rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Merge with upstream

Browse Source
This commit is contained in:
Dan Walsh 2010-08-27 10:21:25 -04:00
parent 59475c2524
commit acb1aed3a4
1 changed files with 26 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
policy-F14.patch
View File

@ -9046,18 +9046,9 @@ index 252913b..a1bbe8f 100644
consoletype_exec(auditadm_t) consoletype_exec(auditadm_t)
') ')
diff --git a/policy/modules/roles/dbadm.te b/policy/modules/roles/dbadm.te diff --git a/policy/modules/roles/dbadm.te b/policy/modules/roles/dbadm.te
index 1875064..a3ddd43 100644 index 1875064..20d9333 100644
--- a/policy/modules/roles/dbadm.te --- a/policy/modules/roles/dbadm.te
+++ b/policy/modules/roles/dbadm.te +++ b/policy/modules/roles/dbadm.te
@@ -21,7 +21,7 @@ gen_tunable(dbadm_read_user_files, false)
role dbadm_r;
-userdom_base_user_template(dbadm)
+userdom_unpriv_user_template(dbadm)
########################################
#
@@ -58,3 +58,7 @@ optional_policy(` @@ -58,3 +58,7 @@ optional_policy(`
optional_policy(` optional_policy(`
postgresql_admin(dbadm_t, dbadm_r) postgresql_admin(dbadm_t, dbadm_r)
@ -26171,7 +26162,7 @@ index 6f1e3c7..39c2bb3 100644
+/var/lib/pqsql/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) +/var/lib/pqsql/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
+ +
diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if
index da2601a..8696a6e 100644 index da2601a..6ff8f25 100644
--- a/policy/modules/services/xserver.if --- a/policy/modules/services/xserver.if
+++ b/policy/modules/services/xserver.if +++ b/policy/modules/services/xserver.if
@@ -19,9 +19,10 @@ @@ -19,9 +19,10 @@
@ -26229,15 +26220,13 @@ index da2601a..8696a6e 100644
# Client read xserver shm # Client read xserver shm
allow $2 xserver_t:fd use; allow $2 xserver_t:fd use;
@@ -89,14 +99,19 @@ interface(`xserver_restricted_role',` @@ -89,14 +99,17 @@ interface(`xserver_restricted_role',`
dev_write_misc($2) dev_write_misc($2)
# open office is looking for the following # open office is looking for the following
dev_getattr_agp_dev($2) dev_getattr_agp_dev($2)
- dev_dontaudit_rw_dri($2) - dev_dontaudit_rw_dri($2)
+ tunable_policy(`user_direct_dri',` + tunable_policy(`user_direct_dri',`
+ dev_rw_dri($2) + dev_rw_dri($2)
+ ',`
+ dev_dontaudit_rw_dri($2)
+ ') + ')
+ +
# GNOME checks for usb and other devices: # GNOME checks for usb and other devices:
@ -26251,7 +26240,7 @@ index da2601a..8696a6e 100644
xserver_xsession_entry_type($2) xserver_xsession_entry_type($2)
xserver_dontaudit_write_log($2) xserver_dontaudit_write_log($2)
xserver_stream_connect_xdm($2) xserver_stream_connect_xdm($2)
@@ -148,6 +163,7 @@ interface(`xserver_role',` @@ -148,6 +161,7 @@ interface(`xserver_role',`
allow $2 xauth_home_t:file manage_file_perms; allow $2 xauth_home_t:file manage_file_perms;
allow $2 xauth_home_t:file { relabelfrom relabelto }; allow $2 xauth_home_t:file { relabelfrom relabelto };
@ -26259,7 +26248,7 @@ index da2601a..8696a6e 100644
manage_dirs_pattern($2, user_fonts_t, user_fonts_t) manage_dirs_pattern($2, user_fonts_t, user_fonts_t)
manage_files_pattern($2, user_fonts_t, user_fonts_t) manage_files_pattern($2, user_fonts_t, user_fonts_t)
relabel_dirs_pattern($2, user_fonts_t, user_fonts_t) relabel_dirs_pattern($2, user_fonts_t, user_fonts_t)
@@ -197,7 +213,7 @@ interface(`xserver_ro_session',` @@ -197,7 +211,7 @@ interface(`xserver_ro_session',`
allow $1 xserver_t:process signal; allow $1 xserver_t:process signal;
# Read /tmp/.X0-lock # Read /tmp/.X0-lock
@ -26268,7 +26257,7 @@ index da2601a..8696a6e 100644
# Client read xserver shm # Client read xserver shm
allow $1 xserver_t:fd use; allow $1 xserver_t:fd use;
@@ -291,12 +307,12 @@ interface(`xserver_user_client',` @@ -291,12 +305,12 @@ interface(`xserver_user_client',`
allow $1 self:unix_stream_socket { connectto create_stream_socket_perms }; allow $1 self:unix_stream_socket { connectto create_stream_socket_perms };
# Read .Xauthority file # Read .Xauthority file
@ -26284,7 +26273,7 @@ index da2601a..8696a6e 100644
allow $1 xdm_tmp_t:dir search; allow $1 xdm_tmp_t:dir search;
allow $1 xdm_tmp_t:sock_file { read write }; allow $1 xdm_tmp_t:sock_file { read write };
dontaudit $1 xdm_t:tcp_socket { read write }; dontaudit $1 xdm_t:tcp_socket { read write };
@@ -355,6 +371,12 @@ template(`xserver_common_x_domain_template',` @@ -355,6 +369,12 @@ template(`xserver_common_x_domain_template',`
class x_property all_x_property_perms; class x_property all_x_property_perms;
class x_event all_x_event_perms; class x_event all_x_event_perms;
class x_synthetic_event all_x_synthetic_event_perms; class x_synthetic_event all_x_synthetic_event_perms;
@ -26297,7 +26286,7 @@ index da2601a..8696a6e 100644
') ')
############################## ##############################
@@ -386,6 +408,15 @@ template(`xserver_common_x_domain_template',` @@ -386,6 +406,15 @@ template(`xserver_common_x_domain_template',`
allow $2 xevent_t:{ x_event x_synthetic_event } receive; allow $2 xevent_t:{ x_event x_synthetic_event } receive;
# dont audit send failures # dont audit send failures
dontaudit $2 input_xevent_type:x_event send; dontaudit $2 input_xevent_type:x_event send;
@ -26313,7 +26302,7 @@ index da2601a..8696a6e 100644
') ')
####################################### #######################################
@@ -476,6 +507,7 @@ template(`xserver_user_x_domain_template',` @@ -476,6 +505,7 @@ template(`xserver_user_x_domain_template',`
xserver_use_user_fonts($2) xserver_use_user_fonts($2)
xserver_read_xdm_tmp_files($2) xserver_read_xdm_tmp_files($2)
@ -26321,7 +26310,7 @@ index da2601a..8696a6e 100644
# X object manager # X object manager
xserver_object_types_template($1) xserver_object_types_template($1)
@@ -545,6 +577,27 @@ interface(`xserver_domtrans_xauth',` @@ -545,6 +575,27 @@ interface(`xserver_domtrans_xauth',`
') ')
domtrans_pattern($1, xauth_exec_t, xauth_t) domtrans_pattern($1, xauth_exec_t, xauth_t)
@ -26349,7 +26338,7 @@ index da2601a..8696a6e 100644
') ')
######################################## ########################################
@@ -598,6 +651,7 @@ interface(`xserver_read_user_xauth',` @@ -598,6 +649,7 @@ interface(`xserver_read_user_xauth',`
allow $1 xauth_home_t:file read_file_perms; allow $1 xauth_home_t:file read_file_perms;
userdom_search_user_home_dirs($1) userdom_search_user_home_dirs($1)
@ -26357,7 +26346,7 @@ index da2601a..8696a6e 100644
') ')
######################################## ########################################
@@ -725,10 +779,12 @@ interface(`xserver_dontaudit_rw_xdm_pipes',` @@ -725,10 +777,12 @@ interface(`xserver_dontaudit_rw_xdm_pipes',`
interface(`xserver_stream_connect_xdm',` interface(`xserver_stream_connect_xdm',`
gen_require(` gen_require(`
type xdm_t, xdm_tmp_t; type xdm_t, xdm_tmp_t;
@ -26370,7 +26359,7 @@ index da2601a..8696a6e 100644
') ')
######################################## ########################################
@@ -805,7 +861,7 @@ interface(`xserver_read_xdm_pid',` @@ -805,7 +859,7 @@ interface(`xserver_read_xdm_pid',`
') ')
files_search_pids($1) files_search_pids($1)
@ -26379,7 +26368,7 @@ index da2601a..8696a6e 100644
') ')
######################################## ########################################
@@ -916,7 +972,7 @@ interface(`xserver_dontaudit_write_log',` @@ -916,7 +970,7 @@ interface(`xserver_dontaudit_write_log',`
type xserver_log_t; type xserver_log_t;
') ')
@ -26388,7 +26377,7 @@ index da2601a..8696a6e 100644
') ')
######################################## ########################################
@@ -963,6 +1019,44 @@ interface(`xserver_read_xkb_libs',` @@ -963,6 +1017,44 @@ interface(`xserver_read_xkb_libs',`
######################################## ########################################
## <summary> ## <summary>
@ -26433,7 +26422,7 @@ index da2601a..8696a6e 100644
## Read xdm temporary files. ## Read xdm temporary files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -1224,9 +1318,20 @@ interface(`xserver_manage_core_devices',` @@ -1224,9 +1316,20 @@ interface(`xserver_manage_core_devices',`
class x_device all_x_device_perms; class x_device all_x_device_perms;
class x_pointer all_x_pointer_perms; class x_pointer all_x_pointer_perms;
class x_keyboard all_x_keyboard_perms; class x_keyboard all_x_keyboard_perms;
@ -26454,7 +26443,7 @@ index da2601a..8696a6e 100644
') ')
######################################## ########################################
@@ -1250,3 +1355,329 @@ interface(`xserver_unconfined',` @@ -1250,3 +1353,329 @@ interface(`xserver_unconfined',`
typeattribute $1 x_domain; typeattribute $1 x_domain;
typeattribute $1 xserver_unconfined_type; typeattribute $1 xserver_unconfined_type;
') ')
@ -29001,7 +28990,7 @@ index f6aafe7..7da8294 100644
+ allow $1 init_t:unix_stream_socket rw_stream_socket_perms; + allow $1 init_t:unix_stream_socket rw_stream_socket_perms;
+') +')
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index bd45076..a1b6d56 100644 index bd45076..a100eb6 100644
--- a/policy/modules/system/init.te --- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te +++ b/policy/modules/system/init.te
@@ -16,6 +16,27 @@ gen_require(` @@ -16,6 +16,27 @@ gen_require(`
@ -29115,7 +29104,7 @@ index bd45076..a1b6d56 100644
corecmd_shell_domtrans(init_t, initrc_t) corecmd_shell_domtrans(init_t, initrc_t)
',` ',`
# Run the shell in the sysadm role for single-user mode. # Run the shell in the sysadm role for single-user mode.
@@ -185,15 +216,80 @@ tunable_policy(`init_upstart',` @@ -185,23 +216,92 @@ tunable_policy(`init_upstart',`
sysadm_shell_domtrans(init_t) sysadm_shell_domtrans(init_t)
') ')
@ -29164,11 +29153,6 @@ index bd45076..a1b6d56 100644
+ init_read_script_state(init_t) + init_read_script_state(init_t)
+ +
+ seutil_read_file_contexts(init_t) + seutil_read_file_contexts(init_t)
+
+ optional_policy(`
+ plymouthd_stream_connect(init_t)
+ plymouthd_exec_plymouth(init_t)
+ ')
+') +')
+ +
optional_policy(` optional_policy(`
@ -29196,7 +29180,13 @@ index bd45076..a1b6d56 100644
nscd_socket_use(init_t) nscd_socket_use(init_t)
') ')
@@ -202,6 +298,10 @@ optional_policy(` optional_policy(`
+ plymouthd_stream_connect(init_t)
+ plymouthd_exec_plymouth(init_t)
+')
+
+optional_policy(`
sssd_stream_connect(init_t)
') ')
optional_policy(` optional_policy(`