rpms/selinux-policy
5
0
Fork 0
Code Issues Pull Requests Releases Activity

- Remove homedir_template

Browse Source
This commit is contained in:
Daniel J Walsh 2007-10-05 19:47:10 +00:00
parent 922f646a26
commit 8fd9df6414
3 changed files with 250 additions and 93 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
booleans-targeted.conf
View File

@ -1,6 +1,6 @@
# Allow making anonymous memory executable, e.g.for runtime-code generation or executable stack. # Allow making anonymous memory executable, e.g.for runtime-code generation or executable stack.
# #
allow_execmem = True allow_execmem = true
# Allow making a modified private filemapping executable (text relocation). # Allow making a modified private filemapping executable (text relocation).
# #
@ -8,7 +8,7 @@ allow_execmod = false
# Allow making the stack executable via mprotect.Also requires allow_execmem. # Allow making the stack executable via mprotect.Also requires allow_execmem.
# #
allow_execstack = True allow_execstack = true
# Allow ftpd to read cifs directories. # Allow ftpd to read cifs directories.
# #

328
policy-20070703.patch
View File

@ -1268,6 +1268,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman
rpm_use_fds(useradd_t) rpm_use_fds(useradd_t)
rpm_rw_pipes(useradd_t) rpm_rw_pipes(useradd_t)
') ')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.0.8/policy/modules/admin/vbetool.te
--- nsaserefpolicy/policy/modules/admin/vbetool.te 2007-09-12 10:34:51.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/admin/vbetool.te 2007-10-05 09:50:03.000000000 -0400
@@ -33,4 +33,5 @@
optional_policy(`
hal_rw_pid_files(vbetool_t)
hal_write_log(vbetool_t)
+ hal_dontaudit_append_lib_files(vbetool_t)
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.fc serefpolicy-3.0.8/policy/modules/admin/vpn.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.fc serefpolicy-3.0.8/policy/modules/admin/vpn.fc
--- nsaserefpolicy/policy/modules/admin/vpn.fc 2007-05-29 14:10:59.000000000 -0400 --- nsaserefpolicy/policy/modules/admin/vpn.fc 2007-05-29 14:10:59.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/admin/vpn.fc 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/admin/vpn.fc 2007-10-03 11:10:24.000000000 -0400
@ -1277,6 +1286,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.fc
/sbin/vpnc -- gen_context(system_u:object_r:vpnc_exec_t,s0) /sbin/vpnc -- gen_context(system_u:object_r:vpnc_exec_t,s0)
+ +
+/var/run/vpnc(/.*)? gen_context(system_u:object_r:vpnc_var_run_t,s0) +/var/run/vpnc(/.*)? gen_context(system_u:object_r:vpnc_var_run_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.if serefpolicy-3.0.8/policy/modules/admin/vpn.if
--- nsaserefpolicy/policy/modules/admin/vpn.if 2007-05-29 14:10:59.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/admin/vpn.if 2007-10-05 10:12:04.000000000 -0400
@@ -67,3 +67,25 @@
allow $1 vpnc_t:process signal;
')
+
+########################################
+## <summary>
+## Send and receive messages from
+## Vpnc over dbus.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`vpnc_dbus_chat',`
+ gen_require(`
+ type vpnc_t;
+ class dbus send_msg;
+ ')
+
+ allow $1 vpnc_t:dbus send_msg;
+ allow vpnc_t $1:dbus send_msg;
+')
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te serefpolicy-3.0.8/policy/modules/admin/vpn.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te serefpolicy-3.0.8/policy/modules/admin/vpn.te
--- nsaserefpolicy/policy/modules/admin/vpn.te 2007-07-25 10:37:43.000000000 -0400 --- nsaserefpolicy/policy/modules/admin/vpn.te 2007-07-25 10:37:43.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/admin/vpn.te 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/admin/vpn.te 2007-10-03 11:10:24.000000000 -0400
@ -2716,7 +2754,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
/usr/src/kernels/.+/lib(/.*)? gen_context(system_u:object_r:usr_t,s0) /usr/src/kernels/.+/lib(/.*)? gen_context(system_u:object_r:usr_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.0.8/policy/modules/kernel/files.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.0.8/policy/modules/kernel/files.if
--- nsaserefpolicy/policy/modules/kernel/files.if 2007-07-03 07:05:38.000000000 -0400 --- nsaserefpolicy/policy/modules/kernel/files.if 2007-07-03 07:05:38.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/kernel/files.if 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/kernel/files.if 2007-10-05 10:05:26.000000000 -0400
@@ -343,8 +343,7 @@ @@ -343,8 +343,7 @@
######################################## ########################################
@ -2826,7 +2864,52 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
## Manage temporary files and directories in /tmp. ## Manage temporary files and directories in /tmp.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -3323,6 +3377,42 @@ @@ -3198,6 +3252,44 @@
########################################
## <summary>
+## Allow attempts to get the attributes
+## of all tmp files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain not to audit.
+## </summary>
+## </param>
+#
+interface(`files_getattr_all_tmp_files',`
+ gen_require(`
+ attribute tmpfile;
+ ')
+
+ allow $1 tmpfile:file getattr;
+')
+
+########################################
+## <summary>
+## Do not audit attempts to get the attributes
+## of all tmp sock_file.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain not to audit.
+## </summary>
+## </param>
+#
+interface(`files_dontaudit_getattr_all_tmp_sockets',`
+ gen_require(`
+ attribute tmpfile;
+ ')
+
+ dontaudit $1 tmpfile:sock_file getattr;
+')
+
+########################################
+## <summary>
## Read all tmp files.
## </summary>
## <param name="domain">
@@ -3323,6 +3415,42 @@
######################################## ########################################
## <summary> ## <summary>
@ -2869,7 +2952,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
## Get the attributes of files in /usr. ## Get the attributes of files in /usr.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -3381,7 +3471,7 @@ @@ -3381,7 +3509,7 @@
######################################## ########################################
## <summary> ## <summary>
@ -2878,7 +2961,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -3389,17 +3479,17 @@ @@ -3389,17 +3517,17 @@
## </summary> ## </summary>
## </param> ## </param>
# #
@ -2899,7 +2982,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -3407,12 +3497,12 @@ @@ -3407,12 +3535,12 @@
## </summary> ## </summary>
## </param> ## </param>
# #
@ -2914,7 +2997,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
') ')
######################################## ########################################
@@ -4043,7 +4133,7 @@ @@ -4043,7 +4171,7 @@
type var_t, var_lock_t; type var_t, var_lock_t;
') ')
@ -2923,7 +3006,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
') ')
######################################## ########################################
@@ -4560,6 +4650,8 @@ @@ -4560,6 +4688,8 @@
# Need to give access to /selinux/member # Need to give access to /selinux/member
selinux_compute_member($1) selinux_compute_member($1)
@ -2932,7 +3015,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
# Need sys_admin capability for mounting # Need sys_admin capability for mounting
allow $1 self:capability { chown fsetid sys_admin }; allow $1 self:capability { chown fsetid sys_admin };
@@ -4582,6 +4674,11 @@ @@ -4582,6 +4712,11 @@
# Default type for mountpoints # Default type for mountpoints
allow $1 poly_t:dir { create mounton }; allow $1 poly_t:dir { create mounton };
fs_unmount_xattr_fs($1) fs_unmount_xattr_fs($1)
@ -2944,7 +3027,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
') ')
######################################## ########################################
@@ -4619,3 +4716,28 @@ @@ -4619,3 +4754,28 @@
allow $1 { file_type -security_file_type }:dir manage_dir_perms; allow $1 { file_type -security_file_type }:dir manage_dir_perms;
') ')
@ -3003,7 +3086,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
# #
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.0.8/policy/modules/kernel/filesystem.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.0.8/policy/modules/kernel/filesystem.if
--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-08-22 07:14:06.000000000 -0400 --- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-08-22 07:14:06.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/kernel/filesystem.if 2007-10-04 12:58:42.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/kernel/filesystem.if 2007-10-05 10:23:56.000000000 -0400
@@ -271,45 +271,6 @@ @@ -271,45 +271,6 @@
######################################## ########################################
@ -3146,7 +3229,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
+ +
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.0.8/policy/modules/kernel/filesystem.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.0.8/policy/modules/kernel/filesystem.te
--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-09-12 10:34:49.000000000 -0400 --- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-09-12 10:34:49.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/kernel/filesystem.te 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/kernel/filesystem.te 2007-10-05 13:59:53.000000000 -0400
@@ -80,6 +80,7 @@ @@ -80,6 +80,7 @@
type fusefs_t; type fusefs_t;
fs_noxattr_type(fusefs_t) fs_noxattr_type(fusefs_t)
@ -3155,6 +3238,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
genfscon fuse / gen_context(system_u:object_r:fusefs_t,s0) genfscon fuse / gen_context(system_u:object_r:fusefs_t,s0)
genfscon fuseblk / gen_context(system_u:object_r:fusefs_t,s0) genfscon fuseblk / gen_context(system_u:object_r:fusefs_t,s0)
@@ -133,6 +134,11 @@
genfscon spufs / gen_context(system_u:object_r:spufs_t,s0)
files_mountpoint(spufs_t)
+type squash_t;
+fs_type(squash_t)
+genfscon squash / gen_context(system_u:object_r:squash_t,s0)
+files_mountpoint(squash_t)
+
type vxfs_t;
fs_noxattr_type(vxfs_t)
files_mountpoint(vxfs_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.8/policy/modules/kernel/kernel.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.8/policy/modules/kernel/kernel.if
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-08-22 07:14:06.000000000 -0400 --- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-08-22 07:14:06.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/kernel/kernel.if 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/kernel/kernel.if 2007-10-03 11:10:24.000000000 -0400
@ -5196,7 +5291,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
+ +
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.8/policy/modules/services/cups.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.8/policy/modules/services/cups.te
--- nsaserefpolicy/policy/modules/services/cups.te 2007-09-12 10:34:50.000000000 -0400 --- nsaserefpolicy/policy/modules/services/cups.te 2007-09-12 10:34:50.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/services/cups.te 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/services/cups.te 2007-10-05 09:02:24.000000000 -0400
@@ -48,9 +48,8 @@ @@ -48,9 +48,8 @@
type hplip_t; type hplip_t;
type hplip_exec_t; type hplip_exec_t;
@ -5293,15 +5388,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
files_list_world_readable(cupsd_t) files_list_world_readable(cupsd_t)
files_read_world_readable_files(cupsd_t) files_read_world_readable_files(cupsd_t)
files_read_world_readable_symlinks(cupsd_t) files_read_world_readable_symlinks(cupsd_t)
@@ -202,6 +206,7 @@ @@ -196,12 +200,9 @@
files_dontaudit_getattr_all_tmp_files(cupsd_t) files_read_var_symlinks(cupsd_t)
# for /etc/printcap
files_dontaudit_write_etc_files(cupsd_t)
-# smbspool seems to be iterating through all existing tmp files.
-# redhat bug #214953
-# cjp: this might be a broken behavior
-files_dontaudit_getattr_all_tmp_files(cupsd_t)
selinux_compute_access_vector(cupsd_t) selinux_compute_access_vector(cupsd_t)
+selinux_validate_context(cupsd_t) +selinux_validate_context(cupsd_t)
init_exec_script_files(cupsd_t) init_exec_script_files(cupsd_t)
@@ -221,17 +226,37 @@ @@ -221,17 +222,37 @@
sysnet_read_config(cupsd_t) sysnet_read_config(cupsd_t)
@ -5339,7 +5440,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
apm_domtrans_client(cupsd_t) apm_domtrans_client(cupsd_t)
') ')
@@ -263,16 +288,16 @@ @@ -263,16 +284,16 @@
') ')
optional_policy(` optional_policy(`
@ -5360,7 +5461,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
seutil_sigchld_newrole(cupsd_t) seutil_sigchld_newrole(cupsd_t)
') ')
@@ -377,6 +402,14 @@ @@ -377,6 +398,14 @@
') ')
optional_policy(` optional_policy(`
@ -5375,7 +5476,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
cron_system_entry(cupsd_config_t, cupsd_config_exec_t) cron_system_entry(cupsd_config_t, cupsd_config_exec_t)
') ')
@@ -393,6 +426,7 @@ @@ -393,6 +422,7 @@
optional_policy(` optional_policy(`
hal_domtrans(cupsd_config_t) hal_domtrans(cupsd_config_t)
hal_read_tmp_files(cupsd_config_t) hal_read_tmp_files(cupsd_config_t)
@ -5383,7 +5484,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
') ')
optional_policy(` optional_policy(`
@@ -525,11 +559,9 @@ @@ -525,11 +555,9 @@
allow hplip_t cupsd_etc_t:dir search; allow hplip_t cupsd_etc_t:dir search;
cups_stream_connect(hplip_t) cups_stream_connect(hplip_t)
@ -5398,7 +5499,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
manage_files_pattern(hplip_t,hplip_var_run_t,hplip_var_run_t) manage_files_pattern(hplip_t,hplip_var_run_t,hplip_var_run_t)
files_pid_filetrans(hplip_t,hplip_var_run_t,file) files_pid_filetrans(hplip_t,hplip_var_run_t,file)
@@ -560,7 +592,7 @@ @@ -560,7 +588,7 @@
dev_read_urand(hplip_t) dev_read_urand(hplip_t)
dev_read_rand(hplip_t) dev_read_rand(hplip_t)
dev_rw_generic_usb_dev(hplip_t) dev_rw_generic_usb_dev(hplip_t)
@ -5407,7 +5508,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
fs_getattr_all_fs(hplip_t) fs_getattr_all_fs(hplip_t)
fs_search_auto_mountpoints(hplip_t) fs_search_auto_mountpoints(hplip_t)
@@ -587,8 +619,6 @@ @@ -587,8 +615,6 @@
userdom_dontaudit_search_sysadm_home_dirs(hplip_t) userdom_dontaudit_search_sysadm_home_dirs(hplip_t)
userdom_dontaudit_search_all_users_home_content(hplip_t) userdom_dontaudit_search_all_users_home_content(hplip_t)
@ -5416,6 +5517,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
optional_policy(` optional_policy(`
seutil_sigchld_newrole(hplip_t) seutil_sigchld_newrole(hplip_t)
') ')
@@ -668,3 +694,15 @@
optional_policy(`
udev_read_db(ptal_t)
')
+
+
+# This whole section needs to be moved to a smbspool policy
+# smbspool seems to be iterating through all existing tmp files.
+# Looking for kerberos files
+files_getattr_all_tmp_files(cupsd_t)
+userdom_read_unpriv_users_tmp_files(cupsd_t)
+files_dontaudit_getattr_all_tmp_sockets(cupsd_t)
+
+optional_policy(`
+ unconfined_read_tmp_files(cupsd_t)
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.0.8/policy/modules/services/cvs.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.0.8/policy/modules/services/cvs.te
--- nsaserefpolicy/policy/modules/services/cvs.te 2007-07-25 10:37:42.000000000 -0400 --- nsaserefpolicy/policy/modules/services/cvs.te 2007-07-25 10:37:42.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/services/cvs.te 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/services/cvs.te 2007-10-03 11:10:24.000000000 -0400
@ -6062,8 +6179,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.0.8/policy/modules/services/exim.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.0.8/policy/modules/services/exim.te
--- nsaserefpolicy/policy/modules/services/exim.te 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/services/exim.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.0.8/policy/modules/services/exim.te 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/services/exim.te 2007-10-05 09:27:09.000000000 -0400
@@ -0,0 +1,227 @@ @@ -0,0 +1,229 @@
+# $Id: exim.te 687 2007-09-09 00:19:41Z aqua $ +# $Id: exim.te 687 2007-09-09 00:19:41Z aqua $
+# Draft SELinux refpolicy module for the Exim MTA +# Draft SELinux refpolicy module for the Exim MTA
+# +#
@ -6173,6 +6290,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim
+files_search_var(exim_t) +files_search_var(exim_t)
+files_read_etc_files(exim_t) +files_read_etc_files(exim_t)
+ +
+fs_getattr_xattr_fs(exim_t)
+
+kernel_read_kernel_sysctls(exim_t) +kernel_read_kernel_sysctls(exim_t)
+kernel_dontaudit_read_system_state(exim_t) +kernel_dontaudit_read_system_state(exim_t)
+ +
@ -6387,7 +6506,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.
optional_policy(` optional_policy(`
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.8/policy/modules/services/hal.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.8/policy/modules/services/hal.fc
--- nsaserefpolicy/policy/modules/services/hal.fc 2007-09-12 10:34:50.000000000 -0400 --- nsaserefpolicy/policy/modules/services/hal.fc 2007-09-12 10:34:50.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/services/hal.fc 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/services/hal.fc 2007-10-05 15:23:01.000000000 -0400
@@ -13,9 +13,12 @@ @@ -13,9 +13,12 @@
/var/cache/hald(/.*)? gen_context(system_u:object_r:hald_cache_t,s0) /var/cache/hald(/.*)? gen_context(system_u:object_r:hald_cache_t,s0)
@ -6403,8 +6522,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
/var/run/vbestate -- gen_context(system_u:object_r:hald_var_run_t,s0) /var/run/vbestate -- gen_context(system_u:object_r:hald_var_run_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.8/policy/modules/services/hal.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.8/policy/modules/services/hal.te
--- nsaserefpolicy/policy/modules/services/hal.te 2007-09-12 10:34:50.000000000 -0400 --- nsaserefpolicy/policy/modules/services/hal.te 2007-09-12 10:34:50.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/services/hal.te 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/services/hal.te 2007-10-05 11:48:00.000000000 -0400
@@ -93,6 +93,7 @@ @@ -49,6 +49,9 @@
type hald_var_lib_t;
files_type(hald_var_lib_t)
+typealias hald_log_t alias pmtools_log_t;
+typealias hald_var_run_t alias pmtools_var_run_t;
+
########################################
#
# Local policy
@@ -70,7 +73,7 @@
manage_files_pattern(hald_t,hald_cache_t,hald_cache_t)
# log files for hald
-allow hald_t hald_log_t:file manage_file_perms;
+manage_files_pattern(hald_t, hald_log_t, hald_log_t)
logging_log_filetrans(hald_t,hald_log_t,file)
manage_dirs_pattern(hald_t,hald_tmp_t,hald_tmp_t)
@@ -93,6 +96,7 @@
kernel_rw_irq_sysctls(hald_t) kernel_rw_irq_sysctls(hald_t)
kernel_rw_vm_sysctls(hald_t) kernel_rw_vm_sysctls(hald_t)
kernel_write_proc_files(hald_t) kernel_write_proc_files(hald_t)
@ -6412,7 +6550,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
auth_read_pam_console_data(hald_t) auth_read_pam_console_data(hald_t)
@@ -155,6 +156,8 @@ @@ -155,6 +159,8 @@
selinux_compute_relabel_context(hald_t) selinux_compute_relabel_context(hald_t)
selinux_compute_user_contexts(hald_t) selinux_compute_user_contexts(hald_t)
@ -6421,7 +6559,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
storage_raw_read_removable_device(hald_t) storage_raw_read_removable_device(hald_t)
storage_raw_write_removable_device(hald_t) storage_raw_write_removable_device(hald_t)
storage_raw_read_fixed_disk(hald_t) storage_raw_read_fixed_disk(hald_t)
@@ -293,6 +296,7 @@ @@ -293,6 +299,7 @@
# #
allow hald_acl_t self:capability { dac_override fowner }; allow hald_acl_t self:capability { dac_override fowner };
@ -6429,7 +6567,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.
allow hald_acl_t self:fifo_file read_fifo_file_perms; allow hald_acl_t self:fifo_file read_fifo_file_perms;
domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t) domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t)
@@ -344,6 +348,8 @@ @@ -344,6 +351,8 @@
files_read_usr_files(hald_mac_t) files_read_usr_files(hald_mac_t)
@ -7257,7 +7395,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw
+/var/log/wpa_supplicant.log -- gen_context(system_u:object_r:NetworkManager_log_t,s0) +/var/log/wpa_supplicant.log -- gen_context(system_u:object_r:NetworkManager_log_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-3.0.8/policy/modules/services/networkmanager.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-3.0.8/policy/modules/services/networkmanager.if
--- nsaserefpolicy/policy/modules/services/networkmanager.if 2007-06-15 14:54:33.000000000 -0400 --- nsaserefpolicy/policy/modules/services/networkmanager.if 2007-06-15 14:54:33.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/services/networkmanager.if 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/services/networkmanager.if 2007-10-05 10:11:35.000000000 -0400
@@ -97,3 +97,24 @@ @@ -97,3 +97,24 @@
allow $1 NetworkManager_t:dbus send_msg; allow $1 NetworkManager_t:dbus send_msg;
allow NetworkManager_t $1:dbus send_msg; allow NetworkManager_t $1:dbus send_msg;
@ -8434,13 +8572,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog
') ')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.0.8/policy/modules/services/rpcbind.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.0.8/policy/modules/services/rpcbind.te
--- nsaserefpolicy/policy/modules/services/rpcbind.te 2007-07-03 07:06:27.000000000 -0400 --- nsaserefpolicy/policy/modules/services/rpcbind.te 2007-07-03 07:06:27.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/services/rpcbind.te 2007-10-03 11:10:24.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/services/rpcbind.te 2007-10-05 13:58:37.000000000 -0400
@@ -21,11 +21,13 @@ @@ -21,11 +21,13 @@
# rpcbind local policy # rpcbind local policy
# #
-allow rpcbind_t self:capability setuid; -allow rpcbind_t self:capability setuid;
+allow rpcbind_t self:capability { setuid sys_tty_config }; +allow rpcbind_t self:capability { dac_override setuid sys_tty_config };
allow rpcbind_t self:fifo_file rw_file_perms; allow rpcbind_t self:fifo_file rw_file_perms;
allow rpcbind_t self:unix_stream_socket create_stream_socket_perms; allow rpcbind_t self:unix_stream_socket create_stream_socket_perms;
allow rpcbind_t self:netlink_route_socket r_netlink_socket_perms; allow rpcbind_t self:netlink_route_socket r_netlink_socket_perms;
@ -13968,7 +14106,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.8/policy/modules/system/unconfined.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.8/policy/modules/system/unconfined.te
--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-07-25 10:37:42.000000000 -0400 --- nsaserefpolicy/policy/modules/system/unconfined.te 2007-07-25 10:37:42.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/system/unconfined.te 2007-10-03 11:10:25.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/system/unconfined.te 2007-10-05 14:12:30.000000000 -0400
@@ -5,28 +5,38 @@ @@ -5,28 +5,38 @@
# #
# Declarations # Declarations
@ -14041,17 +14179,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
optional_policy(` optional_policy(`
- ada_domtrans(unconfined_t) - ada_domtrans(unconfined_t)
+ ada_run(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) -')
') -
-optional_policy(`
optional_policy(`
- apache_run_helper(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) - apache_run_helper(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
- apache_per_role_template(unconfined,unconfined_t,unconfined_r) - apache_per_role_template(unconfined,unconfined_t,unconfined_r)
- # this is disallowed usage: - # this is disallowed usage:
- unconfined_domain(httpd_unconfined_script_t) - unconfined_domain(httpd_unconfined_script_t)
-') + ada_run(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
- ')
-optional_policy(`
optional_policy(`
- bind_run_ndc(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) - bind_run_ndc(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
+ bootloader_run(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) + bootloader_run(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
') ')
@ -14069,7 +14207,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
') ')
optional_policy(` optional_policy(`
@@ -118,11 +122,11 @@ @@ -107,6 +111,10 @@
optional_policy(`
oddjob_dbus_chat(unconfined_t)
')
+
+ optional_policy(`
+ vpnc_dbus_chat(unconfined_t)
+ ')
')
optional_policy(`
@@ -118,11 +126,11 @@
') ')
optional_policy(` optional_policy(`
@ -14083,7 +14232,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
') ')
optional_policy(` optional_policy(`
@@ -134,11 +138,7 @@ @@ -134,11 +142,7 @@
') ')
optional_policy(` optional_policy(`
@ -14096,7 +14245,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
') ')
optional_policy(` optional_policy(`
@@ -155,32 +155,23 @@ @@ -155,32 +159,23 @@
optional_policy(` optional_policy(`
postfix_run_map(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) postfix_run_map(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
@ -14133,7 +14282,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
') ')
optional_policy(` optional_policy(`
@@ -205,11 +196,18 @@ @@ -205,11 +200,18 @@
') ')
optional_policy(` optional_policy(`
@ -14154,7 +14303,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
') ')
######################################## ########################################
@@ -225,8 +223,20 @@ @@ -225,8 +227,20 @@
init_dbus_chat_script(unconfined_execmem_t) init_dbus_chat_script(unconfined_execmem_t)
unconfined_dbus_chat(unconfined_execmem_t) unconfined_dbus_chat(unconfined_execmem_t)
@ -14186,7 +14335,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
/tmp/gconfd-USER -d gen_context(system_u:object_r:ROLE_tmp_t,s0) /tmp/gconfd-USER -d gen_context(system_u:object_r:ROLE_tmp_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.8/policy/modules/system/userdomain.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.8/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-08-27 09:18:17.000000000 -0400 --- nsaserefpolicy/policy/modules/system/userdomain.if 2007-08-27 09:18:17.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/system/userdomain.if 2007-10-04 17:33:14.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/system/userdomain.if 2007-10-05 14:11:08.000000000 -0400
@@ -29,8 +29,9 @@ @@ -29,8 +29,9 @@
') ')
@ -14699,7 +14848,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
allow $1_t self:dbus send_msg; allow $1_t self:dbus send_msg;
dbus_system_bus_client_template($1,$1_t) dbus_system_bus_client_template($1,$1_t)
@@ -834,21 +780,18 @@ @@ -834,20 +780,20 @@
') ')
optional_policy(` optional_policy(`
@ -14719,13 +14868,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ evolution_alarm_dbus_chat($1,$1_t) + evolution_alarm_dbus_chat($1,$1_t)
') ')
- optional_policy(` optional_policy(`
- networkmanager_dbus_chat($1_t) - networkmanager_dbus_chat($1_t)
- ') + vpnc_dbus_chat($1_t)
')
') ')
optional_policy(` @@ -876,17 +822,17 @@
@@ -876,17 +819,17 @@
') ')
optional_policy(` optional_policy(`
@ -14751,7 +14900,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
optional_policy(` optional_policy(`
@@ -900,16 +843,6 @@ @@ -900,16 +846,6 @@
') ')
optional_policy(` optional_policy(`
@ -14768,7 +14917,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
resmgr_stream_connect($1_t) resmgr_stream_connect($1_t)
') ')
@@ -919,11 +852,6 @@ @@ -919,11 +855,6 @@
') ')
optional_policy(` optional_policy(`
@ -14780,7 +14929,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
samba_stream_connect_winbind($1_t) samba_stream_connect_winbind($1_t)
') ')
@@ -954,21 +882,165 @@ @@ -954,21 +885,165 @@
## </summary> ## </summary>
## </param> ## </param>
# #
@ -14952,7 +15101,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
domain_interactive_fd($1_t) domain_interactive_fd($1_t)
typeattribute $1_devpts_t user_ptynode; typeattribute $1_devpts_t user_ptynode;
@@ -977,23 +1049,51 @@ @@ -977,23 +1052,51 @@
typeattribute $1_tmp_t user_tmpfile; typeattribute $1_tmp_t user_tmpfile;
typeattribute $1_tty_device_t user_ttynode; typeattribute $1_tty_device_t user_ttynode;
@ -15015,24 +15164,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
# port access is audited even if dac would not have allowed it, so dontaudit it here # port access is audited even if dac would not have allowed it, so dontaudit it here
corenet_dontaudit_tcp_bind_all_reserved_ports($1_t) corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
@@ -1029,15 +1129,7 @@ @@ -1029,20 +1132,12 @@
# and may change other protocols # and may change other protocols
tunable_policy(`user_tcp_server',` tunable_policy(`user_tcp_server',`
corenet_tcp_bind_all_nodes($1_t) corenet_tcp_bind_all_nodes($1_t)
- corenet_tcp_bind_generic_port($1_t) - corenet_tcp_bind_generic_port($1_t)
- ') + corenet_tcp_bind_all_unreserved_ports($1_t)
- ')
- optional_policy(`
optional_policy(`
- kerberos_use($1_t) - kerberos_use($1_t)
- ') - ')
- -
- optional_policy(` - optional_policy(`
- loadkeys_run($1_t,$1_r,$1_tty_device_t) - loadkeys_run($1_t,$1_r,$1_tty_device_t)
+ corenet_tcp_bind_all_unreserved_ports($1_t) - ')
-
- optional_policy(`
- netutils_run_ping_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
- netutils_run_traceroute_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
+ netutils_run_ping_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
+ netutils_run_traceroute_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
') ')
optional_policy(` # Run pppd in pppd_t by default for user
@@ -1054,17 +1146,6 @@ @@ -1054,17 +1149,6 @@
setroubleshoot_stream_connect($1_t) setroubleshoot_stream_connect($1_t)
') ')
@ -15050,7 +15206,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
####################################### #######################################
@@ -1102,6 +1183,8 @@ @@ -1102,6 +1186,8 @@
class passwd { passwd chfn chsh rootok crontab }; class passwd { passwd chfn chsh rootok crontab };
') ')
@ -15059,7 +15215,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
############################## ##############################
# #
# Declarations # Declarations
@@ -1127,7 +1210,7 @@ @@ -1127,7 +1213,7 @@
# $1_t local policy # $1_t local policy
# #
@ -15068,7 +15224,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
allow $1_t self:process { setexec setfscreate }; allow $1_t self:process { setexec setfscreate };
# Set password information for other users. # Set password information for other users.
@@ -1139,7 +1222,11 @@ @@ -1139,7 +1225,11 @@
# Manipulate other users crontab. # Manipulate other users crontab.
allow $1_t self:passwd crontab; allow $1_t self:passwd crontab;
@ -15081,7 +15237,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
kernel_read_software_raid_state($1_t) kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t) kernel_getattr_core_if($1_t)
@@ -1642,9 +1729,11 @@ @@ -1642,9 +1732,11 @@
template(`userdom_user_home_content',` template(`userdom_user_home_content',`
gen_require(` gen_require(`
attribute $1_file_type; attribute $1_file_type;
@ -15093,7 +15249,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
files_type($2) files_type($2)
') ')
@@ -1894,10 +1983,46 @@ @@ -1894,10 +1986,46 @@
template(`userdom_manage_user_home_content_dirs',` template(`userdom_manage_user_home_content_dirs',`
gen_require(` gen_require(`
type $1_home_dir_t, $1_home_t; type $1_home_dir_t, $1_home_t;
@ -15141,7 +15297,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -3078,7 +3203,7 @@ @@ -3078,7 +3206,7 @@
# #
template(`userdom_tmp_filetrans_user_tmp',` template(`userdom_tmp_filetrans_user_tmp',`
gen_require(` gen_require(`
@ -15150,7 +15306,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
files_tmp_filetrans($2,$1_tmp_t,$3) files_tmp_filetrans($2,$1_tmp_t,$3)
@@ -4615,6 +4740,24 @@ @@ -4615,6 +4743,24 @@
files_list_home($1) files_list_home($1)
allow $1 home_dir_type:dir search_dir_perms; allow $1 home_dir_type:dir search_dir_perms;
') ')
@ -15175,7 +15331,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
######################################## ########################################
## <summary> ## <summary>
@@ -4633,6 +4776,14 @@ @@ -4633,6 +4779,14 @@
files_list_home($1) files_list_home($1)
allow $1 home_dir_type:dir list_dir_perms; allow $1 home_dir_type:dir list_dir_perms;
@ -15190,7 +15346,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -5323,7 +5474,7 @@ @@ -5323,7 +5477,7 @@
attribute user_tmpfile; attribute user_tmpfile;
') ')
@ -15199,7 +15355,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -5559,3 +5710,380 @@ @@ -5559,3 +5713,380 @@
interface(`userdom_unconfined',` interface(`userdom_unconfined',`
refpolicywarn(`$0($*) has been deprecated.') refpolicywarn(`$0($*) has been deprecated.')
') ')
@ -15422,24 +15578,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ cups_dbus_chat($1_usertype) + cups_dbus_chat($1_usertype)
+ ') + ')
+ +
+')
+ +
+optional_policy(` + optional_policy(`
+ consolekit_dbus_chat($1_usertype) + consolekit_dbus_chat($1_usertype)
+') + ')
+ +
+optional_policy(` + optional_policy(`
+ java_per_role_template($1, $1_t, $1_r) + java_per_role_template($1, $1_t, $1_r)
+') + ')
+ +
+optional_policy(` + optional_policy(`
+ mono_per_role_template($1, $1_t, $1_r) + networkmanager_dontaudit_dbus_chat($1_t)
+') + ')
+ +
+optional_policy(` + optional_policy(`
+ networkmanager_dontaudit_dbus_chat($1_usertype) + mono_per_role_template($1, $1_t, $1_r)
+') + ')
+ +
+')
+optional_policy(` +optional_policy(`
+ setroubleshoot_dontaudit_stream_connect($1_usertype) + setroubleshoot_dontaudit_stream_connect($1_usertype)
+') +')
@ -15582,7 +15738,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+ +
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.8/policy/modules/system/userdomain.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.8/policy/modules/system/userdomain.te
--- nsaserefpolicy/policy/modules/system/userdomain.te 2007-09-12 10:34:51.000000000 -0400 --- nsaserefpolicy/policy/modules/system/userdomain.te 2007-09-12 10:34:51.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/system/userdomain.te 2007-10-03 11:10:25.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/system/userdomain.te 2007-10-05 08:59:51.000000000 -0400
@@ -24,13 +24,6 @@ @@ -24,13 +24,6 @@
## <desc> ## <desc>

11
selinux-policy.spec
View File

@ -150,9 +150,9 @@ fi
%define loadpolicy() \ %define loadpolicy() \
( cd /usr/share/selinux/%1; \ ( cd /usr/share/selinux/%1; \
semodule %2 -b base.pp %{expand:%%moduleList %1} -s %1; \ semodule -b base.pp %{expand:%%moduleList %1} -s %1; \
);\ );\
rm -f %{_sysconfdir}/selinux/%1/policy/policy.*.rpmnew rm -f %{_sysconfdir}/selinux/%1/policy/policy.*.rpmnew;
%define relabel() \ %define relabel() \
. %{_sysconfdir}/selinux/config; \ . %{_sysconfdir}/selinux/config; \
@ -285,15 +285,14 @@ SELinux Reference policy targeted base module.
%post targeted %post targeted
semodule -s targeted -r moilscanner 2>/dev/null semodule -s targeted -r moilscanner 2>/dev/null
%loadpolicy targeted
if [ $1 = 1 ]; then if [ $1 = 1 ]; then
semanage login -m -s "system_u" __default__ 2> /dev/null semanage login -m -s "system_u" __default__ 2> /dev/null
semanage user -a -P unconfined -R "unconfined_r system_r" unconfined_u semanage user -a -P unconfined -R "unconfined_r system_r" unconfined_u
semanage user -a -P guest -R guest_r guest_u semanage user -a -P guest -R guest_r guest_u
semanage user -a -P xguest -R xguest_r xguest_u semanage user -a -P xguest -R xguest_r xguest_u
# Don't load on initial install
%loadpolicy targeted
else else
%loadpolicy targeted
%relabel targeted %relabel targeted
fi fi
exit 0 exit 0
@ -330,6 +329,7 @@ SELinux Reference policy olpc base module.
%post olpc %post olpc
%loadpolicy olpc %loadpolicy olpc
if [ $1 != 1 ]; then if [ $1 != 1 ]; then
%relabel olpc %relabel olpc
fi fi
@ -359,6 +359,7 @@ SELinux Reference policy mls base module.
%post mls %post mls
%loadpolicy mls %loadpolicy mls
if [ $1 != 1 ]; then if [ $1 != 1 ]; then
%relabel mls %relabel mls
fi fi