From b253d7866a1898454a007166e5067dec10f943e8 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Thu, 10 Dec 2009 21:30:13 +0000 Subject: [PATCH] - Update to upstream release --- policy-F13.patch | 123 ++++++++++++++++++++++++++++++----------------- 1 file changed, 78 insertions(+), 45 deletions(-) diff --git a/policy-F13.patch b/policy-F13.patch index f5048964..9c327800 100644 --- a/policy-F13.patch +++ b/policy-F13.patch @@ -3562,7 +3562,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.7.4/policy/modules/apps/mozilla.te --- nsaserefpolicy/policy/modules/apps/mozilla.te 2009-12-04 09:43:33.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/apps/mozilla.te 2009-12-04 12:39:47.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/apps/mozilla.te 2009-12-10 15:39:39.000000000 -0500 @@ -91,6 +91,7 @@ corenet_raw_sendrecv_generic_node(mozilla_t) corenet_tcp_sendrecv_http_port(mozilla_t) @@ -3606,7 +3606,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +optional_policy(` + pulseaudio_exec(mozilla_t) + pulseaudio_stream_connect(mozilla_t) -+ pulseaudio_manage_config(mozilla_t) ++ pulseaudio_manage_home(mozilla_t) ') optional_policy(` @@ -3965,7 +3965,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.te serefpolicy-3.7.4/policy/modules/apps/nsplugin.te --- nsaserefpolicy/policy/modules/apps/nsplugin.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/apps/nsplugin.te 2009-12-04 12:33:34.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/apps/nsplugin.te 2009-12-10 15:42:06.000000000 -0500 @@ -0,0 +1,296 @@ + +policy_module(nsplugin, 1.0.0) @@ -4255,7 +4255,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +optional_policy(` + pulseaudio_exec(nsplugin_t) + pulseaudio_stream_connect(nsplugin_t) -+ pulseaudio_manage_config(nsplugin_t) ++ pulseaudio_manage_home(nsplugin_t) +') + +optional_policy(` @@ -4498,7 +4498,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.7.4/policy/modules/apps/pulseaudio.te --- nsaserefpolicy/policy/modules/apps/pulseaudio.te 2009-11-17 10:54:26.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/apps/pulseaudio.te 2009-12-04 12:33:34.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/apps/pulseaudio.te 2009-12-10 15:49:17.000000000 -0500 @@ -11,6 +11,9 @@ application_domain(pulseaudio_t, pulseaudio_exec_t) role system_r types pulseaudio_t; @@ -4534,7 +4534,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + bluetooth_stream_connect(pulseaudio_t) ') -+userdom_search_user_home_dirs($1) ++userdom_search_user_home_dirs(pulseaudio_t) +manage_dirs_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t) +manage_files_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t) + @@ -8755,8 +8755,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.te serefpolicy-3.7.4/policy/modules/roles/unconfineduser.te --- nsaserefpolicy/policy/modules/roles/unconfineduser.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/roles/unconfineduser.te 2009-12-09 10:12:48.000000000 -0500 -@@ -0,0 +1,459 @@ ++++ serefpolicy-3.7.4/policy/modules/roles/unconfineduser.te 2009-12-10 15:25:41.000000000 -0500 +@@ -0,0 +1,460 @@ +policy_module(unconfineduser, 1.0.0) + +######################################## @@ -8930,6 +8930,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + optional_policy(` + xserver_rw_shm(unconfined_usertype) + xserver_run_xauth(unconfined_usertype, unconfined_r) ++ xserver_xdm_dbus_chat(unconfined_usertype) + ') +') + @@ -14465,7 +14466,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol corenet_tcp_sendrecv_generic_if(fetchmail_t) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fprintd.te serefpolicy-3.7.4/policy/modules/services/fprintd.te --- nsaserefpolicy/policy/modules/services/fprintd.te 2009-07-29 15:15:33.000000000 -0400 -+++ serefpolicy-3.7.4/policy/modules/services/fprintd.te 2009-12-05 06:04:00.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/services/fprintd.te 2009-12-10 15:34:41.000000000 -0500 @@ -37,6 +37,8 @@ files_read_etc_files(fprintd_t) files_read_usr_files(fprintd_t) @@ -14475,12 +14476,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol auth_use_nsswitch(fprintd_t) miscfiles_read_localization(fprintd_t) -@@ -51,5 +53,9 @@ +@@ -51,5 +53,8 @@ optional_policy(` policykit_read_reload(fprintd_t) policykit_read_lib(fprintd_t) + policykit_dbus_chat(fprintd_t) -+ policykit_auth_dbus_chat(fprintd_t) policykit_domtrans_auth(fprintd_t) + policykit_dbus_chat_auth(fprintd_t) ') @@ -17906,8 +17906,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +/var/run/plymouth(/.*)? gen_context(system_u:object_r:plymouthd_var_run_t, s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plymouth.if serefpolicy-3.7.4/policy/modules/services/plymouth.if --- nsaserefpolicy/policy/modules/services/plymouth.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/services/plymouth.if 2009-12-04 12:33:34.000000000 -0500 -@@ -0,0 +1,286 @@ ++++ serefpolicy-3.7.4/policy/modules/services/plymouth.if 2009-12-10 15:27:39.000000000 -0500 +@@ -0,0 +1,304 @@ +## policy for plymouthd + +######################################## @@ -17930,6 +17930,24 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + +######################################## +## ++## Execute a plymoth in the current domain ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`plymouth_exec', ` ++ gen_require(` ++ type plymouthd_exec_t; ++ ') ++ ++ can_exec($1, plymouthd_exec_t) ++') ++ ++######################################## ++## +## Execute a domain transition to run plymouthd. +## +## @@ -18196,8 +18214,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plymouth.te serefpolicy-3.7.4/policy/modules/services/plymouth.te --- nsaserefpolicy/policy/modules/services/plymouth.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/services/plymouth.te 2009-12-04 12:33:34.000000000 -0500 -@@ -0,0 +1,101 @@ ++++ serefpolicy-3.7.4/policy/modules/services/plymouth.te 2009-12-10 15:30:43.000000000 -0500 +@@ -0,0 +1,102 @@ +policy_module(plymouthd, 1.0.0) + +######################################## @@ -18256,6 +18274,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +files_read_usr_files(plymouthd_t) + +miscfiles_read_localization(plymouthd_t) ++miscfiles_read_fonts(plymouthd_t) + +manage_dirs_pattern(plymouthd_t, plymouthd_var_run_t, plymouthd_var_run_t) +manage_files_pattern(plymouthd_t, plymouthd_var_run_t, plymouthd_var_run_t) @@ -18319,7 +18338,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.if serefpolicy-3.7.4/policy/modules/services/policykit.if --- nsaserefpolicy/policy/modules/services/policykit.if 2009-08-18 18:39:50.000000000 -0400 -+++ serefpolicy-3.7.4/policy/modules/services/policykit.if 2009-12-05 06:04:03.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/services/policykit.if 2009-12-10 15:31:44.000000000 -0500 @@ -17,12 +17,37 @@ class dbus send_msg; ') @@ -24046,8 +24065,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/vhostmd.te serefpolicy-3.7.4/policy/modules/services/vhostmd.te --- nsaserefpolicy/policy/modules/services/vhostmd.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/services/vhostmd.te 2009-12-09 13:28:27.000000000 -0500 -@@ -0,0 +1,91 @@ ++++ serefpolicy-3.7.4/policy/modules/services/vhostmd.te 2009-12-10 16:06:39.000000000 -0500 +@@ -0,0 +1,86 @@ + +policy_module(vhostmd,1.0.0) + @@ -24134,11 +24153,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + xen_stream_connect_xenstore(vhostmd_t) + xen_stream_connect_xm(vhostmd_t) +') -+ -+optional_policy(` -+ xm_stream_connect(vhostmd_t) -+') -+ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.fc serefpolicy-3.7.4/policy/modules/services/virt.fc --- nsaserefpolicy/policy/modules/services/virt.fc 2009-07-14 14:19:57.000000000 -0400 +++ serefpolicy-3.7.4/policy/modules/services/virt.fc 2009-12-04 12:33:34.000000000 -0500 @@ -25964,7 +25978,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.7.4/policy/modules/services/xserver.te --- nsaserefpolicy/policy/modules/services/xserver.te 2009-12-04 09:43:33.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/services/xserver.te 2009-12-09 11:40:20.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/services/xserver.te 2009-12-10 15:28:09.000000000 -0500 @@ -1,5 +1,5 @@ -policy_module(xserver, 3.3.1) @@ -26581,7 +26595,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol hostname_exec(xdm_t) ') -@@ -547,6 +675,38 @@ +@@ -547,6 +675,39 @@ ') optional_policy(` @@ -26598,6 +26612,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + +optional_policy(` + plymouth_search_spool(xdm_t) ++ plymouth_exec(xdm_t) +') + +optional_policy(` @@ -26620,7 +26635,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol seutil_sigchld_newrole(xdm_t) ') -@@ -555,8 +715,9 @@ +@@ -555,8 +716,9 @@ ') optional_policy(` @@ -26632,7 +26647,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ifndef(`distro_redhat',` allow xdm_t self:process { execheap execmem }; -@@ -565,7 +726,6 @@ +@@ -565,7 +727,6 @@ ifdef(`distro_rhel4',` allow xdm_t self:process { execheap execmem }; ') @@ -26640,7 +26655,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` userhelper_dontaudit_search_config(xdm_t) -@@ -576,6 +736,10 @@ +@@ -576,6 +737,10 @@ ') optional_policy(` @@ -26651,7 +26666,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol xfs_stream_connect(xdm_t) ') -@@ -584,14 +748,6 @@ +@@ -584,14 +749,6 @@ # X server local policy # @@ -26666,7 +26681,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # setuid/setgid for the wrapper program to change UID # sys_rawio is for iopl access - should not be needed for frame-buffer # sys_admin, locking shared mem? chowning IPC message queues or semaphores? -@@ -600,10 +756,9 @@ +@@ -600,10 +757,9 @@ # execheap needed until the X module loader is fixed. # NVIDIA Needs execstack @@ -26678,7 +26693,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow xserver_t self:fd use; allow xserver_t self:fifo_file rw_fifo_file_perms; allow xserver_t self:sock_file read_sock_file_perms; -@@ -615,13 +770,31 @@ +@@ -615,13 +771,31 @@ allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:udp_socket create_socket_perms; @@ -26711,7 +26726,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) -@@ -634,12 +807,19 @@ +@@ -634,12 +808,19 @@ manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) files_search_var_lib(xserver_t) @@ -26733,7 +26748,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol kernel_read_system_state(xserver_t) kernel_read_device_sysctls(xserver_t) -@@ -673,7 +853,6 @@ +@@ -673,7 +854,6 @@ dev_rw_agp(xserver_t) dev_rw_framebuffer(xserver_t) dev_manage_dri_dev(xserver_t) @@ -26741,7 +26756,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol dev_create_generic_dirs(xserver_t) dev_setattr_generic_dirs(xserver_t) # raw memory access is needed if not using the frame buffer -@@ -683,9 +862,12 @@ +@@ -683,9 +863,12 @@ dev_rw_xserver_misc(xserver_t) # read events - the synaptics touchpad driver reads raw events dev_rw_input_dev(xserver_t) @@ -26755,7 +26770,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol files_read_etc_files(xserver_t) files_read_etc_runtime_files(xserver_t) -@@ -700,8 +882,12 @@ +@@ -700,8 +883,12 @@ fs_search_nfs(xserver_t) fs_search_auto_mountpoints(xserver_t) fs_search_ramfs(xserver_t) @@ -26768,7 +26783,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol selinux_validate_context(xserver_t) selinux_compute_access_vector(xserver_t) -@@ -723,6 +909,7 @@ +@@ -723,6 +910,7 @@ miscfiles_read_localization(xserver_t) miscfiles_read_fonts(xserver_t) @@ -26776,7 +26791,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol modutils_domtrans_insmod(xserver_t) -@@ -745,7 +932,7 @@ +@@ -745,7 +933,7 @@ ') ifdef(`enable_mls',` @@ -26785,7 +26800,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol range_transition xserver_t xserver_t:x_drawable s0 - mls_systemhigh; ') -@@ -754,17 +941,15 @@ +@@ -754,17 +942,15 @@ # but typeattribute doesnt work in conditionals allow xserver_t xserver_t:x_server *; @@ -26806,7 +26821,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow xserver_t xextension_type:x_extension *; allow xserver_t { x_domain xserver_t }:x_resource *; allow xserver_t xevent_type:{ x_event x_synthetic_event } *; -@@ -779,12 +964,20 @@ +@@ -779,12 +965,20 @@ ') optional_policy(` @@ -26828,7 +26843,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol unconfined_domtrans(xserver_t) ') -@@ -811,12 +1004,12 @@ +@@ -811,12 +1005,12 @@ allow xserver_t xdm_var_lib_t:file { getattr read }; dontaudit xserver_t xdm_var_lib_t:dir search; @@ -26845,7 +26860,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # Run xkbcomp. allow xserver_t xkb_var_lib_t:lnk_file read; -@@ -832,9 +1025,14 @@ +@@ -832,9 +1026,14 @@ # to read ROLE_home_t - examine this in more detail # (xauth?) userdom_read_user_home_content_files(xserver_t) @@ -26860,7 +26875,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs(xserver_t) fs_manage_nfs_files(xserver_t) -@@ -849,11 +1047,14 @@ +@@ -849,11 +1048,14 @@ optional_policy(` dbus_system_bus_client(xserver_t) @@ -26876,7 +26891,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -867,150 +1068,163 @@ +@@ -867,150 +1069,163 @@ # # Hacks @@ -31923,7 +31938,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +HOME_DIR/\.gvfs(/.*)? <> diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.7.4/policy/modules/system/userdomain.if --- nsaserefpolicy/policy/modules/system/userdomain.if 2009-08-31 13:30:04.000000000 -0400 -+++ serefpolicy-3.7.4/policy/modules/system/userdomain.if 2009-12-09 09:46:14.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/system/userdomain.if 2009-12-10 15:29:06.000000000 -0500 @@ -30,8 +30,9 @@ ') @@ -33625,7 +33640,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol kernel_search_proc($1) ') -@@ -3064,3 +3390,638 @@ +@@ -3064,3 +3390,656 @@ allow $1 userdomain:dbus send_msg; ') @@ -34264,6 +34279,24 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + read_files_pattern($1, home_cert_t, home_cert_t) + read_lnk_files_pattern($1, home_cert_t, home_cert_t) +') ++ ++######################################## ++## ++## dontaudit Search getatrr /root files ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`userdom_dontaudit_getattr_admin_home_files',` ++ gen_require(` ++ type admin_home_t; ++ ') ++ ++ dontaudit $1 admin_home_t:file getattr; ++') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.7.4/policy/modules/system/userdomain.te --- nsaserefpolicy/policy/modules/system/userdomain.te 2009-11-17 10:54:26.000000000 -0500 +++ serefpolicy-3.7.4/policy/modules/system/userdomain.te 2009-12-04 12:33:34.000000000 -0500