rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- fetchmail can use kerberos

Browse Source 
- ksmtuned reads in shell programs
- gnome_systemctl_t reads the process state of ntp
- dnsmasq_t asks the kernel to load multiple kernel mod
- Add rules for domains executing systemctl
- Bogus text within fc file
This commit is contained in:
Miroslav 2011-08-04 22:32:55 +02:00
parent 8becfd3523
commit 913fabe1c8
2 changed files with 185 additions and 105 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

280
policy-F16.patch
View File

@ -1084,7 +1084,7 @@ index 3c7b1e8..1e155f5 100644
+ +
+/var/run/epylog\.pid gen_context(system_u:object_r:logwatch_var_run_t,s0) +/var/run/epylog\.pid gen_context(system_u:object_r:logwatch_var_run_t,s0)
diff --git a/policy/modules/admin/logwatch.te b/policy/modules/admin/logwatch.te diff --git a/policy/modules/admin/logwatch.te b/policy/modules/admin/logwatch.te
index 75ce30f..b48b383 100644 index 75ce30f..7db2988 100644
--- a/policy/modules/admin/logwatch.te --- a/policy/modules/admin/logwatch.te
+++ b/policy/modules/admin/logwatch.te +++ b/policy/modules/admin/logwatch.te
@@ -19,6 +19,12 @@ files_lock_file(logwatch_lock_t) @@ -19,6 +19,12 @@ files_lock_file(logwatch_lock_t)
@ -1143,7 +1143,7 @@ index 75ce30f..b48b383 100644
files_getattr_all_file_type_fs(logwatch_t) files_getattr_all_file_type_fs(logwatch_t)
') ')
@@ -145,3 +160,22 @@ optional_policy(` @@ -145,3 +160,23 @@ optional_policy(`
samba_read_log(logwatch_t) samba_read_log(logwatch_t)
samba_read_share_files(logwatch_t) samba_read_share_files(logwatch_t)
') ')
@ -1158,6 +1158,7 @@ index 75ce30f..b48b383 100644
+manage_files_pattern(logwatch_mail_t, logwatch_tmp_t, logwatch_tmp_t) +manage_files_pattern(logwatch_mail_t, logwatch_tmp_t, logwatch_tmp_t)
+ +
+dev_read_rand(logwatch_mail_t) +dev_read_rand(logwatch_mail_t)
+dev_read_sysfs(logwatch_mail_t)
+ +
+logging_read_all_logs(logwatch_mail_t) +logging_read_all_logs(logwatch_mail_t)
+ +
@ -6678,7 +6679,7 @@ index 93ac529..35b51ab 100644
+/usr/lib/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0) +/usr/lib/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0)
+/usr/lib/xulrunner[^/]*/plugin-container -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0) +/usr/lib/xulrunner[^/]*/plugin-container -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
diff --git a/policy/modules/apps/mozilla.if b/policy/modules/apps/mozilla.if diff --git a/policy/modules/apps/mozilla.if b/policy/modules/apps/mozilla.if
index fbb5c5a..170963f 100644 index fbb5c5a..2339227 100644
--- a/policy/modules/apps/mozilla.if --- a/policy/modules/apps/mozilla.if
+++ b/policy/modules/apps/mozilla.if +++ b/policy/modules/apps/mozilla.if
@@ -29,6 +29,8 @@ interface(`mozilla_role',` @@ -29,6 +29,8 @@ interface(`mozilla_role',`
@ -6716,7 +6717,7 @@ index fbb5c5a..170963f 100644
') ')
######################################## ########################################
@@ -228,6 +238,33 @@ interface(`mozilla_run_plugin',` @@ -228,6 +238,35 @@ interface(`mozilla_run_plugin',`
mozilla_domtrans_plugin($1) mozilla_domtrans_plugin($1)
role $2 types mozilla_plugin_t; role $2 types mozilla_plugin_t;
@ -6725,6 +6726,8 @@ index fbb5c5a..170963f 100644
+ allow $1 mozilla_plugin_t:fd use; + allow $1 mozilla_plugin_t:fd use;
+ +
+ allow mozilla_plugin_t $1:unix_stream_socket rw_socket_perms; + allow mozilla_plugin_t $1:unix_stream_socket rw_socket_perms;
+ allow mozilla_plugin_t $1:shm rw_shm_perms;
+ allow mozilla_plugin_t $1:sem create_sem_perms;
+ +
+ ps_process_pattern($1, mozilla_plugin_t) + ps_process_pattern($1, mozilla_plugin_t)
+ allow $1 mozilla_plugin_t:process { ptrace signal_perms }; + allow $1 mozilla_plugin_t:process { ptrace signal_perms };
@ -6750,7 +6753,7 @@ index fbb5c5a..170963f 100644
') ')
######################################## ########################################
@@ -269,9 +306,27 @@ interface(`mozilla_rw_tcp_sockets',` @@ -269,9 +308,27 @@ interface(`mozilla_rw_tcp_sockets',`
allow $1 mozilla_t:tcp_socket rw_socket_perms; allow $1 mozilla_t:tcp_socket rw_socket_perms;
') ')
@ -6779,7 +6782,7 @@ index fbb5c5a..170963f 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -279,28 +334,28 @@ interface(`mozilla_rw_tcp_sockets',` @@ -279,28 +336,28 @@ interface(`mozilla_rw_tcp_sockets',`
## </summary> ## </summary>
## </param> ## </param>
# #
@ -16004,7 +16007,7 @@ index 6346378..edbe041 100644
+') +')
+ +
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index d91c62f..9740613 100644 index d91c62f..848f59b 100644
--- a/policy/modules/kernel/kernel.te --- a/policy/modules/kernel/kernel.te
+++ b/policy/modules/kernel/kernel.te +++ b/policy/modules/kernel/kernel.te
@@ -50,6 +50,8 @@ sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh) @@ -50,6 +50,8 @@ sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh)
@ -16024,12 +16027,21 @@ index d91c62f..9740613 100644
# These initial sids are no longer used, and can be removed: # These initial sids are no longer used, and can be removed:
sid any_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh) sid any_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
@@ -247,6 +250,9 @@ dev_delete_generic_blk_files(kernel_t) @@ -242,11 +245,14 @@ dev_search_usbfs(kernel_t)
dev_create_generic_chr_files(kernel_t) # devtmpfs handling:
dev_delete_generic_chr_files(kernel_t) dev_create_generic_dirs(kernel_t)
dev_delete_generic_dirs(kernel_t)
-dev_create_generic_blk_files(kernel_t)
-dev_delete_generic_blk_files(kernel_t)
-dev_create_generic_chr_files(kernel_t)
-dev_delete_generic_chr_files(kernel_t)
+dev_create_all_blk_files(kernel_t)
+dev_delete_all_blk_files(kernel_t)
+dev_create_all_chr_files(kernel_t)
+dev_delete_all_chr_files(kernel_t)
dev_mounton(kernel_t) dev_mounton(kernel_t)
+dev_filetrans_all_named_dev(kernel_t) +dev_filetrans_all_named_dev(kernel_t)
+#storage_filetrans_all_named_dev(kernel_t) +storage_filetrans_all_named_dev(kernel_t)
+term_filetrans_all_named_dev(kernel_t) +term_filetrans_all_named_dev(kernel_t)
# Mount root file system. Used when loading a policy # Mount root file system. Used when loading a policy
@ -18983,7 +18995,7 @@ index 0000000..8b2cdf3
+ +
diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
new file mode 100644 new file mode 100644
index 0000000..fc2c9ec index 0000000..db35ff1
--- /dev/null --- /dev/null
+++ b/policy/modules/roles/unconfineduser.te +++ b/policy/modules/roles/unconfineduser.te
@@ -0,0 +1,553 @@ @@ -0,0 +1,553 @@
@ -19364,9 +19376,9 @@ index 0000000..fc2c9ec
+ lpd_run_checkpc(unconfined_t, unconfined_r) + lpd_run_checkpc(unconfined_t, unconfined_r)
+') +')
+ +
+optional_policy(` +#optional_policy(`
+ mock_role(unconfined_r, unconfined_t) +# mock_role(unconfined_r, unconfined_t)
+') +#')
+ +
+optional_policy(` +optional_policy(`
+ modutils_run_update_mods(unconfined_t, unconfined_r) + modutils_run_update_mods(unconfined_t, unconfined_r)
@ -30896,10 +30908,10 @@ index 9bd812b..c4abec3 100644
## an dnsmasq environment ## an dnsmasq environment
## </summary> ## </summary>
diff --git a/policy/modules/services/dnsmasq.te b/policy/modules/services/dnsmasq.te diff --git a/policy/modules/services/dnsmasq.te b/policy/modules/services/dnsmasq.te
index fdaeeba..df87ba8 100644 index fdaeeba..d707dde 100644
--- a/policy/modules/services/dnsmasq.te --- a/policy/modules/services/dnsmasq.te
+++ b/policy/modules/services/dnsmasq.te +++ b/policy/modules/services/dnsmasq.te
@@ -48,8 +48,9 @@ files_var_lib_filetrans(dnsmasq_t, dnsmasq_lease_t, file) @@ -48,11 +48,13 @@ files_var_lib_filetrans(dnsmasq_t, dnsmasq_lease_t, file)
manage_files_pattern(dnsmasq_t, dnsmasq_var_log_t, dnsmasq_var_log_t) manage_files_pattern(dnsmasq_t, dnsmasq_var_log_t, dnsmasq_var_log_t)
logging_log_filetrans(dnsmasq_t, dnsmasq_var_log_t, file) logging_log_filetrans(dnsmasq_t, dnsmasq_var_log_t, file)
@ -30910,7 +30922,11 @@ index fdaeeba..df87ba8 100644
kernel_read_kernel_sysctls(dnsmasq_t) kernel_read_kernel_sysctls(dnsmasq_t)
kernel_read_system_state(dnsmasq_t) kernel_read_system_state(dnsmasq_t)
@@ -88,6 +89,8 @@ logging_send_syslog_msg(dnsmasq_t) +kernel_request_load_module(dnsmasq_t)
corenet_all_recvfrom_unlabeled(dnsmasq_t)
corenet_all_recvfrom_netlabel(dnsmasq_t)
@@ -88,6 +90,8 @@ logging_send_syslog_msg(dnsmasq_t)
miscfiles_read_localization(dnsmasq_t) miscfiles_read_localization(dnsmasq_t)
@ -30919,7 +30935,7 @@ index fdaeeba..df87ba8 100644
userdom_dontaudit_use_unpriv_user_fds(dnsmasq_t) userdom_dontaudit_use_unpriv_user_fds(dnsmasq_t)
userdom_dontaudit_search_user_home_dirs(dnsmasq_t) userdom_dontaudit_search_user_home_dirs(dnsmasq_t)
@@ -96,7 +99,16 @@ optional_policy(` @@ -96,7 +100,16 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30936,7 +30952,7 @@ index fdaeeba..df87ba8 100644
') ')
optional_policy(` optional_policy(`
@@ -114,4 +126,5 @@ optional_policy(` @@ -114,4 +127,5 @@ optional_policy(`
optional_policy(` optional_policy(`
virt_manage_lib_files(dnsmasq_t) virt_manage_lib_files(dnsmasq_t)
virt_read_pid_files(dnsmasq_t) virt_read_pid_files(dnsmasq_t)
@ -32449,6 +32465,21 @@ index 6537214..7d64c0a 100644
ps_process_pattern($1, fetchmail_t) ps_process_pattern($1, fetchmail_t)
files_list_etc($1) files_list_etc($1)
diff --git a/policy/modules/services/fetchmail.te b/policy/modules/services/fetchmail.te
index 3459d93..c39305a 100644
--- a/policy/modules/services/fetchmail.te
+++ b/policy/modules/services/fetchmail.te
@@ -88,6 +88,10 @@ userdom_dontaudit_use_unpriv_user_fds(fetchmail_t)
userdom_dontaudit_search_user_home_dirs(fetchmail_t)
optional_policy(`
+ kerberos_use(fetchmail_t)
+')
+
+optional_policy(`
procmail_domtrans(fetchmail_t)
')
diff --git a/policy/modules/services/finger.te b/policy/modules/services/finger.te diff --git a/policy/modules/services/finger.te b/policy/modules/services/finger.te
index 9b7036a..4770f61 100644 index 9b7036a..4770f61 100644
--- a/policy/modules/services/finger.te --- a/policy/modules/services/finger.te
@ -33797,7 +33828,7 @@ index 671d8fd..25c7ab8 100644
+ dontaudit gnomeclock_t $1:dbus send_msg; + dontaudit gnomeclock_t $1:dbus send_msg;
+') +')
diff --git a/policy/modules/services/gnomeclock.te b/policy/modules/services/gnomeclock.te diff --git a/policy/modules/services/gnomeclock.te b/policy/modules/services/gnomeclock.te
index 4fde46b..b9032a7 100644 index 4fde46b..eac72e4 100644
--- a/policy/modules/services/gnomeclock.te --- a/policy/modules/services/gnomeclock.te
+++ b/policy/modules/services/gnomeclock.te +++ b/policy/modules/services/gnomeclock.te
@@ -9,24 +9,32 @@ type gnomeclock_t; @@ -9,24 +9,32 @@ type gnomeclock_t;
@ -33836,7 +33867,7 @@ index 4fde46b..b9032a7 100644
miscfiles_read_localization(gnomeclock_t) miscfiles_read_localization(gnomeclock_t)
miscfiles_manage_localization(gnomeclock_t) miscfiles_manage_localization(gnomeclock_t)
@@ -35,12 +43,51 @@ miscfiles_etc_filetrans_localization(gnomeclock_t) @@ -35,12 +43,47 @@ miscfiles_etc_filetrans_localization(gnomeclock_t)
userdom_read_all_users_state(gnomeclock_t) userdom_read_all_users_state(gnomeclock_t)
optional_policy(` optional_policy(`
@ -33876,17 +33907,13 @@ index 4fde46b..b9032a7 100644
+files_dontaudit_remove_etc_dir(gnomeclock_systemctl_t) +files_dontaudit_remove_etc_dir(gnomeclock_systemctl_t)
+files_manage_etc_symlinks(gnomeclock_systemctl_t) +files_manage_etc_symlinks(gnomeclock_systemctl_t)
+ +
+fs_dontaudit_search_cgroup_dirs(gnomeclock_systemctl_t) +miscfiles_read_localization(gnomeclock_systemctl_t)
+
+# needed by systemctl
+init_stream_connect(gnomeclock_systemctl_t)
+init_read_state(gnomeclock_systemctl_t)
+init_list_pid_dirs(gnomeclock_systemctl_t)
+ +
+systemd_dontaudit_read_unit_files(gnomeclock_systemctl_t) +systemd_dontaudit_read_unit_files(gnomeclock_systemctl_t)
+ +
+optional_policy(` +optional_policy(`
+ ntpd_read_unit_file(gnomeclock_systemctl_t) + ntp_read_unit_file(gnomeclock_systemctl_t)
+ ntp_read_state(gnomeclock_systemctl_t)
+') +')
diff --git a/policy/modules/services/gpm.if b/policy/modules/services/gpm.if diff --git a/policy/modules/services/gpm.if b/policy/modules/services/gpm.if
index 7d97298..d6b2959 100644 index 7d97298..d6b2959 100644
@ -35215,7 +35242,7 @@ index da2127e..6538d66 100644
+ +
+sysnet_read_config(jabberd_domain) +sysnet_read_config(jabberd_domain)
diff --git a/policy/modules/services/kerberos.fc b/policy/modules/services/kerberos.fc diff --git a/policy/modules/services/kerberos.fc b/policy/modules/services/kerberos.fc
index 3525d24..74ec098 100644 index 3525d24..e065744 100644
--- a/policy/modules/services/kerberos.fc --- a/policy/modules/services/kerberos.fc
+++ b/policy/modules/services/kerberos.fc +++ b/policy/modules/services/kerberos.fc
@@ -8,7 +8,7 @@ HOME_DIR/\.k5login -- gen_context(system_u:object_r:krb5_home_t,s0) @@ -8,7 +8,7 @@ HOME_DIR/\.k5login -- gen_context(system_u:object_r:krb5_home_t,s0)
@ -35227,13 +35254,12 @@ index 3525d24..74ec098 100644
/etc/rc\.d/init\.d/kprop -- gen_context(system_u:object_r:kerberos_initrc_exec_t,s0) /etc/rc\.d/init\.d/kprop -- gen_context(system_u:object_r:kerberos_initrc_exec_t,s0)
/etc/rc\.d/init\.d/krb524d -- gen_context(system_u:object_r:kerberos_initrc_exec_t,s0) /etc/rc\.d/init\.d/krb524d -- gen_context(system_u:object_r:kerberos_initrc_exec_t,s0)
/etc/rc\.d/init\.d/krb5kdc -- gen_context(system_u:object_r:kerberos_initrc_exec_t,s0) /etc/rc\.d/init\.d/krb5kdc -- gen_context(system_u:object_r:kerberos_initrc_exec_t,s0)
@@ -30,4 +30,8 @@ HOME_DIR/\.k5login -- gen_context(system_u:object_r:krb5_home_t,s0) @@ -30,4 +30,7 @@ HOME_DIR/\.k5login -- gen_context(system_u:object_r:krb5_home_t,s0)
/var/log/krb5kdc\.log gen_context(system_u:object_r:krb5kdc_log_t,s0) /var/log/krb5kdc\.log gen_context(system_u:object_r:krb5kdc_log_t,s0)
/var/log/kadmin(d)?\.log gen_context(system_u:object_r:kadmind_log_t,s0) /var/log/kadmin(d)?\.log gen_context(system_u:object_r:kadmind_log_t,s0)
+/var/cache/krb5rcache(/.*)? gen_context(system_u:object_r:krb5_host_rcache_t,s0) +/var/cache/krb5rcache(/.*)? gen_context(system_u:object_r:krb5_host_rcache_t,s0)
+ +
+krb5_host_rcache_t
/var/tmp/host_0 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) /var/tmp/host_0 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0)
+/var/tmp/HTTP_23 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) +/var/tmp/HTTP_23 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0)
diff --git a/policy/modules/services/kerberos.if b/policy/modules/services/kerberos.if diff --git a/policy/modules/services/kerberos.if b/policy/modules/services/kerberos.if
@ -35798,7 +35824,7 @@ index 6fd0b4c..b733e45 100644
- -
') ')
diff --git a/policy/modules/services/ksmtuned.te b/policy/modules/services/ksmtuned.te diff --git a/policy/modules/services/ksmtuned.te b/policy/modules/services/ksmtuned.te
index a73b7a1..7fa55e8 100644 index a73b7a1..677998f 100644
--- a/policy/modules/services/ksmtuned.te --- a/policy/modules/services/ksmtuned.te
+++ b/policy/modules/services/ksmtuned.te +++ b/policy/modules/services/ksmtuned.te
@@ -9,6 +9,9 @@ type ksmtuned_t; @@ -9,6 +9,9 @@ type ksmtuned_t;
@ -35822,13 +35848,14 @@ index a73b7a1..7fa55e8 100644
manage_files_pattern(ksmtuned_t, ksmtuned_var_run_t, ksmtuned_var_run_t) manage_files_pattern(ksmtuned_t, ksmtuned_var_run_t, ksmtuned_var_run_t)
files_pid_filetrans(ksmtuned_t, ksmtuned_var_run_t, file) files_pid_filetrans(ksmtuned_t, ksmtuned_var_run_t, file)
@@ -31,9 +38,16 @@ kernel_read_system_state(ksmtuned_t) @@ -31,9 +38,17 @@ kernel_read_system_state(ksmtuned_t)
dev_rw_sysfs(ksmtuned_t) dev_rw_sysfs(ksmtuned_t)
domain_read_all_domains_state(ksmtuned_t) domain_read_all_domains_state(ksmtuned_t)
+domain_dontaudit_read_all_domains_state(ksmtuned_t) +domain_dontaudit_read_all_domains_state(ksmtuned_t)
corecmd_exec_bin(ksmtuned_t) corecmd_exec_bin(ksmtuned_t)
+corecmd_exec_shell(ksmtuned_t)
files_read_etc_files(ksmtuned_t) files_read_etc_files(ksmtuned_t)
@ -36263,7 +36290,7 @@ index 49e04e5..69db026 100644
/usr/sbin/lircd -- gen_context(system_u:object_r:lircd_exec_t,s0) /usr/sbin/lircd -- gen_context(system_u:object_r:lircd_exec_t,s0)
diff --git a/policy/modules/services/lircd.te b/policy/modules/services/lircd.te diff --git a/policy/modules/services/lircd.te b/policy/modules/services/lircd.te
index 6a78de1..0aebce6 100644 index 6a78de1..a32fbe8 100644
--- a/policy/modules/services/lircd.te --- a/policy/modules/services/lircd.te
+++ b/policy/modules/services/lircd.te +++ b/policy/modules/services/lircd.te
@@ -13,7 +13,7 @@ type lircd_initrc_exec_t; @@ -13,7 +13,7 @@ type lircd_initrc_exec_t;
@ -36283,7 +36310,7 @@ index 6a78de1..0aebce6 100644
allow lircd_t self:fifo_file rw_fifo_file_perms; allow lircd_t self:fifo_file rw_fifo_file_perms;
allow lircd_t self:unix_dgram_socket create_socket_perms; allow lircd_t self:unix_dgram_socket create_socket_perms;
allow lircd_t self:tcp_socket create_stream_socket_perms; allow lircd_t self:tcp_socket create_stream_socket_perms;
@@ -44,13 +45,13 @@ corenet_tcp_bind_lirc_port(lircd_t) @@ -44,13 +45,14 @@ corenet_tcp_bind_lirc_port(lircd_t)
corenet_tcp_sendrecv_all_ports(lircd_t) corenet_tcp_sendrecv_all_ports(lircd_t)
corenet_tcp_connect_lirc_port(lircd_t) corenet_tcp_connect_lirc_port(lircd_t)
@ -36293,6 +36320,7 @@ index 6a78de1..0aebce6 100644
dev_filetrans_lirc(lircd_t) dev_filetrans_lirc(lircd_t)
dev_rw_lirc(lircd_t) dev_rw_lirc(lircd_t)
dev_rw_input_dev(lircd_t) dev_rw_input_dev(lircd_t)
+dev_read_sysfs(lircd_t)
-files_read_etc_files(lircd_t) -files_read_etc_files(lircd_t)
+files_read_config_files(lircd_t) +files_read_config_files(lircd_t)
@ -37663,15 +37691,14 @@ index 47e3612..ece07ab 100644
# The milter runs from /var/lib/spamass-milter # The milter runs from /var/lib/spamass-milter
diff --git a/policy/modules/services/mock.fc b/policy/modules/services/mock.fc diff --git a/policy/modules/services/mock.fc b/policy/modules/services/mock.fc
new file mode 100644 new file mode 100644
index 0000000..68ad33f index 0000000..8d0e473
--- /dev/null --- /dev/null
+++ b/policy/modules/services/mock.fc +++ b/policy/modules/services/mock.fc
@@ -0,0 +1,6 @@ @@ -0,0 +1,5 @@
+ +
+/usr/sbin/mock -- gen_context(system_u:object_r:mock_exec_t,s0) +/usr/sbin/mock -- gen_context(system_u:object_r:mock_exec_t,s0)
+ +
+/var/lib/mock -d gen_context(system_u:object_r:mock_var_lib_t,s0) +/var/lib/mock(/.*)? gen_context(system_u:object_r:mock_var_lib_t,s0)
+/var/lib/mock(/.*)? <<none>>
+/var/cache/mock(/.*)? gen_context(system_u:object_r:mock_cache_t,s0) +/var/cache/mock(/.*)? gen_context(system_u:object_r:mock_cache_t,s0)
diff --git a/policy/modules/services/mock.if b/policy/modules/services/mock.if diff --git a/policy/modules/services/mock.if b/policy/modules/services/mock.if
new file mode 100644 new file mode 100644
@ -40576,7 +40603,7 @@ index e79dccc..50202ef 100644
/usr/sbin/ntpdate -- gen_context(system_u:object_r:ntpdate_exec_t,s0) /usr/sbin/ntpdate -- gen_context(system_u:object_r:ntpdate_exec_t,s0)
diff --git a/policy/modules/services/ntp.if b/policy/modules/services/ntp.if diff --git a/policy/modules/services/ntp.if b/policy/modules/services/ntp.if
index e80f8c0..be0d107 100644 index e80f8c0..d90ed98 100644
--- a/policy/modules/services/ntp.if --- a/policy/modules/services/ntp.if
+++ b/policy/modules/services/ntp.if +++ b/policy/modules/services/ntp.if
@@ -98,6 +98,25 @@ interface(`ntp_initrc_domtrans',` @@ -98,6 +98,25 @@ interface(`ntp_initrc_domtrans',`
@ -40593,7 +40620,7 @@ index e80f8c0..be0d107 100644
+## </summary> +## </summary>
+## </param> +## </param>
+# +#
+interface(`ntpd_read_unit_file',` +interface(`ntp_read_unit_file',`
+ gen_require(` + gen_require(`
+ type ntpd_unit_file_t; + type ntpd_unit_file_t;
+ ') + ')
@ -40605,7 +40632,33 @@ index e80f8c0..be0d107 100644
######################################## ########################################
## <summary> ## <summary>
## Read and write ntpd shared memory. ## Read and write ntpd shared memory.
@@ -140,11 +159,10 @@ interface(`ntp_rw_shm',` @@ -122,6 +141,25 @@ interface(`ntp_rw_shm',`
########################################
## <summary>
+## Allow the domain to read ntpd state files in /proc.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`ntp_read_state',`
+ gen_require(`
+ type ntpd_t;
+ ')
+
+ kernel_search_proc($1)
+ ps_process_pattern($1, ntpd_t)
+')
+
+########################################
+## <summary>
## All of the rules required to administrate
## an ntp environment
## </summary>
@@ -140,11 +178,10 @@ interface(`ntp_rw_shm',`
interface(`ntp_admin',` interface(`ntp_admin',`
gen_require(` gen_require(`
type ntpd_t, ntpd_tmp_t, ntpd_log_t; type ntpd_t, ntpd_tmp_t, ntpd_log_t;
@ -49859,7 +49912,7 @@ index adea9f9..d5b2d93 100644
init_labeled_script_domtrans($1, fsdaemon_initrc_exec_t) init_labeled_script_domtrans($1, fsdaemon_initrc_exec_t)
diff --git a/policy/modules/services/smartmon.te b/policy/modules/services/smartmon.te diff --git a/policy/modules/services/smartmon.te b/policy/modules/services/smartmon.te
index 606a098..f00a814 100644 index 606a098..5e4d100 100644
--- a/policy/modules/services/smartmon.te --- a/policy/modules/services/smartmon.te
+++ b/policy/modules/services/smartmon.te +++ b/policy/modules/services/smartmon.te
@@ -35,7 +35,7 @@ ifdef(`enable_mls',` @@ -35,7 +35,7 @@ ifdef(`enable_mls',`
@ -49867,7 +49920,7 @@ index 606a098..f00a814 100644
# #
-allow fsdaemon_t self:capability { setpcap setgid sys_rawio sys_admin }; -allow fsdaemon_t self:capability { setpcap setgid sys_rawio sys_admin };
+allow fsdaemon_t self:capability { dac_override setpcap setgid sys_rawio sys_admin }; +allow fsdaemon_t self:capability { dac_override kill setpcap setgid sys_rawio sys_admin };
dontaudit fsdaemon_t self:capability sys_tty_config; dontaudit fsdaemon_t self:capability sys_tty_config;
allow fsdaemon_t self:process { getcap setcap signal_perms }; allow fsdaemon_t self:process { getcap setcap signal_perms };
allow fsdaemon_t self:fifo_file rw_fifo_file_perms; allow fsdaemon_t self:fifo_file rw_fifo_file_perms;
@ -57262,7 +57315,7 @@ index 21ae664..3e448dd 100644
+ manage_dirs_pattern($1, zarafa_var_lib_t, zarafa_var_lib_t) + manage_dirs_pattern($1, zarafa_var_lib_t, zarafa_var_lib_t)
+') +')
diff --git a/policy/modules/services/zarafa.te b/policy/modules/services/zarafa.te diff --git a/policy/modules/services/zarafa.te b/policy/modules/services/zarafa.te
index 9fb4747..16b2616 100644 index 9fb4747..a59cfc2 100644
--- a/policy/modules/services/zarafa.te --- a/policy/modules/services/zarafa.te
+++ b/policy/modules/services/zarafa.te +++ b/policy/modules/services/zarafa.te
@@ -18,6 +18,10 @@ files_config_file(zarafa_etc_t) @@ -18,6 +18,10 @@ files_config_file(zarafa_etc_t)
@ -57285,7 +57338,7 @@ index 9fb4747..16b2616 100644
######################################## ########################################
# #
# zarafa-deliver local policy # zarafa-deliver local policy
@@ -57,6 +63,21 @@ corenet_tcp_sendrecv_all_ports(zarafa_gateway_t) @@ -57,6 +63,20 @@ corenet_tcp_sendrecv_all_ports(zarafa_gateway_t)
corenet_tcp_bind_generic_node(zarafa_gateway_t) corenet_tcp_bind_generic_node(zarafa_gateway_t)
corenet_tcp_bind_pop_port(zarafa_gateway_t) corenet_tcp_bind_pop_port(zarafa_gateway_t)
@ -57302,12 +57355,11 @@ index 9fb4747..16b2616 100644
+ +
+manage_dirs_pattern(zarafa_indexer_t, zarafa_var_lib_t, zarafa_var_lib_t) +manage_dirs_pattern(zarafa_indexer_t, zarafa_var_lib_t, zarafa_var_lib_t)
+manage_files_pattern(zarafa_indexer_t, zarafa_var_lib_t, zarafa_var_lib_t) +manage_files_pattern(zarafa_indexer_t, zarafa_var_lib_t, zarafa_var_lib_t)
+
+ +
####################################### #######################################
# #
# zarafa-ical local policy # zarafa-ical local policy
@@ -136,6 +157,34 @@ corenet_tcp_sendrecv_generic_node(zarafa_spooler_t) @@ -136,6 +156,36 @@ corenet_tcp_sendrecv_generic_node(zarafa_spooler_t)
corenet_tcp_sendrecv_all_ports(zarafa_spooler_t) corenet_tcp_sendrecv_all_ports(zarafa_spooler_t)
corenet_tcp_connect_smtp_port(zarafa_spooler_t) corenet_tcp_connect_smtp_port(zarafa_spooler_t)
@ -57321,6 +57373,8 @@ index 9fb4747..16b2616 100644
+allow zarafa_gateway_t self:capability { chown kill }; +allow zarafa_gateway_t self:capability { chown kill };
+allow zarafa_gateway_t self:process setrlimit; +allow zarafa_gateway_t self:process setrlimit;
+ +
+dev_read_rand(zarafa_gateway_t)
+
+corenet_tcp_bind_pop_port(zarafa_gateway_t) +corenet_tcp_bind_pop_port(zarafa_gateway_t)
+ +
+####################################### +#######################################
@ -57342,7 +57396,7 @@ index 9fb4747..16b2616 100644
######################################## ########################################
# #
# zarafa domains local policy # zarafa domains local policy
@@ -156,6 +205,4 @@ kernel_read_system_state(zarafa_domain) @@ -156,6 +206,4 @@ kernel_read_system_state(zarafa_domain)
files_read_etc_files(zarafa_domain) files_read_etc_files(zarafa_domain)
@ -59254,7 +59308,7 @@ index 94fd8dd..417ec32 100644
+ read_fifo_files_pattern($1, init_var_run_t, init_var_run_t) + read_fifo_files_pattern($1, init_var_run_t, init_var_run_t)
+') +')
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 29a9565..4d20828 100644 index 29a9565..2163271 100644
--- a/policy/modules/system/init.te --- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te +++ b/policy/modules/system/init.te
@@ -16,6 +16,34 @@ gen_require(` @@ -16,6 +16,34 @@ gen_require(`
@ -59330,7 +59384,7 @@ index 29a9565..4d20828 100644
# is ~sys_module really needed? observed: # is ~sys_module really needed? observed:
# sys_boot # sys_boot
# sys_tty_config # sys_tty_config
@@ -100,11 +134,15 @@ allow init_t self:fifo_file rw_fifo_file_perms; @@ -100,11 +134,16 @@ allow init_t self:fifo_file rw_fifo_file_perms;
# Re-exec itself # Re-exec itself
can_exec(init_t, init_exec_t) can_exec(init_t, init_exec_t)
@ -59347,10 +59401,11 @@ index 29a9565..4d20828 100644
+manage_lnk_files_pattern(init_t, init_var_run_t, init_var_run_t) +manage_lnk_files_pattern(init_t, init_var_run_t, init_var_run_t)
+manage_sock_files_pattern(init_t, init_var_run_t, init_var_run_t) +manage_sock_files_pattern(init_t, init_var_run_t, init_var_run_t)
+files_pid_filetrans(init_t, init_var_run_t, { dir file }) +files_pid_filetrans(init_t, init_var_run_t, { dir file })
+allow init_t init_var_run_t:dir mounton;
allow init_t initctl_t:fifo_file manage_fifo_file_perms; allow init_t initctl_t:fifo_file manage_fifo_file_perms;
dev_filetrans(init_t, initctl_t, fifo_file) dev_filetrans(init_t, initctl_t, fifo_file)
@@ -114,25 +152,34 @@ allow init_t initrc_var_run_t:file { rw_file_perms setattr }; @@ -114,25 +153,34 @@ allow init_t initrc_var_run_t:file { rw_file_perms setattr };
kernel_read_system_state(init_t) kernel_read_system_state(init_t)
kernel_share_state(init_t) kernel_share_state(init_t)
@ -59385,7 +59440,7 @@ index 29a9565..4d20828 100644
files_etc_filetrans_etc_runtime(init_t, file) files_etc_filetrans_etc_runtime(init_t, file)
# Run /etc/X11/prefdm: # Run /etc/X11/prefdm:
files_exec_etc_files(init_t) files_exec_etc_files(init_t)
@@ -151,10 +198,19 @@ mls_file_read_all_levels(init_t) @@ -151,10 +199,19 @@ mls_file_read_all_levels(init_t)
mls_file_write_all_levels(init_t) mls_file_write_all_levels(init_t)
mls_process_write_down(init_t) mls_process_write_down(init_t)
mls_fd_use_all_levels(init_t) mls_fd_use_all_levels(init_t)
@ -59406,7 +59461,7 @@ index 29a9565..4d20828 100644
# Run init scripts. # Run init scripts.
init_domtrans_script(init_t) init_domtrans_script(init_t)
@@ -162,12 +218,16 @@ init_domtrans_script(init_t) @@ -162,12 +219,16 @@ init_domtrans_script(init_t)
libs_rw_ld_so_cache(init_t) libs_rw_ld_so_cache(init_t)
logging_send_syslog_msg(init_t) logging_send_syslog_msg(init_t)
@ -59423,7 +59478,7 @@ index 29a9565..4d20828 100644
ifdef(`distro_gentoo',` ifdef(`distro_gentoo',`
allow init_t self:process { getcap setcap }; allow init_t self:process { getcap setcap };
') ')
@@ -178,7 +238,7 @@ ifdef(`distro_redhat',` @@ -178,7 +239,7 @@ ifdef(`distro_redhat',`
fs_tmpfs_filetrans(init_t, initctl_t, fifo_file) fs_tmpfs_filetrans(init_t, initctl_t, fifo_file)
') ')
@ -59432,7 +59487,7 @@ index 29a9565..4d20828 100644
corecmd_shell_domtrans(init_t, initrc_t) corecmd_shell_domtrans(init_t, initrc_t)
',` ',`
# Run the shell in the sysadm role for single-user mode. # Run the shell in the sysadm role for single-user mode.
@@ -186,16 +246,136 @@ tunable_policy(`init_upstart',` @@ -186,16 +247,137 @@ tunable_policy(`init_upstart',`
sysadm_shell_domtrans(init_t) sysadm_shell_domtrans(init_t)
') ')
@ -59497,6 +59552,7 @@ index 29a9565..4d20828 100644
+ files_create_lock_dirs(init_t) + files_create_lock_dirs(init_t)
+ files_relabel_all_lock_dirs(init_t) + files_relabel_all_lock_dirs(init_t)
+ +
+ fs_getattr_all_fs(init_t)
+ fs_manage_cgroup_dirs(init_t) + fs_manage_cgroup_dirs(init_t)
+ fs_manage_cgroup_files(init_t) + fs_manage_cgroup_files(init_t)
+ fs_manage_hugetlbfs_dirs(init_t) + fs_manage_hugetlbfs_dirs(init_t)
@ -59571,7 +59627,7 @@ index 29a9565..4d20828 100644
') ')
optional_policy(` optional_policy(`
@@ -203,6 +383,17 @@ optional_policy(` @@ -203,6 +385,17 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -59589,7 +59645,7 @@ index 29a9565..4d20828 100644
unconfined_domain(init_t) unconfined_domain(init_t)
') ')
@@ -212,7 +403,7 @@ optional_policy(` @@ -212,7 +405,7 @@ optional_policy(`
# #
allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched }; allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
@ -59598,7 +59654,7 @@ index 29a9565..4d20828 100644
dontaudit initrc_t self:capability sys_module; # sysctl is triggering this dontaudit initrc_t self:capability sys_module; # sysctl is triggering this
allow initrc_t self:passwd rootok; allow initrc_t self:passwd rootok;
allow initrc_t self:key manage_key_perms; allow initrc_t self:key manage_key_perms;
@@ -241,12 +432,15 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t) @@ -241,12 +434,15 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
allow initrc_t initrc_var_run_t:file manage_file_perms; allow initrc_t initrc_var_run_t:file manage_file_perms;
files_pid_filetrans(initrc_t, initrc_var_run_t, file) files_pid_filetrans(initrc_t, initrc_var_run_t, file)
@ -59614,7 +59670,7 @@ index 29a9565..4d20828 100644
init_write_initctl(initrc_t) init_write_initctl(initrc_t)
@@ -258,20 +452,32 @@ kernel_change_ring_buffer_level(initrc_t) @@ -258,20 +454,32 @@ kernel_change_ring_buffer_level(initrc_t)
kernel_clear_ring_buffer(initrc_t) kernel_clear_ring_buffer(initrc_t)
kernel_get_sysvipc_info(initrc_t) kernel_get_sysvipc_info(initrc_t)
kernel_read_all_sysctls(initrc_t) kernel_read_all_sysctls(initrc_t)
@ -59651,7 +59707,7 @@ index 29a9565..4d20828 100644
corenet_tcp_sendrecv_all_ports(initrc_t) corenet_tcp_sendrecv_all_ports(initrc_t)
corenet_udp_sendrecv_all_ports(initrc_t) corenet_udp_sendrecv_all_ports(initrc_t)
corenet_tcp_connect_all_ports(initrc_t) corenet_tcp_connect_all_ports(initrc_t)
@@ -279,6 +485,7 @@ corenet_sendrecv_all_client_packets(initrc_t) @@ -279,6 +487,7 @@ corenet_sendrecv_all_client_packets(initrc_t)
dev_read_rand(initrc_t) dev_read_rand(initrc_t)
dev_read_urand(initrc_t) dev_read_urand(initrc_t)
@ -59659,7 +59715,7 @@ index 29a9565..4d20828 100644
dev_write_kmsg(initrc_t) dev_write_kmsg(initrc_t)
dev_write_rand(initrc_t) dev_write_rand(initrc_t)
dev_write_urand(initrc_t) dev_write_urand(initrc_t)
@@ -289,8 +496,10 @@ dev_write_framebuffer(initrc_t) @@ -289,8 +498,10 @@ dev_write_framebuffer(initrc_t)
dev_read_realtime_clock(initrc_t) dev_read_realtime_clock(initrc_t)
dev_read_sound_mixer(initrc_t) dev_read_sound_mixer(initrc_t)
dev_write_sound_mixer(initrc_t) dev_write_sound_mixer(initrc_t)
@ -59670,7 +59726,7 @@ index 29a9565..4d20828 100644
dev_delete_lvm_control_dev(initrc_t) dev_delete_lvm_control_dev(initrc_t)
dev_manage_generic_symlinks(initrc_t) dev_manage_generic_symlinks(initrc_t)
dev_manage_generic_files(initrc_t) dev_manage_generic_files(initrc_t)
@@ -298,13 +507,14 @@ dev_manage_generic_files(initrc_t) @@ -298,13 +509,14 @@ dev_manage_generic_files(initrc_t)
dev_delete_generic_symlinks(initrc_t) dev_delete_generic_symlinks(initrc_t)
dev_getattr_all_blk_files(initrc_t) dev_getattr_all_blk_files(initrc_t)
dev_getattr_all_chr_files(initrc_t) dev_getattr_all_chr_files(initrc_t)
@ -59687,7 +59743,7 @@ index 29a9565..4d20828 100644
domain_sigchld_all_domains(initrc_t) domain_sigchld_all_domains(initrc_t)
domain_read_all_domains_state(initrc_t) domain_read_all_domains_state(initrc_t)
domain_getattr_all_domains(initrc_t) domain_getattr_all_domains(initrc_t)
@@ -316,6 +526,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t) @@ -316,6 +528,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
domain_dontaudit_getattr_all_tcp_sockets(initrc_t) domain_dontaudit_getattr_all_tcp_sockets(initrc_t)
domain_dontaudit_getattr_all_dgram_sockets(initrc_t) domain_dontaudit_getattr_all_dgram_sockets(initrc_t)
domain_dontaudit_getattr_all_pipes(initrc_t) domain_dontaudit_getattr_all_pipes(initrc_t)
@ -59695,7 +59751,7 @@ index 29a9565..4d20828 100644
files_getattr_all_dirs(initrc_t) files_getattr_all_dirs(initrc_t)
files_getattr_all_files(initrc_t) files_getattr_all_files(initrc_t)
@@ -323,8 +534,10 @@ files_getattr_all_symlinks(initrc_t) @@ -323,8 +536,10 @@ files_getattr_all_symlinks(initrc_t)
files_getattr_all_pipes(initrc_t) files_getattr_all_pipes(initrc_t)
files_getattr_all_sockets(initrc_t) files_getattr_all_sockets(initrc_t)
files_purge_tmp(initrc_t) files_purge_tmp(initrc_t)
@ -59707,7 +59763,7 @@ index 29a9565..4d20828 100644
files_delete_all_pids(initrc_t) files_delete_all_pids(initrc_t)
files_delete_all_pid_dirs(initrc_t) files_delete_all_pid_dirs(initrc_t)
files_read_etc_files(initrc_t) files_read_etc_files(initrc_t)
@@ -340,8 +553,12 @@ files_list_isid_type_dirs(initrc_t) @@ -340,8 +555,12 @@ files_list_isid_type_dirs(initrc_t)
files_mounton_isid_type_dirs(initrc_t) files_mounton_isid_type_dirs(initrc_t)
files_list_default(initrc_t) files_list_default(initrc_t)
files_mounton_default(initrc_t) files_mounton_default(initrc_t)
@ -59721,7 +59777,7 @@ index 29a9565..4d20828 100644
fs_list_inotifyfs(initrc_t) fs_list_inotifyfs(initrc_t)
fs_register_binary_executable_type(initrc_t) fs_register_binary_executable_type(initrc_t)
# rhgb-console writes to ramfs # rhgb-console writes to ramfs
@@ -351,6 +568,8 @@ fs_mount_all_fs(initrc_t) @@ -351,6 +570,8 @@ fs_mount_all_fs(initrc_t)
fs_unmount_all_fs(initrc_t) fs_unmount_all_fs(initrc_t)
fs_remount_all_fs(initrc_t) fs_remount_all_fs(initrc_t)
fs_getattr_all_fs(initrc_t) fs_getattr_all_fs(initrc_t)
@ -59730,7 +59786,7 @@ index 29a9565..4d20828 100644
# initrc_t needs to do a pidof which requires ptrace # initrc_t needs to do a pidof which requires ptrace
mcs_ptrace_all(initrc_t) mcs_ptrace_all(initrc_t)
@@ -363,6 +582,7 @@ mls_process_read_up(initrc_t) @@ -363,6 +584,7 @@ mls_process_read_up(initrc_t)
mls_process_write_down(initrc_t) mls_process_write_down(initrc_t)
mls_rangetrans_source(initrc_t) mls_rangetrans_source(initrc_t)
mls_fd_share_all_levels(initrc_t) mls_fd_share_all_levels(initrc_t)
@ -59738,7 +59794,7 @@ index 29a9565..4d20828 100644
selinux_get_enforce_mode(initrc_t) selinux_get_enforce_mode(initrc_t)
@@ -374,6 +594,7 @@ term_use_all_terms(initrc_t) @@ -374,6 +596,7 @@ term_use_all_terms(initrc_t)
term_reset_tty_labels(initrc_t) term_reset_tty_labels(initrc_t)
auth_rw_login_records(initrc_t) auth_rw_login_records(initrc_t)
@ -59746,7 +59802,7 @@ index 29a9565..4d20828 100644
auth_setattr_login_records(initrc_t) auth_setattr_login_records(initrc_t)
auth_rw_lastlog(initrc_t) auth_rw_lastlog(initrc_t)
auth_read_pam_pid(initrc_t) auth_read_pam_pid(initrc_t)
@@ -394,18 +615,17 @@ logging_read_audit_config(initrc_t) @@ -394,18 +617,17 @@ logging_read_audit_config(initrc_t)
miscfiles_read_localization(initrc_t) miscfiles_read_localization(initrc_t)
# slapd needs to read cert files from its initscript # slapd needs to read cert files from its initscript
@ -59768,7 +59824,7 @@ index 29a9565..4d20828 100644
ifdef(`distro_debian',` ifdef(`distro_debian',`
dev_setattr_generic_dirs(initrc_t) dev_setattr_generic_dirs(initrc_t)
@@ -458,6 +678,10 @@ ifdef(`distro_gentoo',` @@ -458,6 +680,10 @@ ifdef(`distro_gentoo',`
sysnet_setattr_config(initrc_t) sysnet_setattr_config(initrc_t)
optional_policy(` optional_policy(`
@ -59779,7 +59835,7 @@ index 29a9565..4d20828 100644
alsa_read_lib(initrc_t) alsa_read_lib(initrc_t)
') ')
@@ -478,7 +702,7 @@ ifdef(`distro_redhat',` @@ -478,7 +704,7 @@ ifdef(`distro_redhat',`
# Red Hat systems seem to have a stray # Red Hat systems seem to have a stray
# fd open from the initrd # fd open from the initrd
@ -59788,7 +59844,7 @@ index 29a9565..4d20828 100644
files_dontaudit_read_root_files(initrc_t) files_dontaudit_read_root_files(initrc_t)
# These seem to be from the initrd # These seem to be from the initrd
@@ -493,6 +717,7 @@ ifdef(`distro_redhat',` @@ -493,6 +719,7 @@ ifdef(`distro_redhat',`
files_create_boot_dirs(initrc_t) files_create_boot_dirs(initrc_t)
files_create_boot_flag(initrc_t) files_create_boot_flag(initrc_t)
files_rw_boot_symlinks(initrc_t) files_rw_boot_symlinks(initrc_t)
@ -59796,7 +59852,7 @@ index 29a9565..4d20828 100644
# wants to read /.fonts directory # wants to read /.fonts directory
files_read_default_files(initrc_t) files_read_default_files(initrc_t)
files_mountpoint(initrc_tmp_t) files_mountpoint(initrc_tmp_t)
@@ -522,8 +747,33 @@ ifdef(`distro_redhat',` @@ -522,8 +749,33 @@ ifdef(`distro_redhat',`
') ')
optional_policy(` optional_policy(`
@ -59830,7 +59886,7 @@ index 29a9565..4d20828 100644
') ')
optional_policy(` optional_policy(`
@@ -531,10 +781,26 @@ ifdef(`distro_redhat',` @@ -531,10 +783,26 @@ ifdef(`distro_redhat',`
rpc_write_exports(initrc_t) rpc_write_exports(initrc_t)
rpc_manage_nfs_state_data(initrc_t) rpc_manage_nfs_state_data(initrc_t)
') ')
@ -59857,7 +59913,7 @@ index 29a9565..4d20828 100644
') ')
optional_policy(` optional_policy(`
@@ -549,6 +815,39 @@ ifdef(`distro_suse',` @@ -549,6 +817,39 @@ ifdef(`distro_suse',`
') ')
') ')
@ -59897,7 +59953,7 @@ index 29a9565..4d20828 100644
optional_policy(` optional_policy(`
amavis_search_lib(initrc_t) amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t) amavis_setattr_pid_files(initrc_t)
@@ -561,6 +860,8 @@ optional_policy(` @@ -561,6 +862,8 @@ optional_policy(`
optional_policy(` optional_policy(`
apache_read_config(initrc_t) apache_read_config(initrc_t)
apache_list_modules(initrc_t) apache_list_modules(initrc_t)
@ -59906,7 +59962,7 @@ index 29a9565..4d20828 100644
') ')
optional_policy(` optional_policy(`
@@ -577,6 +878,7 @@ optional_policy(` @@ -577,6 +880,7 @@ optional_policy(`
optional_policy(` optional_policy(`
cgroup_stream_connect_cgred(initrc_t) cgroup_stream_connect_cgred(initrc_t)
@ -59914,7 +59970,7 @@ index 29a9565..4d20828 100644
') ')
optional_policy(` optional_policy(`
@@ -589,6 +891,11 @@ optional_policy(` @@ -589,6 +893,11 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -59926,7 +59982,7 @@ index 29a9565..4d20828 100644
dev_getattr_printer_dev(initrc_t) dev_getattr_printer_dev(initrc_t)
cups_read_log(initrc_t) cups_read_log(initrc_t)
@@ -605,9 +912,13 @@ optional_policy(` @@ -605,9 +914,13 @@ optional_policy(`
dbus_connect_system_bus(initrc_t) dbus_connect_system_bus(initrc_t)
dbus_system_bus_client(initrc_t) dbus_system_bus_client(initrc_t)
dbus_read_config(initrc_t) dbus_read_config(initrc_t)
@ -59940,7 +59996,7 @@ index 29a9565..4d20828 100644
') ')
optional_policy(` optional_policy(`
@@ -649,6 +960,11 @@ optional_policy(` @@ -649,6 +962,11 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -59952,7 +60008,7 @@ index 29a9565..4d20828 100644
inn_exec_config(initrc_t) inn_exec_config(initrc_t)
') ')
@@ -689,6 +1005,7 @@ optional_policy(` @@ -689,6 +1007,7 @@ optional_policy(`
lpd_list_spool(initrc_t) lpd_list_spool(initrc_t)
lpd_read_config(initrc_t) lpd_read_config(initrc_t)
@ -59960,7 +60016,7 @@ index 29a9565..4d20828 100644
') ')
optional_policy(` optional_policy(`
@@ -706,7 +1023,13 @@ optional_policy(` @@ -706,7 +1025,13 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -59974,7 +60030,7 @@ index 29a9565..4d20828 100644
mta_dontaudit_read_spool_symlinks(initrc_t) mta_dontaudit_read_spool_symlinks(initrc_t)
') ')
@@ -729,6 +1052,10 @@ optional_policy(` @@ -729,6 +1054,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -59985,7 +60041,7 @@ index 29a9565..4d20828 100644
postgresql_manage_db(initrc_t) postgresql_manage_db(initrc_t)
postgresql_read_config(initrc_t) postgresql_read_config(initrc_t)
') ')
@@ -738,10 +1065,20 @@ optional_policy(` @@ -738,10 +1067,20 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -60006,7 +60062,7 @@ index 29a9565..4d20828 100644
quota_manage_flags(initrc_t) quota_manage_flags(initrc_t)
') ')
@@ -750,6 +1087,10 @@ optional_policy(` @@ -750,6 +1089,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -60017,7 +60073,7 @@ index 29a9565..4d20828 100644
fs_write_ramfs_sockets(initrc_t) fs_write_ramfs_sockets(initrc_t)
fs_search_ramfs(initrc_t) fs_search_ramfs(initrc_t)
@@ -771,8 +1112,6 @@ optional_policy(` @@ -771,8 +1114,6 @@ optional_policy(`
# bash tries ioctl for some reason # bash tries ioctl for some reason
files_dontaudit_ioctl_all_pids(initrc_t) files_dontaudit_ioctl_all_pids(initrc_t)
@ -60026,7 +60082,7 @@ index 29a9565..4d20828 100644
') ')
optional_policy(` optional_policy(`
@@ -790,10 +1129,12 @@ optional_policy(` @@ -790,10 +1131,12 @@ optional_policy(`
squid_manage_logs(initrc_t) squid_manage_logs(initrc_t)
') ')
@ -60039,7 +60095,7 @@ index 29a9565..4d20828 100644
optional_policy(` optional_policy(`
ssh_dontaudit_read_server_keys(initrc_t) ssh_dontaudit_read_server_keys(initrc_t)
@@ -805,7 +1146,6 @@ optional_policy(` @@ -805,7 +1148,6 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -60047,7 +60103,7 @@ index 29a9565..4d20828 100644
udev_manage_pid_files(initrc_t) udev_manage_pid_files(initrc_t)
udev_manage_rules_files(initrc_t) udev_manage_rules_files(initrc_t)
') ')
@@ -815,11 +1155,24 @@ optional_policy(` @@ -815,11 +1157,24 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -60073,7 +60129,7 @@ index 29a9565..4d20828 100644
ifdef(`distro_redhat',` ifdef(`distro_redhat',`
# system-config-services causes avc messages that should be dontaudited # system-config-services causes avc messages that should be dontaudited
@@ -829,6 +1182,25 @@ optional_policy(` @@ -829,6 +1184,25 @@ optional_policy(`
optional_policy(` optional_policy(`
mono_domtrans(initrc_t) mono_domtrans(initrc_t)
') ')
@ -60099,7 +60155,7 @@ index 29a9565..4d20828 100644
') ')
optional_policy(` optional_policy(`
@@ -844,6 +1216,10 @@ optional_policy(` @@ -844,6 +1218,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -60110,7 +60166,7 @@ index 29a9565..4d20828 100644
# Set device ownerships/modes. # Set device ownerships/modes.
xserver_setattr_console_pipes(initrc_t) xserver_setattr_console_pipes(initrc_t)
@@ -854,3 +1230,149 @@ optional_policy(` @@ -854,3 +1232,149 @@ optional_policy(`
optional_policy(` optional_policy(`
zebra_read_config(initrc_t) zebra_read_config(initrc_t)
') ')
@ -63233,7 +63289,7 @@ index 2cc4bda..167c358 100644
+/etc/share/selinux/targeted(/.*)? gen_context(system_u:object_r:semanage_store_t,s0) +/etc/share/selinux/targeted(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
+/etc/share/selinux/mls(/.*)? gen_context(system_u:object_r:semanage_store_t,s0) +/etc/share/selinux/mls(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if
index 170e2c7..7b10445 100644 index 170e2c7..b85fc73 100644
--- a/policy/modules/system/selinuxutil.if --- a/policy/modules/system/selinuxutil.if
+++ b/policy/modules/system/selinuxutil.if +++ b/policy/modules/system/selinuxutil.if
@@ -199,6 +199,10 @@ interface(`seutil_run_newrole',` @@ -199,6 +199,10 @@ interface(`seutil_run_newrole',`
@ -63449,7 +63505,7 @@ index 170e2c7..7b10445 100644
## Full management of the semanage ## Full management of the semanage
## module store. ## module store.
## </summary> ## </summary>
@@ -1149,3 +1313,199 @@ interface(`seutil_dontaudit_libselinux_linked',` @@ -1149,3 +1313,198 @@ interface(`seutil_dontaudit_libselinux_linked',`
selinux_dontaudit_get_fs_mount($1) selinux_dontaudit_get_fs_mount($1)
seutil_dontaudit_read_config($1) seutil_dontaudit_read_config($1)
') ')
@ -63527,7 +63583,6 @@ index 170e2c7..7b10445 100644
+ seutil_get_semanage_read_lock($1) + seutil_get_semanage_read_lock($1)
+ +
+ userdom_dontaudit_write_user_home_content_files($1) + userdom_dontaudit_write_user_home_content_files($1)
+
+') +')
+ +
+ +
@ -64708,10 +64763,10 @@ index 0000000..3248032
+ +
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
new file mode 100644 new file mode 100644
index 0000000..7501ef8 index 0000000..d46fb42
--- /dev/null --- /dev/null
+++ b/policy/modules/system/systemd.if +++ b/policy/modules/system/systemd.if
@@ -0,0 +1,377 @@ @@ -0,0 +1,376 @@
+## <summary>SELinux policy for systemd components</summary> +## <summary>SELinux policy for systemd components</summary>
+ +
+####################################### +#######################################
@ -64729,17 +64784,16 @@ index 0000000..7501ef8
+ gen_require(` + gen_require(`
+ type systemd_systemctl_exec_t; + type systemd_systemctl_exec_t;
+ role system_r; + role system_r;
+ attribute systemctl_domain;
+ ') + ')
+ +
+ type $1_systemctl_t; + type $1_systemctl_t, systemctl_domain;
+ domain_type($1_systemctl_t) + domain_type($1_systemctl_t)
+ domain_entry_file($1_systemctl_t, systemd_systemctl_exec_t) + domain_entry_file($1_systemctl_t, systemd_systemctl_exec_t)
+ +
+ role system_r types $1_systemctl_t; + role system_r types $1_systemctl_t;
+ +
+ domtrans_pattern($1_t, systemd_systemctl_exec_t , $1_systemctl_t) + domtrans_pattern($1_t, systemd_systemctl_exec_t , $1_systemctl_t)
+
+ init_use_fds($1_t)
+') +')
+ +
+######################################## +########################################
@ -65091,10 +65145,10 @@ index 0000000..7501ef8
+ +
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644 new file mode 100644
index 0000000..0185280 index 0000000..d079aca
--- /dev/null --- /dev/null
+++ b/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te
@@ -0,0 +1,319 @@ @@ -0,0 +1,337 @@
+policy_module(systemd, 1.0.0) +policy_module(systemd, 1.0.0)
+ +
+####################################### +#######################################
@ -65103,6 +65157,8 @@ index 0000000..0185280
+# +#
+ +
+attribute systemd_unit_file_type; +attribute systemd_unit_file_type;
+attribute systemd_domain;
+attribute systemctl_domain;
+ +
+# New in f16 +# New in f16
+permissive systemd_logger_t; +permissive systemd_logger_t;
@ -65414,6 +65470,22 @@ index 0000000..0185280
+logging_send_syslog_msg(systemd_logger_t) +logging_send_syslog_msg(systemd_logger_t)
+ +
+miscfiles_read_localization(systemd_logger_t) +miscfiles_read_localization(systemd_logger_t)
+
+
+########################################
+#
+# systemd_sysctl domains local policy
+#
+fs_list_cgroup_dirs(systemctl_domain)
+fs_read_cgroup_files(systemctl_domain)
+
+# needed by systemctl
+init_stream_connect(systemctl_domain)
+init_read_state(systemctl_domain)
+init_list_pid_dirs(systemctl_domain)
+init_use_fds(systemctl_domain)
+
+miscfiles_read_localization(systemctl_domain)
diff --git a/policy/modules/system/udev.fc b/policy/modules/system/udev.fc diff --git a/policy/modules/system/udev.fc b/policy/modules/system/udev.fc
index 0291685..7e94f4b 100644 index 0291685..7e94f4b 100644
--- a/policy/modules/system/udev.fc --- a/policy/modules/system/udev.fc

10
selinux-policy.spec
View File

@ -17,7 +17,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.10.0 Version: 3.10.0
Release: 14%{?dist} Release: 16%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -452,6 +452,14 @@ SELinux Reference policy mls base module.
%endif %endif
%changelog %changelog
* Thu Aug 4 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-16
- fetchmail can use kerberos
- ksmtuned reads in shell programs
- gnome_systemctl_t reads the process state of ntp
- dnsmasq_t asks the kernel to load multiple kernel modules
- Add rules for domains executing systemctl
- Bogus text within fc file
* Wed Aug 3 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-14 * Wed Aug 3 2011 Miroslav Grepl <mgrepl@redhat.com> 3.10.0-14
- Add cfengine policy - Add cfengine policy