rpms/selinux-policy
6
0
Fork 0
Code Issues Pull Requests Releases Activity

MCS fixes

Browse Source 
quota fixes
This commit is contained in:
Dan Walsh 2011-11-04 13:31:43 -04:00
parent 5717c509f3
commit 8872d3d2ac
4 changed files with 541 additions and 295 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
config.tgz
View File

Binary file not shown.

798
policy-F16.patch
View File

File diff suppressed because it is too large Load Diff

27
qemu.patch
View File

@ -1,6 +1,6 @@
diff -up serefpolicy-3.10.0/policy/modules/apps/qemu.te.qemu serefpolicy-3.10.0/policy/modules/apps/qemu.te diff -up serefpolicy-3.10.0/policy/modules/apps/qemu.te.qemu serefpolicy-3.10.0/policy/modules/apps/qemu.te
--- serefpolicy-3.10.0/policy/modules/apps/qemu.te.qemu 2011-10-27 14:01:31.490807653 -0400 --- serefpolicy-3.10.0/policy/modules/apps/qemu.te.qemu 2011-11-04 13:28:26.200380523 -0400
+++ serefpolicy-3.10.0/policy/modules/apps/qemu.te 2011-10-27 14:01:33.082806413 -0400 +++ serefpolicy-3.10.0/policy/modules/apps/qemu.te 2011-11-04 13:28:27.042380389 -0400
@@ -40,9 +40,7 @@ gen_tunable(qemu_use_nfs, true) @@ -40,9 +40,7 @@ gen_tunable(qemu_use_nfs, true)
## </desc> ## </desc>
gen_tunable(qemu_use_usb, true) gen_tunable(qemu_use_usb, true)
@ -12,8 +12,8 @@ diff -up serefpolicy-3.10.0/policy/modules/apps/qemu.te.qemu serefpolicy-3.10.0/
######################################## ########################################
diff -up serefpolicy-3.10.0/policy/modules/services/virt.if.qemu serefpolicy-3.10.0/policy/modules/services/virt.if diff -up serefpolicy-3.10.0/policy/modules/services/virt.if.qemu serefpolicy-3.10.0/policy/modules/services/virt.if
--- serefpolicy-3.10.0/policy/modules/services/virt.if.qemu 2011-10-27 14:01:33.036806448 -0400 --- serefpolicy-3.10.0/policy/modules/services/virt.if.qemu 2011-11-04 13:28:27.013380393 -0400
+++ serefpolicy-3.10.0/policy/modules/services/virt.if 2011-10-27 14:01:33.084806412 -0400 +++ serefpolicy-3.10.0/policy/modules/services/virt.if 2011-11-04 13:28:27.044380389 -0400
@@ -16,10 +16,11 @@ template(`virt_domain_template',` @@ -16,10 +16,11 @@ template(`virt_domain_template',`
attribute virt_image_type, virt_domain; attribute virt_image_type, virt_domain;
attribute virt_tmpfs_type; attribute virt_tmpfs_type;
@ -50,8 +50,8 @@ diff -up serefpolicy-3.10.0/policy/modules/services/virt.if.qemu serefpolicy-3.1
+') +')
+ +
diff -up serefpolicy-3.10.0/policy/modules/services/virt.te.qemu serefpolicy-3.10.0/policy/modules/services/virt.te diff -up serefpolicy-3.10.0/policy/modules/services/virt.te.qemu serefpolicy-3.10.0/policy/modules/services/virt.te
--- serefpolicy-3.10.0/policy/modules/services/virt.te.qemu 2011-10-27 14:01:33.038806446 -0400 --- serefpolicy-3.10.0/policy/modules/services/virt.te.qemu 2011-11-04 13:28:27.015380393 -0400
+++ serefpolicy-3.10.0/policy/modules/services/virt.te 2011-10-27 14:02:18.478770938 -0400 +++ serefpolicy-3.10.0/policy/modules/services/virt.te 2011-11-04 13:30:30.832359916 -0400
@@ -73,11 +73,14 @@ gen_tunable(virt_use_usb, true) @@ -73,11 +73,14 @@ gen_tunable(virt_use_usb, true)
virt_domain_template(svirt) virt_domain_template(svirt)
@ -67,24 +67,25 @@ diff -up serefpolicy-3.10.0/policy/modules/services/virt.te.qemu serefpolicy-3.1
type virt_cache_t alias svirt_cache_t; type virt_cache_t alias svirt_cache_t;
files_type(virt_cache_t) files_type(virt_cache_t)
@@ -279,6 +282,8 @@ allow virtd_t virt_domain:process { geta @@ -275,6 +278,9 @@ allow virtd_t virt_domain:process { geta
allow virt_domain virtd_t:fd use; allow virt_domain virtd_t:fd use;
dontaudit virt_domain virtd_t:unix_stream_socket { read write }; dontaudit virt_domain virtd_t:unix_stream_socket { read write };
+can_exec(virt_t, qemu_exec_t)
+can_exec(virt_domain, qemu_exec_t) +can_exec(virt_domain, qemu_exec_t)
+ +
allow virtd_t qemu_var_run_t:file relabel_file_perms; allow virtd_t qemu_var_run_t:file relabel_file_perms;
manage_dirs_pattern(virtd_t, qemu_var_run_t, qemu_var_run_t) manage_dirs_pattern(virtd_t, qemu_var_run_t, qemu_var_run_t)
manage_files_pattern(virtd_t, qemu_var_run_t, qemu_var_run_t) manage_files_pattern(virtd_t, qemu_var_run_t, qemu_var_run_t)
@@ -514,11 +519,6 @@ optional_policy(` @@ -643,11 +649,6 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
- qemu_entry_type(virt_domain) - qemu_entry_type(virt_domain)
- qemu_exec(virt_domain) - qemu_exec(virt_domain)
-') -')
- -
-optional_policy(` -optional_policy(`
sanlock_stream_connect(virtd_t) virt_read_config(virt_domain)
') virt_read_lib_files(virt_domain)
virt_read_content(virt_domain)

11
selinux-policy.spec
View File

@ -17,7 +17,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.10.0 Version: 3.10.0
Release: 53%{?dist} Release: 54%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -30,6 +30,7 @@ patch5: userdomain.patch
patch6: apache.patch patch6: apache.patch
patch7: ptrace.patch patch7: ptrace.patch
patch8: qemu.patch patch8: qemu.patch
patch9: consoletype.patch
Source1: modules-targeted.conf Source1: modules-targeted.conf
Source2: booleans-targeted.conf Source2: booleans-targeted.conf
Source3: Makefile.devel Source3: Makefile.devel
@ -252,6 +253,7 @@ Based off of reference policy: Checked out revision 2.20091117
%patch6 -p1 -b .apache %patch6 -p1 -b .apache
%patch7 -p1 -b .ptrace %patch7 -p1 -b .ptrace
%patch8 -p1 -b .qemu %patch8 -p1 -b .qemu
%patch9 -p1 -b .consoletype
%install %install
mkdir selinux_config mkdir selinux_config
@ -483,6 +485,13 @@ SELinux Reference policy mls base module.
%endif %endif
%changelog %changelog
* Fri Nov 4 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-54
- MCS fixes
- quota fixes
* Thu Nov 4 2011 Dan Walsh <dwalsh@redhat.com> 3.10.0-53.1
- Remove transitions to consoletype
* Tue Nov 1 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-53 * Tue Nov 1 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-53
- Make nvidia* to be labeled correctly - Make nvidia* to be labeled correctly
- Fix abrt_manage_cache() interface - Fix abrt_manage_cache() interface