From e46e005f042c2a4678b5942253b944c9054eebc9 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Wed, 11 Feb 2009 20:40:13 +0000 Subject: [PATCH] --- policy-20090105.patch | 256 +++++++++++++++++++++++++++++------------- selinux-policy.spec | 4 +- 2 files changed, 182 insertions(+), 78 deletions(-) diff --git a/policy-20090105.patch b/policy-20090105.patch index 04dc236f..1e982987 100644 --- a/policy-20090105.patch +++ b/policy-20090105.patch @@ -467,10 +467,38 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow consoletype_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow consoletype_t self:fd use; allow consoletype_t self:fifo_file rw_fifo_file_perms; +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.if serefpolicy-3.6.5/policy/modules/admin/kismet.if +--- nsaserefpolicy/policy/modules/admin/kismet.if 2008-11-11 16:13:49.000000000 -0500 ++++ serefpolicy-3.6.5/policy/modules/admin/kismet.if 2009-02-10 15:39:36.000000000 -0500 +@@ -16,6 +16,7 @@ + ') + + domtrans_pattern($1, kismet_exec_t, kismet_t) ++ allow kismet_t $1:process signull; + ') + + ######################################## diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.te serefpolicy-3.6.5/policy/modules/admin/kismet.te --- nsaserefpolicy/policy/modules/admin/kismet.te 2009-01-05 15:39:44.000000000 -0500 -+++ serefpolicy-3.6.5/policy/modules/admin/kismet.te 2009-02-10 09:45:01.000000000 -0500 -@@ -25,11 +25,14 @@ ++++ serefpolicy-3.6.5/policy/modules/admin/kismet.te 2009-02-10 15:44:33.000000000 -0500 +@@ -14,27 +14,37 @@ + type kismet_var_run_t; + files_pid_file(kismet_var_run_t) + +-type kismet_var_lib_t; +-files_type(kismet_var_lib_t) +- + type kismet_log_t; + logging_log_file(kismet_log_t) + ++type kismet_tmp_t; ++files_tmp_file(kismet_tmp_t) ++ ++type kismet_var_lib_t; ++files_type(kismet_var_lib_t) ++ + ######################################## + # # kismet local policy # @@ -487,7 +515,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol manage_files_pattern(kismet_t, kismet_log_t, kismet_log_t) allow kismet_t kismet_log_t:dir setattr; -@@ -47,9 +50,19 @@ + logging_log_filetrans(kismet_t, kismet_log_t, { file dir }) + ++manage_dirs_pattern(kismet_t, kismet_tmp_t, kismet_tmp_t) ++manage_files_pattern(kismet_t, kismet_tmp_t, kismet_tmp_t) ++files_tmp_filetrans(kismet_t, kismet_tmp_t, { file dir }) ++ + allow kismet_t kismet_var_lib_t:file manage_file_perms; + allow kismet_t kismet_var_lib_t:dir manage_dir_perms; + files_var_lib_filetrans(kismet_t, kismet_var_lib_t, { file dir }) +@@ -47,10 +57,22 @@ corecmd_exec_bin(kismet_t) @@ -499,6 +536,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +corenet_tcp_bind_generic_node(kismet_t) +corenet_tcp_bind_kismet_port(kismet_t) +corenet_tcp_connect_kismet_port(kismet_t) ++corenet_tcp_connect_pulseaudio_port(kismet_t) + auth_use_nsswitch(kismet_t) @@ -507,6 +545,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol miscfiles_read_localization(kismet_t) + userdom_use_user_terminals(kismet_t) ++userdom_read_user_tmpfs_files(kismet_t) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.6.5/policy/modules/admin/logrotate.te --- nsaserefpolicy/policy/modules/admin/logrotate.te 2009-01-05 15:39:44.000000000 -0500 +++ serefpolicy-3.6.5/policy/modules/admin/logrotate.te 2009-02-10 09:45:01.000000000 -0500 @@ -5502,7 +5542,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol /var/lib/nfs/rpc_pipefs(/.*)? <> diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.6.5/policy/modules/kernel/files.if --- nsaserefpolicy/policy/modules/kernel/files.if 2009-01-05 15:39:38.000000000 -0500 -+++ serefpolicy-3.6.5/policy/modules/kernel/files.if 2009-02-10 09:45:01.000000000 -0500 ++++ serefpolicy-3.6.5/policy/modules/kernel/files.if 2009-02-10 15:43:06.000000000 -0500 @@ -110,6 +110,11 @@ ## # @@ -8944,7 +8984,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.6.5/policy/modules/services/apache.te --- nsaserefpolicy/policy/modules/services/apache.te 2009-01-19 11:06:49.000000000 -0500 -+++ serefpolicy-3.6.5/policy/modules/services/apache.te 2009-02-10 09:45:36.000000000 -0500 ++++ serefpolicy-3.6.5/policy/modules/services/apache.te 2009-02-10 12:10:14.000000000 -0500 @@ -19,6 +19,8 @@ # Declarations # @@ -12222,11 +12262,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol corenet_udp_sendrecv_all_ports(dcc_client_t) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.fc serefpolicy-3.6.5/policy/modules/services/devicekit.fc --- nsaserefpolicy/policy/modules/services/devicekit.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.6.5/policy/modules/services/devicekit.fc 2009-02-10 09:45:02.000000000 -0500 -@@ -0,0 +1,4 @@ ++++ serefpolicy-3.6.5/policy/modules/services/devicekit.fc 2009-02-10 13:52:24.000000000 -0500 +@@ -0,0 +1,7 @@ + +/usr/libexec/devkit-daemon -- gen_context(system_u:object_r:devicekit_exec_t,s0) +/usr/libexec/devkit-power-daemon -- gen_context(system_u:object_r:devicekit_power_exec_t,s0) ++ ++/var/lib/DeviceKit-power(/.*)? gen_context(system_u:object_r:devicekit_var_lib_t,s0) ++ +/var/run/devkit(/.*)? gen_context(system_u:object_r:devicekit_var_run_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.if serefpolicy-3.6.5/policy/modules/services/devicekit.if --- nsaserefpolicy/policy/modules/services/devicekit.if 1969-12-31 19:00:00.000000000 -0500 @@ -12411,8 +12454,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.6.5/policy/modules/services/devicekit.te --- nsaserefpolicy/policy/modules/services/devicekit.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.6.5/policy/modules/services/devicekit.te 2009-02-10 09:45:02.000000000 -0500 -@@ -0,0 +1,131 @@ ++++ serefpolicy-3.6.5/policy/modules/services/devicekit.te 2009-02-10 13:51:44.000000000 -0500 +@@ -0,0 +1,138 @@ +policy_module(devicekit,1.0.0) + +######################################## @@ -12435,6 +12478,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +type devicekit_var_run_t; +files_pid_file(devicekit_var_run_t) + ++type devicekit_var_lib_t; ++files_type(devicekit_var_lib_t) ++ +# +# DeviceKit local policy +# @@ -12468,6 +12514,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +allow devicekit_power_t self:fifo_file rw_fifo_file_perms; +allow devicekit_power_t self:unix_dgram_socket create_socket_perms; + ++manage_dirs_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t) ++manage_files_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t) ++files_search_var_lib(devicekit_power_t) ++ +corecmd_exec_bin(devicekit_power_t) +corecmd_exec_shell(devicekit_power_t) + @@ -13260,7 +13310,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.6.5/policy/modules/services/ftp.te --- nsaserefpolicy/policy/modules/services/ftp.te 2009-01-19 11:06:49.000000000 -0500 -+++ serefpolicy-3.6.5/policy/modules/services/ftp.te 2009-02-10 11:07:54.000000000 -0500 ++++ serefpolicy-3.6.5/policy/modules/services/ftp.te 2009-02-10 12:12:28.000000000 -0500 @@ -26,7 +26,7 @@ ## ##

@@ -13314,7 +13364,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol tunable_policy(`ftp_home_dir && use_nfs_home_dirs',` fs_manage_nfs_files(ftpd_t) -@@ -258,7 +270,15 @@ +@@ -258,7 +270,26 @@ ') optional_policy(` @@ -13328,10 +13378,21 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + tunable_policy(`ftpd_connect_db',` + mysql_stream_connect(ftpd_t) + ') ++') ++ ++optional_policy(` ++ tunable_policy(`ftpd_connect_db',` ++ postgresql_stream_connect(ftpd_t) ++ ') ++') ++ ++tunable_policy(`ftpd_connect_db',` ++ corenet_tcp_connect_mysqld_port(ftpd_t) ++ corenet_tcp_connect_postgresql_port(ftpd_t) ') optional_policy(` -@@ -270,6 +290,14 @@ +@@ -270,6 +301,14 @@ ') optional_policy(` @@ -18605,7 +18666,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # /usr diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.if serefpolicy-3.6.5/policy/modules/services/postgresql.if --- nsaserefpolicy/policy/modules/services/postgresql.if 2009-01-05 15:39:43.000000000 -0500 -+++ serefpolicy-3.6.5/policy/modules/services/postgresql.if 2009-02-10 09:45:02.000000000 -0500 ++++ serefpolicy-3.6.5/policy/modules/services/postgresql.if 2009-02-10 12:07:46.000000000 -0500 @@ -351,3 +351,46 @@ typeattribute $1 sepgsql_unconfined_type; @@ -18655,7 +18716,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.te serefpolicy-3.6.5/policy/modules/services/postgresql.te --- nsaserefpolicy/policy/modules/services/postgresql.te 2009-02-03 22:50:50.000000000 -0500 -+++ serefpolicy-3.6.5/policy/modules/services/postgresql.te 2009-02-10 09:45:02.000000000 -0500 ++++ serefpolicy-3.6.5/policy/modules/services/postgresql.te 2009-02-10 12:10:08.000000000 -0500 @@ -32,6 +32,9 @@ type postgresql_etc_t; files_config_file(postgresql_etc_t) @@ -22629,6 +22690,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol files_search_home(stunnel_t) optional_policy(` +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.fc serefpolicy-3.6.5/policy/modules/services/sysstat.fc +--- nsaserefpolicy/policy/modules/services/sysstat.fc 2008-08-07 11:15:11.000000000 -0400 ++++ serefpolicy-3.6.5/policy/modules/services/sysstat.fc 2009-02-11 11:00:38.000000000 -0500 +@@ -1,6 +1,6 @@ + + /usr/lib(64)?/atsar/atsa.* -- gen_context(system_u:object_r:sysstat_exec_t,s0) +-/usr/lib(64)?/sa/sadc -- gen_context(system_u:object_r:sysstat_exec_t,s0) ++/usr/lib(64)?/sa/sa.* -- gen_context(system_u:object_r:sysstat_exec_t,s0) + /usr/lib(64)?/sysstat/sa.* -- gen_context(system_u:object_r:sysstat_exec_t,s0) + + /var/log/atsar(/.*)? gen_context(system_u:object_r:sysstat_log_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.6.5/policy/modules/services/sysstat.te --- nsaserefpolicy/policy/modules/services/sysstat.te 2009-01-05 15:39:43.000000000 -0500 +++ serefpolicy-3.6.5/policy/modules/services/sysstat.te 2009-02-10 09:45:02.000000000 -0500 @@ -26480,7 +26552,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.6.5/policy/modules/system/miscfiles.if --- nsaserefpolicy/policy/modules/system/miscfiles.if 2008-08-07 11:15:12.000000000 -0400 -+++ serefpolicy-3.6.5/policy/modules/system/miscfiles.if 2009-02-10 09:45:02.000000000 -0500 ++++ serefpolicy-3.6.5/policy/modules/system/miscfiles.if 2009-02-10 16:18:37.000000000 -0500 @@ -23,6 +23,45 @@ ######################################## @@ -28879,7 +28951,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.5/policy/modules/system/userdomain.if --- nsaserefpolicy/policy/modules/system/userdomain.if 2009-01-19 11:07:34.000000000 -0500 -+++ serefpolicy-3.6.5/policy/modules/system/userdomain.if 2009-02-10 09:45:02.000000000 -0500 ++++ serefpolicy-3.6.5/policy/modules/system/userdomain.if 2009-02-10 16:18:28.000000000 -0500 @@ -30,8 +30,9 @@ ') @@ -29232,7 +29304,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ####################################### -@@ -420,34 +419,41 @@ +@@ -420,34 +419,43 @@ ## is the prefix for user_t). ## ## @@ -29271,6 +29343,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol - xserver_xsession_entry_type($1_t) - xserver_dontaudit_write_log($1_t) - xserver_stream_connect_xdm($1_t) ++ miscfiles_dontaudit_write_fonts($1) ++ + optional_policy(` + xserver_user_client($1, user_tmpfs_t) + xserver_xsession_entry_type($1) @@ -29292,7 +29366,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ####################################### -@@ -497,11 +503,7 @@ +@@ -497,11 +505,7 @@ attribute unpriv_userdomain; ') @@ -29305,7 +29379,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ############################## # -@@ -512,189 +514,198 @@ +@@ -512,189 +516,198 @@ dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown }; dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write }; @@ -29323,26 +29397,26 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + kernel_get_sysvipc_info($1_usertype) # Find CDROM devices: - kernel_read_device_sysctls($1_t) -- -- corecmd_exec_bin($1_t) + kernel_read_device_sysctls($1_usertype) -- corenet_udp_bind_generic_node($1_t) -- corenet_udp_bind_generic_port($1_t) +- corecmd_exec_bin($1_t) + corenet_udp_bind_generic_node($1_usertype) + corenet_udp_bind_generic_port($1_usertype) -- dev_read_rand($1_t) -- dev_write_sound($1_t) -- dev_read_sound($1_t) -- dev_read_sound_mixer($1_t) -- dev_write_sound_mixer($1_t) +- corenet_udp_bind_generic_node($1_t) +- corenet_udp_bind_generic_port($1_t) + dev_read_rand($1_usertype) + dev_write_sound($1_usertype) + dev_read_sound($1_usertype) + dev_read_sound_mixer($1_usertype) + dev_write_sound_mixer($1_usertype) +- dev_read_rand($1_t) +- dev_write_sound($1_t) +- dev_read_sound($1_t) +- dev_read_sound_mixer($1_t) +- dev_write_sound_mixer($1_t) +- - files_exec_etc_files($1_t) - files_search_locks($1_t) + files_exec_etc_files($1_usertype) @@ -29546,16 +29620,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol - postgresql_stream_connect($1_t) - postgresql_tcp_connect($1_t) + postgresql_stream_connect($1_usertype) -+ ') ') -+ -+ optional_policy(` -+ # to allow monitoring of pcmcia status -+ pcmcia_read_pid($1_usertype) ') optional_policy(` - resmgr_stream_connect($1_t) ++ # to allow monitoring of pcmcia status ++ pcmcia_read_pid($1_usertype) ++ ') ++ ++ optional_policy(` + pcscd_read_pub_files($1_usertype) + pcscd_stream_connect($1_usertype) ') @@ -29585,22 +29659,22 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ####################################### -@@ -722,15 +733,29 @@ +@@ -722,15 +735,29 @@ userdom_base_user_template($1) - userdom_manage_home_role($1_r, $1_t) + userdom_change_password_template($1) ++ ++ userdom_manage_home_role($1_r, $1_usertype) - userdom_manage_tmp_role($1_r, $1_t) - userdom_manage_tmpfs_role($1_r, $1_t) -+ userdom_manage_home_role($1_r, $1_usertype) ++ userdom_manage_tmp_role($1_r, $1_usertype) ++ userdom_manage_tmpfs_role($1_r, $1_usertype) - userdom_exec_user_tmp_files($1_t) - userdom_exec_user_home_content_files($1_t) -+ userdom_manage_tmp_role($1_r, $1_usertype) -+ userdom_manage_tmpfs_role($1_r, $1_usertype) -+ + ifelse(`$1',`unconfined',`',` + gen_tunable(allow_$1_exec_content, true) + @@ -29621,7 +29695,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ############################## # -@@ -746,70 +771,72 @@ +@@ -746,70 +773,72 @@ allow $1_t self:context contains; @@ -29727,7 +29801,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ') -@@ -846,6 +873,28 @@ +@@ -846,6 +875,28 @@ # Local policy # @@ -29756,7 +29830,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` loadkeys_run($1_t,$1_r) ') -@@ -876,7 +925,7 @@ +@@ -876,7 +927,7 @@ userdom_restricted_user_template($1) @@ -29765,18 +29839,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ############################## # -@@ -884,14 +933,19 @@ +@@ -884,14 +935,19 @@ # auth_role($1_r, $1_t) - auth_search_pam_console_data($1_t) + auth_search_pam_console_data($1_usertype) ++ ++ xserver_role($1_r, $1_t) ++ xserver_communicate($1_usertype, $1_usertype) - dev_read_sound($1_t) - dev_write_sound($1_t) -+ xserver_role($1_r, $1_t) -+ xserver_communicate($1_usertype, $1_usertype) -+ + dev_read_sound($1_usertype) + dev_write_sound($1_usertype) # gnome keyring wants to read this. @@ -29790,7 +29864,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol logging_dontaudit_send_audit_msgs($1_t) # Need to to this just so screensaver will work. Should be moved to screensaver domain -@@ -899,28 +953,29 @@ +@@ -899,28 +955,29 @@ selinux_get_enforce_mode($1_t) optional_policy(` @@ -29828,7 +29902,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ') -@@ -931,8 +986,7 @@ +@@ -931,8 +988,7 @@ ## ## ##

@@ -29838,7 +29912,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ##

##

## This template creates a user domain, types, and -@@ -954,8 +1008,8 @@ +@@ -954,8 +1010,8 @@ # Declarations # @@ -29848,7 +29922,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol userdom_common_user_template($1) ############################## -@@ -964,11 +1018,12 @@ +@@ -964,11 +1020,12 @@ # # port access is audited even if dac would not have allowed it, so dontaudit it here @@ -29863,7 +29937,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # cjp: why? files_read_kernel_symbol_table($1_t) -@@ -986,37 +1041,47 @@ +@@ -986,37 +1043,47 @@ ') ') @@ -29915,17 +29989,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + + optional_policy(` + mount_run($1_t, $1_r) - ') ++ ') + + # Run pppd in pppd_t by default for user + optional_policy(` + ppp_run_cond($1_t, $1_r) -+ ') + ') + ') ####################################### -@@ -1050,7 +1115,7 @@ +@@ -1050,7 +1117,7 @@ # template(`userdom_admin_user_template',` gen_require(` @@ -29934,7 +30008,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ############################## -@@ -1059,8 +1124,7 @@ +@@ -1059,8 +1126,7 @@ # # Inherit rules for ordinary users. @@ -29944,7 +30018,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol domain_obj_id_change_exemption($1_t) role system_r types $1_t; -@@ -1083,7 +1147,8 @@ +@@ -1083,7 +1149,8 @@ # Skip authentication when pam_rootok is specified. allow $1_t self:passwd rootok; @@ -29954,7 +30028,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol kernel_read_software_raid_state($1_t) kernel_getattr_core_if($1_t) -@@ -1099,6 +1164,7 @@ +@@ -1099,6 +1166,7 @@ kernel_sigstop_unlabeled($1_t) kernel_signull_unlabeled($1_t) kernel_sigchld_unlabeled($1_t) @@ -29962,7 +30036,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol corenet_tcp_bind_generic_port($1_t) # allow setting up tunnels -@@ -1106,8 +1172,6 @@ +@@ -1106,8 +1174,6 @@ dev_getattr_generic_blk_files($1_t) dev_getattr_generic_chr_files($1_t) @@ -29971,7 +30045,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # Allow MAKEDEV to work dev_create_all_blk_files($1_t) dev_create_all_chr_files($1_t) -@@ -1162,20 +1226,6 @@ +@@ -1162,20 +1228,6 @@ # But presently necessary for installing the file_contexts file. seutil_manage_bin_policy($1_t) @@ -29992,7 +30066,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` postgresql_unconfined($1_t) ') -@@ -1221,6 +1271,7 @@ +@@ -1221,6 +1273,7 @@ dev_relabel_all_dev_nodes($1) files_create_boot_flag($1) @@ -30000,7 +30074,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # Necessary for managing /boot/efi fs_manage_dos_files($1) -@@ -1286,11 +1337,15 @@ +@@ -1286,11 +1339,15 @@ interface(`userdom_user_home_content',` gen_require(` type user_home_t; @@ -30016,7 +30090,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1387,7 +1442,7 @@ +@@ -1387,7 +1444,7 @@ ######################################## ##

@@ -30025,7 +30099,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## ## ## -@@ -1420,6 +1475,14 @@ +@@ -1420,6 +1477,14 @@ allow $1 user_home_dir_t:dir list_dir_perms; files_search_home($1) @@ -30040,7 +30114,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1435,9 +1498,11 @@ +@@ -1435,9 +1500,11 @@ interface(`userdom_dontaudit_list_user_home_dirs',` gen_require(` type user_home_dir_t; @@ -30052,7 +30126,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1494,6 +1559,25 @@ +@@ -1494,6 +1561,25 @@ allow $1 user_home_dir_t:dir relabelto; ') @@ -30078,7 +30152,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ######################################## ## ## Create directories in the home dir root with -@@ -1547,9 +1631,9 @@ +@@ -1547,9 +1633,9 @@ type user_home_dir_t, user_home_t; ') @@ -30090,7 +30164,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1568,6 +1652,8 @@ +@@ -1568,6 +1654,8 @@ ') dontaudit $1 user_home_t:dir search_dir_perms; @@ -30099,7 +30173,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1643,6 +1729,7 @@ +@@ -1643,6 +1731,7 @@ type user_home_dir_t, user_home_t; ') @@ -30107,7 +30181,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t) files_search_home($1) ') -@@ -1741,6 +1828,62 @@ +@@ -1741,6 +1830,62 @@ ######################################## ## @@ -30170,7 +30244,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## Execute user home files. ## ## -@@ -1757,14 +1900,6 @@ +@@ -1757,14 +1902,6 @@ files_search_home($1) exec_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t) @@ -30185,7 +30259,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1787,6 +1922,46 @@ +@@ -1787,6 +1924,46 @@ ######################################## ## @@ -30232,7 +30306,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## Create, read, write, and delete files ## in a user home subdirectory. ## -@@ -1799,6 +1974,7 @@ +@@ -1799,6 +1976,7 @@ interface(`userdom_manage_user_home_content_files',` gen_require(` type user_home_dir_t, user_home_t; @@ -30240,7 +30314,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') manage_files_pattern($1, user_home_t, user_home_t) -@@ -1921,7 +2097,7 @@ +@@ -1921,7 +2099,7 @@ ######################################## ## @@ -30249,7 +30323,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## with an automatic type transition to ## a specified private type. ## -@@ -1941,28 +2117,58 @@ +@@ -1941,28 +2119,58 @@ ## ## # @@ -30315,7 +30389,35 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## ## The class of the object to be created. ## -@@ -2814,7 +3020,43 @@ +@@ -2336,6 +2544,27 @@ + ## + ## + # ++interface(`userdom_read_user_tmpfs_files',` ++ gen_require(` ++ type user_tmpfs_t; ++ ') ++ ++ read_files_pattern($1, user_tmpfs_t, user_tmpfs_t) ++ read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t) ++ allow $1 user_tmpfs_t:dir list_dir_perms; ++ fs_search_tmpfs($1) ++') ++ ++######################################## ++## ++## Read/Write user tmpfs files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# + interface(`userdom_rw_user_tmpfs_files',` + gen_require(` + type user_tmpfs_t; +@@ -2814,7 +3043,43 @@ type user_tmp_t; ') @@ -30360,7 +30462,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2851,6 +3093,7 @@ +@@ -2851,6 +3116,7 @@ ') read_files_pattern($1,userdomain,userdomain) @@ -30368,7 +30470,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol kernel_search_proc($1) ') -@@ -2965,6 +3208,24 @@ +@@ -2965,6 +3231,24 @@ ######################################## ## @@ -30393,7 +30495,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## Send a dbus message to all user domains. ## ## -@@ -2981,3 +3242,313 @@ +@@ -2981,3 +3265,313 @@ allow $1 userdomain:dbus send_msg; ') diff --git a/selinux-policy.spec b/selinux-policy.spec index d05ad6b1..f00bc725 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -20,7 +20,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.6.5 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -444,6 +444,8 @@ exit 0 %endif %changelog +* Wed Feb 11 2009 Dan Walsh 3.6.5-3 + * Tue Feb 10 2009 Dan Walsh 3.6.5-2 - Add git web policy