- Fixes for cdrecord, mdadm, and others
This commit is contained in:
Daniel J Walsh
parent
7078554d07
commit
89e3546337
215
policy-F12.patch
215
policy-F12.patch
@ -1376,9 +1376,24 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
kismet_manage_log(tmpreaper_t)
|
||||
')
|
||||
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.6.28/policy/modules/admin/usermanage.if
|
||||
--- nsaserefpolicy/policy/modules/admin/usermanage.if 2009-07-14 14:19:57.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/admin/usermanage.if 2009-08-25 14:37:45.000000000 -0400
|
||||
@@ -274,6 +274,11 @@
|
||||
usermanage_domtrans_useradd($1)
|
||||
role $2 types useradd_t;
|
||||
|
||||
+ # Add/remove user home directories
|
||||
+ userdom_manage_home_role($2, useradd_t)
|
||||
+
|
||||
+ seutil_run_semanage(useradd_t, $2)
|
||||
+
|
||||
optional_policy(`
|
||||
nscd_run(useradd_t, $2)
|
||||
')
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.6.28/policy/modules/admin/usermanage.te
|
||||
--- nsaserefpolicy/policy/modules/admin/usermanage.te 2009-08-14 16:14:31.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/admin/usermanage.te 2009-08-21 18:56:06.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/admin/usermanage.te 2009-08-25 09:31:26.000000000 -0400
|
||||
@@ -209,6 +209,7 @@
|
||||
files_manage_etc_files(groupadd_t)
|
||||
files_relabel_etc_files(groupadd_t)
|
||||
@ -1439,7 +1454,19 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
init_use_fds(useradd_t)
|
||||
init_rw_utmp(useradd_t)
|
||||
@@ -521,6 +518,12 @@
|
||||
@@ -494,10 +491,7 @@
|
||||
|
||||
userdom_use_unpriv_users_fds(useradd_t)
|
||||
# Add/remove user home directories
|
||||
-userdom_manage_user_home_content_dirs(useradd_t)
|
||||
-userdom_manage_user_home_content_files(useradd_t)
|
||||
-userdom_home_filetrans_user_home_dir(useradd_t)
|
||||
-userdom_user_home_dir_filetrans_user_home_content(useradd_t, notdevfile_class_set)
|
||||
+userdom_manage_home_role(system_r, useradd_t)
|
||||
|
||||
mta_manage_spool(useradd_t)
|
||||
|
||||
@@ -521,6 +515,12 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -1519,6 +1546,32 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+optional_policy(`
|
||||
+ nscd_socket_use(calamaris_t)
|
||||
+')
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cdrecord.te serefpolicy-3.6.28/policy/modules/apps/cdrecord.te
|
||||
--- nsaserefpolicy/policy/modules/apps/cdrecord.te 2009-08-14 16:14:31.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/apps/cdrecord.te 2009-08-25 15:56:57.000000000 -0400
|
||||
@@ -28,12 +28,13 @@
|
||||
#
|
||||
|
||||
allow cdrecord_t self:capability { ipc_lock sys_nice setuid dac_override sys_rawio };
|
||||
-allow cdrecord_t self:process { getsched setsched sigkill };
|
||||
+allow cdrecord_t self:process { getcap getsched setsched sigkill };
|
||||
allow cdrecord_t self:unix_dgram_socket create_socket_perms;
|
||||
allow cdrecord_t self:unix_stream_socket create_stream_socket_perms;
|
||||
|
||||
# allow searching for cdrom-drive
|
||||
dev_list_all_dev_nodes(cdrecord_t)
|
||||
+dev_read_sysfs(cdrecord_t)
|
||||
|
||||
domain_interactive_fd(cdrecord_t)
|
||||
domain_use_interactive_fds(cdrecord_t)
|
||||
@@ -44,6 +45,7 @@
|
||||
term_list_ptys(cdrecord_t)
|
||||
|
||||
# allow cdrecord to write the CD
|
||||
+storage_raw_read_removable_device(cdrecord_t)
|
||||
storage_raw_write_removable_device(cdrecord_t)
|
||||
storage_write_scsi_generic(cdrecord_t)
|
||||
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqselector.te serefpolicy-3.6.28/policy/modules/apps/cpufreqselector.te
|
||||
--- nsaserefpolicy/policy/modules/apps/cpufreqselector.te 2009-07-28 13:28:33.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/apps/cpufreqselector.te 2009-08-21 18:56:06.000000000 -0400
|
||||
@ -3538,20 +3591,32 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+term_use_ptmx(ptchown_t)
|
||||
+
|
||||
+miscfiles_read_localization(ptchown_t)
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.if serefpolicy-3.6.28/policy/modules/apps/pulseaudio.if
|
||||
--- nsaserefpolicy/policy/modules/apps/pulseaudio.if 2009-07-23 14:11:04.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/apps/pulseaudio.if 2009-08-25 15:59:29.000000000 -0400
|
||||
@@ -141,5 +141,6 @@
|
||||
')
|
||||
|
||||
allow $1 pulseaudio_t:process signull;
|
||||
+ allow pulseaudio_t $1:process signull;
|
||||
allow $1 pulseaudio_t:unix_stream_socket connectto;
|
||||
')
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te
|
||||
--- nsaserefpolicy/policy/modules/apps/pulseaudio.te 2009-07-23 14:11:04.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te 2009-08-22 07:48:07.000000000 -0400
|
||||
@@ -22,6 +22,9 @@
|
||||
+++ serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te 2009-08-26 08:11:55.000000000 -0400
|
||||
@@ -22,7 +22,11 @@
|
||||
allow pulseaudio_t self:unix_dgram_socket { sendto create_socket_perms };
|
||||
allow pulseaudio_t self:tcp_socket create_stream_socket_perms;
|
||||
allow pulseaudio_t self:udp_socket create_socket_perms;
|
||||
+allow pulseaudio_t self:netlink_kobject_uevent_socket create_socket_perms;
|
||||
+
|
||||
+can_exec(pulseaudio_t, pulseaudio_exec_t)
|
||||
|
||||
+can_exec(pulseaudio_t, pulseaudio_exec_t)
|
||||
+
|
||||
+kernel_read_system_state(pulseaudio_t)
|
||||
kernel_read_kernel_sysctls(pulseaudio_t)
|
||||
|
||||
@@ -47,6 +50,7 @@
|
||||
corecmd_exec_bin(pulseaudio_t)
|
||||
@@ -47,6 +51,7 @@
|
||||
|
||||
fs_rw_anon_inodefs_files(pulseaudio_t)
|
||||
fs_getattr_tmpfs(pulseaudio_t)
|
||||
@ -3559,7 +3624,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
term_use_all_user_ttys(pulseaudio_t)
|
||||
term_use_all_user_ptys(pulseaudio_t)
|
||||
@@ -78,6 +82,15 @@
|
||||
@@ -78,6 +83,15 @@
|
||||
policykit_domtrans_auth(pulseaudio_t)
|
||||
policykit_read_lib(pulseaudio_t)
|
||||
policykit_read_reload(pulseaudio_t)
|
||||
@ -3575,7 +3640,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -85,8 +98,7 @@
|
||||
@@ -85,8 +99,7 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -4620,8 +4685,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
-/opt/picasa/wine/bin/wine -- gen_context(system_u:object_r:wine_exec_t,s0)
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.6.28/policy/modules/apps/wine.if
|
||||
--- nsaserefpolicy/policy/modules/apps/wine.if 2009-07-14 14:19:57.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/apps/wine.if 2009-08-21 18:56:07.000000000 -0400
|
||||
@@ -43,3 +43,63 @@
|
||||
+++ serefpolicy-3.6.28/policy/modules/apps/wine.if 2009-08-25 15:59:59.000000000 -0400
|
||||
@@ -43,3 +43,62 @@
|
||||
wine_domtrans($1)
|
||||
role $2 types wine_t;
|
||||
')
|
||||
@ -4683,11 +4748,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+ relabel_dirs_pattern($2, wine_home_t, wine_home_t)
|
||||
+ relabel_files_pattern($2, wine_home_t, wine_home_t)
|
||||
+ relabel_lnk_files_pattern($2, wine_home_t, wine_home_t)
|
||||
+
|
||||
+')
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.6.28/policy/modules/apps/wine.te
|
||||
--- nsaserefpolicy/policy/modules/apps/wine.te 2009-07-14 14:19:57.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/apps/wine.te 2009-08-21 18:56:07.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/apps/wine.te 2009-08-25 16:00:27.000000000 -0400
|
||||
@@ -9,20 +9,35 @@
|
||||
type wine_t;
|
||||
type wine_exec_t;
|
||||
@ -4933,7 +4997,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
/dev/usb/mdc800.* -c gen_context(system_u:object_r:scanner_device_t,s0)
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.6.28/policy/modules/kernel/devices.if
|
||||
--- nsaserefpolicy/policy/modules/kernel/devices.if 2009-07-14 14:19:57.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/kernel/devices.if 2009-08-24 08:40:29.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/kernel/devices.if 2009-08-25 15:58:11.000000000 -0400
|
||||
@@ -1655,6 +1655,78 @@
|
||||
|
||||
########################################
|
||||
@ -5954,7 +6018,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+/dev/shm -d gen_context(system_u:object_r:tmpfs_t,s0)
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.6.28/policy/modules/kernel/filesystem.if
|
||||
--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2009-07-14 14:19:57.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/kernel/filesystem.if 2009-08-24 08:48:26.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/kernel/filesystem.if 2009-08-24 09:57:00.000000000 -0400
|
||||
@@ -1537,6 +1537,24 @@
|
||||
|
||||
########################################
|
||||
@ -6377,6 +6441,29 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+ fs_type($1)
|
||||
+ mls_trusted_object($1)
|
||||
+')
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.6.28/policy/modules/kernel/storage.fc
|
||||
--- nsaserefpolicy/policy/modules/kernel/storage.fc 2009-07-29 15:15:33.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/kernel/storage.fc 2009-08-24 10:07:26.000000000 -0400
|
||||
@@ -28,6 +28,7 @@
|
||||
/dev/megadev.* -c gen_context(system_u:object_r:removable_device_t,s0)
|
||||
/dev/mmcblk.* -b gen_context(system_u:object_r:removable_device_t,s0)
|
||||
/dev/mspblk.* -b gen_context(system_u:object_r:removable_device_t,s0)
|
||||
+/dev/mtd.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
|
||||
/dev/nb[^/]+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
|
||||
/dev/optcd -b gen_context(system_u:object_r:removable_device_t,s0)
|
||||
/dev/p[fg][0-3] -b gen_context(system_u:object_r:removable_device_t,s0)
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.6.28/policy/modules/kernel/storage.if
|
||||
--- nsaserefpolicy/policy/modules/kernel/storage.if 2009-07-14 14:19:57.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/kernel/storage.if 2009-08-25 15:56:31.000000000 -0400
|
||||
@@ -529,7 +529,7 @@
|
||||
|
||||
')
|
||||
|
||||
- dontaudit $1 removable_device_t:blk_file { getattr ioctl read };
|
||||
+ dontaudit $1 removable_device_t:blk_file read_blk_file_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.6.28/policy/modules/kernel/terminal.fc
|
||||
--- nsaserefpolicy/policy/modules/kernel/terminal.fc 2009-07-14 14:19:57.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/kernel/terminal.fc 2009-08-21 18:56:07.000000000 -0400
|
||||
@ -7680,8 +7767,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+')
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.te serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te
|
||||
--- nsaserefpolicy/policy/modules/roles/unconfineduser.te 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te 2009-08-21 18:56:07.000000000 -0400
|
||||
@@ -0,0 +1,391 @@
|
||||
+++ serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te 2009-08-25 09:40:01.000000000 -0400
|
||||
@@ -0,0 +1,392 @@
|
||||
+policy_module(unconfineduser, 1.0.0)
|
||||
+
|
||||
+########################################
|
||||
@ -7937,9 +8024,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+ portmap_run_helper(unconfined_t, unconfined_r)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ ppp_run(unconfined_t, unconfined_r)
|
||||
+')
|
||||
+#optional_policy(`
|
||||
+# ppp_run(unconfined_t, unconfined_r)
|
||||
+#')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ qemu_role_notrans(unconfined_r, unconfined_t)
|
||||
@ -8012,6 +8099,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+allow unconfined_execmem_t self:process { execstack execmem };
|
||||
+unconfined_domain_noaudit(unconfined_execmem_t)
|
||||
+allow unconfined_execmem_t unconfined_t:process transition;
|
||||
+rpm_transition_script(unconfined_execmem_t)
|
||||
+
|
||||
+optional_policy(`
|
||||
+ init_dbus_chat_script(unconfined_execmem_t)
|
||||
@ -8548,6 +8636,28 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+
|
||||
+permissive abrt_t;
|
||||
+
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/afs.fc serefpolicy-3.6.28/policy/modules/services/afs.fc
|
||||
--- nsaserefpolicy/policy/modules/services/afs.fc 2009-07-23 14:11:04.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/afs.fc 2009-08-24 10:21:30.000000000 -0400
|
||||
@@ -25,6 +25,7 @@
|
||||
/usr/vice/etc/afsd -- gen_context(system_u:object_r:afs_exec_t,s0)
|
||||
|
||||
/var/cache/afs(/.*)? gen_context(system_u:object_r:afs_cache_t,s0)
|
||||
+/usr/vice/cache(/.*)? gen_context(system_u:object_r:afs_cache_t,s0)
|
||||
|
||||
/vicepa gen_context(system_u:object_r:afs_files_t,s0)
|
||||
/vicepb gen_context(system_u:object_r:afs_files_t,s0)
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/afs.te serefpolicy-3.6.28/policy/modules/services/afs.te
|
||||
--- nsaserefpolicy/policy/modules/services/afs.te 2009-08-14 16:14:31.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/afs.te 2009-08-24 09:19:56.000000000 -0400
|
||||
@@ -83,6 +83,7 @@
|
||||
|
||||
files_mounton_mnt(afs_t)
|
||||
files_read_etc_files(afs_t)
|
||||
+files_read_usr_files(afs_t)
|
||||
files_rw_etc_runtime_files(afs_t)
|
||||
|
||||
fs_getattr_xattr_fs(afs_t)
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.6.28/policy/modules/services/amavis.te
|
||||
--- nsaserefpolicy/policy/modules/services/amavis.te 2009-08-14 16:14:31.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/amavis.te 2009-08-21 18:56:07.000000000 -0400
|
||||
@ -11132,7 +11242,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.6.28/policy/modules/services/dbus.if
|
||||
--- nsaserefpolicy/policy/modules/services/dbus.if 2009-07-28 13:28:33.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/dbus.if 2009-08-23 12:50:58.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/dbus.if 2009-08-25 16:33:22.000000000 -0400
|
||||
@@ -42,8 +42,10 @@
|
||||
gen_require(`
|
||||
class dbus { send_msg acquire_svc };
|
||||
@ -11251,11 +11361,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+#
|
||||
+interface(`dbus_manage_lib_files',`
|
||||
+ gen_require(`
|
||||
+ type system_dbus_var_lib_t;
|
||||
+ type system_dbusd_var_lib_t;
|
||||
+ ')
|
||||
+
|
||||
+ files_search_var_lib($1)
|
||||
+ manage_files_pattern($1, system_dbus_var_lib_t, system_dbus_var_lib_t)
|
||||
+ manage_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
|
||||
+')
|
||||
+
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.6.28/policy/modules/services/dbus.te
|
||||
@ -15127,7 +15237,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
########################################
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.6.28/policy/modules/services/ppp.te
|
||||
--- nsaserefpolicy/policy/modules/services/ppp.te 2009-08-14 16:14:31.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/ppp.te 2009-08-21 18:56:07.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/ppp.te 2009-08-24 09:25:42.000000000 -0400
|
||||
@@ -193,6 +193,8 @@
|
||||
|
||||
optional_policy(`
|
||||
@ -15137,6 +15247,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -216,7 +218,7 @@
|
||||
# PPTP Local policy
|
||||
#
|
||||
|
||||
-allow pptp_t self:capability { net_raw net_admin };
|
||||
+allow pptp_t self:capability { dac_override dac_read_search net_raw net_admin };
|
||||
dontaudit pptp_t self:capability sys_tty_config;
|
||||
allow pptp_t self:process signal;
|
||||
allow pptp_t self:fifo_file rw_fifo_file_perms;
|
||||
@@ -295,6 +297,14 @@
|
||||
')
|
||||
|
||||
@ -15935,7 +16054,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
')
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.6.28/policy/modules/services/samba.te
|
||||
--- nsaserefpolicy/policy/modules/services/samba.te 2009-08-14 16:14:31.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/samba.te 2009-08-21 18:56:07.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/services/samba.te 2009-08-25 09:18:50.000000000 -0400
|
||||
@@ -66,6 +66,13 @@
|
||||
## </desc>
|
||||
gen_tunable(samba_share_nfs, false)
|
||||
@ -15978,7 +16097,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
# Allow samba to list mnt_t for potential mounted dirs
|
||||
files_list_mnt(smbd_t)
|
||||
|
||||
@@ -341,6 +352,8 @@
|
||||
@@ -338,9 +349,12 @@
|
||||
|
||||
userdom_use_unpriv_users_fds(smbd_t)
|
||||
userdom_dontaudit_search_user_home_dirs(smbd_t)
|
||||
+userdom_signal_all_users(smbd_t)
|
||||
|
||||
usermanage_read_crack_db(smbd_t)
|
||||
|
||||
@ -15987,7 +16110,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
ifdef(`hide_broken_symptoms', `
|
||||
files_dontaudit_getattr_default_dirs(smbd_t)
|
||||
files_dontaudit_getattr_boot_dirs(smbd_t)
|
||||
@@ -352,19 +365,19 @@
|
||||
@@ -352,19 +366,19 @@
|
||||
')
|
||||
|
||||
tunable_policy(`samba_domain_controller',`
|
||||
@ -16013,7 +16136,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
')
|
||||
|
||||
# Support Samba sharing of NFS mount points
|
||||
@@ -376,6 +389,15 @@
|
||||
@@ -376,6 +390,15 @@
|
||||
fs_manage_nfs_named_sockets(smbd_t)
|
||||
')
|
||||
|
||||
@ -16029,7 +16152,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
optional_policy(`
|
||||
cups_read_rw_config(smbd_t)
|
||||
cups_stream_connect(smbd_t)
|
||||
@@ -391,6 +413,11 @@
|
||||
@@ -391,6 +414,11 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -16041,7 +16164,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
rpc_search_nfs_state_data(smbd_t)
|
||||
')
|
||||
|
||||
@@ -405,13 +432,15 @@
|
||||
@@ -405,13 +433,15 @@
|
||||
tunable_policy(`samba_create_home_dirs',`
|
||||
allow smbd_t self:capability chown;
|
||||
userdom_create_user_home_dirs(smbd_t)
|
||||
@ -16058,7 +16181,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
auth_read_all_files_except_shadow(nmbd_t)
|
||||
')
|
||||
|
||||
@@ -420,8 +449,8 @@
|
||||
@@ -420,8 +450,8 @@
|
||||
auth_manage_all_files_except_shadow(smbd_t)
|
||||
fs_read_noxattr_fs_files(nmbd_t)
|
||||
auth_manage_all_files_except_shadow(nmbd_t)
|
||||
@ -16068,7 +16191,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
########################################
|
||||
#
|
||||
@@ -525,6 +554,7 @@
|
||||
@@ -525,6 +555,7 @@
|
||||
|
||||
allow smbcontrol_t winbind_t:process { signal signull };
|
||||
|
||||
@ -16076,7 +16199,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
samba_read_config(smbcontrol_t)
|
||||
samba_rw_var_files(smbcontrol_t)
|
||||
samba_search_var(smbcontrol_t)
|
||||
@@ -638,6 +668,10 @@
|
||||
@@ -638,6 +669,10 @@
|
||||
|
||||
allow swat_t smbd_var_run_t:file { lock unlink };
|
||||
|
||||
@ -16087,7 +16210,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
rw_files_pattern(swat_t, samba_etc_t, samba_etc_t)
|
||||
read_lnk_files_pattern(swat_t, samba_etc_t, samba_etc_t)
|
||||
|
||||
@@ -713,12 +747,23 @@
|
||||
@@ -713,12 +748,23 @@
|
||||
kerberos_use(swat_t)
|
||||
')
|
||||
|
||||
@ -16112,7 +16235,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
dontaudit winbind_t self:capability sys_tty_config;
|
||||
allow winbind_t self:process { signal_perms getsched setsched };
|
||||
allow winbind_t self:fifo_file rw_fifo_file_perms;
|
||||
@@ -866,6 +911,16 @@
|
||||
@@ -866,6 +912,16 @@
|
||||
#
|
||||
|
||||
optional_policy(`
|
||||
@ -16129,7 +16252,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
type samba_unconfined_script_t;
|
||||
type samba_unconfined_script_exec_t;
|
||||
domain_type(samba_unconfined_script_t)
|
||||
@@ -876,9 +931,12 @@
|
||||
@@ -876,9 +932,12 @@
|
||||
allow smbd_t samba_unconfined_script_exec_t:dir search_dir_perms;
|
||||
allow smbd_t samba_unconfined_script_exec_t:file ioctl;
|
||||
|
||||
@ -23809,8 +23932,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.6.28/policy/modules/system/raid.te
|
||||
--- nsaserefpolicy/policy/modules/system/raid.te 2009-08-14 16:14:31.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/system/raid.te 2009-08-21 18:56:07.000000000 -0400
|
||||
@@ -32,10 +32,6 @@
|
||||
+++ serefpolicy-3.6.28/policy/modules/system/raid.te 2009-08-25 15:58:45.000000000 -0400
|
||||
@@ -32,11 +32,6 @@
|
||||
kernel_rw_software_raid_state(mdadm_t)
|
||||
kernel_getattr_core_if(mdadm_t)
|
||||
|
||||
@ -23818,18 +23941,22 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
-corecmd_exec_bin(mdadm_t)
|
||||
-corecmd_exec_shell(mdadm_t)
|
||||
-
|
||||
dev_read_sysfs(mdadm_t)
|
||||
-dev_read_sysfs(mdadm_t)
|
||||
# Ignore attempts to read every device file
|
||||
dev_dontaudit_getattr_all_blk_files(mdadm_t)
|
||||
@@ -45,24 +41,28 @@
|
||||
dev_dontaudit_getattr_all_chr_files(mdadm_t)
|
||||
@@ -44,25 +39,31 @@
|
||||
dev_dontaudit_getattr_generic_chr_files(mdadm_t)
|
||||
dev_dontaudit_getattr_generic_blk_files(mdadm_t)
|
||||
dev_read_realtime_clock(mdadm_t)
|
||||
|
||||
-
|
||||
-domain_use_interactive_fds(mdadm_t)
|
||||
-
|
||||
-files_read_etc_files(mdadm_t)
|
||||
-files_read_etc_runtime_files(mdadm_t)
|
||||
-
|
||||
+dev_read_raw_memory(mdadm_t)
|
||||
+dev_read_sysfs(mdadm_t)
|
||||
|
||||
fs_search_auto_mountpoints(mdadm_t)
|
||||
fs_dontaudit_list_tmpfs(mdadm_t)
|
||||
|
||||
@ -23902,7 +24029,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+/etc/share/selinux/mls(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.6.28/policy/modules/system/selinuxutil.if
|
||||
--- nsaserefpolicy/policy/modules/system/selinuxutil.if 2009-07-14 14:19:57.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/system/selinuxutil.if 2009-08-21 18:56:07.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/system/selinuxutil.if 2009-08-25 15:30:03.000000000 -0400
|
||||
@@ -535,6 +535,53 @@
|
||||
|
||||
########################################
|
||||
@ -26012,7 +26139,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
||||
+HOME_DIR/\.gvfs(/.*)? <<none>>
|
||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.28/policy/modules/system/userdomain.if
|
||||
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-07-28 13:28:33.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-24 08:49:32.000000000 -0400
|
||||
+++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-25 09:28:37.000000000 -0400
|
||||
@@ -30,8 +30,9 @@
|
||||
')
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@
|
||||
Summary: SELinux policy configuration
|
||||
Name: selinux-policy
|
||||
Version: 3.6.28
|
||||
Release: 6%{?dist}
|
||||
Release: 7%{?dist}
|
||||
License: GPLv2+
|
||||
Group: System Environment/Base
|
||||
Source: serefpolicy-%{version}.tgz
|
||||
@ -475,6 +475,9 @@ exit 0
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Tue Aug 25 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-7
|
||||
- Fixes for cdrecord, mdadm, and others
|
||||
|
||||
* Sat Aug 22 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-6
|
||||
- Add capability setting to dhcpc and gpm
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user