rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Allow gssd to send signals to users

Browse Source 
- Fix duplicate label for apache content
This commit is contained in:
Daniel J Walsh 2009-08-31 17:06:58 +00:00
parent 7d592be23e
commit d367ee8125
1 changed files with 61 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

89
policy-F12.patch
View File

@ -1,3 +1,15 @@
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.6.29/Makefile
--- nsaserefpolicy/Makefile 2009-08-18 11:41:14.000000000 -0400
+++ serefpolicy-3.6.29/Makefile 2009-08-31 13:03:03.000000000 -0400
@@ -244,7 +244,7 @@
appdir := $(contextpath)
user_default_contexts := $(wildcard config/appconfig-$(TYPE)/*_default_contexts)
user_default_contexts_names := $(addprefix $(contextpath)/users/,$(subst _default_contexts,,$(notdir $(user_default_contexts))))
-appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts x_contexts customizable_types securetty_types) $(contextpath)/files/media $(user_default_contexts_names)
+appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts x_contexts customizable_types securetty_types virtual_image_context virtual_domain_context) $(contextpath)/files/media $(user_default_contexts_names)
net_contexts := $(builddir)net_contexts
all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/rsync_selinux.8 serefpolicy-3.6.29/man/man8/rsync_selinux.8
--- nsaserefpolicy/man/man8/rsync_selinux.8 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.29/man/man8/rsync_selinux.8 2009-08-31 09:47:15.000000000 -0400
@ -460,7 +472,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/usr/bin/online_update -- gen_context(system_u:object_r:rpm_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.6.29/policy/modules/admin/rpm.if
--- nsaserefpolicy/policy/modules/admin/rpm.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.29/policy/modules/admin/rpm.if 2009-08-31 09:47:15.000000000 -0400
+++ serefpolicy-3.6.29/policy/modules/admin/rpm.if 2009-08-31 10:37:32.000000000 -0400
@@ -66,6 +66,11 @@
rpm_domtrans($1)
role $2 types rpm_t;
@ -473,7 +485,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
seutil_run_loadpolicy(rpm_script_t, $2)
seutil_run_semanage(rpm_script_t, $2)
seutil_run_setfiles(rpm_script_t, $2)
@@ -146,6 +151,34 @@
@@ -146,6 +151,35 @@
########################################
## <summary>
@ -496,6 +508,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+ dontaudit $1 rpm_t:fifo_file rw_fifo_file_perms;
+ dontaudit $1 rpm_script_t:fd use;
+ dontaudit $1 rpm_script_t:fifo_file rw_fifo_file_perms;
+ dontaudit $1 rpm_var_run_t:file write_file_perms;
+ dontaudit $1 rpm_tmp_t:file rw_file_perms;
+ dontaudit $1 rpm_t:shm rw_shm_perms;
@ -508,7 +521,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Send and receive messages from
## rpm over dbus.
## </summary>
@@ -167,6 +200,48 @@
@@ -167,6 +201,48 @@
########################################
## <summary>
@ -557,7 +570,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Create, read, write, and delete the RPM log.
## </summary>
## <param name="domain">
@@ -186,6 +261,24 @@
@@ -186,6 +262,24 @@
########################################
## <summary>
@ -582,7 +595,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Inherit and use file descriptors from RPM scripts.
## </summary>
## <param name="domain">
@@ -219,7 +312,29 @@
@@ -219,7 +313,29 @@
')
files_search_tmp($1)
@ -612,7 +625,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
@@ -245,6 +360,24 @@
@@ -245,6 +361,24 @@
########################################
## <summary>
@ -637,7 +650,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Create, read, write, and delete the RPM package database.
## </summary>
## <param name="domain">
@@ -283,3 +416,46 @@
@@ -283,3 +417,46 @@
dontaudit $1 rpm_var_lib_t:file manage_file_perms;
dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms;
')
@ -1269,7 +1282,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqselector.te serefpolicy-3.6.29/policy/modules/apps/cpufreqselector.te
--- nsaserefpolicy/policy/modules/apps/cpufreqselector.te 2009-07-28 13:28:33.000000000 -0400
+++ serefpolicy-3.6.29/policy/modules/apps/cpufreqselector.te 2009-08-31 09:47:15.000000000 -0400
+++ serefpolicy-3.6.29/policy/modules/apps/cpufreqselector.te 2009-08-31 10:08:44.000000000 -0400
@@ -8,7 +8,8 @@
type cpufreqselector_t;
@ -1280,7 +1293,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
#
@@ -36,6 +37,7 @@
@@ -26,6 +27,7 @@
dev_rw_sysfs(cpufreqselector_t)
userdom_read_all_users_state(cpufreqselector_t)
+userdom_dontaudit_search_admin_dir(cpufreqselector_t)
optional_policy(`
consolekit_dbus_chat(cpufreqselector_t)
@@ -36,6 +38,7 @@
')
optional_policy(`
@ -1639,7 +1660,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.6.29/policy/modules/apps/gnome.te
--- nsaserefpolicy/policy/modules/apps/gnome.te 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.29/policy/modules/apps/gnome.te 2009-08-31 09:47:15.000000000 -0400
+++ serefpolicy-3.6.29/policy/modules/apps/gnome.te 2009-08-31 10:10:01.000000000 -0400
@@ -9,16 +9,18 @@
attribute gnomedomain;
@ -1678,7 +1699,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##############################
#
# Local Policy
@@ -73,3 +84,82 @@
@@ -73,3 +84,83 @@
xserver_use_xdm_fds(gconfd_t)
xserver_rw_xdm_pipes(gconfd_t)
')
@ -1744,6 +1765,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+files_read_usr_files(gnomesystemmm_t)
+
+userdom_read_all_users_state(gnomesystemmm_t)
+userdom_dontaudit_search_admin_dir(gnomesystemmm_t)
+
+optional_policy(`
+ consolekit_dbus_chat(gnomesystemmm_t)
@ -2046,8 +2068,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/kdumpgui.te serefpolicy-3.6.29/policy/modules/apps/kdumpgui.te
--- nsaserefpolicy/policy/modules/apps/kdumpgui.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.29/policy/modules/apps/kdumpgui.te 2009-08-31 09:47:15.000000000 -0400
@@ -0,0 +1,64 @@
+++ serefpolicy-3.6.29/policy/modules/apps/kdumpgui.te 2009-08-31 10:09:48.000000000 -0400
@@ -0,0 +1,66 @@
+policy_module(kdumpgui,1.0.0)
+
+########################################
@ -2102,6 +2124,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+dontaudit_init_read_all_script_files(kdumpgui_t)
+
+userdom_dontaudit_search_admin_dir(kdumpgui_t)
+
+optional_policy(`
+ dev_rw_lvm_control(kdumpgui_t)
+')
@ -3786,8 +3810,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.te serefpolicy-3.6.29/policy/modules/apps/sambagui.te
--- nsaserefpolicy/policy/modules/apps/sambagui.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.29/policy/modules/apps/sambagui.te 2009-08-31 09:47:15.000000000 -0400
@@ -0,0 +1,55 @@
+++ serefpolicy-3.6.29/policy/modules/apps/sambagui.te 2009-08-31 10:08:12.000000000 -0400
@@ -0,0 +1,56 @@
+policy_module(sambagui,1.0.0)
+
+########################################
@ -3797,7 +3821,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
+type sambagui_t;
+type sambagui_exec_t;
+
+dbus_system_domain(sambagui_t, sambagui_exec_t)
+
+########################################
@ -3836,6 +3859,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+dev_dontaudit_read_urand(sambagui_t)
+nscd_dontaudit_search_pid(sambagui_t)
+
+userdom_dontaudit_search_admin_dir(sambagui_t)
+
+optional_policy(`
+ consoletype_exec(sambagui_t)
+')
@ -5340,7 +5365,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.6.29/policy/modules/kernel/domain.te
--- nsaserefpolicy/policy/modules/kernel/domain.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.29/policy/modules/kernel/domain.te 2009-08-31 09:47:15.000000000 -0400
+++ serefpolicy-3.6.29/policy/modules/kernel/domain.te 2009-08-31 10:41:13.000000000 -0400
@@ -5,6 +5,13 @@
#
# Declarations
@ -5411,7 +5436,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Act upon any other process.
allow unconfined_domain_type domain:process ~{ transition dyntransition execmem execstack execheap };
@@ -153,3 +174,69 @@
@@ -153,3 +174,66 @@
# receive from all domains over labeled networking
domain_all_recvfrom_all_domains(unconfined_domain_type)
@ -5438,6 +5463,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+optional_policy(`
+ rpm_use_fds(domain)
+ rpm_read_pipes(domain)
+ rpm_dontaudit_leaks(domain)
+ rpm_read_script_tmp_files(domain)
+')
+
+
@ -5458,11 +5485,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
+optional_policy(`
+ rpm_dontaudit_leaks(domain)
+ rpm_read_script_tmp_files(domain)
+')
+
+optional_policy(`
+ ssh_rw_pipes(domain)
+')
+
@ -16066,7 +16088,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.6.29/policy/modules/services/samba.te
--- nsaserefpolicy/policy/modules/services/samba.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.29/policy/modules/services/samba.te 2009-08-31 09:47:16.000000000 -0400
+++ serefpolicy-3.6.29/policy/modules/services/samba.te 2009-08-31 11:04:34.000000000 -0400
@@ -66,6 +66,13 @@
## </desc>
gen_tunable(samba_share_nfs, false)
@ -16211,7 +16233,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
samba_read_config(smbcontrol_t)
samba_rw_var_files(smbcontrol_t)
samba_search_var(smbcontrol_t)
@@ -638,6 +669,10 @@
@@ -536,6 +567,8 @@
miscfiles_read_localization(smbcontrol_t)
+userdom_use_user_terminals(smbcontrol_t)
+
########################################
#
# smbmount Local policy
@@ -638,6 +671,10 @@
allow swat_t smbd_var_run_t:file { lock unlink };
@ -16222,7 +16253,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
rw_files_pattern(swat_t, samba_etc_t, samba_etc_t)
read_lnk_files_pattern(swat_t, samba_etc_t, samba_etc_t)
@@ -713,12 +748,23 @@
@@ -713,12 +750,23 @@
kerberos_use(swat_t)
')
@ -16247,24 +16278,26 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dontaudit winbind_t self:capability sys_tty_config;
allow winbind_t self:process { signal_perms getsched setsched };
allow winbind_t self:fifo_file rw_fifo_file_perms;
@@ -866,6 +912,16 @@
@@ -866,6 +914,18 @@
#
optional_policy(`
+ type samba_unconfined_net_t;
+ domain_type(samba_unconfined_net_t)
+ domain_entry_file(samba_unconfined_net_t, samba_net_exec_t)
+ role system_r types samba_unconfined_net_t;
+
+ unconfined_domain(samba_unconfined_net_t)
+
+ manage_files_pattern(samba_unconfined_net_t, samba_etc_t, samba_secrets_t)
+ filetrans_pattern(samba_unconfined_net_t, samba_etc_t, samba_secrets_t, file)
+ userdom_use_user_terminals(samba_unconfined_net_t)
+')
+
type samba_unconfined_script_t;
type samba_unconfined_script_exec_t;
domain_type(samba_unconfined_script_t)
@@ -876,9 +932,12 @@
@@ -876,9 +936,12 @@
allow smbd_t samba_unconfined_script_exec_t:dir search_dir_perms;
allow smbd_t samba_unconfined_script_exec_t:file ioctl;