_var_run_t, { file sock_file })
+kernel_load_module_request(bluetooth_t)
kernel_read_kernel_sysctls(bluetooth_t)
kernel_read_system_state(bluetooth_t)
kernel_read_network_state(bluetooth_t)
@@ -111,6 +113,7 @@
dev_rw_generic_usb_dev(bluetooth_t) dev_rw_generic_usb_dev(bluetooth_t)
dev_read_urand(bluetooth_t) dev_read_urand(bluetooth_t)
dev_rw_input_dev(bluetooth_t) dev_rw_input_dev(bluetooth_t)
@ -9836,7 +9873,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
fs_getattr_all_fs(bluetooth_t) fs_getattr_all_fs(bluetooth_t)
fs_search_auto_mountpoints(bluetooth_t) fs_search_auto_mountpoints(bluetooth_t)
@@ -154,6 +156,10 @@ @@ -154,6 +157,10 @@
') ')
optional_policy(` optional_policy(`
@ -10939,7 +10976,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/usr/local/linuxprinter/ppd(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) +/usr/local/linuxprinter/ppd(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.6.32/policy/modules/services/cups.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.6.32/policy/modules/services/cups.te
--- nsaserefpolicy/policy/modules/services/cups.te 2009-08-14 16:14:31.000000000 -0400 --- nsaserefpolicy/policy/modules/services/cups.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/cups.te 2009-09-16 10:03:09.000000000 -0400 +++ serefpolicy-3.6.32/policy/modules/services/cups.te 2009-09-18 21:49:27.000000000 -0400
@@ -23,6 +23,9 @@ @@ -23,6 +23,9 @@
type cupsd_initrc_exec_t; type cupsd_initrc_exec_t;
init_script_file(cupsd_initrc_exec_t) init_script_file(cupsd_initrc_exec_t)
@ -10977,7 +11014,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
manage_dirs_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t) manage_dirs_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t)
manage_files_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t) manage_files_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t)
filetrans_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t, file) filetrans_pattern(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t, file)
@@ -250,6 +259,7 @@ @@ -153,6 +162,7 @@
stream_connect_pattern(cupsd_t, ptal_var_run_t, ptal_var_run_t, ptal_t)
allow cupsd_t ptal_var_run_t : sock_file setattr;
+kernel_load_module_request(cupsd_t)
kernel_read_system_state(cupsd_t)
kernel_read_network_state(cupsd_t)
kernel_read_all_sysctls(cupsd_t)
@@ -250,6 +260,7 @@
miscfiles_read_localization(cupsd_t) miscfiles_read_localization(cupsd_t)
# invoking ghostscript needs to read fonts # invoking ghostscript needs to read fonts
miscfiles_read_fonts(cupsd_t) miscfiles_read_fonts(cupsd_t)
@ -10985,7 +11030,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
seutil_read_config(cupsd_t) seutil_read_config(cupsd_t)
sysnet_exec_ifconfig(cupsd_t) sysnet_exec_ifconfig(cupsd_t)
@@ -327,7 +337,7 @@ @@ -327,7 +338,7 @@
allow cupsd_config_t self:capability { chown dac_override sys_tty_config }; allow cupsd_config_t self:capability { chown dac_override sys_tty_config };
dontaudit cupsd_config_t self:capability sys_tty_config; dontaudit cupsd_config_t self:capability sys_tty_config;
@ -10994,7 +11039,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow cupsd_config_t self:fifo_file rw_fifo_file_perms; allow cupsd_config_t self:fifo_file rw_fifo_file_perms;
allow cupsd_config_t self:unix_stream_socket create_socket_perms; allow cupsd_config_t self:unix_stream_socket create_socket_perms;
allow cupsd_config_t self:unix_dgram_socket create_socket_perms; allow cupsd_config_t self:unix_dgram_socket create_socket_perms;
@@ -419,12 +429,15 @@ @@ -419,12 +430,15 @@
') ')
optional_policy(` optional_policy(`
@ -11012,7 +11057,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(` optional_policy(`
hal_dbus_chat(cupsd_config_t) hal_dbus_chat(cupsd_config_t)
@@ -542,6 +555,8 @@ @@ -542,6 +556,8 @@
manage_dirs_pattern(cups_pdf_t, cups_pdf_tmp_t, cups_pdf_tmp_t) manage_dirs_pattern(cups_pdf_t, cups_pdf_tmp_t, cups_pdf_tmp_t)
files_tmp_filetrans(cups_pdf_t, cups_pdf_tmp_t, { file dir }) files_tmp_filetrans(cups_pdf_t, cups_pdf_tmp_t, { file dir })
@ -11021,7 +11066,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_system_state(cups_pdf_t) kernel_read_system_state(cups_pdf_t)
files_read_etc_files(cups_pdf_t) files_read_etc_files(cups_pdf_t)
@@ -601,6 +616,9 @@ @@ -601,6 +617,9 @@
read_lnk_files_pattern(hplip_t, hplip_etc_t, hplip_etc_t) read_lnk_files_pattern(hplip_t, hplip_etc_t, hplip_etc_t)
files_search_etc(hplip_t) files_search_etc(hplip_t)
@ -12703,7 +12748,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.6.32/policy/modules/services/networkmanager.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.6.32/policy/modules/services/networkmanager.te
--- nsaserefpolicy/policy/modules/services/networkmanager.te 2009-08-14 16:14:31.000000000 -0400 --- nsaserefpolicy/policy/modules/services/networkmanager.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/networkmanager.te 2009-09-16 10:03:09.000000000 -0400 +++ serefpolicy-3.6.32/policy/modules/services/networkmanager.te 2009-09-18 21:50:26.000000000 -0400
@@ -19,6 +19,9 @@ @@ -19,6 +19,9 @@
type NetworkManager_tmp_t; type NetworkManager_tmp_t;
files_tmp_file(NetworkManager_tmp_t) files_tmp_file(NetworkManager_tmp_t)
@ -12731,7 +12776,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow NetworkManager_t self:tcp_socket create_stream_socket_perms; allow NetworkManager_t self:tcp_socket create_stream_socket_perms;
allow NetworkManager_t self:udp_socket create_socket_perms; allow NetworkManager_t self:udp_socket create_socket_perms;
allow NetworkManager_t self:packet_socket create_socket_perms; allow NetworkManager_t self:packet_socket create_socket_perms;
@@ -51,8 +55,11 @@ @@ -51,18 +55,24 @@
manage_files_pattern(NetworkManager_t, NetworkManager_log_t, NetworkManager_log_t) manage_files_pattern(NetworkManager_t, NetworkManager_log_t, NetworkManager_log_t)
logging_log_filetrans(NetworkManager_t, NetworkManager_log_t, file) logging_log_filetrans(NetworkManager_t, NetworkManager_log_t, file)
@ -12745,7 +12790,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
manage_dirs_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t) manage_dirs_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
manage_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t) manage_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
@@ -63,6 +70,8 @@ manage_sock_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
files_pid_filetrans(NetworkManager_t, NetworkManager_var_run_t, { dir file sock_file })
+kernel_load_module_request(NetworkManager_t)
kernel_read_system_state(NetworkManager_t)
kernel_read_network_state(NetworkManager_t) kernel_read_network_state(NetworkManager_t)
kernel_read_kernel_sysctls(NetworkManager_t) kernel_read_kernel_sysctls(NetworkManager_t)
kernel_load_module(NetworkManager_t) kernel_load_module(NetworkManager_t)
@ -12754,7 +12803,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_all_recvfrom_unlabeled(NetworkManager_t) corenet_all_recvfrom_unlabeled(NetworkManager_t)
corenet_all_recvfrom_netlabel(NetworkManager_t) corenet_all_recvfrom_netlabel(NetworkManager_t)
@@ -81,13 +90,18 @@ @@ -81,13 +91,18 @@
corenet_sendrecv_isakmp_server_packets(NetworkManager_t) corenet_sendrecv_isakmp_server_packets(NetworkManager_t)
corenet_sendrecv_dhcpc_server_packets(NetworkManager_t) corenet_sendrecv_dhcpc_server_packets(NetworkManager_t)
corenet_sendrecv_all_client_packets(NetworkManager_t) corenet_sendrecv_all_client_packets(NetworkManager_t)
@ -12773,7 +12822,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
mls_file_read_all_levels(NetworkManager_t) mls_file_read_all_levels(NetworkManager_t)
@@ -98,15 +112,20 @@ @@ -98,15 +113,20 @@
domain_use_interactive_fds(NetworkManager_t) domain_use_interactive_fds(NetworkManager_t)
domain_read_confined_domains_state(NetworkManager_t) domain_read_confined_domains_state(NetworkManager_t)
@ -12795,7 +12844,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
logging_send_syslog_msg(NetworkManager_t) logging_send_syslog_msg(NetworkManager_t)
miscfiles_read_localization(NetworkManager_t) miscfiles_read_localization(NetworkManager_t)
@@ -116,25 +135,40 @@ @@ -116,25 +136,40 @@
seutil_read_config(NetworkManager_t) seutil_read_config(NetworkManager_t)
@ -12843,7 +12892,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -146,8 +180,25 @@ @@ -146,8 +181,25 @@
') ')
optional_policy(` optional_policy(`
@ -12871,7 +12920,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -155,23 +206,51 @@ @@ -155,23 +207,51 @@
') ')
optional_policy(` optional_policy(`
@ -12925,7 +12974,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -179,12 +258,15 @@ @@ -179,12 +259,15 @@
') ')
optional_policy(` optional_policy(`
@ -13268,7 +13317,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## </summary> ## </summary>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.6.32/policy/modules/services/ntp.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.6.32/policy/modules/services/ntp.te
--- nsaserefpolicy/policy/modules/services/ntp.te 2009-08-14 16:14:31.000000000 -0400 --- nsaserefpolicy/policy/modules/services/ntp.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/ntp.te 2009-09-16 10:03:09.000000000 -0400 +++ serefpolicy-3.6.32/policy/modules/services/ntp.te 2009-09-18 21:48:48.000000000 -0400
@@ -41,10 +41,11 @@ @@ -41,10 +41,11 @@
# sys_resource and setrlimit is for locking memory # sys_resource and setrlimit is for locking memory
@ -13290,7 +13339,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow ntpd_t ntpd_log_t:dir setattr; allow ntpd_t ntpd_log_t:dir setattr;
manage_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t) manage_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
@@ -97,6 +99,8 @@ @@ -72,6 +74,7 @@
manage_files_pattern(ntpd_t, ntpd_var_run_t, ntpd_var_run_t)
files_pid_filetrans(ntpd_t, ntpd_var_run_t, file)
+kernel_load_module_request(ntpd_t)
kernel_read_kernel_sysctls(ntpd_t)
kernel_read_system_state(ntpd_t)
kernel_read_network_state(ntpd_t)
@@ -97,6 +100,8 @@
fs_getattr_all_fs(ntpd_t) fs_getattr_all_fs(ntpd_t)
fs_search_auto_mountpoints(ntpd_t) fs_search_auto_mountpoints(ntpd_t)
@ -13299,7 +13356,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
term_use_ptmx(ntpd_t) term_use_ptmx(ntpd_t)
@@ -129,6 +133,7 @@ @@ -129,6 +134,7 @@
optional_policy(` optional_policy(`
gpsd_rw_shm(ntpd_t) gpsd_rw_shm(ntpd_t)
@ -15607,6 +15664,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## All of the rules required to administrate ## All of the rules required to administrate
## an rpcbind environment ## an rpcbind environment
## </summary> ## </summary>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.6.32/policy/modules/services/rpcbind.te
--- nsaserefpolicy/policy/modules/services/rpcbind.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/rpcbind.te 2009-09-18 21:48:14.000000000 -0400
@@ -42,6 +42,7 @@
kernel_read_system_state(rpcbind_t)
kernel_read_network_state(rpcbind_t)
+kernel_load_module_request(rpcbind_t)
corenet_all_recvfrom_unlabeled(rpcbind_t)
corenet_all_recvfrom_netlabel(rpcbind_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.6.32/policy/modules/services/rpc.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.6.32/policy/modules/services/rpc.if
--- nsaserefpolicy/policy/modules/services/rpc.if 2009-07-14 14:19:57.000000000 -0400 --- nsaserefpolicy/policy/modules/services/rpc.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/rpc.if 2009-09-16 10:03:09.000000000 -0400 +++ serefpolicy-3.6.32/policy/modules/services/rpc.if 2009-09-16 10:03:09.000000000 -0400
@ -16454,7 +16522,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.6.32/policy/modules/services/sendmail.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.6.32/policy/modules/services/sendmail.te
--- nsaserefpolicy/policy/modules/services/sendmail.te 2009-08-14 16:14:31.000000000 -0400 --- nsaserefpolicy/policy/modules/services/sendmail.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/sendmail.te 2009-09-16 10:03:09.000000000 -0400 +++ serefpolicy-3.6.32/policy/modules/services/sendmail.te 2009-09-18 21:48:01.000000000 -0400
@@ -20,13 +20,17 @@ @@ -20,13 +20,17 @@
mta_mailserver_delivery(sendmail_t) mta_mailserver_delivery(sendmail_t)
mta_mailserver_sender(sendmail_t) mta_mailserver_sender(sendmail_t)
@ -16475,15 +16543,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow sendmail_t self:fifo_file rw_fifo_file_perms; allow sendmail_t self:fifo_file rw_fifo_file_perms;
allow sendmail_t self:unix_stream_socket create_stream_socket_perms; allow sendmail_t self:unix_stream_socket create_stream_socket_perms;
allow sendmail_t self:unix_dgram_socket create_socket_perms; allow sendmail_t self:unix_dgram_socket create_socket_perms;
@@ -47,6 +51,7 @@ @@ -47,6 +51,8 @@
kernel_read_kernel_sysctls(sendmail_t) kernel_read_kernel_sysctls(sendmail_t)
# for piping mail to a command # for piping mail to a command
kernel_read_system_state(sendmail_t) kernel_read_system_state(sendmail_t)
+kernel_read_network_state(sendmail_t) +kernel_read_network_state(sendmail_t)
+kernel_load_module_request(sendmail_t)
corenet_all_recvfrom_unlabeled(sendmail_t) corenet_all_recvfrom_unlabeled(sendmail_t)
corenet_all_recvfrom_netlabel(sendmail_t) corenet_all_recvfrom_netlabel(sendmail_t)
@@ -64,24 +69,29 @@ @@ -64,24 +70,29 @@
fs_getattr_all_fs(sendmail_t) fs_getattr_all_fs(sendmail_t)
fs_search_auto_mountpoints(sendmail_t) fs_search_auto_mountpoints(sendmail_t)
@ -16513,7 +16582,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
auth_use_nsswitch(sendmail_t) auth_use_nsswitch(sendmail_t)
@@ -89,23 +99,46 @@ @@ -89,23 +100,46 @@
libs_read_lib_files(sendmail_t) libs_read_lib_files(sendmail_t)
logging_send_syslog_msg(sendmail_t) logging_send_syslog_msg(sendmail_t)
@ -16562,7 +16631,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -113,13 +146,20 @@ @@ -113,13 +147,20 @@
') ')
optional_policy(` optional_policy(`
@ -16584,7 +16653,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -127,24 +167,29 @@ @@ -127,24 +168,29 @@
') ')
optional_policy(` optional_policy(`
@ -17813,7 +17882,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.6.32/policy/modules/services/ssh.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.6.32/policy/modules/services/ssh.te
--- nsaserefpolicy/policy/modules/services/ssh.te 2009-08-14 16:14:31.000000000 -0400 --- nsaserefpolicy/policy/modules/services/ssh.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/ssh.te 2009-09-18 17:38:09.000000000 -0400 +++ serefpolicy-3.6.32/policy/modules/services/ssh.te 2009-09-18 21:47:14.000000000 -0400
@@ -41,6 +41,9 @@ @@ -41,6 +41,9 @@
files_tmp_file(sshd_tmp_t) files_tmp_file(sshd_tmp_t)
files_poly_parent(sshd_tmp_t) files_poly_parent(sshd_tmp_t)
@ -17925,7 +17994,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -310,16 +306,34 @@ @@ -301,6 +297,7 @@
kernel_search_key(sshd_t)
kernel_link_key(sshd_t)
+kernel_load_module_request(sshd_t)
term_use_all_user_ptys(sshd_t)
term_setattr_all_user_ptys(sshd_t)
@@ -310,16 +307,34 @@
corenet_tcp_bind_xserver_port(sshd_t) corenet_tcp_bind_xserver_port(sshd_t)
corenet_sendrecv_xserver_server_packets(sshd_t) corenet_sendrecv_xserver_server_packets(sshd_t)
@ -17962,7 +18039,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -331,6 +345,10 @@ @@ -331,6 +346,10 @@
') ')
optional_policy(` optional_policy(`
@ -17973,7 +18050,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
rpm_use_script_fds(sshd_t) rpm_use_script_fds(sshd_t)
') ')
@@ -341,7 +359,11 @@ @@ -341,7 +360,11 @@
') ')
optional_policy(` optional_policy(`
@ -17986,7 +18063,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
unconfined_shell_domtrans(sshd_t) unconfined_shell_domtrans(sshd_t)
') ')
@@ -400,15 +422,13 @@ @@ -400,15 +423,13 @@
init_use_fds(ssh_keygen_t) init_use_fds(ssh_keygen_t)
init_use_script_ptys(ssh_keygen_t) init_use_script_ptys(ssh_keygen_t)
@ -19515,7 +19592,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.32/policy/modules/services/xserver.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.32/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2009-08-28 14:58:20.000000000 -0400 --- nsaserefpolicy/policy/modules/services/xserver.te 2009-08-28 14:58:20.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/xserver.te 2009-09-16 10:03:09.000000000 -0400 +++ serefpolicy-3.6.32/policy/modules/services/xserver.te 2009-09-18 21:46:25.000000000 -0400
@@ -34,6 +34,13 @@ @@ -34,6 +34,13 @@
## <desc> ## <desc>
@ -19759,7 +19836,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# connect to xdm xserver over stream socket # connect to xdm xserver over stream socket
stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t) stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t)
@@ -366,10 +420,14 @@ @@ -366,15 +420,20 @@
delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)
delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t) delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)
@ -19775,7 +19852,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_system_state(xdm_t) kernel_read_system_state(xdm_t)
kernel_read_kernel_sysctls(xdm_t) kernel_read_kernel_sysctls(xdm_t)
@@ -389,11 +447,13 @@ kernel_read_net_sysctls(xdm_t)
kernel_read_network_state(xdm_t)
+kernel_load_module_request(xdm_t)
corecmd_exec_shell(xdm_t)
corecmd_exec_bin(xdm_t)
@@ -389,11 +448,13 @@
corenet_udp_sendrecv_all_ports(xdm_t) corenet_udp_sendrecv_all_ports(xdm_t)
corenet_tcp_bind_generic_node(xdm_t) corenet_tcp_bind_generic_node(xdm_t)
corenet_udp_bind_generic_node(xdm_t) corenet_udp_bind_generic_node(xdm_t)
@ -19789,7 +19872,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dev_read_rand(xdm_t) dev_read_rand(xdm_t)
dev_read_sysfs(xdm_t) dev_read_sysfs(xdm_t)
dev_getattr_framebuffer_dev(xdm_t) dev_getattr_framebuffer_dev(xdm_t)
@@ -401,6 +461,7 @@ @@ -401,6 +462,7 @@
dev_getattr_mouse_dev(xdm_t) dev_getattr_mouse_dev(xdm_t)
dev_setattr_mouse_dev(xdm_t) dev_setattr_mouse_dev(xdm_t)
dev_rw_apm_bios(xdm_t) dev_rw_apm_bios(xdm_t)
@ -19797,7 +19880,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dev_setattr_apm_bios_dev(xdm_t) dev_setattr_apm_bios_dev(xdm_t)
dev_rw_dri(xdm_t) dev_rw_dri(xdm_t)
dev_rw_agp(xdm_t) dev_rw_agp(xdm_t)
@@ -413,14 +474,17 @@ @@ -413,14 +475,17 @@
dev_setattr_video_dev(xdm_t) dev_setattr_video_dev(xdm_t)
dev_getattr_scanner_dev(xdm_t) dev_getattr_scanner_dev(xdm_t)
dev_setattr_scanner_dev(xdm_t) dev_setattr_scanner_dev(xdm_t)
@ -19817,7 +19900,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_read_etc_files(xdm_t) files_read_etc_files(xdm_t)
files_read_var_files(xdm_t) files_read_var_files(xdm_t)
@@ -431,9 +495,13 @@ @@ -431,9 +496,13 @@
files_read_usr_files(xdm_t) files_read_usr_files(xdm_t)
# Poweroff wants to create the /poweroff file when run from xdm # Poweroff wants to create the /poweroff file when run from xdm
files_create_boot_flag(xdm_t) files_create_boot_flag(xdm_t)
@ -19831,7 +19914,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_read_fixed_disk(xdm_t)
storage_dontaudit_write_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t)
@@ -442,6 +510,7 @@ @@ -442,6 +511,7 @@
storage_dontaudit_raw_write_removable_device(xdm_t) storage_dontaudit_raw_write_removable_device(xdm_t)
storage_dontaudit_setattr_removable_dev(xdm_t) storage_dontaudit_setattr_removable_dev(xdm_t)
storage_dontaudit_rw_scsi_generic(xdm_t) storage_dontaudit_rw_scsi_generic(xdm_t)
@ -19839,7 +19922,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
term_setattr_console(xdm_t) term_setattr_console(xdm_t)
term_use_unallocated_ttys(xdm_t) term_use_unallocated_ttys(xdm_t)
@@ -450,6 +519,7 @@ @@ -450,6 +520,7 @@
auth_domtrans_pam_console(xdm_t) auth_domtrans_pam_console(xdm_t)
auth_manage_pam_pid(xdm_t) auth_manage_pam_pid(xdm_t)
auth_manage_pam_console_data(xdm_t) auth_manage_pam_console_data(xdm_t)
@ -19847,7 +19930,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
auth_rw_faillog(xdm_t) auth_rw_faillog(xdm_t)
auth_write_login_records(xdm_t) auth_write_login_records(xdm_t)
@@ -460,10 +530,11 @@ @@ -460,10 +531,11 @@
logging_read_generic_logs(xdm_t) logging_read_generic_logs(xdm_t)
@ -19861,7 +19944,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_dontaudit_use_unpriv_user_fds(xdm_t)
userdom_create_all_users_keys(xdm_t) userdom_create_all_users_keys(xdm_t)
@@ -472,6 +543,9 @@ @@ -472,6 +544,9 @@
# Search /proc for any user domain processes. # Search /proc for any user domain processes.
userdom_read_all_users_state(xdm_t) userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t) userdom_signal_all_users(xdm_t)
@ -19871,7 +19954,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
xserver_rw_session(xdm_t, xdm_tmpfs_t) xserver_rw_session(xdm_t, xdm_tmpfs_t)
xserver_unconfined(xdm_t) xserver_unconfined(xdm_t)
@@ -504,10 +578,12 @@ @@ -504,10 +579,12 @@
optional_policy(` optional_policy(`
alsa_domtrans(xdm_t) alsa_domtrans(xdm_t)
@ -19884,7 +19967,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -515,12 +591,46 @@ @@ -515,12 +592,46 @@
') ')
optional_policy(` optional_policy(`
@ -19931,7 +20014,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
hostname_exec(xdm_t) hostname_exec(xdm_t)
') ')
@@ -542,6 +652,30 @@ @@ -542,6 +653,30 @@
') ')
optional_policy(` optional_policy(`
@ -19962,7 +20045,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
seutil_sigchld_newrole(xdm_t) seutil_sigchld_newrole(xdm_t)
') ')
@@ -550,8 +684,9 @@ @@ -550,8 +685,9 @@
') ')
optional_policy(` optional_policy(`
@ -19974,7 +20057,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
ifndef(`distro_redhat',` ifndef(`distro_redhat',`
allow xdm_t self:process { execheap execmem }; allow xdm_t self:process { execheap execmem };
@@ -560,7 +695,6 @@ @@ -560,7 +696,6 @@
ifdef(`distro_rhel4',` ifdef(`distro_rhel4',`
allow xdm_t self:process { execheap execmem }; allow xdm_t self:process { execheap execmem };
') ')
@ -19982,7 +20065,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(` optional_policy(`
userhelper_dontaudit_search_config(xdm_t) userhelper_dontaudit_search_config(xdm_t)
@@ -571,6 +705,10 @@ @@ -571,6 +706,10 @@
') ')
optional_policy(` optional_policy(`
@ -19993,7 +20076,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
xfs_stream_connect(xdm_t) xfs_stream_connect(xdm_t)
') ')
@@ -587,10 +725,9 @@ @@ -587,10 +726,9 @@
# execheap needed until the X module loader is fixed. # execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack # NVIDIA Needs execstack
@ -20005,7 +20088,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow xserver_t self:fd use; allow xserver_t self:fd use;
allow xserver_t self:fifo_file rw_fifo_file_perms; allow xserver_t self:fifo_file rw_fifo_file_perms;
allow xserver_t self:sock_file read_sock_file_perms; allow xserver_t self:sock_file read_sock_file_perms;
@@ -602,9 +739,12 @@ @@ -602,9 +740,12 @@
allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:tcp_socket create_stream_socket_perms;
allow xserver_t self:udp_socket create_socket_perms; allow xserver_t self:udp_socket create_socket_perms;
@ -20018,7 +20101,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow xserver_t { input_xevent_t input_xevent_type }:x_event send; allow xserver_t { input_xevent_t input_xevent_type }:x_event send;
@@ -616,13 +756,14 @@ @@ -616,13 +757,14 @@
type_transition xserver_t xserver_t:{ x_drawable x_colormap } rootwindow_t; type_transition xserver_t xserver_t:{ x_drawable x_colormap } rootwindow_t;
allow xserver_t { rootwindow_t x_domain }:x_drawable send; allow xserver_t { rootwindow_t x_domain }:x_drawable send;
@ -20034,7 +20117,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
@@ -635,9 +776,19 @@ @@ -635,9 +777,19 @@
manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
files_search_var_lib(xserver_t) files_search_var_lib(xserver_t)
@ -20054,7 +20137,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_system_state(xserver_t) kernel_read_system_state(xserver_t)
kernel_read_device_sysctls(xserver_t) kernel_read_device_sysctls(xserver_t)
@@ -671,7 +822,6 @@ @@ -671,7 +823,6 @@
dev_rw_agp(xserver_t) dev_rw_agp(xserver_t)
dev_rw_framebuffer(xserver_t) dev_rw_framebuffer(xserver_t)
dev_manage_dri_dev(xserver_t) dev_manage_dri_dev(xserver_t)
@ -20062,7 +20145,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dev_create_generic_dirs(xserver_t) dev_create_generic_dirs(xserver_t)
dev_setattr_generic_dirs(xserver_t) dev_setattr_generic_dirs(xserver_t)
# raw memory access is needed if not using the frame buffer # raw memory access is needed if not using the frame buffer
@@ -681,9 +831,12 @@ @@ -681,9 +832,12 @@
dev_rw_xserver_misc(xserver_t) dev_rw_xserver_misc(xserver_t)
# read events - the synaptics touchpad driver reads raw events # read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev(xserver_t) dev_rw_input_dev(xserver_t)
@ -20076,7 +20159,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_read_etc_files(xserver_t) files_read_etc_files(xserver_t)
files_read_etc_runtime_files(xserver_t) files_read_etc_runtime_files(xserver_t)
@@ -698,8 +851,12 @@ @@ -698,8 +852,12 @@
fs_search_nfs(xserver_t) fs_search_nfs(xserver_t)
fs_search_auto_mountpoints(xserver_t) fs_search_auto_mountpoints(xserver_t)
fs_search_ramfs(xserver_t) fs_search_ramfs(xserver_t)
@ -20089,7 +20172,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
selinux_validate_context(xserver_t) selinux_validate_context(xserver_t)
selinux_compute_access_vector(xserver_t) selinux_compute_access_vector(xserver_t)
@@ -721,6 +878,7 @@ @@ -721,6 +879,7 @@
miscfiles_read_localization(xserver_t) miscfiles_read_localization(xserver_t)
miscfiles_read_fonts(xserver_t) miscfiles_read_fonts(xserver_t)
@ -20097,7 +20180,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
modutils_domtrans_insmod(xserver_t) modutils_domtrans_insmod(xserver_t)
@@ -743,7 +901,7 @@ @@ -743,7 +902,7 @@
') ')
ifdef(`enable_mls',` ifdef(`enable_mls',`
@ -20106,7 +20189,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
range_transition xserver_t xserver_t:x_drawable s0 - mls_systemhigh; range_transition xserver_t xserver_t:x_drawable s0 - mls_systemhigh;
') ')
@@ -775,12 +933,20 @@ @@ -775,12 +934,20 @@
') ')
optional_policy(` optional_policy(`
@ -20128,7 +20211,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
unconfined_domtrans(xserver_t) unconfined_domtrans(xserver_t)
') ')
@@ -807,7 +973,7 @@ @@ -807,7 +974,7 @@
allow xserver_t xdm_var_lib_t:file { getattr read }; allow xserver_t xdm_var_lib_t:file { getattr read };
dontaudit xserver_t xdm_var_lib_t:dir search; dontaudit xserver_t xdm_var_lib_t:dir search;
@ -20137,7 +20220,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Label pid and temporary files with derived types. # Label pid and temporary files with derived types.
manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
@@ -828,9 +994,14 @@ @@ -828,9 +995,14 @@
# to read ROLE_home_t - examine this in more detail # to read ROLE_home_t - examine this in more detail
# (xauth?) # (xauth?)
userdom_read_user_home_content_files(xserver_t) userdom_read_user_home_content_files(xserver_t)
@ -20152,7 +20235,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
tunable_policy(`use_nfs_home_dirs',` tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(xserver_t) fs_manage_nfs_dirs(xserver_t)
fs_manage_nfs_files(xserver_t) fs_manage_nfs_files(xserver_t)
@@ -845,11 +1016,14 @@ @@ -845,11 +1017,14 @@
optional_policy(` optional_policy(`
dbus_system_bus_client(xserver_t) dbus_system_bus_client(xserver_t)
@ -20168,7 +20251,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -882,6 +1056,8 @@ @@ -882,6 +1057,8 @@
# X Server # X Server
# can read server-owned resources # can read server-owned resources
allow x_domain xserver_t:x_resource read; allow x_domain xserver_t:x_resource read;
@ -20177,7 +20260,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# can mess with own clients # can mess with own clients
allow x_domain self:x_client { manage destroy }; allow x_domain self:x_client { manage destroy };
@@ -906,6 +1082,8 @@ @@ -906,6 +1083,8 @@
# operations allowed on my windows # operations allowed on my windows
allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive }; allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
@ -20186,7 +20269,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# X Colormaps # X Colormaps
# can use the default colormap # can use the default colormap
allow x_domain rootwindow_t:x_colormap { read use add_color }; allow x_domain rootwindow_t:x_colormap { read use add_color };
@@ -973,17 +1151,49 @@ @@ -973,17 +1152,49 @@
allow xserver_unconfined_type { x_domain xserver_t }:x_resource *; allow xserver_unconfined_type { x_domain xserver_t }:x_resource *;
allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *; allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *;
@ -21898,7 +21981,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.6.32/policy/modules/system/iptables.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.6.32/policy/modules/system/iptables.te
--- nsaserefpolicy/policy/modules/system/iptables.te 2009-09-09 09:23:16.000000000 -0400 --- nsaserefpolicy/policy/modules/system/iptables.te 2009-09-09 09:23:16.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/iptables.te 2009-09-16 10:03:09.000000000 -0400 +++ serefpolicy-3.6.32/policy/modules/system/iptables.te 2009-09-18 21:49:05.000000000 -0400
@@ -11,6 +11,12 @@ @@ -11,6 +11,12 @@
init_system_domain(iptables_t, iptables_exec_t) init_system_domain(iptables_t, iptables_exec_t)
role system_r types iptables_t; role system_r types iptables_t;
@ -21922,7 +22005,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
manage_files_pattern(iptables_t, iptables_var_run_t, iptables_var_run_t) manage_files_pattern(iptables_t, iptables_var_run_t, iptables_var_run_t)
files_pid_filetrans(iptables_t, iptables_var_run_t, file) files_pid_filetrans(iptables_t, iptables_var_run_t, file)
@@ -53,6 +62,7 @@ @@ -36,6 +45,7 @@
allow iptables_t iptables_tmp_t:file manage_file_perms;
files_tmp_filetrans(iptables_t, iptables_tmp_t, { file dir })
+kernel_load_module_request(iptables_t)
kernel_read_system_state(iptables_t)
kernel_read_network_state(iptables_t)
kernel_read_kernel_sysctls(iptables_t)
@@ -53,6 +63,7 @@
mls_file_read_all_levels(iptables_t) mls_file_read_all_levels(iptables_t)
term_dontaudit_use_console(iptables_t) term_dontaudit_use_console(iptables_t)
@ -21930,7 +22021,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
domain_use_interactive_fds(iptables_t) domain_use_interactive_fds(iptables_t)
@@ -100,6 +110,10 @@ @@ -100,6 +111,10 @@
') ')
optional_policy(` optional_policy(`
@ -25338,7 +25429,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+HOME_DIR/\.gvfs(/.*)? <<none>> +HOME_DIR/\.gvfs(/.*)? <<none>>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.32/policy/modules/system/userdomain.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.32/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-08-31 13:30:04.000000000 -0400 --- nsaserefpolicy/policy/modules/system/userdomain.if 2009-08-31 13:30:04.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/userdomain.if 2009-09-17 13:00:18.000000000 -0400 +++ serefpolicy-3.6.32/policy/modules/system/userdomain.if 2009-09-18 21:52:11.000000000 -0400
@@ -30,8 +30,9 @@ @@ -30,8 +30,9 @@
') ')
@ -25789,7 +25880,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
############################## ##############################
# #
@@ -508,182 +525,207 @@ @@ -508,182 +525,208 @@
# evolution and gnome-session try to create a netlink socket # evolution and gnome-session try to create a netlink socket
dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown }; dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write }; dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
@ -25811,6 +25902,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Find CDROM devices: # Find CDROM devices:
- kernel_read_device_sysctls($1_t) - kernel_read_device_sysctls($1_t)
+ kernel_read_device_sysctls($1_usertype) + kernel_read_device_sysctls($1_usertype)
+ kernel_load_module_request($1_usertype)
- corecmd_exec_bin($1_t) - corecmd_exec_bin($1_t)
+ corenet_udp_bind_generic_node($1_usertype) + corenet_udp_bind_generic_node($1_usertype)
@ -26070,7 +26162,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
####################################### #######################################
@@ -711,13 +753,26 @@ @@ -711,13 +754,26 @@
userdom_base_user_template($1) userdom_base_user_template($1)
@ -26102,7 +26194,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_change_password_template($1) userdom_change_password_template($1)
@@ -735,70 +790,71 @@ @@ -735,70 +791,71 @@
allow $1_t self:context contains; allow $1_t self:context contains;
@ -26207,7 +26299,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
') ')
@@ -835,6 +891,32 @@ @@ -835,6 +892,32 @@
# Local policy # Local policy
# #
@ -26240,7 +26332,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(` optional_policy(`
loadkeys_run($1_t,$1_r) loadkeys_run($1_t,$1_r)
') ')
@@ -865,51 +947,81 @@ @@ -865,51 +948,81 @@
userdom_restricted_user_template($1) userdom_restricted_user_template($1)
@ -26335,7 +26427,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
') ')
@@ -943,8 +1055,8 @@ @@ -943,8 +1056,8 @@
# Declarations # Declarations
# #
@ -26345,7 +26437,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_common_user_template($1) userdom_common_user_template($1)
############################## ##############################
@@ -953,11 +1065,12 @@ @@ -953,11 +1066,12 @@
# #
# port access is audited even if dac would not have allowed it, so dontaudit it here # port access is audited even if dac would not have allowed it, so dontaudit it here
@ -26360,7 +26452,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# cjp: why? # cjp: why?
files_read_kernel_symbol_table($1_t) files_read_kernel_symbol_table($1_t)
@@ -975,36 +1088,53 @@ @@ -975,36 +1089,53 @@
') ')
') ')
@ -26428,7 +26520,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
') ')
@@ -1040,7 +1170,7 @@ @@ -1040,7 +1171,7 @@
template(`userdom_admin_user_template',` template(`userdom_admin_user_template',`
gen_require(` gen_require(`
attribute admindomain; attribute admindomain;
@ -26437,7 +26529,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
############################## ##############################
@@ -1049,8 +1179,7 @@ @@ -1049,8 +1180,7 @@
# #
# Inherit rules for ordinary users. # Inherit rules for ordinary users.
@ -26447,7 +26539,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
domain_obj_id_change_exemption($1_t) domain_obj_id_change_exemption($1_t)
role system_r types $1_t; role system_r types $1_t;
@@ -1075,6 +1204,9 @@ @@ -1075,6 +1205,9 @@
# Skip authentication when pam_rootok is specified. # Skip authentication when pam_rootok is specified.
allow $1_t self:passwd rootok; allow $1_t self:passwd rootok;
@ -26457,7 +26549,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_software_raid_state($1_t) kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t) kernel_getattr_core_if($1_t)
kernel_getattr_message_if($1_t) kernel_getattr_message_if($1_t)
@@ -1089,6 +1221,7 @@ @@ -1089,6 +1222,7 @@
kernel_sigstop_unlabeled($1_t) kernel_sigstop_unlabeled($1_t)
kernel_signull_unlabeled($1_t) kernel_signull_unlabeled($1_t)
kernel_sigchld_unlabeled($1_t) kernel_sigchld_unlabeled($1_t)
@ -26465,7 +26557,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_tcp_bind_generic_port($1_t) corenet_tcp_bind_generic_port($1_t)
# allow setting up tunnels # allow setting up tunnels
@@ -1096,8 +1229,6 @@ @@ -1096,8 +1230,6 @@
dev_getattr_generic_blk_files($1_t) dev_getattr_generic_blk_files($1_t)
dev_getattr_generic_chr_files($1_t) dev_getattr_generic_chr_files($1_t)
@ -26474,7 +26566,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Allow MAKEDEV to work # Allow MAKEDEV to work
dev_create_all_blk_files($1_t) dev_create_all_blk_files($1_t)
dev_create_all_chr_files($1_t) dev_create_all_chr_files($1_t)
@@ -1124,6 +1255,8 @@ @@ -1124,6 +1256,8 @@
files_exec_usr_src_files($1_t) files_exec_usr_src_files($1_t)
fs_getattr_all_fs($1_t) fs_getattr_all_fs($1_t)
@ -26483,7 +26575,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
fs_set_all_quotas($1_t) fs_set_all_quotas($1_t)
fs_exec_noxattr($1_t) fs_exec_noxattr($1_t)
@@ -1152,20 +1285,6 @@ @@ -1152,20 +1286,6 @@
# But presently necessary for installing the file_contexts file. # But presently necessary for installing the file_contexts file.
seutil_manage_bin_policy($1_t) seutil_manage_bin_policy($1_t)
@ -26504,7 +26596,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(` optional_policy(`
postgresql_unconfined($1_t) postgresql_unconfined($1_t)
') ')
@@ -1211,6 +1330,7 @@ @@ -1211,6 +1331,7 @@
dev_relabel_all_dev_nodes($1) dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1) files_create_boot_flag($1)
@ -26512,7 +26604,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Necessary for managing /boot/efi # Necessary for managing /boot/efi
fs_manage_dos_files($1) fs_manage_dos_files($1)
@@ -1276,11 +1396,15 @@ @@ -1276,11 +1397,15 @@
interface(`userdom_user_home_content',` interface(`userdom_user_home_content',`
gen_require(` gen_require(`
type user_home_t; type user_home_t;
@ -26528,7 +26620,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1391,12 +1515,13 @@ @@ -1391,12 +1516,13 @@
') ')
allow $1 user_home_dir_t:dir search_dir_perms; allow $1 user_home_dir_t:dir search_dir_perms;
@ -26543,7 +26635,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -1429,6 +1554,14 @@ @@ -1429,6 +1555,14 @@
allow $1 user_home_dir_t:dir list_dir_perms; allow $1 user_home_dir_t:dir list_dir_perms;
files_search_home($1) files_search_home($1)
@ -26558,7 +26650,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1444,9 +1577,11 @@ @@ -1444,9 +1578,11 @@
interface(`userdom_dontaudit_list_user_home_dirs',` interface(`userdom_dontaudit_list_user_home_dirs',`
gen_require(` gen_require(`
type user_home_dir_t; type user_home_dir_t;
@ -26570,7 +26662,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1503,6 +1638,25 @@ @@ -1503,6 +1639,25 @@
allow $1 user_home_dir_t:dir relabelto; allow $1 user_home_dir_t:dir relabelto;
') ')
@ -26596,7 +26688,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
######################################## ########################################
## <summary> ## <summary>
## Create directories in the home dir root with ## Create directories in the home dir root with
@@ -1577,6 +1731,8 @@ @@ -1577,6 +1732,8 @@
') ')
dontaudit $1 user_home_t:dir search_dir_perms; dontaudit $1 user_home_t:dir search_dir_perms;
@ -26605,7 +26697,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1670,6 +1826,7 @@ @@ -1670,6 +1827,7 @@
type user_home_dir_t, user_home_t; type user_home_dir_t, user_home_t;
') ')
@ -26613,7 +26705,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t) read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
files_search_home($1) files_search_home($1)
') ')
@@ -1797,19 +1954,32 @@ @@ -1797,19 +1955,32 @@
# #
interface(`userdom_exec_user_home_content_files',` interface(`userdom_exec_user_home_content_files',`
gen_require(` gen_require(`
@ -26653,7 +26745,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1844,6 +2014,7 @@ @@ -1844,6 +2015,7 @@
interface(`userdom_manage_user_home_content_files',` interface(`userdom_manage_user_home_content_files',`
gen_require(` gen_require(`
type user_home_dir_t, user_home_t; type user_home_dir_t, user_home_t;
@ -26661,7 +26753,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
manage_files_pattern($1, user_home_t, user_home_t) manage_files_pattern($1, user_home_t, user_home_t)
@@ -2391,27 +2562,7 @@ @@ -2391,27 +2563,7 @@
######################################## ########################################
## <summary> ## <summary>
@ -26690,7 +26782,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -2765,11 +2916,32 @@ @@ -2765,11 +2917,32 @@
# #
interface(`userdom_search_user_home_content',` interface(`userdom_search_user_home_content',`
gen_require(` gen_require(`
@ -26725,7 +26817,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -2897,7 +3069,25 @@ @@ -2897,7 +3070,25 @@
type user_tmp_t; type user_tmp_t;
') ')
@ -26752,7 +26844,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -2934,6 +3124,7 @@ @@ -2934,6 +3125,7 @@
') ')
read_files_pattern($1, userdomain, userdomain) read_files_pattern($1, userdomain, userdomain)
@ -26760,7 +26852,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_search_proc($1) kernel_search_proc($1)
') ')
@@ -3064,3 +3255,559 @@ @@ -3064,3 +3256,559 @@
allow $1 userdomain:dbus send_msg; allow $1 userdomain:dbus send_msg;
') ')

5
selinux-policy.spec
View File

@ -20,7 +20,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.6.32 Version: 3.6.32
Release: 5%{?dist} Release: 6%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -447,6 +447,9 @@ exit 0
%endif %endif
%changelog %changelog
* Fri Sep 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-6
- More fixes for sandbox_web_t
* Fri Sep 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-5 * Fri Sep 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.32-5
- Allow sshd to create .ssh directory and content - Allow sshd to create .ssh directory and content