rpms/selinux-policy
6
0
Fork 0
Code Issues Pull Requests Releases Activity

- Prepare policy for beta release

Browse Source 
- Change some of the system domains back to unconfined
- Turn on some of the booleans
This commit is contained in:
Daniel J Walsh 2008-02-28 05:01:51 +00:00
parent 40ce26840e
commit b7229ad8bb
3 changed files with 25 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
booleans-targeted.conf
View File

@ -1,14 +1,14 @@
# Allow making anonymous memory executable, e.g.for runtime-code generation or executable stack. # Allow making anonymous memory executable, e.g.for runtime-code generation or executable stack.
# #
allow_execmem = false allow_execmem = true
# Allow making a modified private filemapping executable (text relocation). # Allow making a modified private filemapping executable (text relocation).
# #
allow_execmod = false allow_execmod = true
# Allow making the stack executable via mprotect.Also requires allow_execmem. # Allow making the stack executable via mprotect.Also requires allow_execmem.
# #
allow_execstack = false allow_execstack = true
# Allow ftpd to read cifs directories. # Allow ftpd to read cifs directories.
# #
@ -266,3 +266,11 @@ user_rw_noexattrfile=true
# Allow qemu to connect fully to the network # Allow qemu to connect fully to the network
# #
allow_qemu_full_network=true allow_qemu_full_network=true
# Allow nsplugin execmem/execstack for bad plugins
#
allow_nsplugin_execmem=true
# Allow unconfined domain to transition to confined domain
#
allow_unconfined_nsplugin_transition=true

18
policy-20071130.patch
View File

@ -4127,7 +4127,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
+ +
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.3.1/policy/modules/apps/java.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.3.1/policy/modules/apps/java.te
--- nsaserefpolicy/policy/modules/apps/java.te 2007-12-19 05:32:09.000000000 -0500 --- nsaserefpolicy/policy/modules/apps/java.te 2007-12-19 05:32:09.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/apps/java.te 2008-02-26 08:29:22.000000000 -0500 +++ serefpolicy-3.3.1/policy/modules/apps/java.te 2008-02-27 23:56:52.000000000 -0500
@@ -6,16 +6,10 @@ @@ -6,16 +6,10 @@
# Declarations # Declarations
# #
@ -4146,7 +4146,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te
######################################## ########################################
# #
@@ -23,11 +17,23 @@ @@ -23,11 +17,28 @@
# #
# execheap is needed for itanium/BEA jrocket # execheap is needed for itanium/BEA jrocket
@ -4163,16 +4163,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te
+ optional_policy(` + optional_policy(`
+ unconfined_dbus_chat(java_t) + unconfined_dbus_chat(java_t)
+ ') + ')
+')
+
+optional_policy(`
+ rpm_domtrans(java_t)
+') +')
optional_policy(` optional_policy(`
unconfined_domain_noaudit(java_t) unconfined_domain_noaudit(java_t)
- unconfined_dbus_chat(java_t) - unconfined_dbus_chat(java_t)
+') ')
+ +
+optional_policy(` +optional_policy(`
+ xserver_xdm_rw_shm(java_t) + xserver_xdm_rw_shm(java_t)
') +')
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.te serefpolicy-3.3.1/policy/modules/apps/loadkeys.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.te serefpolicy-3.3.1/policy/modules/apps/loadkeys.te
--- nsaserefpolicy/policy/modules/apps/loadkeys.te 2007-12-19 05:32:09.000000000 -0500 --- nsaserefpolicy/policy/modules/apps/loadkeys.te 2007-12-19 05:32:09.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/apps/loadkeys.te 2008-02-26 08:29:22.000000000 -0500 +++ serefpolicy-3.3.1/policy/modules/apps/loadkeys.te 2008-02-26 08:29:22.000000000 -0500
@ -26657,8 +26662,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/qemu.f
+/usr/bin/qemu-kvm -- gen_context(system_u:object_r:qemu_exec_t,s0) +/usr/bin/qemu-kvm -- gen_context(system_u:object_r:qemu_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/qemu.if serefpolicy-3.3.1/policy/modules/system/qemu.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/qemu.if serefpolicy-3.3.1/policy/modules/system/qemu.if
--- nsaserefpolicy/policy/modules/system/qemu.if 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/system/qemu.if 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/system/qemu.if 2008-02-26 08:29:22.000000000 -0500 +++ serefpolicy-3.3.1/policy/modules/system/qemu.if 2008-02-27 23:40:38.000000000 -0500
@@ -0,0 +1,290 @@ @@ -0,0 +1,291 @@
+ +
+## <summary>policy for qemu</summary> +## <summary>policy for qemu</summary>
+ +
@ -26896,6 +26901,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/qemu.i
+ +
+ domain_use_interactive_fds($1_t) + domain_use_interactive_fds($1_t)
+ +
+ allow $1_t self:capability { dac_read_search dac_override };
+ allow $1_t self:process { execstack execmem signal getsched }; + allow $1_t self:process { execstack execmem signal getsched };
+ allow $1_t self:tcp_socket create_stream_socket_perms; + allow $1_t self:tcp_socket create_stream_socket_perms;
+ +

2
selinux-policy.spec
View File

@ -17,7 +17,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.3.1 Version: 3.3.1
Release: 5%{?dist} Release: 6%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz