- Fix role transition from unconfined_r to system_r when running rpm
- Allow unconfined_domains to communicate with user dbus instances
This commit is contained in:
Daniel J Walsh
parent
5d13344539
commit
ed3c8b6ddb
@ -2437,7 +2437,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
|
||||
# /bin
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.2.5/policy/modules/apps/mozilla.if
|
||||
--- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-10-29 07:52:48.000000000 -0400
|
||||
+++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if 2007-12-24 06:47:25.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if 2007-12-26 18:15:18.000000000 -0500
|
||||
@@ -35,7 +35,10 @@
|
||||
template(`mozilla_per_role_template',`
|
||||
gen_require(`
|
||||
@ -4446,7 +4446,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
+')
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.2.5/policy/modules/services/apache.te
|
||||
--- nsaserefpolicy/policy/modules/services/apache.te 2007-12-19 05:32:17.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/apache.te 2007-12-19 05:38:09.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/apache.te 2007-12-26 19:16:19.000000000 -0500
|
||||
@@ -20,6 +20,8 @@
|
||||
# Declarations
|
||||
#
|
||||
@ -4643,7 +4643,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
tunable_policy(`httpd_ssi_exec',`
|
||||
corecmd_shell_domtrans(httpd_t,httpd_sys_script_t)
|
||||
allow httpd_sys_script_t httpd_t:fd use;
|
||||
@@ -437,8 +505,14 @@
|
||||
@@ -425,6 +493,10 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
+ application_exec(httpd_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
calamaris_read_www_files(httpd_t)
|
||||
')
|
||||
|
||||
@@ -437,8 +509,14 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -4659,7 +4670,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -450,19 +524,13 @@
|
||||
@@ -450,19 +528,13 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -4680,7 +4691,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -472,13 +540,14 @@
|
||||
@@ -472,13 +544,14 @@
|
||||
openca_kill(httpd_t)
|
||||
')
|
||||
|
||||
@ -4699,7 +4710,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -486,6 +555,7 @@
|
||||
@@ -486,6 +559,7 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -4707,7 +4718,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
|
||||
snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
|
||||
')
|
||||
@@ -521,6 +591,13 @@
|
||||
@@ -521,6 +595,13 @@
|
||||
userdom_use_sysadm_terms(httpd_helper_t)
|
||||
')
|
||||
|
||||
@ -4721,7 +4732,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
########################################
|
||||
#
|
||||
# Apache PHP script local policy
|
||||
@@ -550,18 +627,24 @@
|
||||
@@ -550,18 +631,24 @@
|
||||
|
||||
fs_search_auto_mountpoints(httpd_php_t)
|
||||
|
||||
@ -4749,7 +4760,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -585,6 +668,8 @@
|
||||
@@ -585,6 +672,8 @@
|
||||
manage_files_pattern(httpd_suexec_t,httpd_suexec_tmp_t,httpd_suexec_tmp_t)
|
||||
files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir })
|
||||
|
||||
@ -4758,7 +4769,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
kernel_read_kernel_sysctls(httpd_suexec_t)
|
||||
kernel_list_proc(httpd_suexec_t)
|
||||
kernel_read_proc_symlinks(httpd_suexec_t)
|
||||
@@ -638,6 +723,12 @@
|
||||
@@ -638,6 +727,12 @@
|
||||
fs_exec_nfs_files(httpd_suexec_t)
|
||||
')
|
||||
|
||||
@ -4771,7 +4782,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
|
||||
fs_read_cifs_files(httpd_suexec_t)
|
||||
fs_read_cifs_symlinks(httpd_suexec_t)
|
||||
@@ -655,10 +746,6 @@
|
||||
@@ -655,10 +750,6 @@
|
||||
dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
|
||||
')
|
||||
|
||||
@ -4782,7 +4793,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
########################################
|
||||
#
|
||||
# Apache system script local policy
|
||||
@@ -668,7 +755,8 @@
|
||||
@@ -668,7 +759,8 @@
|
||||
|
||||
dontaudit httpd_sys_script_t httpd_config_t:dir search;
|
||||
|
||||
@ -4792,7 +4803,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
|
||||
allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms;
|
||||
read_files_pattern(httpd_sys_script_t,squirrelmail_spool_t,squirrelmail_spool_t)
|
||||
@@ -682,15 +770,44 @@
|
||||
@@ -682,15 +774,44 @@
|
||||
# Should we add a boolean?
|
||||
apache_domtrans_rotatelogs(httpd_sys_script_t)
|
||||
|
||||
@ -4804,15 +4815,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
|
||||
-tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
|
||||
+tunable_policy(`httpd_use_nfs', `
|
||||
+ fs_read_nfs_files(httpd_sys_script_t)
|
||||
+ fs_read_nfs_symlinks(httpd_sys_script_t)
|
||||
+')
|
||||
+
|
||||
+tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs', `
|
||||
fs_read_nfs_files(httpd_sys_script_t)
|
||||
fs_read_nfs_symlinks(httpd_sys_script_t)
|
||||
')
|
||||
|
||||
+tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs', `
|
||||
+ fs_read_nfs_files(httpd_sys_script_t)
|
||||
+ fs_read_nfs_symlinks(httpd_sys_script_t)
|
||||
+')
|
||||
+
|
||||
+tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',`
|
||||
+ allow httpd_sys_script_t self:tcp_socket create_stream_socket_perms;
|
||||
+ allow httpd_sys_script_t self:udp_socket create_socket_perms;
|
||||
@ -4838,7 +4849,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
|
||||
fs_read_cifs_files(httpd_sys_script_t)
|
||||
fs_read_cifs_symlinks(httpd_sys_script_t)
|
||||
@@ -700,9 +817,15 @@
|
||||
@@ -700,9 +821,15 @@
|
||||
clamav_domtrans_clamscan(httpd_sys_script_t)
|
||||
')
|
||||
|
||||
@ -4854,7 +4865,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -724,3 +847,46 @@
|
||||
@@ -724,3 +851,46 @@
|
||||
logging_search_logs(httpd_rotatelogs_t)
|
||||
|
||||
miscfiles_read_localization(httpd_rotatelogs_t)
|
||||
@ -5473,7 +5484,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
+')
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.2.5/policy/modules/services/cron.te
|
||||
--- nsaserefpolicy/policy/modules/services/cron.te 2007-12-19 05:32:17.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/cron.te 2007-12-19 05:38:09.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/cron.te 2007-12-27 07:19:39.000000000 -0500
|
||||
@@ -50,6 +50,7 @@
|
||||
|
||||
type crond_tmp_t;
|
||||
@ -5532,7 +5543,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
|
||||
files_read_etc_files(crond_t)
|
||||
files_read_generic_spool(crond_t)
|
||||
@@ -148,7 +156,9 @@
|
||||
@@ -142,13 +150,16 @@
|
||||
files_search_default(crond_t)
|
||||
|
||||
init_rw_utmp(crond_t)
|
||||
+init_spec_domtrans_script(crond_t)
|
||||
|
||||
auth_use_nsswitch(crond_t)
|
||||
|
||||
libs_use_ld_so(crond_t)
|
||||
libs_use_shared_libs(crond_t)
|
||||
|
||||
@ -5542,7 +5560,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
|
||||
seutil_read_config(crond_t)
|
||||
seutil_read_default_contexts(crond_t)
|
||||
@@ -163,9 +173,6 @@
|
||||
@@ -163,9 +174,6 @@
|
||||
mta_send_mail(crond_t)
|
||||
|
||||
ifdef(`distro_debian',`
|
||||
@ -5552,7 +5570,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
optional_policy(`
|
||||
# Debian logcheck has the home dir set to its cache
|
||||
logwatch_search_cache_dir(crond_t)
|
||||
@@ -180,21 +187,45 @@
|
||||
@@ -180,21 +188,45 @@
|
||||
')
|
||||
')
|
||||
|
||||
@ -5599,7 +5617,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -267,9 +298,16 @@
|
||||
@@ -267,9 +299,16 @@
|
||||
filetrans_pattern(system_crond_t,crond_tmp_t,system_crond_tmp_t,{ file lnk_file })
|
||||
files_tmp_filetrans(system_crond_t,system_crond_tmp_t,file)
|
||||
|
||||
@ -5617,7 +5635,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
|
||||
kernel_read_kernel_sysctls(system_crond_t)
|
||||
kernel_read_system_state(system_crond_t)
|
||||
@@ -323,7 +361,7 @@
|
||||
@@ -323,7 +362,7 @@
|
||||
init_read_utmp(system_crond_t)
|
||||
init_dontaudit_rw_utmp(system_crond_t)
|
||||
# prelink tells init to restart it self, we either need to allow or dontaudit
|
||||
@ -5626,7 +5644,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
|
||||
auth_use_nsswitch(system_crond_t)
|
||||
|
||||
@@ -333,6 +371,7 @@
|
||||
@@ -333,6 +372,7 @@
|
||||
libs_exec_ld_so(system_crond_t)
|
||||
|
||||
logging_read_generic_logs(system_crond_t)
|
||||
@ -5634,7 +5652,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
logging_send_syslog_msg(system_crond_t)
|
||||
|
||||
miscfiles_read_localization(system_crond_t)
|
||||
@@ -383,6 +422,14 @@
|
||||
@@ -383,6 +423,14 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -5649,7 +5667,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
mrtg_append_create_logs(system_crond_t)
|
||||
')
|
||||
|
||||
@@ -415,8 +462,7 @@
|
||||
@@ -415,8 +463,7 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -5659,7 +5677,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -424,8 +470,13 @@
|
||||
@@ -424,8 +471,13 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -6031,8 +6049,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.
|
||||
-')
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.5/policy/modules/services/dbus.if
|
||||
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/dbus.if 2007-12-24 06:16:06.000000000 -0500
|
||||
@@ -91,7 +91,9 @@
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/dbus.if 2007-12-30 09:53:47.000000000 -0500
|
||||
@@ -53,6 +53,7 @@
|
||||
gen_require(`
|
||||
type system_dbusd_exec_t, system_dbusd_t, dbusd_etc_t;
|
||||
class dbus { send_msg acquire_svc };
|
||||
+ attribute dbusd_unconfined;
|
||||
')
|
||||
|
||||
##############################
|
||||
@@ -84,6 +85,9 @@
|
||||
allow $1_dbusd_t self:tcp_socket create_stream_socket_perms;
|
||||
allow $1_dbusd_t self:netlink_selinux_socket create_socket_perms;
|
||||
|
||||
+ allow dbusd_unconfined $1_dbusd_t:dbus { send_msg acquire_svc };
|
||||
+ allow $1_dbusd_t dbusd_unconfined:dbus send_msg;
|
||||
+
|
||||
# For connecting to the bus
|
||||
allow $2 $1_dbusd_t:unix_stream_socket connectto;
|
||||
type_change $2 $1_dbusd_t:dbus $1_dbusd_$1_t;
|
||||
@@ -91,7 +95,9 @@
|
||||
# SE-DBus specific permissions
|
||||
allow $1_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg;
|
||||
allow $2 $1_dbusd_t:dbus { send_msg acquire_svc };
|
||||
@ -6043,7 +6079,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
|
||||
allow $1_dbusd_t dbusd_etc_t:dir list_dir_perms;
|
||||
read_files_pattern($1_dbusd_t,dbusd_etc_t,dbusd_etc_t)
|
||||
@@ -104,8 +106,7 @@
|
||||
@@ -104,8 +110,7 @@
|
||||
domtrans_pattern($2, system_dbusd_exec_t, $1_dbusd_t)
|
||||
allow $2 $1_dbusd_t:process { sigkill signal };
|
||||
|
||||
@ -6053,7 +6089,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
allow $1_dbusd_t $2:process sigkill;
|
||||
allow $2 $1_dbusd_t:fd use;
|
||||
allow $2 $1_dbusd_t:fifo_file rw_fifo_file_perms;
|
||||
@@ -161,7 +162,9 @@
|
||||
@@ -161,7 +166,9 @@
|
||||
seutil_read_config($1_dbusd_t)
|
||||
seutil_read_default_contexts($1_dbusd_t)
|
||||
|
||||
@ -6064,7 +6100,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
|
||||
ifdef(`hide_broken_symptoms', `
|
||||
dontaudit $2 $1_dbusd_t:netlink_selinux_socket { read write };
|
||||
@@ -214,7 +217,7 @@
|
||||
@@ -214,7 +221,7 @@
|
||||
|
||||
# SE-DBus specific permissions
|
||||
# allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg;
|
||||
@ -6073,7 +6109,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
|
||||
read_files_pattern($2, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
|
||||
files_search_var_lib($2)
|
||||
@@ -263,6 +266,7 @@
|
||||
@@ -251,6 +258,7 @@
|
||||
template(`dbus_user_bus_client_template',`
|
||||
gen_require(`
|
||||
type $1_dbusd_t;
|
||||
+ attribute dbusd_unconfined;
|
||||
class dbus send_msg;
|
||||
')
|
||||
|
||||
@@ -263,6 +271,7 @@
|
||||
|
||||
# For connecting to the bus
|
||||
allow $3 $1_dbusd_t:unix_stream_socket connectto;
|
||||
@ -6081,7 +6125,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -292,6 +296,59 @@
|
||||
@@ -292,6 +301,59 @@
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
@ -6141,7 +6185,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus
|
||||
## Read dbus configuration.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
@@ -366,3 +423,53 @@
|
||||
@@ -366,3 +428,53 @@
|
||||
|
||||
allow $1 system_dbusd_t:dbus *;
|
||||
')
|
||||
@ -7328,7 +7372,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail
|
||||
+files_type(mailscanner_spool_t)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.2.5/policy/modules/services/mta.if
|
||||
--- nsaserefpolicy/policy/modules/services/mta.if 2007-12-06 13:12:03.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/mta.if 2007-12-19 05:38:09.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/mta.if 2007-12-27 11:44:00.000000000 -0500
|
||||
@@ -133,6 +133,12 @@
|
||||
sendmail_create_log($1_mail_t)
|
||||
')
|
||||
@ -7415,7 +7459,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -438,20 +491,18 @@
|
||||
@@ -422,6 +475,7 @@
|
||||
# apache should set close-on-exec
|
||||
apache_dontaudit_rw_stream_sockets($1)
|
||||
apache_dontaudit_rw_sys_script_stream_sockets($1)
|
||||
+ apache_append_log($1)
|
||||
')
|
||||
')
|
||||
|
||||
@@ -438,20 +492,18 @@
|
||||
interface(`mta_send_mail',`
|
||||
gen_require(`
|
||||
attribute mta_user_agent;
|
||||
@ -7442,7 +7494,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -586,6 +637,25 @@
|
||||
@@ -586,6 +638,25 @@
|
||||
files_search_etc($1)
|
||||
allow $1 etc_aliases_t:file { rw_file_perms setattr };
|
||||
')
|
||||
@ -7468,6 +7520,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.
|
||||
|
||||
#######################################
|
||||
## <summary>
|
||||
@@ -837,6 +908,25 @@
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
+## read mail queue files.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed access.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+interface(`mta_read_queue',`
|
||||
+ gen_require(`
|
||||
+ type mqueue_spool_t;
|
||||
+ ')
|
||||
+
|
||||
+ files_search_spool($1)
|
||||
+ read_files_pattern($1,mqueue_spool_t,mqueue_spool_t)
|
||||
+')
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
## Create, read, write, and delete
|
||||
## mail queue files.
|
||||
## </summary>
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.2.5/policy/modules/services/mta.te
|
||||
--- nsaserefpolicy/policy/modules/services/mta.te 2007-12-19 05:32:17.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/mta.te 2007-12-19 05:38:09.000000000 -0500
|
||||
@ -7878,13 +7956,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw
|
||||
+/var/log/wpa_supplicant\.log -- gen_context(system_u:object_r:NetworkManager_log_t,s0)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.2.5/policy/modules/services/networkmanager.te
|
||||
--- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-12-19 05:32:17.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/networkmanager.te 2007-12-19 05:38:09.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/networkmanager.te 2007-12-26 20:31:36.000000000 -0500
|
||||
@@ -13,6 +13,9 @@
|
||||
type NetworkManager_var_run_t;
|
||||
files_pid_file(NetworkManager_var_run_t)
|
||||
|
||||
+type NetworkManager_log_t;
|
||||
+files_pid_file(NetworkManager_log_t)
|
||||
+logging_log_file(NetworkManager_log_t)
|
||||
+
|
||||
########################################
|
||||
#
|
||||
@ -8891,8 +8969,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.
|
||||
optional_policy(`
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.2.5/policy/modules/services/procmail.te
|
||||
--- nsaserefpolicy/policy/modules/services/procmail.te 2007-12-19 05:32:17.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/procmail.te 2007-12-19 05:38:09.000000000 -0500
|
||||
@@ -133,3 +133,7 @@
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/procmail.te 2007-12-26 18:16:54.000000000 -0500
|
||||
@@ -129,7 +129,12 @@
|
||||
corenet_udp_bind_generic_port(procmail_t)
|
||||
corenet_dontaudit_udp_bind_all_ports(procmail_t)
|
||||
|
||||
+ spamassassin_read_user_home_files(procmail_t)
|
||||
spamassassin_exec(procmail_t)
|
||||
spamassassin_exec_client(procmail_t)
|
||||
spamassassin_read_lib_files(procmail_t)
|
||||
')
|
||||
@ -8942,7 +9025,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo
|
||||
########################################
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.2.5/policy/modules/services/pyzor.te
|
||||
--- nsaserefpolicy/policy/modules/services/pyzor.te 2007-12-19 05:32:17.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/pyzor.te 2007-12-19 05:38:09.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/pyzor.te 2007-12-27 11:44:33.000000000 -0500
|
||||
@@ -28,6 +28,9 @@
|
||||
type pyzor_var_lib_t;
|
||||
files_type(pyzor_var_lib_t)
|
||||
@ -8953,6 +9036,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo
|
||||
########################################
|
||||
#
|
||||
# Pyzor local policy
|
||||
@@ -68,6 +71,8 @@
|
||||
|
||||
miscfiles_read_localization(pyzor_t)
|
||||
|
||||
+mta_read_queue(pyzor_t)
|
||||
+
|
||||
userdom_dontaudit_search_sysadm_home_dirs(pyzor_t)
|
||||
|
||||
optional_policy(`
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.fc serefpolicy-3.2.5/policy/modules/services/razor.fc
|
||||
--- nsaserefpolicy/policy/modules/services/razor.fc 2007-10-12 08:56:07.000000000 -0400
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/razor.fc 2007-12-19 05:38:09.000000000 -0500
|
||||
@ -10149,7 +10241,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
|
||||
/usr/bin/spamassassin -- gen_context(system_u:object_r:spamassassin_exec_t,s0)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-3.2.5/policy/modules/services/spamassassin.if
|
||||
--- nsaserefpolicy/policy/modules/services/spamassassin.if 2007-10-12 08:56:07.000000000 -0400
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/spamassassin.if 2007-12-19 05:38:09.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/spamassassin.if 2007-12-26 18:16:14.000000000 -0500
|
||||
@@ -38,6 +38,8 @@
|
||||
gen_require(`
|
||||
type spamc_exec_t, spamassassin_exec_t;
|
||||
@ -10253,7 +10345,56 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
|
||||
|
||||
kernel_read_kernel_sysctls($1_spamassassin_t)
|
||||
|
||||
@@ -528,3 +526,21 @@
|
||||
@@ -407,6 +405,40 @@
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
+## Read spamassassin per user homedir
|
||||
+## </summary>
|
||||
+## <desc>
|
||||
+## <p>
|
||||
+## Read spamassassin per user homedir
|
||||
+## </p>
|
||||
+## <p>
|
||||
+## This is a templated interface, and should only
|
||||
+## be called from a per-userdomain template.
|
||||
+## </p>
|
||||
+## </desc>
|
||||
+## <param name="userdomain_prefix">
|
||||
+## <summary>
|
||||
+## The prefix of the user domain (e.g., user
|
||||
+## is the prefix for user_t).
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain allowed access.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+template(`spamassassin_read_user_home_files',`
|
||||
+ gen_require(`
|
||||
+ type user_spamassassin_home_t;
|
||||
+ ')
|
||||
+
|
||||
+ allow $1 user_spamassassin_home_t:dir list_dir_perms;
|
||||
+ allow $1 user_spamassassin_home_t:file read_file_perms;
|
||||
+')
|
||||
+
|
||||
+########################################
|
||||
+## <summary>
|
||||
## Execute the spamassassin client
|
||||
## program in the caller directory.
|
||||
## </summary>
|
||||
@@ -469,6 +501,7 @@
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
+ read_dirs_pattern($1,spamd_var_lib_t,spamd_var_lib_t)
|
||||
read_files_pattern($1,spamd_var_lib_t,spamd_var_lib_t)
|
||||
')
|
||||
|
||||
@@ -528,3 +561,22 @@
|
||||
|
||||
dontaudit $1 spamd_tmp_t:sock_file getattr;
|
||||
')
|
||||
@ -10275,6 +10416,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam
|
||||
+
|
||||
+ stream_connect_pattern($1,spamd_var_run_t,spamd_var_run_t,spamd_t)
|
||||
+')
|
||||
+
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.2.5/policy/modules/services/spamassassin.te
|
||||
--- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-12-19 05:32:17.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/spamassassin.te 2007-12-19 05:38:09.000000000 -0500
|
||||
@ -10812,7 +10954,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.2.5/policy/modules/services/xserver.if
|
||||
--- nsaserefpolicy/policy/modules/services/xserver.if 2007-12-04 11:02:50.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/xserver.if 2007-12-19 05:38:09.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/services/xserver.if 2007-12-27 11:37:04.000000000 -0500
|
||||
@@ -45,7 +45,7 @@
|
||||
# execheap needed until the X module loader is fixed.
|
||||
# NVIDIA Needs execstack
|
||||
@ -10822,7 +10964,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
dontaudit $1_xserver_t self:capability chown;
|
||||
allow $1_xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
|
||||
allow $1_xserver_t self:memprotect mmap_zero;
|
||||
@@ -115,8 +115,7 @@
|
||||
@@ -115,18 +115,23 @@
|
||||
dev_rw_agp($1_xserver_t)
|
||||
dev_rw_framebuffer($1_xserver_t)
|
||||
dev_manage_dri_dev($1_xserver_t)
|
||||
@ -10832,7 +10974,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
# raw memory access is needed if not using the frame buffer
|
||||
dev_read_raw_memory($1_xserver_t)
|
||||
dev_wx_raw_memory($1_xserver_t)
|
||||
@@ -125,8 +124,13 @@
|
||||
# for other device nodes such as the NVidia binary-only driver
|
||||
dev_rw_xserver_misc($1_xserver_t)
|
||||
+ dev_setattr_xserver_misc_dev($1_xserver_t)
|
||||
# read events - the synaptics touchpad driver reads raw events
|
||||
dev_rw_input_dev($1_xserver_t)
|
||||
dev_rwx_zero($1_xserver_t)
|
||||
@ -10846,7 +10990,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
|
||||
files_read_etc_files($1_xserver_t)
|
||||
files_read_etc_runtime_files($1_xserver_t)
|
||||
@@ -140,12 +144,16 @@
|
||||
@@ -140,12 +145,16 @@
|
||||
fs_getattr_xattr_fs($1_xserver_t)
|
||||
fs_search_nfs($1_xserver_t)
|
||||
fs_search_auto_mountpoints($1_xserver_t)
|
||||
@ -10864,7 +11008,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
term_setattr_unallocated_ttys($1_xserver_t)
|
||||
term_use_unallocated_ttys($1_xserver_t)
|
||||
|
||||
@@ -232,39 +240,26 @@
|
||||
@@ -232,39 +241,26 @@
|
||||
# Declarations
|
||||
#
|
||||
|
||||
@ -10911,7 +11055,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
##############################
|
||||
#
|
||||
# $1_xserver_t Local policy
|
||||
@@ -272,12 +267,15 @@
|
||||
@@ -272,12 +268,15 @@
|
||||
|
||||
domtrans_pattern($1_xserver_t, xauth_exec_t, $1_xauth_t)
|
||||
|
||||
@ -10928,7 +11072,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
|
||||
manage_dirs_pattern($2,$1_fonts_t,$1_fonts_t)
|
||||
manage_files_pattern($2,$1_fonts_t,$1_fonts_t)
|
||||
@@ -307,6 +305,7 @@
|
||||
@@ -307,6 +306,7 @@
|
||||
userdom_use_user_ttys($1,$1_xserver_t)
|
||||
userdom_setattr_user_ttys($1,$1_xserver_t)
|
||||
userdom_rw_user_tmpfs_files($1,$1_xserver_t)
|
||||
@ -10936,7 +11080,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
|
||||
xserver_use_user_fonts($1,$1_xserver_t)
|
||||
xserver_rw_xdm_tmp_files($1_xauth_t)
|
||||
@@ -330,12 +329,12 @@
|
||||
@@ -330,12 +330,12 @@
|
||||
allow $1_xauth_t self:process signal;
|
||||
allow $1_xauth_t self:unix_stream_socket create_stream_socket_perms;
|
||||
|
||||
@ -10954,7 +11098,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
|
||||
domtrans_pattern($2, xauth_exec_t, $1_xauth_t)
|
||||
|
||||
@@ -344,12 +343,6 @@
|
||||
@@ -344,12 +344,6 @@
|
||||
# allow ps to show xauth
|
||||
ps_process_pattern($2,$1_xauth_t)
|
||||
|
||||
@ -10967,7 +11111,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
domain_use_interactive_fds($1_xauth_t)
|
||||
|
||||
files_read_etc_files($1_xauth_t)
|
||||
@@ -378,6 +371,14 @@
|
||||
@@ -378,6 +372,14 @@
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -10982,7 +11126,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
ssh_sigchld($1_xauth_t)
|
||||
ssh_read_pipes($1_xauth_t)
|
||||
ssh_dontaudit_rw_tcp_sockets($1_xauth_t)
|
||||
@@ -390,16 +391,16 @@
|
||||
@@ -390,16 +392,16 @@
|
||||
|
||||
domtrans_pattern($2, iceauth_exec_t, $1_iceauth_t)
|
||||
|
||||
@ -11004,7 +11148,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
|
||||
fs_search_auto_mountpoints($1_iceauth_t)
|
||||
|
||||
@@ -523,17 +524,16 @@
|
||||
@@ -523,17 +525,16 @@
|
||||
template(`xserver_user_client_template',`
|
||||
|
||||
gen_require(`
|
||||
@ -11029,7 +11173,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
|
||||
# for when /tmp/.X11-unix is created by the system
|
||||
allow $2 xdm_t:fd use;
|
||||
@@ -542,25 +542,55 @@
|
||||
@@ -542,25 +543,55 @@
|
||||
allow $2 xdm_tmp_t:sock_file { read write };
|
||||
dontaudit $2 xdm_t:tcp_socket { read write };
|
||||
|
||||
@ -11093,7 +11237,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
')
|
||||
')
|
||||
|
||||
@@ -613,6 +643,24 @@
|
||||
@@ -613,6 +644,24 @@
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
@ -11118,7 +11262,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
## Transition to a user Xauthority domain.
|
||||
## </summary>
|
||||
## <desc>
|
||||
@@ -646,6 +694,73 @@
|
||||
@@ -646,6 +695,73 @@
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
@ -11192,7 +11336,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
## Transition to a user Xauthority domain.
|
||||
## </summary>
|
||||
## <desc>
|
||||
@@ -671,10 +786,10 @@
|
||||
@@ -671,10 +787,10 @@
|
||||
#
|
||||
template(`xserver_user_home_dir_filetrans_user_xauth',`
|
||||
gen_require(`
|
||||
@ -11205,7 +11349,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -760,7 +875,7 @@
|
||||
@@ -760,7 +876,7 @@
|
||||
type xconsole_device_t;
|
||||
')
|
||||
|
||||
@ -11214,7 +11358,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -860,6 +975,25 @@
|
||||
@@ -860,6 +976,25 @@
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
@ -11240,7 +11384,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
## Read xdm-writable configuration files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
@@ -914,6 +1048,7 @@
|
||||
@@ -914,6 +1049,7 @@
|
||||
files_search_tmp($1)
|
||||
allow $1 xdm_tmp_t:dir list_dir_perms;
|
||||
create_sock_files_pattern($1,xdm_tmp_t,xdm_tmp_t)
|
||||
@ -11248,7 +11392,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -974,6 +1109,37 @@
|
||||
@@ -974,6 +1110,37 @@
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
@ -11286,7 +11430,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
## Make an X session script an entrypoint for the specified domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
@@ -1123,7 +1289,7 @@
|
||||
@@ -1123,7 +1290,7 @@
|
||||
type xdm_xserver_tmp_t;
|
||||
')
|
||||
|
||||
@ -11295,7 +11439,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1312,3 +1478,45 @@
|
||||
@@ -1312,3 +1479,45 @@
|
||||
files_search_tmp($1)
|
||||
stream_connect_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t,xdm_xserver_t)
|
||||
')
|
||||
@ -12467,8 +12611,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.
|
||||
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.2.5/policy/modules/system/libraries.fc
|
||||
--- nsaserefpolicy/policy/modules/system/libraries.fc 2007-12-12 11:35:28.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/system/libraries.fc 2007-12-19 05:38:09.000000000 -0500
|
||||
@@ -292,6 +292,8 @@
|
||||
+++ serefpolicy-3.2.5/policy/modules/system/libraries.fc 2007-12-27 11:40:35.000000000 -0500
|
||||
@@ -183,6 +183,7 @@
|
||||
/usr/lib(64)?/libdv\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/helix/plugins/[^/]*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/helix/codecs/[^/]*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
+/usr/lib(64)?/libswscale\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/libSDL-.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/xorg/modules/dri/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/X11R6/lib/modules/dri/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
@@ -242,7 +243,8 @@
|
||||
|
||||
# Flash plugin, Macromedia
|
||||
HOME_DIR/\.mozilla(/.*)?/plugins/libflashplayer\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
-HOME_DIR/.*/plugins/libflashplayer\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
+HOME_DIR/\.mozilla(/.*)?/plugins/libflashplayer\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
+HOME_DIR/.*/plugins/nppdf\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/lib(64)?/.*/libflashplayer\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
/usr/local/(.*/)?libflashplayer\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
HOME_DIR/.*/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
|
||||
@@ -292,6 +294,8 @@
|
||||
#
|
||||
# /var
|
||||
#
|
||||
@ -12477,6 +12639,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar
|
||||
/var/ftp/lib(64)?(/.*)? gen_context(system_u:object_r:lib_t,s0)
|
||||
/var/ftp/lib(64)?/ld[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:ld_so_t,s0)
|
||||
|
||||
@@ -304,3 +308,4 @@
|
||||
/var/spool/postfix/lib(64)?(/.*)? gen_context(system_u:object_r:lib_t,s0)
|
||||
/var/spool/postfix/usr(/.*)? gen_context(system_u:object_r:lib_t,s0)
|
||||
/var/spool/postfix/lib(64)?/ld.*\.so.* -- gen_context(system_u:object_r:ld_so_t,s0)
|
||||
+
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.2.5/policy/modules/system/libraries.te
|
||||
--- nsaserefpolicy/policy/modules/system/libraries.te 2007-12-19 05:32:17.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/system/libraries.te 2007-12-19 05:38:09.000000000 -0500
|
||||
@ -12710,7 +12877,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
|
||||
+
|
||||
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.2.5/policy/modules/system/logging.te
|
||||
--- nsaserefpolicy/policy/modules/system/logging.te 2007-12-19 05:32:17.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/system/logging.te 2007-12-19 05:38:09.000000000 -0500
|
||||
+++ serefpolicy-3.2.5/policy/modules/system/logging.te 2007-12-25 07:00:24.000000000 -0500
|
||||
@@ -61,6 +61,12 @@
|
||||
logging_log_file(var_log_t)
|
||||
files_mountpoint(var_log_t)
|
||||
@ -12724,7 +12891,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin
|
||||
ifdef(`enable_mls',`
|
||||
init_ranged_daemon_domain(auditd_t,auditd_exec_t,mls_systemhigh)
|
||||
')
|
||||
@@ -202,6 +208,7 @@
|
||||
@@ -165,6 +171,10 @@
|
||||
userdom_dontaudit_search_sysadm_home_dirs(auditd_t)
|
||||
|
||||
optional_policy(`
|
||||
+ mta_send_mail(auditd_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
seutil_sigchld_newrole(auditd_t)
|
||||
')
|
||||
|
||||
@@ -202,6 +212,7 @@
|
||||
|
||||
fs_getattr_all_fs(klogd_t)
|
||||
fs_search_auto_mountpoints(klogd_t)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user