rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Allow gdm to read rpm database 

- Allow nsplugin to read mplayer config files
This commit is contained in:
Daniel J Walsh 2008-06-30 21:12:23 +00:00
parent c62a1b487c
commit cd60b64c83
3 changed files with 26 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
modules-mls.conf
View File

@ -1116,3 +1116,9 @@ guest = module
# #
xguest = module xguest = module
# Layer: services
# Module: courier
#
# IMAP and POP3 email servers
#
courier = module

23
policy-20080509.patch
View File

@ -12336,7 +12336,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cour
+/var/spool/courier(/.*)? gen_context(system_u:object_r:courier_spool_t,s0) +/var/spool/courier(/.*)? gen_context(system_u:object_r:courier_spool_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.if serefpolicy-3.4.2/policy/modules/services/courier.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.if serefpolicy-3.4.2/policy/modules/services/courier.if
--- nsaserefpolicy/policy/modules/services/courier.if 2008-06-12 23:25:06.000000000 -0400 --- nsaserefpolicy/policy/modules/services/courier.if 2008-06-12 23:25:06.000000000 -0400
+++ serefpolicy-3.4.2/policy/modules/services/courier.if 2008-06-12 23:37:52.000000000 -0400 +++ serefpolicy-3.4.2/policy/modules/services/courier.if 2008-06-30 17:10:40.000000000 -0400
@@ -123,3 +123,77 @@ @@ -123,3 +123,77 @@
domtrans_pattern($1, courier_pop_exec_t, courier_pop_t) domtrans_pattern($1, courier_pop_exec_t, courier_pop_t)
@ -12410,10 +12410,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cour
+# +#
+interface(`courier_rw_pipes',` +interface(`courier_rw_pipes',`
+ gen_require(` + gen_require(`
+ type courier_t; + type courier_authdaemon_t;
+ ') + ')
+ +
+ allow $1 courier_t:fifo_file rw_fifo_file_perms; + allow $1 courier_authdaemon_t:fifo_file rw_fifo_file_perms;
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.4.2/policy/modules/services/courier.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.4.2/policy/modules/services/courier.te
--- nsaserefpolicy/policy/modules/services/courier.te 2008-06-12 23:25:05.000000000 -0400 --- nsaserefpolicy/policy/modules/services/courier.te 2008-06-12 23:25:05.000000000 -0400
@ -17867,7 +17867,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
## </summary> ## </summary>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.4.2/policy/modules/services/mta.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.4.2/policy/modules/services/mta.te
--- nsaserefpolicy/policy/modules/services/mta.te 2008-06-12 23:25:05.000000000 -0400 --- nsaserefpolicy/policy/modules/services/mta.te 2008-06-12 23:25:05.000000000 -0400
+++ serefpolicy-3.4.2/policy/modules/services/mta.te 2008-06-30 08:33:53.000000000 -0400 +++ serefpolicy-3.4.2/policy/modules/services/mta.te 2008-06-30 17:10:20.000000000 -0400
@@ -6,6 +6,8 @@ @@ -6,6 +6,8 @@
# Declarations # Declarations
# #
@ -17939,7 +17939,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
') ')
optional_policy(` optional_policy(`
@@ -73,7 +98,10 @@ @@ -73,7 +98,17 @@
optional_policy(` optional_policy(`
cron_read_system_job_tmp_files(system_mail_t) cron_read_system_job_tmp_files(system_mail_t)
@ -17947,10 +17947,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
cron_dontaudit_write_pipes(system_mail_t) cron_dontaudit_write_pipes(system_mail_t)
+ cron_dontaudit_write_system_job_tmp_files(system_mail_t) + cron_dontaudit_write_system_job_tmp_files(system_mail_t)
+ cron_rw_system_stream_sockets(system_mail_t) + cron_rw_system_stream_sockets(system_mail_t)
+')
+
+optional_policy(`
+ courier_read_config(system_mail_t)
+ courier_manage_spool_dirs(system_mail_t)
+ courier_manage_spool_files(system_mail_t)
+# courier_rw_pipes(system_mail_t)
') ')
optional_policy(` optional_policy(`
@@ -81,6 +109,11 @@ @@ -81,6 +116,11 @@
') ')
optional_policy(` optional_policy(`
@ -17962,7 +17969,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
logrotate_read_tmp_files(system_mail_t) logrotate_read_tmp_files(system_mail_t)
') ')
@@ -136,11 +169,38 @@ @@ -136,11 +176,38 @@
') ')
optional_policy(` optional_policy(`
@ -18002,7 +18009,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
optional_policy(` optional_policy(`
# why is mail delivered to a directory of type arpwatch_data_t? # why is mail delivered to a directory of type arpwatch_data_t?
arpwatch_search_data(mailserver_delivery) arpwatch_search_data(mailserver_delivery)
@@ -154,3 +214,5 @@ @@ -154,3 +221,5 @@
cron_read_system_job_tmp_files(mta_user_agent) cron_read_system_job_tmp_files(mta_user_agent)
') ')
') ')

6
selinux-policy.spec
View File

@ -17,7 +17,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.4.2 Version: 3.4.2
Release: 8%{?dist} Release: 9%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -375,6 +375,10 @@ exit 0
%endif %endif
%changelog %changelog
* Sun Jun 29 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-9
- Allow gdm to read rpm database
- Allow nsplugin to read mplayer config files
* Thu Jun 26 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-8 * Thu Jun 26 2008 Dan Walsh <dwalsh@redhat.com> 3.4.2-8
- Allow vpnc to run ifconfig - Allow vpnc to run ifconfig