- Allow all domains that can use cgroups to search tmpfs_t directory
- Allow init to send audit messages
This commit is contained in:
parent
a0e8efd42c
commit
ba8c31f5cd
214
policy-F14.patch
214
policy-F14.patch
@ -5473,10 +5473,10 @@ index 0000000..5dd356f
|
|||||||
+')
|
+')
|
||||||
diff --git a/policy/modules/apps/sandbox.te b/policy/modules/apps/sandbox.te
|
diff --git a/policy/modules/apps/sandbox.te b/policy/modules/apps/sandbox.te
|
||||||
new file mode 100644
|
new file mode 100644
|
||||||
index 0000000..942bb30
|
index 0000000..2251b02
|
||||||
--- /dev/null
|
--- /dev/null
|
||||||
+++ b/policy/modules/apps/sandbox.te
|
+++ b/policy/modules/apps/sandbox.te
|
||||||
@@ -0,0 +1,400 @@
|
@@ -0,0 +1,407 @@
|
||||||
+policy_module(sandbox,1.0.0)
|
+policy_module(sandbox,1.0.0)
|
||||||
+dbus_stub()
|
+dbus_stub()
|
||||||
+attribute sandbox_domain;
|
+attribute sandbox_domain;
|
||||||
@ -5741,6 +5741,13 @@ index 0000000..942bb30
|
|||||||
+ hal_dbus_chat(sandbox_x_client_t)
|
+ hal_dbus_chat(sandbox_x_client_t)
|
||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
|
+
|
||||||
|
+allow sandbox_web_t self:process setsched;
|
||||||
|
+
|
||||||
|
+optional_policy(`
|
||||||
|
+ nsplugin_read_rw_files(sandbox_web_t)
|
||||||
|
+')
|
||||||
|
+
|
||||||
+########################################
|
+########################################
|
||||||
+#
|
+#
|
||||||
+# sandbox_web_client_t local policy
|
+# sandbox_web_client_t local policy
|
||||||
@ -8580,10 +8587,74 @@ index 59bae6a..16f0f9e 100644
|
|||||||
+/dev/hugepages -d gen_context(system_u:object_r:hugetlbfs_t,s0)
|
+/dev/hugepages -d gen_context(system_u:object_r:hugetlbfs_t,s0)
|
||||||
+/dev/hugepages(/.*)? <<none>>
|
+/dev/hugepages(/.*)? <<none>>
|
||||||
diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
|
diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
|
||||||
index 437a42a..8d6d333 100644
|
index 437a42a..4eecefb 100644
|
||||||
--- a/policy/modules/kernel/filesystem.if
|
--- a/policy/modules/kernel/filesystem.if
|
||||||
+++ b/policy/modules/kernel/filesystem.if
|
+++ b/policy/modules/kernel/filesystem.if
|
||||||
@@ -1241,7 +1241,7 @@ interface(`fs_dontaudit_rw_cifs_files',`
|
@@ -646,6 +646,7 @@ interface(`fs_search_cgroup_dirs',`
|
||||||
|
')
|
||||||
|
|
||||||
|
search_dirs_pattern($1, cgroup_t, cgroup_t)
|
||||||
|
+ fs_search_tmpfs($1)
|
||||||
|
dev_search_sysfs($1)
|
||||||
|
')
|
||||||
|
|
||||||
|
@@ -665,6 +666,7 @@ interface(`fs_list_cgroup_dirs', `
|
||||||
|
')
|
||||||
|
|
||||||
|
list_dirs_pattern($1, cgroup_t, cgroup_t)
|
||||||
|
+ fs_search_tmpfs($1)
|
||||||
|
dev_search_sysfs($1)
|
||||||
|
')
|
||||||
|
|
||||||
|
@@ -684,6 +686,7 @@ interface(`fs_delete_cgroup_dirs', `
|
||||||
|
')
|
||||||
|
|
||||||
|
delete_dirs_pattern($1, cgroup_t, cgroup_t)
|
||||||
|
+ fs_search_tmpfs($1)
|
||||||
|
dev_search_sysfs($1)
|
||||||
|
')
|
||||||
|
|
||||||
|
@@ -704,6 +707,7 @@ interface(`fs_manage_cgroup_dirs',`
|
||||||
|
')
|
||||||
|
|
||||||
|
manage_dirs_pattern($1, cgroup_t, cgroup_t)
|
||||||
|
+ fs_search_tmpfs($1)
|
||||||
|
dev_search_sysfs($1)
|
||||||
|
')
|
||||||
|
|
||||||
|
@@ -724,6 +728,7 @@ interface(`fs_read_cgroup_files',`
|
||||||
|
')
|
||||||
|
|
||||||
|
read_files_pattern($1, cgroup_t, cgroup_t)
|
||||||
|
+ fs_search_tmpfs($1)
|
||||||
|
dev_search_sysfs($1)
|
||||||
|
')
|
||||||
|
|
||||||
|
@@ -743,6 +748,7 @@ interface(`fs_write_cgroup_files', `
|
||||||
|
')
|
||||||
|
|
||||||
|
write_files_pattern($1, cgroup_t, cgroup_t)
|
||||||
|
+ fs_search_tmpfs($1)
|
||||||
|
dev_search_sysfs($1)
|
||||||
|
')
|
||||||
|
|
||||||
|
@@ -763,6 +769,7 @@ interface(`fs_rw_cgroup_files',`
|
||||||
|
')
|
||||||
|
|
||||||
|
rw_files_pattern($1, cgroup_t, cgroup_t)
|
||||||
|
+ fs_search_tmpfs($1)
|
||||||
|
dev_search_sysfs($1)
|
||||||
|
')
|
||||||
|
|
||||||
|
@@ -803,6 +810,7 @@ interface(`fs_manage_cgroup_files',`
|
||||||
|
')
|
||||||
|
|
||||||
|
manage_files_pattern($1, cgroup_t, cgroup_t)
|
||||||
|
+ fs_search_tmpfs($1)
|
||||||
|
dev_search_sysfs($1)
|
||||||
|
')
|
||||||
|
|
||||||
|
@@ -1241,7 +1249,7 @@ interface(`fs_dontaudit_rw_cifs_files',`
|
||||||
type cifs_t;
|
type cifs_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -8592,7 +8663,7 @@ index 437a42a..8d6d333 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -1504,6 +1504,25 @@ interface(`fs_cifs_domtrans',`
|
@@ -1504,6 +1512,25 @@ interface(`fs_cifs_domtrans',`
|
||||||
domain_auto_transition_pattern($1, cifs_t, $2)
|
domain_auto_transition_pattern($1, cifs_t, $2)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -8618,7 +8689,7 @@ index 437a42a..8d6d333 100644
|
|||||||
#######################################
|
#######################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Create, read, write, and delete dirs
|
## Create, read, write, and delete dirs
|
||||||
@@ -1931,7 +1950,26 @@ interface(`fs_read_fusefs_symlinks',`
|
@@ -1931,7 +1958,26 @@ interface(`fs_read_fusefs_symlinks',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -8646,7 +8717,7 @@ index 437a42a..8d6d333 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -1946,6 +1984,41 @@ interface(`fs_rw_hugetlbfs_files',`
|
@@ -1946,6 +1992,41 @@ interface(`fs_rw_hugetlbfs_files',`
|
||||||
|
|
||||||
rw_files_pattern($1, hugetlbfs_t, hugetlbfs_t)
|
rw_files_pattern($1, hugetlbfs_t, hugetlbfs_t)
|
||||||
')
|
')
|
||||||
@ -8688,7 +8759,7 @@ index 437a42a..8d6d333 100644
|
|||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -1999,6 +2072,7 @@ interface(`fs_list_inotifyfs',`
|
@@ -1999,6 +2080,7 @@ interface(`fs_list_inotifyfs',`
|
||||||
')
|
')
|
||||||
|
|
||||||
allow $1 inotifyfs_t:dir list_dir_perms;
|
allow $1 inotifyfs_t:dir list_dir_perms;
|
||||||
@ -8696,7 +8767,7 @@ index 437a42a..8d6d333 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -2395,6 +2469,25 @@ interface(`fs_exec_nfs_files',`
|
@@ -2395,6 +2477,25 @@ interface(`fs_exec_nfs_files',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -8722,7 +8793,7 @@ index 437a42a..8d6d333 100644
|
|||||||
## Append files
|
## Append files
|
||||||
## on a NFS filesystem.
|
## on a NFS filesystem.
|
||||||
## </summary>
|
## </summary>
|
||||||
@@ -2449,7 +2542,7 @@ interface(`fs_dontaudit_rw_nfs_files',`
|
@@ -2449,7 +2550,7 @@ interface(`fs_dontaudit_rw_nfs_files',`
|
||||||
type nfs_t;
|
type nfs_t;
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -8731,7 +8802,7 @@ index 437a42a..8d6d333 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -2637,6 +2730,24 @@ interface(`fs_dontaudit_read_removable_files',`
|
@@ -2637,6 +2738,24 @@ interface(`fs_dontaudit_read_removable_files',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -8756,7 +8827,7 @@ index 437a42a..8d6d333 100644
|
|||||||
## Read removable storage symbolic links.
|
## Read removable storage symbolic links.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -2845,7 +2956,7 @@ interface(`fs_dontaudit_manage_nfs_files',`
|
@@ -2845,7 +2964,7 @@ interface(`fs_dontaudit_manage_nfs_files',`
|
||||||
#########################################
|
#########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Create, read, write, and delete symbolic links
|
## Create, read, write, and delete symbolic links
|
||||||
@ -8765,7 +8836,7 @@ index 437a42a..8d6d333 100644
|
|||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
## <summary>
|
## <summary>
|
||||||
@@ -3970,6 +4081,24 @@ interface(`fs_dontaudit_use_tmpfs_chr_dev',`
|
@@ -3970,6 +4089,24 @@ interface(`fs_dontaudit_use_tmpfs_chr_dev',`
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -8790,7 +8861,7 @@ index 437a42a..8d6d333 100644
|
|||||||
## Relabel character nodes on tmpfs filesystems.
|
## Relabel character nodes on tmpfs filesystems.
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@@ -4662,3 +4791,24 @@ interface(`fs_unconfined',`
|
@@ -4662,3 +4799,24 @@ interface(`fs_unconfined',`
|
||||||
|
|
||||||
typeattribute $1 filesystem_unconfined_type;
|
typeattribute $1 filesystem_unconfined_type;
|
||||||
')
|
')
|
||||||
@ -22626,7 +22697,7 @@ index 06e37d4..87043e1 100644
|
|||||||
+userdom_home_filetrans_user_home_dir(postfix_virtual_t)
|
+userdom_home_filetrans_user_home_dir(postfix_virtual_t)
|
||||||
+userdom_user_home_dir_filetrans_user_home_content(postfix_virtual_t, {file dir })
|
+userdom_user_home_dir_filetrans_user_home_content(postfix_virtual_t, {file dir })
|
||||||
diff --git a/policy/modules/services/postgresql.te b/policy/modules/services/postgresql.te
|
diff --git a/policy/modules/services/postgresql.te b/policy/modules/services/postgresql.te
|
||||||
index c0652ec..a5b6508 100644
|
index c0652ec..0ed1671 100644
|
||||||
--- a/policy/modules/services/postgresql.te
|
--- a/policy/modules/services/postgresql.te
|
||||||
+++ b/policy/modules/services/postgresql.te
|
+++ b/policy/modules/services/postgresql.te
|
||||||
@@ -202,9 +202,10 @@ manage_sock_files_pattern(postgresql_t, postgresql_tmp_t, postgresql_tmp_t)
|
@@ -202,9 +202,10 @@ manage_sock_files_pattern(postgresql_t, postgresql_tmp_t, postgresql_tmp_t)
|
||||||
@ -22641,6 +22712,16 @@ index c0652ec..a5b6508 100644
|
|||||||
|
|
||||||
kernel_read_kernel_sysctls(postgresql_t)
|
kernel_read_kernel_sysctls(postgresql_t)
|
||||||
kernel_read_system_state(postgresql_t)
|
kernel_read_system_state(postgresql_t)
|
||||||
|
@@ -250,8 +251,7 @@ domain_dontaudit_list_all_domains_state(postgresql_t)
|
||||||
|
domain_use_interactive_fds(postgresql_t)
|
||||||
|
|
||||||
|
files_dontaudit_search_home(postgresql_t)
|
||||||
|
-files_manage_etc_files(postgresql_t)
|
||||||
|
-files_search_etc(postgresql_t)
|
||||||
|
+files_read_etc_files(postgresql_t)
|
||||||
|
files_read_etc_runtime_files(postgresql_t)
|
||||||
|
files_read_usr_files(postgresql_t)
|
||||||
|
|
||||||
diff --git a/policy/modules/services/postgrey.te b/policy/modules/services/postgrey.te
|
diff --git a/policy/modules/services/postgrey.te b/policy/modules/services/postgrey.te
|
||||||
index 2c066b0..afaf453 100644
|
index 2c066b0..afaf453 100644
|
||||||
--- a/policy/modules/services/postgrey.te
|
--- a/policy/modules/services/postgrey.te
|
||||||
@ -26969,7 +27050,7 @@ index 7c5d8d8..1a0701b 100644
|
|||||||
+')
|
+')
|
||||||
+
|
+
|
||||||
diff --git a/policy/modules/services/virt.te b/policy/modules/services/virt.te
|
diff --git a/policy/modules/services/virt.te b/policy/modules/services/virt.te
|
||||||
index 3eca020..f38e1ce 100644
|
index 3eca020..91a1d0a 100644
|
||||||
--- a/policy/modules/services/virt.te
|
--- a/policy/modules/services/virt.te
|
||||||
+++ b/policy/modules/services/virt.te
|
+++ b/policy/modules/services/virt.te
|
||||||
@@ -4,6 +4,7 @@ policy_module(virt, 1.4.0)
|
@@ -4,6 +4,7 @@ policy_module(virt, 1.4.0)
|
||||||
@ -27191,7 +27272,7 @@ index 3eca020..f38e1ce 100644
|
|||||||
|
|
||||||
fs_list_auto_mountpoints(virtd_t)
|
fs_list_auto_mountpoints(virtd_t)
|
||||||
fs_getattr_xattr_fs(virtd_t)
|
fs_getattr_xattr_fs(virtd_t)
|
||||||
@@ -262,6 +315,17 @@ fs_rw_anon_inodefs_files(virtd_t)
|
@@ -262,6 +315,18 @@ fs_rw_anon_inodefs_files(virtd_t)
|
||||||
fs_list_inotifyfs(virtd_t)
|
fs_list_inotifyfs(virtd_t)
|
||||||
fs_manage_cgroup_dirs(virtd_t)
|
fs_manage_cgroup_dirs(virtd_t)
|
||||||
fs_rw_cgroup_files(virtd_t)
|
fs_rw_cgroup_files(virtd_t)
|
||||||
@ -27201,6 +27282,7 @@ index 3eca020..f38e1ce 100644
|
|||||||
+mls_fd_share_all_levels(virtd_t)
|
+mls_fd_share_all_levels(virtd_t)
|
||||||
+mls_file_read_to_clearance(virtd_t)
|
+mls_file_read_to_clearance(virtd_t)
|
||||||
+mls_file_write_to_clearance(virtd_t)
|
+mls_file_write_to_clearance(virtd_t)
|
||||||
|
+mls_process_read_to_clearance(virtd_t)
|
||||||
+mls_process_write_to_clearance(virtd_t)
|
+mls_process_write_to_clearance(virtd_t)
|
||||||
+mls_net_write_within_range(virtd_t)
|
+mls_net_write_within_range(virtd_t)
|
||||||
+mls_socket_write_to_clearance(virtd_t)
|
+mls_socket_write_to_clearance(virtd_t)
|
||||||
@ -27209,7 +27291,7 @@ index 3eca020..f38e1ce 100644
|
|||||||
|
|
||||||
mcs_process_set_categories(virtd_t)
|
mcs_process_set_categories(virtd_t)
|
||||||
|
|
||||||
@@ -286,15 +350,24 @@ modutils_manage_module_config(virtd_t)
|
@@ -286,15 +351,24 @@ modutils_manage_module_config(virtd_t)
|
||||||
|
|
||||||
logging_send_syslog_msg(virtd_t)
|
logging_send_syslog_msg(virtd_t)
|
||||||
|
|
||||||
@ -27234,7 +27316,7 @@ index 3eca020..f38e1ce 100644
|
|||||||
|
|
||||||
tunable_policy(`virt_use_nfs',`
|
tunable_policy(`virt_use_nfs',`
|
||||||
fs_manage_nfs_dirs(virtd_t)
|
fs_manage_nfs_dirs(virtd_t)
|
||||||
@@ -365,6 +438,8 @@ optional_policy(`
|
@@ -365,6 +439,8 @@ optional_policy(`
|
||||||
qemu_signal(virtd_t)
|
qemu_signal(virtd_t)
|
||||||
qemu_kill(virtd_t)
|
qemu_kill(virtd_t)
|
||||||
qemu_setsched(virtd_t)
|
qemu_setsched(virtd_t)
|
||||||
@ -27243,7 +27325,7 @@ index 3eca020..f38e1ce 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -402,6 +477,19 @@ allow virt_domain self:unix_stream_socket create_stream_socket_perms;
|
@@ -402,6 +478,19 @@ allow virt_domain self:unix_stream_socket create_stream_socket_perms;
|
||||||
allow virt_domain self:unix_dgram_socket { create_socket_perms sendto };
|
allow virt_domain self:unix_dgram_socket { create_socket_perms sendto };
|
||||||
allow virt_domain self:tcp_socket create_stream_socket_perms;
|
allow virt_domain self:tcp_socket create_stream_socket_perms;
|
||||||
|
|
||||||
@ -27263,7 +27345,7 @@ index 3eca020..f38e1ce 100644
|
|||||||
append_files_pattern(virt_domain, virt_log_t, virt_log_t)
|
append_files_pattern(virt_domain, virt_log_t, virt_log_t)
|
||||||
|
|
||||||
append_files_pattern(virt_domain, virt_var_lib_t, virt_var_lib_t)
|
append_files_pattern(virt_domain, virt_var_lib_t, virt_var_lib_t)
|
||||||
@@ -422,6 +510,7 @@ corenet_rw_tun_tap_dev(virt_domain)
|
@@ -422,6 +511,7 @@ corenet_rw_tun_tap_dev(virt_domain)
|
||||||
corenet_tcp_bind_virt_migration_port(virt_domain)
|
corenet_tcp_bind_virt_migration_port(virt_domain)
|
||||||
corenet_tcp_connect_virt_migration_port(virt_domain)
|
corenet_tcp_connect_virt_migration_port(virt_domain)
|
||||||
|
|
||||||
@ -27271,7 +27353,7 @@ index 3eca020..f38e1ce 100644
|
|||||||
dev_read_rand(virt_domain)
|
dev_read_rand(virt_domain)
|
||||||
dev_read_sound(virt_domain)
|
dev_read_sound(virt_domain)
|
||||||
dev_read_urand(virt_domain)
|
dev_read_urand(virt_domain)
|
||||||
@@ -429,10 +518,12 @@ dev_write_sound(virt_domain)
|
@@ -429,10 +519,12 @@ dev_write_sound(virt_domain)
|
||||||
dev_rw_ksm(virt_domain)
|
dev_rw_ksm(virt_domain)
|
||||||
dev_rw_kvm(virt_domain)
|
dev_rw_kvm(virt_domain)
|
||||||
dev_rw_qemu(virt_domain)
|
dev_rw_qemu(virt_domain)
|
||||||
@ -27284,7 +27366,7 @@ index 3eca020..f38e1ce 100644
|
|||||||
files_read_usr_files(virt_domain)
|
files_read_usr_files(virt_domain)
|
||||||
files_read_var_files(virt_domain)
|
files_read_var_files(virt_domain)
|
||||||
files_search_all(virt_domain)
|
files_search_all(virt_domain)
|
||||||
@@ -440,6 +531,11 @@ files_search_all(virt_domain)
|
@@ -440,6 +532,11 @@ files_search_all(virt_domain)
|
||||||
fs_getattr_tmpfs(virt_domain)
|
fs_getattr_tmpfs(virt_domain)
|
||||||
fs_rw_anon_inodefs_files(virt_domain)
|
fs_rw_anon_inodefs_files(virt_domain)
|
||||||
fs_rw_tmpfs_files(virt_domain)
|
fs_rw_tmpfs_files(virt_domain)
|
||||||
@ -27296,7 +27378,7 @@ index 3eca020..f38e1ce 100644
|
|||||||
|
|
||||||
term_use_all_terms(virt_domain)
|
term_use_all_terms(virt_domain)
|
||||||
term_getattr_pty_fs(virt_domain)
|
term_getattr_pty_fs(virt_domain)
|
||||||
@@ -457,8 +553,121 @@ optional_policy(`
|
@@ -457,8 +554,121 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -30493,7 +30575,7 @@ index f6aafe7..447aaec 100644
|
|||||||
+ allow $1 init_t:unix_stream_socket rw_stream_socket_perms;
|
+ allow $1 init_t:unix_stream_socket rw_stream_socket_perms;
|
||||||
+')
|
+')
|
||||||
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
|
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
|
||||||
index 698c11e..e0dc975 100644
|
index 698c11e..1b6733f 100644
|
||||||
--- a/policy/modules/system/init.te
|
--- a/policy/modules/system/init.te
|
||||||
+++ b/policy/modules/system/init.te
|
+++ b/policy/modules/system/init.te
|
||||||
@@ -16,6 +16,27 @@ gen_require(`
|
@@ -16,6 +16,27 @@ gen_require(`
|
||||||
@ -30590,7 +30672,14 @@ index 698c11e..e0dc975 100644
|
|||||||
files_rw_generic_pids(init_t)
|
files_rw_generic_pids(init_t)
|
||||||
files_dontaudit_search_isid_type_dirs(init_t)
|
files_dontaudit_search_isid_type_dirs(init_t)
|
||||||
files_manage_etc_runtime_files(init_t)
|
files_manage_etc_runtime_files(init_t)
|
||||||
@@ -168,6 +197,8 @@ seutil_read_config(init_t)
|
@@ -162,12 +191,15 @@ init_domtrans_script(init_t)
|
||||||
|
libs_rw_ld_so_cache(init_t)
|
||||||
|
|
||||||
|
logging_send_syslog_msg(init_t)
|
||||||
|
+logging_send_audit_msgs(init_t)
|
||||||
|
logging_rw_generic_logs(init_t)
|
||||||
|
|
||||||
|
seutil_read_config(init_t)
|
||||||
|
|
||||||
miscfiles_read_localization(init_t)
|
miscfiles_read_localization(init_t)
|
||||||
|
|
||||||
@ -30599,7 +30688,7 @@ index 698c11e..e0dc975 100644
|
|||||||
ifdef(`distro_gentoo',`
|
ifdef(`distro_gentoo',`
|
||||||
allow init_t self:process { getcap setcap };
|
allow init_t self:process { getcap setcap };
|
||||||
')
|
')
|
||||||
@@ -178,7 +209,7 @@ ifdef(`distro_redhat',`
|
@@ -178,7 +210,7 @@ ifdef(`distro_redhat',`
|
||||||
fs_tmpfs_filetrans(init_t, initctl_t, fifo_file)
|
fs_tmpfs_filetrans(init_t, initctl_t, fifo_file)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -30608,7 +30697,7 @@ index 698c11e..e0dc975 100644
|
|||||||
corecmd_shell_domtrans(init_t, initrc_t)
|
corecmd_shell_domtrans(init_t, initrc_t)
|
||||||
',`
|
',`
|
||||||
# Run the shell in the sysadm role for single-user mode.
|
# Run the shell in the sysadm role for single-user mode.
|
||||||
@@ -186,12 +217,74 @@ tunable_policy(`init_upstart',`
|
@@ -186,12 +218,74 @@ tunable_policy(`init_upstart',`
|
||||||
sysadm_shell_domtrans(init_t)
|
sysadm_shell_domtrans(init_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -30683,7 +30772,7 @@ index 698c11e..e0dc975 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -199,10 +292,19 @@ optional_policy(`
|
@@ -199,10 +293,19 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -30703,7 +30792,7 @@ index 698c11e..e0dc975 100644
|
|||||||
unconfined_domain(init_t)
|
unconfined_domain(init_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -212,7 +314,7 @@ optional_policy(`
|
@@ -212,7 +315,7 @@ optional_policy(`
|
||||||
#
|
#
|
||||||
|
|
||||||
allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
|
allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
|
||||||
@ -30712,7 +30801,7 @@ index 698c11e..e0dc975 100644
|
|||||||
dontaudit initrc_t self:capability sys_module; # sysctl is triggering this
|
dontaudit initrc_t self:capability sys_module; # sysctl is triggering this
|
||||||
allow initrc_t self:passwd rootok;
|
allow initrc_t self:passwd rootok;
|
||||||
allow initrc_t self:key manage_key_perms;
|
allow initrc_t self:key manage_key_perms;
|
||||||
@@ -241,6 +343,7 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
|
@@ -241,6 +344,7 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
|
||||||
|
|
||||||
allow initrc_t initrc_var_run_t:file manage_file_perms;
|
allow initrc_t initrc_var_run_t:file manage_file_perms;
|
||||||
files_pid_filetrans(initrc_t, initrc_var_run_t, file)
|
files_pid_filetrans(initrc_t, initrc_var_run_t, file)
|
||||||
@ -30720,7 +30809,7 @@ index 698c11e..e0dc975 100644
|
|||||||
|
|
||||||
can_exec(initrc_t, initrc_tmp_t)
|
can_exec(initrc_t, initrc_tmp_t)
|
||||||
manage_files_pattern(initrc_t, initrc_tmp_t, initrc_tmp_t)
|
manage_files_pattern(initrc_t, initrc_tmp_t, initrc_tmp_t)
|
||||||
@@ -258,11 +361,22 @@ kernel_change_ring_buffer_level(initrc_t)
|
@@ -258,11 +362,22 @@ kernel_change_ring_buffer_level(initrc_t)
|
||||||
kernel_clear_ring_buffer(initrc_t)
|
kernel_clear_ring_buffer(initrc_t)
|
||||||
kernel_get_sysvipc_info(initrc_t)
|
kernel_get_sysvipc_info(initrc_t)
|
||||||
kernel_read_all_sysctls(initrc_t)
|
kernel_read_all_sysctls(initrc_t)
|
||||||
@ -30743,7 +30832,7 @@ index 698c11e..e0dc975 100644
|
|||||||
|
|
||||||
corecmd_exec_all_executables(initrc_t)
|
corecmd_exec_all_executables(initrc_t)
|
||||||
|
|
||||||
@@ -291,6 +405,7 @@ dev_read_sound_mixer(initrc_t)
|
@@ -291,6 +406,7 @@ dev_read_sound_mixer(initrc_t)
|
||||||
dev_write_sound_mixer(initrc_t)
|
dev_write_sound_mixer(initrc_t)
|
||||||
dev_setattr_all_chr_files(initrc_t)
|
dev_setattr_all_chr_files(initrc_t)
|
||||||
dev_rw_lvm_control(initrc_t)
|
dev_rw_lvm_control(initrc_t)
|
||||||
@ -30751,7 +30840,7 @@ index 698c11e..e0dc975 100644
|
|||||||
dev_delete_lvm_control_dev(initrc_t)
|
dev_delete_lvm_control_dev(initrc_t)
|
||||||
dev_manage_generic_symlinks(initrc_t)
|
dev_manage_generic_symlinks(initrc_t)
|
||||||
dev_manage_generic_files(initrc_t)
|
dev_manage_generic_files(initrc_t)
|
||||||
@@ -298,13 +413,13 @@ dev_manage_generic_files(initrc_t)
|
@@ -298,13 +414,13 @@ dev_manage_generic_files(initrc_t)
|
||||||
dev_delete_generic_symlinks(initrc_t)
|
dev_delete_generic_symlinks(initrc_t)
|
||||||
dev_getattr_all_blk_files(initrc_t)
|
dev_getattr_all_blk_files(initrc_t)
|
||||||
dev_getattr_all_chr_files(initrc_t)
|
dev_getattr_all_chr_files(initrc_t)
|
||||||
@ -30767,7 +30856,7 @@ index 698c11e..e0dc975 100644
|
|||||||
domain_sigchld_all_domains(initrc_t)
|
domain_sigchld_all_domains(initrc_t)
|
||||||
domain_read_all_domains_state(initrc_t)
|
domain_read_all_domains_state(initrc_t)
|
||||||
domain_getattr_all_domains(initrc_t)
|
domain_getattr_all_domains(initrc_t)
|
||||||
@@ -323,8 +438,10 @@ files_getattr_all_symlinks(initrc_t)
|
@@ -323,8 +439,10 @@ files_getattr_all_symlinks(initrc_t)
|
||||||
files_getattr_all_pipes(initrc_t)
|
files_getattr_all_pipes(initrc_t)
|
||||||
files_getattr_all_sockets(initrc_t)
|
files_getattr_all_sockets(initrc_t)
|
||||||
files_purge_tmp(initrc_t)
|
files_purge_tmp(initrc_t)
|
||||||
@ -30779,7 +30868,7 @@ index 698c11e..e0dc975 100644
|
|||||||
files_delete_all_pids(initrc_t)
|
files_delete_all_pids(initrc_t)
|
||||||
files_delete_all_pid_dirs(initrc_t)
|
files_delete_all_pid_dirs(initrc_t)
|
||||||
files_read_etc_files(initrc_t)
|
files_read_etc_files(initrc_t)
|
||||||
@@ -340,8 +457,12 @@ files_list_isid_type_dirs(initrc_t)
|
@@ -340,8 +458,12 @@ files_list_isid_type_dirs(initrc_t)
|
||||||
files_mounton_isid_type_dirs(initrc_t)
|
files_mounton_isid_type_dirs(initrc_t)
|
||||||
files_list_default(initrc_t)
|
files_list_default(initrc_t)
|
||||||
files_mounton_default(initrc_t)
|
files_mounton_default(initrc_t)
|
||||||
@ -30793,7 +30882,7 @@ index 698c11e..e0dc975 100644
|
|||||||
fs_list_inotifyfs(initrc_t)
|
fs_list_inotifyfs(initrc_t)
|
||||||
fs_register_binary_executable_type(initrc_t)
|
fs_register_binary_executable_type(initrc_t)
|
||||||
# rhgb-console writes to ramfs
|
# rhgb-console writes to ramfs
|
||||||
@@ -351,6 +472,8 @@ fs_mount_all_fs(initrc_t)
|
@@ -351,6 +473,8 @@ fs_mount_all_fs(initrc_t)
|
||||||
fs_unmount_all_fs(initrc_t)
|
fs_unmount_all_fs(initrc_t)
|
||||||
fs_remount_all_fs(initrc_t)
|
fs_remount_all_fs(initrc_t)
|
||||||
fs_getattr_all_fs(initrc_t)
|
fs_getattr_all_fs(initrc_t)
|
||||||
@ -30802,7 +30891,7 @@ index 698c11e..e0dc975 100644
|
|||||||
|
|
||||||
# initrc_t needs to do a pidof which requires ptrace
|
# initrc_t needs to do a pidof which requires ptrace
|
||||||
mcs_ptrace_all(initrc_t)
|
mcs_ptrace_all(initrc_t)
|
||||||
@@ -363,6 +486,7 @@ mls_process_read_up(initrc_t)
|
@@ -363,6 +487,7 @@ mls_process_read_up(initrc_t)
|
||||||
mls_process_write_down(initrc_t)
|
mls_process_write_down(initrc_t)
|
||||||
mls_rangetrans_source(initrc_t)
|
mls_rangetrans_source(initrc_t)
|
||||||
mls_fd_share_all_levels(initrc_t)
|
mls_fd_share_all_levels(initrc_t)
|
||||||
@ -30810,7 +30899,7 @@ index 698c11e..e0dc975 100644
|
|||||||
|
|
||||||
selinux_get_enforce_mode(initrc_t)
|
selinux_get_enforce_mode(initrc_t)
|
||||||
|
|
||||||
@@ -394,13 +518,14 @@ logging_read_audit_config(initrc_t)
|
@@ -394,13 +519,14 @@ logging_read_audit_config(initrc_t)
|
||||||
|
|
||||||
miscfiles_read_localization(initrc_t)
|
miscfiles_read_localization(initrc_t)
|
||||||
# slapd needs to read cert files from its initscript
|
# slapd needs to read cert files from its initscript
|
||||||
@ -30826,7 +30915,7 @@ index 698c11e..e0dc975 100644
|
|||||||
userdom_read_user_home_content_files(initrc_t)
|
userdom_read_user_home_content_files(initrc_t)
|
||||||
# Allow access to the sysadm TTYs. Note that this will give access to the
|
# Allow access to the sysadm TTYs. Note that this will give access to the
|
||||||
# TTYs to any process in the initrc_t domain. Therefore, daemons and such
|
# TTYs to any process in the initrc_t domain. Therefore, daemons and such
|
||||||
@@ -473,7 +598,7 @@ ifdef(`distro_redhat',`
|
@@ -473,7 +599,7 @@ ifdef(`distro_redhat',`
|
||||||
|
|
||||||
# Red Hat systems seem to have a stray
|
# Red Hat systems seem to have a stray
|
||||||
# fd open from the initrd
|
# fd open from the initrd
|
||||||
@ -30835,7 +30924,7 @@ index 698c11e..e0dc975 100644
|
|||||||
files_dontaudit_read_root_files(initrc_t)
|
files_dontaudit_read_root_files(initrc_t)
|
||||||
|
|
||||||
# These seem to be from the initrd
|
# These seem to be from the initrd
|
||||||
@@ -519,6 +644,19 @@ ifdef(`distro_redhat',`
|
@@ -519,6 +645,19 @@ ifdef(`distro_redhat',`
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
bind_manage_config_dirs(initrc_t)
|
bind_manage_config_dirs(initrc_t)
|
||||||
bind_write_config(initrc_t)
|
bind_write_config(initrc_t)
|
||||||
@ -30855,7 +30944,7 @@ index 698c11e..e0dc975 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -526,10 +664,17 @@ ifdef(`distro_redhat',`
|
@@ -526,10 +665,17 @@ ifdef(`distro_redhat',`
|
||||||
rpc_write_exports(initrc_t)
|
rpc_write_exports(initrc_t)
|
||||||
rpc_manage_nfs_state_data(initrc_t)
|
rpc_manage_nfs_state_data(initrc_t)
|
||||||
')
|
')
|
||||||
@ -30873,7 +30962,7 @@ index 698c11e..e0dc975 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -544,6 +689,35 @@ ifdef(`distro_suse',`
|
@@ -544,6 +690,35 @@ ifdef(`distro_suse',`
|
||||||
')
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -30909,7 +30998,7 @@ index 698c11e..e0dc975 100644
|
|||||||
optional_policy(`
|
optional_policy(`
|
||||||
amavis_search_lib(initrc_t)
|
amavis_search_lib(initrc_t)
|
||||||
amavis_setattr_pid_files(initrc_t)
|
amavis_setattr_pid_files(initrc_t)
|
||||||
@@ -556,6 +730,8 @@ optional_policy(`
|
@@ -556,6 +731,8 @@ optional_policy(`
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
apache_read_config(initrc_t)
|
apache_read_config(initrc_t)
|
||||||
apache_list_modules(initrc_t)
|
apache_list_modules(initrc_t)
|
||||||
@ -30918,7 +31007,7 @@ index 698c11e..e0dc975 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -572,6 +748,7 @@ optional_policy(`
|
@@ -572,6 +749,7 @@ optional_policy(`
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
cgroup_stream_connect_cgred(initrc_t)
|
cgroup_stream_connect_cgred(initrc_t)
|
||||||
@ -30926,7 +31015,7 @@ index 698c11e..e0dc975 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -584,6 +761,11 @@ optional_policy(`
|
@@ -584,6 +762,11 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -30938,7 +31027,7 @@ index 698c11e..e0dc975 100644
|
|||||||
dev_getattr_printer_dev(initrc_t)
|
dev_getattr_printer_dev(initrc_t)
|
||||||
|
|
||||||
cups_read_log(initrc_t)
|
cups_read_log(initrc_t)
|
||||||
@@ -600,6 +782,9 @@ optional_policy(`
|
@@ -600,6 +783,9 @@ optional_policy(`
|
||||||
dbus_connect_system_bus(initrc_t)
|
dbus_connect_system_bus(initrc_t)
|
||||||
dbus_system_bus_client(initrc_t)
|
dbus_system_bus_client(initrc_t)
|
||||||
dbus_read_config(initrc_t)
|
dbus_read_config(initrc_t)
|
||||||
@ -30948,7 +31037,7 @@ index 698c11e..e0dc975 100644
|
|||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
consolekit_dbus_chat(initrc_t)
|
consolekit_dbus_chat(initrc_t)
|
||||||
@@ -701,7 +886,13 @@ optional_policy(`
|
@@ -701,7 +887,13 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -30962,7 +31051,7 @@ index 698c11e..e0dc975 100644
|
|||||||
mta_dontaudit_read_spool_symlinks(initrc_t)
|
mta_dontaudit_read_spool_symlinks(initrc_t)
|
||||||
')
|
')
|
||||||
|
|
||||||
@@ -724,6 +915,10 @@ optional_policy(`
|
@@ -724,6 +916,10 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -30973,7 +31062,7 @@ index 698c11e..e0dc975 100644
|
|||||||
postgresql_manage_db(initrc_t)
|
postgresql_manage_db(initrc_t)
|
||||||
postgresql_read_config(initrc_t)
|
postgresql_read_config(initrc_t)
|
||||||
')
|
')
|
||||||
@@ -745,6 +940,10 @@ optional_policy(`
|
@@ -745,6 +941,10 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -30984,7 +31073,7 @@ index 698c11e..e0dc975 100644
|
|||||||
fs_write_ramfs_sockets(initrc_t)
|
fs_write_ramfs_sockets(initrc_t)
|
||||||
fs_search_ramfs(initrc_t)
|
fs_search_ramfs(initrc_t)
|
||||||
|
|
||||||
@@ -766,8 +965,6 @@ optional_policy(`
|
@@ -766,8 +966,6 @@ optional_policy(`
|
||||||
# bash tries ioctl for some reason
|
# bash tries ioctl for some reason
|
||||||
files_dontaudit_ioctl_all_pids(initrc_t)
|
files_dontaudit_ioctl_all_pids(initrc_t)
|
||||||
|
|
||||||
@ -30993,7 +31082,7 @@ index 698c11e..e0dc975 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -776,14 +973,21 @@ optional_policy(`
|
@@ -776,14 +974,21 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -31015,7 +31104,7 @@ index 698c11e..e0dc975 100644
|
|||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
ssh_dontaudit_read_server_keys(initrc_t)
|
ssh_dontaudit_read_server_keys(initrc_t)
|
||||||
@@ -805,11 +1009,19 @@ optional_policy(`
|
@@ -805,11 +1010,19 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -31036,7 +31125,7 @@ index 698c11e..e0dc975 100644
|
|||||||
|
|
||||||
ifdef(`distro_redhat',`
|
ifdef(`distro_redhat',`
|
||||||
# system-config-services causes avc messages that should be dontaudited
|
# system-config-services causes avc messages that should be dontaudited
|
||||||
@@ -819,6 +1031,25 @@ optional_policy(`
|
@@ -819,6 +1032,25 @@ optional_policy(`
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
mono_domtrans(initrc_t)
|
mono_domtrans(initrc_t)
|
||||||
')
|
')
|
||||||
@ -31062,7 +31151,7 @@ index 698c11e..e0dc975 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@@ -844,3 +1075,55 @@ optional_policy(`
|
@@ -844,3 +1076,55 @@ optional_policy(`
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
zebra_read_config(initrc_t)
|
zebra_read_config(initrc_t)
|
||||||
')
|
')
|
||||||
@ -32835,7 +32924,7 @@ index 8b5c196..3490497 100644
|
|||||||
+ role $2 types showmount_t;
|
+ role $2 types showmount_t;
|
||||||
')
|
')
|
||||||
diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
|
diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
|
||||||
index fca6947..1f8fee9 100644
|
index fca6947..0fcd4e7 100644
|
||||||
--- a/policy/modules/system/mount.te
|
--- a/policy/modules/system/mount.te
|
||||||
+++ b/policy/modules/system/mount.te
|
+++ b/policy/modules/system/mount.te
|
||||||
@@ -17,8 +17,15 @@ type mount_exec_t;
|
@@ -17,8 +17,15 @@ type mount_exec_t;
|
||||||
@ -33057,7 +33146,7 @@ index fca6947..1f8fee9 100644
|
|||||||
ifdef(`hide_broken_symptoms',`
|
ifdef(`hide_broken_symptoms',`
|
||||||
# for a bug in the X server
|
# for a bug in the X server
|
||||||
rhgb_dontaudit_rw_stream_sockets(mount_t)
|
rhgb_dontaudit_rw_stream_sockets(mount_t)
|
||||||
@@ -180,6 +271,15 @@ optional_policy(`
|
@@ -180,13 +271,36 @@ optional_policy(`
|
||||||
')
|
')
|
||||||
')
|
')
|
||||||
|
|
||||||
@ -33073,7 +33162,8 @@ index fca6947..1f8fee9 100644
|
|||||||
# for kernel package installation
|
# for kernel package installation
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
rpm_rw_pipes(mount_t)
|
rpm_rw_pipes(mount_t)
|
||||||
@@ -187,6 +287,19 @@ optional_policy(`
|
+ rpm_dontaudit_leaks(mount_t)
|
||||||
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
samba_domtrans_smbmount(mount_t)
|
samba_domtrans_smbmount(mount_t)
|
||||||
@ -33093,7 +33183,7 @@ index fca6947..1f8fee9 100644
|
|||||||
')
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@@ -195,6 +308,42 @@ optional_policy(`
|
@@ -195,6 +309,42 @@ optional_policy(`
|
||||||
#
|
#
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
@ -35645,10 +35735,10 @@ index f976344..4474379 100644
|
|||||||
- ')
|
- ')
|
||||||
-')
|
-')
|
||||||
diff --git a/policy/modules/system/userdomain.fc b/policy/modules/system/userdomain.fc
|
diff --git a/policy/modules/system/userdomain.fc b/policy/modules/system/userdomain.fc
|
||||||
index db75976..61db6da 100644
|
index db75976..392d1ee 100644
|
||||||
--- a/policy/modules/system/userdomain.fc
|
--- a/policy/modules/system/userdomain.fc
|
||||||
+++ b/policy/modules/system/userdomain.fc
|
+++ b/policy/modules/system/userdomain.fc
|
||||||
@@ -1,4 +1,15 @@
|
@@ -1,4 +1,17 @@
|
||||||
HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
|
HOME_DIR -d gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
|
||||||
+HOME_DIR -l gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
|
+HOME_DIR -l gen_context(system_u:object_r:user_home_dir_t,s0-mls_systemhigh)
|
||||||
HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
|
HOME_DIR/.+ gen_context(system_u:object_r:user_home_t,s0)
|
||||||
@ -35656,6 +35746,7 @@ index db75976..61db6da 100644
|
|||||||
/tmp/gconfd-USER -d gen_context(system_u:object_r:user_tmp_t,s0)
|
/tmp/gconfd-USER -d gen_context(system_u:object_r:user_tmp_t,s0)
|
||||||
+/root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
|
+/root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
|
||||||
+/root/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
|
+/root/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
|
||||||
|
+/root/\.debug(/.*)? <<none>>
|
||||||
+/dev/shm/pulse-shm.* gen_context(system_u:object_r:user_tmpfs_t,s0)
|
+/dev/shm/pulse-shm.* gen_context(system_u:object_r:user_tmpfs_t,s0)
|
||||||
+/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
|
+/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
|
||||||
+HOME_DIR/bin(/.*)? gen_context(system_u:object_r:home_bin_t,s0)
|
+HOME_DIR/bin(/.*)? gen_context(system_u:object_r:home_bin_t,s0)
|
||||||
@ -35665,6 +35756,7 @@ index db75976..61db6da 100644
|
|||||||
+HOME_DIR/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
|
+HOME_DIR/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
|
||||||
+HOME_DIR/\.pki(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
|
+HOME_DIR/\.pki(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
|
||||||
+HOME_DIR/\.gvfs(/.*)? <<none>>
|
+HOME_DIR/\.gvfs(/.*)? <<none>>
|
||||||
|
+HOME_DIR/\.debug(/.*)? <<none>>
|
||||||
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
|
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
|
||||||
index 2aa8928..c67c8e8 100644
|
index 2aa8928..c67c8e8 100644
|
||||||
--- a/policy/modules/system/userdomain.if
|
--- a/policy/modules/system/userdomain.if
|
||||||
|
@ -20,7 +20,7 @@
|
|||||||
Summary: SELinux policy configuration
|
Summary: SELinux policy configuration
|
||||||
Name: selinux-policy
|
Name: selinux-policy
|
||||||
Version: 3.9.4
|
Version: 3.9.4
|
||||||
Release: 1%{?dist}
|
Release: 2%{?dist}
|
||||||
License: GPLv2+
|
License: GPLv2+
|
||||||
Group: System Environment/Base
|
Group: System Environment/Base
|
||||||
Source: serefpolicy-%{version}.tgz
|
Source: serefpolicy-%{version}.tgz
|
||||||
@ -469,6 +469,10 @@ exit 0
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Tue Sep 14 2010 Dan Walsh <dwalsh@redhat.com> 3.9.4-2
|
||||||
|
- Allow all domains that can use cgroups to search tmpfs_t directory
|
||||||
|
- Allow init to send audit messages
|
||||||
|
|
||||||
* Thu Sep 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.4-1
|
* Thu Sep 8 2010 Dan Walsh <dwalsh@redhat.com> 3.9.4-1
|
||||||
- Update to upstream
|
- Update to upstream
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user