rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Fix labeling on /var/spool/rsyslog

Browse Source
This commit is contained in:
Daniel J Walsh 2008-12-02 19:41:59 +00:00
parent 359d6dac92
commit b3d78ec348
1 changed files with 58 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

94
policy-20081111.patch
View File

@ -24786,8 +24786,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.6.1/policy/modules/system/unconfined.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.6.1/policy/modules/system/unconfined.te
--- nsaserefpolicy/policy/modules/system/unconfined.te 2008-11-11 16:13:48.000000000 -0500 --- nsaserefpolicy/policy/modules/system/unconfined.te 2008-11-11 16:13:48.000000000 -0500
+++ serefpolicy-3.6.1/policy/modules/system/unconfined.te 2008-11-25 09:45:43.000000000 -0500 +++ serefpolicy-3.6.1/policy/modules/system/unconfined.te 2008-12-02 14:32:40.000000000 -0500
@@ -6,35 +6,75 @@ @@ -6,35 +6,76 @@
# Declarations # Declarations
# #
@ -24822,6 +24822,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+userdom_restricted_user_template(unconfined) +userdom_restricted_user_template(unconfined)
+#userdom_common_user_template(unconfined) +#userdom_common_user_template(unconfined)
+#userdom_xwindows_client_template(unconfined) +#userdom_xwindows_client_template(unconfined)
+userdom_execmod_user_home_files(unconfined_t)
type unconfined_exec_t; type unconfined_exec_t;
init_system_domain(unconfined_t, unconfined_exec_t) init_system_domain(unconfined_t, unconfined_exec_t)
@ -24870,7 +24871,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
libs_run_ldconfig(unconfined_t, unconfined_r) libs_run_ldconfig(unconfined_t, unconfined_r)
@@ -42,26 +82,39 @@ @@ -42,26 +83,39 @@
logging_run_auditctl(unconfined_t, unconfined_r) logging_run_auditctl(unconfined_t, unconfined_r)
mount_run_unconfined(unconfined_t, unconfined_r) mount_run_unconfined(unconfined_t, unconfined_r)
@ -24912,7 +24913,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -102,12 +155,24 @@ @@ -102,12 +156,24 @@
') ')
optional_policy(` optional_policy(`
@ -24937,7 +24938,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -119,7 +184,7 @@ @@ -119,7 +185,7 @@
') ')
optional_policy(` optional_policy(`
@ -24946,7 +24947,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -127,23 +192,25 @@ @@ -127,23 +193,25 @@
') ')
optional_policy(` optional_policy(`
@ -24977,7 +24978,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -155,36 +222,38 @@ @@ -155,36 +223,38 @@
') ')
optional_policy(` optional_policy(`
@ -25028,7 +25029,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -192,7 +261,7 @@ @@ -192,7 +262,7 @@
') ')
optional_policy(` optional_policy(`
@ -25037,7 +25038,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -204,11 +273,12 @@ @@ -204,11 +274,12 @@
') ')
optional_policy(` optional_policy(`
@ -25052,7 +25053,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -218,14 +288,58 @@ @@ -218,14 +289,58 @@
allow unconfined_execmem_t self:process { execstack execmem }; allow unconfined_execmem_t self:process { execstack execmem };
unconfined_domain_noaudit(unconfined_execmem_t) unconfined_domain_noaudit(unconfined_execmem_t)
@ -25125,7 +25126,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/root(/.*)? gen_context(system_u:object_r:admin_home_t,s0) +/root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.1/policy/modules/system/userdomain.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.1/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2008-11-13 18:40:02.000000000 -0500 --- nsaserefpolicy/policy/modules/system/userdomain.if 2008-11-13 18:40:02.000000000 -0500
+++ serefpolicy-3.6.1/policy/modules/system/userdomain.if 2008-12-02 11:36:42.000000000 -0500 +++ serefpolicy-3.6.1/policy/modules/system/userdomain.if 2008-12-02 14:39:39.000000000 -0500
@@ -30,8 +30,9 @@ @@ -30,8 +30,9 @@
') ')
@ -25377,10 +25378,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
- gen_require(` - gen_require(`
- type $1_t; - type $1_t;
- ') - ')
- +interface(`userdom_basic_networking',`
- allow $1_t self:tcp_socket create_stream_socket_perms; - allow $1_t self:tcp_socket create_stream_socket_perms;
- allow $1_t self:udp_socket create_socket_perms; - allow $1_t self:udp_socket create_socket_perms;
+interface(`userdom_basic_networking',` + allow $1 self:tcp_socket create_stream_socket_perms;
+ allow $1 self:udp_socket create_socket_perms;
- corenet_all_recvfrom_unlabeled($1_t) - corenet_all_recvfrom_unlabeled($1_t)
- corenet_all_recvfrom_netlabel($1_t) - corenet_all_recvfrom_netlabel($1_t)
@ -25392,9 +25395,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
- corenet_udp_sendrecv_all_ports($1_t) - corenet_udp_sendrecv_all_ports($1_t)
- corenet_tcp_connect_all_ports($1_t) - corenet_tcp_connect_all_ports($1_t)
- corenet_sendrecv_all_client_packets($1_t) - corenet_sendrecv_all_client_packets($1_t)
+ allow $1 self:tcp_socket create_stream_socket_perms; -
+ allow $1 self:udp_socket create_socket_perms;
- corenet_all_recvfrom_labeled($1_t, $1_t) - corenet_all_recvfrom_labeled($1_t, $1_t)
+ corenet_all_recvfrom_unlabeled($1) + corenet_all_recvfrom_unlabeled($1)
+ corenet_all_recvfrom_netlabel($1) + corenet_all_recvfrom_netlabel($1)
@ -25511,26 +25512,26 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ kernel_get_sysvipc_info($1_usertype) + kernel_get_sysvipc_info($1_usertype)
# Find CDROM devices: # Find CDROM devices:
- kernel_read_device_sysctls($1_t) - kernel_read_device_sysctls($1_t)
-
- corecmd_exec_bin($1_t)
+ kernel_read_device_sysctls($1_usertype) + kernel_read_device_sysctls($1_usertype)
- corenet_udp_bind_all_nodes($1_t) - corecmd_exec_bin($1_t)
- corenet_udp_bind_generic_port($1_t)
+ corenet_udp_bind_all_nodes($1_usertype) + corenet_udp_bind_all_nodes($1_usertype)
+ corenet_udp_bind_generic_port($1_usertype) + corenet_udp_bind_generic_port($1_usertype)
- dev_read_rand($1_t) - corenet_udp_bind_all_nodes($1_t)
- dev_write_sound($1_t) - corenet_udp_bind_generic_port($1_t)
- dev_read_sound($1_t)
- dev_read_sound_mixer($1_t)
- dev_write_sound_mixer($1_t)
+ dev_read_rand($1_usertype) + dev_read_rand($1_usertype)
+ dev_write_sound($1_usertype) + dev_write_sound($1_usertype)
+ dev_read_sound($1_usertype) + dev_read_sound($1_usertype)
+ dev_read_sound_mixer($1_usertype) + dev_read_sound_mixer($1_usertype)
+ dev_write_sound_mixer($1_usertype) + dev_write_sound_mixer($1_usertype)
- dev_read_rand($1_t)
- dev_write_sound($1_t)
- dev_read_sound($1_t)
- dev_read_sound_mixer($1_t)
- dev_write_sound_mixer($1_t)
-
- files_exec_etc_files($1_t) - files_exec_etc_files($1_t)
- files_search_locks($1_t) - files_search_locks($1_t)
+ files_exec_etc_files($1_usertype) + files_exec_etc_files($1_usertype)
@ -25967,29 +25968,29 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(` optional_policy(`
- alsa_read_rw_config($1_t) - alsa_read_rw_config($1_t)
- ') + alsa_read_rw_config($1_usertype)
- ')
- optional_policy(`
optional_policy(`
- dbus_role_template($1, $1_r, $1_t) - dbus_role_template($1, $1_r, $1_t)
- dbus_system_bus_client($1_t) - dbus_system_bus_client($1_t)
- -
- optional_policy(` - optional_policy(`
- consolekit_dbus_chat($1_t) - consolekit_dbus_chat($1_t)
+ alsa_read_rw_config($1_usertype) + apache_role($1_r, $1_usertype)
') ')
optional_policy(` optional_policy(`
- cups_dbus_chat($1_t) - cups_dbus_chat($1_t)
- ') - ')
+ apache_role($1_r, $1_usertype)
')
optional_policy(`
- java_role($1_r, $1_t)
+ openoffice_role_template($1, $1_r, $1_usertype) + openoffice_role_template($1, $1_r, $1_usertype)
') ')
optional_policy(` optional_policy(`
- java_role($1_r, $1_t)
- ')
-
- optional_policy(`
- setroubleshoot_dontaudit_stream_connect($1_t) - setroubleshoot_dontaudit_stream_connect($1_t)
+ polkit_role($1_r, $1_usertype) + polkit_role($1_r, $1_usertype)
') ')
@ -26413,7 +26414,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Send a dbus message to all user domains. ## Send a dbus message to all user domains.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -2981,3 +3165,226 @@ @@ -2981,3 +3165,247 @@
allow $1 userdomain:dbus send_msg; allow $1 userdomain:dbus send_msg;
') ')
@ -26638,7 +26639,28 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ attribute + attribute
+ ') + ')
+ +
+ allow $1 unpriv_userdomain;:unix_dgram_socket sendto; + allow $1 unpriv_userdomain:unix_dgram_socket sendto;
+')
+
+
+
+#######################################
+## <summary>
+## Allow execmod on files in homedirectory
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolebase/>
+#
+interface(`userdom_execmod_user_home_files',`
+ gen_require(`
+ type user_home_t;
+ ')
+
+ allow $1 user_home_t:file execmod;
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.6.1/policy/modules/system/userdomain.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.6.1/policy/modules/system/userdomain.te
--- nsaserefpolicy/policy/modules/system/userdomain.te 2008-11-13 18:40:02.000000000 -0500 --- nsaserefpolicy/policy/modules/system/userdomain.te 2008-11-13 18:40:02.000000000 -0500