rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Eliminate rpm_t:fifo_file avcs 

- Fix dbus path for helper app
This commit is contained in:
Daniel J Walsh 2007-09-24 14:18:57 +00:00
parent d9ab02548b
commit d83ea801ac
2 changed files with 122 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

167
policy-20070703.patch
View File

@ -835,8 +835,33 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.0.8/policy/modules/admin/rpm.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.0.8/policy/modules/admin/rpm.if
--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-30 11:47:29.000000000 -0400 --- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-30 11:47:29.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/admin/rpm.if 2007-09-17 16:20:18.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/admin/rpm.if 2007-09-24 09:34:18.000000000 -0400
@@ -210,6 +210,24 @@ @@ -152,6 +152,24 @@
########################################
## <summary>
+## dontaudit read and write an unnamed RPM pipe.
+## </summary>
+## <param name="domain">
+## <summary>
+## The type of the process performing this action.
+## </summary>
+## </param>
+#
+interface(`rpm_dontaudit_rw_pipes',`
+ gen_require(`
+ type rpm_t;
+ ')
+
+ dontaudit $1 rpm_t:fifo_file rw_fifo_file_perms;
+')
+
+########################################
+## <summary>
## Send and receive messages from
## rpm over dbus.
## </summary>
@@ -210,6 +228,24 @@
######################################## ########################################
## <summary> ## <summary>
@ -861,7 +886,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
## Create, read, write, and delete RPM ## Create, read, write, and delete RPM
## script temporary files. ## script temporary files.
## </summary> ## </summary>
@@ -224,8 +242,29 @@ @@ -224,8 +260,29 @@
type rpm_script_tmp_t; type rpm_script_tmp_t;
') ')
@ -892,7 +917,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
') ')
######################################## ########################################
@@ -289,3 +328,84 @@ @@ -289,3 +346,84 @@
dontaudit $1 rpm_var_lib_t:file manage_file_perms; dontaudit $1 rpm_var_lib_t:file manage_file_perms;
dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms; dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms;
') ')
@ -2306,7 +2331,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te
') ')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.0.8/policy/modules/kernel/corecommands.fc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.0.8/policy/modules/kernel/corecommands.fc
--- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-08-22 07:14:06.000000000 -0400 --- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-08-22 07:14:06.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/kernel/corecommands.fc 2007-09-21 14:41:45.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/kernel/corecommands.fc 2007-09-24 09:59:57.000000000 -0400
@@ -36,6 +36,11 @@ @@ -36,6 +36,11 @@
/etc/cipe/ip-up.* -- gen_context(system_u:object_r:bin_t,s0) /etc/cipe/ip-up.* -- gen_context(system_u:object_r:bin_t,s0)
/etc/cipe/ip-down.* -- gen_context(system_u:object_r:bin_t,s0) /etc/cipe/ip-down.* -- gen_context(system_u:object_r:bin_t,s0)
@ -2340,7 +2365,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
/usr/sbin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0) /usr/sbin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0)
@@ -259,3 +265,8 @@ @@ -259,3 +265,9 @@
ifdef(`distro_suse',` ifdef(`distro_suse',`
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0) /var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
') ')
@ -2348,7 +2373,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco
+/etc/gdm/XKeepsCrashing[^/]* -- gen_context(system_u:object_r:bin_t,s0) +/etc/gdm/XKeepsCrashing[^/]* -- gen_context(system_u:object_r:bin_t,s0)
+/etc/gdm/[^/]+ -d gen_context(system_u:object_r:bin_t,s0) +/etc/gdm/[^/]+ -d gen_context(system_u:object_r:bin_t,s0)
+/etc/gdm/[^/]+/.* gen_context(system_u:object_r:bin_t,s0) +/etc/gdm/[^/]+/.* gen_context(system_u:object_r:bin_t,s0)
+/lib(64)?/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:bin_t,s0) +/lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:bin_t,s0)
+/lib64/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:bin_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.if.in serefpolicy-3.0.8/policy/modules/kernel/corenetwork.if.in diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.if.in serefpolicy-3.0.8/policy/modules/kernel/corenetwork.if.in
--- nsaserefpolicy/policy/modules/kernel/corenetwork.if.in 2007-07-03 07:05:38.000000000 -0400 --- nsaserefpolicy/policy/modules/kernel/corenetwork.if.in 2007-07-03 07:05:38.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/kernel/corenetwork.if.in 2007-09-17 16:20:18.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/kernel/corenetwork.if.in 2007-09-17 16:20:18.000000000 -0400
@ -10991,8 +11017,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.8/policy/modules/system/init.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.8/policy/modules/system/init.if
--- nsaserefpolicy/policy/modules/system/init.if 2007-08-22 07:14:12.000000000 -0400 --- nsaserefpolicy/policy/modules/system/init.if 2007-08-22 07:14:12.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/system/init.if 2007-09-22 07:07:39.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/system/init.if 2007-09-24 09:49:24.000000000 -0400
@@ -211,6 +211,13 @@ @@ -211,6 +211,20 @@
kernel_dontaudit_use_fds($1) kernel_dontaudit_use_fds($1)
') ')
') ')
@ -11003,10 +11029,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
+ term_dontaudit_use_all_user_ttys($1) + term_dontaudit_use_all_user_ttys($1)
+ term_dontaudit_use_all_user_ptys($1) + term_dontaudit_use_all_user_ptys($1)
+ ') + ')
+ optional_policy(`
+ tunable_policy(`allow_daemons_use_tty',`
+ unconfined_use_terminals($1)
+ ', `
+ unconfined_dontaudit_use_terminals($1)
+ ')
+ ')
') ')
######################################## ########################################
@@ -540,18 +547,19 @@ @@ -540,18 +554,19 @@
# #
interface(`init_spec_domtrans_script',` interface(`init_spec_domtrans_script',`
gen_require(` gen_require(`
@ -11030,23 +11063,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
') ')
') ')
@@ -567,18 +575,46 @@ @@ -567,18 +582,46 @@
# #
interface(`init_domtrans_script',` interface(`init_domtrans_script',`
gen_require(` gen_require(`
- type initrc_t, initrc_exec_t; - type initrc_t, initrc_exec_t;
+ type initrc_t; + type initrc_t;
+ attribute initscript; + attribute initscript;
+ ') ')
+
+ files_list_etc($1) files_list_etc($1)
- domtrans_pattern($1,initrc_exec_t,initrc_t)
+ domtrans_pattern($1,initscript,initrc_t) + domtrans_pattern($1,initscript,initrc_t)
+
+ ifdef(`enable_mcs',` ifdef(`enable_mcs',`
- range_transition $1 initrc_exec_t:process s0;
+ range_transition $1 initscript:process s0; + range_transition $1 initscript:process s0;
+ ') ')
+
+ ifdef(`enable_mls',` ifdef(`enable_mls',`
- range_transition $1 initrc_exec_t:process s0 - mls_systemhigh;
+ range_transition $1 initscript:process s0 - mls_systemhigh; + range_transition $1 initscript:process s0 - mls_systemhigh;
+ ') + ')
+') +')
@ -11064,24 +11100,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
+interface(`init_script_domtrans_spec',` +interface(`init_script_domtrans_spec',`
+ gen_require(` + gen_require(`
+ type initrc_t; + type initrc_t;
') + ')
+
files_list_etc($1) + files_list_etc($1)
- domtrans_pattern($1,initrc_exec_t,initrc_t)
+ domtrans_pattern($1,$2,initrc_t) + domtrans_pattern($1,$2,initrc_t)
+
ifdef(`enable_mcs',` + ifdef(`enable_mcs',`
- range_transition $1 initrc_exec_t:process s0;
+ range_transition $1 $2:process s0; + range_transition $1 $2:process s0;
') + ')
+
ifdef(`enable_mls',` + ifdef(`enable_mls',`
- range_transition $1 initrc_exec_t:process s0 - mls_systemhigh;
+ range_transition $1 $2:process s0 - mls_systemhigh; + range_transition $1 $2:process s0 - mls_systemhigh;
') ')
') ')
@@ -609,11 +645,11 @@ @@ -609,11 +652,11 @@
# cjp: added for gentoo integrated run_init # cjp: added for gentoo integrated run_init
interface(`init_script_file_domtrans',` interface(`init_script_file_domtrans',`
gen_require(` gen_require(`
@ -11095,7 +11128,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
') ')
######################################## ########################################
@@ -684,11 +720,11 @@ @@ -684,11 +727,11 @@
# #
interface(`init_getattr_script_files',` interface(`init_getattr_script_files',`
gen_require(` gen_require(`
@ -11109,7 +11142,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
') ')
######################################## ########################################
@@ -703,11 +739,11 @@ @@ -703,11 +746,11 @@
# #
interface(`init_exec_script_files',` interface(`init_exec_script_files',`
gen_require(` gen_require(`
@ -11123,7 +11156,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
') ')
######################################## ########################################
@@ -931,6 +967,7 @@ @@ -931,6 +974,7 @@
dontaudit $1 initrc_t:unix_stream_socket connectto; dontaudit $1 initrc_t:unix_stream_socket connectto;
') ')
@ -11131,7 +11164,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
######################################## ########################################
## <summary> ## <summary>
## Send messages to init scripts over dbus. ## Send messages to init scripts over dbus.
@@ -1030,11 +1067,11 @@ @@ -1030,11 +1074,11 @@
# #
interface(`init_read_script_files',` interface(`init_read_script_files',`
gen_require(` gen_require(`
@ -11145,7 +11178,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
') ')
######################################## ########################################
@@ -1252,7 +1289,7 @@ @@ -1252,7 +1296,7 @@
type initrc_var_run_t; type initrc_var_run_t;
') ')
@ -11154,7 +11187,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
') ')
######################################## ########################################
@@ -1273,3 +1310,64 @@ @@ -1273,3 +1317,64 @@
files_search_pids($1) files_search_pids($1)
allow $1 initrc_var_run_t:file manage_file_perms; allow $1 initrc_var_run_t:file manage_file_perms;
') ')
@ -11221,7 +11254,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.8/policy/modules/system/init.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.8/policy/modules/system/init.te
--- nsaserefpolicy/policy/modules/system/init.te 2007-09-12 10:34:51.000000000 -0400 --- nsaserefpolicy/policy/modules/system/init.te 2007-09-12 10:34:51.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/system/init.te 2007-09-22 07:06:37.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/system/init.te 2007-09-24 09:50:18.000000000 -0400
@@ -10,6 +10,20 @@ @@ -10,6 +10,20 @@
# Declarations # Declarations
# #
@ -11316,7 +11349,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
selinux_get_enforce_mode(initrc_t) selinux_get_enforce_mode(initrc_t)
@@ -497,6 +515,43 @@ @@ -497,6 +515,47 @@
') ')
optional_policy(` optional_policy(`
@ -11342,17 +11375,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
+ files_dump_core(daemon) + files_dump_core(daemon)
+') +')
+ +
+tunable_policy(`allow_daemons_use_tty',`
+ term_use_all_user_ttys(daemon)
+ term_use_all_user_ptys(daemon)
+', `
+ term_dontaudit_use_all_user_ttys(daemon)
+ term_dontaudit_use_all_user_ptys(daemon)
+')
+
+optional_policy(` +optional_policy(`
+ unconfined_dontaudit_rw_pipes(daemon) + unconfined_dontaudit_rw_pipes(daemon)
+ +
+ tunable_policy(`allow_daemons_use_tty',` + tunable_policy(`allow_daemons_use_tty',`
+ unconfined_use_terminals(daemon) + unconfined_use_terminals(daemon)
+ term_use_all_user_ttys(daemon)
+ term_use_all_user_ptys(daemon)
+ ', ` + ', `
+ unconfined_dontaudit_use_terminals(daemon) + unconfined_dontaudit_use_terminals(daemon)
+ term_dontaudit_use_all_user_ttys(daemon)
+ term_dontaudit_use_all_user_ptys(daemon)
+ ') + ')
+') +')
+ +
@ -11360,7 +11397,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
amavis_search_lib(initrc_t) amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t) amavis_setattr_pid_files(initrc_t)
') ')
@@ -632,12 +687,6 @@ @@ -632,12 +691,6 @@
mta_read_config(initrc_t) mta_read_config(initrc_t)
mta_dontaudit_read_spool_symlinks(initrc_t) mta_dontaudit_read_spool_symlinks(initrc_t)
') ')
@ -11373,7 +11410,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
optional_policy(` optional_policy(`
ifdef(`distro_redhat',` ifdef(`distro_redhat',`
@@ -703,6 +752,9 @@ @@ -703,6 +756,9 @@
# why is this needed: # why is this needed:
rpm_manage_db(initrc_t) rpm_manage_db(initrc_t)
@ -11383,6 +11420,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t
') ')
optional_policy(` optional_policy(`
@@ -750,6 +806,10 @@
')
optional_policy(`
+ rpm_dontaudit_rw_pipes(daemon)
+')
+
+optional_policy(`
vmware_read_system_config(initrc_t)
vmware_append_system_config(initrc_t)
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.8/policy/modules/system/ipsec.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.8/policy/modules/system/ipsec.te
--- nsaserefpolicy/policy/modules/system/ipsec.te 2007-07-25 10:37:42.000000000 -0400 --- nsaserefpolicy/policy/modules/system/ipsec.te 2007-07-25 10:37:42.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/system/ipsec.te 2007-09-17 16:20:18.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/system/ipsec.te 2007-09-17 16:20:18.000000000 -0400
@ -12803,7 +12851,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
+') +')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.0.8/policy/modules/system/selinuxutil.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.0.8/policy/modules/system/selinuxutil.te
--- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-09-12 10:34:51.000000000 -0400 --- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-09-12 10:34:51.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.te 2007-09-20 11:55:54.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.te 2007-09-24 09:36:36.000000000 -0400
@@ -76,7 +76,6 @@ @@ -76,7 +76,6 @@
type restorecond_exec_t; type restorecond_exec_t;
init_daemon_domain(restorecond_t,restorecond_exec_t) init_daemon_domain(restorecond_t,restorecond_exec_t)
@ -12933,7 +12981,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
auth_dontaudit_read_shadow(run_init_t) auth_dontaudit_read_shadow(run_init_t)
corecmd_exec_bin(run_init_t) corecmd_exec_bin(run_init_t)
@@ -423,77 +426,53 @@ @@ -423,77 +426,54 @@
nscd_socket_use(run_init_t) nscd_socket_use(run_init_t)
') ')
@ -13035,12 +13083,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
+ +
+optional_policy(` +optional_policy(`
+ rpm_dontaudit_rw_tmp_files(semanage_t) + rpm_dontaudit_rw_tmp_files(semanage_t)
+ rpm_dontaudit_rw_pipes(semanage_t)
+') +')
+ +
# cjp: need a more general way to handle this: # cjp: need a more general way to handle this:
ifdef(`enable_mls',` ifdef(`enable_mls',`
# read secadm tmp files # read secadm tmp files
@@ -521,6 +500,8 @@ @@ -521,6 +501,8 @@
allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:file r_file_perms; allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:file r_file_perms;
allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:lnk_file r_file_perms; allow setfiles_t { policy_src_t policy_config_t file_context_t selinux_config_t default_context_t }:lnk_file r_file_perms;
@ -13049,7 +13098,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
kernel_read_system_state(setfiles_t) kernel_read_system_state(setfiles_t)
kernel_relabelfrom_unlabeled_dirs(setfiles_t) kernel_relabelfrom_unlabeled_dirs(setfiles_t)
kernel_relabelfrom_unlabeled_files(setfiles_t) kernel_relabelfrom_unlabeled_files(setfiles_t)
@@ -537,6 +518,7 @@ @@ -537,6 +519,7 @@
fs_getattr_xattr_fs(setfiles_t) fs_getattr_xattr_fs(setfiles_t)
fs_list_all(setfiles_t) fs_list_all(setfiles_t)
@ -13057,8 +13106,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
fs_search_auto_mountpoints(setfiles_t) fs_search_auto_mountpoints(setfiles_t)
fs_relabelfrom_noxattr_fs(setfiles_t) fs_relabelfrom_noxattr_fs(setfiles_t)
@@ -592,6 +574,10 @@ @@ -590,8 +573,16 @@
fs_relabel_tmpfs_chr_file(setfiles_t)
')
+optional_policy(`
+ rpm_dontaudit_rw_pipes(setfiles_t)
+')
+
ifdef(`hide_broken_symptoms',` ifdef(`hide_broken_symptoms',`
optional_policy(` optional_policy(`
+ ppp_dontaudit_use_fds(setfiles_t) + ppp_dontaudit_use_fds(setfiles_t)
@ -13068,6 +13123,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
udev_dontaudit_rw_dgram_sockets(setfiles_t) udev_dontaudit_rw_dgram_sockets(setfiles_t)
') ')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.fc serefpolicy-3.0.8/policy/modules/system/sysnetwork.fc
--- nsaserefpolicy/policy/modules/system/sysnetwork.fc 2007-05-29 14:10:58.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.fc 2007-09-24 08:54:25.000000000 -0400
@@ -54,7 +54,7 @@
/var/run/dhclient.*\.pid -- gen_context(system_u:object_r:dhcpc_var_run_t,s0)
/var/run/dhclient.*\.leases -- gen_context(system_u:object_r:dhcpc_var_run_t,s0)
-
+/var/run/dhclient-[^/]*\.lease -- gen_context(system_u:object_r:dhcpc_var_run_t,s0)
ifdef(`distro_gentoo',`
/var/lib/dhcpc(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0)
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.0.8/policy/modules/system/sysnetwork.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.0.8/policy/modules/system/sysnetwork.if
--- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-07-03 07:06:32.000000000 -0400 --- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-07-03 07:06:32.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.if 2007-09-17 16:20:18.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.if 2007-09-17 16:20:18.000000000 -0400

6
selinux-policy.spec
View File

@ -17,7 +17,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.0.8 Version: 3.0.8
Release: 9%{?dist} Release: 10%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -362,6 +362,10 @@ exit 0
%endif %endif
%changelog %changelog
* Mon Sep 24 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-10
- Eliminate rpm_t:fifo_file avcs
- Fix dbus path for helper app
* Sat Sep 22 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-9 * Sat Sep 22 2007 Dan Walsh <dwalsh@redhat.com> 3.0.8-9
- Fix service start stop terminal avc's - Fix service start stop terminal avc's