rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Fix system-config-services policy

Browse Source
This commit is contained in:
Daniel J Walsh 2009-08-20 17:48:51 +00:00
parent fc8ff2feac
commit e3dd4912ce
3 changed files with 250 additions and 96 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.cvsignore
View File

@ -184,3 +184,4 @@ serefpolicy-3.6.25.tgz
serefpolicy-3.6.26.tgz
serefpolicy-3.6.27.tgz
serefpolicy-3.6.28.tgz
setroubleshoot-2.2.21.tar.gz

340
policy-F12.patch
View File

@ -440,7 +440,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
(( h1 dom h2 ) or ( t1 == mcssetcats ));
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.6.28/policy/modules/admin/anaconda.te
--- nsaserefpolicy/policy/modules/admin/anaconda.te 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/admin/anaconda.te 2009-08-18 13:23:29.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/admin/anaconda.te 2009-08-20 08:51:33.000000000 -0400
@@ -31,6 +31,7 @@
modutils_domtrans_insmod(anaconda_t)
@ -449,6 +449,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_user_home_dir_filetrans_user_home_content(anaconda_t, { dir file lnk_file fifo_file sock_file })
@@ -52,7 +53,7 @@
')
optional_policy(`
- unconfined_domain(anaconda_t)
+ unconfined_domain_noaudit(anaconda_t)
')
optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/certwatch.te serefpolicy-3.6.28/policy/modules/admin/certwatch.te
--- nsaserefpolicy/policy/modules/admin/certwatch.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/admin/certwatch.te 2009-08-18 13:23:29.000000000 -0400
@ -4730,8 +4739,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.6.28/policy/modules/kernel/corecommands.fc
--- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2009-07-30 13:09:10.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/kernel/corecommands.fc 2009-08-18 13:23:29.000000000 -0400
@@ -125,6 +125,7 @@
+++ serefpolicy-3.6.28/policy/modules/kernel/corecommands.fc 2009-08-20 08:44:10.000000000 -0400
@@ -54,6 +54,7 @@
/etc/cron.weekly/.* -- gen_context(system_u:object_r:bin_t,s0)
/etc/cron.monthly/.* -- gen_context(system_u:object_r:bin_t,s0)
+/etc/dhcp/dhclient\.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
/etc/hotplug/.*agent -- gen_context(system_u:object_r:bin_t,s0)
/etc/hotplug/.*rc -- gen_context(system_u:object_r:bin_t,s0)
/etc/hotplug/hotplug\.functions -- gen_context(system_u:object_r:bin_t,s0)
@@ -125,6 +126,7 @@
/sbin/.* gen_context(system_u:object_r:bin_t,s0)
/sbin/mkfs\.cramfs -- gen_context(system_u:object_r:bin_t,s0)
/sbin/insmod_ksymoops_clean -- gen_context(system_u:object_r:bin_t,s0)
@ -4739,7 +4756,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
#
# /opt
@@ -142,6 +143,9 @@
@@ -142,6 +144,9 @@
/opt/vmware/workstation/lib/lib/wrapper-gtk24\.sh -- gen_context(system_u:object_r:bin_t,s0)
')
@ -4749,7 +4766,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
#
# /usr
#
@@ -315,3 +319,21 @@
@@ -315,3 +320,21 @@
ifdef(`distro_suse',`
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
')
@ -4925,7 +4942,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/dev/usb/mdc800.* -c gen_context(system_u:object_r:scanner_device_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.6.28/policy/modules/kernel/devices.if
--- nsaserefpolicy/policy/modules/kernel/devices.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/kernel/devices.if 2009-08-18 13:23:29.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/kernel/devices.if 2009-08-20 09:16:58.000000000 -0400
@@ -1655,6 +1655,78 @@
########################################
@ -5514,7 +5531,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/lib/nfs/rpc_pipefs(/.*)? <<none>>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.6.28/policy/modules/kernel/files.if
--- nsaserefpolicy/policy/modules/kernel/files.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/kernel/files.if 2009-08-18 13:38:01.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/kernel/files.if 2009-08-20 09:41:17.000000000 -0400
@@ -110,6 +110,11 @@
## </param>
#
@ -5687,7 +5704,32 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
@@ -4955,7 +5047,7 @@
@@ -4188,6 +4280,24 @@
########################################
## <summary>
+## Set the attributes of the /var/run directory.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`files_setattr_pid_dirs',`
+ gen_require(`
+ type var_run_t;
+ ')
+
+ allow $1 var_run_t:dir setattr;
+')
+
+########################################
+## <summary>
## Search the /var/lib directory.
## </summary>
## <param name="domain">
@@ -4955,7 +5065,7 @@
selinux_compute_member($1)
# Need sys_admin capability for mounting
@ -5696,7 +5738,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Need to give access to the directories to be polyinstantiated
allow $1 polydir:dir { create open getattr search write add_name setattr mounton rmdir };
@@ -4977,12 +5069,15 @@
@@ -4977,12 +5087,15 @@
allow $1 poly_t:dir { create mounton };
fs_unmount_xattr_fs($1)
@ -5713,7 +5755,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
')
@@ -5003,3 +5098,173 @@
@@ -5003,3 +5116,173 @@
typeattribute $1 files_unconfined_type;
')
@ -7632,8 +7674,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.te serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te
--- nsaserefpolicy/policy/modules/roles/unconfineduser.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te 2009-08-18 13:23:29.000000000 -0400
@@ -0,0 +1,395 @@
+++ serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te 2009-08-20 09:01:03.000000000 -0400
@@ -0,0 +1,391 @@
+policy_module(unconfineduser, 1.0.0)
+
+########################################
@ -7940,10 +7982,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
+
+optional_policy(`
+ vbetool_run(unconfined_t, unconfined_r)
+')
+
+optional_policy(`
+ vpn_run(unconfined_t, unconfined_r)
+')
+
@ -9620,8 +9658,43 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.if serefpolicy-3.6.28/policy/modules/services/bind.if
--- nsaserefpolicy/policy/modules/services/bind.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/bind.if 2009-08-18 13:23:29.000000000 -0400
@@ -287,6 +287,25 @@
+++ serefpolicy-3.6.28/policy/modules/services/bind.if 2009-08-20 08:12:55.000000000 -0400
@@ -235,7 +235,7 @@
########################################
## <summary>
-## Do not audit attempts to set the attributes
+## Allow domain to set the attributes
## of the BIND pid directory.
## </summary>
## <param name="domain">
@@ -254,6 +254,25 @@
########################################
## <summary>
+## Allow domain to set attributes
+## of the BIND zone directory.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`bind_setattr_zone_dirs',`
+ gen_require(`
+ type named_zone_t;
+ ')
+
+ allow $1 named_zone_t:dir setattr;
+')
+
+########################################
+## <summary>
## Read BIND zone files.
## </summary>
## <param name="domain">
@@ -287,6 +306,25 @@
########################################
## <summary>
@ -11024,7 +11097,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow $1 devicekit_t:process { ptrace signal_perms getattr };
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.6.28/policy/modules/services/devicekit.te
--- nsaserefpolicy/policy/modules/services/devicekit.te 2009-07-29 15:15:33.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/devicekit.te 2009-08-18 13:23:29.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/devicekit.te 2009-08-20 09:17:41.000000000 -0400
@@ -36,12 +36,15 @@
manage_dirs_pattern(devicekit_t, devicekit_var_run_t, devicekit_var_run_t)
manage_files_pattern(devicekit_t, devicekit_var_run_t, devicekit_var_run_t)
@ -11144,7 +11217,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dev_rw_generic_usb_dev(devicekit_power_t)
dev_rw_netcontrol(devicekit_power_t)
dev_rw_sysfs(devicekit_power_t)
@@ -167,12 +195,16 @@
@@ -167,12 +195,17 @@
files_read_etc_files(devicekit_power_t)
files_read_usr_files(devicekit_power_t)
@ -11156,12 +11229,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
miscfiles_read_localization(devicekit_power_t)
+sysnet_read_config(devicekit_power_t)
+sysnet_read_dhcp_config(devicekit_power_t)
+
userdom_read_all_users_state(devicekit_power_t)
optional_policy(`
@@ -180,8 +212,11 @@
@@ -180,8 +213,11 @@
')
optional_policy(`
@ -11174,7 +11248,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow devicekit_power_t devicekit_t:dbus send_msg;
optional_policy(`
@@ -203,17 +238,23 @@
@@ -203,17 +239,23 @@
optional_policy(`
hal_domtrans_mac(devicekit_power_t)
@ -11587,8 +11661,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd.te serefpolicy-3.6.28/policy/modules/services/gpsd.te
--- nsaserefpolicy/policy/modules/services/gpsd.te 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/gpsd.te 2009-08-18 13:23:29.000000000 -0400
@@ -11,9 +11,15 @@
+++ serefpolicy-3.6.28/policy/modules/services/gpsd.te 2009-08-20 08:28:36.000000000 -0400
@@ -11,15 +11,21 @@
application_domain(gpsd_t, gpsd_exec_t)
init_daemon_domain(gpsd_t, gpsd_exec_t)
@ -11604,6 +11678,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
#
# gpsd local policy
#
-allow gpsd_t self:capability { setuid sys_nice setgid fowner };
+allow gpsd_t self:capability { fsetid setuid sys_nice setgid fowner };
allow gpsd_t self:process setsched;
allow gpsd_t self:shm create_shm_perms;
allow gpsd_t self:unix_dgram_socket { create_socket_perms sendto };
@@ -29,6 +35,10 @@
manage_files_pattern(gpsd_t, gpsd_tmpfs_t, gpsd_tmpfs_t)
fs_tmpfs_filetrans(gpsd_t, gpsd_tmpfs_t, { dir file })
@ -13459,9 +13540,45 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.fc serefpolicy-3.6.28/policy/modules/services/nx.fc
--- nsaserefpolicy/policy/modules/services/nx.fc 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/nx.fc 2009-08-20 08:55:05.000000000 -0400
@@ -1,6 +1,7 @@
/opt/NX/bin/nxserver -- gen_context(system_u:object_r:nx_server_exec_t,s0)
/opt/NX/home/nx/\.ssh(/.*)? gen_context(system_u:object_r:nx_server_home_ssh_t,s0)
+/var/lib/nxserver/home/.ssh(/.*)? gen_context(system_u:object_r:nx_server_home_ssh_t,s0)
/opt/NX/var(/.*)? gen_context(system_u:object_r:nx_server_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.if serefpolicy-3.6.28/policy/modules/services/nx.if
--- nsaserefpolicy/policy/modules/services/nx.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/nx.if 2009-08-20 09:23:37.000000000 -0400
@@ -17,3 +17,21 @@
spec_domtrans_pattern($1, nx_server_exec_t, nx_server_t)
')
+
+########################################
+## <summary>
+## Read nx home directory content
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`nx_read_home_files',`
+ gen_require(`
+ type nx_server_home_ssh_t;
+ ')
+
+ read_files_pattern($1, nx_server_home_ssh_t, nx_server_home_ssh_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.te serefpolicy-3.6.28/policy/modules/services/nx.te
--- nsaserefpolicy/policy/modules/services/nx.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/nx.te 2009-08-18 13:23:29.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/nx.te 2009-08-20 12:45:07.000000000 -0400
@@ -25,6 +25,9 @@
type nx_server_var_run_t;
files_pid_file(nx_server_var_run_t)
@ -14608,7 +14725,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.if serefpolicy-3.6.28/policy/modules/services/ppp.if
--- nsaserefpolicy/policy/modules/services/ppp.if 2009-07-23 14:11:04.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/ppp.if 2009-08-18 13:23:29.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/ppp.if 2009-08-20 08:37:53.000000000 -0400
@@ -177,10 +177,16 @@
interface(`ppp_run',`
gen_require(`
@ -14628,7 +14745,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.6.28/policy/modules/services/ppp.te
--- nsaserefpolicy/policy/modules/services/ppp.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/ppp.te 2009-08-18 13:23:29.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/ppp.te 2009-08-20 08:34:18.000000000 -0400
@@ -193,6 +193,8 @@
optional_policy(`
@ -17076,7 +17193,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/root/\.ssh(/.*)? gen_context(system_u:object_r:home_ssh_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.6.28/policy/modules/services/ssh.if
--- nsaserefpolicy/policy/modules/services/ssh.if 2009-07-23 14:11:04.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/ssh.if 2009-08-18 13:23:29.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/ssh.if 2009-08-20 12:45:06.000000000 -0400
@@ -36,6 +36,7 @@
gen_require(`
attribute ssh_server;
@ -17379,7 +17496,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.6.28/policy/modules/services/ssh.te
--- nsaserefpolicy/policy/modules/services/ssh.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/ssh.te 2009-08-18 13:23:29.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/ssh.te 2009-08-20 09:24:08.000000000 -0400
@@ -41,6 +41,9 @@
files_tmp_file(sshd_tmp_t)
files_poly_parent(sshd_tmp_t)
@ -17520,7 +17637,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
@@ -341,7 +355,11 @@
@@ -331,6 +345,10 @@
')
optional_policy(`
+ nx_read_home_files(sshd_t)
+')
+
+optional_policy(`
rpm_use_script_fds(sshd_t)
')
@@ -341,7 +359,11 @@
')
optional_policy(`
@ -17533,7 +17661,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
unconfined_shell_domtrans(sshd_t)
')
@@ -400,15 +418,13 @@
@@ -400,15 +422,13 @@
init_use_fds(ssh_keygen_t)
init_use_script_ptys(ssh_keygen_t)
@ -19034,7 +19162,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.28/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/xserver.te 2009-08-18 13:23:29.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/xserver.te 2009-08-20 07:54:04.000000000 -0400
@@ -34,6 +34,13 @@
## <desc>
@ -20287,7 +20415,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.6.28/policy/modules/system/fstools.te
--- nsaserefpolicy/policy/modules/system/fstools.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/fstools.te 2009-08-18 13:23:29.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/fstools.te 2009-08-20 08:58:51.000000000 -0400
@@ -65,13 +65,7 @@
kernel_rw_unlabeled_dirs(fsadm_t)
kernel_rw_unlabeled_blk_files(fsadm_t)
@ -20377,7 +20505,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
init_use_fds(fsadm_t)
init_use_script_ptys(fsadm_t)
init_dontaudit_getattr_initctl(fsadm_t)
@@ -147,8 +154,7 @@
@@ -144,11 +151,11 @@
miscfiles_read_localization(fsadm_t)
modutils_read_module_config(fsadm_t)
+modutils_read_module_deps(fsadm_t)
seutil_read_config(fsadm_t)
@ -20387,7 +20519,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
ifdef(`distro_redhat',`
optional_policy(`
@@ -177,4 +183,6 @@
@@ -177,4 +184,6 @@
optional_policy(`
xen_append_log(fsadm_t)
@ -20508,7 +20640,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
#
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.6.28/policy/modules/system/init.if
--- nsaserefpolicy/policy/modules/system/init.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/init.if 2009-08-18 13:23:29.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/init.if 2009-08-20 08:05:39.000000000 -0400
@@ -174,6 +174,7 @@
role system_r types $1;
@ -20748,7 +20880,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.6.28/policy/modules/system/init.te
--- nsaserefpolicy/policy/modules/system/init.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/init.te 2009-08-18 13:23:29.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/init.te 2009-08-20 09:41:30.000000000 -0400
@@ -17,6 +17,20 @@
## </desc>
gen_tunable(init_upstart, false)
@ -20873,22 +21005,25 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_tmp_filetrans(initrc_t, initrc_tmp_t, { file dir })
init_write_initctl(initrc_t)
@@ -249,10 +287,12 @@
@@ -249,10 +287,15 @@
kernel_rw_all_sysctls(initrc_t)
# for lsof which is used by alsa shutdown:
kernel_dontaudit_getattr_message_if(initrc_t)
+kernel_stream_connect(initrc_t)
+files_read_kernel_modules(initrc_t)
+files_read_config_files(initrc_t)
+files_read_var_lib_symlinks(initrc_t)
+files_setattr_pid_dirs(initrc_t)
files_read_kernel_symbol_table(initrc_t)
-
-corecmd_exec_all_executables(initrc_t)
+files_exec_etc_files(initrc_t)
+files_manage_etc_symlinks(initrc_t)
corenet_all_recvfrom_unlabeled(initrc_t)
corenet_all_recvfrom_netlabel(initrc_t)
@@ -272,16 +312,62 @@
@@ -272,16 +315,62 @@
dev_rw_sysfs(initrc_t)
dev_list_usbfs(initrc_t)
dev_read_framebuffer(initrc_t)
@ -20952,7 +21087,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
domain_kill_all_domains(initrc_t)
domain_signal_all_domains(initrc_t)
@@ -291,7 +377,7 @@
@@ -291,7 +380,7 @@
domain_sigchld_all_domains(initrc_t)
domain_read_all_domains_state(initrc_t)
domain_getattr_all_domains(initrc_t)
@ -20961,7 +21096,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
domain_getsession_all_domains(initrc_t)
domain_use_interactive_fds(initrc_t)
# for lsof which is used by alsa shutdown:
@@ -306,14 +392,15 @@
@@ -306,14 +395,15 @@
files_getattr_all_pipes(initrc_t)
files_getattr_all_sockets(initrc_t)
files_purge_tmp(initrc_t)
@ -20979,7 +21114,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_exec_etc_files(initrc_t)
files_read_usr_files(initrc_t)
files_manage_urandom_seed(initrc_t)
@@ -325,47 +412,13 @@
@@ -325,47 +415,13 @@
files_list_default(initrc_t)
files_mounton_default(initrc_t)
@ -21029,7 +21164,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
logging_send_syslog_msg(initrc_t)
logging_manage_generic_logs(initrc_t)
logging_read_all_logs(initrc_t)
@@ -422,8 +475,6 @@
@@ -422,8 +478,6 @@
# init scripts touch this
clock_dontaudit_write_adjtime(initrc_t)
@ -21038,7 +21173,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# for integrated run_init to read run_init_type.
# happens during boot (/sbin/rc execs init scripts)
seutil_read_default_contexts(initrc_t)
@@ -450,11 +501,9 @@
@@ -450,11 +504,9 @@
# Red Hat systems seem to have a stray
# fd open from the initrd
@ -21051,7 +21186,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# These seem to be from the initrd
# during device initialization:
dev_create_generic_dirs(initrc_t)
@@ -464,6 +513,7 @@
@@ -464,6 +516,7 @@
storage_raw_read_fixed_disk(initrc_t)
storage_raw_write_fixed_disk(initrc_t)
@ -21059,7 +21194,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_create_boot_flag(initrc_t)
files_rw_boot_symlinks(initrc_t)
# wants to read /.fonts directory
@@ -497,6 +547,7 @@
@@ -492,11 +545,13 @@
optional_policy(`
bind_manage_config_dirs(initrc_t)
bind_write_config(initrc_t)
+ bind_setattr_zone_dirs(initrc_t)
')
optional_policy(`
#for /etc/rc.d/init.d/nfs to create /etc/exports
rpc_write_exports(initrc_t)
@ -21067,7 +21208,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
@@ -515,6 +566,33 @@
@@ -515,6 +570,33 @@
')
')
@ -21101,7 +21242,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t)
@@ -569,6 +647,10 @@
@@ -569,8 +651,16 @@
dbus_read_config(initrc_t)
optional_policy(`
@ -21111,8 +21252,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ optional_policy(`
networkmanager_dbus_chat(initrc_t)
')
+
+ optional_policy(`
+ policykit_dbus_chat(initrc_t)
+ ')
')
@@ -590,6 +672,10 @@
optional_policy(`
@@ -590,6 +680,10 @@
')
optional_policy(`
@ -21123,7 +21270,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dev_read_usbfs(initrc_t)
# init scripts run /etc/hotplug/usb.rc
@@ -646,20 +732,20 @@
@@ -646,20 +740,20 @@
')
optional_policy(`
@ -21150,7 +21297,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
ifdef(`distro_redhat',`
@@ -668,6 +754,7 @@
@@ -668,6 +762,7 @@
mysql_stream_connect(initrc_t)
mysql_write_log(initrc_t)
@ -21158,7 +21305,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
@@ -696,7 +783,6 @@
@@ -696,7 +791,6 @@
')
optional_policy(`
@ -21166,7 +21313,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
fs_write_ramfs_sockets(initrc_t)
fs_search_ramfs(initrc_t)
@@ -718,8 +804,6 @@
@@ -718,8 +812,6 @@
# bash tries ioctl for some reason
files_dontaudit_ioctl_all_pids(initrc_t)
@ -21175,7 +21322,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
@@ -732,10 +816,12 @@
@@ -732,10 +824,12 @@
squid_manage_logs(initrc_t)
')
@ -21188,7 +21335,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
ssh_dontaudit_read_server_keys(initrc_t)
@@ -754,6 +840,15 @@
@@ -754,6 +848,15 @@
')
optional_policy(`
@ -21204,7 +21351,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
unconfined_domain(initrc_t)
ifdef(`distro_redhat',`
@@ -764,6 +859,13 @@
@@ -764,6 +867,13 @@
optional_policy(`
mono_domtrans(initrc_t)
')
@ -21218,7 +21365,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
optional_policy(`
@@ -789,3 +891,31 @@
@@ -789,3 +899,31 @@
optional_policy(`
zebra_read_config(initrc_t)
')
@ -21293,7 +21440,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.6.28/policy/modules/system/ipsec.te
--- nsaserefpolicy/policy/modules/system/ipsec.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/ipsec.te 2009-08-19 20:01:37.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/ipsec.te 2009-08-20 12:45:08.000000000 -0400
@@ -6,6 +6,13 @@
# Declarations
#
@ -21525,12 +21672,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
locallogin_use_fds(racoon_t)
logging_send_syslog_msg(racoon_t)
@@ -328,6 +362,13 @@
@@ -328,6 +362,14 @@
miscfiles_read_localization(racoon_t)
+auth_use_pam(racoon_t)
+
+
+auth_can_read_shadow_passwords(racoon_t)
+tunable_policy(`racoon_read_shadow',`
+ auth_tunable_read_shadow(racoon_t)
@ -21539,7 +21687,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
#
# Setkey local policy
@@ -347,6 +388,7 @@
@@ -347,6 +389,7 @@
files_read_etc_files(setkey_t)
init_dontaudit_use_fds(setkey_t)
@ -24037,7 +24185,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/etc/firestarter/firestarter\.sh gen_context(system_u:object_r:dhcpc_helper_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.6.28/policy/modules/system/sysnetwork.if
--- nsaserefpolicy/policy/modules/system/sysnetwork.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/sysnetwork.if 2009-08-18 13:23:29.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/sysnetwork.if 2009-08-20 12:45:07.000000000 -0400
@@ -43,6 +43,39 @@
sysnet_domtrans_dhcpc($1)
@ -25362,7 +25510,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.28/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-07-28 13:28:33.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-18 13:23:29.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-20 09:09:55.000000000 -0400
@@ -30,8 +30,9 @@
')
@ -25727,7 +25875,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
#######################################
@@ -420,34 +424,41 @@
@@ -420,34 +424,43 @@
## is the prefix for user_t).
## </summary>
## </param>
@ -25761,6 +25909,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
- dev_rw_usbfs($1_t)
+ dev_rw_usbfs($1)
+ dev_rw_generic_usb_dev($1)
+ dev_read_video_dev($1)
+ dev_write_video_dev($1)
- xserver_user_client($1_t, user_tmpfs_t)
- xserver_xsession_entry_type($1_t)
@ -25787,7 +25937,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
#######################################
@@ -497,11 +508,7 @@
@@ -497,11 +510,7 @@
attribute unpriv_userdomain;
')
@ -25800,7 +25950,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##############################
#
@@ -511,182 +518,195 @@
@@ -511,182 +520,195 @@
# evolution and gnome-session try to create a netlink socket
dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
@ -26072,7 +26222,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
#######################################
@@ -714,13 +734,26 @@
@@ -714,13 +736,26 @@
userdom_base_user_template($1)
@ -26104,7 +26254,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_change_password_template($1)
@@ -738,70 +771,71 @@
@@ -738,70 +773,71 @@
allow $1_t self:context contains;
@ -26209,7 +26359,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
')
@@ -838,6 +872,28 @@
@@ -838,6 +874,28 @@
# Local policy
#
@ -26238,7 +26388,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
loadkeys_run($1_t,$1_r)
')
@@ -868,7 +924,10 @@
@@ -868,7 +926,10 @@
userdom_restricted_user_template($1)
@ -26250,7 +26400,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##############################
#
@@ -876,14 +935,19 @@
@@ -876,14 +937,19 @@
#
auth_role($1_r, $1_t)
@ -26275,7 +26425,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
logging_dontaudit_send_audit_msgs($1_t)
# Need to to this just so screensaver will work. Should be moved to screensaver domain
@@ -891,28 +955,47 @@
@@ -891,28 +957,47 @@
selinux_get_enforce_mode($1_t)
optional_policy(`
@ -26330,7 +26480,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
')
@@ -946,8 +1029,8 @@
@@ -946,8 +1031,8 @@
# Declarations
#
@ -26340,7 +26490,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_common_user_template($1)
##############################
@@ -956,11 +1039,12 @@
@@ -956,11 +1041,12 @@
#
# port access is audited even if dac would not have allowed it, so dontaudit it here
@ -26355,7 +26505,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# cjp: why?
files_read_kernel_symbol_table($1_t)
@@ -978,36 +1062,53 @@
@@ -978,36 +1064,53 @@
')
')
@ -26423,7 +26573,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
')
@@ -1042,7 +1143,7 @@
@@ -1042,7 +1145,7 @@
#
template(`userdom_admin_user_template',`
gen_require(`
@ -26432,7 +26582,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
##############################
@@ -1051,8 +1152,7 @@
@@ -1051,8 +1154,7 @@
#
# Inherit rules for ordinary users.
@ -26442,7 +26592,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
domain_obj_id_change_exemption($1_t)
role system_r types $1_t;
@@ -1075,7 +1175,8 @@
@@ -1075,7 +1177,8 @@
# Skip authentication when pam_rootok is specified.
allow $1_t self:passwd rootok;
@ -26452,7 +26602,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
@@ -1091,6 +1192,7 @@
@@ -1091,6 +1194,7 @@
kernel_sigstop_unlabeled($1_t)
kernel_signull_unlabeled($1_t)
kernel_sigchld_unlabeled($1_t)
@ -26460,7 +26610,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_tcp_bind_generic_port($1_t)
# allow setting up tunnels
@@ -1098,8 +1200,6 @@
@@ -1098,8 +1202,6 @@
dev_getattr_generic_blk_files($1_t)
dev_getattr_generic_chr_files($1_t)
@ -26469,7 +26619,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Allow MAKEDEV to work
dev_create_all_blk_files($1_t)
dev_create_all_chr_files($1_t)
@@ -1154,20 +1254,6 @@
@@ -1154,20 +1256,6 @@
# But presently necessary for installing the file_contexts file.
seutil_manage_bin_policy($1_t)
@ -26490,7 +26640,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
postgresql_unconfined($1_t)
')
@@ -1213,6 +1299,7 @@
@@ -1213,6 +1301,7 @@
dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1)
@ -26498,7 +26648,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Necessary for managing /boot/efi
fs_manage_dos_files($1)
@@ -1278,11 +1365,15 @@
@@ -1278,11 +1367,15 @@
interface(`userdom_user_home_content',`
gen_require(`
type user_home_t;
@ -26514,7 +26664,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
@@ -1374,12 +1465,13 @@
@@ -1374,12 +1467,13 @@
')
allow $1 user_home_dir_t:dir search_dir_perms;
@ -26529,7 +26679,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## </summary>
## <param name="domain">
## <summary>
@@ -1412,6 +1504,14 @@
@@ -1412,6 +1506,14 @@
allow $1 user_home_dir_t:dir list_dir_perms;
files_search_home($1)
@ -26544,7 +26694,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
@@ -1427,9 +1527,11 @@
@@ -1427,9 +1529,11 @@
interface(`userdom_dontaudit_list_user_home_dirs',`
gen_require(`
type user_home_dir_t;
@ -26556,7 +26706,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
@@ -1486,6 +1588,25 @@
@@ -1486,6 +1590,25 @@
allow $1 user_home_dir_t:dir relabelto;
')
@ -26582,7 +26732,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
########################################
## <summary>
## Create directories in the home dir root with
@@ -1560,6 +1681,8 @@
@@ -1560,6 +1683,8 @@
')
dontaudit $1 user_home_t:dir search_dir_perms;
@ -26591,7 +26741,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
@@ -1653,6 +1776,7 @@
@@ -1653,6 +1778,7 @@
type user_home_dir_t, user_home_t;
')
@ -26599,7 +26749,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
files_search_home($1)
')
@@ -1780,19 +1904,32 @@
@@ -1780,19 +1906,32 @@
#
interface(`userdom_exec_user_home_content_files',`
gen_require(`
@ -26639,7 +26789,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
@@ -1827,6 +1964,7 @@
@@ -1827,6 +1966,7 @@
interface(`userdom_manage_user_home_content_files',`
gen_require(`
type user_home_dir_t, user_home_t;
@ -26647,7 +26797,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
manage_files_pattern($1, user_home_t, user_home_t)
@@ -2374,7 +2512,7 @@
@@ -2374,7 +2514,7 @@
########################################
## <summary>
@ -26656,7 +26806,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## </summary>
## <param name="domain">
## <summary>
@@ -2728,11 +2866,32 @@
@@ -2728,11 +2868,32 @@
#
interface(`userdom_search_user_home_content',`
gen_require(`
@ -26691,7 +26841,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
@@ -2860,7 +3019,25 @@
@@ -2860,7 +3021,25 @@
type user_tmp_t;
')
@ -26718,7 +26868,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
@@ -2897,6 +3074,7 @@
@@ -2897,6 +3076,7 @@
')
read_files_pattern($1, userdomain, userdomain)
@ -26726,7 +26876,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_search_proc($1)
')
@@ -3027,3 +3205,501 @@
@@ -3027,3 +3207,501 @@
allow $1 userdomain:dbus send_msg;
')

5
selinux-policy.spec
View File

@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.6.28
Release: 2%{?dist}
Release: 3%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@ -475,6 +475,9 @@ exit 0
%endif
%changelog
* Thu Aug 20 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-3
- Fix system-config-services policy
* Wed Aug 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-2
- Allow libvirt to change user componant of virt_domain