rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Allow amanada to create data files

This commit is contained in:
Daniel J Walsh 2008-05-07 19:10:59 +00:00
parent da67f18558
commit 993c27dacb
2 changed files with 218 additions and 157 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

358
policy-20071130.patch
View File

@ -1399,6 +1399,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-3.3.1
# #
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.te serefpolicy-3.3.1/policy/modules/admin/amanda.te
--- nsaserefpolicy/policy/modules/admin/amanda.te 2008-02-26 08:23:10.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/admin/amanda.te 2008-05-07 13:40:42.000000000 -0400
@@ -82,8 +82,7 @@
allow amanda_t amanda_config_t:file { getattr read };
# access to amandas data structure
-allow amanda_t amanda_data_t:dir { read search write };
-allow amanda_t amanda_data_t:file manage_file_perms;
+manage_files_pattern(amanda_t, amanda_data_t, amanda_data_t)
# access to amanda_dumpdates_t
allow amanda_t amanda_dumpdates_t:file { getattr lock read write };
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.3.1/policy/modules/admin/anaconda.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.3.1/policy/modules/admin/anaconda.te
--- nsaserefpolicy/policy/modules/admin/anaconda.te 2008-02-26 08:23:10.000000000 -0500 --- nsaserefpolicy/policy/modules/admin/anaconda.te 2008-02-26 08:23:10.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/admin/anaconda.te 2008-05-06 14:02:43.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/admin/anaconda.te 2008-05-06 14:02:43.000000000 -0400
@ -5711,8 +5724,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.te serefpolicy-3.3.1/policy/modules/apps/nsplugin.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.te serefpolicy-3.3.1/policy/modules/apps/nsplugin.te
--- nsaserefpolicy/policy/modules/apps/nsplugin.te 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/apps/nsplugin.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/apps/nsplugin.te 2008-05-06 14:02:43.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/apps/nsplugin.te 2008-05-07 10:42:53.000000000 -0400
@@ -0,0 +1,198 @@ @@ -0,0 +1,201 @@
+ +
+policy_module(nsplugin,1.0.0) +policy_module(nsplugin,1.0.0)
+ +
@ -5788,6 +5801,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin
+dev_read_rand(nsplugin_t) +dev_read_rand(nsplugin_t)
+dev_read_sound(nsplugin_t) +dev_read_sound(nsplugin_t)
+dev_write_sound(nsplugin_t) +dev_write_sound(nsplugin_t)
+dev_read_video_dev(nsplugin_t)
+dev_write_video_dev(nsplugin_t)
+ +
+kernel_read_kernel_sysctls(nsplugin_t) +kernel_read_kernel_sysctls(nsplugin_t)
+kernel_read_system_state(nsplugin_t) +kernel_read_system_state(nsplugin_t)
@ -5824,6 +5839,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin
+userdom_manage_user_tmp_sockets(user,nsplugin_t) +userdom_manage_user_tmp_sockets(user,nsplugin_t)
+userdom_tmp_filetrans_user_tmp(user,nsplugin_t, { file dir sock_file }) +userdom_tmp_filetrans_user_tmp(user,nsplugin_t, { file dir sock_file })
+userdom_read_user_tmpfs_files(user,nsplugin_t) +userdom_read_user_tmpfs_files(user,nsplugin_t)
+userdom_rw_unpriv_user_semaphores(nsplugin_t)
+ +
+userdom_read_user_home_content_symlinks(user, nsplugin_t) +userdom_read_user_home_content_symlinks(user, nsplugin_t)
+userdom_read_user_home_content_files(user, nsplugin_t) +userdom_read_user_home_content_files(user, nsplugin_t)
@ -7098,7 +7114,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device
+ +
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.3.1/policy/modules/kernel/devices.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.3.1/policy/modules/kernel/devices.if
--- nsaserefpolicy/policy/modules/kernel/devices.if 2008-02-26 08:23:12.000000000 -0500 --- nsaserefpolicy/policy/modules/kernel/devices.if 2008-02-26 08:23:12.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/kernel/devices.if 2008-05-06 14:08:38.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/kernel/devices.if 2008-05-07 10:37:38.000000000 -0400
@@ -65,7 +65,7 @@ @@ -65,7 +65,7 @@
relabelfrom_dirs_pattern($1,device_t,device_node) relabelfrom_dirs_pattern($1,device_t,device_node)
@ -8822,7 +8838,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav
+ +
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.3.1/policy/modules/services/amavis.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.3.1/policy/modules/services/amavis.te
--- nsaserefpolicy/policy/modules/services/amavis.te 2008-02-26 08:23:10.000000000 -0500 --- nsaserefpolicy/policy/modules/services/amavis.te 2008-02-26 08:23:10.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/services/amavis.te 2008-05-06 14:02:43.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/services/amavis.te 2008-05-07 06:38:24.000000000 -0400
@@ -13,7 +13,7 @@ @@ -13,7 +13,7 @@
# configuration files # configuration files
@ -9496,7 +9512,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.3.1/policy/modules/services/apache.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.3.1/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2008-02-26 08:23:10.000000000 -0500 --- nsaserefpolicy/policy/modules/services/apache.te 2008-02-26 08:23:10.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/services/apache.te 2008-05-06 16:40:13.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/services/apache.te 2008-05-07 14:22:10.000000000 -0400
@@ -20,6 +20,8 @@ @@ -20,6 +20,8 @@
# Declarations # Declarations
# #
@ -19633,7 +19649,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
# Local Policy # Local Policy
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.3.1/policy/modules/services/postfix.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.3.1/policy/modules/services/postfix.te
--- nsaserefpolicy/policy/modules/services/postfix.te 2008-02-26 08:23:10.000000000 -0500 --- nsaserefpolicy/policy/modules/services/postfix.te 2008-02-26 08:23:10.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/services/postfix.te 2008-05-06 14:02:43.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/services/postfix.te 2008-05-07 06:40:55.000000000 -0400
@@ -6,6 +6,14 @@ @@ -6,6 +6,14 @@
# Declarations # Declarations
# #
@ -19677,7 +19693,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
type postfix_map_tmp_t; type postfix_map_tmp_t;
files_tmp_file(postfix_map_tmp_t) files_tmp_file(postfix_map_tmp_t)
@@ -99,6 +112,7 @@ @@ -80,6 +93,9 @@
type postfix_public_t;
files_type(postfix_public_t)
+type postfix_var_lib_t;
+files_type(postfix_var_lib_t)
+
type postfix_var_run_t;
files_pid_file(postfix_var_run_t)
@@ -99,6 +115,7 @@
allow postfix_master_t self:fifo_file rw_fifo_file_perms; allow postfix_master_t self:fifo_file rw_fifo_file_perms;
allow postfix_master_t self:tcp_socket create_stream_socket_perms; allow postfix_master_t self:tcp_socket create_stream_socket_perms;
allow postfix_master_t self:udp_socket create_socket_perms; allow postfix_master_t self:udp_socket create_socket_perms;
@ -19685,7 +19711,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
allow postfix_master_t postfix_etc_t:file rw_file_perms; allow postfix_master_t postfix_etc_t:file rw_file_perms;
@@ -174,6 +188,7 @@ @@ -122,6 +139,10 @@
domtrans_pattern(postfix_master_t, postfix_showq_exec_t, postfix_showq_t)
+manage_dirs_pattern(postfix_master_t,postfix_var_lib_t,postfix_var_lib_t)
+manage_files_pattern(postfix_master_t,postfix_var_lib_t,postfix_var_lib_t)
+files_search_var_lib(postfix_master_t)
+
# allow access to deferred queue and allow removing bogus incoming entries
manage_dirs_pattern(postfix_master_t,postfix_spool_t,postfix_spool_t)
manage_files_pattern(postfix_master_t,postfix_spool_t,postfix_spool_t)
@@ -174,6 +195,7 @@
mta_rw_aliases(postfix_master_t) mta_rw_aliases(postfix_master_t)
mta_read_sendmail_bin(postfix_master_t) mta_read_sendmail_bin(postfix_master_t)
@ -19693,7 +19730,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
optional_policy(` optional_policy(`
cyrus_stream_connect(postfix_master_t) cyrus_stream_connect(postfix_master_t)
@@ -248,6 +263,10 @@ @@ -248,6 +270,10 @@
corecmd_exec_bin(postfix_cleanup_t) corecmd_exec_bin(postfix_cleanup_t)
@ -19704,7 +19741,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
######################################## ########################################
# #
# Postfix local local policy # Postfix local local policy
@@ -273,18 +292,25 @@ @@ -273,18 +299,25 @@
files_read_etc_files(postfix_local_t) files_read_etc_files(postfix_local_t)
@ -19730,7 +19767,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
') ')
optional_policy(` optional_policy(`
@@ -295,8 +321,7 @@ @@ -295,8 +328,7 @@
# #
# Postfix map local policy # Postfix map local policy
# #
@ -19740,7 +19777,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
allow postfix_map_t self:unix_stream_socket create_stream_socket_perms; allow postfix_map_t self:unix_stream_socket create_stream_socket_perms;
allow postfix_map_t self:unix_dgram_socket create_socket_perms; allow postfix_map_t self:unix_dgram_socket create_socket_perms;
allow postfix_map_t self:tcp_socket create_stream_socket_perms; allow postfix_map_t self:tcp_socket create_stream_socket_perms;
@@ -346,8 +371,6 @@ @@ -346,8 +378,6 @@
miscfiles_read_localization(postfix_map_t) miscfiles_read_localization(postfix_map_t)
@ -19749,7 +19786,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
tunable_policy(`read_default_t',` tunable_policy(`read_default_t',`
files_list_default(postfix_map_t) files_list_default(postfix_map_t)
files_read_default_files(postfix_map_t) files_read_default_files(postfix_map_t)
@@ -360,6 +383,11 @@ @@ -360,6 +390,11 @@
locallogin_dontaudit_use_fds(postfix_map_t) locallogin_dontaudit_use_fds(postfix_map_t)
') ')
@ -19761,7 +19798,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
######################################## ########################################
# #
# Postfix pickup local policy # Postfix pickup local policy
@@ -384,6 +412,7 @@ @@ -384,6 +419,7 @@
# #
allow postfix_pipe_t self:fifo_file rw_fifo_file_perms; allow postfix_pipe_t self:fifo_file rw_fifo_file_perms;
@ -19769,7 +19806,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
write_sock_files_pattern(postfix_pipe_t,postfix_private_t,postfix_private_t) write_sock_files_pattern(postfix_pipe_t,postfix_private_t,postfix_private_t)
@@ -391,6 +420,12 @@ @@ -391,6 +427,12 @@
rw_files_pattern(postfix_pipe_t,postfix_spool_t,postfix_spool_t) rw_files_pattern(postfix_pipe_t,postfix_spool_t,postfix_spool_t)
@ -19782,7 +19819,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
optional_policy(` optional_policy(`
procmail_domtrans(postfix_pipe_t) procmail_domtrans(postfix_pipe_t)
') ')
@@ -400,6 +435,10 @@ @@ -400,6 +442,10 @@
') ')
optional_policy(` optional_policy(`
@ -19793,7 +19830,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
uucp_domtrans_uux(postfix_pipe_t) uucp_domtrans_uux(postfix_pipe_t)
') ')
@@ -532,9 +571,6 @@ @@ -532,9 +578,6 @@
# connect to master process # connect to master process
stream_connect_pattern(postfix_smtpd_t,{ postfix_private_t postfix_public_t },{ postfix_private_t postfix_public_t },postfix_master_t) stream_connect_pattern(postfix_smtpd_t,{ postfix_private_t postfix_public_t },{ postfix_private_t postfix_public_t },postfix_master_t)
@ -19803,7 +19840,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
# for prng_exch # for prng_exch
allow postfix_smtpd_t postfix_spool_t:file rw_file_perms; allow postfix_smtpd_t postfix_spool_t:file rw_file_perms;
allow postfix_smtpd_t postfix_prng_t:file rw_file_perms; allow postfix_smtpd_t postfix_prng_t:file rw_file_perms;
@@ -557,6 +593,10 @@ @@ -557,6 +600,10 @@
sasl_connect(postfix_smtpd_t) sasl_connect(postfix_smtpd_t)
') ')
@ -19814,7 +19851,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post
######################################## ########################################
# #
# Postfix virtual local policy # Postfix virtual local policy
@@ -572,7 +612,7 @@ @@ -572,7 +619,7 @@
files_tmp_filetrans(postfix_virtual_t, postfix_virtual_tmp_t, { file dir }) files_tmp_filetrans(postfix_virtual_t, postfix_virtual_tmp_t, { file dir })
# connect to master process # connect to master process
@ -27877,7 +27914,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.3.1/policy/modules/system/authlogin.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.3.1/policy/modules/system/authlogin.te
--- nsaserefpolicy/policy/modules/system/authlogin.te 2008-02-26 08:23:09.000000000 -0500 --- nsaserefpolicy/policy/modules/system/authlogin.te 2008-02-26 08:23:09.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/system/authlogin.te 2008-05-06 14:02:43.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/system/authlogin.te 2008-05-07 14:02:18.000000000 -0400
@@ -59,6 +59,9 @@ @@ -59,6 +59,9 @@
type utempter_exec_t; type utempter_exec_t;
application_domain(utempter_t,utempter_exec_t) application_domain(utempter_t,utempter_exec_t)
@ -28089,7 +28126,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.f
- -
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.3.1/policy/modules/system/init.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.3.1/policy/modules/system/init.if
--- nsaserefpolicy/policy/modules/system/init.if 2008-02-26 08:23:09.000000000 -0500 --- nsaserefpolicy/policy/modules/system/init.if 2008-02-26 08:23:09.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/system/init.if 2008-05-06 14:02:43.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/system/init.if 2008-05-07 10:57:02.000000000 -0400
@@ -211,6 +211,13 @@ @@ -211,6 +211,13 @@
kernel_dontaudit_use_fds($1) kernel_dontaudit_use_fds($1)
') ')
@ -28756,7 +28793,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
+ +
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.3.1/policy/modules/system/iptables.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.3.1/policy/modules/system/iptables.te
--- nsaserefpolicy/policy/modules/system/iptables.te 2008-02-26 08:23:09.000000000 -0500 --- nsaserefpolicy/policy/modules/system/iptables.te 2008-02-26 08:23:09.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/system/iptables.te 2008-05-06 14:02:43.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/system/iptables.te 2008-05-07 08:53:39.000000000 -0400
@@ -48,6 +48,7 @@ @@ -48,6 +48,7 @@
fs_getattr_xattr_fs(iptables_t) fs_getattr_xattr_fs(iptables_t)
@ -28765,6 +28802,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl
mls_file_read_all_levels(iptables_t) mls_file_read_all_levels(iptables_t)
@@ -113,3 +114,7 @@
optional_policy(`
udev_read_db(iptables_t)
')
+
+optional_policy(`
+ unconfined_rw_stream_sockets(iptables_t)
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.3.1/policy/modules/system/iscsi.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.3.1/policy/modules/system/iscsi.te
--- nsaserefpolicy/policy/modules/system/iscsi.te 2008-02-26 08:23:09.000000000 -0500 --- nsaserefpolicy/policy/modules/system/iscsi.te 2008-02-26 08:23:09.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/system/iscsi.te 2008-05-06 14:02:43.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/system/iscsi.te 2008-05-06 14:02:43.000000000 -0400
@ -28982,7 +29027,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall
-') -')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.3.1/policy/modules/system/logging.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.3.1/policy/modules/system/logging.fc
--- nsaserefpolicy/policy/modules/system/logging.fc 2008-02-26 08:23:09.000000000 -0500 --- nsaserefpolicy/policy/modules/system/logging.fc 2008-02-26 08:23:09.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/system/logging.fc 2008-05-06 14:02:43.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/system/logging.fc 2008-05-07 14:09:20.000000000 -0400
@@ -4,6 +4,8 @@ @@ -4,6 +4,8 @@
/etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) /etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
/etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh) /etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh)
@ -28992,7 +29037,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
/sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0) /sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0)
/sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0) /sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0)
/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0) /sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
@@ -46,7 +48,7 @@ @@ -36,6 +38,7 @@
/var/log/spooler[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
/var/log/audit(/.*)? gen_context(system_u:object_r:auditd_log_t,mls_systemhigh)
/var/log/syslog-ng(/.*)? -- gen_context(system_u:object_r:syslogd_var_run_t,s0)
+/var/lib/syslog-ng(/.*)? -- gen_context(system_u:object_r:syslogd_var_lib_t,s0)
ifndef(`distro_gentoo',`
/var/log/audit\.log -- gen_context(system_u:object_r:auditd_log_t,mls_systemhigh)
@@ -46,7 +49,7 @@
') ')
/var/run/audit_events -s gen_context(system_u:object_r:auditd_var_run_t,s0) /var/run/audit_events -s gen_context(system_u:object_r:auditd_var_run_t,s0)
@ -29001,7 +29054,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
/var/run/auditd\.pid -- gen_context(system_u:object_r:auditd_var_run_t,s0) /var/run/auditd\.pid -- gen_context(system_u:object_r:auditd_var_run_t,s0)
/var/run/auditd_sock -s gen_context(system_u:object_r:auditd_var_run_t,s0) /var/run/auditd_sock -s gen_context(system_u:object_r:auditd_var_run_t,s0)
/var/run/klogd\.pid -- gen_context(system_u:object_r:klogd_var_run_t,s0) /var/run/klogd\.pid -- gen_context(system_u:object_r:klogd_var_run_t,s0)
@@ -57,3 +59,8 @@ @@ -57,3 +60,8 @@
/var/spool/postfix/pid -d gen_context(system_u:object_r:var_run_t,s0) /var/spool/postfix/pid -d gen_context(system_u:object_r:var_run_t,s0)
/var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0) /var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
@ -30525,7 +30578,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.3.1/policy/modules/system/selinuxutil.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.3.1/policy/modules/system/selinuxutil.if
--- nsaserefpolicy/policy/modules/system/selinuxutil.if 2008-02-26 08:23:09.000000000 -0500 --- nsaserefpolicy/policy/modules/system/selinuxutil.if 2008-02-26 08:23:09.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/system/selinuxutil.if 2008-05-06 14:02:43.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/system/selinuxutil.if 2008-05-07 10:50:23.000000000 -0400
@@ -215,8 +215,6 @@ @@ -215,8 +215,6 @@
seutil_domtrans_newrole($1) seutil_domtrans_newrole($1)
role $2 types newrole_t; role $2 types newrole_t;
@ -30666,7 +30719,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
## Full management of the semanage ## Full management of the semanage
## module store. ## module store.
## </summary> ## </summary>
@@ -1141,3 +1215,140 @@ @@ -1141,3 +1215,141 @@
selinux_dontaudit_get_fs_mount($1) selinux_dontaudit_get_fs_mount($1)
seutil_dontaudit_read_config($1) seutil_dontaudit_read_config($1)
') ')
@ -30772,6 +30825,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
+ files_read_usr_files($1) + files_read_usr_files($1)
+ files_list_pids($1) + files_list_pids($1)
+ fs_list_inotifyfs($1) + fs_list_inotifyfs($1)
+ fs_getattr_all_fs($1)
+ +
+ mls_file_write_all_levels($1) + mls_file_write_all_levels($1)
+ mls_file_read_all_levels($1) + mls_file_read_all_levels($1)
@ -31097,6 +31151,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/setran
selinux_compute_access_vector(setrans_t) selinux_compute_access_vector(setrans_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.fc serefpolicy-3.3.1/policy/modules/system/sysnetwork.fc
--- nsaserefpolicy/policy/modules/system/sysnetwork.fc 2008-02-26 08:23:10.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/system/sysnetwork.fc 2008-05-07 10:59:24.000000000 -0400
@@ -57,3 +57,5 @@
ifdef(`distro_gentoo',`
/var/lib/dhcpc(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0)
')
+
+/etc/firestarter/firestarter\.sh gen_context(system_u:object_r:dhcpc_helper_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.3.1/policy/modules/system/sysnetwork.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.3.1/policy/modules/system/sysnetwork.if
--- nsaserefpolicy/policy/modules/system/sysnetwork.if 2008-02-26 08:23:09.000000000 -0500 --- nsaserefpolicy/policy/modules/system/sysnetwork.if 2008-02-26 08:23:09.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/system/sysnetwork.if 2008-05-06 14:02:43.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/system/sysnetwork.if 2008-05-06 14:02:43.000000000 -0400
@ -31198,8 +31261,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.3.1/policy/modules/system/sysnetwork.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.3.1/policy/modules/system/sysnetwork.te
--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2008-02-26 08:23:09.000000000 -0500 --- nsaserefpolicy/policy/modules/system/sysnetwork.te 2008-02-26 08:23:09.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/system/sysnetwork.te 2008-05-06 14:02:43.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/system/sysnetwork.te 2008-05-07 10:58:33.000000000 -0400
@@ -45,7 +45,7 @@ @@ -20,6 +20,10 @@
init_daemon_domain(dhcpc_t,dhcpc_exec_t)
role system_r types dhcpc_t;
+type dhcpc_helper_exec_t;
+domain_entry_file(dhcpc_helper_exec_t)
+init_script_domtrans_spec(dhcpc_t, dhcpc_helper_exec_t)
+
type dhcpc_state_t;
files_type(dhcpc_state_t)
@@ -45,7 +49,7 @@
dontaudit dhcpc_t self:capability sys_tty_config; dontaudit dhcpc_t self:capability sys_tty_config;
# for access("/etc/bashrc", X_OK) on Red Hat # for access("/etc/bashrc", X_OK) on Red Hat
dontaudit dhcpc_t self:capability { dac_read_search sys_module }; dontaudit dhcpc_t self:capability { dac_read_search sys_module };
@ -31208,7 +31282,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
allow dhcpc_t self:fifo_file rw_file_perms; allow dhcpc_t self:fifo_file rw_file_perms;
allow dhcpc_t self:tcp_socket create_stream_socket_perms; allow dhcpc_t self:tcp_socket create_stream_socket_perms;
allow dhcpc_t self:udp_socket create_socket_perms; allow dhcpc_t self:udp_socket create_socket_perms;
@@ -123,7 +123,7 @@ @@ -123,7 +127,7 @@
files_read_etc_runtime_files(dhcpc_t) files_read_etc_runtime_files(dhcpc_t)
files_search_home(dhcpc_t) files_search_home(dhcpc_t)
files_search_var_lib(dhcpc_t) files_search_var_lib(dhcpc_t)
@ -31217,7 +31291,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
init_rw_utmp(dhcpc_t) init_rw_utmp(dhcpc_t)
@@ -136,6 +136,7 @@ @@ -136,6 +140,7 @@
modutils_domtrans_insmod(dhcpc_t) modutils_domtrans_insmod(dhcpc_t)
@ -31225,7 +31299,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
userdom_dontaudit_search_staff_home_dirs(dhcpc_t) userdom_dontaudit_search_staff_home_dirs(dhcpc_t)
ifdef(`distro_redhat', ` ifdef(`distro_redhat', `
@@ -153,11 +154,19 @@ @@ -153,11 +158,19 @@
') ')
optional_policy(` optional_policy(`
@ -31245,7 +31319,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
optional_policy(` optional_policy(`
networkmanager_dbus_chat(dhcpc_t) networkmanager_dbus_chat(dhcpc_t)
') ')
@@ -186,6 +195,10 @@ @@ -186,6 +199,10 @@
') ')
optional_policy(` optional_policy(`
@ -31256,7 +31330,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
nis_use_ypbind(dhcpc_t) nis_use_ypbind(dhcpc_t)
nis_signal_ypbind(dhcpc_t) nis_signal_ypbind(dhcpc_t)
nis_read_ypbind_pid(dhcpc_t) nis_read_ypbind_pid(dhcpc_t)
@@ -202,9 +215,7 @@ @@ -202,9 +219,7 @@
') ')
optional_policy(` optional_policy(`
@ -31267,7 +31341,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
') ')
optional_policy(` optional_policy(`
@@ -215,6 +226,7 @@ @@ -215,6 +230,7 @@
optional_policy(` optional_policy(`
seutil_sigchld_newrole(dhcpc_t) seutil_sigchld_newrole(dhcpc_t)
seutil_dontaudit_search_config(dhcpc_t) seutil_dontaudit_search_config(dhcpc_t)
@ -31275,7 +31349,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
') ')
optional_policy(` optional_policy(`
@@ -226,6 +238,10 @@ @@ -226,6 +242,10 @@
') ')
optional_policy(` optional_policy(`
@ -31286,7 +31360,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
kernel_read_xen_state(dhcpc_t) kernel_read_xen_state(dhcpc_t)
kernel_write_xen_state(dhcpc_t) kernel_write_xen_state(dhcpc_t)
xen_append_log(dhcpc_t) xen_append_log(dhcpc_t)
@@ -239,7 +255,6 @@ @@ -239,7 +259,6 @@
allow ifconfig_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack }; allow ifconfig_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack };
allow ifconfig_t self:capability { net_raw net_admin sys_tty_config }; allow ifconfig_t self:capability { net_raw net_admin sys_tty_config };
@ -31294,7 +31368,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
allow ifconfig_t self:fd use; allow ifconfig_t self:fd use;
allow ifconfig_t self:fifo_file rw_fifo_file_perms; allow ifconfig_t self:fifo_file rw_fifo_file_perms;
@@ -253,6 +268,7 @@ @@ -253,6 +272,7 @@
allow ifconfig_t self:sem create_sem_perms; allow ifconfig_t self:sem create_sem_perms;
allow ifconfig_t self:msgq create_msgq_perms; allow ifconfig_t self:msgq create_msgq_perms;
allow ifconfig_t self:msg { send receive }; allow ifconfig_t self:msg { send receive };
@ -31302,7 +31376,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
# Create UDP sockets, necessary when called from dhcpc # Create UDP sockets, necessary when called from dhcpc
allow ifconfig_t self:udp_socket create_socket_perms; allow ifconfig_t self:udp_socket create_socket_perms;
@@ -268,7 +284,10 @@ @@ -268,7 +288,10 @@
kernel_read_system_state(ifconfig_t) kernel_read_system_state(ifconfig_t)
kernel_read_network_state(ifconfig_t) kernel_read_network_state(ifconfig_t)
kernel_search_network_sysctl(ifconfig_t) kernel_search_network_sysctl(ifconfig_t)
@ -31313,7 +31387,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
corenet_rw_tun_tap_dev(ifconfig_t) corenet_rw_tun_tap_dev(ifconfig_t)
@@ -279,8 +298,11 @@ @@ -279,8 +302,11 @@
fs_getattr_xattr_fs(ifconfig_t) fs_getattr_xattr_fs(ifconfig_t)
fs_search_auto_mountpoints(ifconfig_t) fs_search_auto_mountpoints(ifconfig_t)
@ -31325,7 +31399,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
domain_use_interactive_fds(ifconfig_t) domain_use_interactive_fds(ifconfig_t)
@@ -308,7 +330,7 @@ @@ -308,7 +334,7 @@
unconfined_domain(ifconfig_t) unconfined_domain(ifconfig_t)
') ')
') ')
@ -31334,7 +31408,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
ifdef(`hide_broken_symptoms',` ifdef(`hide_broken_symptoms',`
optional_policy(` optional_policy(`
dev_dontaudit_rw_cardmgr(ifconfig_t) dev_dontaudit_rw_cardmgr(ifconfig_t)
@@ -332,6 +354,14 @@ @@ -332,6 +358,14 @@
') ')
optional_policy(` optional_policy(`
@ -32179,7 +32253,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+/root(/.*)? gen_context(system_u:object_r:admin_home_t,s0) +/root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.3.1/policy/modules/system/userdomain.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.3.1/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2008-02-26 08:23:09.000000000 -0500 --- nsaserefpolicy/policy/modules/system/userdomain.if 2008-02-26 08:23:09.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/system/userdomain.if 2008-05-06 14:02:43.000000000 -0400 +++ serefpolicy-3.3.1/policy/modules/system/userdomain.if 2008-05-07 10:42:29.000000000 -0400
@@ -29,9 +29,14 @@ @@ -29,9 +29,14 @@
') ')
@ -34151,7 +34225,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## </summary> ## </summary>
## </param> ## </param>
# #
@@ -4231,11 +4404,11 @@ @@ -3962,6 +4135,24 @@
########################################
## <summary>
+## RW unpriviledged user SysV sempaphores.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`userdom_rw_unpriv_user_semaphores',`
+ gen_require(`
+ attribute unpriv_userdomain;
+ ')
+
+ allow $1 unpriv_userdomain:sem rw_sem_perms;
+')
+
+########################################
+## <summary>
## Manage unpriviledged user SysV shared
## memory segments.
## </summary>
@@ -4231,11 +4422,11 @@
# #
interface(`userdom_search_staff_home_dirs',` interface(`userdom_search_staff_home_dirs',`
gen_require(` gen_require(`
@ -34165,7 +34264,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4251,10 +4424,10 @@ @@ -4251,10 +4442,10 @@
# #
interface(`userdom_dontaudit_search_staff_home_dirs',` interface(`userdom_dontaudit_search_staff_home_dirs',`
gen_require(` gen_require(`
@ -34178,7 +34277,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4270,11 +4443,11 @@ @@ -4270,11 +4461,11 @@
# #
interface(`userdom_manage_staff_home_dirs',` interface(`userdom_manage_staff_home_dirs',`
gen_require(` gen_require(`
@ -34192,7 +34291,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4289,16 +4462,16 @@ @@ -4289,16 +4480,16 @@
# #
interface(`userdom_relabelto_staff_home_dirs',` interface(`userdom_relabelto_staff_home_dirs',`
gen_require(` gen_require(`
@ -34212,7 +34311,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## users home directory. ## users home directory.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -4307,12 +4480,35 @@ @@ -4307,12 +4498,35 @@
## </summary> ## </summary>
## </param> ## </param>
# #
@ -34251,7 +34350,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4327,13 +4523,13 @@ @@ -4327,13 +4541,13 @@
# #
interface(`userdom_read_staff_home_content_files',` interface(`userdom_read_staff_home_content_files',`
gen_require(` gen_require(`
@ -34269,7 +34368,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4531,10 +4727,10 @@ @@ -4531,10 +4745,10 @@
# #
interface(`userdom_getattr_sysadm_home_dirs',` interface(`userdom_getattr_sysadm_home_dirs',`
gen_require(` gen_require(`
@ -34282,7 +34381,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4551,10 +4747,10 @@ @@ -4551,10 +4765,10 @@
# #
interface(`userdom_dontaudit_getattr_sysadm_home_dirs',` interface(`userdom_dontaudit_getattr_sysadm_home_dirs',`
gen_require(` gen_require(`
@ -34295,7 +34394,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4569,10 +4765,10 @@ @@ -4569,10 +4783,10 @@
# #
interface(`userdom_search_sysadm_home_dirs',` interface(`userdom_search_sysadm_home_dirs',`
gen_require(` gen_require(`
@ -34308,7 +34407,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4588,10 +4784,10 @@ @@ -4588,10 +4802,10 @@
# #
interface(`userdom_dontaudit_search_sysadm_home_dirs',` interface(`userdom_dontaudit_search_sysadm_home_dirs',`
gen_require(` gen_require(`
@ -34321,7 +34420,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4606,10 +4802,10 @@ @@ -4606,10 +4820,10 @@
# #
interface(`userdom_list_sysadm_home_dirs',` interface(`userdom_list_sysadm_home_dirs',`
gen_require(` gen_require(`
@ -34334,7 +34433,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4625,10 +4821,10 @@ @@ -4625,10 +4839,10 @@
# #
interface(`userdom_dontaudit_list_sysadm_home_dirs',` interface(`userdom_dontaudit_list_sysadm_home_dirs',`
gen_require(` gen_require(`
@ -34347,7 +34446,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4644,12 +4840,11 @@ @@ -4644,12 +4858,11 @@
# #
interface(`userdom_dontaudit_read_sysadm_home_content_files',` interface(`userdom_dontaudit_read_sysadm_home_content_files',`
gen_require(` gen_require(`
@ -34363,7 +34462,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4676,10 +4871,10 @@ @@ -4676,10 +4889,10 @@
# #
interface(`userdom_sysadm_home_dir_filetrans',` interface(`userdom_sysadm_home_dir_filetrans',`
gen_require(` gen_require(`
@ -34376,7 +34475,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4694,10 +4889,10 @@ @@ -4694,10 +4907,10 @@
# #
interface(`userdom_search_sysadm_home_content_dirs',` interface(`userdom_search_sysadm_home_content_dirs',`
gen_require(` gen_require(`
@ -34389,7 +34488,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4712,13 +4907,13 @@ @@ -4712,13 +4925,13 @@
# #
interface(`userdom_read_sysadm_home_content_files',` interface(`userdom_read_sysadm_home_content_files',`
gen_require(` gen_require(`
@ -34407,7 +34506,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4754,11 +4949,49 @@ @@ -4754,11 +4967,49 @@
# #
interface(`userdom_search_all_users_home_dirs',` interface(`userdom_search_all_users_home_dirs',`
gen_require(` gen_require(`
@ -34458,7 +34557,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4778,6 +5011,14 @@ @@ -4778,6 +5029,14 @@
files_list_home($1) files_list_home($1)
allow $1 home_dir_type:dir list_dir_perms; allow $1 home_dir_type:dir list_dir_perms;
@ -34473,7 +34572,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
######################################## ########################################
@@ -4839,6 +5080,26 @@ @@ -4839,6 +5098,26 @@
######################################## ########################################
## <summary> ## <summary>
@ -34500,7 +34599,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## Create, read, write, and delete all directories ## Create, read, write, and delete all directories
## in all users home directories. ## in all users home directories.
## </summary> ## </summary>
@@ -4859,6 +5120,25 @@ @@ -4859,6 +5138,25 @@
######################################## ########################################
## <summary> ## <summary>
@ -34526,7 +34625,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## Create, read, write, and delete all files ## Create, read, write, and delete all files
## in all users home directories. ## in all users home directories.
## </summary> ## </summary>
@@ -4879,6 +5159,26 @@ @@ -4879,6 +5177,26 @@
######################################## ########################################
## <summary> ## <summary>
@ -34553,7 +34652,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## Create, read, write, and delete all symlinks ## Create, read, write, and delete all symlinks
## in all users home directories. ## in all users home directories.
## </summary> ## </summary>
@@ -5115,7 +5415,7 @@ @@ -5115,7 +5433,7 @@
# #
interface(`userdom_relabelto_generic_user_home_dirs',` interface(`userdom_relabelto_generic_user_home_dirs',`
gen_require(` gen_require(`
@ -34562,7 +34661,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
') ')
files_search_home($1) files_search_home($1)
@@ -5304,6 +5604,63 @@ @@ -5304,6 +5622,63 @@
######################################## ########################################
## <summary> ## <summary>
@ -34626,7 +34725,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## Create, read, write, and delete directories in ## Create, read, write, and delete directories in
## unprivileged users home directories. ## unprivileged users home directories.
## </summary> ## </summary>
@@ -5509,7 +5866,7 @@ @@ -5509,7 +5884,7 @@
######################################## ########################################
## <summary> ## <summary>
@ -34635,7 +34734,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -5517,18 +5874,17 @@ @@ -5517,12 +5892,48 @@
## </summary> ## </summary>
## </param> ## </param>
# #
@ -34648,102 +34747,55 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
- allow $1 user_ttynode:chr_file rw_term_perms; - allow $1 user_ttynode:chr_file rw_term_perms;
+ manage_files_pattern($1, user_tmp_t, user_tmp_t) + manage_files_pattern($1, user_tmp_t, user_tmp_t)
') +')
+
######################################## +########################################
## <summary> +## <summary>
-## Do not audit attempts to use unprivileged
-## user ttys.
+## Write all unprivileged users lnk_files in /tmp +## Write all unprivileged users lnk_files in /tmp
## </summary> +## </summary>
## <param name="domain"> +## <param name="domain">
## <summary> +## <summary>
@@ -5536,17 +5892,17 @@ +## Domain allowed access.
## </summary> +## </summary>
## </param> +## </param>
# +#
-interface(`userdom_dontaudit_use_unpriv_users_ttys',`
+interface(`userdom_manage_unpriv_users_tmp_symlinks',` +interface(`userdom_manage_unpriv_users_tmp_symlinks',`
gen_require(` + gen_require(`
- attribute user_ttynode;
+ type user_tmp_t; + type user_tmp_t;
') + ')
+
- dontaudit $1 user_ttynode:chr_file rw_file_perms;
+ manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t) + manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
') +')
+
######################################## +########################################
## <summary> +## <summary>
-## Read the process state of all user domains.
+## Read and write unprivileged user ttys. +## Read and write unprivileged user ttys.
## </summary> +## </summary>
## <param name="domain"> +## <param name="domain">
## <summary> +## <summary>
@@ -5554,19 +5910,56 @@ +## Domain allowed access.
## </summary> +## </summary>
## </param> +## </param>
# +#
-interface(`userdom_read_all_users_state',`
+interface(`userdom_use_unpriv_users_ttys',` +interface(`userdom_use_unpriv_users_ttys',`
gen_require(` + gen_require(`
- attribute userdomain;
+ attribute user_ttynode; + attribute user_ttynode;
') + ')
+
- read_files_pattern($1,userdomain,userdomain)
- kernel_search_proc($1)
+ allow $1 user_ttynode:chr_file rw_term_perms; + allow $1 user_ttynode:chr_file rw_term_perms;
') ')
######################################## ########################################
## <summary> @@ -5559,7 +5970,7 @@
-## Get the attributes of all user domains. attribute userdomain;
-## </summary> ')
+## Do not audit attempts to use unprivileged
+## user ttys. - read_files_pattern($1,userdomain,userdomain)
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`userdom_dontaudit_use_unpriv_users_ttys',`
+ gen_require(`
+ attribute user_ttynode;
+ ')
+
+ dontaudit $1 user_ttynode:chr_file rw_file_perms;
+')
+
+########################################
+## <summary>
+## Read the process state of all user domains.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`userdom_read_all_users_state',`
+ gen_require(`
+ attribute userdomain;
+ ')
+
+ ps_process_pattern($1,userdomain) + ps_process_pattern($1,userdomain)
+ kernel_search_proc($1) kernel_search_proc($1)
+') ')
+
+######################################## @@ -5674,6 +6085,42 @@
+## <summary>
+## Get the attributes of all user domains.
+## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
@@ -5674,6 +6067,42 @@
######################################## ########################################
## <summary> ## <summary>
@ -34786,7 +34838,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## Send a dbus message to all user domains. ## Send a dbus message to all user domains.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -5704,3 +6133,408 @@ @@ -5704,3 +6151,408 @@
interface(`userdom_unconfined',` interface(`userdom_unconfined',`
refpolicywarn(`$0($*) has been deprecated.') refpolicywarn(`$0($*) has been deprecated.')
') ')

17
selinux-policy.spec
View File

@ -17,7 +17,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.3.1 Version: 3.3.1
Release: 45%{?dist} Release: 48%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -288,9 +288,9 @@ SELinux Reference policy targeted base module.
%post targeted %post targeted
if [ $1 -eq 1 ]; then if [ $1 -eq 1 ]; then
%loadpolicy targeted %loadpolicy targeted
semanage user -a -S targeted -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u 2> /dev/null semanage user -a -S targeted -P user -R "unconfined_r system_r" -r s0-s0:c0.c1023 unconfined_u
semanage login -m -S targeted -P user -s "unconfined_u" -r s0-s0:c0.c1023 __default__ 2> /dev/null semanage login -m -S targeted -s "unconfined_u" -r s0-s0:c0.c1023 __default__
semanage login -m -S targeted -P user -s "unconfined_u" -r s0-s0:c0.c1023 root 2> /dev/null semanage login -m -S targeted -s "unconfined_u" -r s0-s0:c0.c1023 root
semanage user -a -S targeted -P user -R guest_r guest_u semanage user -a -S targeted -P user -R guest_r guest_u
semanage user -a -S targeted -P user -R xguest_r xguest_u semanage user -a -S targeted -P user -R xguest_r xguest_u
restorecon -R /root /var/log /var/run 2> /dev/null restorecon -R /root /var/log /var/run 2> /dev/null
@ -385,6 +385,15 @@ exit 0
%endif %endif
%changelog %changelog
* Wed May 7 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-48
- Allow amanada to create data files
* Wed May 7 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-47
- Fix initial install, semanage setup
* Tue May 6 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-46
- Allow system_r for httpd_unconfined_script_t
* Wed Apr 30 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-45 * Wed Apr 30 2008 Dan Walsh <dwalsh@redhat.com> 3.3.1-45
- Remove dmesg boolean - Remove dmesg boolean
- Allow user domains to read/write game data - Allow user domains to read/write game data