Update f14

policy/modules/admin/accountsd.fc

@@ -1,3 +0,0 @@
-/usr/libexec/accounts-daemon		--	gen_context(system_u:object_r:accountsd_exec_t,s0)
-
-/var/lib/AccountsService(/.*)?			gen_context(system_u:object_r:accountsd_var_lib_t,s0)

policy/modules/admin/accountsd.if

@@ -1,173 +0,0 @@
-## <summary>Accountsservice D-Bus interfaces for querying and manipulating user account information.</summary>
-
-########################################
-## <summary>
-##	Execute a domain transition to
-##	run Account Service daemon.
-## </summary>
-## <param name="domain">
-## <summary>
-##	Domain allowed to transition.
-## </summary>
-## </param>
-#
-interface(`accountsd_domtrans',`
-	gen_require(`
-		type accountsd_t, accountsd_exec_t;
-	')
-
-	domtrans_pattern($1, accountsd_exec_t, accountsd_t)
-	corecmd_search_bin($1)
-	files_search_usr($1)
-')
-
-########################################
-## <summary>
-##	Search Accounts Service daemon
-##	lib directories.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`accountsd_search_lib',`
-	gen_require(`
-		type accountsd_var_lib_t;
-	')
-
-	allow $1 accountsd_var_lib_t:dir search_dir_perms;
-	files_search_var_lib($1)
-')
-
-########################################
-## <summary>
-##	Read Accounts Service daemon
-##	lib files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`accountsd_read_lib_files',`
-	gen_require(`
-		type accountsd_var_lib_t;
-	')
-
-	read_files_pattern($1, accountsd_var_lib_t, accountsd_var_lib_t)
-	files_search_var_lib($1)
-')
-
-########################################
-## <summary>
-##	Manage Account Service daemon
-##	lib files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`accountsd_manage_lib_files',`
-	gen_require(`
-		type accountsd_var_lib_t;
-	')
-
-	manage_files_pattern($1, accountsd_var_lib_t,  accountsd_var_lib_t)
-	files_search_var_lib($1)
-')
-
-########################################
-## <summary>
-##	Manage Account Service daemon
-##	lib content.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`accountsd_manage_var_lib',`
-	gen_require(`
-		type accountsd_var_lib_t;
-	')
-
-	manage_dirs_pattern($1, accountsd_var_lib_t, accountsd_var_lib_t)
-	manage_files_pattern($1, accountsd_var_lib_t, accountsd_var_lib_t)
-	manage_lnk_files_pattern($1, accountsd_var_lib_t, accountsd_var_lib_t)
-	files_search_var_lib($1)
-')
-
-########################################
-## <summary>
-##	Send and receive messages from
-##	Account Service daemon over dbus.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`accountsd_dbus_chat',`
-	gen_require(`
-		type accountsd_t;
-		class dbus send_msg;
-	')
-
-	allow $1 accountsd_t:dbus send_msg;
-	allow accountsd_t $1:dbus send_msg;
-')
-
-########################################
-## <summary>
-##	Do not audit attempts to read and 
-##	write Account Service daemon pipes.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`accountsd_dontaudit_rw_fifo_file',`
-	gen_require(`
-		type accountsd_t;
-	')
-
-	dontaudit $1 accountsd_t:fifo_file rw_inherited_fifo_file_perms;
-')
-
-########################################
-## <summary>
-##	All of the rules required to administrate 
-##	an Account Service daemon environment.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-## <param name="role">
-##	<summary>
-##	Role allowed access.
-##	</summary>
-## </param>
-## <rolecap/>
-#
-interface(`accountsd_admin',`
-	gen_require(`
-		type accountsd_t, accountsd_var_lib_t;
-	')
-
-	allow $1 accountsd_t:process { ptrace signal_perms	};
-	read_files_pattern($1, accountsd_t, accountsd_t)
-
-	admin_pattern($1, accountsd_var_lib_t)
-	files_search_var_lib($1)
-')

policy/modules/apps/gnome.if

@@ -35,71 +35,13 @@ interface(`gnome_role',`
 	allow $2 gconfd_t:unix_stream_socket connectto;
 ')
 
-########################################
-## <summary>
-##	Execute gconf programs in
-##	in the caller domain.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`gnome_exec_gconf',`
-	gen_require(`
-		type gconfd_exec_t;
-	')
-
-	can_exec($1, gconfd_exec_t)
-')
-
-########################################
-## <summary>
-##	Read gconf config files.
-## </summary>
-## <param name="user_domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-template(`gnome_read_gconf_config',`
-	gen_require(`
-		type gconf_etc_t;
-	')
-
-	allow $1 gconf_etc_t:dir list_dir_perms;
-	read_files_pattern($1, gconf_etc_t, gconf_etc_t)
-	files_search_etc($1)
-')
-
-#######################################
-## <summary>
-##	Create, read, write, and delete gconf config files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`gnome_manage_gconf_config',`
-	gen_require(`
-		type gconf_etc_t;
-	')
-
-	manage_files_pattern($1, gconf_etc_t, gconf_etc_t)
-	files_search_etc($1)
-')
-
 ########################################
 ## <summary>
 ##	gconf connection template.
 ## </summary>
 ## <param name="user_domain">
 ##	<summary>
-##	Domain allowed access.
+##	The type of the user domain.
 ##	</summary>
 ## </param>
 #
@@ -132,22 +74,41 @@ interface(`gnome_domtrans_gconfd',`
 
 ########################################
 ## <summary>
-##	Read gnome homedir content (.config)
+##	Dontaudit search gnome homedir content (.config)
 ## </summary>
 ## <param name="user_domain">
 ##	<summary>
-##	Domain allowed access.
+##	The type of the user domain.
 ##	</summary>
 ## </param>
 #
-template(`gnome_read_config',`
+interface(`gnome_dontaudit_search_config',`
 	gen_require(`
 		attribute gnome_home_type;
 	')
 
-	list_dirs_pattern($1, gnome_home_type, gnome_home_type)
+	dontaudit $1 gnome_home_type:dir search_dir_perms;
-	read_files_pattern($1, gnome_home_type, gnome_home_type)
+')
-	read_lnk_files_pattern($1, gnome_home_type, gnome_home_type)
+
+########################################
+## <summary>
+##	manage gnome homedir content (.config)
+## </summary>
+## <param name="user_domain">
+##	<summary>
+##	The type of the user domain.
+##	</summary>
+## </param>
+#
+interface(`gnome_manage_config',`
+	gen_require(`
+		attribute gnome_home_type;
+	')
+
+	allow $1 gnome_home_type:dir manage_dir_perms;
+	allow $1 gnome_home_type:file manage_file_perms;
+	allow $1 gnome_home_type:lnk_file manage_lnk_file_perms;
+	userdom_search_user_home_dirs($1)
 ')
 
 ########################################
@@ -256,6 +217,45 @@ interface(`gnome_write_generic_cache_files',`
 	userdom_search_user_home_dirs($1)
 ')
 
+########################################
+## <summary>
+##	read gnome homedir content (.config)
+## </summary>
+## <param name="user_domain">
+##	<summary>
+##	The type of the user domain.
+##	</summary>
+## </param>
+#
+template(`gnome_read_config',`
+	gen_require(`
+		attribute gnome_home_type;
+	')
+
+	list_dirs_pattern($1, gnome_home_type, gnome_home_type)
+	read_files_pattern($1, gnome_home_type, gnome_home_type)
+	read_lnk_files_pattern($1, gnome_home_type, gnome_home_type)
+')
+
+########################################
+## <summary>
+##	Set attributes of Gnome config dirs.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`gnome_setattr_config_dirs',`
+	gen_require(`
+		type gnome_home_t;
+	')
+
+	setattr_dirs_pattern($1, gnome_home_t, gnome_home_t)
+	files_search_home($1)
+')
+
 ########################################
 ## <summary>
 ##	Create objects in a Gnome gconf home directory
@@ -525,62 +525,3 @@ interface(`gnome_dbus_chat_gconfdefault',`
 	allow $1 gconfdefaultsm_t:dbus send_msg;
 	allow gconfdefaultsm_t $1:dbus send_msg;
 ')
-
-########################################
-## <summary>
-##	Dontaudit search gnome homedir content (.config)
-## </summary>
-## <param name="user_domain">
-##	<summary>
-##	The type of the user domain.
-##	</summary>
-## </param>
-#
-interface(`gnome_dontaudit_search_config',`
-	gen_require(`
-		attribute gnome_home_type;
-	')
-
-	dontaudit $1 gnome_home_type:dir search_dir_perms;
-')
-
-########################################
-## <summary>
-##	Set attributes of Gnome config dirs.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`gnome_setattr_config_dirs',`
-	gen_require(`
-		type gnome_home_t;
-	')
-
-	setattr_dirs_pattern($1, gnome_home_t, gnome_home_t)
-	files_search_home($1)
-')
-
-########################################
-## <summary>
-##	manage gnome homedir content (.config)
-## </summary>
-## <param name="user_domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`gnome_manage_config',`
-	gen_require(`
-		attribute gnome_home_type;
-	')
-
-	allow $1 gnome_home_type:dir manage_dir_perms;
-	allow $1 gnome_home_type:file manage_file_perms;
-	allow $1 gnome_home_type:lnk_file manage_lnk_file_perms;
-	userdom_search_user_home_dirs($1)
-')
-

policy/modules/apps/telepathy.te

@@ -50,8 +50,8 @@ manage_dirs_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
 manage_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
 manage_sock_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
 exec_files_pattern(telepathy_msn_t, telepathy_msn_tmp_t, telepathy_msn_tmp_t)
-files_tmp_filetrans(telepathy_msn_t, telepathy_msn_tmp_t, { dir file})
+files_tmp_filetrans(telepathy_msn_t, telepathy_msn_tmp_t, { dir file sock_file })
-userdom_user_tmp_filetrans(telepathy_msn_t, telepathy_msn_tmp_t, { dir file sock_file})
+userdom_user_tmp_filetrans(telepathy_msn_t, telepathy_msn_tmp_t, { dir file sock_file })
 userdom_dontaudit_setattr_user_tmp(telepathy_msn_t)
 
 corenet_sendrecv_http_client_packets(telepathy_msn_t)

policy/modules/kernel/files.if

@@ -5308,25 +5308,6 @@ interface(`files_getattr_generic_locks',`
 	getattr_files_pattern($1, var_lock_t, var_lock_t)
 ')
 
-########################################
-## <summary>
-##	Delete generic lock files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`files_delete_generic_locks',`
-	gen_require(`
-		type var_t, var_lock_t;
-	')
-
-	allow $1 var_t:dir search_dir_perms;
-	delete_files_pattern($1, var_lock_t, var_lock_t)
-')
-
 ########################################
 ## <summary>
 ##	Create, read, write, and delete generic

policy/modules/kernel/terminal.if

@@ -1233,11 +1233,13 @@ interface(`term_dontaudit_use_unallocated_ttys',`
 #
 interface(`term_getattr_all_ttys',`
 	gen_require(`
+		type tty_device_t;
 		attribute ttynode;
 	')
 
 	dev_list_all_dev_nodes($1)
 	allow $1 ttynode:chr_file getattr;
+	allow $1 tty_device_t:chr_file getattr;
 ')
 
 ########################################

policy/modules/roles/dbadm.te

@@ -5,52 +5,15 @@ policy_module(dbadm, 1.0.0)
 # Declarations
 #
 
-## <desc>
-## <p>
-## Allow dbadm to manage files in users home directories
-## </p>
-## </desc>
-gen_tunable(dbadm_manage_user_files, false)
-
-## <desc>
-## <p>
-## Allow dbadm to read files in users home directories
-## </p>
-## </desc>
-gen_tunable(dbadm_read_user_files, false)
-
 role dbadm_r;
 
-userdom_base_user_template(dbadm)
+userdom_unpriv_user_template(dbadm)
 
 ########################################
 #
 # database admin local policy
 #
 
-allow dbadm_t self:capability { dac_override dac_read_search sys_ptrace };
-
-files_dontaudit_search_all_dirs(dbadm_t)
-files_delete_generic_locks(dbadm_t)
-files_list_var(dbadm_t)
-
-selinux_get_enforce_mode(dbadm_t)
-
-logging_send_syslog_msg(dbadm_t)
-
-userdom_dontaudit_search_user_home_dirs(dbadm_t)
-
-tunable_policy(`dbadm_manage_user_files',`
-	userdom_manage_user_home_content_files(dbadm_t)
-	userdom_read_user_tmp_files(dbadm_t)
-	userdom_write_user_tmp_files(dbadm_t)
-')
-
-tunable_policy(`dbadm_read_user_files',`
-	userdom_read_user_home_content_files(dbadm_t)
-	userdom_read_user_tmp_files(dbadm_t)
-')
-
 optional_policy(`
 	mysql_admin(dbadm_t, dbadm_r)
 ')
@@ -58,3 +21,12 @@ optional_policy(`
 optional_policy(`
 	postgresql_admin(dbadm_t, dbadm_r)
 ')
+
+# For starting up daemon processes
+optional_policy(`
+	su_role_template(dbadm, dbadm_r, dbadm_t)
+')
+
+optional_policy(`
+	sudo_role_template(dbadm, dbadm_r, dbadm_t)
+')

policy/modules/services/accountsd.te

@@ -8,6 +8,8 @@ policy_module(accountsd, 1.0.0)
 type accountsd_t;
 type accountsd_exec_t;
 dbus_system_domain(accountsd_t, accountsd_exec_t)
+init_daemon_domain(accountsd_t, accountsd_exec_t)
+role system_r types accountsd_t;
 
 type accountsd_var_lib_t;
 files_type(accountsd_var_lib_t)
@@ -55,3 +57,8 @@ optional_policy(`
 optional_policy(`
 	policykit_dbus_chat(accountsd_t)
 ')
+
+optional_policy(`
+	xserver_dbus_chat_xdm(accountsd_t)
+	xserver_manage_xdm_etc_files(accountsd_t)
+')

policy/modules/services/cron.te

@@ -678,6 +678,7 @@ list_dirs_pattern(crond_t, user_cron_spool_t, user_cron_spool_t)
 rw_dirs_pattern(crond_t, user_cron_spool_t, user_cron_spool_t)
 read_files_pattern(crond_t, user_cron_spool_t, user_cron_spool_t)
 read_lnk_files_pattern(crond_t, user_cron_spool_t, user_cron_spool_t)
+allow cronjob_t user_cron_spool_t:file create_lnk_perms;
 
 tunable_policy(`fcron_crond', `
 	allow crond_t user_cron_spool_t:file manage_file_perms;

policy/modules/system/init.te

@@ -446,7 +446,9 @@ files_mounton_default(initrc_t)
 files_manage_mnt_dirs(initrc_t)
 files_manage_mnt_files(initrc_t)
 
-fs_write_cgroup_files(initrc_t)
+fs_delete_cgroup_dirs(initrc_t)
+fs_list_cgroup_dirs(initrc_t)
+fs_rw_cgroup_files(initrc_t)
 fs_list_inotifyfs(initrc_t)
 fs_register_binary_executable_type(initrc_t)
 # rhgb-console writes to ramfs