rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Allow svirt images to create sock_file in svirt_var_run_t

This commit is contained in:
Daniel J Walsh 2009-08-05 19:37:52 +00:00
parent 4673269d66
commit f3b436ca6a
1 changed files with 173 additions and 115 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

288
policy-F12.patch
View File

@ -1008,7 +1008,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
java_domtrans_unconfined(rpm_script_t) java_domtrans_unconfined(rpm_script_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.6.26/policy/modules/admin/sudo.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.6.26/policy/modules/admin/sudo.if
--- nsaserefpolicy/policy/modules/admin/sudo.if 2009-07-28 13:28:33.000000000 -0400 --- nsaserefpolicy/policy/modules/admin/sudo.if 2009-07-28 13:28:33.000000000 -0400
+++ serefpolicy-3.6.26/policy/modules/admin/sudo.if 2009-07-30 15:33:08.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/admin/sudo.if 2009-08-05 07:57:19.000000000 -0400
@@ -66,8 +66,8 @@ @@ -66,8 +66,8 @@
allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms; allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms;
allow $1_sudo_t self:unix_dgram_socket sendto; allow $1_sudo_t self:unix_dgram_socket sendto;
@ -1041,6 +1041,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
tunable_policy(`use_nfs_home_dirs',` tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_files($1_sudo_t) fs_manage_nfs_files($1_sudo_t)
@@ -147,6 +149,11 @@
optional_policy(`
dbus_system_bus_client($1_sudo_t)
')
+
+ optional_policy(`
+ fprintd_dbus_chat($1_sudo_t)
+ ')
+
')
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.te serefpolicy-3.6.26/policy/modules/admin/tmpreaper.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.te serefpolicy-3.6.26/policy/modules/admin/tmpreaper.te
--- nsaserefpolicy/policy/modules/admin/tmpreaper.te 2009-07-28 13:28:33.000000000 -0400 --- nsaserefpolicy/policy/modules/admin/tmpreaper.te 2009-07-28 13:28:33.000000000 -0400
+++ serefpolicy-3.6.26/policy/modules/admin/tmpreaper.te 2009-07-30 15:33:08.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/admin/tmpreaper.te 2009-07-30 15:33:08.000000000 -0400
@ -2575,8 +2587,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.te serefpolicy-3.6.26/policy/modules/apps/nsplugin.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/nsplugin.te serefpolicy-3.6.26/policy/modules/apps/nsplugin.te
--- nsaserefpolicy/policy/modules/apps/nsplugin.te 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/apps/nsplugin.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.26/policy/modules/apps/nsplugin.te 2009-07-30 15:33:08.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/apps/nsplugin.te 2009-08-05 07:20:45.000000000 -0400
@@ -0,0 +1,287 @@ @@ -0,0 +1,285 @@
+ +
+policy_module(nsplugin, 1.0.0) +policy_module(nsplugin, 1.0.0)
+ +
@ -2769,12 +2781,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ xserver_common_app(nsplugin_t) + xserver_common_app(nsplugin_t)
+ xserver_rw_shm(nsplugin_t) + xserver_rw_shm(nsplugin_t)
+ xserver_read_xdm_tmp_files(nsplugin_t) + xserver_read_xdm_tmp_files(nsplugin_t)
+ xserver_read_xdm_pid(nsplugin_t)
+ xserver_read_user_xauth(nsplugin_t) + xserver_read_user_xauth(nsplugin_t)
+ xserver_read_user_iceauth(nsplugin_t) + xserver_read_user_iceauth(nsplugin_t)
+ xserver_use_user_fonts(nsplugin_t) + xserver_use_user_fonts(nsplugin_t)
+ xserver_manage_home_fonts(nsplugin_t) + xserver_manage_home_fonts(nsplugin_t)
+ xserver_dontaudit_rw_xdm_home_files(nsplugin_t)
+') +')
+ +
+######################################## +########################################
@ -3948,8 +3958,25 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/screen.if serefpolicy-3.6.26/policy/modules/apps/screen.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/screen.if serefpolicy-3.6.26/policy/modules/apps/screen.if
--- nsaserefpolicy/policy/modules/apps/screen.if 2009-07-23 14:11:04.000000000 -0400 --- nsaserefpolicy/policy/modules/apps/screen.if 2009-07-23 14:11:04.000000000 -0400
+++ serefpolicy-3.6.26/policy/modules/apps/screen.if 2009-07-30 15:33:08.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/apps/screen.if 2009-08-05 07:38:57.000000000 -0400
@@ -157,3 +157,24 @@ @@ -61,6 +61,8 @@
manage_fifo_files_pattern($1_screen_t, screen_dir_t, screen_var_run_t)
manage_dirs_pattern($1_screen_t, screen_dir_t, screen_dir_t)
filetrans_pattern($1_screen_t, screen_dir_t, screen_var_run_t, fifo_file)
+ dontaudit $3 $1_var_run_t:fifo_file read;
+
files_pid_filetrans($1_screen_t, screen_dir_t, dir)
allow $1_screen_t screen_home_t:dir list_dir_perms;
@@ -91,6 +93,7 @@
# Revert to the user domain when a shell is executed.
corecmd_shell_domtrans($1_screen_t, $3)
corecmd_bin_domtrans($1_screen_t, $3)
+ allow $3 $1_screen_t:process sigchld;
corenet_all_recvfrom_unlabeled($1_screen_t)
corenet_all_recvfrom_netlabel($1_screen_t)
@@ -157,3 +160,24 @@
nscd_socket_use($1_screen_t) nscd_socket_use($1_screen_t)
') ')
') ')
@ -4561,7 +4588,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.6.26/policy/modules/kernel/domain.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.6.26/policy/modules/kernel/domain.if
--- nsaserefpolicy/policy/modules/kernel/domain.if 2009-07-14 14:19:57.000000000 -0400 --- nsaserefpolicy/policy/modules/kernel/domain.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.26/policy/modules/kernel/domain.if 2009-08-03 08:04:07.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/kernel/domain.if 2009-08-05 08:03:44.000000000 -0400
@@ -44,34 +44,6 @@ @@ -44,34 +44,6 @@
interface(`domain_type',` interface(`domain_type',`
# start with basic domain # start with basic domain
@ -4744,7 +4771,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.6.26/policy/modules/kernel/domain.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.6.26/policy/modules/kernel/domain.te
--- nsaserefpolicy/policy/modules/kernel/domain.te 2009-07-14 14:19:57.000000000 -0400 --- nsaserefpolicy/policy/modules/kernel/domain.te 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.26/policy/modules/kernel/domain.te 2009-07-30 15:33:08.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/kernel/domain.te 2009-08-05 07:21:34.000000000 -0400
@@ -5,6 +5,13 @@ @@ -5,6 +5,13 @@
# #
# Declarations # Declarations
@ -4802,7 +4829,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(` optional_policy(`
xserver_dontaudit_use_xdm_fds(domain) xserver_dontaudit_use_xdm_fds(domain)
xserver_dontaudit_rw_xdm_pipes(domain) xserver_dontaudit_rw_xdm_pipes(domain)
+ xserver_dontaudit_rw_xdm_home_files(domain) + xserver_dontaudit_append_xdm_home_files(domain)
') ')
######################################## ########################################
@ -5643,31 +5670,24 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+gen_user(guest_u, user, guest_r, s0, s0) +gen_user(guest_u, user, guest_r, s0, s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.te serefpolicy-3.6.26/policy/modules/roles/staff.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.te serefpolicy-3.6.26/policy/modules/roles/staff.te
--- nsaserefpolicy/policy/modules/roles/staff.te 2009-07-14 14:19:57.000000000 -0400 --- nsaserefpolicy/policy/modules/roles/staff.te 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.26/policy/modules/roles/staff.te 2009-07-30 15:33:08.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/roles/staff.te 2009-08-05 07:37:10.000000000 -0400
@@ -15,156 +15,105 @@ @@ -15,156 +15,110 @@
# Local policy # Local policy
# #
-optional_policy(` -optional_policy(`
- apache_role(staff_r, staff_t) - apache_role(staff_r, staff_t)
-') -')
+kernel_read_ring_buffer(staff_t) -
+kernel_getattr_core_if(staff_t)
+kernel_getattr_message_if(staff_t)
+kernel_read_software_raid_state(staff_t)
-optional_policy(` -optional_policy(`
- auth_role(staff_r, staff_t) - auth_role(staff_r, staff_t)
-') -')
+auth_domtrans_pam_console(staff_t) -
-optional_policy(` -optional_policy(`
- auditadm_role_change(staff_r) - auditadm_role_change(staff_r)
-') -')
+seutil_run_newrole(staff_t, staff_r) -
+netutils_run_ping(staff_t, staff_r) -optional_policy(`
optional_policy(`
- bluetooth_role(staff_r, staff_t) - bluetooth_role(staff_r, staff_t)
-') -')
- -
@ -5682,7 +5702,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-optional_policy(` -optional_policy(`
- dbus_role_template(staff, staff_r, staff_t) - dbus_role_template(staff, staff_r, staff_t)
-') -')
- +kernel_read_ring_buffer(staff_t)
+kernel_getattr_core_if(staff_t)
+kernel_getattr_message_if(staff_t)
+kernel_read_software_raid_state(staff_t)
-optional_policy(` -optional_policy(`
- ethereal_role(staff_r, staff_t) - ethereal_role(staff_r, staff_t)
-') -')
@ -5694,113 +5718,117 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-optional_policy(` -optional_policy(`
- games_role(staff_r, staff_t) - games_role(staff_r, staff_t)
-') -')
- +auth_domtrans_pam_console(staff_t)
-optional_policy(` -optional_policy(`
- gift_role(staff_r, staff_t) - gift_role(staff_r, staff_t)
-') -')
- +seutil_run_newrole(staff_t, staff_r)
-optional_policy(` +netutils_run_ping(staff_t, staff_r)
optional_policy(`
- gnome_role(staff_r, staff_t) - gnome_role(staff_r, staff_t)
-')
-
-optional_policy(`
- gpg_role(staff_r, staff_t)
+ sudo_role_template(staff, staff_r, staff_t) + sudo_role_template(staff, staff_r, staff_t)
') ')
optional_policy(` optional_policy(`
- irc_role(staff_r, staff_t) - gpg_role(staff_r, staff_t)
+ auditadm_role_change(staff_r) + auditadm_role_change(staff_r)
') ')
optional_policy(` optional_policy(`
- java_role(staff_r, staff_t) - irc_role(staff_r, staff_t)
+ kerneloops_manage_tmp_files(staff_t) + kerneloops_manage_tmp_files(staff_t)
') ')
optional_policy(` optional_policy(`
- lockdev_role(staff_r, staff_t) - java_role(staff_r, staff_t)
+ logadm_role_change(staff_r) + logadm_role_change(staff_r)
') ')
optional_policy(` optional_policy(`
- lpd_role(staff_r, staff_t) - lockdev_role(staff_r, staff_t)
+ postgresql_role(staff_r, staff_t) + postgresql_role(staff_r, staff_t)
') ')
optional_policy(` optional_policy(`
- mozilla_role(staff_r, staff_t) - lpd_role(staff_r, staff_t)
+ rtkit_daemon_system_domain(staff_t) + rtkit_daemon_system_domain(staff_t)
') ')
optional_policy(` optional_policy(`
- mplayer_role(staff_r, staff_t) - mozilla_role(staff_r, staff_t)
+ secadm_role_change(staff_r) + secadm_role_change(staff_r)
') ')
optional_policy(` optional_policy(`
- mta_role(staff_r, staff_t) - mplayer_role(staff_r, staff_t)
+ ssh_role_template(staff, staff_r, staff_t) + ssh_role_template(staff, staff_r, staff_t)
') ')
optional_policy(`
- mta_role(staff_r, staff_t)
+ sysadm_role_change(staff_r)
')
optional_policy(` optional_policy(`
- oident_manage_user_content(staff_t) - oident_manage_user_content(staff_t)
- oident_relabel_user_content(staff_t) - oident_relabel_user_content(staff_t)
+ sysadm_role_change(staff_r)
')
optional_policy(`
- pyzor_role(staff_r, staff_t)
+ usernetctl_run(staff_t, staff_r) + usernetctl_run(staff_t, staff_r)
') ')
optional_policy(` optional_policy(`
- razor_role(staff_r, staff_t) - pyzor_role(staff_r, staff_t)
+ unconfined_role_change(staff_r) + unconfined_role_change(staff_r)
') ')
optional_policy(` optional_policy(`
- rssh_role(staff_r, staff_t) - razor_role(staff_r, staff_t)
+ webadm_role_change(staff_r) + webadm_role_change(staff_r)
') ')
-optional_policy(` -optional_policy(`
- screen_role_template(staff, staff_r, staff_t) - rssh_role(staff_r, staff_t)
-') -')
+domain_read_all_domains_state(staff_t) +domain_read_all_domains_state(staff_t)
+domain_getattr_all_domains(staff_t) +domain_getattr_all_domains(staff_t)
+domain_obj_id_change_exemption(staff_t) +domain_obj_id_change_exemption(staff_t)
-optional_policy(` -optional_policy(`
- secadm_role_change(staff_r) - screen_role_template(staff, staff_r, staff_t)
-') -')
+files_read_kernel_modules(staff_t) +files_read_kernel_modules(staff_t)
-optional_policy(` -optional_policy(`
- spamassassin_role(staff_r, staff_t) - secadm_role_change(staff_r)
-') -')
+kernel_read_fs_sysctls(staff_t) +kernel_read_fs_sysctls(staff_t)
-optional_policy(` -optional_policy(`
- ssh_role_template(staff, staff_r, staff_t) - spamassassin_role(staff_r, staff_t)
-') -')
+modutils_read_module_config(staff_t) +modutils_read_module_config(staff_t)
+modutils_read_module_deps(staff_t) +modutils_read_module_deps(staff_t)
-optional_policy(` -optional_policy(`
- su_role_template(staff, staff_r, staff_t) - ssh_role_template(staff, staff_r, staff_t)
-') -')
+miscfiles_read_hwdata(staff_t) +miscfiles_read_hwdata(staff_t)
-optional_policy(` -optional_policy(`
- sudo_role_template(staff, staff_r, staff_t) - su_role_template(staff, staff_r, staff_t)
-') -')
+term_use_unallocated_ttys(staff_t) +term_use_unallocated_ttys(staff_t)
optional_policy(`
- sudo_role_template(staff, staff_r, staff_t)
+ gnomeclock_dbus_chat(staff_t)
')
optional_policy(` optional_policy(`
- sysadm_role_change(staff_r) - sysadm_role_change(staff_r)
- userdom_dontaudit_use_user_terminals(staff_t) - userdom_dontaudit_use_user_terminals(staff_t)
+ gnomeclock_dbus_chat(staff_t) + lpd_list_spool(staff_t
') ')
optional_policy(` optional_policy(`
@ -5820,6 +5848,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(` optional_policy(`
- userhelper_role_template(staff, staff_r, staff_t) - userhelper_role_template(staff, staff_r, staff_t)
+ screen_role_template(staff, staff_r, staff_t)
+ screen_manage_var_run(staff_t) + screen_manage_var_run(staff_t)
') ')
@ -9828,7 +9857,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.6.26/policy/modules/services/dbus.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.6.26/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2009-07-28 13:28:33.000000000 -0400 --- nsaserefpolicy/policy/modules/services/dbus.if 2009-07-28 13:28:33.000000000 -0400
+++ serefpolicy-3.6.26/policy/modules/services/dbus.if 2009-07-30 15:33:08.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/services/dbus.if 2009-08-05 07:49:49.000000000 -0400
@@ -42,8 +42,10 @@ @@ -42,8 +42,10 @@
gen_require(` gen_require(`
class dbus { send_msg acquire_svc }; class dbus { send_msg acquire_svc };
@ -9867,7 +9896,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_read_user_home_content_files($1_dbusd_t) userdom_read_user_home_content_files($1_dbusd_t)
ifdef(`hide_broken_symptoms', ` ifdef(`hide_broken_symptoms', `
@@ -153,6 +157,10 @@ @@ -153,12 +157,15 @@
') ')
optional_policy(` optional_policy(`
@ -9878,7 +9907,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
hal_dbus_chat($1_dbusd_t) hal_dbus_chat($1_dbusd_t)
') ')
@@ -178,10 +186,12 @@ optional_policy(`
- xserver_use_xdm_fds($1_dbusd_t)
- xserver_rw_xdm_pipes($1_dbusd_t)
+ xserver_use_xdm($1_dbusd_t)
')
')
@@ -178,10 +185,12 @@
type system_dbusd_t, system_dbusd_t; type system_dbusd_t, system_dbusd_t;
type system_dbusd_var_run_t, system_dbusd_var_lib_t; type system_dbusd_var_run_t, system_dbusd_var_lib_t;
class dbus send_msg; class dbus send_msg;
@ -9892,7 +9928,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
read_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t) read_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
files_search_var_lib($1) files_search_var_lib($1)
@@ -190,6 +200,10 @@ @@ -190,6 +199,10 @@
files_search_pids($1) files_search_pids($1)
stream_connect_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t, system_dbusd_t) stream_connect_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t, system_dbusd_t)
dbus_read_config($1) dbus_read_config($1)
@ -9903,7 +9939,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
####################################### #######################################
@@ -256,7 +270,7 @@ @@ -256,7 +269,7 @@
######################################## ########################################
## <summary> ## <summary>
@ -10959,8 +10995,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/modemmanager.te serefpolicy-3.6.26/policy/modules/services/modemmanager.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/modemmanager.te serefpolicy-3.6.26/policy/modules/services/modemmanager.te
--- nsaserefpolicy/policy/modules/services/modemmanager.te 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/services/modemmanager.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.26/policy/modules/services/modemmanager.te 2009-07-30 15:33:08.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/services/modemmanager.te 2009-08-05 15:31:50.000000000 -0400
@@ -0,0 +1,41 @@ @@ -0,0 +1,46 @@
+policy_module(ModemManager,1.0.0) +policy_module(ModemManager,1.0.0)
+ +
+######################################## +########################################
@ -10992,6 +11028,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
+files_read_etc_files(ModemManager_t) +files_read_etc_files(ModemManager_t)
+ +
+term_use_unallocated_ttys(ModemManager_t)
+
+miscfiles_read_localization(ModemManager_t) +miscfiles_read_localization(ModemManager_t)
+ +
+logging_send_syslog_msg(ModemManager_t) +logging_send_syslog_msg(ModemManager_t)
@ -11000,8 +11038,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ networkmanager_dbus_chat(ModemManager_t) + networkmanager_dbus_chat(ModemManager_t)
+') +')
+ +
+permissive ModemManager_t; +optional_policy(`
+ udev_read_db(ModemManager_t)
+')
+ +
+permissive ModemManager_t;
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.6.26/policy/modules/services/mta.fc diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.6.26/policy/modules/services/mta.fc
--- nsaserefpolicy/policy/modules/services/mta.fc 2009-07-29 15:15:33.000000000 -0400 --- nsaserefpolicy/policy/modules/services/mta.fc 2009-07-29 15:15:33.000000000 -0400
+++ serefpolicy-3.6.26/policy/modules/services/mta.fc 2009-07-30 15:33:09.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/services/mta.fc 2009-07-30 15:33:09.000000000 -0400
@ -11536,7 +11577,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.6.26/policy/modules/services/networkmanager.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.6.26/policy/modules/services/networkmanager.te
--- nsaserefpolicy/policy/modules/services/networkmanager.te 2009-07-14 14:19:57.000000000 -0400 --- nsaserefpolicy/policy/modules/services/networkmanager.te 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.26/policy/modules/services/networkmanager.te 2009-07-30 15:33:09.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/services/networkmanager.te 2009-08-05 08:04:33.000000000 -0400
@@ -19,6 +19,9 @@ @@ -19,6 +19,9 @@
type NetworkManager_tmp_t; type NetworkManager_tmp_t;
files_tmp_file(NetworkManager_tmp_t) files_tmp_file(NetworkManager_tmp_t)
@ -11564,20 +11605,21 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow NetworkManager_t self:tcp_socket create_stream_socket_perms; allow NetworkManager_t self:tcp_socket create_stream_socket_perms;
allow NetworkManager_t self:udp_socket create_socket_perms; allow NetworkManager_t self:udp_socket create_socket_perms;
allow NetworkManager_t self:packet_socket create_socket_perms; allow NetworkManager_t self:packet_socket create_socket_perms;
@@ -51,8 +55,10 @@ @@ -51,8 +55,11 @@
manage_files_pattern(NetworkManager_t, NetworkManager_log_t, NetworkManager_log_t) manage_files_pattern(NetworkManager_t, NetworkManager_log_t, NetworkManager_log_t)
logging_log_filetrans(NetworkManager_t, NetworkManager_log_t, file) logging_log_filetrans(NetworkManager_t, NetworkManager_log_t, file)
-rw_sock_files_pattern(NetworkManager_t, NetworkManager_tmp_t, NetworkManager_tmp_t) -rw_sock_files_pattern(NetworkManager_t, NetworkManager_tmp_t, NetworkManager_tmp_t)
-files_search_tmp(NetworkManager_t) -files_search_tmp(NetworkManager_t)
+manage_files_pattern(NetworkManager_t, NetworkManager_tmp_t, NetworkManager_tmp_t)
+manage_sock_files_pattern(NetworkManager_t, NetworkManager_tmp_t, NetworkManager_tmp_t) +manage_sock_files_pattern(NetworkManager_t, NetworkManager_tmp_t, NetworkManager_tmp_t)
+files_tmp_filetrans(NetworkManager_t, NetworkManager_tmp_t, sock_file) +files_tmp_filetrans(NetworkManager_t, NetworkManager_tmp_t, { sock_file file })
+ +
+manage_files_pattern(NetworkManager_t, NetworkManager_var_lib_t, NetworkManager_var_lib_t) +manage_files_pattern(NetworkManager_t, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
manage_dirs_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t) manage_dirs_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
manage_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t) manage_files_pattern(NetworkManager_t, NetworkManager_var_run_t, NetworkManager_var_run_t)
@@ -63,6 +69,8 @@ @@ -63,6 +70,8 @@
kernel_read_network_state(NetworkManager_t) kernel_read_network_state(NetworkManager_t)
kernel_read_kernel_sysctls(NetworkManager_t) kernel_read_kernel_sysctls(NetworkManager_t)
kernel_load_module(NetworkManager_t) kernel_load_module(NetworkManager_t)
@ -11586,7 +11628,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_all_recvfrom_unlabeled(NetworkManager_t) corenet_all_recvfrom_unlabeled(NetworkManager_t)
corenet_all_recvfrom_netlabel(NetworkManager_t) corenet_all_recvfrom_netlabel(NetworkManager_t)
@@ -81,13 +89,18 @@ @@ -81,13 +90,18 @@
corenet_sendrecv_isakmp_server_packets(NetworkManager_t) corenet_sendrecv_isakmp_server_packets(NetworkManager_t)
corenet_sendrecv_dhcpc_server_packets(NetworkManager_t) corenet_sendrecv_dhcpc_server_packets(NetworkManager_t)
corenet_sendrecv_all_client_packets(NetworkManager_t) corenet_sendrecv_all_client_packets(NetworkManager_t)
@ -11605,7 +11647,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
mls_file_read_all_levels(NetworkManager_t) mls_file_read_all_levels(NetworkManager_t)
@@ -98,15 +111,20 @@ @@ -98,15 +112,20 @@
domain_use_interactive_fds(NetworkManager_t) domain_use_interactive_fds(NetworkManager_t)
domain_read_confined_domains_state(NetworkManager_t) domain_read_confined_domains_state(NetworkManager_t)
@ -11627,7 +11669,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
logging_send_syslog_msg(NetworkManager_t) logging_send_syslog_msg(NetworkManager_t)
miscfiles_read_localization(NetworkManager_t) miscfiles_read_localization(NetworkManager_t)
@@ -116,25 +134,40 @@ @@ -116,25 +135,40 @@
seutil_read_config(NetworkManager_t) seutil_read_config(NetworkManager_t)
@ -11675,7 +11717,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -146,8 +179,25 @@ @@ -146,8 +180,25 @@
') ')
optional_policy(` optional_policy(`
@ -11703,7 +11745,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -155,23 +205,51 @@ @@ -155,23 +206,51 @@
') ')
optional_policy(` optional_policy(`
@ -11757,7 +11799,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -179,12 +257,15 @@ @@ -179,12 +258,15 @@
') ')
optional_policy(` optional_policy(`
@ -12592,7 +12634,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.6.26/policy/modules/services/policykit.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.6.26/policy/modules/services/policykit.te
--- nsaserefpolicy/policy/modules/services/policykit.te 2009-07-23 14:11:04.000000000 -0400 --- nsaserefpolicy/policy/modules/services/policykit.te 2009-07-23 14:11:04.000000000 -0400
+++ serefpolicy-3.6.26/policy/modules/services/policykit.te 2009-08-03 06:50:17.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/services/policykit.te 2009-08-05 15:36:05.000000000 -0400
@@ -38,9 +38,10 @@ @@ -38,9 +38,10 @@
allow policykit_t self:capability { setgid setuid }; allow policykit_t self:capability { setgid setuid };
@ -12650,7 +12692,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
rw_files_pattern(policykit_auth_t, policykit_reload_t, policykit_reload_t) rw_files_pattern(policykit_auth_t, policykit_reload_t, policykit_reload_t)
@@ -104,6 +119,7 @@ @@ -96,6 +111,7 @@
files_read_usr_files(policykit_auth_t)
auth_use_nsswitch(policykit_auth_t)
+auth_domtrans_chk_passwd(policykit_auth_t)
logging_send_syslog_msg(policykit_auth_t)
@@ -104,6 +120,7 @@
userdom_dontaudit_read_user_home_content_files(policykit_auth_t) userdom_dontaudit_read_user_home_content_files(policykit_auth_t)
optional_policy(` optional_policy(`
@ -12658,7 +12708,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
dbus_session_bus_client(policykit_auth_t) dbus_session_bus_client(policykit_auth_t)
optional_policy(` optional_policy(`
@@ -116,6 +132,13 @@ @@ -116,6 +133,13 @@
hal_read_state(policykit_auth_t) hal_read_state(policykit_auth_t)
') ')
@ -12672,7 +12722,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
######################################## ########################################
# #
# polkit_grant local policy # polkit_grant local policy
@@ -123,7 +146,8 @@ @@ -123,7 +147,8 @@
allow policykit_grant_t self:capability setuid; allow policykit_grant_t self:capability setuid;
allow policykit_grant_t self:process getattr; allow policykit_grant_t self:process getattr;
@ -12682,7 +12732,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow policykit_grant_t self:unix_dgram_socket create_socket_perms; allow policykit_grant_t self:unix_dgram_socket create_socket_perms;
allow policykit_grant_t self:unix_stream_socket create_stream_socket_perms; allow policykit_grant_t self:unix_stream_socket create_stream_socket_perms;
@@ -153,9 +177,12 @@ @@ -153,9 +178,12 @@
userdom_read_all_users_state(policykit_grant_t) userdom_read_all_users_state(policykit_grant_t)
optional_policy(` optional_policy(`
@ -12696,7 +12746,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
consolekit_dbus_chat(policykit_grant_t) consolekit_dbus_chat(policykit_grant_t)
') ')
') ')
@@ -167,7 +194,8 @@ @@ -167,7 +195,8 @@
allow policykit_resolve_t self:capability { setuid sys_nice sys_ptrace }; allow policykit_resolve_t self:capability { setuid sys_nice sys_ptrace };
allow policykit_resolve_t self:process getattr; allow policykit_resolve_t self:process getattr;
@ -14979,7 +15029,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.6.26/policy/modules/services/setroubleshoot.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.6.26/policy/modules/services/setroubleshoot.te
--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2009-07-14 14:19:57.000000000 -0400 --- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.26/policy/modules/services/setroubleshoot.te 2009-07-30 15:33:09.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/services/setroubleshoot.te 2009-08-05 08:03:58.000000000 -0400
@@ -22,13 +22,19 @@ @@ -22,13 +22,19 @@
type setroubleshoot_var_run_t; type setroubleshoot_var_run_t;
files_pid_file(setroubleshoot_var_run_t) files_pid_file(setroubleshoot_var_run_t)
@ -15013,7 +15063,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corecmd_exec_bin(setroubleshootd_t) corecmd_exec_bin(setroubleshootd_t)
corecmd_exec_shell(setroubleshootd_t) corecmd_exec_shell(setroubleshootd_t)
@@ -68,16 +77,25 @@ @@ -68,16 +77,26 @@
dev_read_urand(setroubleshootd_t) dev_read_urand(setroubleshootd_t)
dev_read_sysfs(setroubleshootd_t) dev_read_sysfs(setroubleshootd_t)
@ -15021,6 +15071,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+dev_getattr_all_chr_files(setroubleshootd_t) +dev_getattr_all_chr_files(setroubleshootd_t)
domain_dontaudit_search_all_domains_state(setroubleshootd_t) domain_dontaudit_search_all_domains_state(setroubleshootd_t)
+domain_signull_all_domains(setroubleshootd_t)
files_read_usr_files(setroubleshootd_t) files_read_usr_files(setroubleshootd_t)
files_read_etc_files(setroubleshootd_t) files_read_etc_files(setroubleshootd_t)
@ -15040,7 +15091,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
selinux_get_enforce_mode(setroubleshootd_t) selinux_get_enforce_mode(setroubleshootd_t)
selinux_validate_context(setroubleshootd_t) selinux_validate_context(setroubleshootd_t)
@@ -94,23 +112,54 @@ @@ -94,23 +113,54 @@
locallogin_dontaudit_use_fds(setroubleshootd_t) locallogin_dontaudit_use_fds(setroubleshootd_t)
@ -16637,7 +16688,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.26/policy/modules/services/virt.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.26/policy/modules/services/virt.te
--- nsaserefpolicy/policy/modules/services/virt.te 2009-07-14 14:19:57.000000000 -0400 --- nsaserefpolicy/policy/modules/services/virt.te 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.26/policy/modules/services/virt.te 2009-08-04 05:06:14.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/services/virt.te 2009-08-05 15:13:13.000000000 -0400
@@ -20,6 +20,28 @@ @@ -20,6 +20,28 @@
## </desc> ## </desc>
gen_tunable(virt_use_samba, false) gen_tunable(virt_use_samba, false)
@ -16855,7 +16906,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -195,8 +290,154 @@ @@ -195,8 +290,155 @@
xen_stream_connect(virtd_t) xen_stream_connect(virtd_t)
xen_stream_connect_xenstore(virtd_t) xen_stream_connect_xenstore(virtd_t)
@ -16885,6 +16936,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
+manage_dirs_pattern(svirt_t, svirt_var_run_t, svirt_var_run_t) +manage_dirs_pattern(svirt_t, svirt_var_run_t, svirt_var_run_t)
+manage_files_pattern(svirt_t, svirt_var_run_t, svirt_var_run_t) +manage_files_pattern(svirt_t, svirt_var_run_t, svirt_var_run_t)
+manage_sock_files_pattern(svirt_t, svirt_var_run_t, svirt_var_run_t)
+manage_lnk_files_pattern(svirt_t, svirt_var_run_t, svirt_var_run_t) +manage_lnk_files_pattern(svirt_t, svirt_var_run_t, svirt_var_run_t)
+files_pid_filetrans(svirt_t, svirt_var_run_t, { dir file }) +files_pid_filetrans(svirt_t, svirt_var_run_t, { dir file })
+stream_connect_pattern(svirt_t, svirt_var_run_t, svirt_var_run_t, virtd_t) +stream_connect_pattern(svirt_t, svirt_var_run_t, svirt_var_run_t, virtd_t)
@ -17107,7 +17159,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0) /var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.6.26/policy/modules/services/xserver.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.6.26/policy/modules/services/xserver.if
--- nsaserefpolicy/policy/modules/services/xserver.if 2009-07-14 14:19:57.000000000 -0400 --- nsaserefpolicy/policy/modules/services/xserver.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.26/policy/modules/services/xserver.if 2009-08-03 06:49:41.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/services/xserver.if 2009-08-05 07:48:30.000000000 -0400
@@ -90,7 +90,7 @@ @@ -90,7 +90,7 @@
allow $2 xauth_home_t:file manage_file_perms; allow $2 xauth_home_t:file manage_file_perms;
allow $2 xauth_home_t:file { relabelfrom relabelto }; allow $2 xauth_home_t:file { relabelfrom relabelto };
@ -17418,7 +17470,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
domtrans_pattern($1, xserver_exec_t, xserver_t) domtrans_pattern($1, xserver_exec_t, xserver_t)
') ')
@@ -1159,6 +1281,276 @@ @@ -1159,6 +1281,278 @@
######################################## ########################################
## <summary> ## <summary>
@ -17541,7 +17593,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
+######################################## +########################################
+## <summary> +## <summary>
+## Dontaudit write to .xsession-errors file +## Dontaudit append to .xsession-errors file
+## </summary> +## </summary>
+## <param name="domain"> +## <param name="domain">
+## <summary> +## <summary>
@ -17549,7 +17601,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+## </summary> +## </summary>
+## </param> +## </param>
+# +#
+interface(`xserver_dontaudit_rw_xdm_home_files',` +interface(`xserver_dontaudit_append_xdm_home_files',`
+ gen_require(` + gen_require(`
+ type xdm_home_t; + type xdm_home_t;
+ ') + ')
@ -17574,6 +17626,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ gen_require(` + gen_require(`
+ type xdm_t, xdm_tmp_t; + type xdm_t, xdm_tmp_t;
+ type xdm_xproperty_t; + type xdm_xproperty_t;
+ type xdm_home_t;
+ class x_client all_x_client_perms; + class x_client all_x_client_perms;
+ class x_drawable all_x_drawable_perms; + class x_drawable all_x_drawable_perms;
+ class x_property all_x_property_perms; + class x_property all_x_property_perms;
@ -17589,11 +17642,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ xserver_xdm_stream_connect($1) + xserver_xdm_stream_connect($1)
+ xserver_setattr_xdm_tmp_dirs($1) + xserver_setattr_xdm_tmp_dirs($1)
+ xserver_read_xdm_pid($1) + xserver_read_xdm_pid($1)
+ xserver_search_xdm_lib($1)
+ +
+ allow $1 xdm_t:x_client { getattr destroy }; + allow $1 xdm_t:x_client { getattr destroy };
+ allow $1 xdm_t:x_drawable { read receive get_property getattr send list_child add_child }; + allow $1 xdm_t:x_drawable { read receive get_property getattr send list_child add_child };
+ allow $1 xdm_xproperty_t:x_property { write read }; + allow $1 xdm_xproperty_t:x_property { write read };
+ + allow $1 xdm_home_t:file append_file_perms;
+') +')
+ +
+######################################## +########################################
@ -17695,7 +17749,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Interface to provide X object permissions on a given X server to ## Interface to provide X object permissions on a given X server to
## an X client domain. Gives the domain complete control over the ## an X client domain. Gives the domain complete control over the
## display. ## display.
@@ -1172,7 +1564,103 @@ @@ -1172,7 +1566,103 @@
interface(`xserver_unconfined',` interface(`xserver_unconfined',`
gen_require(` gen_require(`
attribute xserver_unconfined_type; attribute xserver_unconfined_type;
@ -19251,7 +19305,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.6.26/policy/modules/system/init.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.6.26/policy/modules/system/init.te
--- nsaserefpolicy/policy/modules/system/init.te 2009-07-30 09:44:08.000000000 -0400 --- nsaserefpolicy/policy/modules/system/init.te 2009-07-30 09:44:08.000000000 -0400
+++ serefpolicy-3.6.26/policy/modules/system/init.te 2009-07-30 15:33:09.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/system/init.te 2009-08-05 07:18:15.000000000 -0400
@@ -17,6 +17,20 @@ @@ -17,6 +17,20 @@
## </desc> ## </desc>
gen_tunable(init_upstart, false) gen_tunable(init_upstart, false)
@ -19641,7 +19695,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
+ +
+optional_policy(` +optional_policy(`
+ xserver_rw_xdm_home_files(daemon) + xserver_dontaudit_append_xdm_home_files(daemon)
+ tunable_policy(`use_nfs_home_dirs',` + tunable_policy(`use_nfs_home_dirs',`
+ fs_dontaudit_rw_nfs_files(daemon) + fs_dontaudit_rw_nfs_files(daemon)
+ ') + ')
@ -22990,7 +23044,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0) +/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.26/policy/modules/system/userdomain.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.26/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-07-28 13:28:33.000000000 -0400 --- nsaserefpolicy/policy/modules/system/userdomain.if 2009-07-28 13:28:33.000000000 -0400
+++ serefpolicy-3.6.26/policy/modules/system/userdomain.if 2009-07-30 15:33:09.000000000 -0400 +++ serefpolicy-3.6.26/policy/modules/system/userdomain.if 2009-08-05 07:54:48.000000000 -0400
@@ -30,8 +30,9 @@ @@ -30,8 +30,9 @@
') ')
@ -23900,7 +23954,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
logging_dontaudit_send_audit_msgs($1_t) logging_dontaudit_send_audit_msgs($1_t)
# Need to to this just so screensaver will work. Should be moved to screensaver domain # Need to to this just so screensaver will work. Should be moved to screensaver domain
@@ -891,28 +953,43 @@ @@ -891,28 +953,47 @@
selinux_get_enforce_mode($1_t) selinux_get_enforce_mode($1_t)
optional_policy(` optional_policy(`
@ -23916,6 +23970,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ devicekit_dbus_chat($1_usertype) + devicekit_dbus_chat($1_usertype)
+ devicekit_dbus_chat_disk($1_usertype) + devicekit_dbus_chat_disk($1_usertype)
+ devicekit_dbus_chat_power($1_usertype) + devicekit_dbus_chat_power($1_usertype)
+ ')
+
+ optional_policy(`
+ fprintd_dbus_chat($1_t)
') ')
optional_policy(` optional_policy(`
@ -23951,7 +24009,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
') ')
@@ -946,8 +1023,8 @@ @@ -946,8 +1027,8 @@
# Declarations # Declarations
# #
@ -23961,7 +24019,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_common_user_template($1) userdom_common_user_template($1)
############################## ##############################
@@ -956,11 +1033,12 @@ @@ -956,11 +1037,12 @@
# #
# port access is audited even if dac would not have allowed it, so dontaudit it here # port access is audited even if dac would not have allowed it, so dontaudit it here
@ -23976,7 +24034,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# cjp: why? # cjp: why?
files_read_kernel_symbol_table($1_t) files_read_kernel_symbol_table($1_t)
@@ -978,37 +1056,55 @@ @@ -978,37 +1060,55 @@
') ')
') ')
@ -24046,7 +24104,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
####################################### #######################################
@@ -1042,7 +1138,7 @@ @@ -1042,7 +1142,7 @@
# #
template(`userdom_admin_user_template',` template(`userdom_admin_user_template',`
gen_require(` gen_require(`
@ -24055,7 +24113,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
############################## ##############################
@@ -1051,8 +1147,7 @@ @@ -1051,8 +1151,7 @@
# #
# Inherit rules for ordinary users. # Inherit rules for ordinary users.
@ -24065,7 +24123,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
domain_obj_id_change_exemption($1_t) domain_obj_id_change_exemption($1_t)
role system_r types $1_t; role system_r types $1_t;
@@ -1075,7 +1170,8 @@ @@ -1075,7 +1174,8 @@
# Skip authentication when pam_rootok is specified. # Skip authentication when pam_rootok is specified.
allow $1_t self:passwd rootok; allow $1_t self:passwd rootok;
@ -24075,7 +24133,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_software_raid_state($1_t) kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t) kernel_getattr_core_if($1_t)
@@ -1091,6 +1187,7 @@ @@ -1091,6 +1191,7 @@
kernel_sigstop_unlabeled($1_t) kernel_sigstop_unlabeled($1_t)
kernel_signull_unlabeled($1_t) kernel_signull_unlabeled($1_t)
kernel_sigchld_unlabeled($1_t) kernel_sigchld_unlabeled($1_t)
@ -24083,7 +24141,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_tcp_bind_generic_port($1_t) corenet_tcp_bind_generic_port($1_t)
# allow setting up tunnels # allow setting up tunnels
@@ -1098,8 +1195,6 @@ @@ -1098,8 +1199,6 @@
dev_getattr_generic_blk_files($1_t) dev_getattr_generic_blk_files($1_t)
dev_getattr_generic_chr_files($1_t) dev_getattr_generic_chr_files($1_t)
@ -24092,7 +24150,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Allow MAKEDEV to work # Allow MAKEDEV to work
dev_create_all_blk_files($1_t) dev_create_all_blk_files($1_t)
dev_create_all_chr_files($1_t) dev_create_all_chr_files($1_t)
@@ -1154,20 +1249,6 @@ @@ -1154,20 +1253,6 @@
# But presently necessary for installing the file_contexts file. # But presently necessary for installing the file_contexts file.
seutil_manage_bin_policy($1_t) seutil_manage_bin_policy($1_t)
@ -24113,7 +24171,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(` optional_policy(`
postgresql_unconfined($1_t) postgresql_unconfined($1_t)
') ')
@@ -1213,6 +1294,7 @@ @@ -1213,6 +1298,7 @@
dev_relabel_all_dev_nodes($1) dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1) files_create_boot_flag($1)
@ -24121,7 +24179,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Necessary for managing /boot/efi # Necessary for managing /boot/efi
fs_manage_dos_files($1) fs_manage_dos_files($1)
@@ -1278,11 +1360,15 @@ @@ -1278,11 +1364,15 @@
interface(`userdom_user_home_content',` interface(`userdom_user_home_content',`
gen_require(` gen_require(`
type user_home_t; type user_home_t;
@ -24137,7 +24195,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1374,12 +1460,13 @@ @@ -1374,12 +1464,13 @@
') ')
allow $1 user_home_dir_t:dir search_dir_perms; allow $1 user_home_dir_t:dir search_dir_perms;
@ -24152,7 +24210,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -1412,6 +1499,14 @@ @@ -1412,6 +1503,14 @@
allow $1 user_home_dir_t:dir list_dir_perms; allow $1 user_home_dir_t:dir list_dir_perms;
files_search_home($1) files_search_home($1)
@ -24167,7 +24225,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1427,9 +1522,11 @@ @@ -1427,9 +1526,11 @@
interface(`userdom_dontaudit_list_user_home_dirs',` interface(`userdom_dontaudit_list_user_home_dirs',`
gen_require(` gen_require(`
type user_home_dir_t; type user_home_dir_t;
@ -24179,7 +24237,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1486,6 +1583,25 @@ @@ -1486,6 +1587,25 @@
allow $1 user_home_dir_t:dir relabelto; allow $1 user_home_dir_t:dir relabelto;
') ')
@ -24205,7 +24263,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
######################################## ########################################
## <summary> ## <summary>
## Create directories in the home dir root with ## Create directories in the home dir root with
@@ -1560,6 +1676,8 @@ @@ -1560,6 +1680,8 @@
') ')
dontaudit $1 user_home_t:dir search_dir_perms; dontaudit $1 user_home_t:dir search_dir_perms;
@ -24214,7 +24272,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1653,6 +1771,7 @@ @@ -1653,6 +1775,7 @@
type user_home_dir_t, user_home_t; type user_home_dir_t, user_home_t;
') ')
@ -24222,7 +24280,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t) read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
files_search_home($1) files_search_home($1)
') ')
@@ -1780,19 +1899,32 @@ @@ -1780,19 +1903,32 @@
# #
interface(`userdom_exec_user_home_content_files',` interface(`userdom_exec_user_home_content_files',`
gen_require(` gen_require(`
@ -24262,7 +24320,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -1827,6 +1959,7 @@ @@ -1827,6 +1963,7 @@
interface(`userdom_manage_user_home_content_files',` interface(`userdom_manage_user_home_content_files',`
gen_require(` gen_require(`
type user_home_dir_t, user_home_t; type user_home_dir_t, user_home_t;
@ -24270,7 +24328,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
manage_files_pattern($1, user_home_t, user_home_t) manage_files_pattern($1, user_home_t, user_home_t)
@@ -2374,7 +2507,7 @@ @@ -2374,7 +2511,7 @@
######################################## ########################################
## <summary> ## <summary>
@ -24279,7 +24337,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -2728,11 +2861,32 @@ @@ -2728,11 +2865,32 @@
# #
interface(`userdom_search_user_home_content',` interface(`userdom_search_user_home_content',`
gen_require(` gen_require(`
@ -24314,7 +24372,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -2860,7 +3014,25 @@ @@ -2860,7 +3018,25 @@
type user_tmp_t; type user_tmp_t;
') ')
@ -24341,7 +24399,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
######################################## ########################################
@@ -2897,6 +3069,7 @@ @@ -2897,6 +3073,7 @@
') ')
read_files_pattern($1, userdomain, userdomain) read_files_pattern($1, userdomain, userdomain)
@ -24349,7 +24407,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_search_proc($1) kernel_search_proc($1)
') ')
@@ -3027,3 +3200,501 @@ @@ -3027,3 +3204,501 @@
allow $1 userdomain:dbus send_msg; allow $1 userdomain:dbus send_msg;
') ')