- Dontaudit listing of /root directory for cron system jobs
This commit is contained in:
parent
3434a9be73
commit
90ea5b3fef
@ -1580,6 +1580,68 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
/usr/bin/cdrecord -- gen_context(system_u:object_r:cdrecord_exec_t,s0)
|
/usr/bin/cdrecord -- gen_context(system_u:object_r:cdrecord_exec_t,s0)
|
||||||
+/usr/bin/growisoifs -- gen_context(system_u:object_r:cdrecord_exec_t,s0)
|
+/usr/bin/growisoifs -- gen_context(system_u:object_r:cdrecord_exec_t,s0)
|
||||||
|
|
||||||
|
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqselector.fc serefpolicy-3.6.10/policy/modules/apps/cpufreqselector.fc
|
||||||
|
--- nsaserefpolicy/policy/modules/apps/cpufreqselector.fc 1969-12-31 19:00:00.000000000 -0500
|
||||||
|
+++ serefpolicy-3.6.10/policy/modules/apps/cpufreqselector.fc 2009-04-02 10:05:45.000000000 -0400
|
||||||
|
@@ -0,0 +1 @@
|
||||||
|
+/usr/bin/cpufreq-selector -- gen_context(system_u:object_r:cpufreqselector_exec_t,s0)
|
||||||
|
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqselector.if serefpolicy-3.6.10/policy/modules/apps/cpufreqselector.if
|
||||||
|
--- nsaserefpolicy/policy/modules/apps/cpufreqselector.if 1969-12-31 19:00:00.000000000 -0500
|
||||||
|
+++ serefpolicy-3.6.10/policy/modules/apps/cpufreqselector.if 2009-04-02 10:05:45.000000000 -0400
|
||||||
|
@@ -0,0 +1,2 @@
|
||||||
|
+## <summary>cpufreq-selector policy</summary>
|
||||||
|
+
|
||||||
|
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqselector.te serefpolicy-3.6.10/policy/modules/apps/cpufreqselector.te
|
||||||
|
--- nsaserefpolicy/policy/modules/apps/cpufreqselector.te 1969-12-31 19:00:00.000000000 -0500
|
||||||
|
+++ serefpolicy-3.6.10/policy/modules/apps/cpufreqselector.te 2009-04-02 10:05:45.000000000 -0400
|
||||||
|
@@ -0,0 +1,47 @@
|
||||||
|
+policy_module(cpufreqselector,1.0.0)
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+#
|
||||||
|
+# Declarations
|
||||||
|
+#
|
||||||
|
+
|
||||||
|
+type cpufreqselector_t;
|
||||||
|
+type cpufreqselector_exec_t;
|
||||||
|
+
|
||||||
|
+dbus_system_domain(cpufreqselector_t, cpufreqselector_exec_t)
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+#
|
||||||
|
+# cpufreq-selector local policy
|
||||||
|
+#
|
||||||
|
+
|
||||||
|
+allow cpufreqselector_t self:capability { sys_nice sys_ptrace };
|
||||||
|
+allow cpufreqselector_t self:fifo_file rw_fifo_file_perms;
|
||||||
|
+
|
||||||
|
+files_read_etc_files(cpufreqselector_t)
|
||||||
|
+files_read_usr_files(cpufreqselector_t)
|
||||||
|
+
|
||||||
|
+corecmd_search_bin(cpufreqselector_t)
|
||||||
|
+
|
||||||
|
+dev_rw_sysfs(cpufreqselector_t)
|
||||||
|
+
|
||||||
|
+fs_list_inotifyfs(cpufreqselector_t)
|
||||||
|
+
|
||||||
|
+libs_use_ld_so(cpufreqselector_t)
|
||||||
|
+libs_use_shared_libs(cpufreqselector_t)
|
||||||
|
+
|
||||||
|
+userdom_read_all_users_state(cpufreqselector_t)
|
||||||
|
+
|
||||||
|
+nscd_dontaudit_search_pid(cpufreqselector_t)
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
|
+ consolekit_dbus_chat(cpufreqselector_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
|
+ polkit_domtrans_auth(cpufreqselector_t)
|
||||||
|
+ polkit_read_lib(cpufreqselector_t)
|
||||||
|
+ polkit_read_reload(cpufreqselector_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
|
+permissive cpufreqselector_t;
|
||||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/git.fc serefpolicy-3.6.10/policy/modules/apps/git.fc
|
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/git.fc serefpolicy-3.6.10/policy/modules/apps/git.fc
|
||||||
--- nsaserefpolicy/policy/modules/apps/git.fc 1969-12-31 19:00:00.000000000 -0500
|
--- nsaserefpolicy/policy/modules/apps/git.fc 1969-12-31 19:00:00.000000000 -0500
|
||||||
+++ serefpolicy-3.6.10/policy/modules/apps/git.fc 2009-03-30 10:09:41.000000000 -0400
|
+++ serefpolicy-3.6.10/policy/modules/apps/git.fc 2009-03-30 10:09:41.000000000 -0400
|
||||||
@ -9098,7 +9160,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
+/var/log/rpmpkgs.* -- gen_context(system_u:object_r:cron_log_t,s0)
|
+/var/log/rpmpkgs.* -- gen_context(system_u:object_r:cron_log_t,s0)
|
||||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.6.10/policy/modules/services/cron.if
|
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.6.10/policy/modules/services/cron.if
|
||||||
--- nsaserefpolicy/policy/modules/services/cron.if 2008-11-11 16:13:47.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/cron.if 2008-11-11 16:13:47.000000000 -0500
|
||||||
+++ serefpolicy-3.6.10/policy/modules/services/cron.if 2009-03-30 10:09:41.000000000 -0400
|
+++ serefpolicy-3.6.10/policy/modules/services/cron.if 2009-04-02 11:21:32.000000000 -0400
|
||||||
@@ -12,6 +12,10 @@
|
@@ -12,6 +12,10 @@
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -9187,7 +9249,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@@ -261,6 +277,7 @@
|
@@ -261,10 +277,12 @@
|
||||||
allow $1 system_cronjob_t:fifo_file rw_file_perms;
|
allow $1 system_cronjob_t:fifo_file rw_file_perms;
|
||||||
allow $1 system_cronjob_t:process sigchld;
|
allow $1 system_cronjob_t:process sigchld;
|
||||||
|
|
||||||
@ -9195,7 +9257,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
allow $1 crond_t:fifo_file rw_file_perms;
|
allow $1 crond_t:fifo_file rw_file_perms;
|
||||||
allow $1 crond_t:fd use;
|
allow $1 crond_t:fd use;
|
||||||
allow $1 crond_t:process sigchld;
|
allow $1 crond_t:process sigchld;
|
||||||
@@ -343,6 +360,24 @@
|
|
||||||
|
+ userdom_dontaudit_list_admin_dir($1)
|
||||||
|
role system_r types $1;
|
||||||
|
')
|
||||||
|
|
||||||
|
@@ -343,6 +361,24 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -9220,7 +9287,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
## Read and write a cron daemon unnamed pipe.
|
## Read and write a cron daemon unnamed pipe.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -361,7 +396,7 @@
|
@@ -361,7 +397,7 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -9229,7 +9296,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -369,7 +404,7 @@
|
@@ -369,7 +405,7 @@
|
||||||
## </summary>
|
## </summary>
|
||||||
## </param>
|
## </param>
|
||||||
#
|
#
|
||||||
@ -9238,7 +9305,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
gen_require(`
|
gen_require(`
|
||||||
type crond_t;
|
type crond_t;
|
||||||
')
|
')
|
||||||
@@ -416,6 +451,42 @@
|
@@ -416,6 +452,42 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -9281,7 +9348,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
## Inherit and use a file descriptor
|
## Inherit and use a file descriptor
|
||||||
## from system cron jobs.
|
## from system cron jobs.
|
||||||
## </summary>
|
## </summary>
|
||||||
@@ -481,11 +552,14 @@
|
@@ -481,11 +553,14 @@
|
||||||
#
|
#
|
||||||
interface(`cron_read_system_job_tmp_files',`
|
interface(`cron_read_system_job_tmp_files',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -9297,7 +9364,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -506,3 +580,101 @@
|
@@ -506,3 +581,101 @@
|
||||||
|
|
||||||
dontaudit $1 system_cronjob_tmp_t:file append;
|
dontaudit $1 system_cronjob_tmp_t:file append;
|
||||||
')
|
')
|
||||||
@ -18450,7 +18517,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
+')
|
+')
|
||||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.6.10/policy/modules/services/samba.if
|
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.6.10/policy/modules/services/samba.if
|
||||||
--- nsaserefpolicy/policy/modules/services/samba.if 2009-01-05 15:39:43.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/samba.if 2009-01-05 15:39:43.000000000 -0500
|
||||||
+++ serefpolicy-3.6.10/policy/modules/services/samba.if 2009-03-30 10:09:41.000000000 -0400
|
+++ serefpolicy-3.6.10/policy/modules/services/samba.if 2009-04-01 15:42:15.000000000 -0400
|
||||||
@@ -4,6 +4,45 @@
|
@@ -4,6 +4,45 @@
|
||||||
## from Windows NT servers.
|
## from Windows NT servers.
|
||||||
## </summary>
|
## </summary>
|
||||||
@ -18850,7 +18917,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
+
|
+
|
||||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.6.10/policy/modules/services/samba.te
|
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.6.10/policy/modules/services/samba.te
|
||||||
--- nsaserefpolicy/policy/modules/services/samba.te 2009-01-19 11:07:34.000000000 -0500
|
--- nsaserefpolicy/policy/modules/services/samba.te 2009-01-19 11:07:34.000000000 -0500
|
||||||
+++ serefpolicy-3.6.10/policy/modules/services/samba.te 2009-03-30 10:09:41.000000000 -0400
|
+++ serefpolicy-3.6.10/policy/modules/services/samba.te 2009-04-01 15:20:37.000000000 -0400
|
||||||
@@ -66,6 +66,13 @@
|
@@ -66,6 +66,13 @@
|
||||||
## </desc>
|
## </desc>
|
||||||
gen_tunable(samba_share_nfs, false)
|
gen_tunable(samba_share_nfs, false)
|
||||||
@ -19136,7 +19203,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
allow swat_t self:udp_socket create_socket_perms;
|
allow swat_t self:udp_socket create_socket_perms;
|
||||||
|
|
||||||
+allow swat_t self:unix_stream_socket connectto;
|
+allow swat_t self:unix_stream_socket connectto;
|
||||||
+can_exec(swat_t, smbd_exec_t)
|
+samba_domtrans_smb(swat_t)
|
||||||
+allow swat_t smbd_port_t:tcp_socket name_bind;
|
+allow swat_t smbd_port_t:tcp_socket name_bind;
|
||||||
+allow swat_t smbd_t:process { signal signull };
|
+allow swat_t smbd_t:process { signal signull };
|
||||||
+allow swat_t smbd_var_run_t:file { lock unlink };
|
+allow swat_t smbd_var_run_t:file { lock unlink };
|
||||||
@ -23819,13 +23886,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
#
|
#
|
||||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.6.10/policy/modules/system/init.if
|
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.6.10/policy/modules/system/init.if
|
||||||
--- nsaserefpolicy/policy/modules/system/init.if 2009-01-05 15:39:43.000000000 -0500
|
--- nsaserefpolicy/policy/modules/system/init.if 2009-01-05 15:39:43.000000000 -0500
|
||||||
+++ serefpolicy-3.6.10/policy/modules/system/init.if 2009-03-30 10:09:41.000000000 -0400
|
+++ serefpolicy-3.6.10/policy/modules/system/init.if 2009-04-01 15:00:12.000000000 -0400
|
||||||
@@ -280,6 +280,27 @@
|
@@ -280,6 +280,28 @@
|
||||||
kernel_dontaudit_use_fds($1)
|
kernel_dontaudit_use_fds($1)
|
||||||
')
|
')
|
||||||
')
|
')
|
||||||
+
|
+
|
||||||
+ userdom_dontaudit_search_user_home_dirs($1)
|
+ userdom_dontaudit_search_user_home_dirs($1)
|
||||||
|
+ userdom_dontaudit_rw_stream($1)
|
||||||
+
|
+
|
||||||
+ tunable_policy(`allow_daemons_use_tty',`
|
+ tunable_policy(`allow_daemons_use_tty',`
|
||||||
+ term_use_all_user_ttys($1)
|
+ term_use_all_user_ttys($1)
|
||||||
@ -23848,7 +23916,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -546,7 +567,7 @@
|
@@ -546,7 +568,7 @@
|
||||||
|
|
||||||
# upstart uses a datagram socket instead of initctl pipe
|
# upstart uses a datagram socket instead of initctl pipe
|
||||||
allow $1 self:unix_dgram_socket create_socket_perms;
|
allow $1 self:unix_dgram_socket create_socket_perms;
|
||||||
@ -23857,7 +23925,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
')
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -619,18 +640,19 @@
|
@@ -619,18 +641,19 @@
|
||||||
#
|
#
|
||||||
interface(`init_spec_domtrans_script',`
|
interface(`init_spec_domtrans_script',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -23881,7 +23949,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
')
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -646,23 +668,43 @@
|
@@ -646,23 +669,43 @@
|
||||||
#
|
#
|
||||||
interface(`init_domtrans_script',`
|
interface(`init_domtrans_script',`
|
||||||
gen_require(`
|
gen_require(`
|
||||||
@ -23929,7 +23997,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
## Execute a init script in a specified domain.
|
## Execute a init script in a specified domain.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <desc>
|
## <desc>
|
||||||
@@ -1291,6 +1333,25 @@
|
@@ -1291,6 +1334,25 @@
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -23955,7 +24023,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
## Create files in a init script
|
## Create files in a init script
|
||||||
## temporary data directory.
|
## temporary data directory.
|
||||||
## </summary>
|
## </summary>
|
||||||
@@ -1521,3 +1582,51 @@
|
@@ -1521,3 +1583,51 @@
|
||||||
')
|
')
|
||||||
corenet_udp_recvfrom_labeled($1, daemon)
|
corenet_udp_recvfrom_labeled($1, daemon)
|
||||||
')
|
')
|
||||||
@ -24009,7 +24077,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
+')
|
+')
|
||||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.6.10/policy/modules/system/init.te
|
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.6.10/policy/modules/system/init.te
|
||||||
--- nsaserefpolicy/policy/modules/system/init.te 2009-01-19 11:07:34.000000000 -0500
|
--- nsaserefpolicy/policy/modules/system/init.te 2009-01-19 11:07:34.000000000 -0500
|
||||||
+++ serefpolicy-3.6.10/policy/modules/system/init.te 2009-03-30 10:09:41.000000000 -0400
|
+++ serefpolicy-3.6.10/policy/modules/system/init.te 2009-04-01 15:00:25.000000000 -0400
|
||||||
@@ -17,6 +17,20 @@
|
@@ -17,6 +17,20 @@
|
||||||
## </desc>
|
## </desc>
|
||||||
gen_tunable(init_upstart,false)
|
gen_tunable(init_upstart,false)
|
||||||
@ -24292,13 +24360,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
vmware_read_system_config(initrc_t)
|
vmware_read_system_config(initrc_t)
|
||||||
vmware_append_system_config(initrc_t)
|
vmware_append_system_config(initrc_t)
|
||||||
')
|
')
|
||||||
@@ -790,3 +865,17 @@
|
@@ -790,3 +865,19 @@
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
zebra_read_config(initrc_t)
|
zebra_read_config(initrc_t)
|
||||||
')
|
')
|
||||||
+
|
+
|
||||||
+userdom_append_user_home_content_files(daemon)
|
+userdom_append_user_home_content_files(daemon)
|
||||||
+userdom_write_user_tmp_files(daemon)
|
+userdom_write_user_tmp_files(daemon)
|
||||||
|
+userdom_dontaudit_rw_stream(daemon)
|
||||||
|
+
|
||||||
+logging_append_all_logs(daemon)
|
+logging_append_all_logs(daemon)
|
||||||
+
|
+
|
||||||
+optional_policy(`
|
+optional_policy(`
|
||||||
@ -26941,7 +27011,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
+/opt/real/(.*/)?realplay\.bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
+/opt/real/(.*/)?realplay\.bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
||||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.6.10/policy/modules/system/unconfined.if
|
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.6.10/policy/modules/system/unconfined.if
|
||||||
--- nsaserefpolicy/policy/modules/system/unconfined.if 2008-11-11 16:13:48.000000000 -0500
|
--- nsaserefpolicy/policy/modules/system/unconfined.if 2008-11-11 16:13:48.000000000 -0500
|
||||||
+++ serefpolicy-3.6.10/policy/modules/system/unconfined.if 2009-03-30 10:09:41.000000000 -0400
|
+++ serefpolicy-3.6.10/policy/modules/system/unconfined.if 2009-04-01 14:58:39.000000000 -0400
|
||||||
@@ -12,14 +12,13 @@
|
@@ -12,14 +12,13 @@
|
||||||
#
|
#
|
||||||
interface(`unconfined_domain_noaudit',`
|
interface(`unconfined_domain_noaudit',`
|
||||||
@ -27598,7 +27668,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
+/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
|
+/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
|
||||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.10/policy/modules/system/userdomain.if
|
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.10/policy/modules/system/userdomain.if
|
||||||
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-01-19 11:07:34.000000000 -0500
|
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-01-19 11:07:34.000000000 -0500
|
||||||
+++ serefpolicy-3.6.10/policy/modules/system/userdomain.if 2009-03-30 10:09:41.000000000 -0400
|
+++ serefpolicy-3.6.10/policy/modules/system/userdomain.if 2009-04-01 14:59:58.000000000 -0400
|
||||||
@@ -30,8 +30,9 @@
|
@@ -30,8 +30,9 @@
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -28982,7 +29052,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
kernel_search_proc($1)
|
kernel_search_proc($1)
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -2981,3 +3182,462 @@
|
@@ -2981,3 +3182,482 @@
|
||||||
|
|
||||||
allow $1 userdomain:dbus send_msg;
|
allow $1 userdomain:dbus send_msg;
|
||||||
')
|
')
|
||||||
@ -29445,6 +29515,26 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
|
|||||||
+ allow $1 userdomain:key manage_key_perms;
|
+ allow $1 userdomain:key manage_key_perms;
|
||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
|
+
|
||||||
|
+########################################
|
||||||
|
+## <summary>
|
||||||
|
+## Do not audit attempts to read and write
|
||||||
|
+## unserdomain stream.
|
||||||
|
+## </summary>
|
||||||
|
+## <param name="domain">
|
||||||
|
+## <summary>
|
||||||
|
+## Domain to not audit.
|
||||||
|
+## </summary>
|
||||||
|
+## </param>
|
||||||
|
+#
|
||||||
|
+interface(`userdom_dontaudit_rw_stream',`
|
||||||
|
+ gen_require(`
|
||||||
|
+ attribute userdomain;
|
||||||
|
+ ')
|
||||||
|
+
|
||||||
|
+ dontaudit $1 userdomain:unix_stream_socket rw_file_perms;
|
||||||
|
+')
|
||||||
|
+
|
||||||
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.6.10/policy/modules/system/userdomain.te
|
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.6.10/policy/modules/system/userdomain.te
|
||||||
--- nsaserefpolicy/policy/modules/system/userdomain.te 2009-01-19 11:07:34.000000000 -0500
|
--- nsaserefpolicy/policy/modules/system/userdomain.te 2009-01-19 11:07:34.000000000 -0500
|
||||||
+++ serefpolicy-3.6.10/policy/modules/system/userdomain.te 2009-03-30 10:09:41.000000000 -0400
|
+++ serefpolicy-3.6.10/policy/modules/system/userdomain.te 2009-03-30 10:09:41.000000000 -0400
|
||||||
|
@ -20,7 +20,7 @@
|
|||||||
Summary: SELinux policy configuration
|
Summary: SELinux policy configuration
|
||||||
Name: selinux-policy
|
Name: selinux-policy
|
||||||
Version: 3.6.10
|
Version: 3.6.10
|
||||||
Release: 5%{?dist}
|
Release: 6%{?dist}
|
||||||
License: GPLv2+
|
License: GPLv2+
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
Source: serefpolicy-%{version}.tgz
|
Source: serefpolicy-%{version}.tgz
|
||||||
@ -444,6 +444,9 @@ exit 0
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Thu Apr 2 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-6
|
||||||
|
- Dontaudit listing of /root directory for cron system jobs
|
||||||
|
|
||||||
* Mon Mar 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-5
|
* Mon Mar 30 2009 Dan Walsh <dwalsh@redhat.com> 3.6.10-5
|
||||||
- Fix missing ld.so.cache label
|
- Fix missing ld.so.cache label
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user