From e9c6cda7da0eb0aabcf51574f9939f241665847d Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Tue, 29 Apr 2008 13:58:34 +0000 Subject: [PATCH] trunk: Move user roles into individual modules. --- Changelog | 1 + policy/modules/admin/acct.te | 5 +- policy/modules/admin/alsa.te | 8 +- policy/modules/admin/amanda.te | 6 +- policy/modules/admin/anaconda.te | 4 +- policy/modules/admin/bootloader.te | 9 +- policy/modules/admin/dmesg.te | 5 +- policy/modules/admin/firstboot.te | 16 +- policy/modules/admin/kudzu.te | 5 +- policy/modules/admin/logrotate.te | 5 +- policy/modules/admin/logwatch.te | 7 +- policy/modules/admin/mrtg.te | 5 +- policy/modules/admin/portage.if | 2 +- policy/modules/admin/portage.te | 2 +- policy/modules/admin/readahead.te | 5 +- policy/modules/admin/usermanage.te | 13 +- policy/modules/apps/calamaris.te | 4 +- policy/modules/apps/games.te | 5 +- policy/modules/apps/mono.te | 4 +- policy/modules/apps/uml.te | 5 +- policy/modules/apps/userhelper.if | 4 +- policy/modules/apps/userhelper.te | 2 +- policy/modules/apps/vmware.te | 5 +- policy/modules/roles/auditadm.fc | 1 + policy/modules/roles/auditadm.if | 45 ++ policy/modules/roles/auditadm.te | 50 ++ policy/modules/roles/metadata.xml | 1 + policy/modules/roles/secadm.fc | 1 + policy/modules/roles/secadm.if | 45 ++ policy/modules/roles/secadm.te | 62 +++ policy/modules/roles/staff.fc | 1 + policy/modules/roles/staff.if | 162 +++++++ policy/modules/roles/staff.te | 30 ++ policy/modules/roles/sysadm.fc | 1 + policy/modules/roles/sysadm.if | 547 ++++++++++++++++++++++ policy/modules/roles/sysadm.te | 330 +++++++++++++ policy/modules/roles/unprivuser.fc | 1 + policy/modules/roles/unprivuser.if | 325 +++++++++++++ policy/modules/roles/unprivuser.te | 15 + policy/modules/services/afs.te | 14 +- policy/modules/services/amavis.te | 6 +- policy/modules/services/apache.te | 11 +- policy/modules/services/apm.te | 5 +- policy/modules/services/arpwatch.te | 5 +- policy/modules/services/asterisk.te | 5 +- policy/modules/services/audioentropy.te | 5 +- policy/modules/services/automount.te | 5 +- policy/modules/services/avahi.te | 5 +- policy/modules/services/bind.te | 5 +- policy/modules/services/bluetooth.te | 7 +- policy/modules/services/canna.te | 5 +- policy/modules/services/comsat.te | 6 +- policy/modules/services/courier.te | 5 +- policy/modules/services/cups.te | 10 +- policy/modules/services/cyrus.te | 5 +- policy/modules/services/dante.te | 5 +- policy/modules/services/dbus.te | 5 +- policy/modules/services/dcc.te | 11 +- policy/modules/services/ddclient.te | 5 +- policy/modules/services/dhcp.te | 5 +- policy/modules/services/distcc.te | 5 +- policy/modules/services/dnsmasq.te | 5 +- policy/modules/services/dovecot.te | 5 +- policy/modules/services/exim.te | 7 +- policy/modules/services/fetchmail.te | 5 +- policy/modules/services/finger.te | 10 +- policy/modules/services/ftp.te | 5 +- policy/modules/services/gatekeeper.te | 5 +- policy/modules/services/gpm.te | 5 +- policy/modules/services/hal.te | 5 +- policy/modules/services/howl.te | 5 +- policy/modules/services/i18n_input.te | 5 +- policy/modules/services/imaze.te | 5 +- policy/modules/services/inetd.te | 5 +- policy/modules/services/inn.te | 5 +- policy/modules/services/ircd.te | 5 +- policy/modules/services/irqbalance.te | 5 +- policy/modules/services/jabber.te | 5 +- policy/modules/services/kerberos.te | 8 +- policy/modules/services/ldap.te | 5 +- policy/modules/services/lpd.te | 5 +- policy/modules/services/mailman.te | 9 +- policy/modules/services/monop.te | 5 +- policy/modules/services/mta.te | 6 +- policy/modules/services/munin.te | 5 +- policy/modules/services/mysql.te | 5 +- policy/modules/services/nagios.te | 5 +- policy/modules/services/nessus.te | 5 +- policy/modules/services/networkmanager.te | 5 +- policy/modules/services/nis.te | 11 +- policy/modules/services/nscd.te | 5 +- policy/modules/services/nsd.te | 7 +- policy/modules/services/ntop.te | 5 +- policy/modules/services/ntp.te | 6 +- policy/modules/services/oav.te | 5 +- policy/modules/services/oddjob.te | 16 +- policy/modules/services/openct.te | 5 +- policy/modules/services/pegasus.te | 5 +- policy/modules/services/perdition.te | 5 +- policy/modules/services/portmap.te | 5 +- policy/modules/services/postgresql.te | 7 +- policy/modules/services/postgrey.te | 5 +- policy/modules/services/ppp.te | 10 +- policy/modules/services/privoxy.te | 7 +- policy/modules/services/procmail.te | 7 +- policy/modules/services/pxe.te | 5 +- policy/modules/services/pyzor.te | 12 +- policy/modules/services/radius.te | 7 +- policy/modules/services/radvd.te | 5 +- policy/modules/services/rhgb.te | 5 +- policy/modules/services/roundup.te | 5 +- policy/modules/services/samba.te | 15 +- policy/modules/services/sasl.te | 5 +- policy/modules/services/sendmail.te | 5 +- policy/modules/services/setroubleshoot.te | 4 +- policy/modules/services/slrnpull.te | 5 +- policy/modules/services/smartmon.te | 5 +- policy/modules/services/snmp.te | 5 +- policy/modules/services/snort.te | 5 +- policy/modules/services/soundserver.te | 5 +- policy/modules/services/spamassassin.te | 5 +- policy/modules/services/speedtouch.te | 5 +- policy/modules/services/squid.te | 5 +- policy/modules/services/stunnel.te | 5 +- policy/modules/services/sysstat.te | 4 +- policy/modules/services/tftp.te | 7 +- policy/modules/services/timidity.te | 5 +- policy/modules/services/transproxy.te | 5 +- policy/modules/services/uptime.te | 5 +- policy/modules/services/uwimap.te | 5 +- policy/modules/services/watchdog.te | 5 +- policy/modules/services/xfs.te | 5 +- policy/modules/services/xprint.te | 5 +- policy/modules/services/xserver.te | 5 +- policy/modules/services/zebra.te | 5 +- policy/modules/system/authlogin.te | 5 +- policy/modules/system/hotplug.te | 5 +- policy/modules/system/init.te | 7 +- policy/modules/system/ipsec.te | 7 +- policy/modules/system/locallogin.te | 12 +- policy/modules/system/logging.te | 10 +- policy/modules/system/lvm.te | 5 +- policy/modules/system/modutils.te | 8 +- policy/modules/system/pcmcia.te | 5 +- policy/modules/system/raid.te | 5 +- policy/modules/system/selinuxutil.te | 6 +- policy/modules/system/sysnetwork.te | 4 +- policy/modules/system/userdomain.if | 474 +++++-------------- policy/modules/system/userdomain.te | 405 +--------------- policy/modules/system/xen.te | 6 +- 150 files changed, 2187 insertions(+), 1096 deletions(-) create mode 100644 policy/modules/roles/auditadm.fc create mode 100644 policy/modules/roles/auditadm.if create mode 100644 policy/modules/roles/auditadm.te create mode 100644 policy/modules/roles/metadata.xml create mode 100644 policy/modules/roles/secadm.fc create mode 100644 policy/modules/roles/secadm.if create mode 100644 policy/modules/roles/secadm.te create mode 100644 policy/modules/roles/staff.fc create mode 100644 policy/modules/roles/staff.if create mode 100644 policy/modules/roles/staff.te create mode 100644 policy/modules/roles/sysadm.fc create mode 100644 policy/modules/roles/sysadm.if create mode 100644 policy/modules/roles/sysadm.te create mode 100644 policy/modules/roles/unprivuser.fc create mode 100644 policy/modules/roles/unprivuser.if create mode 100644 policy/modules/roles/unprivuser.te diff --git a/Changelog b/Changelog index 0fa7738d..17d4d04c 100644 --- a/Changelog +++ b/Changelog @@ -1,3 +1,4 @@ +- Move user roles into individual modules. - Make hald_log_t a log file. - Cryptsetup runs shell scripts. Patch from Martin Orr. - Add file for enabling policy capabilities. diff --git a/policy/modules/admin/acct.te b/policy/modules/admin/acct.te index 87dc0c15..1fb54450 100644 --- a/policy/modules/admin/acct.te +++ b/policy/modules/admin/acct.te @@ -1,5 +1,5 @@ -policy_module(acct,1.1.0) +policy_module(acct,1.1.1) ######################################## # @@ -66,9 +66,10 @@ logging_send_syslog_msg(acct_t) miscfiles_read_localization(acct_t) -userdom_dontaudit_search_sysadm_home_dirs(acct_t) userdom_dontaudit_use_unpriv_user_fds(acct_t) +sysadm_dontaudit_search_home_dirs(acct_t) + optional_policy(` optional_policy(` # for monthly cron job diff --git a/policy/modules/admin/alsa.te b/policy/modules/admin/alsa.te index ffe916b7..914f7576 100644 --- a/policy/modules/admin/alsa.te +++ b/policy/modules/admin/alsa.te @@ -1,5 +1,5 @@ -policy_module(alsa,1.4.0) +policy_module(alsa,1.4.1) ######################################## # @@ -60,8 +60,10 @@ miscfiles_read_localization(alsa_t) userdom_manage_unpriv_user_semaphores(alsa_t) userdom_manage_unpriv_user_shared_mem(alsa_t) -userdom_search_generic_user_home_dirs(alsa_t) -userdom_dontaudit_search_sysadm_home_dirs(alsa_t) + +sysadm_dontaudit_search_home_dirs(alsa_t) + +unprivuser_search_home_dirs(alsa_t) optional_policy(` hal_use_fds(alsa_t) diff --git a/policy/modules/admin/amanda.te b/policy/modules/admin/amanda.te index 025da735..a5f6f457 100644 --- a/policy/modules/admin/amanda.te +++ b/policy/modules/admin/amanda.te @@ -1,5 +1,5 @@ -policy_module(amanda,1.8.0) +policy_module(amanda,1.8.1) ####################################### # @@ -181,7 +181,7 @@ manage_files_pattern(amanda_recover_t,amanda_recover_dir_t,amanda_recover_dir_t) manage_lnk_files_pattern(amanda_recover_t,amanda_recover_dir_t,amanda_recover_dir_t) manage_fifo_files_pattern(amanda_recover_t,amanda_recover_dir_t,amanda_recover_dir_t) manage_sock_files_pattern(amanda_recover_t,amanda_recover_dir_t,amanda_recover_dir_t) -userdom_sysadm_home_dir_filetrans(amanda_recover_t,amanda_recover_dir_t,{ dir file lnk_file sock_file fifo_file }) +sysadm_home_dir_filetrans(amanda_recover_t,amanda_recover_dir_t,{ dir file lnk_file sock_file fifo_file }) manage_dirs_pattern(amanda_recover_t,amanda_tmp_t,amanda_tmp_t) manage_files_pattern(amanda_recover_t,amanda_tmp_t,amanda_tmp_t) @@ -228,4 +228,4 @@ logging_search_logs(amanda_recover_t) miscfiles_read_localization(amanda_recover_t) -userdom_search_sysadm_home_content_dirs(amanda_recover_t) +sysadm_search_home_content_dirs(amanda_recover_t) diff --git a/policy/modules/admin/anaconda.te b/policy/modules/admin/anaconda.te index 9684a0e3..34255f08 100644 --- a/policy/modules/admin/anaconda.te +++ b/policy/modules/admin/anaconda.te @@ -1,5 +1,5 @@ -policy_module(anaconda,1.2.0) +policy_module(anaconda,1.2.1) ######################################## # @@ -34,7 +34,7 @@ seutil_domtrans_semanage(anaconda_t) unconfined_domain(anaconda_t) -userdom_generic_user_home_dir_filetrans_generic_user_home_content(anaconda_t,{ dir file lnk_file fifo_file sock_file }) +unprivuser_home_dir_filetrans_home_content(anaconda_t,{ dir file lnk_file fifo_file sock_file }) optional_policy(` dmesg_domtrans(anaconda_t) diff --git a/policy/modules/admin/bootloader.te b/policy/modules/admin/bootloader.te index b430249d..be26bcb1 100644 --- a/policy/modules/admin/bootloader.te +++ b/policy/modules/admin/bootloader.te @@ -1,5 +1,5 @@ -policy_module(bootloader,1.7.0) +policy_module(bootloader,1.7.1) ######################################## # @@ -212,6 +212,9 @@ optional_policy(` ') optional_policy(` - userdom_dontaudit_search_staff_home_dirs(bootloader_t) - userdom_dontaudit_search_sysadm_home_dirs(bootloader_t) + staff_dontaudit_search_home_dirs(bootloader_t) +') + +optional_policy(` + sysadm_dontaudit_search_home_dirs(bootloader_t) ') diff --git a/policy/modules/admin/dmesg.te b/policy/modules/admin/dmesg.te index 91b0e982..7a740947 100644 --- a/policy/modules/admin/dmesg.te +++ b/policy/modules/admin/dmesg.te @@ -1,5 +1,5 @@ -policy_module(dmesg,1.1.0) +policy_module(dmesg,1.1.1) ######################################## # @@ -50,9 +50,10 @@ logging_write_generic_logs(dmesg_t) miscfiles_read_localization(dmesg_t) -userdom_use_sysadm_terms(dmesg_t) userdom_dontaudit_use_unpriv_user_fds(dmesg_t) +sysadm_use_terms(dmesg_t) + optional_policy(` seutil_sigchld_newrole(dmesg_t) ') diff --git a/policy/modules/admin/firstboot.te b/policy/modules/admin/firstboot.te index 1a2a66a7..ec7cf5cd 100644 --- a/policy/modules/admin/firstboot.te +++ b/policy/modules/admin/firstboot.te @@ -1,5 +1,5 @@ -policy_module(firstboot,1.6.0) +policy_module(firstboot,1.6.1) gen_require(` class passwd rootok; @@ -88,13 +88,13 @@ modutils_read_module_config(firstboot_t) modutils_read_module_deps(firstboot_t) # Add/remove user home directories -userdom_manage_generic_user_home_content_dirs(firstboot_t) -userdom_manage_generic_user_home_content_files(firstboot_t) -userdom_manage_generic_user_home_content_symlinks(firstboot_t) -userdom_manage_generic_user_home_content_pipes(firstboot_t) -userdom_manage_generic_user_home_content_sockets(firstboot_t) -userdom_home_filetrans_generic_user_home_dir(firstboot_t) -userdom_generic_user_home_dir_filetrans_generic_user_home_content(firstboot_t,{ dir file lnk_file fifo_file sock_file }) +unprivuser_manage_home_content_dirs(firstboot_t) +unprivuser_manage_home_content_files(firstboot_t) +unprivuser_manage_home_content_symlinks(firstboot_t) +unprivuser_manage_home_content_pipes(firstboot_t) +unprivuser_manage_home_content_sockets(firstboot_t) +unprivuser_home_filetrans_home_dir(firstboot_t) +unprivuser_home_dir_filetrans_home_content(firstboot_t, { dir file lnk_file fifo_file sock_file }) optional_policy(` hal_dbus_chat(firstboot_t) diff --git a/policy/modules/admin/kudzu.te b/policy/modules/admin/kudzu.te index 6b7f12f3..47e98f77 100644 --- a/policy/modules/admin/kudzu.te +++ b/policy/modules/admin/kudzu.te @@ -1,5 +1,5 @@ -policy_module(kudzu,1.5.0) +policy_module(kudzu,1.5.1) ######################################## # @@ -122,9 +122,10 @@ modutils_domtrans_insmod(kudzu_t) sysnet_read_config(kudzu_t) -userdom_search_sysadm_home_dirs(kudzu_t) userdom_dontaudit_use_unpriv_user_fds(kudzu_t) +sysadm_search_home_dirs(kudzu_t) + optional_policy(` gpm_getattr_gpmctl(kudzu_t) ') diff --git a/policy/modules/admin/logrotate.te b/policy/modules/admin/logrotate.te index 313298b9..ff27e336 100644 --- a/policy/modules/admin/logrotate.te +++ b/policy/modules/admin/logrotate.te @@ -1,5 +1,5 @@ -policy_module(logrotate,1.8.0) +policy_module(logrotate,1.8.1) ######################################## # @@ -115,7 +115,6 @@ miscfiles_read_localization(logrotate_t) seutil_dontaudit_read_config(logrotate_t) -userdom_dontaudit_search_sysadm_home_dirs(logrotate_t) userdom_use_unpriv_users_fds(logrotate_t) cron_system_entry(logrotate_t, logrotate_exec_t) @@ -123,6 +122,8 @@ cron_search_spool(logrotate_t) mta_send_mail(logrotate_t) +sysadm_dontaudit_search_home_dirs(logrotate_t) + ifdef(`distro_debian', ` allow logrotate_t logrotate_tmp_t:file { relabelfrom relabelto }; # for savelog diff --git a/policy/modules/admin/logwatch.te b/policy/modules/admin/logwatch.te index 7fd7487c..59c4a4e5 100644 --- a/policy/modules/admin/logwatch.te +++ b/policy/modules/admin/logwatch.te @@ -1,5 +1,5 @@ -policy_module(logwatch,1.7.0) +policy_module(logwatch,1.7.1) ################################# # @@ -88,11 +88,10 @@ selinux_dontaudit_getattr_dir(logwatch_t) sysnet_dns_name_resolve(logwatch_t) -userdom_dontaudit_search_sysadm_home_dirs(logwatch_t) -userdom_dontaudit_getattr_sysadm_home_dirs(logwatch_t) - mta_send_mail(logwatch_t) +sysadm_dontaudit_search_home_dirs(logwatch_t) + optional_policy(` apache_read_log(logwatch_t) ') diff --git a/policy/modules/admin/mrtg.te b/policy/modules/admin/mrtg.te index 4cfd88a3..c13c762d 100644 --- a/policy/modules/admin/mrtg.te +++ b/policy/modules/admin/mrtg.te @@ -1,5 +1,5 @@ -policy_module(mrtg,1.3.0) +policy_module(mrtg,1.3.1) ######################################## # @@ -115,7 +115,8 @@ selinux_dontaudit_getattr_dir(mrtg_t) sysnet_read_config(mrtg_t) userdom_dontaudit_use_unpriv_user_fds(mrtg_t) -userdom_use_sysadm_terms(mrtg_t) + +sysadm_use_terms(mrtg_t) ifdef(`enable_mls',` corenet_udp_sendrecv_lo_if(mrtg_t) diff --git a/policy/modules/admin/portage.if b/policy/modules/admin/portage.if index 401120a1..2c063043 100644 --- a/policy/modules/admin/portage.if +++ b/policy/modules/admin/portage.if @@ -272,7 +272,7 @@ interface(`portage_fetch_domain',` sysnet_read_config($1) sysnet_dns_name_resolve($1) - userdom_dontaudit_read_sysadm_home_content_files($1) + sysadm_dontaudit_read_home_content_files($1) ifdef(`hide_broken_symptoms',` dontaudit $1 portage_cache_t:file read; diff --git a/policy/modules/admin/portage.te b/policy/modules/admin/portage.te index 49476ac1..151828a0 100644 --- a/policy/modules/admin/portage.te +++ b/policy/modules/admin/portage.te @@ -1,5 +1,5 @@ -policy_module(portage,1.5.0) +policy_module(portage,1.5.1) ######################################## # diff --git a/policy/modules/admin/readahead.te b/policy/modules/admin/readahead.te index b8227d48..fde16087 100644 --- a/policy/modules/admin/readahead.te +++ b/policy/modules/admin/readahead.te @@ -1,5 +1,5 @@ -policy_module(readahead,1.5.0) +policy_module(readahead,1.5.1) ######################################## # @@ -79,7 +79,8 @@ logging_dontaudit_search_audit_config(readahead_t) miscfiles_read_localization(readahead_t) userdom_dontaudit_use_unpriv_user_fds(readahead_t) -userdom_dontaudit_search_sysadm_home_dirs(readahead_t) + +sysadm_dontaudit_search_home_dirs(readahead_t) optional_policy(` cron_system_entry(readahead_t, readahead_exec_t) diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te index 64953251..1d6fa25b 100644 --- a/policy/modules/admin/usermanage.te +++ b/policy/modules/admin/usermanage.te @@ -1,5 +1,5 @@ -policy_module(usermanage,1.10.0) +policy_module(usermanage,1.10.1) ######################################## # @@ -159,7 +159,7 @@ libs_use_shared_libs(crack_t) logging_send_syslog_msg(crack_t) -userdom_dontaudit_search_sysadm_home_dirs(crack_t) +sysadm_dontaudit_search_home_dirs(crack_t) ifdef(`distro_debian',` # the package cracklib-runtime on Debian contains a daily maintenance @@ -236,8 +236,9 @@ auth_use_nsswitch(groupadd_t) seutil_read_config(groupadd_t) userdom_use_unpriv_users_fds(groupadd_t) + # for when /root is the cwd -userdom_dontaudit_search_sysadm_home_dirs(groupadd_t) +sysadm_dontaudit_search_home_dirs(groupadd_t) optional_policy(` dpkg_use_fds(groupadd_t) @@ -501,13 +502,11 @@ seutil_domtrans_semanage(useradd_t) seutil_domtrans_setfiles(useradd_t) userdom_use_unpriv_users_fds(useradd_t) -# for when /root is the cwd -userdom_dontaudit_search_sysadm_home_dirs(useradd_t) # Add/remove user home directories -userdom_home_filetrans_generic_user_home_dir(useradd_t) userdom_manage_all_users_home_content_dirs(useradd_t) userdom_manage_all_users_home_content_files(useradd_t) -userdom_generic_user_home_dir_filetrans_generic_user_home_content(useradd_t,notdevfile_class_set) +unprivuser_home_filetrans_home_dir(useradd_t) +unprivuser_home_dir_filetrans_home_content(useradd_t,notdevfile_class_set) mta_manage_spool(useradd_t) diff --git a/policy/modules/apps/calamaris.te b/policy/modules/apps/calamaris.te index 7d104357..d48ff4b1 100644 --- a/policy/modules/apps/calamaris.te +++ b/policy/modules/apps/calamaris.te @@ -1,5 +1,5 @@ -policy_module(calamaris,1.2.0) +policy_module(calamaris,1.2.1) ######################################## # @@ -67,7 +67,7 @@ miscfiles_read_localization(calamaris_t) sysnet_read_config(calamaris_t) -userdom_dontaudit_list_sysadm_home_dirs(calamaris_t) +sysadm_dontaudit_list_home_dirs(calamaris_t) squid_read_log(calamaris_t) diff --git a/policy/modules/apps/games.te b/policy/modules/apps/games.te index 3a02cc7a..9bbd43fe 100644 --- a/policy/modules/apps/games.te +++ b/policy/modules/apps/games.te @@ -1,5 +1,5 @@ -policy_module(games,1.6.0) +policy_module(games,1.6.1) ######################################## # @@ -58,7 +58,8 @@ logging_send_syslog_msg(games_t) miscfiles_read_localization(games_t) userdom_dontaudit_use_unpriv_user_fds(games_t) -userdom_dontaudit_search_sysadm_home_dirs(games_t) + +sysadm_dontaudit_search_home_dirs(games_t) optional_policy(` seutil_sigchld_newrole(games_t) diff --git a/policy/modules/apps/mono.te b/policy/modules/apps/mono.te index 47b711a6..ee29a1f0 100644 --- a/policy/modules/apps/mono.te +++ b/policy/modules/apps/mono.te @@ -1,5 +1,5 @@ -policy_module(mono,1.4.0) +policy_module(mono,1.4.1) ######################################## # @@ -17,7 +17,7 @@ init_system_domain(mono_t,mono_exec_t) allow mono_t self:process { execheap execmem }; -userdom_generic_user_home_dir_filetrans_generic_user_home_content(mono_t,{ dir file lnk_file fifo_file sock_file }) +unprivuser_home_dir_filetrans_home_content(mono_t,{ dir file lnk_file fifo_file sock_file }) init_dbus_chat_script(mono_t) diff --git a/policy/modules/apps/uml.te b/policy/modules/apps/uml.te index aae9a1b1..7be910c0 100644 --- a/policy/modules/apps/uml.te +++ b/policy/modules/apps/uml.te @@ -1,5 +1,5 @@ -policy_module(uml,1.5.0) +policy_module(uml,1.5.1) ######################################## # @@ -57,7 +57,8 @@ logging_send_syslog_msg(uml_switch_t) miscfiles_read_localization(uml_switch_t) userdom_dontaudit_use_unpriv_user_fds(uml_switch_t) -userdom_dontaudit_search_sysadm_home_dirs(uml_switch_t) + +sysadm_dontaudit_search_home_dirs(uml_switch_t) optional_policy(` seutil_sigchld_newrole(uml_switch_t) diff --git a/policy/modules/apps/userhelper.if b/policy/modules/apps/userhelper.if index ccc3d2ce..4a6c6a85 100644 --- a/policy/modules/apps/userhelper.if +++ b/policy/modules/apps/userhelper.if @@ -161,8 +161,8 @@ template(`userhelper_per_role_template',` tunable_policy(`! secure_mode',` #if we are not in secure mode then we can transition to sysadm_t - userdom_bin_spec_domtrans_sysadm($1_userhelper_t) - userdom_entry_spec_domtrans_sysadm($1_userhelper_t) + sysadm_bin_spec_domtrans($1_userhelper_t) + sysadm_entry_spec_domtrans($1_userhelper_t) ') optional_policy(` diff --git a/policy/modules/apps/userhelper.te b/policy/modules/apps/userhelper.te index f84c4e4e..69fa2e10 100644 --- a/policy/modules/apps/userhelper.te +++ b/policy/modules/apps/userhelper.te @@ -1,5 +1,5 @@ -policy_module(userhelper,1.3.0) +policy_module(userhelper,1.3.1) ######################################## # diff --git a/policy/modules/apps/vmware.te b/policy/modules/apps/vmware.te index 69e988ae..d239b8de 100644 --- a/policy/modules/apps/vmware.te +++ b/policy/modules/apps/vmware.te @@ -1,5 +1,5 @@ -policy_module(vmware,1.5.0) +policy_module(vmware,1.5.1) ######################################## # @@ -87,7 +87,8 @@ miscfiles_read_localization(vmware_host_t) sysnet_dns_name_resolve(vmware_host_t) userdom_dontaudit_use_unpriv_user_fds(vmware_host_t) -userdom_dontaudit_search_sysadm_home_dirs(vmware_host_t) + +sysadm_dontaudit_search_home_dirs(vmware_host_t) optional_policy(` seutil_sigchld_newrole(vmware_host_t) diff --git a/policy/modules/roles/auditadm.fc b/policy/modules/roles/auditadm.fc new file mode 100644 index 00000000..601a7b02 --- /dev/null +++ b/policy/modules/roles/auditadm.fc @@ -0,0 +1 @@ +# file contexts handled by userdomain and genhomedircon diff --git a/policy/modules/roles/auditadm.if b/policy/modules/roles/auditadm.if new file mode 100644 index 00000000..532cb5a4 --- /dev/null +++ b/policy/modules/roles/auditadm.if @@ -0,0 +1,45 @@ +## Audit administrator role + +######################################## +## +## Change to the generic user role. +## +## +## +## The prefix of the user role (e.g., user +## is the prefix for user_r). +## +## +## +# +template(`auditadm_role_change_template',` + userdom_role_change_template($1, auditadm) +') + +######################################## +## +## Change from the generic user role. +## +## +##

+## Change from the generic user role to +## the specified role. +##

+##

+## This is a template to support third party modules +## and its use is not allowed in upstream reference +## policy. +##

+## +## +## +## The prefix of the user role (e.g., user +## is the prefix for user_r). +## +## +## +# +template(`auditadm_role_change_to_template',` + userdom_role_change_template(auditadm, $1) +') + diff --git a/policy/modules/roles/auditadm.te b/policy/modules/roles/auditadm.te new file mode 100644 index 00000000..29d389a1 --- /dev/null +++ b/policy/modules/roles/auditadm.te @@ -0,0 +1,50 @@ + +policy_module(auditadm, 1.0.0) + +######################################## +# +# Declarations +# + +role auditadm_r; + +userdom_unpriv_user_template(auditadm) + +######################################## +# +# Local policy +# + +allow auditadm_t self:capability { dac_read_search dac_override }; + +corecmd_exec_shell(auditadm_t) + +domain_kill_all_domains(auditadm_t) + +logging_send_syslog_msg(auditadm_t) +logging_read_generic_logs(auditadm_t) +logging_manage_audit_log(auditadm_t) +logging_manage_audit_config(auditadm_t) +logging_run_auditctl(auditadm_t, auditadm_r, { auditadm_tty_device_t auditadm_devpts_t }) +logging_run_auditd(auditadm_t, auditadm_r, { auditadm_tty_device_t auditadm_devpts_t }) + +seutil_run_runinit(auditadm_t, auditadm_r, { auditadm_tty_device_t auditadm_devpts_t }) +seutil_read_bin_policy(auditadm_t) + +optional_policy(` + consoletype_exec(auditadm_t) +') + +optional_policy(` + dmesg_exec(auditadm_t) +') + +optional_policy(` + secadm_role_change_template(auditadm) +') + +optional_policy(` + sysadm_role_change_template(auditadm) + sysadm_dontaudit_read_home_content_files(auditadm_t) +') + diff --git a/policy/modules/roles/metadata.xml b/policy/modules/roles/metadata.xml new file mode 100644 index 00000000..ba002e80 --- /dev/null +++ b/policy/modules/roles/metadata.xml @@ -0,0 +1 @@ +Policy modules for user roles. diff --git a/policy/modules/roles/secadm.fc b/policy/modules/roles/secadm.fc new file mode 100644 index 00000000..601a7b02 --- /dev/null +++ b/policy/modules/roles/secadm.fc @@ -0,0 +1 @@ +# file contexts handled by userdomain and genhomedircon diff --git a/policy/modules/roles/secadm.if b/policy/modules/roles/secadm.if new file mode 100644 index 00000000..a5148b07 --- /dev/null +++ b/policy/modules/roles/secadm.if @@ -0,0 +1,45 @@ +## Security administrator role + +######################################## +## +## Change to the generic user role. +## +## +## +## The prefix of the user role (e.g., user +## is the prefix for user_r). +## +## +## +# +template(`secadm_role_change_template',` + userdom_role_change_template($1, secadm) +') + +######################################## +## +## Change from the generic user role. +## +## +##

+## Change from the generic user role to +## the specified role. +##

+##

+## This is a template to support third party modules +## and its use is not allowed in upstream reference +## policy. +##

+## +## +## +## The prefix of the user role (e.g., user +## is the prefix for user_r). +## +## +## +# +template(`secadm_role_change_to_template',` + userdom_role_change_template(secadm, $1) +') + diff --git a/policy/modules/roles/secadm.te b/policy/modules/roles/secadm.te new file mode 100644 index 00000000..18319616 --- /dev/null +++ b/policy/modules/roles/secadm.te @@ -0,0 +1,62 @@ + +policy_module(secadm, 1.0.0) + +######################################## +# +# Declarations +# + +role secadm_r; + +userdom_unpriv_user_template(secadm) +userdom_security_admin_template(secadm_t, secadm_r, { secadm_tty_device_t secadm_devpts_t }) + +######################################## +# +# Local policy +# + +allow secadm_t self:capability { dac_read_search dac_override }; + +corecmd_exec_shell(secadm_t) + +dev_relabel_all_dev_nodes(secadm_t) + +domain_obj_id_change_exemption(secadm_t) + +mls_process_read_up(secadm_t) +mls_file_read_all_levels(secadm_t) +mls_file_write_all_levels(secadm_t) +mls_file_upgrade(secadm_t) +mls_file_downgrade(secadm_t) + +auth_relabel_all_files_except_shadow(secadm_t) +auth_relabel_shadow(secadm_t) + +init_exec(secadm_t) + +logging_read_audit_log(secadm_t) +logging_read_generic_logs(secadm_t) +logging_read_audit_config(secadm_t) + +optional_policy(` + aide_run(secadm_t, secadm_r, { secadm_tty_device_t secadm_devpts_t }) +') + +optional_policy(` + auditadm_role_change_template(secadm) +') + +optional_policy(` + netlabel_run_mgmt(secadm_t, secadm_r, { secadm_tty_device_t secadm_devpts_t }) +') + +optional_policy(` + staff_dontaudit_append_home_content_files(secadm_t) +') + +optional_policy(` + sysadm_role_change_template(secadm) + sysadm_dontaudit_read_home_content_files(secadm_t) +') + diff --git a/policy/modules/roles/staff.fc b/policy/modules/roles/staff.fc new file mode 100644 index 00000000..601a7b02 --- /dev/null +++ b/policy/modules/roles/staff.fc @@ -0,0 +1 @@ +# file contexts handled by userdomain and genhomedircon diff --git a/policy/modules/roles/staff.if b/policy/modules/roles/staff.if new file mode 100644 index 00000000..6e0bc69f --- /dev/null +++ b/policy/modules/roles/staff.if @@ -0,0 +1,162 @@ +## Administrator's unprivileged user role + +######################################## +## +## Change to the staff role. +## +## +## +## The prefix of the user role (e.g., user +## is the prefix for user_r). +## +## +## +# +template(`staff_role_change_template',` + userdom_role_change_template($1, staff) +') + +######################################## +## +## Change from the staff role. +## +## +##

+## Change from the staff role to +## the specified role. +##

+##

+## This is a template to support third party modules +## and its use is not allowed in upstream reference +## policy. +##

+## +## +## +## The prefix of the user role (e.g., user +## is the prefix for user_r). +## +## +## +# +template(`staff_role_change_to_template',` + userdom_role_change_template(staff, $1) +') + +######################################## +## +## Search the staff users home directory. +## +## +## +## Domain allowed access. +## +## +# +interface(`staff_search_home_dirs',` + gen_require(` + type staff_home_dir_t; + ') + + files_search_home($1) + allow $1 staff_home_dir_t:dir search_dir_perms; +') + +######################################## +## +## Do not audit attempts to search the staff +## users home directory. +## +## +## +## Domain to not audit. +## +## +# +interface(`staff_dontaudit_search_home_dirs',` + gen_require(` + type staff_home_dir_t; + ') + + dontaudit $1 staff_home_dir_t:dir search_dir_perms; +') + +######################################## +## +## Create, read, write, and delete staff +## home directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`staff_manage_home_dirs',` + gen_require(` + type staff_home_dir_t; + ') + + files_search_home($1) + allow $1 staff_home_dir_t:dir manage_dir_perms; +') + +######################################## +## +## Relabel to staff home directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`staff_relabelto_home_dirs',` + gen_require(` + type staff_home_dir_t; + ') + + files_search_home($1) + allow $1 staff_home_dir_t:dir relabelto; +') + +######################################## +## +## Do not audit attempts to append to the staff +## users home directory. +## +## +## +## Domain to not audit. +## +## +# +interface(`staff_dontaudit_append_home_content_files',` + gen_require(` + type staff_home_t; + ') + + dontaudit $1 staff_home_t:file append; +') + +######################################## +## +## Read files in the staff users home directory. +## +## +## +## Domain allowed access. +## +## +# +interface(`staff_read_home_content_files',` + gen_require(` + type staff_home_dir_t, staff_home_t; + ') + + files_search_home($1) + allow $1 { staff_home_dir_t staff_home_t }:dir list_dir_perms; + read_files_pattern($1, { staff_home_dir_t staff_home_t }, staff_home_t) + read_lnk_files_pattern($1, { staff_home_dir_t staff_home_t }, staff_home_t) +') + diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te new file mode 100644 index 00000000..9d68d0b9 --- /dev/null +++ b/policy/modules/roles/staff.te @@ -0,0 +1,30 @@ + +policy_module(staff, 1.0.0) + +######################################## +# +# Declarations +# + +role staff_r; + +userdom_unpriv_user_template(staff) + +######################################## +# +# Local policy +# + +optional_policy(` + auditadm_role_change_template(staff) +') + +optional_policy(` + secadm_role_change_template(staff) +') + +optional_policy(` + sysadm_role_change_template(staff) + sysadm_dontaudit_use_terms(staff_t) +') + diff --git a/policy/modules/roles/sysadm.fc b/policy/modules/roles/sysadm.fc new file mode 100644 index 00000000..601a7b02 --- /dev/null +++ b/policy/modules/roles/sysadm.fc @@ -0,0 +1 @@ +# file contexts handled by userdomain and genhomedircon diff --git a/policy/modules/roles/sysadm.if b/policy/modules/roles/sysadm.if new file mode 100644 index 00000000..8c4ad00e --- /dev/null +++ b/policy/modules/roles/sysadm.if @@ -0,0 +1,547 @@ +## General system administration role + +######################################## +## +## Change to the generic user role. +## +## +## +## The prefix of the user role (e.g., user +## is the prefix for user_r). +## +## +## +# +template(`sysadm_role_change_template',` + userdom_role_change_template($1, sysadm) +') + +######################################## +## +## Change from the generic user role. +## +## +##

+## Change from the generic user role to +## the specified role. +##

+##

+## This is a template to support third party modules +## and its use is not allowed in upstream reference +## policy. +##

+## +## +## +## The prefix of the user role (e.g., user +## is the prefix for user_r). +## +## +## +# +template(`sysadm_role_change_to_template',` + userdom_role_change_template(sysadm, $1) +') + +######################################## +## +## Execute a shell in the sysadm domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`sysadm_shell_domtrans',` + gen_require(` + type sysadm_t; + ') + + corecmd_shell_domtrans($1, sysadm_t) + allow sysadm_t $1:fd use; + allow sysadm_t $1:fifo_file rw_file_perms; + allow sysadm_t $1:process sigchld; +') + +######################################## +## +## Execute a generic bin program in the sysadm domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`sysadm_bin_spec_domtrans',` + gen_require(` + type sysadm_t; + ') + + corecmd_bin_spec_domtrans($1, sysadm_t) + allow sysadm_t $1:fd use; + allow sysadm_t $1:fifo_file rw_file_perms; + allow sysadm_t $1:process sigchld; +') + +######################################## +## +## Execute all entrypoint files in the sysadm domain. This +## is an explicit transition, requiring the +## caller to use setexeccon(). +## +## +## +## Domain allowed access. +## +## +# +interface(`sysadm_entry_spec_domtrans',` + gen_require(` + type sysadm_t; + ') + + domain_entry_file_spec_domtrans($1, sysadm_t) + allow sysadm_t $1:fd use; + allow sysadm_t $1:fifo_file rw_file_perms; + allow sysadm_t $1:process sigchld; +') + +######################################## +## +## Allow sysadm to execute a generic bin program in +## a specified domain. This is an explicit transition, +## requiring the caller to use setexeccon(). +## +## +##

+## Allow sysadm to execute a generic bin program in +## a specified domain. +##

+##

+## This is a interface to support third party modules +## and its use is not allowed in upstream reference +## policy. +##

+## +## +## +## Domain to execute in. +## +## +# +interface(`sysadm_bin_spec_domtrans_to',` + gen_require(` + type sysadm_t; + ') + + corecmd_bin_spec_domtrans(sysadm_t, $1) + allow $1 sysadm_t:fd use; + allow $1 sysadm_t:fifo_file rw_file_perms; + allow $1 sysadm_t:process sigchld; +') + +######################################## +## +## Send a SIGCHLD signal to sysadm users. +## +## +## +## Domain allowed access. +## +## +# +interface(`sysadm_sigchld',` + gen_require(` + type sysadm_t; + ') + + allow $1 sysadm_t:process sigchld; +') + +######################################## +## +## Inherit and use sysadm file descriptors +## +## +## +## Domain allowed access. +## +## +# +interface(`sysadm_use_fds',` + gen_require(` + type sysadm_t; + ') + + allow $1 sysadm_t:fd use; +') + +######################################## +## +## Read and write sysadm user unnamed pipes. +## +## +## +## Domain allowed access. +## +## +# +interface(`sysadm_rw_pipes',` + gen_require(` + type sysadm_t; + ') + + allow $1 sysadm_t:fifo_file rw_fifo_file_perms; +') + +######################################## +## +## Do not audit attepts to get the attributes +## of sysadm ttys. +## +## +## +## Domain allowed access. +## +## +# +interface(`sysadm_dontaudit_getattr_ttys',` + gen_require(` + type sysadm_tty_device_t; + ') + + dontaudit $1 sysadm_tty_device_t:chr_file getattr; +') + +######################################## +## +## Read and write sysadm ttys. +## +## +## +## Domain allowed access. +## +## +# +interface(`sysadm_use_ttys',` + gen_require(` + type sysadm_tty_device_t; + ') + + dev_list_all_dev_nodes($1) + term_list_ptys($1) + allow $1 sysadm_tty_device_t:chr_file rw_term_perms; +') + +######################################## +## +## Do not audit attempts to use sysadm ttys. +## +## +## +## Domain to not audit. +## +## +# +interface(`sysadm_dontaudit_use_ttys',` + gen_require(` + type sysadm_tty_device_t; + ') + + dontaudit $1 sysadm_tty_device_t:chr_file { read write }; +') + +######################################## +## +## Read and write sysadm ptys. +## +## +## +## Domain allowed access. +## +## +# +interface(`sysadm_use_ptys',` + gen_require(` + type sysadm_devpts_t; + ') + + dev_list_all_dev_nodes($1) + term_list_ptys($1) + allow $1 sysadm_devpts_t:chr_file rw_term_perms; +') + +######################################## +## +## Dont audit attempts to read and write sysadm ptys. +## +## +## +## Domain to not audit. +## +## +# +interface(`sysadm_dontaudit_use_ptys',` + gen_require(` + type sysadm_devpts_t; + ') + + dontaudit $1 sysadm_devpts_t:chr_file { read write }; +') + +######################################## +## +## Read and write sysadm ttys and ptys. +## +## +## +## Domain allowed access. +## +## +# +interface(`sysadm_use_terms',` + sysadm_use_ttys($1) + sysadm_use_ptys($1) +') + +######################################## +## +## Do not audit attempts to use sysadm ttys and ptys. +## +## +## +## Domain to not audit. +## +## +# +interface(`sysadm_dontaudit_use_terms',` + sysadm_dontaudit_use_ttys($1) + sysadm_dontaudit_use_ptys($1) +') + +######################################## +## +## Get the attributes of the sysadm users +## home directory. +## +## +## +## Domain allowed access. +## +## +# +interface(`sysadm_getattr_home_dirs',` + gen_require(` + type sysadm_home_dir_t; + ') + + allow $1 sysadm_home_dir_t:dir getattr; +') + +######################################## +## +## Do not audit attempts to get the +## attributes of the sysadm users +## home directory. +## +## +## +## Domain to not audit. +## +## +# +interface(`sysadm_dontaudit_getattr_home_dirs',` + gen_require(` + type sysadm_home_dir_t; + ') + + dontaudit $1 sysadm_home_dir_t:dir getattr; +') + +######################################## +## +## Search the sysadm users home directory. +## +## +## +## Domain to not audit. +## +## +# +interface(`sysadm_search_home_dirs',` + gen_require(` + type sysadm_home_dir_t; + ') + + allow $1 sysadm_home_dir_t:dir search_dir_perms; +') + +######################################## +## +## Do not audit attempts to search the sysadm +## users home directory. +## +## +## +## Domain to not audit. +## +## +# +interface(`sysadm_dontaudit_search_home_dirs',` + gen_require(` + type sysadm_home_dir_t; + ') + + dontaudit $1 sysadm_home_dir_t:dir search_dir_perms; +') + +######################################## +## +## List the sysadm users home directory. +## +## +## +## Domain allowed access. +## +## +# +interface(`sysadm_list_home_dirs',` + gen_require(` + type sysadm_home_dir_t; + ') + + allow $1 sysadm_home_dir_t:dir list_dir_perms; +') + +######################################## +## +## Do not audit attempts to list the sysadm +## users home directory. +## +## +## +## Domain to not audit. +## +## +# +interface(`sysadm_dontaudit_list_home_dirs',` + gen_require(` + type sysadm_home_dir_t; + ') + + dontaudit $1 sysadm_home_dir_t:dir list_dir_perms; +') + +######################################## +## +## Create objects in sysadm home directories +## with automatic file type transition. +## +## +## +## Domain allowed access. +## +## +## +## +## The type of the object to be created. +## +## +## +## +## The class of the object to be created. +## If not specified, file is used. +## +## +# +interface(`sysadm_home_dir_filetrans',` + gen_require(` + type sysadm_home_dir_t; + ') + + filetrans_pattern($1, sysadm_home_dir_t, $2, $3) +') + +######################################## +## +## Search the sysadm users home sub directories. +## +## +## +## Domain to not audit. +## +## +# +interface(`sysadm_search_home_content_dirs',` + gen_require(` + type sysadm_home_dir_t, sysadm_home_t; + ') + + allow $1 { sysadm_home_dir_t sysadm_home_t }:dir search_dir_perms; +') + +######################################## +## +## Read files in the sysadm home directory. +## +## +## +## Domain allowed access. +## +## +# +interface(`sysadm_read_home_content_files',` + gen_require(` + type sysadm_home_dir_t, sysadm_home_t; + ') + + files_search_home($1) + allow $1 { sysadm_home_dir_t sysadm_home_t }:dir list_dir_perms; + read_files_pattern($1, { sysadm_home_dir_t sysadm_home_t }, sysadm_home_t) + read_lnk_files_pattern($1, { sysadm_home_dir_t sysadm_home_t }, sysadm_home_t) +') + +######################################## +## +## Do not audit attempts to read files in the sysadm +## home directory. +## +## +## +## Domain to not audit. +## +## +# +interface(`sysadm_dontaudit_read_home_content_files',` + gen_require(` + type sysadm_home_dir_t, sysadm_home_t; + ') + + dontaudit $1 sysadm_home_dir_t:dir search_dir_perms; + dontaudit $1 sysadm_home_t:dir search_dir_perms; + dontaudit $1 sysadm_home_t:file read_file_perms; +') + +######################################## +## +## Read sysadm temporary files. +## +## +## +## Domain allowed access. +## +## +# +interface(`sysadm_read_tmp_files',` + gen_require(` + type sysadm_tmp_t; + ') + + files_search_tmp($1) + allow $1 sysadm_tmp_t:dir list_dir_perms; + read_files_pattern($1, sysadm_tmp_t, sysadm_tmp_t) + read_lnk_files_pattern($1, sysadm_tmp_t, sysadm_tmp_t) +') + diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te new file mode 100644 index 00000000..186b2a6f --- /dev/null +++ b/policy/modules/roles/sysadm.te @@ -0,0 +1,330 @@ + +policy_module(sysadm, 1.0.0) + +######################################## +# +# Declarations +# + +## +##

+## Allow sysadm to debug or ptrace all processes. +##

+## +gen_tunable(allow_ptrace,false) + +role sysadm_r; + +userdom_admin_user_template(sysadm) + +ifndef(`enable_mls',` + userdom_security_admin_template(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +######################################## +# +# Local policy +# + +corecmd_exec_shell(sysadm_t) + +mls_process_read_up(sysadm_t) + +init_exec(sysadm_t) + +# For sending reboot and wall messages +userdom_use_unpriv_users_ptys(sysadm_t) +userdom_use_unpriv_users_ttys(sysadm_t) + +ifdef(`direct_sysadm_daemon',` + optional_policy(` + init_run_daemon(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + ') +',` + ifdef(`distro_gentoo',` + optional_policy(` + seutil_init_script_run_runinit(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + ') + ') +') + +ifndef(`enable_mls',` + logging_manage_audit_log(sysadm_t) + logging_manage_audit_config(sysadm_t) + logging_run_auditctl(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +tunable_policy(`allow_ptrace',` + domain_ptrace_all_domains(sysadm_t) +') + +optional_policy(` + amanda_run_recover(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + apache_run_helper(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + #apache_run_all_scripts(sysadm_t, sysadm_r) + #apache_domtrans_sys_script(sysadm_t) +') + +optional_policy(` + # cjp: why is this not apm_run_client + apm_domtrans_client(sysadm_t) +') + +optional_policy(` + apt_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + auditadm_role_change_template(sysadm) +') + +optional_policy(` + backup_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + bind_run_ndc(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + bootloader_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + certwatch_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + clock_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + clockspeed_run_cli(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + consoletype_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + cron_admin_template(sysadm, sysadm_t, sysadm_r) +') + +optional_policy(` + cvs_exec(sysadm_t) +') + +optional_policy(` + dcc_run_cdcc(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + dcc_run_client(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + dcc_run_dbclean(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + ddcprobe_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + dmesg_exec(sysadm_t) +') + +optional_policy(` + dmidecode_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + dpkg_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + ethereal_run_tethereal(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + ethereal_admin_template(sysadm, sysadm_t, sysadm_r) +') + +optional_policy(` + firstboot_run(sysadm_t, sysadm_r, sysadm_tty_device_t) +') + +optional_policy(` + fstools_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + hostname_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + # allow system administrator to use the ipsec script to look + # at things (e.g., ipsec auto --status) + # probably should create an ipsec_admin role for this kind of thing + ipsec_exec_mgmt(sysadm_t) + ipsec_stream_connect(sysadm_t) + # for lsof + ipsec_getattr_key_sockets(sysadm_t) +') + +optional_policy(` + iptables_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + kudzu_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + libs_run_ldconfig(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + logrotate_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + lpd_run_checkpc(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + lpr_admin_template(sysadm, sysadm_t, sysadm_r) +') + +optional_policy(` + lvm_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + modutils_run_depmod(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + modutils_run_insmod(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + modutils_run_update_mods(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + mount_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + mta_admin_template(sysadm, sysadm_t, sysadm_r) +') + +optional_policy(` + munin_stream_connect(sysadm_t) +') + +optional_policy(` + mysql_stream_connect(sysadm_t) +') + +optional_policy(` + netutils_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + netutils_run_ping(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + netutils_run_traceroute(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + ntp_stub() + corenet_udp_bind_ntp_port(sysadm_t) +') + +optional_policy(` + oav_run_update(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + pcmcia_run_cardctl(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + portage_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + portage_run_gcc_config(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + portmap_run_helper(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + quota_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + raid_domtrans_mdadm(sysadm_t) +') + +optional_policy(` + rpc_domtrans_nfsd(sysadm_t) +') + +optional_policy(` + rpm_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + rsync_exec(sysadm_t) +') + +optional_policy(` + samba_run_net(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + samba_run_winbind_helper(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + secadm_role_change_template(sysadm) +') + +optional_policy(` + seutil_run_setfiles(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + seutil_run_runinit(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + staff_role_change_template(sysadm) +') + +optional_policy(` + sysnet_run_ifconfig(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + sysnet_run_dhcpc(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + tripwire_run_siggen(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + tripwire_run_tripwire(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + tripwire_run_twadmin(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + tripwire_run_twprint(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + tzdata_domtrans(sysadm_t) +') + +optional_policy(` + unconfined_domtrans(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + # Add/remove user home directories + unprivuser_manage_home_dirs(sysadm_t) + unprivuser_home_filetrans_home_dir(sysadm_t) + + unprivuser_role_change_template(sysadm) +') + +optional_policy(` + usbmodules_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + usermanage_run_admin_passwd(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + usermanage_run_groupadd(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) + usermanage_run_useradd(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + vpn_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + webalizer_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') + +optional_policy(` + yam_run(sysadm_t, sysadm_r, { sysadm_tty_device_t sysadm_devpts_t }) +') diff --git a/policy/modules/roles/unprivuser.fc b/policy/modules/roles/unprivuser.fc new file mode 100644 index 00000000..601a7b02 --- /dev/null +++ b/policy/modules/roles/unprivuser.fc @@ -0,0 +1 @@ +# file contexts handled by userdomain and genhomedircon diff --git a/policy/modules/roles/unprivuser.if b/policy/modules/roles/unprivuser.if new file mode 100644 index 00000000..1b551530 --- /dev/null +++ b/policy/modules/roles/unprivuser.if @@ -0,0 +1,325 @@ +## Generic unprivileged user role + +######################################## +## +## Change to the generic user role. +## +## +## +## The prefix of the user role (e.g., user +## is the prefix for user_r). +## +## +## +# +template(`unprivuser_role_change_template',` + userdom_role_change_template($1, user) +') + +######################################## +## +## Change from the generic user role. +## +## +##

+## Change from the generic user role to +## the specified role. +##

+##

+## This is a template to support third party modules +## and its use is not allowed in upstream reference +## policy. +##

+## +## +## +## The prefix of the user role (e.g., user +## is the prefix for user_r). +## +## +## +# +template(`unprivuser_role_change_to_template',` + userdom_role_change_template(user, $1) +') + +######################################## +## +## Create generic user home directories +## with automatic file type transition. +## +## +## +## Domain allowed access. +## +## +# +interface(`unprivuser_home_filetrans_home_dir',` + gen_require(` + type user_home_dir_t; + ') + + files_home_filetrans($1,user_home_dir_t,dir) +') + +######################################## +## +## Search generic user home directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`unprivuser_search_home_dirs',` + gen_require(` + type user_home_dir_t; + ') + + allow $1 user_home_dir_t:dir search_dir_perms; +') + +######################################## +## +## Create objects in generic user home directories +## with automatic file type transition. +## +## +## +## Domain allowed access. +## +## +## +## +## The class of the object to be created. +## If not specified, file is used. +## +## +# +interface(`unprivuser_home_dir_filetrans_home_content',` + gen_require(` + type user_home_dir_t, user_home_t; + ') + + files_search_home($1) + filetrans_pattern($1,user_home_dir_t,user_home_t,$2) +') + +######################################## +## +## Don't audit search on the user home subdirectory. +## +## +## +## Domain allowed access. +## +## +# +interface(`unprivuser_dontaudit_search_home_dirs',` + gen_require(` + type user_home_t; + ') + + dontaudit $1 user_home_t:dir search_dir_perms; +') + +######################################## +## +## Create, read, write, and delete generic user +## home directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`unprivuser_manage_home_dirs',` + gen_require(` + type user_home_dir_t; + ') + + files_search_home($1) + allow $1 user_home_dir_t:dir manage_dir_perms; +') + +######################################## +## +## Create, read, write, and delete +## subdirectories of generic user +## home directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`unprivuser_manage_home_content_dirs',` + gen_require(` + type user_home_dir_t, user_home_t; + ') + + files_search_home($1) + manage_dirs_pattern($1,{ user_home_dir_t user_home_t },user_home_t) +') + +######################################## +## +## Relabel to generic user home directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`unprivuser_relabelto_home_dirs',` + gen_require(` + type user_home_dir_t; + ') + + files_search_home($1) + allow $1 user_home_dir_t:dir relabelto; +') + +######################################## +## +## Read files in generic user home directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`unprivuser_read_home_content_files',` + gen_require(` + type user_home_t, user_home_dir_t; + ') + + files_search_home($1) + allow $1 user_home_t:dir list_dir_perms; + read_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) +') + +######################################## +## +## Mmap of generic user +## home files. +## +## +## +## Domain allowed access. +## +## +# +interface(`unprivuser_mmap_home_content_files',` + gen_require(` + type user_home_t; + ') + + files_search_home($1) + allow $1 user_home_t:file execute; +') + +######################################## +## +## Create, read, write, and delete files +## in generic user home directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`unprivuser_manage_home_content_files',` + gen_require(` + type user_home_dir_t, user_home_t; + ') + + files_search_home($1) + manage_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) +') + +######################################## +## +## Do not audit attempts to relabel generic user +## home files. +## +## +## +## Domain allowed access. +## +## +# +interface(`unprivuser_dontaudit_relabel_home_content_files',` + gen_require(` + type user_home_t; + ') + + dontaudit $1 user_home_t:file { relabelto relabelfrom }; +') + +######################################## +## +## Create, read, write, and delete symbolic +## links in generic user home directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`unprivuser_manage_home_content_symlinks',` + gen_require(` + type user_home_dir_t, user_home_t; + ') + + files_search_home($1) + manage_lnk_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) +') + +######################################## +## +## Create, read, write, and delete named +## pipes in generic user home directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`unprivuser_manage_home_content_pipes',` + gen_require(` + type user_home_dir_t, user_home_t; + ') + + files_search_home($1) + manage_fifo_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) +') + +######################################## +## +## Create, read, write, and delete named +## sockets in generic user home directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`unprivuser_manage_home_content_sockets',` + gen_require(` + type user_home_dir_t, user_home_t; + ') + + files_search_home($1) + manage_sock_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) +') + diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te new file mode 100644 index 00000000..6a1254b1 --- /dev/null +++ b/policy/modules/roles/unprivuser.te @@ -0,0 +1,15 @@ + +policy_module(unprivuser, 1.0.0) + +# this module should be named user, but that is +# a compile error since user is a keyword. + +######################################## +# +# Declarations +# + +role user_r; + +userdom_unpriv_user_template(user) + diff --git a/policy/modules/services/afs.te b/policy/modules/services/afs.te index f77f14c1..462cb200 100644 --- a/policy/modules/services/afs.te +++ b/policy/modules/services/afs.te @@ -1,5 +1,5 @@ -policy_module(afs,1.2.0) +policy_module(afs,1.2.1) ######################################## # @@ -186,8 +186,7 @@ seutil_read_config(afs_fsserver_t) sysnet_read_config(afs_fsserver_t) -userdom_dontaudit_use_sysadm_ttys(afs_fsserver_t) -userdom_dontaudit_use_sysadm_ptys(afs_fsserver_t) +sysadm_dontaudit_use_terms(afs_fsserver_t) ######################################## # @@ -235,8 +234,7 @@ seutil_read_config(afs_kaserver_t) sysnet_read_config(afs_kaserver_t) -userdom_dontaudit_use_sysadm_ttys(afs_kaserver_t) -userdom_dontaudit_use_sysadm_ptys(afs_kaserver_t) +sysadm_dontaudit_use_terms(afs_kaserver_t) ######################################## # @@ -277,8 +275,7 @@ miscfiles_read_localization(afs_ptserver_t) sysnet_read_config(afs_ptserver_t) -userdom_dontaudit_use_sysadm_ttys(afs_ptserver_t) -userdom_dontaudit_use_sysadm_ptys(afs_ptserver_t) +sysadm_dontaudit_use_terms(afs_ptserver_t) ######################################## # @@ -319,5 +316,4 @@ miscfiles_read_localization(afs_vlserver_t) sysnet_read_config(afs_vlserver_t) -userdom_dontaudit_use_sysadm_ttys(afs_vlserver_t) -userdom_dontaudit_use_sysadm_ptys(afs_vlserver_t) +sysadm_dontaudit_use_terms(afs_vlserver_t) diff --git a/policy/modules/services/amavis.te b/policy/modules/services/amavis.te index b8b475c5..c8f4bbce 100644 --- a/policy/modules/services/amavis.te +++ b/policy/modules/services/amavis.te @@ -1,5 +1,5 @@ -policy_module(amavis,1.6.0) +policy_module(amavis,1.6.1) ######################################## # @@ -143,8 +143,6 @@ miscfiles_read_localization(amavis_t) sysnet_dns_name_resolve(amavis_t) sysnet_use_ldap(amavis_t) -userdom_dontaudit_search_sysadm_home_dirs(amavis_t) - # Cron handling cron_use_fds(amavis_t) cron_use_system_job_fds(amavis_t) @@ -152,6 +150,8 @@ cron_rw_pipes(amavis_t) mta_read_config(amavis_t) +sysadm_dontaudit_search_home_dirs(amavis_t) + optional_policy(` clamav_stream_connect(amavis_t) clamav_domtrans_clamscan(amavis_t) diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te index 74accd12..b263dbb2 100644 --- a/policy/modules/services/apache.te +++ b/policy/modules/services/apache.te @@ -1,5 +1,5 @@ -policy_module(apache,1.9.0) +policy_module(apache,1.9.1) # # NOTES: @@ -419,9 +419,9 @@ tunable_policy(`httpd_tty_comm',` # cjp: this is redundant: term_use_controlling_term(httpd_t) - userdom_use_sysadm_terms(httpd_t) + sysadm_use_terms(httpd_t) ',` - userdom_dontaudit_use_sysadm_terms(httpd_t) + sysadm_dontaudit_use_terms(httpd_t) ') optional_policy(` @@ -515,10 +515,7 @@ libs_use_shared_libs(httpd_helper_t) logging_send_syslog_msg(httpd_helper_t) tunable_policy(`httpd_tty_comm',` - # cjp: this is redundant: - term_use_controlling_term(httpd_helper_t) - - userdom_use_sysadm_terms(httpd_helper_t) + sysadm_use_terms(httpd_helper_t) ') ######################################## diff --git a/policy/modules/services/apm.te b/policy/modules/services/apm.te index 44a1a00d..3aaf5bd7 100644 --- a/policy/modules/services/apm.te +++ b/policy/modules/services/apm.te @@ -1,5 +1,5 @@ -policy_module(apm,1.6.0) +policy_module(apm,1.6.1) ######################################## # @@ -139,9 +139,10 @@ modutils_read_module_config(apmd_t) seutil_dontaudit_read_config(apmd_t) userdom_dontaudit_use_unpriv_user_fds(apmd_t) -userdom_dontaudit_search_sysadm_home_dirs(apmd_t) userdom_dontaudit_search_all_users_home_content(apmd_t) # Excessive? +sysadm_dontaudit_search_home_dirs(apmd_t) + ifdef(`distro_redhat',` allow apmd_t apmd_lock_t:file manage_file_perms; files_lock_filetrans(apmd_t,apmd_lock_t,file) diff --git a/policy/modules/services/arpwatch.te b/policy/modules/services/arpwatch.te index 63afd6f7..f09cbdd5 100644 --- a/policy/modules/services/arpwatch.te +++ b/policy/modules/services/arpwatch.te @@ -1,5 +1,5 @@ -policy_module(arpwatch,1.5.0) +policy_module(arpwatch,1.5.1) ######################################## # @@ -81,10 +81,11 @@ logging_send_syslog_msg(arpwatch_t) miscfiles_read_localization(arpwatch_t) userdom_dontaudit_use_unpriv_user_fds(arpwatch_t) -userdom_dontaudit_search_sysadm_home_dirs(arpwatch_t) mta_send_mail(arpwatch_t) +sysadm_dontaudit_search_home_dirs(arpwatch_t) + optional_policy(` seutil_sigchld_newrole(arpwatch_t) ') diff --git a/policy/modules/services/asterisk.te b/policy/modules/services/asterisk.te index b9e5d01f..d1ba5553 100644 --- a/policy/modules/services/asterisk.te +++ b/policy/modules/services/asterisk.te @@ -1,5 +1,5 @@ -policy_module(asterisk,1.4.0) +policy_module(asterisk,1.4.1) ######################################## # @@ -126,7 +126,8 @@ miscfiles_read_localization(asterisk_t) sysnet_read_config(asterisk_t) userdom_dontaudit_use_unpriv_user_fds(asterisk_t) -userdom_dontaudit_search_sysadm_home_dirs(asterisk_t) + +sysadm_dontaudit_search_home_dirs(asterisk_t) optional_policy(` nis_use_ypbind(asterisk_t) diff --git a/policy/modules/services/audioentropy.te b/policy/modules/services/audioentropy.te index 63de93c6..9005dde3 100644 --- a/policy/modules/services/audioentropy.te +++ b/policy/modules/services/audioentropy.te @@ -1,5 +1,5 @@ -policy_module(audio_entropy,1.3.0) +policy_module(audio_entropy,1.3.1) ######################################## # @@ -49,7 +49,8 @@ logging_send_syslog_msg(entropyd_t) miscfiles_read_localization(entropyd_t) userdom_dontaudit_use_unpriv_user_fds(entropyd_t) -userdom_dontaudit_search_sysadm_home_dirs(entropyd_t) + +sysadm_dontaudit_search_home_dirs(entropyd_t) optional_policy(` seutil_sigchld_newrole(entropyd_t) diff --git a/policy/modules/services/automount.te b/policy/modules/services/automount.te index 03aaa9ea..e62ae70b 100644 --- a/policy/modules/services/automount.te +++ b/policy/modules/services/automount.te @@ -1,5 +1,5 @@ -policy_module(automount,1.8.0) +policy_module(automount,1.8.1) ######################################## # @@ -145,7 +145,8 @@ sysnet_use_ldap(automount_t) sysnet_read_config(automount_t) userdom_dontaudit_use_unpriv_user_fds(automount_t) -userdom_dontaudit_search_sysadm_home_dirs(automount_t) + +sysadm_dontaudit_search_home_dirs(automount_t) optional_policy(` bind_search_cache(automount_t) diff --git a/policy/modules/services/avahi.te b/policy/modules/services/avahi.te index 726d403f..01404f6d 100644 --- a/policy/modules/services/avahi.te +++ b/policy/modules/services/avahi.te @@ -1,5 +1,5 @@ -policy_module(avahi,1.8.0) +policy_module(avahi,1.8.1) ######################################## # @@ -78,7 +78,8 @@ logging_send_syslog_msg(avahi_t) miscfiles_read_localization(avahi_t) userdom_dontaudit_use_unpriv_user_fds(avahi_t) -userdom_dontaudit_search_sysadm_home_dirs(avahi_t) + +sysadm_dontaudit_search_home_dirs(avahi_t) optional_policy(` dbus_system_bus_client_template(avahi,avahi_t) diff --git a/policy/modules/services/bind.te b/policy/modules/services/bind.te index f330f16e..d35fe065 100644 --- a/policy/modules/services/bind.te +++ b/policy/modules/services/bind.te @@ -1,5 +1,5 @@ -policy_module(bind,1.6.0) +policy_module(bind,1.6.1) ######################################## # @@ -147,7 +147,8 @@ miscfiles_read_certs(named_t) sysnet_read_config(named_t) userdom_dontaudit_use_unpriv_user_fds(named_t) -userdom_dontaudit_search_sysadm_home_dirs(named_t) + +sysadm_dontaudit_search_home_dirs(named_t) tunable_policy(`named_write_master_zones',` manage_dirs_pattern(named_t,named_zone_t,named_zone_t) diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te index c80a6ff9..f4db88cc 100644 --- a/policy/modules/services/bluetooth.te +++ b/policy/modules/services/bluetooth.te @@ -1,5 +1,5 @@ -policy_module(bluetooth,2.1.0) +policy_module(bluetooth,2.1.1) ######################################## # @@ -121,8 +121,9 @@ miscfiles_read_fonts(bluetooth_t) sysnet_read_config(bluetooth_t) userdom_dontaudit_use_unpriv_user_fds(bluetooth_t) -userdom_dontaudit_use_sysadm_ptys(bluetooth_t) -userdom_dontaudit_search_sysadm_home_dirs(bluetooth_t) + +sysadm_dontaudit_use_ptys(bluetooth_t) +sysadm_dontaudit_search_home_dirs(bluetooth_t) optional_policy(` dbus_system_bus_client_template(bluetooth,bluetooth_t) diff --git a/policy/modules/services/canna.te b/policy/modules/services/canna.te index e94d4d71..ea586b61 100644 --- a/policy/modules/services/canna.te +++ b/policy/modules/services/canna.te @@ -1,5 +1,5 @@ -policy_module(canna,1.6.0) +policy_module(canna,1.6.1) ######################################## # @@ -78,7 +78,8 @@ miscfiles_read_localization(canna_t) sysnet_read_config(canna_t) userdom_dontaudit_use_unpriv_user_fds(canna_t) -userdom_dontaudit_search_sysadm_home_dirs(canna_t) + +sysadm_dontaudit_search_home_dirs(canna_t) optional_policy(` nis_use_ypbind(canna_t) diff --git a/policy/modules/services/comsat.te b/policy/modules/services/comsat.te index 6f9defd3..d8ae2466 100644 --- a/policy/modules/services/comsat.te +++ b/policy/modules/services/comsat.te @@ -1,5 +1,5 @@ -policy_module(comsat,1.4.0) +policy_module(comsat,1.4.1) ######################################## # @@ -69,10 +69,10 @@ logging_send_syslog_msg(comsat_t) miscfiles_read_localization(comsat_t) -userdom_dontaudit_getattr_sysadm_ttys(comsat_t) - mta_getattr_spool(comsat_t) +sysadm_dontaudit_getattr_ttys(comsat_t) + optional_policy(` kerberos_use(comsat_t) ') diff --git a/policy/modules/services/courier.te b/policy/modules/services/courier.te index e9205ab0..9c1006d6 100644 --- a/policy/modules/services/courier.te +++ b/policy/modules/services/courier.te @@ -1,5 +1,5 @@ -policy_module(courier,1.4.0) +policy_module(courier,1.4.1) ######################################## # @@ -65,10 +65,11 @@ miscfiles_read_localization(courier_authdaemon_t) # should not be needed! userdom_search_unpriv_users_home_dirs(courier_authdaemon_t) -userdom_dontaudit_search_sysadm_home_dirs(courier_authdaemon_t) courier_domtrans_pop(courier_authdaemon_t) +sysadm_dontaudit_search_home_dirs(courier_authdaemon_t) + ######################################## # # Calendar (PCP) local policy diff --git a/policy/modules/services/cups.te b/policy/modules/services/cups.te index 2c648c27..5a002308 100644 --- a/policy/modules/services/cups.te +++ b/policy/modules/services/cups.te @@ -1,5 +1,5 @@ -policy_module(cups,1.9.0) +policy_module(cups,1.9.1) ######################################## # @@ -357,11 +357,12 @@ miscfiles_read_localization(cupsd_config_t) seutil_dontaudit_search_config(cupsd_config_t) userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t) -userdom_dontaudit_search_sysadm_home_dirs(cupsd_config_t) + +cups_stream_connect(cupsd_config_t) lpd_read_config(cupsd_config_t) -cups_stream_connect(cupsd_config_t) +sysadm_dontaudit_search_home_dirs(cupsd_config_t) ifdef(`distro_redhat',` init_getattr_script_files(cupsd_config_t) @@ -561,11 +562,12 @@ miscfiles_read_localization(hplip_t) sysnet_read_config(hplip_t) userdom_dontaudit_use_unpriv_user_fds(hplip_t) -userdom_dontaudit_search_sysadm_home_dirs(hplip_t) userdom_dontaudit_search_all_users_home_content(hplip_t) lpd_read_config(cupsd_t) +sysadm_dontaudit_search_home_dirs(hplip_t) + optional_policy(` seutil_sigchld_newrole(hplip_t) ') diff --git a/policy/modules/services/cyrus.te b/policy/modules/services/cyrus.te index c3c926cf..04609253 100644 --- a/policy/modules/services/cyrus.te +++ b/policy/modules/services/cyrus.te @@ -1,5 +1,5 @@ -policy_module(cyrus,1.5.0) +policy_module(cyrus,1.5.1) ######################################## # @@ -108,12 +108,13 @@ miscfiles_read_certs(cyrus_t) sysnet_read_config(cyrus_t) userdom_dontaudit_use_unpriv_user_fds(cyrus_t) -userdom_dontaudit_search_sysadm_home_dirs(cyrus_t) userdom_use_unpriv_users_fds(cyrus_t) mta_manage_spool(cyrus_t) mta_send_mail(cyrus_t) +sysadm_dontaudit_search_home_dirs(cyrus_t) + optional_policy(` cron_system_entry(cyrus_t,cyrus_exec_t) ') diff --git a/policy/modules/services/dante.te b/policy/modules/services/dante.te index ebf3ecf1..fd1fbfef 100644 --- a/policy/modules/services/dante.te +++ b/policy/modules/services/dante.te @@ -1,5 +1,5 @@ -policy_module(dante,1.4.0) +policy_module(dante,1.4.1) ######################################## # @@ -72,7 +72,8 @@ miscfiles_read_localization(dante_t) sysnet_read_config(dante_t) userdom_dontaudit_use_unpriv_user_fds(dante_t) -userdom_dontaudit_search_sysadm_home_dirs(dante_t) + +sysadm_dontaudit_search_home_dirs(dante_t) optional_policy(` seutil_sigchld_newrole(dante_t) diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te index 1e2b2bff..3d7eb761 100644 --- a/policy/modules/services/dbus.te +++ b/policy/modules/services/dbus.te @@ -1,5 +1,5 @@ -policy_module(dbus,1.8.0) +policy_module(dbus,1.8.1) gen_require(` class dbus all_dbus_perms; @@ -106,7 +106,8 @@ seutil_read_default_contexts(system_dbusd_t) seutil_sigchld_newrole(system_dbusd_t) userdom_dontaudit_use_unpriv_user_fds(system_dbusd_t) -userdom_dontaudit_search_sysadm_home_dirs(system_dbusd_t) + +sysadm_dontaudit_search_home_dirs(system_dbusd_t) tunable_policy(`read_default_t',` files_list_default(system_dbusd_t) diff --git a/policy/modules/services/dcc.te b/policy/modules/services/dcc.te index f019c256..e92766af 100644 --- a/policy/modules/services/dcc.te +++ b/policy/modules/services/dcc.te @@ -1,5 +1,5 @@ -policy_module(dcc,1.5.0) +policy_module(dcc,1.5.1) ######################################## # @@ -273,7 +273,8 @@ sysnet_read_config(dccd_t) sysnet_dns_name_resolve(dccd_t) userdom_dontaudit_use_unpriv_user_fds(dccd_t) -userdom_dontaudit_search_sysadm_home_dirs(dccd_t) + +sysadm_dontaudit_search_home_dirs(dccd_t) optional_policy(` nscd_socket_use(dccd_t) @@ -346,7 +347,8 @@ sysnet_read_config(dccifd_t) sysnet_dns_name_resolve(dccifd_t) userdom_dontaudit_use_unpriv_user_fds(dccifd_t) -userdom_dontaudit_search_sysadm_home_dirs(dccifd_t) + +sysadm_dontaudit_search_home_dirs(dccifd_t) optional_policy(` nscd_socket_use(dccifd_t) @@ -418,7 +420,8 @@ sysnet_read_config(dccm_t) sysnet_dns_name_resolve(dccm_t) userdom_dontaudit_use_unpriv_user_fds(dccm_t) -userdom_dontaudit_search_sysadm_home_dirs(dccm_t) + +sysadm_dontaudit_search_home_dirs(dccm_t) optional_policy(` nscd_socket_use(dccm_t) diff --git a/policy/modules/services/ddclient.te b/policy/modules/services/ddclient.te index f94e1343..aef76b65 100644 --- a/policy/modules/services/ddclient.te +++ b/policy/modules/services/ddclient.te @@ -1,5 +1,5 @@ -policy_module(ddclient,1.4.0) +policy_module(ddclient,1.4.1) ######################################## # @@ -98,7 +98,8 @@ sysnet_exec_ifconfig(ddclient_t) sysnet_read_config(ddclient_t) userdom_dontaudit_use_unpriv_user_fds(ddclient_t) -userdom_dontaudit_search_sysadm_home_dirs(ddclient_t) + +sysadm_dontaudit_search_home_dirs(ddclient_t) optional_policy(` seutil_sigchld_newrole(ddclient_t) diff --git a/policy/modules/services/dhcp.te b/policy/modules/services/dhcp.te index 901635ab..bfbcaed4 100644 --- a/policy/modules/services/dhcp.te +++ b/policy/modules/services/dhcp.te @@ -1,5 +1,5 @@ -policy_module(dhcp,1.5.0) +policy_module(dhcp,1.5.1) ######################################## # @@ -99,7 +99,8 @@ sysnet_read_config(dhcpd_t) sysnet_read_dhcp_config(dhcpd_t) userdom_dontaudit_use_unpriv_user_fds(dhcpd_t) -userdom_dontaudit_search_sysadm_home_dirs(dhcpd_t) + +sysadm_dontaudit_search_home_dirs(dhcpd_t) ifdef(`distro_gentoo',` allow dhcpd_t self:capability { chown dac_override setgid setuid sys_chroot }; diff --git a/policy/modules/services/distcc.te b/policy/modules/services/distcc.te index 3bfd4aa4..660b169b 100644 --- a/policy/modules/services/distcc.te +++ b/policy/modules/services/distcc.te @@ -1,5 +1,5 @@ -policy_module(distcc,1.5.0) +policy_module(distcc,1.5.1) ######################################## # @@ -81,7 +81,8 @@ miscfiles_read_localization(distccd_t) sysnet_read_config(distccd_t) userdom_dontaudit_use_unpriv_user_fds(distccd_t) -userdom_dontaudit_search_sysadm_home_dirs(distccd_t) + +sysadm_dontaudit_search_home_dirs(distccd_t) optional_policy(` nis_use_ypbind(distccd_t) diff --git a/policy/modules/services/dnsmasq.te b/policy/modules/services/dnsmasq.te index 49990989..bf6c334c 100644 --- a/policy/modules/services/dnsmasq.te +++ b/policy/modules/services/dnsmasq.te @@ -1,5 +1,5 @@ -policy_module(dnsmasq,1.5.0) +policy_module(dnsmasq,1.5.1) ######################################## # @@ -81,7 +81,8 @@ miscfiles_read_localization(dnsmasq_t) sysnet_read_config(dnsmasq_t) userdom_dontaudit_use_unpriv_user_fds(dnsmasq_t) -userdom_dontaudit_search_sysadm_home_dirs(dnsmasq_t) + +sysadm_dontaudit_search_home_dirs(dnsmasq_t) optional_policy(` nis_use_ypbind(dnsmasq_t) diff --git a/policy/modules/services/dovecot.te b/policy/modules/services/dovecot.te index 34deb41c..9471e996 100644 --- a/policy/modules/services/dovecot.te +++ b/policy/modules/services/dovecot.te @@ -1,5 +1,5 @@ -policy_module(dovecot,1.8.0) +policy_module(dovecot,1.8.1) ######################################## # @@ -113,11 +113,12 @@ miscfiles_read_certs(dovecot_t) miscfiles_read_localization(dovecot_t) userdom_dontaudit_use_unpriv_user_fds(dovecot_t) -userdom_dontaudit_search_sysadm_home_dirs(dovecot_t) userdom_priveleged_home_dir_manager(dovecot_t) mta_manage_spool(dovecot_t) +sysadm_dontaudit_search_home_dirs(dovecot_t) + optional_policy(` kerberos_use(dovecot_t) ') diff --git a/policy/modules/services/exim.te b/policy/modules/services/exim.te index b43336e2..9e97e84d 100644 --- a/policy/modules/services/exim.te +++ b/policy/modules/services/exim.te @@ -1,5 +1,5 @@ -policy_module(exim,1.1.0) +policy_module(exim,1.1.1) ######################################## # @@ -102,12 +102,13 @@ miscfiles_read_localization(exim_t) sysnet_dns_name_resolve(exim_t) -userdom_dontaudit_search_sysadm_home_dirs(exim_t) -userdom_dontaudit_search_generic_user_home_dirs(exim_t) +unprivuser_dontaudit_search_home_dirs(exim_t) mta_read_aliases(exim_t) mta_rw_spool(exim_t) +sysadm_dontaudit_search_home_dirs(exim_t) + tunable_policy(`exim_read_user_files',` userdom_read_unpriv_users_home_content_files(exim_t) userdom_read_unpriv_users_tmp_files(exim_t) diff --git a/policy/modules/services/fetchmail.te b/policy/modules/services/fetchmail.te index 0f58ecd4..4106bbbd 100644 --- a/policy/modules/services/fetchmail.te +++ b/policy/modules/services/fetchmail.te @@ -1,5 +1,5 @@ -policy_module(fetchmail,1.5.1) +policy_module(fetchmail,1.5.2) ######################################## # @@ -83,7 +83,8 @@ miscfiles_read_certs(fetchmail_t) sysnet_read_config(fetchmail_t) userdom_dontaudit_use_unpriv_user_fds(fetchmail_t) -userdom_dontaudit_search_sysadm_home_dirs(fetchmail_t) + +sysadm_dontaudit_search_home_dirs(fetchmail_t) optional_policy(` procmail_domtrans(fetchmail_t) diff --git a/policy/modules/services/finger.te b/policy/modules/services/finger.te index 7bea8afa..b69b8aa4 100644 --- a/policy/modules/services/finger.te +++ b/policy/modules/services/finger.te @@ -1,5 +1,5 @@ -policy_module(finger,1.6.0) +policy_module(finger,1.6.1) ######################################## # @@ -91,12 +91,12 @@ sysnet_read_config(fingerd_t) miscfiles_read_localization(fingerd_t) -userdom_read_unpriv_users_home_content_files(fingerd_t) -userdom_dontaudit_use_unpriv_user_fds(fingerd_t) -userdom_dontaudit_search_sysadm_home_dirs(fingerd_t) # stop it accessing sub-directories, prevents checking a Maildir for new mail, # have to change this when we create a type for Maildir -userdom_dontaudit_search_generic_user_home_dirs(fingerd_t) +userdom_read_unpriv_users_home_content_files(fingerd_t) +userdom_dontaudit_use_unpriv_user_fds(fingerd_t) + +sysadm_dontaudit_search_home_dirs(fingerd_t) optional_policy(` cron_system_entry(fingerd_t, fingerd_exec_t) diff --git a/policy/modules/services/ftp.te b/policy/modules/services/ftp.te index 02c5ea55..26d43ef3 100644 --- a/policy/modules/services/ftp.te +++ b/policy/modules/services/ftp.te @@ -1,5 +1,5 @@ -policy_module(ftp,1.7.0) +policy_module(ftp,1.7.1) ######################################## # @@ -179,9 +179,10 @@ seutil_dontaudit_search_config(ftpd_t) sysnet_read_config(ftpd_t) sysnet_use_ldap(ftpd_t) -userdom_dontaudit_search_sysadm_home_dirs(ftpd_t) userdom_dontaudit_use_unpriv_user_fds(ftpd_t) +sysadm_dontaudit_search_home_dirs(ftpd_t) + tunable_policy(`allow_ftpd_anon_write',` miscfiles_manage_public_files(ftpd_t) ') diff --git a/policy/modules/services/gatekeeper.te b/policy/modules/services/gatekeeper.te index 118dfa5a..a7ce0dbe 100644 --- a/policy/modules/services/gatekeeper.te +++ b/policy/modules/services/gatekeeper.te @@ -1,5 +1,5 @@ -policy_module(gatekeeper,1.4.0) +policy_module(gatekeeper,1.4.1) ######################################## # @@ -88,7 +88,8 @@ miscfiles_read_localization(gatekeeper_t) sysnet_read_config(gatekeeper_t) userdom_dontaudit_use_unpriv_user_fds(gatekeeper_t) -userdom_dontaudit_search_sysadm_home_dirs(gatekeeper_t) + +sysadm_dontaudit_search_home_dirs(gatekeeper_t) optional_policy(` nis_use_ypbind(gatekeeper_t) diff --git a/policy/modules/services/gpm.te b/policy/modules/services/gpm.te index 185d96f1..ad755586 100644 --- a/policy/modules/services/gpm.te +++ b/policy/modules/services/gpm.te @@ -1,5 +1,5 @@ -policy_module(gpm,1.4.0) +policy_module(gpm,1.4.1) ######################################## # @@ -69,7 +69,8 @@ logging_send_syslog_msg(gpm_t) miscfiles_read_localization(gpm_t) userdom_dontaudit_use_unpriv_user_fds(gpm_t) -userdom_dontaudit_search_sysadm_home_dirs(gpm_t) + +sysadm_dontaudit_search_home_dirs(gpm_t) optional_policy(` seutil_sigchld_newrole(gpm_t) diff --git a/policy/modules/services/hal.te b/policy/modules/services/hal.te index 6170da58..bb0da44e 100644 --- a/policy/modules/services/hal.te +++ b/policy/modules/services/hal.te @@ -1,5 +1,5 @@ -policy_module(hal,1.9.1) +policy_module(hal,1.9.2) ######################################## # @@ -193,7 +193,8 @@ seutil_read_file_contexts(hald_t) sysnet_read_config(hald_t) userdom_dontaudit_use_unpriv_user_fds(hald_t) -userdom_dontaudit_search_sysadm_home_dirs(hald_t) + +sysadm_dontaudit_search_home_dirs(hald_t) optional_policy(` alsa_domtrans(hald_t) diff --git a/policy/modules/services/howl.te b/policy/modules/services/howl.te index 9b7d99ec..3466646c 100644 --- a/policy/modules/services/howl.te +++ b/policy/modules/services/howl.te @@ -1,5 +1,5 @@ -policy_module(howl,1.5.0) +policy_module(howl,1.5.1) ######################################## # @@ -69,7 +69,8 @@ miscfiles_read_localization(howl_t) sysnet_read_config(howl_t) userdom_dontaudit_use_unpriv_user_fds(howl_t) -userdom_dontaudit_search_sysadm_home_dirs(howl_t) + +sysadm_dontaudit_search_home_dirs(howl_t) optional_policy(` nis_use_ypbind(howl_t) diff --git a/policy/modules/services/i18n_input.te b/policy/modules/services/i18n_input.te index 08d28b8c..50774e6e 100644 --- a/policy/modules/services/i18n_input.te +++ b/policy/modules/services/i18n_input.te @@ -1,5 +1,5 @@ -policy_module(i18n_input,1.5.0) +policy_module(i18n_input,1.5.1) ######################################## # @@ -77,9 +77,10 @@ miscfiles_read_localization(i18n_input_t) sysnet_read_config(i18n_input_t) userdom_dontaudit_use_unpriv_user_fds(i18n_input_t) -userdom_dontaudit_search_sysadm_home_dirs(i18n_input_t) userdom_read_unpriv_users_home_content_files(i18n_input_t) +sysadm_dontaudit_search_home_dirs(i18n_input_t) + tunable_policy(`use_nfs_home_dirs',` fs_read_nfs_files(i18n_input_t) fs_read_nfs_symlinks(i18n_input_t) diff --git a/policy/modules/services/imaze.te b/policy/modules/services/imaze.te index ff3be766..c481d8b0 100644 --- a/policy/modules/services/imaze.te +++ b/policy/modules/services/imaze.te @@ -1,5 +1,5 @@ -policy_module(imaze,1.4.0) +policy_module(imaze,1.4.1) ######################################## # @@ -88,7 +88,8 @@ miscfiles_read_localization(imazesrv_t) sysnet_read_config(imazesrv_t) userdom_use_unpriv_users_fds(imazesrv_t) -userdom_dontaudit_search_sysadm_home_dirs(imazesrv_t) + +sysadm_dontaudit_search_home_dirs(imazesrv_t) optional_policy(` nis_use_ypbind(imazesrv_t) diff --git a/policy/modules/services/inetd.te b/policy/modules/services/inetd.te index 90663bd4..9e30dbaa 100644 --- a/policy/modules/services/inetd.te +++ b/policy/modules/services/inetd.te @@ -1,5 +1,5 @@ -policy_module(inetd,1.6.0) +policy_module(inetd,1.6.1) ######################################## # @@ -145,7 +145,8 @@ mls_process_set_level(inetd_t) sysnet_read_config(inetd_t) userdom_dontaudit_use_unpriv_user_fds(inetd_t) -userdom_dontaudit_search_sysadm_home_dirs(inetd_t) + +sysadm_dontaudit_search_home_dirs(inetd_t) ifdef(`enable_mls',` corenet_tcp_recvfrom_netlabel(inetd_t) diff --git a/policy/modules/services/inn.te b/policy/modules/services/inn.te index bbe2b975..6c6db78c 100644 --- a/policy/modules/services/inn.te +++ b/policy/modules/services/inn.te @@ -1,5 +1,5 @@ -policy_module(inn,1.5.0) +policy_module(inn,1.5.1) ######################################## # @@ -105,7 +105,8 @@ seutil_dontaudit_search_config(innd_t) sysnet_read_config(innd_t) userdom_dontaudit_use_unpriv_user_fds(innd_t) -userdom_dontaudit_search_sysadm_home_dirs(innd_t) + +sysadm_dontaudit_search_home_dirs(innd_t) mta_send_mail(innd_t) diff --git a/policy/modules/services/ircd.te b/policy/modules/services/ircd.te index 27dab6b6..2bd2d523 100644 --- a/policy/modules/services/ircd.te +++ b/policy/modules/services/ircd.te @@ -1,5 +1,5 @@ -policy_module(ircd,1.4.0) +policy_module(ircd,1.4.1) ######################################## # @@ -82,7 +82,8 @@ miscfiles_read_localization(ircd_t) sysnet_read_config(ircd_t) userdom_dontaudit_use_unpriv_user_fds(ircd_t) -userdom_dontaudit_search_sysadm_home_dirs(ircd_t) + +sysadm_dontaudit_search_home_dirs(ircd_t) optional_policy(` nis_use_ypbind(ircd_t) diff --git a/policy/modules/services/irqbalance.te b/policy/modules/services/irqbalance.te index 4913ef7f..ef5e9616 100644 --- a/policy/modules/services/irqbalance.te +++ b/policy/modules/services/irqbalance.te @@ -1,5 +1,5 @@ -policy_module(irqbalance,1.2.0) +policy_module(irqbalance,1.2.1) ######################################## # @@ -50,7 +50,8 @@ logging_send_syslog_msg(irqbalance_t) miscfiles_read_localization(irqbalance_t) userdom_dontaudit_use_unpriv_user_fds(irqbalance_t) -userdom_dontaudit_search_sysadm_home_dirs(irqbalance_t) + +sysadm_dontaudit_search_home_dirs(irqbalance_t) optional_policy(` seutil_sigchld_newrole(irqbalance_t) diff --git a/policy/modules/services/jabber.te b/policy/modules/services/jabber.te index cd02124b..a232bec7 100644 --- a/policy/modules/services/jabber.te +++ b/policy/modules/services/jabber.te @@ -1,5 +1,5 @@ -policy_module(jabber,1.4.0) +policy_module(jabber,1.4.1) ######################################## # @@ -80,7 +80,8 @@ miscfiles_read_localization(jabberd_t) sysnet_read_config(jabberd_t) userdom_dontaudit_use_unpriv_user_fds(jabberd_t) -userdom_dontaudit_search_sysadm_home_dirs(jabberd_t) + +sysadm_dontaudit_search_home_dirs(jabberd_t) optional_policy(` nis_use_ypbind(jabberd_t) diff --git a/policy/modules/services/kerberos.te b/policy/modules/services/kerberos.te index efdc3349..d1588867 100644 --- a/policy/modules/services/kerberos.te +++ b/policy/modules/services/kerberos.te @@ -1,5 +1,5 @@ -policy_module(kerberos,1.6.0) +policy_module(kerberos,1.6.1) ######################################## # @@ -129,7 +129,8 @@ miscfiles_read_localization(kadmind_t) sysnet_read_config(kadmind_t) userdom_dontaudit_use_unpriv_user_fds(kadmind_t) -userdom_dontaudit_search_sysadm_home_dirs(kadmind_t) + +sysadm_dontaudit_search_home_dirs(kadmind_t) optional_policy(` nis_use_ypbind(kadmind_t) @@ -225,7 +226,8 @@ miscfiles_read_localization(krb5kdc_t) sysnet_read_config(krb5kdc_t) userdom_dontaudit_use_unpriv_user_fds(krb5kdc_t) -userdom_dontaudit_search_sysadm_home_dirs(krb5kdc_t) + +sysadm_dontaudit_search_home_dirs(krb5kdc_t) optional_policy(` nis_use_ypbind(krb5kdc_t) diff --git a/policy/modules/services/ldap.te b/policy/modules/services/ldap.te index e90f4f93..560717c4 100644 --- a/policy/modules/services/ldap.te +++ b/policy/modules/services/ldap.te @@ -1,5 +1,5 @@ -policy_module(ldap,1.6.0) +policy_module(ldap,1.6.1) ######################################## # @@ -114,7 +114,8 @@ miscfiles_read_certs(slapd_t) miscfiles_read_localization(slapd_t) userdom_dontaudit_use_unpriv_user_fds(slapd_t) -userdom_dontaudit_search_sysadm_home_dirs(slapd_t) + +sysadm_dontaudit_search_home_dirs(slapd_t) optional_policy(` kerberos_use(slapd_t) diff --git a/policy/modules/services/lpd.te b/policy/modules/services/lpd.te index 03e8d29f..eb9f3642 100644 --- a/policy/modules/services/lpd.te +++ b/policy/modules/services/lpd.te @@ -1,5 +1,5 @@ -policy_module(lpd,1.9.0) +policy_module(lpd,1.9.1) ######################################## # @@ -200,7 +200,8 @@ miscfiles_read_localization(lpd_t) sysnet_read_config(lpd_t) userdom_dontaudit_use_unpriv_user_fds(lpd_t) -userdom_dontaudit_search_sysadm_home_dirs(lpd_t) + +sysadm_dontaudit_search_home_dirs(lpd_t) optional_policy(` nis_use_ypbind(lpd_t) diff --git a/policy/modules/services/mailman.te b/policy/modules/services/mailman.te index 30c65b0d..874805aa 100644 --- a/policy/modules/services/mailman.te +++ b/policy/modules/services/mailman.te @@ -1,5 +1,5 @@ -policy_module(mailman,1.4.0) +policy_module(mailman,1.4.1) ######################################## # @@ -99,12 +99,11 @@ files_dontaudit_search_pids(mailman_queue_t) # for su seutil_dontaudit_search_config(mailman_queue_t) +su_exec(mailman_queue_t) + # some of the following could probably be changed to dontaudit, someone who # knows mailman well should test this out and send the changes -userdom_search_sysadm_home_dirs(mailman_queue_t) -userdom_getattr_sysadm_home_dirs(mailman_queue_t) - -su_exec(mailman_queue_t) +sysadm_search_home_dirs(mailman_queue_t) optional_policy(` cron_system_entry(mailman_queue_t,mailman_queue_exec_t) diff --git a/policy/modules/services/monop.te b/policy/modules/services/monop.te index a1bed0f8..99fce617 100644 --- a/policy/modules/services/monop.te +++ b/policy/modules/services/monop.te @@ -1,5 +1,5 @@ -policy_module(monop,1.4.0) +policy_module(monop,1.4.1) ######################################## # @@ -74,7 +74,8 @@ miscfiles_read_localization(monopd_t) sysnet_read_config(monopd_t) userdom_dontaudit_use_unpriv_user_fds(monopd_t) -userdom_dontaudit_search_sysadm_home_dirs(monopd_t) + +sysadm_dontaudit_search_home_dirs(monopd_t) optional_policy(` nis_use_ypbind(monopd_t) diff --git a/policy/modules/services/mta.te b/policy/modules/services/mta.te index d313f4c0..bd4c6cdf 100644 --- a/policy/modules/services/mta.te +++ b/policy/modules/services/mta.te @@ -1,5 +1,5 @@ -policy_module(mta,1.9.0) +policy_module(mta,1.9.1) ######################################## # @@ -49,8 +49,8 @@ dev_read_urand(system_mail_t) init_use_script_ptys(system_mail_t) -userdom_use_sysadm_terms(system_mail_t) -userdom_dontaudit_search_sysadm_home_dirs(system_mail_t) +sysadm_use_terms(system_mail_t) +sysadm_dontaudit_search_home_dirs(system_mail_t) optional_policy(` apache_read_squirrelmail_data(system_mail_t) diff --git a/policy/modules/services/munin.te b/policy/modules/services/munin.te index 023d05db..e8bd9f27 100644 --- a/policy/modules/services/munin.te +++ b/policy/modules/services/munin.te @@ -1,5 +1,5 @@ -policy_module(munin,1.4.0) +policy_module(munin,1.4.1) ######################################## # @@ -96,7 +96,8 @@ miscfiles_read_localization(munin_t) sysnet_read_config(munin_t) userdom_dontaudit_use_unpriv_user_fds(munin_t) -userdom_dontaudit_search_sysadm_home_dirs(munin_t) + +sysadm_dontaudit_search_home_dirs(munin_t) optional_policy(` # for accessing the output directory diff --git a/policy/modules/services/mysql.te b/policy/modules/services/mysql.te index c1207feb..3cc3de14 100644 --- a/policy/modules/services/mysql.te +++ b/policy/modules/services/mysql.te @@ -1,5 +1,5 @@ -policy_module(mysql,1.7.0) +policy_module(mysql,1.7.1) ######################################## # @@ -100,8 +100,9 @@ miscfiles_read_localization(mysqld_t) sysnet_read_config(mysqld_t) userdom_dontaudit_use_unpriv_user_fds(mysqld_t) + # for /root/.my.cnf - should not be needed: -userdom_read_sysadm_home_content_files(mysqld_t) +sysadm_read_home_content_files(mysqld_t) ifdef(`distro_redhat',` # because Fedora has the sock_file in the database directory diff --git a/policy/modules/services/nagios.te b/policy/modules/services/nagios.te index fa8e8d99..2846858d 100644 --- a/policy/modules/services/nagios.te +++ b/policy/modules/services/nagios.te @@ -1,5 +1,5 @@ -policy_module(nagios,1.5.0) +policy_module(nagios,1.5.1) ######################################## # @@ -103,10 +103,11 @@ logging_send_syslog_msg(nagios_t) miscfiles_read_localization(nagios_t) userdom_dontaudit_use_unpriv_user_fds(nagios_t) -userdom_dontaudit_search_sysadm_home_dirs(nagios_t) mta_send_mail(nagios_t) +sysadm_dontaudit_search_home_dirs(nagios_t) + optional_policy(` netutils_domtrans_ping(nagios_t) netutils_signal_ping(nagios_t) diff --git a/policy/modules/services/nessus.te b/policy/modules/services/nessus.te index 160489d6..727ddce5 100644 --- a/policy/modules/services/nessus.te +++ b/policy/modules/services/nessus.te @@ -1,5 +1,5 @@ -policy_module(nessus,1.4.0) +policy_module(nessus,1.4.1) ######################################## # @@ -94,7 +94,8 @@ miscfiles_read_localization(nessusd_t) sysnet_read_config(nessusd_t) userdom_dontaudit_use_unpriv_user_fds(nessusd_t) -userdom_dontaudit_search_sysadm_home_dirs(nessusd_t) + +sysadm_dontaudit_search_home_dirs(nessusd_t) optional_policy(` nis_use_ypbind(nessusd_t) diff --git a/policy/modules/services/networkmanager.te b/policy/modules/services/networkmanager.te index fa17c58b..36188ccf 100644 --- a/policy/modules/services/networkmanager.te +++ b/policy/modules/services/networkmanager.te @@ -1,5 +1,5 @@ -policy_module(networkmanager,1.9.0) +policy_module(networkmanager,1.9.1) ######################################## # @@ -109,11 +109,12 @@ sysnet_manage_config(NetworkManager_t) sysnet_etc_filetrans_config(NetworkManager_t) userdom_dontaudit_use_unpriv_user_fds(NetworkManager_t) -userdom_dontaudit_search_sysadm_home_dirs(NetworkManager_t) userdom_dontaudit_use_unpriv_users_ttys(NetworkManager_t) # Read gnome-keyring userdom_read_unpriv_users_home_content_files(NetworkManager_t) +sysadm_dontaudit_search_home_dirs(NetworkManager_t) + optional_policy(` bind_domtrans(NetworkManager_t) bind_manage_cache(NetworkManager_t) diff --git a/policy/modules/services/nis.te b/policy/modules/services/nis.te index ed2d6016..e8a7cac6 100644 --- a/policy/modules/services/nis.te +++ b/policy/modules/services/nis.te @@ -1,5 +1,5 @@ -policy_module(nis,1.6.0) +policy_module(nis,1.6.1) ######################################## # @@ -111,7 +111,8 @@ miscfiles_read_localization(ypbind_t) sysnet_read_config(ypbind_t) userdom_dontaudit_use_unpriv_user_fds(ypbind_t) -userdom_dontaudit_search_sysadm_home_dirs(ypbind_t) + +sysadm_dontaudit_search_home_dirs(ypbind_t) optional_policy(` seutil_sigchld_newrole(ypbind_t) @@ -192,7 +193,8 @@ miscfiles_read_localization(yppasswdd_t) sysnet_read_config(yppasswdd_t) userdom_dontaudit_use_unpriv_user_fds(yppasswdd_t) -userdom_dontaudit_search_sysadm_home_dirs(yppasswdd_t) + +sysadm_dontaudit_search_home_dirs(yppasswdd_t) optional_policy(` hostname_exec(yppasswdd_t) @@ -275,7 +277,8 @@ nis_domtrans_ypxfr(ypserv_t) sysnet_read_config(ypserv_t) userdom_dontaudit_use_unpriv_user_fds(ypserv_t) -userdom_dontaudit_search_sysadm_home_dirs(ypserv_t) + +sysadm_dontaudit_search_home_dirs(ypserv_t) optional_policy(` seutil_sigchld_newrole(ypserv_t) diff --git a/policy/modules/services/nscd.te b/policy/modules/services/nscd.te index 89baef04..c727db11 100644 --- a/policy/modules/services/nscd.te +++ b/policy/modules/services/nscd.te @@ -1,5 +1,5 @@ -policy_module(nscd,1.6.0) +policy_module(nscd,1.6.1) gen_require(` class nscd all_nscd_perms; @@ -104,7 +104,8 @@ seutil_sigchld_newrole(nscd_t) sysnet_read_config(nscd_t) userdom_dontaudit_use_unpriv_user_fds(nscd_t) -userdom_dontaudit_search_sysadm_home_dirs(nscd_t) + +sysadm_dontaudit_search_home_dirs(nscd_t) optional_policy(` udev_read_db(nscd_t) diff --git a/policy/modules/services/nsd.te b/policy/modules/services/nsd.te index eff9ee6c..675e2e10 100644 --- a/policy/modules/services/nsd.te +++ b/policy/modules/services/nsd.te @@ -1,5 +1,5 @@ -policy_module(nsd,1.4.0) +policy_module(nsd,1.4.1) ######################################## # @@ -96,7 +96,8 @@ miscfiles_read_localization(nsd_t) sysnet_read_config(nsd_t) userdom_dontaudit_use_unpriv_user_fds(nsd_t) -userdom_dontaudit_search_sysadm_home_dirs(nsd_t) + +sysadm_dontaudit_search_home_dirs(nsd_t) optional_policy(` nis_use_ypbind(nsd_t) @@ -172,7 +173,7 @@ miscfiles_read_localization(nsd_crond_t) sysnet_read_config(nsd_crond_t) -userdom_dontaudit_search_sysadm_home_dirs(nsd_crond_t) +sysadm_dontaudit_search_home_dirs(nsd_crond_t) optional_policy(` cron_system_entry(nsd_crond_t,nsd_exec_t) diff --git a/policy/modules/services/ntop.te b/policy/modules/services/ntop.te index 47893f75..dff5d4a0 100644 --- a/policy/modules/services/ntop.te +++ b/policy/modules/services/ntop.te @@ -1,5 +1,5 @@ -policy_module(ntop,1.5.0) +policy_module(ntop,1.5.1) ######################################## # @@ -92,7 +92,8 @@ miscfiles_read_localization(ntop_t) sysnet_read_config(ntop_t) userdom_dontaudit_use_unpriv_user_fds(ntop_t) -userdom_dontaudit_search_sysadm_home_dirs(ntop_t) + +sysadm_dontaudit_search_home_dirs(ntop_t) optional_policy(` seutil_sigchld_newrole(ntop_t) diff --git a/policy/modules/services/ntp.te b/policy/modules/services/ntp.te index 91814a21..86ef2b02 100644 --- a/policy/modules/services/ntp.te +++ b/policy/modules/services/ntp.te @@ -1,5 +1,5 @@ -policy_module(ntp,1.5.0) +policy_module(ntp,1.5.1) ######################################## # @@ -106,8 +106,8 @@ logging_send_syslog_msg(ntpd_t) miscfiles_read_localization(ntpd_t) userdom_dontaudit_use_unpriv_user_fds(ntpd_t) -userdom_list_sysadm_home_dirs(ntpd_t) -userdom_dontaudit_list_sysadm_home_dirs(ntpd_t) + +sysadm_list_home_dirs(ntpd_t) optional_policy(` # for cron jobs diff --git a/policy/modules/services/oav.te b/policy/modules/services/oav.te index c10ccda2..8ef4f1b6 100644 --- a/policy/modules/services/oav.te +++ b/policy/modules/services/oav.te @@ -1,5 +1,5 @@ -policy_module(oav,1.5.0) +policy_module(oav,1.5.1) ######################################## # @@ -142,7 +142,8 @@ miscfiles_read_localization(scannerdaemon_t) sysnet_read_config(scannerdaemon_t) userdom_dontaudit_use_unpriv_user_fds(scannerdaemon_t) -userdom_dontaudit_search_sysadm_home_dirs(scannerdaemon_t) + +sysadm_dontaudit_search_home_dirs(scannerdaemon_t) optional_policy(` seutil_sigchld_newrole(scannerdaemon_t) diff --git a/policy/modules/services/oddjob.te b/policy/modules/services/oddjob.te index 2650a8b6..3c4717f6 100644 --- a/policy/modules/services/oddjob.te +++ b/policy/modules/services/oddjob.te @@ -1,5 +1,5 @@ -policy_module(oddjob,1.4.0) +policy_module(oddjob,1.4.1) ######################################## # @@ -78,10 +78,12 @@ libs_use_shared_libs(oddjob_mkhomedir_t) miscfiles_read_localization(oddjob_mkhomedir_t) +staff_manage_home_dirs(oddjob_mkhomedir_t) + # Add/remove user home directories -userdom_home_filetrans_generic_user_home_dir(oddjob_mkhomedir_t) -userdom_manage_generic_user_home_content_dirs(oddjob_mkhomedir_t) -userdom_manage_generic_user_home_content_files(oddjob_mkhomedir_t) -userdom_manage_generic_user_home_dirs(oddjob_mkhomedir_t) -userdom_manage_staff_home_dirs(oddjob_mkhomedir_t) -userdom_generic_user_home_dir_filetrans_generic_user_home_content(oddjob_mkhomedir_t,notdevfile_class_set) +unprivuser_home_filetrans_home_dir(oddjob_mkhomedir_t) +unprivuser_manage_home_content_dirs(oddjob_mkhomedir_t) +unprivuser_manage_home_content_files(oddjob_mkhomedir_t) +unprivuser_manage_home_dirs(oddjob_mkhomedir_t) +unprivuser_home_dir_filetrans_home_content(oddjob_mkhomedir_t,notdevfile_class_set) + diff --git a/policy/modules/services/openct.te b/policy/modules/services/openct.te index 7908ac88..351cfe6d 100644 --- a/policy/modules/services/openct.te +++ b/policy/modules/services/openct.te @@ -1,5 +1,5 @@ -policy_module(openct,1.2.1) +policy_module(openct,1.2.2) ######################################## # @@ -51,7 +51,8 @@ logging_send_syslog_msg(openct_t) miscfiles_read_localization(openct_t) userdom_dontaudit_use_unpriv_user_fds(openct_t) -userdom_dontaudit_search_sysadm_home_dirs(openct_t) + +sysadm_dontaudit_search_home_dirs(openct_t) openct_exec(openct_t) diff --git a/policy/modules/services/pegasus.te b/policy/modules/services/pegasus.te index 3cb9992b..9c163ed0 100644 --- a/policy/modules/services/pegasus.te +++ b/policy/modules/services/pegasus.te @@ -1,5 +1,5 @@ -policy_module(pegasus,1.5.1) +policy_module(pegasus,1.5.2) ######################################## # @@ -122,7 +122,8 @@ sysnet_read_config(pegasus_t) sysnet_domtrans_ifconfig(pegasus_t) userdom_dontaudit_use_unpriv_user_fds(pegasus_t) -userdom_dontaudit_search_sysadm_home_dirs(pegasus_t) + +sysadm_dontaudit_search_home_dirs(pegasus_t) optional_policy(` rpm_exec(pegasus_t) diff --git a/policy/modules/services/perdition.te b/policy/modules/services/perdition.te index 2020b031..edc1a048 100644 --- a/policy/modules/services/perdition.te +++ b/policy/modules/services/perdition.te @@ -1,5 +1,5 @@ -policy_module(perdition,1.4.0) +policy_module(perdition,1.4.1) ######################################## # @@ -68,7 +68,8 @@ miscfiles_read_localization(perdition_t) sysnet_read_config(perdition_t) userdom_dontaudit_use_unpriv_user_fds(perdition_t) -userdom_dontaudit_search_sysadm_home_dirs(perdition_t) + +sysadm_dontaudit_search_home_dirs(perdition_t) optional_policy(` seutil_sigchld_newrole(perdition_t) diff --git a/policy/modules/services/portmap.te b/policy/modules/services/portmap.te index 0a0e50ab..4c660188 100644 --- a/policy/modules/services/portmap.te +++ b/policy/modules/services/portmap.te @@ -1,5 +1,5 @@ -policy_module(portmap,1.6.0) +policy_module(portmap,1.6.1) ######################################## # @@ -87,7 +87,8 @@ miscfiles_read_localization(portmap_t) sysnet_read_config(portmap_t) userdom_dontaudit_use_unpriv_user_fds(portmap_t) -userdom_dontaudit_search_sysadm_home_dirs(portmap_t) + +sysadm_dontaudit_search_home_dirs(portmap_t) optional_policy(` nis_use_ypbind(portmap_t) diff --git a/policy/modules/services/postgresql.te b/policy/modules/services/postgresql.te index bd904043..1c5416fc 100644 --- a/policy/modules/services/postgresql.te +++ b/policy/modules/services/postgresql.te @@ -1,5 +1,5 @@ -policy_module(postgresql,1.5.0) +policy_module(postgresql,1.5.1) ################################# # @@ -128,12 +128,13 @@ miscfiles_read_localization(postgresql_t) seutil_dontaudit_search_config(postgresql_t) -userdom_dontaudit_search_sysadm_home_dirs(postgresql_t) -userdom_dontaudit_use_sysadm_ttys(postgresql_t) userdom_dontaudit_use_unpriv_user_fds(postgresql_t) mta_getattr_spool(postgresql_t) +sysadm_dontaudit_search_home_dirs(postgresql_t) +sysadm_dontaudit_use_ttys(postgresql_t) + tunable_policy(`allow_execmem',` allow postgresql_t self:process execmem; ') diff --git a/policy/modules/services/postgrey.te b/policy/modules/services/postgrey.te index b6cda434..04458eda 100644 --- a/policy/modules/services/postgrey.te +++ b/policy/modules/services/postgrey.te @@ -1,5 +1,5 @@ -policy_module(postgrey,1.4.0) +policy_module(postgrey,1.4.1) ######################################## # @@ -78,7 +78,8 @@ miscfiles_read_localization(postgrey_t) sysnet_read_config(postgrey_t) userdom_dontaudit_use_unpriv_user_fds(postgrey_t) -userdom_dontaudit_search_sysadm_home_dirs(postgrey_t) + +sysadm_dontaudit_search_home_dirs(postgrey_t) optional_policy(` nis_use_ypbind(postgrey_t) diff --git a/policy/modules/services/ppp.te b/policy/modules/services/ppp.te index 9f60fd9d..a7c890af 100644 --- a/policy/modules/services/ppp.te +++ b/policy/modules/services/ppp.te @@ -1,5 +1,5 @@ -policy_module(ppp,1.7.0) +policy_module(ppp,1.7.1) ######################################## # @@ -176,14 +176,15 @@ sysnet_manage_config(pppd_t) sysnet_etc_filetrans_config(pppd_t) userdom_dontaudit_use_unpriv_user_fds(pppd_t) -userdom_dontaudit_search_sysadm_home_dirs(pppd_t) # for ~/.ppprc - if it actually exists then you need some policy to read it #allow pppd_t { sysadm_home_dir_t home_root_t user_home_dir_type }:dir search; -userdom_search_sysadm_home_dirs(pppd_t) userdom_search_unpriv_users_home_dirs(pppd_t) ppp_exec(pppd_t) +sysadm_dontaudit_search_home_dirs(pppd_t) +sysadm_search_home_dirs(pppd_t) + optional_policy(` ddclient_domtrans(pppd_t) ') @@ -280,7 +281,8 @@ miscfiles_read_localization(pptp_t) sysnet_read_config(pptp_t) userdom_dontaudit_use_unpriv_user_fds(pptp_t) -userdom_dontaudit_search_sysadm_home_dirs(pptp_t) + +sysadm_dontaudit_search_home_dirs(pptp_t) optional_policy(` consoletype_exec(pppd_t) diff --git a/policy/modules/services/privoxy.te b/policy/modules/services/privoxy.te index 26d2b168..9dbbebc2 100644 --- a/policy/modules/services/privoxy.te +++ b/policy/modules/services/privoxy.te @@ -1,5 +1,5 @@ -policy_module(privoxy,1.6.0) +policy_module(privoxy,1.6.1) ######################################## # @@ -76,9 +76,10 @@ miscfiles_read_localization(privoxy_t) sysnet_dns_name_resolve(privoxy_t) userdom_dontaudit_use_unpriv_user_fds(privoxy_t) -userdom_dontaudit_search_sysadm_home_dirs(privoxy_t) + +sysadm_dontaudit_search_home_dirs(privoxy_t) # cjp: this should really not be needed -userdom_use_sysadm_terms(privoxy_t) +sysadm_use_terms(privoxy_t) optional_policy(` nis_use_ypbind(privoxy_t) diff --git a/policy/modules/services/procmail.te b/policy/modules/services/procmail.te index d334245d..f104fa75 100644 --- a/policy/modules/services/procmail.te +++ b/policy/modules/services/procmail.te @@ -1,5 +1,5 @@ -policy_module(procmail,1.8.0) +policy_module(procmail,1.8.1) ######################################## # @@ -74,9 +74,10 @@ miscfiles_read_localization(procmail_t) # only works until we define a different type for maildir userdom_priveleged_home_dir_manager(procmail_t) + # Do not audit attempts to access /root. -userdom_dontaudit_search_sysadm_home_dirs(procmail_t) -userdom_dontaudit_search_staff_home_dirs(procmail_t) +staff_dontaudit_search_home_dirs(procmail_t) +sysadm_dontaudit_search_home_dirs(procmail_t) mta_manage_spool(procmail_t) diff --git a/policy/modules/services/pxe.te b/policy/modules/services/pxe.te index ce9b8651..910cad01 100644 --- a/policy/modules/services/pxe.te +++ b/policy/modules/services/pxe.te @@ -1,5 +1,5 @@ -policy_module(pxe,1.2.0) +policy_module(pxe,1.2.1) # cjp: policy seems incomplete @@ -56,7 +56,8 @@ logging_send_syslog_msg(pxe_t) miscfiles_read_localization(pxe_t) userdom_dontaudit_use_unpriv_user_fds(pxe_t) -userdom_dontaudit_search_sysadm_home_dirs(pxe_t) + +sysadm_dontaudit_search_home_dirs(pxe_t) optional_policy(` seutil_sigchld_newrole(pxe_t) diff --git a/policy/modules/services/pyzor.te b/policy/modules/services/pyzor.te index 05ca327d..36f71f29 100644 --- a/policy/modules/services/pyzor.te +++ b/policy/modules/services/pyzor.te @@ -1,5 +1,5 @@ -policy_module(pyzor,1.5.0) +policy_module(pyzor,1.5.1) ######################################## # @@ -68,7 +68,7 @@ libs_use_shared_libs(pyzor_t) miscfiles_read_localization(pyzor_t) -userdom_dontaudit_search_sysadm_home_dirs(pyzor_t) +sysadm_dontaudit_search_home_dirs(pyzor_t) optional_policy(` amavis_manage_lib_files(pyzor_t) @@ -127,12 +127,12 @@ locallogin_dontaudit_use_fds(pyzord_t) miscfiles_read_localization(pyzord_t) -# Do not audit attempts to access /root. -userdom_dontaudit_search_sysadm_home_dirs(pyzord_t) -userdom_dontaudit_search_staff_home_dirs(pyzord_t) - mta_manage_spool(pyzord_t) +# Do not audit attempts to access /root. +staff_dontaudit_search_home_dirs(pyzord_t) +sysadm_dontaudit_search_home_dirs(pyzord_t) + optional_policy(` logging_send_syslog_msg(pyzord_t) ') diff --git a/policy/modules/services/radius.te b/policy/modules/services/radius.te index ed0a0e43..60e1525c 100644 --- a/policy/modules/services/radius.te +++ b/policy/modules/services/radius.te @@ -1,5 +1,5 @@ -policy_module(radius,1.7.0) +policy_module(radius,1.7.1) ######################################## # @@ -110,8 +110,9 @@ miscfiles_read_certs(radiusd_t) sysnet_read_config(radiusd_t) userdom_dontaudit_use_unpriv_user_fds(radiusd_t) -userdom_dontaudit_search_sysadm_home_dirs(radiusd_t) -userdom_dontaudit_getattr_sysadm_home_dirs(radiusd_t) + +sysadm_dontaudit_search_home_dirs(radiusd_t) +sysadm_dontaudit_getattr_home_dirs(radiusd_t) optional_policy(` cron_system_entry(radiusd_t,radiusd_exec_t) diff --git a/policy/modules/services/radvd.te b/policy/modules/services/radvd.te index 027da47d..b08b7adf 100644 --- a/policy/modules/services/radvd.te +++ b/policy/modules/services/radvd.te @@ -1,5 +1,5 @@ -policy_module(radvd,1.7.0) +policy_module(radvd,1.7.1) ######################################## # @@ -69,7 +69,8 @@ miscfiles_read_localization(radvd_t) sysnet_read_config(radvd_t) userdom_dontaudit_use_unpriv_user_fds(radvd_t) -userdom_dontaudit_search_sysadm_home_dirs(radvd_t) + +sysadm_dontaudit_search_home_dirs(radvd_t) optional_policy(` nis_use_ypbind(radvd_t) diff --git a/policy/modules/services/rhgb.te b/policy/modules/services/rhgb.te index 433ba9ef..e096a062 100644 --- a/policy/modules/services/rhgb.te +++ b/policy/modules/services/rhgb.te @@ -1,5 +1,5 @@ -policy_module(rhgb,1.6.0) +policy_module(rhgb,1.6.1) ######################################## # @@ -111,9 +111,10 @@ sysnet_read_config(rhgb_t) sysnet_domtrans_ifconfig(rhgb_t) userdom_dontaudit_use_unpriv_user_fds(rhgb_t) -userdom_dontaudit_search_sysadm_home_dirs(rhgb_t) userdom_dontaudit_search_all_users_home_content(rhgb_t) +sysadm_dontaudit_search_home_dirs(rhgb_t) + xserver_read_xdm_xserver_tmp_files(rhgb_t) xserver_kill_xdm_xserver(rhgb_t) # for running setxkbmap diff --git a/policy/modules/services/roundup.te b/policy/modules/services/roundup.te index b9a6f891..c1add20d 100644 --- a/policy/modules/services/roundup.te +++ b/policy/modules/services/roundup.te @@ -1,5 +1,5 @@ -policy_module(roundup,1.4.0) +policy_module(roundup,1.4.1) ######################################## # @@ -81,7 +81,8 @@ miscfiles_read_localization(roundup_t) sysnet_read_config(roundup_t) userdom_dontaudit_use_unpriv_user_fds(roundup_t) -userdom_dontaudit_search_sysadm_home_dirs(roundup_t) + +sysadm_dontaudit_search_home_dirs(roundup_t) optional_policy(` mysql_stream_connect(roundup_t) diff --git a/policy/modules/services/samba.te b/policy/modules/services/samba.te index e25ec57d..a523f68c 100644 --- a/policy/modules/services/samba.te +++ b/policy/modules/services/samba.te @@ -1,5 +1,5 @@ -policy_module(samba,1.8.0) +policy_module(samba,1.8.1) ################################# # @@ -193,7 +193,7 @@ logging_send_syslog_msg(samba_net_t) miscfiles_read_localization(samba_net_t) -userdom_dontaudit_search_sysadm_home_dirs(samba_net_t) +sysadm_dontaudit_search_home_dirs(samba_net_t) optional_policy(` kerberos_use(samba_net_t) @@ -316,10 +316,11 @@ logging_send_syslog_msg(smbd_t) miscfiles_read_localization(smbd_t) miscfiles_read_public_files(smbd_t) -userdom_dontaudit_search_sysadm_home_dirs(smbd_t) userdom_dontaudit_use_unpriv_user_fds(smbd_t) userdom_use_unpriv_users_fds(smbd_t) +sysadm_dontaudit_search_home_dirs(smbd_t) + ifdef(`hide_broken_symptoms', ` files_dontaudit_getattr_default_dirs(smbd_t) files_dontaudit_getattr_boot_dirs(smbd_t) @@ -375,7 +376,7 @@ tunable_policy(`samba_export_all_rw',` auth_manage_all_files_except_shadow(smbd_t) fs_read_noxattr_fs_files(nmbd_t) auth_manage_all_files_except_shadow(nmbd_t) - userdom_generic_user_home_dir_filetrans_generic_user_home_content(nmbd_t, { file dir }) + unprivuser_home_dir_filetrans_home_content(nmbd_t, { file dir }) ') ######################################## @@ -457,10 +458,11 @@ logging_send_syslog_msg(nmbd_t) miscfiles_read_localization(nmbd_t) -userdom_dontaudit_search_sysadm_home_dirs(nmbd_t) userdom_dontaudit_use_unpriv_user_fds(nmbd_t) userdom_use_unpriv_users_fds(nmbd_t) +sysadm_dontaudit_search_home_dirs(nmbd_t) + optional_policy(` seutil_sigchld_newrole(nmbd_t) ') @@ -718,9 +720,10 @@ logging_send_syslog_msg(winbind_t) miscfiles_read_localization(winbind_t) userdom_dontaudit_use_unpriv_user_fds(winbind_t) -userdom_dontaudit_search_sysadm_home_dirs(winbind_t) userdom_priveleged_home_dir_manager(winbind_t) +sysadm_dontaudit_search_home_dirs(winbind_t) + optional_policy(` kerberos_use(winbind_t) ') diff --git a/policy/modules/services/sasl.te b/policy/modules/services/sasl.te index 8c7abe33..528f8ae1 100644 --- a/policy/modules/services/sasl.te +++ b/policy/modules/services/sasl.te @@ -1,5 +1,5 @@ -policy_module(sasl,1.8.0) +policy_module(sasl,1.8.1) ######################################## # @@ -89,7 +89,8 @@ seutil_dontaudit_read_config(saslauthd_t) sysnet_read_config(saslauthd_t) userdom_dontaudit_use_unpriv_user_fds(saslauthd_t) -userdom_dontaudit_search_sysadm_home_dirs(saslauthd_t) + +sysadm_dontaudit_search_home_dirs(saslauthd_t) # cjp: typeattribute doesnt work in conditionals auth_can_read_shadow_passwords(saslauthd_t) diff --git a/policy/modules/services/sendmail.te b/policy/modules/services/sendmail.te index 8a66c3c3..f6ae7ec7 100644 --- a/policy/modules/services/sendmail.te +++ b/policy/modules/services/sendmail.te @@ -1,5 +1,5 @@ -policy_module(sendmail,1.7.0) +policy_module(sendmail,1.7.1) ######################################## # @@ -96,7 +96,6 @@ miscfiles_read_certs(sendmail_t) miscfiles_read_localization(sendmail_t) userdom_dontaudit_use_unpriv_user_fds(sendmail_t) -userdom_dontaudit_search_sysadm_home_dirs(sendmail_t) mta_read_config(sendmail_t) mta_etc_filetrans_aliases(sendmail_t) @@ -106,6 +105,8 @@ mta_rw_aliases(sendmail_t) mta_manage_queue(sendmail_t) mta_manage_spool(sendmail_t) +sysadm_dontaudit_search_home_dirs(sendmail_t) + optional_policy(` clamav_search_lib(sendmail_t) ') diff --git a/policy/modules/services/setroubleshoot.te b/policy/modules/services/setroubleshoot.te index 96d1caa9..0a801f77 100644 --- a/policy/modules/services/setroubleshoot.te +++ b/policy/modules/services/setroubleshoot.te @@ -1,5 +1,5 @@ -policy_module(setroubleshoot,1.6.0) +policy_module(setroubleshoot,1.6.1) ######################################## # @@ -105,7 +105,7 @@ seutil_read_file_contexts(setroubleshootd_t) sysnet_read_config(setroubleshootd_t) -userdom_dontaudit_read_sysadm_home_content_files(setroubleshootd_t) +sysadm_dontaudit_read_home_content_files(setroubleshootd_t) optional_policy(` dbus_system_bus_client_template(setroubleshootd, setroubleshootd_t) diff --git a/policy/modules/services/slrnpull.te b/policy/modules/services/slrnpull.te index de7deeb8..d05d9ac9 100644 --- a/policy/modules/services/slrnpull.te +++ b/policy/modules/services/slrnpull.te @@ -1,5 +1,5 @@ -policy_module(slrnpull,1.2.0) +policy_module(slrnpull,1.2.1) ######################################## # @@ -59,7 +59,8 @@ logging_send_syslog_msg(slrnpull_t) miscfiles_read_localization(slrnpull_t) userdom_dontaudit_use_unpriv_user_fds(slrnpull_t) -userdom_dontaudit_search_sysadm_home_dirs(slrnpull_t) + +sysadm_dontaudit_search_home_dirs(slrnpull_t) optional_policy(` cron_system_entry(slrnpull_t,slrnpull_exec_t) diff --git a/policy/modules/services/smartmon.te b/policy/modules/services/smartmon.te index 24ed53bf..30c9ec20 100644 --- a/policy/modules/services/smartmon.te +++ b/policy/modules/services/smartmon.te @@ -1,5 +1,5 @@ -policy_module(smartmon,1.5.0) +policy_module(smartmon,1.5.1) ######################################## # @@ -81,7 +81,8 @@ miscfiles_read_localization(fsdaemon_t) sysnet_read_config(fsdaemon_t) userdom_dontaudit_use_unpriv_user_fds(fsdaemon_t) -userdom_dontaudit_search_sysadm_home_dirs(fsdaemon_t) + +sysadm_dontaudit_search_home_dirs(fsdaemon_t) optional_policy(` mta_send_mail(fsdaemon_t) diff --git a/policy/modules/services/snmp.te b/policy/modules/services/snmp.te index 0e8d8d56..5eceb5fb 100644 --- a/policy/modules/services/snmp.te +++ b/policy/modules/services/snmp.te @@ -1,5 +1,5 @@ -policy_module(snmp,1.7.0) +policy_module(snmp,1.7.1) ######################################## # @@ -106,7 +106,8 @@ seutil_dontaudit_search_config(snmpd_t) sysnet_read_config(snmpd_t) userdom_dontaudit_use_unpriv_user_fds(snmpd_t) -userdom_dontaudit_search_sysadm_home_dirs(snmpd_t) + +sysadm_dontaudit_search_home_dirs(snmpd_t) ifdef(`distro_redhat', ` optional_policy(` diff --git a/policy/modules/services/snort.te b/policy/modules/services/snort.te index a1ec5866..1bad55da 100644 --- a/policy/modules/services/snort.te +++ b/policy/modules/services/snort.te @@ -1,5 +1,5 @@ -policy_module(snort,1.4.0) +policy_module(snort,1.4.1) ######################################## # @@ -86,7 +86,8 @@ miscfiles_read_localization(snort_t) sysnet_read_config(snort_t) userdom_dontaudit_use_unpriv_user_fds(snort_t) -userdom_dontaudit_search_sysadm_home_dirs(snort_t) + +sysadm_dontaudit_search_home_dirs(snort_t) optional_policy(` seutil_sigchld_newrole(snort_t) diff --git a/policy/modules/services/soundserver.te b/policy/modules/services/soundserver.te index e5e4910a..50155104 100644 --- a/policy/modules/services/soundserver.te +++ b/policy/modules/services/soundserver.te @@ -1,5 +1,5 @@ -policy_module(soundserver,1.4.0) +policy_module(soundserver,1.4.1) ######################################## # @@ -96,7 +96,8 @@ miscfiles_read_localization(soundd_t) sysnet_read_config(soundd_t) userdom_dontaudit_use_unpriv_user_fds(soundd_t) -userdom_dontaudit_search_sysadm_home_dirs(soundd_t) + +sysadm_dontaudit_search_home_dirs(soundd_t) optional_policy(` seutil_sigchld_newrole(soundd_t) diff --git a/policy/modules/services/spamassassin.te b/policy/modules/services/spamassassin.te index 4197b9e4..bb4c27af 100644 --- a/policy/modules/services/spamassassin.te +++ b/policy/modules/services/spamassassin.te @@ -1,5 +1,5 @@ -policy_module(spamassassin,1.9.0) +policy_module(spamassassin,1.9.1) ######################################## # @@ -147,7 +147,8 @@ sysnet_dns_name_resolve(spamd_t) userdom_use_unpriv_users_fds(spamd_t) userdom_search_unpriv_users_home_dirs(spamd_t) -userdom_dontaudit_search_sysadm_home_dirs(spamd_t) + +sysadm_dontaudit_search_home_dirs(spamd_t) tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_files(spamd_t) diff --git a/policy/modules/services/speedtouch.te b/policy/modules/services/speedtouch.te index cb818913..624358a3 100644 --- a/policy/modules/services/speedtouch.te +++ b/policy/modules/services/speedtouch.te @@ -1,5 +1,5 @@ -policy_module(speedtouch,1.2.0) +policy_module(speedtouch,1.2.1) ####################################### # @@ -54,7 +54,8 @@ logging_send_syslog_msg(speedmgmt_t) miscfiles_read_localization(speedmgmt_t) userdom_dontaudit_use_unpriv_user_fds(speedmgmt_t) -userdom_dontaudit_search_sysadm_home_dirs(speedmgmt_t) + +sysadm_dontaudit_search_home_dirs(speedmgmt_t) optional_policy(` seutil_sigchld_newrole(speedmgmt_t) diff --git a/policy/modules/services/squid.te b/policy/modules/services/squid.te index b8ae177c..af457b91 100644 --- a/policy/modules/services/squid.te +++ b/policy/modules/services/squid.te @@ -1,5 +1,5 @@ -policy_module(squid,1.5.0) +policy_module(squid,1.5.1) ######################################## # @@ -141,7 +141,8 @@ miscfiles_read_localization(squid_t) userdom_use_unpriv_users_fds(squid_t) userdom_dontaudit_use_unpriv_user_fds(squid_t) -userdom_dontaudit_search_sysadm_home_dirs(squid_t) + +sysadm_dontaudit_search_home_dirs(squid_t) tunable_policy(`squid_connect_any',` corenet_tcp_connect_all_ports(squid_t) diff --git a/policy/modules/services/stunnel.te b/policy/modules/services/stunnel.te index a14c521a..69f02a80 100644 --- a/policy/modules/services/stunnel.te +++ b/policy/modules/services/stunnel.te @@ -1,5 +1,5 @@ -policy_module(stunnel,1.5.0) +policy_module(stunnel,1.5.1) ######################################## # @@ -89,7 +89,8 @@ ifdef(`distro_gentoo', ` domain_use_interactive_fds(stunnel_t) userdom_dontaudit_use_unpriv_user_fds(stunnel_t) - userdom_dontaudit_search_sysadm_home_dirs(stunnel_t) + + sysadm_dontaudit_search_home_dirs(stunnel_t) optional_policy(` daemontools_service_domain(stunnel_t, stunnel_exec_t) diff --git a/policy/modules/services/sysstat.te b/policy/modules/services/sysstat.te index 411fc8d8..ff835250 100644 --- a/policy/modules/services/sysstat.te +++ b/policy/modules/services/sysstat.te @@ -1,5 +1,5 @@ -policy_module(sysstat,1.2.0) +policy_module(sysstat,1.2.1) ######################################## # @@ -60,7 +60,7 @@ locallogin_use_fds(sysstat_t) miscfiles_read_localization(sysstat_t) -userdom_dontaudit_list_sysadm_home_dirs(sysstat_t) +sysadm_dontaudit_list_home_dirs(sysstat_t) optional_policy(` cron_system_entry(sysstat_t,sysstat_exec_t) diff --git a/policy/modules/services/tftp.te b/policy/modules/services/tftp.te index 99370f11..6fca7a26 100644 --- a/policy/modules/services/tftp.te +++ b/policy/modules/services/tftp.te @@ -1,5 +1,5 @@ -policy_module(tftp,1.7.0) +policy_module(tftp,1.7.1) ######################################## # @@ -92,8 +92,9 @@ sysnet_read_config(tftpd_t) sysnet_use_ldap(tftpd_t) userdom_dontaudit_use_unpriv_user_fds(tftpd_t) -userdom_dontaudit_use_sysadm_ttys(tftpd_t) -userdom_dontaudit_search_sysadm_home_dirs(tftpd_t) + +sysadm_dontaudit_use_ttys(tftpd_t) +sysadm_dontaudit_search_home_dirs(tftpd_t) tunable_policy(`tftp_anon_write',` miscfiles_manage_public_files(tftpd_t) diff --git a/policy/modules/services/timidity.te b/policy/modules/services/timidity.te index 55b65f4b..336b4d3a 100644 --- a/policy/modules/services/timidity.te +++ b/policy/modules/services/timidity.te @@ -1,5 +1,5 @@ -policy_module(timidity,1.6.0) +policy_module(timidity,1.6.1) # Note: You only need this policy if you want to run timidity as a server @@ -73,10 +73,11 @@ logging_send_syslog_msg(timidity_t) sysnet_read_config(timidity_t) userdom_dontaudit_use_unpriv_user_fds(timidity_t) + # stupid timidity won't start if it can't search its current directory. # allow this so /etc/init.d/alsasound start works from /root # cjp: this should be fixed if possible so this rule can be removed. -userdom_search_sysadm_home_dirs(timidity_t) +sysadm_search_home_dirs(timidity_t) optional_policy(` seutil_sigchld_newrole(timidity_t) diff --git a/policy/modules/services/transproxy.te b/policy/modules/services/transproxy.te index f90dc35e..7eaf8fa5 100644 --- a/policy/modules/services/transproxy.te +++ b/policy/modules/services/transproxy.te @@ -1,5 +1,5 @@ -policy_module(transproxy,1.4.0) +policy_module(transproxy,1.4.1) ######################################## # @@ -58,7 +58,8 @@ miscfiles_read_localization(transproxy_t) sysnet_read_config(transproxy_t) userdom_dontaudit_use_unpriv_user_fds(transproxy_t) -userdom_dontaudit_search_sysadm_home_dirs(transproxy_t) + +sysadm_dontaudit_search_home_dirs(transproxy_t) optional_policy(` seutil_sigchld_newrole(transproxy_t) diff --git a/policy/modules/services/uptime.te b/policy/modules/services/uptime.te index f6449c27..ec773f0b 100644 --- a/policy/modules/services/uptime.te +++ b/policy/modules/services/uptime.te @@ -1,5 +1,5 @@ -policy_module(uptime,1.2.0) +policy_module(uptime,1.2.1) ######################################## # @@ -62,7 +62,8 @@ logging_send_syslog_msg(uptimed_t) miscfiles_read_localization(uptimed_t) userdom_dontaudit_use_unpriv_user_fds(uptimed_t) -userdom_dontaudit_search_sysadm_home_dirs(uptimed_t) + +sysadm_dontaudit_search_home_dirs(uptimed_t) optional_policy(` mta_send_mail(uptimed_t) diff --git a/policy/modules/services/uwimap.te b/policy/modules/services/uwimap.te index 6bf41f6b..bfb01c73 100644 --- a/policy/modules/services/uwimap.te +++ b/policy/modules/services/uwimap.te @@ -1,5 +1,5 @@ -policy_module(uwimap,1.5.0) +policy_module(uwimap,1.5.1) ######################################## # @@ -75,11 +75,12 @@ miscfiles_read_localization(imapd_t) sysnet_read_config(imapd_t) userdom_dontaudit_use_unpriv_user_fds(imapd_t) -userdom_dontaudit_search_sysadm_home_dirs(imapd_t) # cjp: this is excessive, should be limited to the # mail directories userdom_priveleged_home_dir_manager(imapd_t) +sysadm_dontaudit_search_home_dirs(imapd_t) + mta_rw_spool(imapd_t) optional_policy(` diff --git a/policy/modules/services/watchdog.te b/policy/modules/services/watchdog.te index d93f5a60..9523876e 100644 --- a/policy/modules/services/watchdog.te +++ b/policy/modules/services/watchdog.te @@ -1,5 +1,5 @@ -policy_module(watchdog,1.4.0) +policy_module(watchdog,1.4.1) ################################# # @@ -90,7 +90,8 @@ miscfiles_read_localization(watchdog_t) sysnet_read_config(watchdog_t) userdom_dontaudit_use_unpriv_user_fds(watchdog_t) -userdom_dontaudit_search_sysadm_home_dirs(watchdog_t) + +sysadm_dontaudit_search_home_dirs(watchdog_t) optional_policy(` mta_send_mail(watchdog_t) diff --git a/policy/modules/services/xfs.te b/policy/modules/services/xfs.te index 314175ba..bbd09897 100644 --- a/policy/modules/services/xfs.te +++ b/policy/modules/services/xfs.te @@ -1,5 +1,5 @@ -policy_module(xfs,1.3.0) +policy_module(xfs,1.3.1) ######################################## # @@ -73,7 +73,8 @@ miscfiles_read_localization(xfs_t) miscfiles_read_fonts(xfs_t) userdom_dontaudit_use_unpriv_user_fds(xfs_t) -userdom_dontaudit_search_sysadm_home_dirs(xfs_t) + +sysadm_dontaudit_search_home_dirs(xfs_t) xfs_exec(xfs_t) diff --git a/policy/modules/services/xprint.te b/policy/modules/services/xprint.te index fd2293a6..e6ee53b2 100644 --- a/policy/modules/services/xprint.te +++ b/policy/modules/services/xprint.te @@ -1,5 +1,5 @@ -policy_module(xprint,1.4.0) +policy_module(xprint,1.4.1) ######################################## # @@ -67,7 +67,8 @@ miscfiles_read_localization(xprint_t) sysnet_read_config(xprint_t) userdom_dontaudit_use_unpriv_user_fds(xprint_t) -userdom_dontaudit_search_sysadm_home_dirs(xprint_t) + +sysadm_dontaudit_search_home_dirs(xprint_t) optional_policy(` cups_read_config(xprint_t) diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te index dcafdcfa..22f436f3 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -1,5 +1,5 @@ -policy_module(xserver,2.0.0) +policy_module(xserver,2.0.1) ######################################## # @@ -308,7 +308,6 @@ miscfiles_read_fonts(xdm_t) sysnet_read_config(xdm_t) userdom_dontaudit_use_unpriv_user_fds(xdm_t) -userdom_dontaudit_search_sysadm_home_dirs(xdm_t) userdom_create_all_users_keys(xdm_t) # for .dmrc userdom_read_unpriv_users_home_content_files(xdm_t) @@ -316,6 +315,8 @@ userdom_read_unpriv_users_home_content_files(xdm_t) userdom_read_all_users_state(xdm_t) userdom_signal_all_users(xdm_t) +sysadm_dontaudit_search_home_dirs(xdm_t) + xserver_rw_session_template(xdm,xdm_t,xdm_tmpfs_t) xserver_unconfined(xdm_t) diff --git a/policy/modules/services/zebra.te b/policy/modules/services/zebra.te index 098d4bd1..0e284772 100644 --- a/policy/modules/services/zebra.te +++ b/policy/modules/services/zebra.te @@ -1,5 +1,5 @@ -policy_module(zebra,1.6.0) +policy_module(zebra,1.6.1) ######################################## # @@ -112,7 +112,8 @@ miscfiles_read_localization(zebra_t) sysnet_read_config(zebra_t) userdom_dontaudit_use_unpriv_user_fds(zebra_t) -userdom_dontaudit_search_sysadm_home_dirs(zebra_t) + +sysadm_dontaudit_search_home_dirs(zebra_t) tunable_policy(`allow_zebra_write_config',` manage_files_pattern(zebra_t, zebra_conf_t, zebra_conf_t) diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te index 8aab5da6..efab9301 100644 --- a/policy/modules/system/authlogin.te +++ b/policy/modules/system/authlogin.te @@ -1,5 +1,5 @@ -policy_module(authlogin,1.10.0) +policy_module(authlogin,1.10.1) ######################################## # @@ -274,7 +274,8 @@ term_dontaudit_use_generic_ptys(system_chkpwd_t) userdom_dontaudit_use_unpriv_users_ttys(system_chkpwd_t) userdom_dontaudit_use_unpriv_users_ptys(system_chkpwd_t) -userdom_dontaudit_use_sysadm_terms(system_chkpwd_t) + +sysadm_dontaudit_use_terms(system_chkpwd_t) ifdef(`distro_ubuntu',` optional_policy(` diff --git a/policy/modules/system/hotplug.te b/policy/modules/system/hotplug.te index e9e4011f..3789ea80 100644 --- a/policy/modules/system/hotplug.te +++ b/policy/modules/system/hotplug.te @@ -1,5 +1,5 @@ -policy_module(hotplug,1.8.0) +policy_module(hotplug,1.8.1) ######################################## # @@ -114,7 +114,8 @@ seutil_dontaudit_search_config(hotplug_t) sysnet_read_config(hotplug_t) userdom_dontaudit_use_unpriv_user_fds(hotplug_t) -userdom_dontaudit_search_sysadm_home_dirs(hotplug_t) + +sysadm_dontaudit_search_home_dirs(hotplug_t) ifdef(`distro_redhat', ` optional_policy(` diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index d95575e5..bc7d821b 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -1,5 +1,5 @@ -policy_module(init,1.10.0) +policy_module(init,1.10.1) gen_require(` class passwd rootok; @@ -179,7 +179,7 @@ tunable_policy(`init_upstart',` ',` # Run the shell in the sysadm role for single-user mode. # causes problems with upstart - userdom_shell_domtrans_sysadm(init_t) + sysadm_shell_domtrans(init_t) ') optional_policy(` @@ -381,10 +381,11 @@ modutils_domtrans_insmod(initrc_t) seutil_read_config(initrc_t) userdom_read_all_users_home_content_files(initrc_t) + # Allow access to the sysadm TTYs. Note that this will give access to the # TTYs to any process in the initrc_t domain. Therefore, daemons and such # started from init should be placed in their own domain. -userdom_use_sysadm_terms(initrc_t) +sysadm_use_terms(initrc_t) ifdef(`distro_debian',` dev_setattr_generic_dirs(initrc_t) diff --git a/policy/modules/system/ipsec.te b/policy/modules/system/ipsec.te index f551e832..70208670 100644 --- a/policy/modules/system/ipsec.te +++ b/policy/modules/system/ipsec.te @@ -1,5 +1,5 @@ -policy_module(ipsec,1.6.0) +policy_module(ipsec,1.6.1) ######################################## # @@ -137,7 +137,8 @@ miscfiles_read_localization(ipsec_t) sysnet_read_config(ipsec_t) userdom_dontaudit_use_unpriv_user_fds(ipsec_t) -userdom_dontaudit_search_sysadm_home_dirs(ipsec_t) + +sysadm_dontaudit_search_home_dirs(ipsec_t) optional_policy(` nis_use_ypbind(ipsec_t) @@ -255,7 +256,7 @@ seutil_dontaudit_search_config(ipsec_mgmt_t) sysnet_domtrans_ifconfig(ipsec_mgmt_t) -userdom_use_sysadm_terms(ipsec_mgmt_t) +sysadm_use_terms(ipsec_mgmt_t) optional_policy(` consoletype_exec(ipsec_mgmt_t) diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te index 39ceb8d3..8a3ca689 100644 --- a/policy/modules/system/locallogin.te +++ b/policy/modules/system/locallogin.te @@ -1,5 +1,5 @@ -policy_module(locallogin,1.6.0) +policy_module(locallogin,1.6.1) ######################################## # @@ -241,11 +241,13 @@ seutil_read_default_contexts(sulogin_t) auth_read_shadow(sulogin_t) -userdom_shell_domtrans_sysadm(sulogin_t) userdom_use_unpriv_users_fds(sulogin_t) -userdom_use_sysadm_ptys(sulogin_t) -userdom_search_staff_home_dirs(sulogin_t) -userdom_search_sysadm_home_dirs(sulogin_t) + +staff_search_home_dirs(sulogin_t) + +sysadm_shell_domtrans(sulogin_t) +sysadm_use_ptys(sulogin_t) +sysadm_search_home_dirs(sulogin_t) # suse and debian do not use pam with sulogin... ifdef(`distro_suse', `define(`sulogin_no_pam')') diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te index 1b6dfbf5..b9c618dd 100644 --- a/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te @@ -1,5 +1,5 @@ -policy_module(logging,1.10.0) +policy_module(logging,1.10.1) ######################################## # @@ -162,7 +162,8 @@ mls_file_write_all_levels(auditd_t) # Need to be able to write to /var/run/ dire seutil_dontaudit_read_config(auditd_t) userdom_dontaudit_use_unpriv_user_fds(auditd_t) -userdom_dontaudit_search_sysadm_home_dirs(auditd_t) + +sysadm_dontaudit_search_home_dirs(auditd_t) ifdef(`distro_ubuntu',` optional_policy(` @@ -224,7 +225,7 @@ miscfiles_read_localization(klogd_t) mls_file_read_all_levels(klogd_t) -userdom_dontaudit_search_sysadm_home_dirs(klogd_t) +sysadm_dontaudit_search_home_dirs(klogd_t) ifdef(`distro_ubuntu',` optional_policy(` @@ -355,7 +356,8 @@ sysnet_read_config(syslogd_t) miscfiles_read_localization(syslogd_t) userdom_dontaudit_use_unpriv_user_fds(syslogd_t) -userdom_dontaudit_search_sysadm_home_dirs(syslogd_t) + +sysadm_dontaudit_search_home_dirs(syslogd_t) ifdef(`distro_gentoo',` # default gentoo syslog-ng config appends kernel diff --git a/policy/modules/system/lvm.te b/policy/modules/system/lvm.te index 6be1bcd3..f1fbb4ba 100644 --- a/policy/modules/system/lvm.te +++ b/policy/modules/system/lvm.te @@ -1,5 +1,5 @@ -policy_module(lvm,1.8.1) +policy_module(lvm,1.8.2) ######################################## # @@ -117,7 +117,8 @@ seutil_dontaudit_search_config(clvmd_t) seutil_sigchld_newrole(clvmd_t) userdom_dontaudit_use_unpriv_user_fds(clvmd_t) -userdom_dontaudit_search_sysadm_home_dirs(clvmd_t) + +sysadm_dontaudit_search_home_dirs(clvmd_t) lvm_domtrans(clvmd_t) lvm_read_config(clvmd_t) diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te index 53a0afc1..245cea6f 100644 --- a/policy/modules/system/modutils.te +++ b/policy/modules/system/modutils.te @@ -1,5 +1,5 @@ -policy_module(modutils,1.6.0) +policy_module(modutils,1.6.1) gen_require(` bool secure_mode_insmod; @@ -208,8 +208,8 @@ libs_use_shared_libs(depmod_t) # Read System.map from home directories. files_list_home(depmod_t) -userdom_read_staff_home_content_files(depmod_t) -userdom_read_sysadm_home_content_files(depmod_t) +staff_read_home_content_files(depmod_t) +sysadm_read_home_content_files(depmod_t) ifdef(`distro_ubuntu',` optional_policy(` @@ -283,7 +283,7 @@ logging_send_syslog_msg(update_modules_t) miscfiles_read_localization(update_modules_t) -userdom_dontaudit_search_sysadm_home_dirs(update_modules_t) +sysadm_dontaudit_search_home_dirs(update_modules_t) ifdef(`distro_gentoo',` files_search_pids(update_modules_t) diff --git a/policy/modules/system/pcmcia.te b/policy/modules/system/pcmcia.te index 2c41ad4c..c9f8458a 100644 --- a/policy/modules/system/pcmcia.te +++ b/policy/modules/system/pcmcia.te @@ -1,5 +1,5 @@ -policy_module(pcmcia,1.4.0) +policy_module(pcmcia,1.4.1) ######################################## # @@ -110,7 +110,8 @@ sysnet_etc_filetrans_config(cardmgr_t) sysnet_manage_config(cardmgr_t) userdom_dontaudit_use_unpriv_user_fds(cardmgr_t) -userdom_dontaudit_search_sysadm_home_dirs(cardmgr_t) + +sysadm_dontaudit_search_home_dirs(cardmgr_t) optional_policy(` seutil_dontaudit_read_config(cardmgr_t) diff --git a/policy/modules/system/raid.te b/policy/modules/system/raid.te index 4e939097..7808c98b 100644 --- a/policy/modules/system/raid.te +++ b/policy/modules/system/raid.te @@ -1,5 +1,5 @@ -policy_module(raid,1.5.0) +policy_module(raid,1.5.1) ######################################## # @@ -69,11 +69,12 @@ logging_send_syslog_msg(mdadm_t) miscfiles_read_localization(mdadm_t) userdom_dontaudit_use_unpriv_user_fds(mdadm_t) -userdom_dontaudit_use_sysadm_ttys(mdadm_t) userdom_dontaudit_search_all_users_home_content(mdadm_t) mta_send_mail(mdadm_t) +sysadm_dontaudit_use_ttys(mdadm_t) + optional_policy(` gpm_dontaudit_getattr_gpmctl(mdadm_t) ') diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te index 3ea965ae..9597607a 100644 --- a/policy/modules/system/selinuxutil.te +++ b/policy/modules/system/selinuxutil.te @@ -1,5 +1,5 @@ -policy_module(selinuxutil,1.9.0) +policy_module(selinuxutil,1.9.1) gen_require(` bool secure_mode; @@ -512,8 +512,8 @@ ifdef(`enable_mls',` # read secadm tmp files ',` # Handle pp files created in homedir and /tmp - userdom_read_sysadm_home_content_files(semanage_t) - userdom_read_sysadm_tmp_files(semanage_t) + sysadm_read_home_content_files(semanage_t) + sysadm_read_tmp_files(semanage_t) optional_policy(` unconfined_read_home_content_files(semanage_t) diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te index 8ea1a850..1d175e1e 100644 --- a/policy/modules/system/sysnetwork.te +++ b/policy/modules/system/sysnetwork.te @@ -1,5 +1,5 @@ -policy_module(sysnetwork,1.6.0) +policy_module(sysnetwork,1.6.1) ######################################## # @@ -136,7 +136,7 @@ miscfiles_read_localization(dhcpc_t) modutils_domtrans_insmod(dhcpc_t) -userdom_dontaudit_search_staff_home_dirs(dhcpc_t) +staff_dontaudit_search_home_dirs(dhcpc_t) ifdef(`distro_redhat', ` files_exec_etc_files(dhcpc_t) diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if index 7b7d55a9..91ef0a0b 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -1451,8 +1451,9 @@ template(`userdom_security_admin_template',` seutil_run_semanage($1,$2,$3) seutil_run_setfiles($1, $2, $3) - userdom_dontaudit_append_staff_home_content_files($1) - userdom_dontaudit_read_sysadm_home_content_files($1) + staff_dontaudit_append_home_content_files($1) + + sysadm_dontaudit_read_home_content_files($1) optional_policy(` aide_run($1,$2, $3) @@ -1479,16 +1480,6 @@ template(`userdom_security_admin_template',` ## ## Change to the generic user role. ## -## -##

-## Change to the generic user role. -##

-##

-## This is a template to support third party modules -## and its use is not allowed in upstream reference -## policy. -##

-## ## ## ## The prefix of the user role (e.g., user @@ -1498,7 +1489,8 @@ template(`userdom_security_admin_template',` ## # template(`userdom_role_change_generic_user',` - userdom_role_change_template($1, user) + refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_role_change_template() instead.') + unprivuser_role_change_template($1) ') ######################################## @@ -1525,23 +1517,14 @@ template(`userdom_role_change_generic_user',` ## # template(`userdom_role_change_from_generic_user',` - userdom_role_change_template(user, $1) + refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_role_change_to_template() instead.') + unprivuser_role_change_to_template($1) ') ######################################## ## ## Change to the staff user role. ## -## -##

-## Change to the staff user role. -##

-##

-## This is a template to support third party modules -## and its use is not allowed in upstream reference -## policy. -##

-## ## ## ## The prefix of the user role (e.g., user @@ -1551,7 +1534,8 @@ template(`userdom_role_change_from_generic_user',` ## # template(`userdom_role_change_staff',` - userdom_role_change_template($1, staff) + refpolicywarn(`$0($*) has been deprecated. Please use staff_role_change_template() instead.') + staff_role_change_template($1) ') ######################################## @@ -1578,23 +1562,14 @@ template(`userdom_role_change_staff',` ## # template(`userdom_role_change_from_staff',` - userdom_role_change_template(staff, $1) + refpolicywarn(`$0($*) has been deprecated. Please use staff_role_change_to_template() instead.') + staff_role_change_to_template($1) ') ######################################## ## ## Change to the sysadm user role. ## -## -##

-## Change to the sysadm user role. -##

-##

-## This is a template to support third party modules -## and its use is not allowed in upstream reference -## policy. -##

-## ## ## ## The prefix of the user role (e.g., user @@ -1604,7 +1579,8 @@ template(`userdom_role_change_from_staff',` ## # template(`userdom_role_change_sysadm',` - userdom_role_change_template($1, sysadm) + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_role_change_template() instead.') + sysadm_role_change_template($1) ') ######################################## @@ -1631,23 +1607,14 @@ template(`userdom_role_change_sysadm',` ## # template(`userdom_role_change_from_sysadm',` - userdom_role_change_template(sysadm, $1) + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_role_change_to_template() instead.') + sysadm_role_change_to_template($1) ') ######################################## ## ## Change to the secadm user role. ## -## -##

-## Change to the secadm user role. -##

-##

-## This is a template to support third party modules -## and its use is not allowed in upstream reference -## policy. -##

-## ## ## ## The prefix of the user role (e.g., user @@ -1657,11 +1624,8 @@ template(`userdom_role_change_from_sysadm',` ## # template(`userdom_role_change_secadm',` - ifdef(`enable_mls',` - userdom_role_change_template($1,secadm) - ',` - refpolicywarn(`$0($*) has no effect in non-MLS policy.') - ') + refpolicywarn(`$0($*) has been deprecated. Please use secadm_role_change_template() instead.') + secadm_role_change_template($1) ') ######################################## @@ -1688,27 +1652,14 @@ template(`userdom_role_change_secadm',` ## # template(`userdom_role_change_from_secadm',` - ifdef(`enable_mls',` - userdom_role_change_template(secadm,$1) - ',` - refpolicywarn(`$0($*) has no effect in non-MLS policy.') - ') + refpolicywarn(`$0($*) has been deprecated. Please use secadm_role_change_to_template() instead.') + secadm_role_change_to_template($1) ') ######################################## ## ## Change to the auditadm user role. ## -## -##

-## Change to the auditadm user role. -##

-##

-## This is a template to support third party modules -## and its use is not allowed in upstream reference -## policy. -##

-## ## ## ## The prefix of the auditadm role (e.g., user @@ -1718,11 +1669,8 @@ template(`userdom_role_change_from_secadm',` ## # template(`userdom_role_change_auditadm',` - ifdef(`enable_mls',` - userdom_role_change_template($1,auditadm) - ',` - refpolicywarn(`$0($*) has no effect in non-MLS policy.') - ') + refpolicywarn(`$0($*) has been deprecated. Please use auditadm_role_change_template() instead.') + auditadm_role_change_template($1) ') ######################################## @@ -1749,11 +1697,8 @@ template(`userdom_role_change_auditadm',` ## # template(`userdom_role_change_from_auditadm',` - ifdef(`enable_mls',` - userdom_role_change_template(auditadm,$1) - ',` - refpolicywarn(`$0($*) has no effect in non-MLS policy.') - ') + refpolicywarn(`$0($*) has been deprecated. Please use auditadm_role_change_to_template() instead.') + auditadm_role_change_to_template($1) ') ######################################## @@ -4053,14 +3998,8 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',` ## # interface(`userdom_shell_domtrans_sysadm',` - gen_require(` - type sysadm_t; - ') - - corecmd_shell_domtrans($1, sysadm_t) - allow sysadm_t $1:fd use; - allow sysadm_t $1:fifo_file rw_file_perms; - allow sysadm_t $1:process sigchld; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_shell_domtrans() instead.') + sysadm_shell_domtrans($1) ') ######################################## @@ -4074,14 +4013,8 @@ interface(`userdom_shell_domtrans_sysadm',` ## # interface(`userdom_bin_spec_domtrans_sysadm',` - gen_require(` - type sysadm_t; - ') - - corecmd_bin_spec_domtrans($1,sysadm_t) - allow sysadm_t $1:fd use; - allow sysadm_t $1:fifo_file rw_file_perms; - allow sysadm_t $1:process sigchld; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_bin_spec_domtrans() instead.') + sysadm_bin_spec_domtrans($1) ') ######################################## @@ -4095,8 +4028,8 @@ interface(`userdom_bin_spec_domtrans_sysadm',` ## # interface(`userdom_sbin_spec_domtrans_sysadm',` - userdom_bin_spec_domtrans_sysadm($1) - refpolicywarn(`$0() has been deprecated, please use userdom_bin_spec_domtrans_sysadm() instead.') + refpolicywarn(`$0() has been deprecated, please use sysadm_bin_spec_domtrans() instead.') + sysadm_bin_spec_domtrans($1) ') ######################################## @@ -4112,14 +4045,8 @@ interface(`userdom_sbin_spec_domtrans_sysadm',` ## # interface(`userdom_entry_spec_domtrans_sysadm',` - gen_require(` - type sysadm_t; - ') - - domain_entry_file_spec_domtrans($1,sysadm_t) - allow sysadm_t $1:fd use; - allow sysadm_t $1:fifo_file rw_file_perms; - allow sysadm_t $1:process sigchld; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_entry_spec_domtrans() instead.') + sysadm_entry_spec_domtrans($1) ') ######################################## @@ -4146,14 +4073,8 @@ interface(`userdom_entry_spec_domtrans_sysadm',` ## # interface(`userdom_sysadm_bin_spec_domtrans_to',` - gen_require(` - type sysadm_t; - ') - - corecmd_bin_spec_domtrans(sysadm_t,$1) - allow $1 sysadm_t:fd use; - allow $1 sysadm_t:fifo_file rw_file_perms; - allow $1 sysadm_t:process sigchld; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_bin_spec_domtrans_to() instead.') + sysadm_bin_spec_domtrans_to($1) ') ######################################## @@ -4180,8 +4101,8 @@ interface(`userdom_sysadm_bin_spec_domtrans_to',` ## # interface(`userdom_sysadm_sbin_spec_domtrans_to',` - userdom_sysadm_bin_spec_domtrans_to($1) - refpolicywarn(`$0() has been deprecated, please use userdom_sysadm_bin_spec_domtrans_to() instead.') + refpolicywarn(`$0() has been deprecated, please use sysadm_bin_spec_domtrans_to() instead.') + sysadm_bin_spec_domtrans_to($1) ') ######################################## @@ -4209,14 +4130,8 @@ interface(`userdom_sysadm_sbin_spec_domtrans_to',` ## # interface(`userdom_sysadm_entry_spec_domtrans_to',` - gen_require(` - type sysadm_t; - ') - - domain_entry_file_spec_domtrans(sysadm_t, $1) - allow $1 sysadm_t:fd use; - allow $1 sysadm_t:fifo_file rw_file_perms; - allow $1 sysadm_t:process sigchld; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_entry_spec_domtrans_to() instead.') + sysadm_entry_spec_domtrans_to($1) ') ######################################## @@ -4230,12 +4145,8 @@ interface(`userdom_sysadm_entry_spec_domtrans_to',` ## # interface(`userdom_search_staff_home_dirs',` - gen_require(` - type staff_home_dir_t; - ') - - files_search_home($1) - allow $1 staff_home_dir_t:dir search_dir_perms; + refpolicywarn(`$0($*) has been deprecated. Please use staff_search_home_dirs() instead.') + staff_search_home_dirs($1) ') ######################################## @@ -4250,11 +4161,8 @@ interface(`userdom_search_staff_home_dirs',` ## # interface(`userdom_dontaudit_search_staff_home_dirs',` - gen_require(` - type staff_home_dir_t; - ') - - dontaudit $1 staff_home_dir_t:dir search_dir_perms; + refpolicywarn(`$0($*) has been deprecated. Please use staff_dontaudit_search_home_dirs() instead.') + staff_dontaudit_search_home_dirs($1) ') ######################################## @@ -4269,12 +4177,8 @@ interface(`userdom_dontaudit_search_staff_home_dirs',` ## # interface(`userdom_manage_staff_home_dirs',` - gen_require(` - type staff_home_dir_t; - ') - - files_search_home($1) - allow $1 staff_home_dir_t:dir manage_dir_perms; + refpolicywarn(`$0($*) has been deprecated. Please use staff_manage_home_dirs() instead.') + staff_manage_home_dirs($1) ') ######################################## @@ -4288,12 +4192,8 @@ interface(`userdom_manage_staff_home_dirs',` ## # interface(`userdom_relabelto_staff_home_dirs',` - gen_require(` - type staff_home_dir_t; - ') - - files_search_home($1) - allow $1 staff_home_dir_t:dir relabelto; + refpolicywarn(`$0($*) has been deprecated. Please use staff_relabelto_home_dirs() instead.') + staff_relabelto_home_dirs($1) ') ######################################## @@ -4308,11 +4208,8 @@ interface(`userdom_relabelto_staff_home_dirs',` ## # interface(`userdom_dontaudit_append_staff_home_content_files',` - gen_require(` - type staff_home_t; - ') - - dontaudit $1 staff_home_t:file append; + refpolicywarn(`$0($*) has been deprecated. Please use staff_dontaudit_append_home_content_files() instead.') + staff_dontaudit_append_home_content_files($1) ') ######################################## @@ -4326,14 +4223,8 @@ interface(`userdom_dontaudit_append_staff_home_content_files',` ## # interface(`userdom_read_staff_home_content_files',` - gen_require(` - type staff_home_dir_t, staff_home_t; - ') - - files_search_home($1) - allow $1 { staff_home_dir_t staff_home_t }:dir list_dir_perms; - read_files_pattern($1,{ staff_home_dir_t staff_home_t },staff_home_t) - read_lnk_files_pattern($1,{ staff_home_dir_t staff_home_t },staff_home_t) + refpolicywarn(`$0($*) has been deprecated. Please use staff_read_home_content_files() instead.') + staff_read_home_content_files($1) ') ######################################## @@ -4347,11 +4238,8 @@ interface(`userdom_read_staff_home_content_files',` ## # interface(`userdom_sigchld_sysadm',` - gen_require(` - type sysadm_t; - ') - - allow $1 sysadm_t:process sigchld; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_sigchld() instead.') + sysadm_sigchld($1) ') ######################################## @@ -4366,11 +4254,8 @@ interface(`userdom_sigchld_sysadm',` ## # interface(`userdom_dontaudit_getattr_sysadm_ttys',` - gen_require(` - type sysadm_tty_device_t; - ') - - dontaudit $1 sysadm_tty_device_t:chr_file getattr; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_dontaudit_getattr_ttys() instead.') + sysadm_dontaudit_getattr_ttys($1) ') ######################################## @@ -4384,13 +4269,8 @@ interface(`userdom_dontaudit_getattr_sysadm_ttys',` ## # interface(`userdom_use_sysadm_ttys',` - gen_require(` - type sysadm_tty_device_t; - ') - - dev_list_all_dev_nodes($1) - term_list_ptys($1) - allow $1 sysadm_tty_device_t:chr_file rw_term_perms; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_use_ttys() instead.') + sysadm_use_ttys($1) ') ######################################## @@ -4404,11 +4284,8 @@ interface(`userdom_use_sysadm_ttys',` ## # interface(`userdom_dontaudit_use_sysadm_ttys',` - gen_require(` - type sysadm_tty_device_t; - ') - - dontaudit $1 sysadm_tty_device_t:chr_file { read write }; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_dontaudit_use_ttys() instead.') + sysadm_dontaudit_use_ttys($1) ') ######################################## @@ -4422,13 +4299,8 @@ interface(`userdom_dontaudit_use_sysadm_ttys',` ## # interface(`userdom_use_sysadm_ptys',` - gen_require(` - type sysadm_devpts_t; - ') - - dev_list_all_dev_nodes($1) - term_list_ptys($1) - allow $1 sysadm_devpts_t:chr_file rw_term_perms; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_use_ptys() instead.') + sysadm_use_ptys($1) ') ######################################## @@ -4442,11 +4314,8 @@ interface(`userdom_use_sysadm_ptys',` ## # interface(`userdom_dontaudit_use_sysadm_ptys',` - gen_require(` - type sysadm_devpts_t; - ') - - dontaudit $1 sysadm_devpts_t:chr_file { read write }; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_dontaudit_use_ptys() instead.') + sysadm_dontaudit_use_ptys($1) ') ######################################## @@ -4460,8 +4329,8 @@ interface(`userdom_dontaudit_use_sysadm_ptys',` ## # interface(`userdom_use_sysadm_terms',` - userdom_use_sysadm_ttys($1) - userdom_use_sysadm_ptys($1) + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_use_terms() instead.') + sysadm_use_terms($1) ') ######################################## @@ -4475,11 +4344,8 @@ interface(`userdom_use_sysadm_terms',` ## # interface(`userdom_dontaudit_use_sysadm_terms',` - gen_require(` - attribute admin_terminal; - ') - - dontaudit $1 admin_terminal:chr_file { read write }; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_dontaudit_use_terms() instead.') + sysadm_dontaudit_use_terms($1) ') ######################################## @@ -4493,11 +4359,8 @@ interface(`userdom_dontaudit_use_sysadm_terms',` ## # interface(`userdom_use_sysadm_fds',` - gen_require(` - type sysadm_t; - ') - - allow $1 sysadm_t:fd use; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_use_fds() instead.') + sysadm_use_fds($1) ') ######################################## @@ -4511,11 +4374,8 @@ interface(`userdom_use_sysadm_fds',` ## # interface(`userdom_rw_sysadm_pipes',` - gen_require(` - type sysadm_t; - ') - - allow $1 sysadm_t:fifo_file rw_fifo_file_perms; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_rw_pipes() instead.') + sysadm_rw_pipes($1) ') ######################################## @@ -4530,11 +4390,8 @@ interface(`userdom_rw_sysadm_pipes',` ## # interface(`userdom_getattr_sysadm_home_dirs',` - gen_require(` - type sysadm_home_dir_t; - ') - - allow $1 sysadm_home_dir_t:dir getattr; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_getattr_home_dirs() instead.') + sysadm_getattr_home_dirs($1) ') ######################################## @@ -4550,11 +4407,8 @@ interface(`userdom_getattr_sysadm_home_dirs',` ## # interface(`userdom_dontaudit_getattr_sysadm_home_dirs',` - gen_require(` - type sysadm_home_dir_t; - ') - - dontaudit $1 sysadm_home_dir_t:dir getattr; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_dontaudit_getattr_home_dirs() instead.') + sysadm_dontaudit_getattr_home_dirs($1) ') ######################################## @@ -4568,11 +4422,8 @@ interface(`userdom_dontaudit_getattr_sysadm_home_dirs',` ## # interface(`userdom_search_sysadm_home_dirs',` - gen_require(` - type sysadm_home_dir_t; - ') - - allow $1 sysadm_home_dir_t:dir search_dir_perms; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_search_home_dirs() instead.') + sysadm_search_home_dirs($1) ') ######################################## @@ -4587,11 +4438,8 @@ interface(`userdom_search_sysadm_home_dirs',` ## # interface(`userdom_dontaudit_search_sysadm_home_dirs',` - gen_require(` - type sysadm_home_dir_t; - ') - - dontaudit $1 sysadm_home_dir_t:dir search_dir_perms; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_dontaudit_search_home_dirs() instead.') + sysadm_dontaudit_search_home_dirs($1) ') ######################################## @@ -4605,11 +4453,8 @@ interface(`userdom_dontaudit_search_sysadm_home_dirs',` ## # interface(`userdom_list_sysadm_home_dirs',` - gen_require(` - type sysadm_home_dir_t; - ') - - allow $1 sysadm_home_dir_t:dir list_dir_perms; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_list_home_dirs() instead.') + sysadm_list_home_dirs($1) ') ######################################## @@ -4624,11 +4469,8 @@ interface(`userdom_list_sysadm_home_dirs',` ## # interface(`userdom_dontaudit_list_sysadm_home_dirs',` - gen_require(` - type sysadm_home_dir_t; - ') - - dontaudit $1 sysadm_home_dir_t:dir list_dir_perms; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_dontaudit_list_home_dirs() instead.') + sysadm_dontaudit_list_home_dirs($1) ') ######################################## @@ -4643,13 +4485,8 @@ interface(`userdom_dontaudit_list_sysadm_home_dirs',` ## # interface(`userdom_dontaudit_read_sysadm_home_content_files',` - gen_require(` - type sysadm_home_dir_t, sysadm_home_t; - ') - - dontaudit $1 sysadm_home_dir_t:dir search_dir_perms; - dontaudit $1 sysadm_home_t:dir search_dir_perms; - dontaudit $1 sysadm_home_t:file read_file_perms; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_dontaudit_read_home_content_files() instead.') + sysadm_dontaudit_read_home_content_files($1) ') ######################################## @@ -4675,11 +4512,8 @@ interface(`userdom_dontaudit_read_sysadm_home_content_files',` ## # interface(`userdom_sysadm_home_dir_filetrans',` - gen_require(` - type sysadm_home_dir_t; - ') - - filetrans_pattern($1,sysadm_home_dir_t,$2,$3) + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_home_dir_filetrans() instead.') + sysadm_home_dir_filetrans($1,$2,$3) ') ######################################## @@ -4693,11 +4527,8 @@ interface(`userdom_sysadm_home_dir_filetrans',` ## # interface(`userdom_search_sysadm_home_content_dirs',` - gen_require(` - type sysadm_home_dir_t, sysadm_home_t; - ') - - allow $1 { sysadm_home_dir_t sysadm_home_t }:dir search_dir_perms; + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_search_home_content_dirs() instead.') + sysadm_search_home_content_dirs($1) ') ######################################## @@ -4711,14 +4542,8 @@ interface(`userdom_search_sysadm_home_content_dirs',` ## # interface(`userdom_read_sysadm_home_content_files',` - gen_require(` - type sysadm_home_dir_t, sysadm_home_t; - ') - - files_search_home($1) - allow $1 { sysadm_home_dir_t sysadm_home_t }:dir list_dir_perms; - read_files_pattern($1, { sysadm_home_dir_t sysadm_home_t }, sysadm_home_t) - read_lnk_files_pattern($1, { sysadm_home_dir_t sysadm_home_t }, sysadm_home_t) + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_read_home_content_files() instead.') + sysadm_read_home_content_files($1) ') ######################################## @@ -4732,14 +4557,8 @@ interface(`userdom_read_sysadm_home_content_files',` ## # interface(`userdom_read_sysadm_tmp_files',` - gen_require(` - type sysadm_tmp_t; - ') - - files_search_tmp($1) - allow $1 sysadm_tmp_t:dir list_dir_perms; - read_files_pattern($1, sysadm_tmp_t, sysadm_tmp_t) - read_lnk_files_pattern($1, sysadm_tmp_t, sysadm_tmp_t) + refpolicywarn(`$0($*) has been deprecated. Please use sysadm_read_tmp_files() instead.') + sysadm_read_tmp_files($1) ') ######################################## @@ -4993,11 +4812,8 @@ interface(`userdom_dontaudit_use_unpriv_user_fds',` ## # interface(`userdom_home_filetrans_generic_user_home_dir',` - gen_require(` - type user_home_dir_t; - ') - - files_home_filetrans($1,user_home_dir_t,dir) + refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_home_filetrans_home_dir() instead.') + unprivuser_home_filetrans_home_dir($1) ') ######################################## @@ -5011,11 +4827,8 @@ interface(`userdom_home_filetrans_generic_user_home_dir',` ## # interface(`userdom_search_generic_user_home_dirs',` - gen_require(` - type user_home_dir_t; - ') - - allow $1 user_home_dir_t:dir search_dir_perms; + refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_search_home_dirs() instead.') + unprivuser_search_home_dirs($1) ') ######################################## @@ -5036,12 +4849,8 @@ interface(`userdom_search_generic_user_home_dirs',` ## # interface(`userdom_generic_user_home_dir_filetrans_generic_user_home_content',` - gen_require(` - type user_home_dir_t, user_home_t; - ') - - files_search_home($1) - filetrans_pattern($1,user_home_dir_t,user_home_t,$2) + refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_home_dir_filetrans_home_content() instead.') + unprivuser_home_dir_filetrans_home_content($1) ') ######################################## @@ -5055,11 +4864,8 @@ interface(`userdom_generic_user_home_dir_filetrans_generic_user_home_content',` ## # interface(`userdom_dontaudit_search_generic_user_home_dirs',` - gen_require(` - type user_home_t; - ') - - dontaudit $1 user_home_t:dir search_dir_perms; + refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_dontaudit_search_home_dirs() instead.') + unprivuser_dontaudit_search_home_dirs($1) ') ######################################## @@ -5074,12 +4880,8 @@ interface(`userdom_dontaudit_search_generic_user_home_dirs',` ## # interface(`userdom_manage_generic_user_home_dirs',` - gen_require(` - type user_home_dir_t; - ') - - files_search_home($1) - allow $1 user_home_dir_t:dir manage_dir_perms; + refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_manage_home_dirs() instead.') + unprivuser_manage_home_dirs($1) ') ######################################## @@ -5095,17 +4897,13 @@ interface(`userdom_manage_generic_user_home_dirs',` ## # interface(`userdom_manage_generic_user_home_content_dirs',` - gen_require(` - type user_home_dir_t, user_home_t; - ') - - files_search_home($1) - manage_dirs_pattern($1,{ user_home_dir_t user_home_t },user_home_t) + refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_manage_home_content_dirs() instead.') + unprivuser_manage_home_content_dirs($1) ') ######################################## ## -## Relabel to staff home directories. +## Relabel to generic user home directories. ## ## ## @@ -5114,12 +4912,8 @@ interface(`userdom_manage_generic_user_home_content_dirs',` ## # interface(`userdom_relabelto_generic_user_home_dirs',` - gen_require(` - type staff_home_dir_t; - ') - - files_search_home($1) - allow $1 user_home_dir_t:dir relabelto; + refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_relabelto_home_dirs() instead.') + unprivuser_relabelto_home_dirs($1) ') ######################################## @@ -5133,13 +4927,8 @@ interface(`userdom_relabelto_generic_user_home_dirs',` ## # interface(`userdom_read_generic_user_home_content_files',` - gen_require(` - type user_home_t, user_home_dir_t; - ') - - files_search_home($1) - allow $1 user_home_t:dir list_dir_perms; - read_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) + refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_read_home_content_files() instead.') + unprivuser_read_home_content_files($1) ') ######################################## @@ -5154,12 +4943,8 @@ interface(`userdom_read_generic_user_home_content_files',` ## # interface(`userdom_mmap_generic_user_home_content_files',` - gen_require(` - type user_home_t; - ') - - files_search_home($1) - allow $1 user_home_t:file execute; + refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_mmap_home_content_files() instead.') + unprivuser_mmap_home_content_files($1) ') ######################################## @@ -5174,12 +4959,8 @@ interface(`userdom_mmap_generic_user_home_content_files',` ## # interface(`userdom_manage_generic_user_home_content_files',` - gen_require(` - type user_home_dir_t, user_home_t; - ') - - files_search_home($1) - manage_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) + refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_manage_home_content_files() instead.') + unprivuser_manage_home_content_files($1) ') ######################################## @@ -5194,11 +4975,8 @@ interface(`userdom_manage_generic_user_home_content_files',` ## # interface(`userdom_dontaudit_relabel_generic_user_home_content_files',` - gen_require(` - type user_home_t; - ') - - dontaudit $1 user_home_t:file { relabelto relabelfrom }; + refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_dontaudit_relabel_home_content_files() instead.') + unprivuser_dontaudit_relabel_home_content_files($1) ') ######################################## @@ -5213,12 +4991,8 @@ interface(`userdom_dontaudit_relabel_generic_user_home_content_files',` ## # interface(`userdom_manage_generic_user_home_content_symlinks',` - gen_require(` - type user_home_dir_t, user_home_t; - ') - - files_search_home($1) - manage_lnk_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) + refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_manage_home_content_symlinks() instead.') + unprivuser_manage_home_content_symlinks($1) ') ######################################## @@ -5233,12 +5007,8 @@ interface(`userdom_manage_generic_user_home_content_symlinks',` ## # interface(`userdom_manage_generic_user_home_content_pipes',` - gen_require(` - type user_home_dir_t, user_home_t; - ') - - files_search_home($1) - manage_fifo_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) + refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_manage_home_content_pipes() instead.') + unprivuser_manage_home_content_pipes($1) ') ######################################## @@ -5253,12 +5023,8 @@ interface(`userdom_manage_generic_user_home_content_pipes',` ## # interface(`userdom_manage_generic_user_home_content_sockets',` - gen_require(` - type user_home_dir_t, user_home_t; - ') - - files_search_home($1) - manage_sock_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) + refpolicywarn(`$0($*) has been deprecated. Please use unprivuser_manage_home_content_sockets() instead.') + unprivuser_manage_home_content_sockets($1) ') ######################################## diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te index ae663095..276640b3 100644 --- a/policy/modules/system/userdomain.te +++ b/policy/modules/system/userdomain.te @@ -1,27 +1,11 @@ -policy_module(userdomain,2.5.0) - -gen_require(` - role sysadm_r, staff_r, user_r; - - ifdef(`enable_mls',` - role secadm_r; - role auditadm_r; - ') -') +policy_module(userdomain, 3.0.1) ######################################## # # Declarations # -## -##

-## Allow sysadm to debug or ptrace all processes. -##

-## -gen_tunable(allow_ptrace,false) - ## ##

## Allow users to connect to mysql @@ -100,390 +84,3 @@ attribute unpriv_userdomain; attribute untrusted_content_type; attribute untrusted_content_tmp_type; - -######################################## -# -# Local policy -# - -userdom_admin_user_template(sysadm) -userdom_unpriv_user_template(staff) -userdom_unpriv_user_template(user) - -# user role change rules: -# sysadm_r can change to user roles -userdom_role_change_template(sysadm, user) -userdom_role_change_template(sysadm, staff) - -# only staff_r can change to sysadm_r -userdom_role_change_template(staff, sysadm) -dontaudit staff_t admin_terminal:chr_file { read write }; - -ifdef(`enable_mls',` - userdom_unpriv_user_template(secadm) - userdom_unpriv_user_template(auditadm) - - userdom_role_change_template(staff, auditadm) - userdom_role_change_template(staff, secadm) - - userdom_role_change_template(sysadm, secadm) - userdom_role_change_template(sysadm, auditadm) - - userdom_role_change_template(auditadm, secadm) - userdom_role_change_template(auditadm, sysadm) - - userdom_role_change_template(secadm, auditadm) - userdom_role_change_template(secadm, sysadm) -') - -######################################## -# -# Sysadm local policy -# - -# for su -allow sysadm_t userdomain:fd use; - -# Add/remove user home directories -allow sysadm_t user_home_dir_t:dir manage_dir_perms; -files_home_filetrans(sysadm_t, user_home_dir_t, dir) - -corecmd_exec_shell(sysadm_t) - -mls_process_read_up(sysadm_t) - -init_exec(sysadm_t) - -# Following for sending reboot and wall messages -userdom_use_unpriv_users_ptys(sysadm_t) -userdom_use_unpriv_users_ttys(sysadm_t) - -ifdef(`direct_sysadm_daemon',` - optional_policy(` - init_run_daemon(sysadm_t, sysadm_r, admin_terminal) - ') -',` - ifdef(`distro_gentoo',` - optional_policy(` - seutil_init_script_run_runinit(sysadm_t, sysadm_r, admin_terminal) - ') - ') -') - -ifdef(`enable_mls',` - allow auditadm_t self:capability { dac_read_search dac_override }; - seutil_run_runinit(auditadm_t, auditadm_r, { auditadm_tty_device_t auditadm_devpts_t }) - domain_kill_all_domains(auditadm_t) - seutil_read_bin_policy(auditadm_t) - corecmd_exec_shell(auditadm_t) - logging_send_syslog_msg(auditadm_t) - logging_read_generic_logs(auditadm_t) - logging_manage_audit_log(auditadm_t) - logging_manage_audit_config(auditadm_t) - logging_run_auditctl(auditadm_t, auditadm_r, { auditadm_tty_device_t auditadm_devpts_t }) - logging_run_auditd(auditadm_t, auditadm_r, { auditadm_tty_device_t auditadm_devpts_t }) - userdom_dontaudit_read_sysadm_home_content_files(auditadm_t) - - allow secadm_t self:capability { dac_read_search dac_override }; - corecmd_exec_shell(secadm_t) - domain_obj_id_change_exemption(secadm_t) - mls_process_read_up(secadm_t) - mls_file_read_all_levels(secadm_t) - mls_file_write_all_levels(secadm_t) - mls_file_upgrade(secadm_t) - mls_file_downgrade(secadm_t) - auth_relabel_all_files_except_shadow(secadm_t) - dev_relabel_all_dev_nodes(secadm_t) - auth_relabel_shadow(secadm_t) - init_exec(secadm_t) - logging_read_audit_log(secadm_t) - logging_read_generic_logs(secadm_t) - logging_read_audit_config(secadm_t) - userdom_dontaudit_append_staff_home_content_files(secadm_t) - userdom_dontaudit_read_sysadm_home_content_files(secadm_t) - - optional_policy(` - aide_run(secadm_t, secadm_r, { secadm_tty_device_t secadm_devpts_t }) - ') - - optional_policy(` - netlabel_run_mgmt(secadm_t, secadm_r, { secadm_tty_device_t secadm_devpts_t }) - ') -',` - logging_manage_audit_log(sysadm_t) - logging_manage_audit_config(sysadm_t) - logging_run_auditctl(sysadm_t, sysadm_r, admin_terminal) -') - -tunable_policy(`allow_ptrace',` - domain_ptrace_all_domains(sysadm_t) -') - -optional_policy(` - amanda_run_recover(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - apache_run_helper(sysadm_t, sysadm_r, admin_terminal) - #apache_run_all_scripts(sysadm_t, sysadm_r) - #apache_domtrans_sys_script(sysadm_t) -') - -optional_policy(` - tzdata_domtrans(sysadm_t) -') - -optional_policy(` - raid_domtrans_mdadm(sysadm_t) -') - -optional_policy(` - # cjp: why is this not apm_run_client - apm_domtrans_client(sysadm_t) -') - -optional_policy(` - apt_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - backup_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - bootloader_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - bind_run_ndc(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - certwatch_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - consoletype_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - clock_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - clockspeed_run_cli(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - cvs_exec(sysadm_t) -') - -optional_policy(` - consoletype_exec(sysadm_t) - - ifdef(`enable_mls',` - consoletype_exec(auditadm_t) - ') -') - -optional_policy(` - cron_admin_template(sysadm, sysadm_t, sysadm_r) -') - -optional_policy(` - dcc_run_cdcc(sysadm_t, sysadm_r, admin_terminal) - dcc_run_client(sysadm_t, sysadm_r, admin_terminal) - dcc_run_dbclean(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - ddcprobe_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - dmesg_exec(sysadm_t) - - ifdef(`enable_mls',` - dmesg_exec(auditadm_t) - ') -') - -optional_policy(` - dmidecode_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - dpkg_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - ethereal_run_tethereal(sysadm_t, sysadm_r, admin_terminal) - ethereal_admin_template(sysadm, sysadm_t, sysadm_r) -') - -optional_policy(` - firstboot_run(sysadm_t, sysadm_r, sysadm_tty_device_t) -') - -optional_policy(` - fstools_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - hostname_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - # allow system administrator to use the ipsec script to look - # at things (e.g., ipsec auto --status) - # probably should create an ipsec_admin role for this kind of thing - ipsec_exec_mgmt(sysadm_t) - ipsec_stream_connect(sysadm_t) - # for lsof - ipsec_getattr_key_sockets(sysadm_t) -') - -optional_policy(` - iptables_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - libs_run_ldconfig(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - lvm_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - logrotate_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - lpd_run_checkpc(sysadm_t, sysadm_r, admin_terminal) - lpr_admin_template(sysadm, sysadm_t, sysadm_r) -') - -optional_policy(` - kudzu_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - modutils_run_depmod(sysadm_t, sysadm_r, admin_terminal) - modutils_run_insmod(sysadm_t, sysadm_r, admin_terminal) - modutils_run_update_mods(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - mount_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - mta_admin_template(sysadm, sysadm_t, sysadm_r) -') - -optional_policy(` - mysql_stream_connect(sysadm_t) -') - -optional_policy(` - netutils_run(sysadm_t, sysadm_r, admin_terminal) - netutils_run_ping(sysadm_t, sysadm_r, admin_terminal) - netutils_run_traceroute(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - rpc_domtrans_nfsd(sysadm_t) -') - -optional_policy(` - munin_stream_connect(sysadm_t) -') - -optional_policy(` - ntp_stub() - corenet_udp_bind_ntp_port(sysadm_t) -') - -optional_policy(` - oav_run_update(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - pcmcia_run_cardctl(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - portage_run(sysadm_t, sysadm_r, admin_terminal) - portage_run_gcc_config(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - portmap_run_helper(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - quota_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - rpm_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - rsync_exec(sysadm_t) -') - -optional_policy(` - samba_run_net(sysadm_t, sysadm_r, admin_terminal) - samba_run_winbind_helper(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - seutil_run_setfiles(sysadm_t, sysadm_r, admin_terminal) - seutil_run_runinit(sysadm_t, sysadm_r, admin_terminal) - - ifdef(`enable_mls',` - userdom_security_admin_template(secadm_t, secadm_r, { secadm_tty_device_t sysadm_devpts_t }) - ', ` - userdom_security_admin_template(sysadm_t, sysadm_r, admin_terminal) - ') -') - -optional_policy(` - sysnet_run_ifconfig(sysadm_t, sysadm_r, admin_terminal) - sysnet_run_dhcpc(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - tripwire_run_siggen(sysadm_t, sysadm_r, admin_terminal) - tripwire_run_tripwire(sysadm_t, sysadm_r, admin_terminal) - tripwire_run_twadmin(sysadm_t, sysadm_r, admin_terminal) - tripwire_run_twprint(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - unconfined_domtrans(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - usbmodules_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - usermanage_run_admin_passwd(sysadm_t, sysadm_r, admin_terminal) - usermanage_run_groupadd(sysadm_t, sysadm_r, admin_terminal) - usermanage_run_useradd(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - vpn_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - webalizer_run(sysadm_t, sysadm_r, admin_terminal) -') - -optional_policy(` - yam_run(sysadm_t, sysadm_r, admin_terminal) -') diff --git a/policy/modules/system/xen.te b/policy/modules/system/xen.te index 45e0a64b..d58ca23d 100644 --- a/policy/modules/system/xen.te +++ b/policy/modules/system/xen.te @@ -1,5 +1,5 @@ -policy_module(xen,1.6.0) +policy_module(xen,1.6.1) ######################################## # @@ -207,12 +207,12 @@ sysnet_delete_dhcpc_pid(xend_t) sysnet_read_dhcpc_pid(xend_t) sysnet_rw_dhcp_config(xend_t) -userdom_dontaudit_search_sysadm_home_dirs(xend_t) - xen_stream_connect_xenstore(xend_t) netutils_domtrans(xend_t) +sysadm_dontaudit_search_home_dirs(xend_t) + optional_policy(` consoletype_exec(xend_t) ')