- More fixes for polkit
This commit is contained in:
Daniel J Walsh
parent
ebe074be56
commit
e359546c5a
@ -2452,7 +2452,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.if s
|
||||
########################################
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.2.7/policy/modules/apps/gpg.te
|
||||
--- nsaserefpolicy/policy/modules/apps/gpg.te 2007-12-19 05:32:09.000000000 -0500
|
||||
+++ serefpolicy-3.2.7/policy/modules/apps/gpg.te 2008-02-11 14:16:30.000000000 -0500
|
||||
+++ serefpolicy-3.2.7/policy/modules/apps/gpg.te 2008-02-12 12:01:08.000000000 -0500
|
||||
@@ -7,15 +7,232 @@
|
||||
#
|
||||
|
||||
@ -2549,7 +2549,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te s
|
||||
+# GPG helper local policy
|
||||
+#
|
||||
+
|
||||
+allow gpg_helper_t self:process getsched;
|
||||
+allow gpg_helper_t self:process { getsched setsched };
|
||||
+
|
||||
+# for helper programs (which automatically fetch keys)
|
||||
+# Note: this is only tested with the hkp interface. If you use eg the
|
||||
@ -5647,7 +5647,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.
|
||||
# etc_runtime_t is the type of various
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.2.7/policy/modules/kernel/filesystem.if
|
||||
--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-10-24 15:00:24.000000000 -0400
|
||||
+++ serefpolicy-3.2.7/policy/modules/kernel/filesystem.if 2008-02-06 11:02:29.000000000 -0500
|
||||
+++ serefpolicy-3.2.7/policy/modules/kernel/filesystem.if 2008-02-12 09:41:43.000000000 -0500
|
||||
@@ -310,6 +310,25 @@
|
||||
|
||||
########################################
|
||||
@ -5735,6 +5735,90 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy
|
||||
## Relabel block nodes on tmpfs filesystems.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
@@ -3551,3 +3608,83 @@
|
||||
relabelfrom_blk_files_pattern($1,noxattrfs,noxattrfs)
|
||||
relabelfrom_chr_files_pattern($1,noxattrfs,noxattrfs)
|
||||
')
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Create, read, write, and delete directories
|
||||
+## on a FUSEFS filesystem.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed access.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+## <rolecap/>
|
||||
+#
|
||||
+interface(`fs_manage_fusefs_dirs',`
|
||||
+ gen_require(`
|
||||
+ type fusefs_t;
|
||||
+ ')
|
||||
+
|
||||
+ allow $1 fusefs_t:dir manage_dir_perms;
|
||||
+')
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Do not audit attempts to create, read,
|
||||
+## write, and delete directories
|
||||
+## on a FUSEFS filesystem.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain to not audit.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+interface(`fs_dontaudit_manage_fusefs_dirs',`
|
||||
+ gen_require(`
|
||||
+ type fusefs_t;
|
||||
+ ')
|
||||
+
|
||||
+ dontaudit $1 fusefs_t:dir manage_dir_perms;
|
||||
+')
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Create, read, write, and delete files
|
||||
+## on a FUSEFS filesystem.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed access.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+## <rolecap/>
|
||||
+#
|
||||
+interface(`fs_manage_fusefs_files',`
|
||||
+ gen_require(`
|
||||
+ type fusefs_t;
|
||||
+ ')
|
||||
+
|
||||
+ manage_files_pattern($1,fusefs_t,fusefs_t)
|
||||
+')
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
+## Do not audit attempts to create,
|
||||
+## read, write, and delete files
|
||||
+## on a FUSEFS filesystem.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain to not audit.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+interface(`fs_dontaudit_manage_fusefs_files',`
|
||||
+ gen_require(`
|
||||
+ type fusefs_t;
|
||||
+ ')
|
||||
+
|
||||
+ dontaudit $1 fusefs_t:file manage_file_perms;
|
||||
+')
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.2.7/policy/modules/kernel/filesystem.te
|
||||
--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-12-19 05:32:07.000000000 -0500
|
||||
+++ serefpolicy-3.2.7/policy/modules/kernel/filesystem.te 2008-02-06 11:02:29.000000000 -0500
|
||||
@ -9223,7 +9307,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
|
||||
+
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.2.7/policy/modules/services/cups.te
|
||||
--- nsaserefpolicy/policy/modules/services/cups.te 2007-12-19 05:32:17.000000000 -0500
|
||||
+++ serefpolicy-3.2.7/policy/modules/services/cups.te 2008-02-06 11:02:29.000000000 -0500
|
||||
+++ serefpolicy-3.2.7/policy/modules/services/cups.te 2008-02-12 10:06:49.000000000 -0500
|
||||
@@ -43,14 +43,12 @@
|
||||
|
||||
type cupsd_var_run_t;
|
||||
@ -9443,7 +9527,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
|
||||
|
||||
fs_getattr_all_fs(cupsd_config_t)
|
||||
fs_search_auto_mountpoints(cupsd_config_t)
|
||||
@@ -372,6 +404,10 @@
|
||||
@@ -353,6 +385,7 @@
|
||||
logging_send_syslog_msg(cupsd_config_t)
|
||||
|
||||
miscfiles_read_localization(cupsd_config_t)
|
||||
+miscfiles_read_hwdata(cupsd_config_t)
|
||||
|
||||
seutil_dontaudit_search_config(cupsd_config_t)
|
||||
|
||||
@@ -372,6 +405,10 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -9454,7 +9546,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
|
||||
cron_system_entry(cupsd_config_t, cupsd_config_exec_t)
|
||||
')
|
||||
|
||||
@@ -387,6 +423,7 @@
|
||||
@@ -387,6 +424,7 @@
|
||||
optional_policy(`
|
||||
hal_domtrans(cupsd_config_t)
|
||||
hal_read_tmp_files(cupsd_config_t)
|
||||
@ -9462,7 +9554,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -499,14 +536,12 @@
|
||||
@@ -499,14 +537,12 @@
|
||||
allow hplip_t self:udp_socket create_socket_perms;
|
||||
allow hplip_t self:rawip_socket create_socket_perms;
|
||||
|
||||
@ -9481,7 +9573,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
|
||||
|
||||
manage_files_pattern(hplip_t,hplip_var_run_t,hplip_var_run_t)
|
||||
files_pid_filetrans(hplip_t,hplip_var_run_t,file)
|
||||
@@ -537,14 +572,14 @@
|
||||
@@ -537,14 +573,14 @@
|
||||
dev_read_urand(hplip_t)
|
||||
dev_read_rand(hplip_t)
|
||||
dev_rw_generic_usb_dev(hplip_t)
|
||||
@ -9498,7 +9590,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups
|
||||
domain_use_interactive_fds(hplip_t)
|
||||
|
||||
files_read_etc_files(hplip_t)
|
||||
@@ -565,6 +600,7 @@
|
||||
@@ -565,6 +601,7 @@
|
||||
userdom_dontaudit_search_all_users_home_content(hplip_t)
|
||||
|
||||
lpd_read_config(cupsd_t)
|
||||
@ -9851,7 +9943,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru
|
||||
# Local policy
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.7/policy/modules/services/dbus.if
|
||||
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500
|
||||
+++ serefpolicy-3.2.7/policy/modules/services/dbus.if 2008-02-11 17:07:47.000000000 -0500
|
||||
+++ serefpolicy-3.2.7/policy/modules/services/dbus.if 2008-02-12 12:42:53.000000000 -0500
|
||||
@@ -53,6 +53,7 @@
|
||||
gen_require(`
|
||||
type system_dbusd_exec_t, system_dbusd_t, dbusd_etc_t;
|
||||
@ -9860,7 +9952,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
')
|
||||
|
||||
##############################
|
||||
@@ -84,14 +85,20 @@
|
||||
@@ -64,8 +65,6 @@
|
||||
domain_entry_file($1_dbusd_t,system_dbusd_exec_t)
|
||||
role $3 types $1_dbusd_t;
|
||||
|
||||
- type $1_dbusd_$1_t;
|
||||
-
|
||||
type $1_dbusd_tmp_t;
|
||||
files_tmp_file($1_dbusd_tmp_t)
|
||||
|
||||
@@ -84,14 +83,18 @@
|
||||
allow $1_dbusd_t self:tcp_socket create_stream_socket_perms;
|
||||
allow $1_dbusd_t self:netlink_selinux_socket create_socket_perms;
|
||||
|
||||
@ -9869,12 +9970,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
+
|
||||
# For connecting to the bus
|
||||
- allow $2 $1_dbusd_t:unix_stream_socket connectto;
|
||||
- type_change $2 $1_dbusd_t:dbus $1_dbusd_$1_t;
|
||||
+ allow $2 $1_dbusd_t:unix_stream_socket { getattr connectto };
|
||||
+ allow $2 $1_dbusd_t:unix_dgram_socket getattr;
|
||||
type_change $2 $1_dbusd_t:dbus $1_dbusd_$1_t;
|
||||
|
||||
# SE-DBus specific permissions
|
||||
allow $1_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg;
|
||||
- allow $1_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg;
|
||||
allow $2 $1_dbusd_t:dbus { send_msg acquire_svc };
|
||||
- allow $1_t system_dbusd_t:dbus { send_msg acquire_svc };
|
||||
+ allow $1_dbusd_t $2:dbus send_msg;
|
||||
@ -9883,7 +9984,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
|
||||
allow $1_dbusd_t dbusd_etc_t:dir list_dir_perms;
|
||||
read_files_pattern($1_dbusd_t,dbusd_etc_t,dbusd_etc_t)
|
||||
@@ -102,10 +109,9 @@
|
||||
@@ -102,10 +105,9 @@
|
||||
files_tmp_filetrans($1_dbusd_t, $1_dbusd_tmp_t, { file dir })
|
||||
|
||||
domtrans_pattern($2, system_dbusd_exec_t, $1_dbusd_t)
|
||||
@ -9896,7 +9997,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
allow $1_dbusd_t $2:process sigkill;
|
||||
allow $2 $1_dbusd_t:fd use;
|
||||
allow $2 $1_dbusd_t:fifo_file rw_fifo_file_perms;
|
||||
@@ -139,6 +145,7 @@
|
||||
@@ -139,6 +141,7 @@
|
||||
|
||||
fs_getattr_romfs($1_dbusd_t)
|
||||
fs_getattr_xattr_fs($1_dbusd_t)
|
||||
@ -9904,7 +10005,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
|
||||
selinux_get_fs_mount($1_dbusd_t)
|
||||
selinux_validate_context($1_dbusd_t)
|
||||
@@ -161,12 +168,23 @@
|
||||
@@ -161,12 +164,23 @@
|
||||
seutil_read_config($1_dbusd_t)
|
||||
seutil_read_default_contexts($1_dbusd_t)
|
||||
|
||||
@ -9912,7 +10013,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
+ userdom_dontaudit_search_sysadm_home_dirs($1_dbusd_t)
|
||||
+ userdom_read_unpriv_users_home_content_files($1_dbusd_t)
|
||||
+ userdom_dontaudit_append_unpriv_home_content_files($1_dbusd_t)
|
||||
+ userdom_dontaudit_use_user_terminals($1, $1_dbusd_t)
|
||||
+ term_dontaudit_use_all_user_ptys($1_dbusd_t)
|
||||
|
||||
ifdef(`hide_broken_symptoms', `
|
||||
dontaudit $2 $1_dbusd_t:netlink_selinux_socket { read write };
|
||||
@ -9929,7 +10030,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
tunable_policy(`read_default_t',`
|
||||
files_list_default($1_dbusd_t)
|
||||
files_read_default_files($1_dbusd_t)
|
||||
@@ -182,6 +200,7 @@
|
||||
@@ -182,6 +196,7 @@
|
||||
optional_policy(`
|
||||
xserver_use_xdm_fds($1_dbusd_t)
|
||||
xserver_rw_xdm_pipes($1_dbusd_t)
|
||||
@ -9937,17 +10038,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
')
|
||||
')
|
||||
|
||||
@@ -214,7 +233,8 @@
|
||||
@@ -209,12 +224,9 @@
|
||||
class dbus send_msg;
|
||||
')
|
||||
|
||||
-# type $1_dbusd_system_t;
|
||||
-# type_change $2 system_dbusd_t:dbus $1_dbusd_system_t;
|
||||
-
|
||||
# SE-DBus specific permissions
|
||||
# allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg;
|
||||
-# allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg;
|
||||
- allow $2 { system_dbusd_t self }:dbus send_msg;
|
||||
+ allow $2 { system_dbusd_t $2 }:dbus send_msg;
|
||||
+ allow system_dbusd_t $2:dbus send_msg;
|
||||
|
||||
read_files_pattern($2, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
|
||||
files_search_var_lib($2)
|
||||
@@ -223,6 +243,10 @@
|
||||
@@ -223,6 +235,10 @@
|
||||
files_search_pids($2)
|
||||
stream_connect_pattern($2,system_dbusd_var_run_t,system_dbusd_var_run_t,system_dbusd_t)
|
||||
dbus_read_config($2)
|
||||
@ -9958,7 +10064,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
')
|
||||
|
||||
#######################################
|
||||
@@ -251,6 +275,7 @@
|
||||
@@ -251,18 +267,16 @@
|
||||
template(`dbus_user_bus_client_template',`
|
||||
gen_require(`
|
||||
type $1_dbusd_t;
|
||||
@ -9966,7 +10072,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
class dbus send_msg;
|
||||
')
|
||||
|
||||
@@ -263,6 +288,7 @@
|
||||
-# type $2_dbusd_$1_t;
|
||||
-# type_change $3 $1_dbusd_t:dbus $2_dbusd_$1_t;
|
||||
-
|
||||
# SE-DBus specific permissions
|
||||
-# allow $2_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg;
|
||||
allow $3 { $1_dbusd_t self }:dbus send_msg;
|
||||
|
||||
# For connecting to the bus
|
||||
allow $3 $1_dbusd_t:unix_stream_socket connectto;
|
||||
@ -9974,7 +10085,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -292,6 +318,59 @@
|
||||
@@ -292,6 +306,59 @@
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
@ -10034,7 +10145,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
## Read dbus configuration.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
@@ -366,3 +445,55 @@
|
||||
@@ -366,3 +433,55 @@
|
||||
|
||||
allow $1 system_dbusd_t:dbus *;
|
||||
')
|
||||
@ -16181,8 +16292,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prel
|
||||
+')
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.te serefpolicy-3.2.7/policy/modules/services/prelude.te
|
||||
--- nsaserefpolicy/policy/modules/services/prelude.te 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ serefpolicy-3.2.7/policy/modules/services/prelude.te 2008-02-08 14:54:04.000000000 -0500
|
||||
@@ -0,0 +1,140 @@
|
||||
+++ serefpolicy-3.2.7/policy/modules/services/prelude.te 2008-02-12 12:37:44.000000000 -0500
|
||||
@@ -0,0 +1,142 @@
|
||||
+policy_module(prelude,1.0.0)
|
||||
+
|
||||
+########################################
|
||||
@ -16250,6 +16361,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prel
|
||||
+manage_dirs_pattern(prelude_t,prelude_spool_t,prelude_spool_t)
|
||||
+manage_files_pattern(prelude_t,prelude_spool_t,prelude_spool_t)
|
||||
+
|
||||
+auth_use_nsswitch(prelude_t)
|
||||
+
|
||||
+libs_use_ld_so(prelude_t)
|
||||
+libs_use_shared_libs(prelude_t)
|
||||
+
|
||||
@ -18021,7 +18134,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
+
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.2.7/policy/modules/services/samba.te
|
||||
--- nsaserefpolicy/policy/modules/services/samba.te 2007-12-19 05:32:17.000000000 -0500
|
||||
+++ serefpolicy-3.2.7/policy/modules/services/samba.te 2008-02-08 14:53:50.000000000 -0500
|
||||
+++ serefpolicy-3.2.7/policy/modules/services/samba.te 2008-02-12 09:43:12.000000000 -0500
|
||||
@@ -26,28 +26,28 @@
|
||||
|
||||
## <desc>
|
||||
@ -18055,7 +18168,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
## </p>
|
||||
## </desc>
|
||||
gen_tunable(samba_run_unconfined,false)
|
||||
@@ -73,11 +73,9 @@
|
||||
@@ -59,6 +59,13 @@
|
||||
## </desc>
|
||||
gen_tunable(samba_share_nfs,false)
|
||||
|
||||
+## <desc>
|
||||
+## <p>
|
||||
+## Allow samba to export ntfs/fusefs volumes.
|
||||
+## </p>
|
||||
+## </desc>
|
||||
+gen_tunable(samba_share_fusefs,false)
|
||||
+
|
||||
type nmbd_t;
|
||||
type nmbd_exec_t;
|
||||
init_daemon_domain(nmbd_t,nmbd_exec_t)
|
||||
@@ -73,11 +80,9 @@
|
||||
logging_log_file(samba_log_t)
|
||||
|
||||
type samba_net_t;
|
||||
@ -18069,7 +18196,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
|
||||
type samba_net_tmp_t;
|
||||
files_tmp_file(samba_net_tmp_t)
|
||||
@@ -139,6 +137,14 @@
|
||||
@@ -139,6 +144,14 @@
|
||||
type winbind_var_run_t;
|
||||
files_pid_file(winbind_var_run_t)
|
||||
|
||||
@ -18084,7 +18211,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
########################################
|
||||
#
|
||||
# Samba net local policy
|
||||
@@ -193,7 +199,10 @@
|
||||
@@ -193,7 +206,10 @@
|
||||
|
||||
miscfiles_read_localization(samba_net_t)
|
||||
|
||||
@ -18095,7 +18222,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
|
||||
optional_policy(`
|
||||
kerberos_use(samba_net_t)
|
||||
@@ -213,7 +222,7 @@
|
||||
@@ -213,7 +229,7 @@
|
||||
allow smbd_t self:msgq create_msgq_perms;
|
||||
allow smbd_t self:sem create_sem_perms;
|
||||
allow smbd_t self:shm create_shm_perms;
|
||||
@ -18104,7 +18231,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
allow smbd_t self:tcp_socket create_stream_socket_perms;
|
||||
allow smbd_t self:udp_socket create_socket_perms;
|
||||
allow smbd_t self:unix_dgram_socket { create_socket_perms sendto };
|
||||
@@ -221,10 +230,8 @@
|
||||
@@ -221,10 +237,8 @@
|
||||
|
||||
allow smbd_t samba_etc_t:file { rw_file_perms setattr };
|
||||
|
||||
@ -18117,7 +18244,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
|
||||
allow smbd_t samba_net_tmp_t:file getattr;
|
||||
|
||||
@@ -234,6 +241,7 @@
|
||||
@@ -234,6 +248,7 @@
|
||||
manage_dirs_pattern(smbd_t,samba_share_t,samba_share_t)
|
||||
manage_files_pattern(smbd_t,samba_share_t,samba_share_t)
|
||||
manage_lnk_files_pattern(smbd_t,samba_share_t,samba_share_t)
|
||||
@ -18125,7 +18252,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
|
||||
manage_dirs_pattern(smbd_t,samba_var_t,samba_var_t)
|
||||
manage_files_pattern(smbd_t,samba_var_t,samba_var_t)
|
||||
@@ -251,7 +259,7 @@
|
||||
@@ -251,7 +266,7 @@
|
||||
manage_sock_files_pattern(smbd_t,smbd_var_run_t,smbd_var_run_t)
|
||||
files_pid_filetrans(smbd_t,smbd_var_run_t,file)
|
||||
|
||||
@ -18134,7 +18261,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
|
||||
kernel_getattr_core_if(smbd_t)
|
||||
kernel_getattr_message_if(smbd_t)
|
||||
@@ -320,6 +328,8 @@
|
||||
@@ -320,6 +335,8 @@
|
||||
userdom_dontaudit_use_unpriv_user_fds(smbd_t)
|
||||
userdom_use_unpriv_users_fds(smbd_t)
|
||||
|
||||
@ -18143,7 +18270,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
ifdef(`hide_broken_symptoms', `
|
||||
files_dontaudit_getattr_default_dirs(smbd_t)
|
||||
files_dontaudit_getattr_boot_dirs(smbd_t)
|
||||
@@ -340,6 +350,17 @@
|
||||
@@ -340,6 +357,23 @@
|
||||
tunable_policy(`samba_share_nfs',`
|
||||
fs_manage_nfs_dirs(smbd_t)
|
||||
fs_manage_nfs_files(smbd_t)
|
||||
@ -18152,6 +18279,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
+ fs_manage_nfs_named_sockets(smbd_t)
|
||||
+')
|
||||
+
|
||||
+# Support Samba sharing of ntfs/fusefs mount points
|
||||
+tunable_policy(`samba_share_fusefs',`
|
||||
+ fs_manage_fusefs_dirs(smbd_t)
|
||||
+ fs_manage_fusefs_files(smbd_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ kerberos_read_keytab(smbd_t)
|
||||
+')
|
||||
@ -18161,7 +18294,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -391,7 +412,7 @@
|
||||
@@ -391,7 +425,7 @@
|
||||
allow nmbd_t self:msgq create_msgq_perms;
|
||||
allow nmbd_t self:sem create_sem_perms;
|
||||
allow nmbd_t self:shm create_shm_perms;
|
||||
@ -18170,7 +18303,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
allow nmbd_t self:tcp_socket create_stream_socket_perms;
|
||||
allow nmbd_t self:udp_socket create_socket_perms;
|
||||
allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto };
|
||||
@@ -403,8 +424,7 @@
|
||||
@@ -403,8 +437,7 @@
|
||||
read_files_pattern(nmbd_t,samba_etc_t,samba_etc_t)
|
||||
|
||||
manage_dirs_pattern(nmbd_t,samba_log_t,samba_log_t)
|
||||
@ -18180,7 +18313,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
|
||||
read_files_pattern(nmbd_t,samba_log_t,samba_log_t)
|
||||
create_files_pattern(nmbd_t,samba_log_t,samba_log_t)
|
||||
@@ -439,6 +459,7 @@
|
||||
@@ -439,6 +472,7 @@
|
||||
dev_getattr_mtrr_dev(nmbd_t)
|
||||
|
||||
fs_getattr_all_fs(nmbd_t)
|
||||
@ -18188,7 +18321,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
fs_search_auto_mountpoints(nmbd_t)
|
||||
|
||||
domain_use_interactive_fds(nmbd_t)
|
||||
@@ -522,6 +543,7 @@
|
||||
@@ -522,6 +556,7 @@
|
||||
storage_raw_write_fixed_disk(smbmount_t)
|
||||
|
||||
term_list_ptys(smbmount_t)
|
||||
@ -18196,7 +18329,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
|
||||
corecmd_list_bin(smbmount_t)
|
||||
|
||||
@@ -546,28 +568,37 @@
|
||||
@@ -546,28 +581,37 @@
|
||||
|
||||
userdom_use_all_users_fds(smbmount_t)
|
||||
|
||||
@ -18241,7 +18374,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
allow swat_t smbd_var_run_t:file read;
|
||||
|
||||
manage_dirs_pattern(swat_t,swat_tmp_t,swat_tmp_t)
|
||||
@@ -577,7 +608,9 @@
|
||||
@@ -577,7 +621,9 @@
|
||||
manage_files_pattern(swat_t,swat_var_run_t,swat_var_run_t)
|
||||
files_pid_filetrans(swat_t,swat_var_run_t,file)
|
||||
|
||||
@ -18252,7 +18385,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
|
||||
kernel_read_kernel_sysctls(swat_t)
|
||||
kernel_read_system_state(swat_t)
|
||||
@@ -602,6 +635,7 @@
|
||||
@@ -602,6 +648,7 @@
|
||||
|
||||
dev_read_urand(swat_t)
|
||||
|
||||
@ -18260,7 +18393,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
files_read_etc_files(swat_t)
|
||||
files_search_home(swat_t)
|
||||
files_read_usr_files(swat_t)
|
||||
@@ -614,6 +648,7 @@
|
||||
@@ -614,6 +661,7 @@
|
||||
libs_use_shared_libs(swat_t)
|
||||
|
||||
logging_send_syslog_msg(swat_t)
|
||||
@ -18268,7 +18401,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
logging_search_logs(swat_t)
|
||||
|
||||
miscfiles_read_localization(swat_t)
|
||||
@@ -631,6 +666,17 @@
|
||||
@@ -631,6 +679,17 @@
|
||||
kerberos_use(swat_t)
|
||||
')
|
||||
|
||||
@ -18286,7 +18419,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
########################################
|
||||
#
|
||||
# Winbind local policy
|
||||
@@ -679,6 +725,8 @@
|
||||
@@ -679,6 +738,8 @@
|
||||
manage_sock_files_pattern(winbind_t,winbind_var_run_t,winbind_var_run_t)
|
||||
files_pid_filetrans(winbind_t,winbind_var_run_t,file)
|
||||
|
||||
@ -18295,7 +18428,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
kernel_read_kernel_sysctls(winbind_t)
|
||||
kernel_list_proc(winbind_t)
|
||||
kernel_read_proc_symlinks(winbind_t)
|
||||
@@ -766,6 +814,7 @@
|
||||
@@ -766,6 +827,7 @@
|
||||
optional_policy(`
|
||||
squid_read_log(winbind_helper_t)
|
||||
squid_append_log(winbind_helper_t)
|
||||
@ -18303,7 +18436,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -790,3 +839,37 @@
|
||||
@@ -790,3 +852,37 @@
|
||||
domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t)
|
||||
')
|
||||
')
|
||||
@ -20992,7 +21125,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.2.7/policy/modules/services/xserver.if
|
||||
--- nsaserefpolicy/policy/modules/services/xserver.if 2007-12-04 11:02:50.000000000 -0500
|
||||
+++ serefpolicy-3.2.7/policy/modules/services/xserver.if 2008-02-06 11:02:30.000000000 -0500
|
||||
+++ serefpolicy-3.2.7/policy/modules/services/xserver.if 2008-02-12 12:15:41.000000000 -0500
|
||||
@@ -15,6 +15,7 @@
|
||||
template(`xserver_common_domain_template',`
|
||||
gen_require(`
|
||||
@ -21714,7 +21847,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
+
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.2.7/policy/modules/services/xserver.te
|
||||
--- nsaserefpolicy/policy/modules/services/xserver.te 2007-12-19 05:32:17.000000000 -0500
|
||||
+++ serefpolicy-3.2.7/policy/modules/services/xserver.te 2008-02-11 14:21:09.000000000 -0500
|
||||
+++ serefpolicy-3.2.7/policy/modules/services/xserver.te 2008-02-12 12:43:50.000000000 -0500
|
||||
@@ -16,6 +16,13 @@
|
||||
|
||||
## <desc>
|
||||
@ -21919,31 +22052,36 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
|
||||
xserver_rw_session_template(xdm,xdm_t,xdm_tmpfs_t)
|
||||
|
||||
@@ -304,7 +363,23 @@
|
||||
@@ -304,7 +363,27 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
- consolekit_dbus_chat(xdm_t)
|
||||
+ bootloader_domtrans(xdm_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ consolekit_read_log(xdm_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
consolekit_dbus_chat(xdm_t)
|
||||
+ dbus_system_bus_client_template(xdm, xdm_t)
|
||||
+ dbus_per_role_template(xdm, xdm_t, system_r)
|
||||
+ dbus_system_bus_client_template(xdm, xdm_t)
|
||||
+
|
||||
+ optional_policy(`
|
||||
+ consolekit_dbus_chat(xdm_t)
|
||||
+ ')
|
||||
+
|
||||
+ optional_policy(`
|
||||
+ hal_dbus_chat(xdm_t)
|
||||
+ ')
|
||||
+
|
||||
+ optional_policy(`
|
||||
+ networkmanager_dbus_chat(xdm_t)
|
||||
+ ')
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -322,6 +397,10 @@
|
||||
@@ -322,6 +401,10 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -21954,7 +22092,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
loadkeys_exec(xdm_t)
|
||||
')
|
||||
|
||||
@@ -335,6 +414,11 @@
|
||||
@@ -335,6 +418,11 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -21966,7 +22104,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
seutil_sigchld_newrole(xdm_t)
|
||||
')
|
||||
|
||||
@@ -343,8 +427,8 @@
|
||||
@@ -343,8 +431,8 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -21976,7 +22114,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
|
||||
ifndef(`distro_redhat',`
|
||||
allow xdm_t self:process { execheap execmem };
|
||||
@@ -380,7 +464,7 @@
|
||||
@@ -380,7 +468,7 @@
|
||||
allow xdm_xserver_t xdm_var_lib_t:file { getattr read };
|
||||
dontaudit xdm_xserver_t xdm_var_lib_t:dir search;
|
||||
|
||||
@ -21985,7 +22123,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
|
||||
# Label pid and temporary files with derived types.
|
||||
manage_files_pattern(xdm_xserver_t,xdm_tmp_t,xdm_tmp_t)
|
||||
@@ -392,6 +476,15 @@
|
||||
@@ -392,6 +480,15 @@
|
||||
can_exec(xdm_xserver_t, xkb_var_lib_t)
|
||||
files_search_var_lib(xdm_xserver_t)
|
||||
|
||||
@ -22001,7 +22139,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
# VNC v4 module in X server
|
||||
corenet_tcp_bind_vnc_port(xdm_xserver_t)
|
||||
|
||||
@@ -404,6 +497,7 @@
|
||||
@@ -404,6 +501,7 @@
|
||||
# to read ROLE_home_t - examine this in more detail
|
||||
# (xauth?)
|
||||
userdom_read_unpriv_users_home_content_files(xdm_xserver_t)
|
||||
@ -22009,7 +22147,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
|
||||
xserver_use_all_users_fonts(xdm_xserver_t)
|
||||
|
||||
@@ -420,6 +514,14 @@
|
||||
@@ -420,6 +518,14 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -22024,7 +22162,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
resmgr_stream_connect(xdm_t)
|
||||
')
|
||||
|
||||
@@ -429,47 +531,103 @@
|
||||
@@ -429,47 +535,103 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -22048,6 +22186,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
+ # xserver signals unconfined user on startx
|
||||
+ unconfined_signal(xdm_xserver_t)
|
||||
+ unconfined_getpgid(xdm_xserver_t)
|
||||
+')
|
||||
+
|
||||
+
|
||||
+tunable_policy(`allow_xserver_execmem', `
|
||||
+ allow xdm_xserver_t self:process { execheap execmem execstack };
|
||||
+')
|
||||
+
|
||||
+ifndef(`distro_redhat',`
|
||||
+ allow xdm_xserver_t self:process { execheap execmem };
|
||||
')
|
||||
|
||||
-ifdef(`TODO',`
|
||||
@ -22071,19 +22218,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
-allow xdm_t polymember:lnk_file { create unlink };
|
||||
-# xdm needs access for copying .Xauthority into new home
|
||||
-allow xdm_t polymember:file { create getattr write };
|
||||
+
|
||||
+tunable_policy(`allow_xserver_execmem', `
|
||||
+ allow xdm_xserver_t self:process { execheap execmem execstack };
|
||||
')
|
||||
|
||||
+ifndef(`distro_redhat',`
|
||||
+ allow xdm_xserver_t self:process { execheap execmem };
|
||||
+')
|
||||
+
|
||||
+ifdef(`distro_rhel4',`
|
||||
+ allow xdm_xserver_t self:process { execheap execmem };
|
||||
+')
|
||||
+
|
||||
')
|
||||
|
||||
+##############################
|
||||
#
|
||||
-# Wants to delete .xsession-errors file
|
||||
@ -25316,8 +25454,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
|
||||
xen_append_log(ifconfig_t)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.2.7/policy/modules/system/udev.te
|
||||
--- nsaserefpolicy/policy/modules/system/udev.te 2007-12-19 05:32:17.000000000 -0500
|
||||
+++ serefpolicy-3.2.7/policy/modules/system/udev.te 2008-02-06 11:02:30.000000000 -0500
|
||||
@@ -96,9 +96,6 @@
|
||||
+++ serefpolicy-3.2.7/policy/modules/system/udev.te 2008-02-12 12:02:58.000000000 -0500
|
||||
@@ -83,6 +83,7 @@
|
||||
kernel_rw_unix_dgram_sockets(udev_t)
|
||||
kernel_dgram_send(udev_t)
|
||||
kernel_signal(udev_t)
|
||||
+kernel_search_debugfs(udev_t)
|
||||
|
||||
#https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235182
|
||||
kernel_rw_net_sysctls(udev_t)
|
||||
@@ -96,9 +97,6 @@
|
||||
dev_delete_generic_files(udev_t)
|
||||
dev_search_usbfs(udev_t)
|
||||
dev_relabel_all_dev_nodes(udev_t)
|
||||
@ -25327,7 +25473,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
|
||||
|
||||
domain_read_all_domains_state(udev_t)
|
||||
domain_dontaudit_ptrace_all_domains(udev_t) #pidof triggers these
|
||||
@@ -189,6 +186,7 @@
|
||||
@@ -189,6 +187,7 @@
|
||||
|
||||
optional_policy(`
|
||||
alsa_domtrans(udev_t)
|
||||
@ -25335,7 +25481,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t
|
||||
alsa_read_rw_config(udev_t)
|
||||
')
|
||||
|
||||
@@ -197,6 +195,10 @@
|
||||
@@ -197,6 +196,10 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
|
||||
Loading…
Reference in New Issue
Block a user