- New labels for ghc http content
- nsplugin_config needs to read urand, lvm now calls setfscreate to create dev - pm-suspend now creates log file for append access so we remove devicekit_wri - Change authlogin_use_sssd to authlogin_nsswitch_use_ldap - Fixes for greylist_milter policy
This commit is contained in:
Dan Walsh
parent
c68e37c2c7
commit
ef836a9861
159
policy-F15.patch
159
policy-F15.patch
|
|
@ -5109,10 +5109,10 @@ index 0000000..4f9cb05
|
|||
+')
|
||||
diff --git a/policy/modules/apps/nsplugin.te b/policy/modules/apps/nsplugin.te
|
||||
new file mode 100644
|
||||
index 0000000..aedbcbe
|
||||
index 0000000..ae1d09b
|
||||
--- /dev/null
|
||||
+++ b/policy/modules/apps/nsplugin.te
|
||||
@@ -0,0 +1,315 @@
|
||||
@@ -0,0 +1,316 @@
|
||||
+policy_module(nsplugin, 1.0.0)
|
||||
+
|
||||
+########################################
|
||||
|
|
@ -5343,6 +5343,7 @@ index 0000000..aedbcbe
|
|||
+allow nsplugin_config_t self:fifo_file rw_file_perms;
|
||||
+allow nsplugin_config_t self:unix_stream_socket create_stream_socket_perms;
|
||||
+
|
||||
+dev_read_urand(nsplugin_config_t)
|
||||
+dev_dontaudit_read_rand(nsplugin_config_t)
|
||||
+dev_dontaudit_rw_dri(nsplugin_config_t)
|
||||
+
|
||||
|
|
@ -7846,7 +7847,7 @@ index 82842a0..4111a1d 100644
|
|||
dbus_system_bus_client($1_wm_t)
|
||||
dbus_session_bus_client($1_wm_t)
|
||||
diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
|
||||
index 34c9d01..93e0ee8 100644
|
||||
index 34c9d01..d858795 100644
|
||||
--- a/policy/modules/kernel/corecommands.fc
|
||||
+++ b/policy/modules/kernel/corecommands.fc
|
||||
@@ -72,7 +72,9 @@ ifdef(`distro_redhat',`
|
||||
|
|
@ -7887,7 +7888,11 @@ index 34c9d01..93e0ee8 100644
|
|||
/usr/lib/vmware-tools/(s)?bin32(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/lib/vmware-tools/(s)?bin64(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/authconfig/authconfig-gtk\.py -- gen_context(system_u:object_r:bin_t,s0)
|
||||
@@ -319,6 +324,7 @@ ifdef(`distro_redhat', `
|
||||
@@ -316,9 +321,11 @@ ifdef(`distro_redhat', `
|
||||
/usr/share/clamav/clamd-gen -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/clamav/freshclam-sleep -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/createrepo(/.*)? gen_context(system_u:object_r:bin_t,s0)
|
||||
+/usr/share/doc/ghc/html/libraries/gen_contents_index -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/fedora-usermgmt/wrapper -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/hplip/[^/]* -- gen_context(system_u:object_r:bin_t,s0)
|
||||
/usr/share/hwbrowser/hwbrowser -- gen_context(system_u:object_r:bin_t,s0)
|
||||
|
|
@ -8003,7 +8008,7 @@ index b06df19..c0763c2 100644
|
|||
## </summary>
|
||||
## <param name="domain">
|
||||
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
|
||||
index edefaf3..e00278f 100644
|
||||
index edefaf3..7548158 100644
|
||||
--- a/policy/modules/kernel/corenetwork.te.in
|
||||
+++ b/policy/modules/kernel/corenetwork.te.in
|
||||
@@ -15,6 +15,7 @@ attribute rpc_port_type;
|
||||
|
|
@ -8094,7 +8099,7 @@ index edefaf3..e00278f 100644
|
|||
network_port(i18n_input, tcp,9010,s0)
|
||||
network_port(imaze, tcp,5323,s0, udp,5323,s0)
|
||||
network_port(inetd_child, tcp,1,s0, udp,1,s0, tcp,7,s0, udp,7,s0, tcp,9,s0, udp,9,s0, tcp,13,s0, udp,13,s0, tcp,19,s0, udp,19,s0, tcp,37,s0, udp,37,s0, tcp,512,s0, tcp,543,s0, tcp,544,s0, tcp,891,s0, udp,891,s0, tcp,892,s0, udp,892,s0, tcp,2105,s0, tcp,5666,s0)
|
||||
@@ -125,30 +147,34 @@ network_port(iscsi, tcp,3260,s0)
|
||||
@@ -125,30 +147,35 @@ network_port(iscsi, tcp,3260,s0)
|
||||
network_port(isns, tcp,3205,s0, udp,3205,s0)
|
||||
network_port(jabber_client, tcp,5222,s0, tcp,5223,s0)
|
||||
network_port(jabber_interserver, tcp,5269,s0)
|
||||
|
|
@ -8116,6 +8121,7 @@ index edefaf3..e00278f 100644
|
|||
network_port(memcache, tcp,11211,s0, udp,11211,s0)
|
||||
network_port(mmcc, tcp,5050,s0, udp,5050,s0)
|
||||
network_port(monopd, tcp,1234,s0)
|
||||
+network_port(movaz_ssc, tcp,5252,s0)
|
||||
+network_port(mpd, tcp,6600,s0)
|
||||
network_port(msnp, tcp,1863,s0, udp,1863,s0)
|
||||
-network_port(mssql, tcp,1433,s0, tcp,1434,s0, udp,1433,s0, udp,1434,s0)
|
||||
|
|
@ -8133,7 +8139,7 @@ index edefaf3..e00278f 100644
|
|||
network_port(ntp, udp,123,s0)
|
||||
network_port(ocsp, tcp,9080,s0)
|
||||
network_port(openvpn, tcp,1194,s0, udp,1194,s0)
|
||||
@@ -156,12 +182,20 @@ network_port(pegasus_http, tcp,5988,s0)
|
||||
@@ -156,12 +183,20 @@ network_port(pegasus_http, tcp,5988,s0)
|
||||
network_port(pegasus_https, tcp,5989,s0)
|
||||
network_port(pgpkeyserver, udp, 11371,s0, tcp,11371,s0)
|
||||
network_port(pingd, tcp,9125,s0)
|
||||
|
|
@ -8154,7 +8160,7 @@ index edefaf3..e00278f 100644
|
|||
network_port(printer, tcp,515,s0)
|
||||
network_port(ptal, tcp,5703,s0)
|
||||
network_port(pulseaudio, tcp,4713,s0)
|
||||
@@ -176,43 +210,49 @@ network_port(ricci, tcp,11111,s0, udp,11111,s0)
|
||||
@@ -176,43 +211,49 @@ network_port(ricci, tcp,11111,s0, udp,11111,s0)
|
||||
network_port(ricci_modcluster, tcp,16851,s0, udp,16851,s0)
|
||||
network_port(rlogind, tcp,513,s0)
|
||||
network_port(rndc, tcp,953,s0)
|
||||
|
|
@ -14200,7 +14206,7 @@ index c3a1903..b0e48c6 100644
|
|||
corenet_all_recvfrom_unlabeled(amavis_t)
|
||||
corenet_all_recvfrom_netlabel(amavis_t)
|
||||
diff --git a/policy/modules/services/apache.fc b/policy/modules/services/apache.fc
|
||||
index 9e39aa5..3bfac20 100644
|
||||
index 9e39aa5..7ba3b11 100644
|
||||
--- a/policy/modules/services/apache.fc
|
||||
+++ b/policy/modules/services/apache.fc
|
||||
@@ -2,7 +2,7 @@ HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_u
|
||||
|
|
@ -14220,17 +14226,19 @@ index 9e39aa5..3bfac20 100644
|
|||
/usr/lib(64)?/apache(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0)
|
||||
/usr/lib(64)?/apache2/modules(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0)
|
||||
/usr/lib(64)?/apache(2)?/suexec(2)? -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0)
|
||||
@@ -43,8 +42,7 @@ ifdef(`distro_suse', `
|
||||
@@ -43,8 +42,9 @@ ifdef(`distro_suse', `
|
||||
/usr/sbin/httpd2-.* -- gen_context(system_u:object_r:httpd_exec_t,s0)
|
||||
')
|
||||
|
||||
-/usr/share/dirsrv(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
|
||||
-/usr/share/drupal(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
|
||||
+/usr/share/drupal(6)?(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
|
||||
+/usr/share/doc/ghc/html(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
|
||||
+
|
||||
/usr/share/htdig(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
|
||||
/usr/share/icecast(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
|
||||
/usr/share/mythweb(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
|
||||
@@ -74,7 +72,8 @@ ifdef(`distro_suse', `
|
||||
@@ -74,7 +74,8 @@ ifdef(`distro_suse', `
|
||||
|
||||
/var/lib/cacti/rra(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
|
||||
/var/lib/dav(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0)
|
||||
|
|
@ -14240,7 +14248,7 @@ index 9e39aa5..3bfac20 100644
|
|||
/var/lib/htdig(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
|
||||
/var/lib/httpd(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0)
|
||||
/var/lib/php/session(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0)
|
||||
@@ -86,7 +85,6 @@ ifdef(`distro_suse', `
|
||||
@@ -86,7 +87,6 @@ ifdef(`distro_suse', `
|
||||
/var/log/cgiwrap\.log.* -- gen_context(system_u:object_r:httpd_log_t,s0)
|
||||
/var/log/httpd(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
|
||||
/var/log/lighttpd(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
|
||||
|
|
@ -14248,7 +14256,7 @@ index 9e39aa5..3bfac20 100644
|
|||
|
||||
ifdef(`distro_debian', `
|
||||
/var/log/horde2(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
|
||||
@@ -109,3 +107,22 @@ ifdef(`distro_debian', `
|
||||
@@ -109,3 +109,22 @@ ifdef(`distro_debian', `
|
||||
/var/www/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0)
|
||||
/var/www/icons(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
|
||||
/var/www/perl(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0)
|
||||
|
|
@ -20208,7 +20216,7 @@ index 418a5a0..28d9e41 100644
|
|||
/var/run/udisks(/.*)? gen_context(system_u:object_r:devicekit_var_run_t,s0)
|
||||
/var/run/upower(/.*)? gen_context(system_u:object_r:devicekit_var_run_t,s0)
|
||||
diff --git a/policy/modules/services/devicekit.if b/policy/modules/services/devicekit.if
|
||||
index f706b99..20efe4a 100644
|
||||
index f706b99..22b862e 100644
|
||||
--- a/policy/modules/services/devicekit.if
|
||||
+++ b/policy/modules/services/devicekit.if
|
||||
@@ -5,9 +5,9 @@
|
||||
|
|
@ -20223,29 +20231,10 @@ index f706b99..20efe4a 100644
|
|||
## </param>
|
||||
#
|
||||
interface(`devicekit_domtrans',`
|
||||
@@ -118,6 +118,63 @@ interface(`devicekit_dbus_chat_power',`
|
||||
@@ -118,6 +118,44 @@ interface(`devicekit_dbus_chat_power',`
|
||||
allow devicekit_power_t $1:dbus send_msg;
|
||||
')
|
||||
|
||||
+######################################
|
||||
+## <summary>
|
||||
+## Allow to write the devicekit
|
||||
+## log files.
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain to not audit.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+interface(`devicekit_write_log',`
|
||||
+ gen_require(`
|
||||
+ type devicekit_var_log_t;
|
||||
+ ')
|
||||
+
|
||||
+ allow $1 devicekit_var_log_t:file { write };
|
||||
+')
|
||||
+
|
||||
+#######################################
|
||||
+## <summary>
|
||||
+## Do not audit attempts to write the devicekit
|
||||
|
|
@ -20287,7 +20276,7 @@ index f706b99..20efe4a 100644
|
|||
########################################
|
||||
## <summary>
|
||||
## Read devicekit PID files.
|
||||
@@ -139,22 +196,52 @@ interface(`devicekit_read_pid_files',`
|
||||
@@ -139,22 +177,52 @@ interface(`devicekit_read_pid_files',`
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
|
|
@ -20347,7 +20336,7 @@ index f706b99..20efe4a 100644
|
|||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
@@ -165,21 +252,22 @@ interface(`devicekit_admin',`
|
||||
@@ -165,21 +233,21 @@ interface(`devicekit_admin',`
|
||||
type devicekit_var_lib_t, devicekit_var_run_t, devicekit_tmp_t;
|
||||
')
|
||||
|
||||
|
|
@ -20375,7 +20364,6 @@ index f706b99..20efe4a 100644
|
|||
- files_search_pids($1)
|
||||
+ files_list_pids($1)
|
||||
')
|
||||
+
|
||||
diff --git a/policy/modules/services/devicekit.te b/policy/modules/services/devicekit.te
|
||||
index f231f17..4ecd4b7 100644
|
||||
--- a/policy/modules/services/devicekit.te
|
||||
|
|
@ -24961,7 +24949,7 @@ index ed1af3c..40b5f0e 100644
|
|||
+ delete_files_pattern($1, dkim_milter_data_t, dkim_milter_data_t)
|
||||
+')
|
||||
diff --git a/policy/modules/services/milter.te b/policy/modules/services/milter.te
|
||||
index 47e3612..98801a7 100644
|
||||
index 47e3612..ece07ab 100644
|
||||
--- a/policy/modules/services/milter.te
|
||||
+++ b/policy/modules/services/milter.te
|
||||
@@ -9,6 +9,13 @@ policy_module(milter, 1.3.0)
|
||||
|
|
@ -25009,7 +24997,27 @@ index 47e3612..98801a7 100644
|
|||
#
|
||||
|
||||
# It removes any existing socket (not owned by root) whilst running as root,
|
||||
@@ -52,8 +76,8 @@ mta_read_config(greylist_milter_t)
|
||||
@@ -33,11 +57,19 @@ files_type(spamass_milter_state_t)
|
||||
allow greylist_milter_t self:capability { chown dac_override setgid setuid sys_nice };
|
||||
allow greylist_milter_t self:process { setsched getsched };
|
||||
|
||||
+allow greylist_milter_t self:tcp_socket create_stream_socket_perms;
|
||||
+
|
||||
# It creates a pid file /var/run/milter-greylist.pid
|
||||
files_pid_filetrans(greylist_milter_t, greylist_milter_data_t, file)
|
||||
|
||||
kernel_read_kernel_sysctls(greylist_milter_t)
|
||||
|
||||
+corecmd_exec_bin(greylist_milter_t)
|
||||
+corecmd_exec_shell(greylist_milter_t)
|
||||
+
|
||||
+corenet_tcp_bind_movaz_ssc_port(greylist_milter_t)
|
||||
+corenet_tcp_connect_movaz_ssc_port(greylist_milter_t)
|
||||
+
|
||||
# Allow the milter to read a GeoIP database in /usr/share
|
||||
files_read_usr_files(greylist_milter_t)
|
||||
# The milter runs from /var/lib/milter-greylist and maintains files there
|
||||
@@ -52,8 +84,8 @@ mta_read_config(greylist_milter_t)
|
||||
########################################
|
||||
#
|
||||
# milter-regex local policy
|
||||
|
|
@ -25020,7 +25028,7 @@ index 47e3612..98801a7 100644
|
|||
#
|
||||
|
||||
# It removes any existing socket (not owned by root) whilst running as root
|
||||
@@ -72,8 +96,8 @@ mta_read_config(regex_milter_t)
|
||||
@@ -72,8 +104,8 @@ mta_read_config(regex_milter_t)
|
||||
########################################
|
||||
#
|
||||
# spamass-milter local policy
|
||||
|
|
@ -41253,7 +41261,7 @@ index 1c4b1e7..ffa4134 100644
|
|||
/var/run/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
|
||||
/var/run/sepermit(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
|
||||
diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
|
||||
index bea0ade..cbd62c5 100644
|
||||
index bea0ade..a0feb45 100644
|
||||
--- a/policy/modules/system/authlogin.if
|
||||
+++ b/policy/modules/system/authlogin.if
|
||||
@@ -57,6 +57,8 @@ interface(`auth_use_pam',`
|
||||
|
|
@ -41580,7 +41588,7 @@ index bea0ade..cbd62c5 100644
|
|||
## Read login records files (/var/log/wtmp).
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
@@ -1500,28 +1692,38 @@ interface(`auth_manage_login_records',`
|
||||
@@ -1500,28 +1692,36 @@ interface(`auth_manage_login_records',`
|
||||
#
|
||||
interface(`auth_use_nsswitch',`
|
||||
|
||||
|
|
@ -41594,7 +41602,7 @@ index bea0ade..cbd62c5 100644
|
|||
sysnet_dns_name_resolve($1)
|
||||
- sysnet_use_ldap($1)
|
||||
+
|
||||
+ tunable_policy(`authlogin_use_sssd',`', `
|
||||
+ tunable_policy(`authlogin_nsswitch_use_ldap',`
|
||||
+ files_list_var_lib($1)
|
||||
+
|
||||
+ miscfiles_read_generic_certs($1)
|
||||
|
|
@ -41604,61 +41612,45 @@ index bea0ade..cbd62c5 100644
|
|||
|
||||
optional_policy(`
|
||||
- avahi_stream_connect($1)
|
||||
+ tunable_policy(`authlogin_use_sssd',`', `
|
||||
+ tunable_policy(`authlogin_nsswitch_use_ldap',`
|
||||
+ dirsrv_stream_connect($1)
|
||||
+ ')
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
- ldap_stream_connect($1)
|
||||
+ tunable_policy(`authlogin_use_sssd',`', `
|
||||
+ tunable_policy(`authlogin_nsswitch_use_ldap',`
|
||||
+ ldap_stream_connect($1)
|
||||
+ ')
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
- likewise_stream_connect_lsassd($1)
|
||||
+ tunable_policy(`authlogin_use_sssd',`', `
|
||||
+ likewise_stream_connect_lsassd($1)
|
||||
+ ')
|
||||
likewise_stream_connect_lsassd($1)
|
||||
')
|
||||
|
||||
+ # can not wrap nis_use_ypbind or kerberos_use, but they both have booleans you can turn off.
|
||||
optional_policy(`
|
||||
kerberos_use($1)
|
||||
')
|
||||
@@ -1531,13 +1733,25 @@ interface(`auth_use_nsswitch',`
|
||||
@@ -1531,7 +1731,15 @@ interface(`auth_use_nsswitch',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
- nscd_socket_use($1)
|
||||
+ nscd_use($1)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
- samba_stream_connect_winbind($1)
|
||||
- samba_read_var_files($1)
|
||||
- samba_dontaudit_write_var_files($1)
|
||||
+ tunable_policy(`authlogin_use_sssd',`', `
|
||||
+ nslcd_stream_connect($1)
|
||||
+ ')
|
||||
+ ')
|
||||
+
|
||||
+ optional_policy(`
|
||||
+ nslcd_stream_connect($1)
|
||||
+ ')
|
||||
+
|
||||
+ optional_policy(`
|
||||
+ sssd_stream_connect($1)
|
||||
+ ')
|
||||
+
|
||||
+ optional_policy(`
|
||||
+ tunable_policy(`authlogin_use_sssd',`', `
|
||||
+ samba_stream_connect_winbind($1)
|
||||
+ samba_read_var_files($1)
|
||||
+ samba_dontaudit_write_var_files($1)
|
||||
+ ')
|
||||
')
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te
|
||||
index 54d122b..c2a3970 100644
|
||||
index 54d122b..069790d 100644
|
||||
--- a/policy/modules/system/authlogin.te
|
||||
+++ b/policy/modules/system/authlogin.te
|
||||
@@ -5,9 +5,24 @@ policy_module(authlogin, 2.2.0)
|
||||
|
|
@ -41677,7 +41669,7 @@ index 54d122b..c2a3970 100644
|
|||
+## Allow users to login using a sssd server
|
||||
+## </p>
|
||||
+## </desc>
|
||||
+gen_tunable(authlogin_use_sssd, false)
|
||||
+gen_tunable(authlogin_nsswitch_use_ldap, false)
|
||||
+
|
||||
attribute can_read_shadow_passwords;
|
||||
attribute can_write_shadow_passwords;
|
||||
|
|
@ -42553,7 +42545,7 @@ index ed152c4..be3bb8f 100644
|
|||
+ allow $1 init_t:unix_dgram_socket sendto;
|
||||
+')
|
||||
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
|
||||
index 0580e7c..28fd86c 100644
|
||||
index 0580e7c..1618f9d 100644
|
||||
--- a/policy/modules/system/init.te
|
||||
+++ b/policy/modules/system/init.te
|
||||
@@ -16,6 +16,27 @@ gen_require(`
|
||||
|
|
@ -43241,7 +43233,7 @@ index 0580e7c..28fd86c 100644
|
|||
+userdom_inherit_append_user_tmp_files(daemon)
|
||||
+userdom_dontaudit_rw_stream(daemon)
|
||||
+
|
||||
+logging_append_all_logs(daemon)
|
||||
+logging_inherit_append_all_logs(daemon)
|
||||
+
|
||||
+optional_policy(`
|
||||
+ # sudo service restart causes this
|
||||
|
|
@ -44345,7 +44337,7 @@ index 571599b..17dd196 100644
|
|||
+
|
||||
+/var/webmin(/.*)? gen_context(system_u:object_r:var_log_t,s0)
|
||||
diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
|
||||
index c7cfb62..620e0a4 100644
|
||||
index c7cfb62..ee9809d 100644
|
||||
--- a/policy/modules/system/logging.if
|
||||
+++ b/policy/modules/system/logging.if
|
||||
@@ -545,6 +545,44 @@ interface(`logging_send_syslog_msg',`
|
||||
|
|
@ -44416,7 +44408,7 @@ index c7cfb62..620e0a4 100644
|
|||
+ attribute logfile;
|
||||
+ ')
|
||||
+
|
||||
+ allow $1 logfile:file { getattr append };
|
||||
+ allow $1 logfile:file { getattr append ioctl lock };
|
||||
+')
|
||||
+
|
||||
+########################################
|
||||
|
|
@ -44660,7 +44652,7 @@ index 58bc27f..b4f0663 100644
|
|||
+ allow $1 clvmd_tmpfs_t:file rw_file_perms;
|
||||
+')
|
||||
diff --git a/policy/modules/system/lvm.te b/policy/modules/system/lvm.te
|
||||
index 86ef2da..a251276 100644
|
||||
index 86ef2da..0676045 100644
|
||||
--- a/policy/modules/system/lvm.te
|
||||
+++ b/policy/modules/system/lvm.te
|
||||
@@ -12,6 +12,9 @@ init_daemon_domain(clvmd_t, clvmd_exec_t)
|
||||
|
|
@ -44705,8 +44697,12 @@ index 86ef2da..a251276 100644
|
|||
ccs_stream_connect(clvmd_t)
|
||||
')
|
||||
|
||||
@@ -170,6 +182,7 @@ dontaudit lvm_t self:capability sys_tty_config;
|
||||
allow lvm_t self:process { sigchld sigkill sigstop signull signal };
|
||||
@@ -167,9 +179,10 @@ optional_policy(`
|
||||
# net_admin for multipath
|
||||
allow lvm_t self:capability { dac_override fowner ipc_lock sys_admin sys_nice mknod chown sys_resource sys_rawio net_admin };
|
||||
dontaudit lvm_t self:capability sys_tty_config;
|
||||
-allow lvm_t self:process { sigchld sigkill sigstop signull signal };
|
||||
+allow lvm_t self:process { setfscreate sigchld sigkill sigstop signull signal };
|
||||
# LVM will complain a lot if it cannot set its priority.
|
||||
allow lvm_t self:process setsched;
|
||||
+allow lvm_t self:sem create_sem_perms;
|
||||
|
|
@ -46782,7 +46778,7 @@ index 8e71fb7..f1b155a 100644
|
|||
+ role_transition $1 dhcpc_exec_t system_r;
|
||||
+')
|
||||
diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
|
||||
index dfbe736..d8c6f24 100644
|
||||
index dfbe736..d1f6368 100644
|
||||
--- a/policy/modules/system/sysnetwork.te
|
||||
+++ b/policy/modules/system/sysnetwork.te
|
||||
@@ -5,6 +5,13 @@ policy_module(sysnetwork, 1.11.0)
|
||||
|
|
@ -46944,12 +46940,11 @@ index dfbe736..d8c6f24 100644
|
|||
ifdef(`hide_broken_symptoms',`
|
||||
optional_policy(`
|
||||
dev_dontaudit_rw_cardmgr(ifconfig_t)
|
||||
@@ -325,8 +372,15 @@ ifdef(`hide_broken_symptoms',`
|
||||
@@ -325,8 +372,14 @@ ifdef(`hide_broken_symptoms',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
+ devicekit_dontaudit_read_pid_files(ifconfig_t)
|
||||
+ devicekit_write_log(ifconfig_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
|
|
@ -46960,7 +46955,7 @@ index dfbe736..d8c6f24 100644
|
|||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -334,6 +388,14 @@ optional_policy(`
|
||||
@@ -334,6 +387,14 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
|
|
@ -46975,7 +46970,7 @@ index dfbe736..d8c6f24 100644
|
|||
nis_use_ypbind(ifconfig_t)
|
||||
')
|
||||
|
||||
@@ -355,3 +417,9 @@ optional_policy(`
|
||||
@@ -355,3 +416,9 @@ optional_policy(`
|
||||
xen_append_log(ifconfig_t)
|
||||
xen_dontaudit_rw_unix_stream_sockets(ifconfig_t)
|
||||
')
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@
|
|||
Summary: SELinux policy configuration
|
||||
Name: selinux-policy
|
||||
Version: 3.9.12
|
||||
Release: 1%{?dist}
|
||||
Release: 2%{?dist}
|
||||
License: GPLv2+
|
||||
Group: System Environment/Base
|
||||
Source: serefpolicy-%{version}.tgz
|
||||
|
|
@ -471,6 +471,13 @@ exit 0
|
|||
%endif
|
||||
|
||||
%changelog
|
||||
* Tue Dec 21 2010 Dan Walsh <dwalsh@redhat.com> 3.9.12-2
|
||||
- New labels for ghc http content
|
||||
- nsplugin_config needs to read urand, lvm now calls setfscreate to create dev
|
||||
- pm-suspend now creates log file for append access so we remove devicekit_wri
|
||||
- Change authlogin_use_sssd to authlogin_nsswitch_use_ldap
|
||||
- Fixes for greylist_milter policy
|
||||
|
||||
* Tue Dec 21 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.12-1
|
||||
- Update to upstream
|
||||
- Fixes for systemd policy
|
||||
|
|
|
|||
Loading…
Reference in New Issue