rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Browse Source
This commit is contained in:
Daniel J Walsh 2009-02-11 20:40:13 +00:00
parent d43c255c87
commit e46e005f04
2 changed files with 182 additions and 78 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

256
policy-20090105.patch
View File

@ -467,10 +467,38 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow consoletype_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow consoletype_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow consoletype_t self:fd use; allow consoletype_t self:fd use;
allow consoletype_t self:fifo_file rw_fifo_file_perms; allow consoletype_t self:fifo_file rw_fifo_file_perms;
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.if serefpolicy-3.6.5/policy/modules/admin/kismet.if
--- nsaserefpolicy/policy/modules/admin/kismet.if 2008-11-11 16:13:49.000000000 -0500
+++ serefpolicy-3.6.5/policy/modules/admin/kismet.if 2009-02-10 15:39:36.000000000 -0500
@@ -16,6 +16,7 @@
')
domtrans_pattern($1, kismet_exec_t, kismet_t)
+ allow kismet_t $1:process signull;
')
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.te serefpolicy-3.6.5/policy/modules/admin/kismet.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.te serefpolicy-3.6.5/policy/modules/admin/kismet.te
--- nsaserefpolicy/policy/modules/admin/kismet.te 2009-01-05 15:39:44.000000000 -0500 --- nsaserefpolicy/policy/modules/admin/kismet.te 2009-01-05 15:39:44.000000000 -0500
+++ serefpolicy-3.6.5/policy/modules/admin/kismet.te 2009-02-10 09:45:01.000000000 -0500 +++ serefpolicy-3.6.5/policy/modules/admin/kismet.te 2009-02-10 15:44:33.000000000 -0500
@@ -25,11 +25,14 @@ @@ -14,27 +14,37 @@
type kismet_var_run_t;
files_pid_file(kismet_var_run_t)
-type kismet_var_lib_t;
-files_type(kismet_var_lib_t)
-
type kismet_log_t;
logging_log_file(kismet_log_t)
+type kismet_tmp_t;
+files_tmp_file(kismet_tmp_t)
+
+type kismet_var_lib_t;
+files_type(kismet_var_lib_t)
+
########################################
#
# kismet local policy # kismet local policy
# #
@ -487,7 +515,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
manage_files_pattern(kismet_t, kismet_log_t, kismet_log_t) manage_files_pattern(kismet_t, kismet_log_t, kismet_log_t)
allow kismet_t kismet_log_t:dir setattr; allow kismet_t kismet_log_t:dir setattr;
@@ -47,9 +50,19 @@ logging_log_filetrans(kismet_t, kismet_log_t, { file dir })
+manage_dirs_pattern(kismet_t, kismet_tmp_t, kismet_tmp_t)
+manage_files_pattern(kismet_t, kismet_tmp_t, kismet_tmp_t)
+files_tmp_filetrans(kismet_t, kismet_tmp_t, { file dir })
+
allow kismet_t kismet_var_lib_t:file manage_file_perms;
allow kismet_t kismet_var_lib_t:dir manage_dir_perms;
files_var_lib_filetrans(kismet_t, kismet_var_lib_t, { file dir })
@@ -47,10 +57,22 @@
corecmd_exec_bin(kismet_t) corecmd_exec_bin(kismet_t)
@ -499,6 +536,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+corenet_tcp_bind_generic_node(kismet_t) +corenet_tcp_bind_generic_node(kismet_t)
+corenet_tcp_bind_kismet_port(kismet_t) +corenet_tcp_bind_kismet_port(kismet_t)
+corenet_tcp_connect_kismet_port(kismet_t) +corenet_tcp_connect_kismet_port(kismet_t)
+corenet_tcp_connect_pulseaudio_port(kismet_t)
+ +
auth_use_nsswitch(kismet_t) auth_use_nsswitch(kismet_t)
@ -507,6 +545,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
miscfiles_read_localization(kismet_t) miscfiles_read_localization(kismet_t)
userdom_use_user_terminals(kismet_t)
+userdom_read_user_tmpfs_files(kismet_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.6.5/policy/modules/admin/logrotate.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.6.5/policy/modules/admin/logrotate.te
--- nsaserefpolicy/policy/modules/admin/logrotate.te 2009-01-05 15:39:44.000000000 -0500 --- nsaserefpolicy/policy/modules/admin/logrotate.te 2009-01-05 15:39:44.000000000 -0500
+++ serefpolicy-3.6.5/policy/modules/admin/logrotate.te 2009-02-10 09:45:01.000000000 -0500 +++ serefpolicy-3.6.5/policy/modules/admin/logrotate.te 2009-02-10 09:45:01.000000000 -0500
@ -5502,7 +5542,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/lib/nfs/rpc_pipefs(/.*)? <<none>> /var/lib/nfs/rpc_pipefs(/.*)? <<none>>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.6.5/policy/modules/kernel/files.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.6.5/policy/modules/kernel/files.if
--- nsaserefpolicy/policy/modules/kernel/files.if 2009-01-05 15:39:38.000000000 -0500 --- nsaserefpolicy/policy/modules/kernel/files.if 2009-01-05 15:39:38.000000000 -0500
+++ serefpolicy-3.6.5/policy/modules/kernel/files.if 2009-02-10 09:45:01.000000000 -0500 +++ serefpolicy-3.6.5/policy/modules/kernel/files.if 2009-02-10 15:43:06.000000000 -0500
@@ -110,6 +110,11 @@ @@ -110,6 +110,11 @@
## </param> ## </param>
# #
@ -8944,7 +8984,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.6.5/policy/modules/services/apache.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.6.5/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2009-01-19 11:06:49.000000000 -0500 --- nsaserefpolicy/policy/modules/services/apache.te 2009-01-19 11:06:49.000000000 -0500
+++ serefpolicy-3.6.5/policy/modules/services/apache.te 2009-02-10 09:45:36.000000000 -0500 +++ serefpolicy-3.6.5/policy/modules/services/apache.te 2009-02-10 12:10:14.000000000 -0500
@@ -19,6 +19,8 @@ @@ -19,6 +19,8 @@
# Declarations # Declarations
# #
@ -12222,11 +12262,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_udp_sendrecv_all_ports(dcc_client_t) corenet_udp_sendrecv_all_ports(dcc_client_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.fc serefpolicy-3.6.5/policy/modules/services/devicekit.fc diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.fc serefpolicy-3.6.5/policy/modules/services/devicekit.fc
--- nsaserefpolicy/policy/modules/services/devicekit.fc 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/services/devicekit.fc 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.5/policy/modules/services/devicekit.fc 2009-02-10 09:45:02.000000000 -0500 +++ serefpolicy-3.6.5/policy/modules/services/devicekit.fc 2009-02-10 13:52:24.000000000 -0500
@@ -0,0 +1,4 @@ @@ -0,0 +1,7 @@
+ +
+/usr/libexec/devkit-daemon -- gen_context(system_u:object_r:devicekit_exec_t,s0) +/usr/libexec/devkit-daemon -- gen_context(system_u:object_r:devicekit_exec_t,s0)
+/usr/libexec/devkit-power-daemon -- gen_context(system_u:object_r:devicekit_power_exec_t,s0) +/usr/libexec/devkit-power-daemon -- gen_context(system_u:object_r:devicekit_power_exec_t,s0)
+
+/var/lib/DeviceKit-power(/.*)? gen_context(system_u:object_r:devicekit_var_lib_t,s0)
+
+/var/run/devkit(/.*)? gen_context(system_u:object_r:devicekit_var_run_t,s0) +/var/run/devkit(/.*)? gen_context(system_u:object_r:devicekit_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.if serefpolicy-3.6.5/policy/modules/services/devicekit.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.if serefpolicy-3.6.5/policy/modules/services/devicekit.if
--- nsaserefpolicy/policy/modules/services/devicekit.if 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/services/devicekit.if 1969-12-31 19:00:00.000000000 -0500
@ -12411,8 +12454,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.6.5/policy/modules/services/devicekit.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.6.5/policy/modules/services/devicekit.te
--- nsaserefpolicy/policy/modules/services/devicekit.te 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/services/devicekit.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.5/policy/modules/services/devicekit.te 2009-02-10 09:45:02.000000000 -0500 +++ serefpolicy-3.6.5/policy/modules/services/devicekit.te 2009-02-10 13:51:44.000000000 -0500
@@ -0,0 +1,131 @@ @@ -0,0 +1,138 @@
+policy_module(devicekit,1.0.0) +policy_module(devicekit,1.0.0)
+ +
+######################################## +########################################
@ -12435,6 +12478,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+type devicekit_var_run_t; +type devicekit_var_run_t;
+files_pid_file(devicekit_var_run_t) +files_pid_file(devicekit_var_run_t)
+ +
+type devicekit_var_lib_t;
+files_type(devicekit_var_lib_t)
+
+# +#
+# DeviceKit local policy +# DeviceKit local policy
+# +#
@ -12468,6 +12514,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+allow devicekit_power_t self:fifo_file rw_fifo_file_perms; +allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
+allow devicekit_power_t self:unix_dgram_socket create_socket_perms; +allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
+ +
+manage_dirs_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t)
+manage_files_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t)
+files_search_var_lib(devicekit_power_t)
+
+corecmd_exec_bin(devicekit_power_t) +corecmd_exec_bin(devicekit_power_t)
+corecmd_exec_shell(devicekit_power_t) +corecmd_exec_shell(devicekit_power_t)
+ +
@ -13260,7 +13310,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.6.5/policy/modules/services/ftp.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.6.5/policy/modules/services/ftp.te
--- nsaserefpolicy/policy/modules/services/ftp.te 2009-01-19 11:06:49.000000000 -0500 --- nsaserefpolicy/policy/modules/services/ftp.te 2009-01-19 11:06:49.000000000 -0500
+++ serefpolicy-3.6.5/policy/modules/services/ftp.te 2009-02-10 11:07:54.000000000 -0500 +++ serefpolicy-3.6.5/policy/modules/services/ftp.te 2009-02-10 12:12:28.000000000 -0500
@@ -26,7 +26,7 @@ @@ -26,7 +26,7 @@
## <desc> ## <desc>
## <p> ## <p>
@ -13314,7 +13364,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
tunable_policy(`ftp_home_dir && use_nfs_home_dirs',` tunable_policy(`ftp_home_dir && use_nfs_home_dirs',`
fs_manage_nfs_files(ftpd_t) fs_manage_nfs_files(ftpd_t)
@@ -258,7 +270,15 @@ @@ -258,7 +270,26 @@
') ')
optional_policy(` optional_policy(`
@ -13328,10 +13378,21 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ tunable_policy(`ftpd_connect_db',` + tunable_policy(`ftpd_connect_db',`
+ mysql_stream_connect(ftpd_t) + mysql_stream_connect(ftpd_t)
+ ') + ')
+')
+
+optional_policy(`
+ tunable_policy(`ftpd_connect_db',`
+ postgresql_stream_connect(ftpd_t)
+ ')
+')
+
+tunable_policy(`ftpd_connect_db',`
+ corenet_tcp_connect_mysqld_port(ftpd_t)
+ corenet_tcp_connect_postgresql_port(ftpd_t)
') ')
optional_policy(` optional_policy(`
@@ -270,6 +290,14 @@ @@ -270,6 +301,14 @@
') ')
optional_policy(` optional_policy(`
@ -18605,7 +18666,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# /usr # /usr
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.if serefpolicy-3.6.5/policy/modules/services/postgresql.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.if serefpolicy-3.6.5/policy/modules/services/postgresql.if
--- nsaserefpolicy/policy/modules/services/postgresql.if 2009-01-05 15:39:43.000000000 -0500 --- nsaserefpolicy/policy/modules/services/postgresql.if 2009-01-05 15:39:43.000000000 -0500
+++ serefpolicy-3.6.5/policy/modules/services/postgresql.if 2009-02-10 09:45:02.000000000 -0500 +++ serefpolicy-3.6.5/policy/modules/services/postgresql.if 2009-02-10 12:07:46.000000000 -0500
@@ -351,3 +351,46 @@ @@ -351,3 +351,46 @@
typeattribute $1 sepgsql_unconfined_type; typeattribute $1 sepgsql_unconfined_type;
@ -18655,7 +18716,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.te serefpolicy-3.6.5/policy/modules/services/postgresql.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.te serefpolicy-3.6.5/policy/modules/services/postgresql.te
--- nsaserefpolicy/policy/modules/services/postgresql.te 2009-02-03 22:50:50.000000000 -0500 --- nsaserefpolicy/policy/modules/services/postgresql.te 2009-02-03 22:50:50.000000000 -0500
+++ serefpolicy-3.6.5/policy/modules/services/postgresql.te 2009-02-10 09:45:02.000000000 -0500 +++ serefpolicy-3.6.5/policy/modules/services/postgresql.te 2009-02-10 12:10:08.000000000 -0500
@@ -32,6 +32,9 @@ @@ -32,6 +32,9 @@
type postgresql_etc_t; type postgresql_etc_t;
files_config_file(postgresql_etc_t) files_config_file(postgresql_etc_t)
@ -22629,6 +22690,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_search_home(stunnel_t) files_search_home(stunnel_t)
optional_policy(` optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.fc serefpolicy-3.6.5/policy/modules/services/sysstat.fc
--- nsaserefpolicy/policy/modules/services/sysstat.fc 2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.6.5/policy/modules/services/sysstat.fc 2009-02-11 11:00:38.000000000 -0500
@@ -1,6 +1,6 @@
/usr/lib(64)?/atsar/atsa.* -- gen_context(system_u:object_r:sysstat_exec_t,s0)
-/usr/lib(64)?/sa/sadc -- gen_context(system_u:object_r:sysstat_exec_t,s0)
+/usr/lib(64)?/sa/sa.* -- gen_context(system_u:object_r:sysstat_exec_t,s0)
/usr/lib(64)?/sysstat/sa.* -- gen_context(system_u:object_r:sysstat_exec_t,s0)
/var/log/atsar(/.*)? gen_context(system_u:object_r:sysstat_log_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.6.5/policy/modules/services/sysstat.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.6.5/policy/modules/services/sysstat.te
--- nsaserefpolicy/policy/modules/services/sysstat.te 2009-01-05 15:39:43.000000000 -0500 --- nsaserefpolicy/policy/modules/services/sysstat.te 2009-01-05 15:39:43.000000000 -0500
+++ serefpolicy-3.6.5/policy/modules/services/sysstat.te 2009-02-10 09:45:02.000000000 -0500 +++ serefpolicy-3.6.5/policy/modules/services/sysstat.te 2009-02-10 09:45:02.000000000 -0500
@ -26480,7 +26552,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.6.5/policy/modules/system/miscfiles.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.6.5/policy/modules/system/miscfiles.if
--- nsaserefpolicy/policy/modules/system/miscfiles.if 2008-08-07 11:15:12.000000000 -0400 --- nsaserefpolicy/policy/modules/system/miscfiles.if 2008-08-07 11:15:12.000000000 -0400
+++ serefpolicy-3.6.5/policy/modules/system/miscfiles.if 2009-02-10 09:45:02.000000000 -0500 +++ serefpolicy-3.6.5/policy/modules/system/miscfiles.if 2009-02-10 16:18:37.000000000 -0500
@@ -23,6 +23,45 @@ @@ -23,6 +23,45 @@
######################################## ########################################
@ -28879,7 +28951,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0) +/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.5/policy/modules/system/userdomain.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.5/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-01-19 11:07:34.000000000 -0500 --- nsaserefpolicy/policy/modules/system/userdomain.if 2009-01-19 11:07:34.000000000 -0500
+++ serefpolicy-3.6.5/policy/modules/system/userdomain.if 2009-02-10 09:45:02.000000000 -0500 +++ serefpolicy-3.6.5/policy/modules/system/userdomain.if 2009-02-10 16:18:28.000000000 -0500
@@ -30,8 +30,9 @@ @@ -30,8 +30,9 @@
') ')
@ -29232,7 +29304,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
####################################### #######################################
@@ -420,34 +419,41 @@ @@ -420,34 +419,43 @@
## is the prefix for user_t). ## is the prefix for user_t).
## </summary> ## </summary>
## </param> ## </param>
@ -29271,6 +29343,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
- xserver_xsession_entry_type($1_t) - xserver_xsession_entry_type($1_t)
- xserver_dontaudit_write_log($1_t) - xserver_dontaudit_write_log($1_t)
- xserver_stream_connect_xdm($1_t) - xserver_stream_connect_xdm($1_t)
+ miscfiles_dontaudit_write_fonts($1)
+
+ optional_policy(` + optional_policy(`
+ xserver_user_client($1, user_tmpfs_t) + xserver_user_client($1, user_tmpfs_t)
+ xserver_xsession_entry_type($1) + xserver_xsession_entry_type($1)
@ -29292,7 +29366,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
####################################### #######################################
@@ -497,11 +503,7 @@ @@ -497,11 +505,7 @@
attribute unpriv_userdomain; attribute unpriv_userdomain;
') ')
@ -29305,7 +29379,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
############################## ##############################
# #
@@ -512,189 +514,198 @@ @@ -512,189 +516,198 @@
dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown }; dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write }; dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
@ -29323,26 +29397,26 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ kernel_get_sysvipc_info($1_usertype) + kernel_get_sysvipc_info($1_usertype)
# Find CDROM devices: # Find CDROM devices:
- kernel_read_device_sysctls($1_t) - kernel_read_device_sysctls($1_t)
-
- corecmd_exec_bin($1_t)
+ kernel_read_device_sysctls($1_usertype) + kernel_read_device_sysctls($1_usertype)
- corenet_udp_bind_generic_node($1_t) - corecmd_exec_bin($1_t)
- corenet_udp_bind_generic_port($1_t)
+ corenet_udp_bind_generic_node($1_usertype) + corenet_udp_bind_generic_node($1_usertype)
+ corenet_udp_bind_generic_port($1_usertype) + corenet_udp_bind_generic_port($1_usertype)
- dev_read_rand($1_t) - corenet_udp_bind_generic_node($1_t)
- dev_write_sound($1_t) - corenet_udp_bind_generic_port($1_t)
- dev_read_sound($1_t)
- dev_read_sound_mixer($1_t)
- dev_write_sound_mixer($1_t)
+ dev_read_rand($1_usertype) + dev_read_rand($1_usertype)
+ dev_write_sound($1_usertype) + dev_write_sound($1_usertype)
+ dev_read_sound($1_usertype) + dev_read_sound($1_usertype)
+ dev_read_sound_mixer($1_usertype) + dev_read_sound_mixer($1_usertype)
+ dev_write_sound_mixer($1_usertype) + dev_write_sound_mixer($1_usertype)
- dev_read_rand($1_t)
- dev_write_sound($1_t)
- dev_read_sound($1_t)
- dev_read_sound_mixer($1_t)
- dev_write_sound_mixer($1_t)
-
- files_exec_etc_files($1_t) - files_exec_etc_files($1_t)
- files_search_locks($1_t) - files_search_locks($1_t)
+ files_exec_etc_files($1_usertype) + files_exec_etc_files($1_usertype)
@ -29546,16 +29620,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
- postgresql_stream_connect($1_t) - postgresql_stream_connect($1_t)
- postgresql_tcp_connect($1_t) - postgresql_tcp_connect($1_t)
+ postgresql_stream_connect($1_usertype) + postgresql_stream_connect($1_usertype)
+ ')
') ')
+
+ optional_policy(`
+ # to allow monitoring of pcmcia status
+ pcmcia_read_pid($1_usertype)
') ')
optional_policy(` optional_policy(`
- resmgr_stream_connect($1_t) - resmgr_stream_connect($1_t)
+ # to allow monitoring of pcmcia status
+ pcmcia_read_pid($1_usertype)
+ ')
+
+ optional_policy(`
+ pcscd_read_pub_files($1_usertype) + pcscd_read_pub_files($1_usertype)
+ pcscd_stream_connect($1_usertype) + pcscd_stream_connect($1_usertype)
') ')
@ -29585,22 +29659,22 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
####################################### #######################################
@@ -722,15 +733,29 @@ @@ -722,15 +735,29 @@
userdom_base_user_template($1) userdom_base_user_template($1)
- userdom_manage_home_role($1_r, $1_t) - userdom_manage_home_role($1_r, $1_t)
+ userdom_change_password_template($1) + userdom_change_password_template($1)
+
+ userdom_manage_home_role($1_r, $1_usertype)
- userdom_manage_tmp_role($1_r, $1_t) - userdom_manage_tmp_role($1_r, $1_t)
- userdom_manage_tmpfs_role($1_r, $1_t) - userdom_manage_tmpfs_role($1_r, $1_t)
+ userdom_manage_home_role($1_r, $1_usertype) + userdom_manage_tmp_role($1_r, $1_usertype)
+ userdom_manage_tmpfs_role($1_r, $1_usertype)
- userdom_exec_user_tmp_files($1_t) - userdom_exec_user_tmp_files($1_t)
- userdom_exec_user_home_content_files($1_t) - userdom_exec_user_home_content_files($1_t)
+ userdom_manage_tmp_role($1_r, $1_usertype)
+ userdom_manage_tmpfs_role($1_r, $1_usertype)
+
+ ifelse(`$1',`unconfined',`',` + ifelse(`$1',`unconfined',`',`
+ gen_tunable(allow_$1_exec_content, true) + gen_tunable(allow_$1_exec_content, true)
+ +
@ -29621,7 +29695,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
############################## ##############################
# #
@@ -746,70 +771,72 @@ @@ -746,70 +773,72 @@
allow $1_t self:context contains; allow $1_t self:context contains;
@ -29727,7 +29801,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
') ')
@@ -846,6 +873,28 @@ @@ -846,6 +875,28 @@
# Local policy # Local policy
# #
@ -29756,7 +29830,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(` optional_policy(`
loadkeys_run($1_t,$1_r) loadkeys_run($1_t,$1_r)
') ')
@@ -876,7 +925,7 @@ @@ -876,7 +927,7 @@
userdom_restricted_user_template($1) userdom_restricted_user_template($1)
@ -29765,18 +29839,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
############################## ##############################
# #
@@ -884,14 +933,19 @@ @@ -884,14 +935,19 @@
# #
auth_role($1_r, $1_t) auth_role($1_r, $1_t)
- auth_search_pam_console_data($1_t) - auth_search_pam_console_data($1_t)
+ auth_search_pam_console_data($1_usertype) + auth_search_pam_console_data($1_usertype)
+
+ xserver_role($1_r, $1_t)
+ xserver_communicate($1_usertype, $1_usertype)
- dev_read_sound($1_t) - dev_read_sound($1_t)
- dev_write_sound($1_t) - dev_write_sound($1_t)
+ xserver_role($1_r, $1_t)
+ xserver_communicate($1_usertype, $1_usertype)
+
+ dev_read_sound($1_usertype) + dev_read_sound($1_usertype)
+ dev_write_sound($1_usertype) + dev_write_sound($1_usertype)
# gnome keyring wants to read this. # gnome keyring wants to read this.
@ -29790,7 +29864,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
logging_dontaudit_send_audit_msgs($1_t) logging_dontaudit_send_audit_msgs($1_t)
# Need to to this just so screensaver will work. Should be moved to screensaver domain # Need to to this just so screensaver will work. Should be moved to screensaver domain
@@ -899,28 +953,29 @@ @@ -899,28 +955,29 @@
selinux_get_enforce_mode($1_t) selinux_get_enforce_mode($1_t)
optional_policy(` optional_policy(`
@ -29828,7 +29902,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
') ')
@@ -931,8 +986,7 @@ @@ -931,8 +988,7 @@
## </summary> ## </summary>
## <desc> ## <desc>
## <p> ## <p>
@ -29838,7 +29912,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## </p> ## </p>
## <p> ## <p>
## This template creates a user domain, types, and ## This template creates a user domain, types, and
@@ -954,8 +1008,8 @@ @@ -954,8 +1010,8 @@
# Declarations # Declarations
# #
@ -29848,7 +29922,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_common_user_template($1) userdom_common_user_template($1)
############################## ##############################
@@ -964,11 +1018,12 @@ @@ -964,11 +1020,12 @@
# #
# port access is audited even if dac would not have allowed it, so dontaudit it here # port access is audited even if dac would not have allowed it, so dontaudit it here
@ -29863,7 +29937,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# cjp: why? # cjp: why?
files_read_kernel_symbol_table($1_t) files_read_kernel_symbol_table($1_t)
@@ -986,37 +1041,47 @@ @@ -986,37 +1043,47 @@
') ')
') ')
@ -29915,17 +29989,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
+ optional_policy(` + optional_policy(`
+ mount_run($1_t, $1_r) + mount_run($1_t, $1_r)
') + ')
+ +
+ # Run pppd in pppd_t by default for user + # Run pppd in pppd_t by default for user
+ optional_policy(` + optional_policy(`
+ ppp_run_cond($1_t, $1_r) + ppp_run_cond($1_t, $1_r)
+ ') ')
+ +
') ')
####################################### #######################################
@@ -1050,7 +1115,7 @@ @@ -1050,7 +1117,7 @@
# #
template(`userdom_admin_user_template',` template(`userdom_admin_user_template',`
gen_require(` gen_require(`
@ -29934,7 +30008,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
############################## ##############################
@@ -1059,8 +1124,7 @@ @@ -1059,8 +1126,7 @@
# #
# Inherit rules for ordinary users. # Inherit rules for ordinary users.
@ -29944,7 +30018,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
domain_obj_id_change_exemption($1_t) domain_obj_id_change_exemption($1_t)
role system_r types $1_t; role system_r types $1_t;
@@ -1083,7 +1147,8 @@ @@ -1083,7 +1149,8 @@
# Skip authentication when pam_rootok is specified. # Skip authentication when pam_rootok is specified.
allow $1_t self:passwd rootok; allow $1_t self:passwd rootok;
@ -29954,7 +30028,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_software_raid_state($1_t) kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t) kernel_getattr_core_if($1_t)
@@ -1099,6 +1164,7 @@ @@ -1099,6 +1166,7 @@
kernel_sigstop_unlabeled($1_t) kernel_sigstop_unlabeled($1_t)
kernel_signull_unlabeled($1_t) kernel_signull_unlabeled($1_t)
kernel_sigchld_unlabeled($1_t) kernel_sigchld_unlabeled($1_t)
@ -29962,7 +30036,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_tcp_bind_generic_port($1_t) corenet_tcp_bind_generic_port($1_t)
# allow setting up tunnels # allow setting up tunnels
@@ -1106,8 +1172,6 @@ @@ -1106,8 +1174,6 @@
dev_getattr_generic_blk_files($1_t) dev_getattr_generic_blk_files($1_t)
dev_getattr_generic_chr_files($1_t) dev_getattr_generic_chr_files($1_t)
@ -29971,7 +30045,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Allow MAKEDEV to work # Allow MAKEDEV to work
dev_create_all_blk_files($1_t) dev_create_all_blk_files($1_t)
dev_create_all_chr_files($1_t) dev_create_all_chr_files($1_t)
@@ -1162,20 +1226,6 @@ @@ -1162,20 +1228,6 @@
# But presently necessary for installing the file_contexts file. # But presently necessary for installing the file_contexts file.
seutil_manage_bin_policy($1_t) seutil_manage_bin_policy($1_t)
@ -29992,7 +30066,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(` optional_policy(`
postgresql_unconfined($1_t) postgresql_unconfined($1_t)
') ')
@@ -1221,6 +1271,7 @@ @@ -1221,6 +1273,7 @@
dev_relabel_all_dev_nodes($1) dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1) files_create_boot_flag($1)
@ -30000,7 +30074,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Necessary for managing /boot/efi # Necessary for managing /boot/efi
fs_manage_dos_files($1) fs_manage_dos_files($1)
@@ -1286,11 +1337,15 @@ @@ -1286,11 +1339,15 @@
interface(`userdom_user_home_content',` interface(`userdom_user_home_content',`
gen_require(` gen_require(`
type user_home_t; type user_home_t;
@ -30016,7 +30090,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1387,7 +1442,7 @@ @@ -1387,7 +1444,7 @@
######################################## ########################################
## <summary> ## <summary>
@ -30025,7 +30099,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -1420,6 +1475,14 @@ @@ -1420,6 +1477,14 @@
allow $1 user_home_dir_t:dir list_dir_perms; allow $1 user_home_dir_t:dir list_dir_perms;
files_search_home($1) files_search_home($1)
@ -30040,7 +30114,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1435,9 +1498,11 @@ @@ -1435,9 +1500,11 @@
interface(`userdom_dontaudit_list_user_home_dirs',` interface(`userdom_dontaudit_list_user_home_dirs',`
gen_require(` gen_require(`
type user_home_dir_t; type user_home_dir_t;
@ -30052,7 +30126,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1494,6 +1559,25 @@ @@ -1494,6 +1561,25 @@
allow $1 user_home_dir_t:dir relabelto; allow $1 user_home_dir_t:dir relabelto;
') ')
@ -30078,7 +30152,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
######################################## ########################################
## <summary> ## <summary>
## Create directories in the home dir root with ## Create directories in the home dir root with
@@ -1547,9 +1631,9 @@ @@ -1547,9 +1633,9 @@
type user_home_dir_t, user_home_t; type user_home_dir_t, user_home_t;
') ')
@ -30090,7 +30164,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1568,6 +1652,8 @@ @@ -1568,6 +1654,8 @@
') ')
dontaudit $1 user_home_t:dir search_dir_perms; dontaudit $1 user_home_t:dir search_dir_perms;
@ -30099,7 +30173,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1643,6 +1729,7 @@ @@ -1643,6 +1731,7 @@
type user_home_dir_t, user_home_t; type user_home_dir_t, user_home_t;
') ')
@ -30107,7 +30181,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t) read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
files_search_home($1) files_search_home($1)
') ')
@@ -1741,6 +1828,62 @@ @@ -1741,6 +1830,62 @@
######################################## ########################################
## <summary> ## <summary>
@ -30170,7 +30244,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Execute user home files. ## Execute user home files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -1757,14 +1900,6 @@ @@ -1757,14 +1902,6 @@
files_search_home($1) files_search_home($1)
exec_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t) exec_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
@ -30185,7 +30259,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1787,6 +1922,46 @@ @@ -1787,6 +1924,46 @@
######################################## ########################################
## <summary> ## <summary>
@ -30232,7 +30306,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Create, read, write, and delete files ## Create, read, write, and delete files
## in a user home subdirectory. ## in a user home subdirectory.
## </summary> ## </summary>
@@ -1799,6 +1974,7 @@ @@ -1799,6 +1976,7 @@
interface(`userdom_manage_user_home_content_files',` interface(`userdom_manage_user_home_content_files',`
gen_require(` gen_require(`
type user_home_dir_t, user_home_t; type user_home_dir_t, user_home_t;
@ -30240,7 +30314,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
manage_files_pattern($1, user_home_t, user_home_t) manage_files_pattern($1, user_home_t, user_home_t)
@@ -1921,7 +2097,7 @@ @@ -1921,7 +2099,7 @@
######################################## ########################################
## <summary> ## <summary>
@ -30249,7 +30323,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## with an automatic type transition to ## with an automatic type transition to
## a specified private type. ## a specified private type.
## </summary> ## </summary>
@@ -1941,28 +2117,58 @@ @@ -1941,28 +2119,58 @@
## </summary> ## </summary>
## </param> ## </param>
# #
@ -30315,7 +30389,35 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## <summary> ## <summary>
## The class of the object to be created. ## The class of the object to be created.
## </summary> ## </summary>
@@ -2814,7 +3020,43 @@ @@ -2336,6 +2544,27 @@
## </summary>
## </param>
#
+interface(`userdom_read_user_tmpfs_files',`
+ gen_require(`
+ type user_tmpfs_t;
+ ')
+
+ read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+ read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+ allow $1 user_tmpfs_t:dir list_dir_perms;
+ fs_search_tmpfs($1)
+')
+
+########################################
+## <summary>
+## Read/Write user tmpfs files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
interface(`userdom_rw_user_tmpfs_files',`
gen_require(`
type user_tmpfs_t;
@@ -2814,7 +3043,43 @@
type user_tmp_t; type user_tmp_t;
') ')
@ -30360,7 +30462,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -2851,6 +3093,7 @@ @@ -2851,6 +3116,7 @@
') ')
read_files_pattern($1,userdomain,userdomain) read_files_pattern($1,userdomain,userdomain)
@ -30368,7 +30470,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_search_proc($1) kernel_search_proc($1)
') ')
@@ -2965,6 +3208,24 @@ @@ -2965,6 +3231,24 @@
######################################## ########################################
## <summary> ## <summary>
@ -30393,7 +30495,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Send a dbus message to all user domains. ## Send a dbus message to all user domains.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -2981,3 +3242,313 @@ @@ -2981,3 +3265,313 @@
allow $1 userdomain:dbus send_msg; allow $1 userdomain:dbus send_msg;
') ')

4
selinux-policy.spec
View File

@ -20,7 +20,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.6.5 Version: 3.6.5
Release: 2%{?dist} Release: 3%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -444,6 +444,8 @@ exit 0
%endif %endif
%changelog %changelog
* Wed Feb 11 2009 Dan Walsh <dwalsh@redhat.com> 3.6.5-3
* Tue Feb 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.5-2 * Tue Feb 10 2009 Dan Walsh <dwalsh@redhat.com> 3.6.5-2
- Add git web policy - Add git web policy