- Update selinux policy to handle new /usr/share/sandbox/start script
This commit is contained in:
Dan Walsh
parent
b4f1891ade
commit
f3f61efb0b
274
policy-F15.patch
274
policy-F15.patch
@ -1990,9 +1990,18 @@ index 441cf22..e1b55f8 100644
|
||||
mta_manage_spool(useradd_t)
|
||||
|
||||
diff --git a/policy/modules/admin/vpn.te b/policy/modules/admin/vpn.te
|
||||
index ebf4b26..c7cb8c5 100644
|
||||
index ebf4b26..f663276 100644
|
||||
--- a/policy/modules/admin/vpn.te
|
||||
+++ b/policy/modules/admin/vpn.te
|
||||
@@ -21,7 +21,7 @@ files_pid_file(vpnc_var_run_t)
|
||||
# Local policy
|
||||
#
|
||||
|
||||
-allow vpnc_t self:capability { dac_read_search dac_override net_admin ipc_lock net_raw };
|
||||
+allow vpnc_t self:capability { dac_read_search dac_override net_admin ipc_lock net_raw setuid };
|
||||
allow vpnc_t self:process { getsched signal };
|
||||
allow vpnc_t self:fifo_file rw_fifo_file_perms;
|
||||
allow vpnc_t self:netlink_route_socket rw_netlink_socket_perms;
|
||||
@@ -106,7 +106,8 @@ sysnet_etc_filetrans_config(vpnc_t)
|
||||
sysnet_manage_config(vpnc_t)
|
||||
|
||||
@ -2249,13 +2258,12 @@ index 0457de1..f702cfe 100644
|
||||
dbus_system_domain(cpufreqselector_t, cpufreqselector_exec_t)
|
||||
diff --git a/policy/modules/apps/execmem.fc b/policy/modules/apps/execmem.fc
|
||||
new file mode 100644
|
||||
index 0000000..4ef897d
|
||||
index 0000000..09f0673
|
||||
--- /dev/null
|
||||
+++ b/policy/modules/apps/execmem.fc
|
||||
@@ -0,0 +1,50 @@
|
||||
@@ -0,0 +1,49 @@
|
||||
+
|
||||
+/usr/bin/aticonfig -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
||||
+/usr/bin/compiz -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
||||
+/usr/bin/darcs -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
||||
+/usr/bin/dosbox -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
||||
+/usr/bin/haddock.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
||||
@ -5040,10 +5048,10 @@ index 0000000..4f9cb05
|
||||
+')
|
||||
diff --git a/policy/modules/apps/nsplugin.te b/policy/modules/apps/nsplugin.te
|
||||
new file mode 100644
|
||||
index 0000000..182e476
|
||||
index 0000000..7b483f3
|
||||
--- /dev/null
|
||||
+++ b/policy/modules/apps/nsplugin.te
|
||||
@@ -0,0 +1,312 @@
|
||||
@@ -0,0 +1,314 @@
|
||||
+policy_module(nsplugin, 1.0.0)
|
||||
+
|
||||
+########################################
|
||||
@ -5105,8 +5113,10 @@ index 0000000..182e476
|
||||
+allow nsplugin_t self:sem create_sem_perms;
|
||||
+allow nsplugin_t self:shm create_shm_perms;
|
||||
+allow nsplugin_t self:msgq create_msgq_perms;
|
||||
+allow nsplugin_t self:netlink_kobject_uevent_socket create_socket_perms;
|
||||
+allow nsplugin_t self:unix_stream_socket { connectto create_stream_socket_perms };
|
||||
+allow nsplugin_t self:unix_dgram_socket { sendto create_socket_perms };
|
||||
+allow nsplugin_t self:tcp_socket create_stream_socket_perms;
|
||||
+allow nsplugin_t nsplugin_rw_t:dir list_dir_perms;
|
||||
+read_lnk_files_pattern(nsplugin_t, nsplugin_rw_t, nsplugin_rw_t)
|
||||
+read_files_pattern(nsplugin_t, nsplugin_rw_t, nsplugin_rw_t)
|
||||
@ -5158,7 +5168,7 @@ index 0000000..182e476
|
||||
+dev_write_video_dev(nsplugin_t)
|
||||
+dev_getattr_dri_dev(nsplugin_t)
|
||||
+dev_rwx_zero(nsplugin_t)
|
||||
+dev_search_sysfs(nsplugin_t)
|
||||
+dev_read_sysfs(nsplugin_t)
|
||||
+
|
||||
+kernel_read_kernel_sysctls(nsplugin_t)
|
||||
+kernel_read_system_state(nsplugin_t)
|
||||
@ -5934,17 +5944,18 @@ index 9ec1478..26bb71c 100644
|
||||
')
|
||||
diff --git a/policy/modules/apps/sandbox.fc b/policy/modules/apps/sandbox.fc
|
||||
new file mode 100644
|
||||
index 0000000..15778fd
|
||||
index 0000000..6caef63
|
||||
--- /dev/null
|
||||
+++ b/policy/modules/apps/sandbox.fc
|
||||
@@ -0,0 +1 @@
|
||||
+# No types are sandbox_exec_t
|
||||
@@ -0,0 +1,2 @@
|
||||
+
|
||||
+/usr/share/sandbox/start -- gen_context(system_u:object_r:sandbox_exec_t,s0)
|
||||
diff --git a/policy/modules/apps/sandbox.if b/policy/modules/apps/sandbox.if
|
||||
new file mode 100644
|
||||
index 0000000..0c411b4
|
||||
index 0000000..5f09eb9
|
||||
--- /dev/null
|
||||
+++ b/policy/modules/apps/sandbox.if
|
||||
@@ -0,0 +1,334 @@
|
||||
@@ -0,0 +1,335 @@
|
||||
+
|
||||
+## <summary>policy for sandbox</summary>
|
||||
+
|
||||
@ -6065,6 +6076,7 @@ index 0000000..0c411b4
|
||||
+ gen_require(`
|
||||
+ type xserver_exec_t, sandbox_devpts_t;
|
||||
+ type sandbox_xserver_t;
|
||||
+ type sandbox_exec_t;
|
||||
+ attribute sandbox_domain, sandbox_x_domain;
|
||||
+ attribute sandbox_file_type, sandbox_tmpfs_type;
|
||||
+ attribute sandbox_type;
|
||||
@ -6107,8 +6119,8 @@ index 0000000..0c411b4
|
||||
+ domtrans_pattern($1_t, xserver_exec_t, sandbox_xserver_t)
|
||||
+ allow $1_t sandbox_xserver_t:process signal_perms;
|
||||
+
|
||||
+ domtrans_pattern($1_t, $1_file_t, $1_client_t)
|
||||
+ domain_entry_file($1_client_t, $1_file_t)
|
||||
+ domtrans_pattern($1_t, sandbox_exec_t, $1_client_t)
|
||||
+ domain_entry_file($1_client_t, sandbox_exec_t)
|
||||
+
|
||||
+ # Random tmpfs_t that gets created when you run X.
|
||||
+ fs_rw_tmpfs_files($1_t)
|
||||
@ -6281,10 +6293,10 @@ index 0000000..0c411b4
|
||||
+')
|
||||
diff --git a/policy/modules/apps/sandbox.te b/policy/modules/apps/sandbox.te
|
||||
new file mode 100644
|
||||
index 0000000..6b46acd
|
||||
index 0000000..5259647
|
||||
--- /dev/null
|
||||
+++ b/policy/modules/apps/sandbox.te
|
||||
@@ -0,0 +1,448 @@
|
||||
@@ -0,0 +1,451 @@
|
||||
+policy_module(sandbox,1.0.0)
|
||||
+dbus_stub()
|
||||
+attribute sandbox_domain;
|
||||
@ -6294,6 +6306,9 @@ index 0000000..6b46acd
|
||||
+attribute sandbox_tmpfs_type;
|
||||
+attribute sandbox_type;
|
||||
+
|
||||
+type sandbox_exec_t;
|
||||
+files_type(sandbox_exec_t)
|
||||
+
|
||||
+########################################
|
||||
+#
|
||||
+# Declarations
|
||||
@ -10919,7 +10934,7 @@ index 3994e57..43aa641 100644
|
||||
+
|
||||
+/lib/udev/devices/pts -d gen_context(system_u:object_r:devpts_t,s0-mls_systemhigh)
|
||||
diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if
|
||||
index 492bf76..525563a 100644
|
||||
index 492bf76..00b786e 100644
|
||||
--- a/policy/modules/kernel/terminal.if
|
||||
+++ b/policy/modules/kernel/terminal.if
|
||||
@@ -267,7 +267,6 @@ interface(`term_dontaudit_read_console',`
|
||||
@ -10952,7 +10967,33 @@ index 492bf76..525563a 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -848,7 +849,7 @@ interface(`term_dontaudit_use_all_ptys',`
|
||||
@@ -651,6 +652,25 @@ interface(`term_use_controlling_term',`
|
||||
allow $1 devtty_t:chr_file { rw_term_perms lock append };
|
||||
')
|
||||
|
||||
+#######################################
|
||||
+## <summary>
|
||||
+## Allow attempts to get attributes
|
||||
+## on the pty multiplexor (/dev/ptmx).
|
||||
+## </summary>
|
||||
+## <param name="domain">
|
||||
+## <summary>
|
||||
+## Domain to not audit.
|
||||
+## </summary>
|
||||
+## </param>
|
||||
+#
|
||||
+interface(`term_getattr_ptmx',`
|
||||
+ gen_require(`
|
||||
+ type ptmx_t;
|
||||
+ ')
|
||||
+
|
||||
+ allow $1 ptmx_t:chr_file getattr;
|
||||
+')
|
||||
+
|
||||
########################################
|
||||
## <summary>
|
||||
## Do not audit attempts to get attributes
|
||||
@@ -848,7 +868,7 @@ interface(`term_dontaudit_use_all_ptys',`
|
||||
attribute ptynode;
|
||||
')
|
||||
|
||||
@ -10961,7 +11002,7 @@ index 492bf76..525563a 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1116,7 +1117,7 @@ interface(`term_relabel_unallocated_ttys',`
|
||||
@@ -1116,7 +1136,7 @@ interface(`term_relabel_unallocated_ttys',`
|
||||
')
|
||||
|
||||
dev_list_all_dev_nodes($1)
|
||||
@ -10970,7 +11011,7 @@ index 492bf76..525563a 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1215,7 +1216,7 @@ interface(`term_dontaudit_use_unallocated_ttys',`
|
||||
@@ -1215,7 +1235,7 @@ interface(`term_dontaudit_use_unallocated_ttys',`
|
||||
type tty_device_t;
|
||||
')
|
||||
|
||||
@ -10979,7 +11020,7 @@ index 492bf76..525563a 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1231,11 +1232,13 @@ interface(`term_dontaudit_use_unallocated_ttys',`
|
||||
@@ -1231,11 +1251,13 @@ interface(`term_dontaudit_use_unallocated_ttys',`
|
||||
#
|
||||
interface(`term_getattr_all_ttys',`
|
||||
gen_require(`
|
||||
@ -10993,7 +11034,7 @@ index 492bf76..525563a 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1252,10 +1255,12 @@ interface(`term_getattr_all_ttys',`
|
||||
@@ -1252,10 +1274,12 @@ interface(`term_getattr_all_ttys',`
|
||||
interface(`term_dontaudit_getattr_all_ttys',`
|
||||
gen_require(`
|
||||
attribute ttynode;
|
||||
@ -11006,7 +11047,7 @@ index 492bf76..525563a 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1294,7 +1299,7 @@ interface(`term_relabel_all_ttys',`
|
||||
@@ -1294,7 +1318,7 @@ interface(`term_relabel_all_ttys',`
|
||||
')
|
||||
|
||||
dev_list_all_dev_nodes($1)
|
||||
@ -11015,7 +11056,7 @@ index 492bf76..525563a 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1352,7 +1357,7 @@ interface(`term_dontaudit_use_all_ttys',`
|
||||
@@ -1352,7 +1376,7 @@ interface(`term_dontaudit_use_all_ttys',`
|
||||
attribute ttynode;
|
||||
')
|
||||
|
||||
@ -11024,7 +11065,7 @@ index 492bf76..525563a 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1468,3 +1473,22 @@ interface(`term_dontaudit_use_all_user_ttys',`
|
||||
@@ -1468,3 +1492,22 @@ interface(`term_dontaudit_use_all_user_ttys',`
|
||||
refpolicywarn(`$0() is deprecated, use term_dontaudit_use_all_ttys() instead.')
|
||||
term_dontaudit_use_all_ttys($1)
|
||||
')
|
||||
@ -11336,7 +11377,7 @@ index 2be17d2..96d3fbf 100644
|
||||
')
|
||||
|
||||
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
|
||||
index 1ae9a94..27404e7 100644
|
||||
index 4a8d146..a0a91fe 100644
|
||||
--- a/policy/modules/roles/sysadm.te
|
||||
+++ b/policy/modules/roles/sysadm.te
|
||||
@@ -24,20 +24,41 @@ ifndef(`enable_mls',`
|
||||
@ -11508,7 +11549,7 @@ index 1ae9a94..27404e7 100644
|
||||
|
||||
optional_policy(`
|
||||
rsync_exec(sysadm_t)
|
||||
@@ -303,7 +326,7 @@ optional_policy(`
|
||||
@@ -307,7 +330,7 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -11517,7 +11558,7 @@ index 1ae9a94..27404e7 100644
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -328,10 +351,6 @@ optional_policy(`
|
||||
@@ -332,10 +355,6 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -11528,7 +11569,7 @@ index 1ae9a94..27404e7 100644
|
||||
tripwire_run_siggen(sysadm_t, sysadm_r)
|
||||
tripwire_run_tripwire(sysadm_t, sysadm_r)
|
||||
tripwire_run_twadmin(sysadm_t, sysadm_r)
|
||||
@@ -339,18 +358,10 @@ optional_policy(`
|
||||
@@ -343,18 +362,10 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -11547,7 +11588,7 @@ index 1ae9a94..27404e7 100644
|
||||
unconfined_domtrans(sysadm_t)
|
||||
')
|
||||
|
||||
@@ -363,17 +374,14 @@ optional_policy(`
|
||||
@@ -367,17 +378,14 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -11567,7 +11608,7 @@ index 1ae9a94..27404e7 100644
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -385,7 +393,7 @@ optional_policy(`
|
||||
@@ -389,7 +397,7 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -11576,7 +11617,7 @@ index 1ae9a94..27404e7 100644
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -400,8 +408,15 @@ optional_policy(`
|
||||
@@ -404,8 +412,15 @@ optional_policy(`
|
||||
yam_run(sysadm_t, sysadm_r)
|
||||
')
|
||||
|
||||
@ -11592,7 +11633,7 @@ index 1ae9a94..27404e7 100644
|
||||
auth_role(sysadm_r, sysadm_t)
|
||||
')
|
||||
|
||||
@@ -448,5 +463,60 @@ ifndef(`distro_redhat',`
|
||||
@@ -452,5 +467,60 @@ ifndef(`distro_redhat',`
|
||||
optional_policy(`
|
||||
java_role(sysadm_r, sysadm_t)
|
||||
')
|
||||
@ -16148,10 +16189,10 @@ index 0000000..fa9b95a
|
||||
+')
|
||||
diff --git a/policy/modules/services/boinc.te b/policy/modules/services/boinc.te
|
||||
new file mode 100644
|
||||
index 0000000..3b58d07
|
||||
index 0000000..6d8fdeb
|
||||
--- /dev/null
|
||||
+++ b/policy/modules/services/boinc.te
|
||||
@@ -0,0 +1,169 @@
|
||||
@@ -0,0 +1,173 @@
|
||||
+policy_module(boinc, 1.0.0)
|
||||
+
|
||||
+########################################
|
||||
@ -16216,6 +16257,7 @@ index 0000000..3b58d07
|
||||
+manage_dirs_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
|
||||
+manage_files_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t)
|
||||
+
|
||||
+# needs read /proc/interrupts
|
||||
+kernel_read_system_state(boinc_t)
|
||||
+
|
||||
+files_getattr_all_dirs(boinc_t)
|
||||
@ -16253,7 +16295,10 @@ index 0000000..3b58d07
|
||||
+
|
||||
+fs_getattr_all_fs(boinc_t)
|
||||
+
|
||||
+term_dontaudit_getattr_ptmx(boinc_t)
|
||||
+term_getattr_all_ptys(boinc_t)
|
||||
+term_getattr_unallocated_ttys(boinc_t)
|
||||
+
|
||||
+init_read_utmp(boinc_t)
|
||||
+
|
||||
+miscfiles_read_localization(boinc_t)
|
||||
+miscfiles_read_generic_certs(boinc_t)
|
||||
@ -25485,10 +25530,10 @@ index 0000000..311aaed
|
||||
+')
|
||||
diff --git a/policy/modules/services/mpd.te b/policy/modules/services/mpd.te
|
||||
new file mode 100644
|
||||
index 0000000..ba77ba5
|
||||
index 0000000..f2e8836
|
||||
--- /dev/null
|
||||
+++ b/policy/modules/services/mpd.te
|
||||
@@ -0,0 +1,125 @@
|
||||
@@ -0,0 +1,126 @@
|
||||
+policy_module(mpd, 1.0.0)
|
||||
+
|
||||
+########################################
|
||||
@ -25570,6 +25615,7 @@ index 0000000..ba77ba5
|
||||
+corenet_tcp_bind_mpd_port(mpd_t)
|
||||
+corenet_tcp_bind_soundd_port(mpd_t)
|
||||
+
|
||||
+dev_read_sound(mpd_t)
|
||||
+dev_read_sysfs(mpd_t)
|
||||
+
|
||||
+files_read_usr_files(mpd_t)
|
||||
@ -26116,10 +26162,18 @@ index 64268e4..ce7924b 100644
|
||||
+ exim_manage_log(user_mail_domain)
|
||||
+')
|
||||
diff --git a/policy/modules/services/munin.fc b/policy/modules/services/munin.fc
|
||||
index fd71d69..bad9920 100644
|
||||
index fd71d69..2e9f2a3 100644
|
||||
--- a/policy/modules/services/munin.fc
|
||||
+++ b/policy/modules/services/munin.fc
|
||||
@@ -63,6 +63,7 @@
|
||||
@@ -51,6 +51,7 @@
|
||||
/usr/share/munin/plugins/irqstats -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0)
|
||||
/usr/share/munin/plugins/load -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0)
|
||||
/usr/share/munin/plugins/memory -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0)
|
||||
+/usr/share/munin/plugins/munin_* -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0)
|
||||
/usr/share/munin/plugins/netstat -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0)
|
||||
/usr/share/munin/plugins/nfs.* -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0)
|
||||
/usr/share/munin/plugins/open_files -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0)
|
||||
@@ -63,6 +64,7 @@
|
||||
/usr/share/munin/plugins/yum -- gen_context(system_u:object_r:system_munin_plugin_exec_t,s0)
|
||||
|
||||
/var/lib/munin(/.*)? gen_context(system_u:object_r:munin_var_lib_t,s0)
|
||||
@ -26216,7 +26270,7 @@ index c358d8f..fec6a97 100644
|
||||
|
||||
allow $1 munin_t:process { ptrace signal_perms };
|
||||
diff --git a/policy/modules/services/munin.te b/policy/modules/services/munin.te
|
||||
index f17583b..bdeea89 100644
|
||||
index f17583b..8f01394 100644
|
||||
--- a/policy/modules/services/munin.te
|
||||
+++ b/policy/modules/services/munin.te
|
||||
@@ -5,6 +5,8 @@ policy_module(munin, 1.8.0)
|
||||
@ -26333,7 +26387,15 @@ index f17583b..bdeea89 100644
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -255,10 +263,6 @@ corenet_tcp_connect_http_port(services_munin_plugin_t)
|
||||
@@ -245,6 +253,7 @@ optional_policy(`
|
||||
# local policy for service plugins
|
||||
#
|
||||
|
||||
+allow services_munin_plugin_t self:sem create_sem_perms;
|
||||
allow services_munin_plugin_t self:tcp_socket create_stream_socket_perms;
|
||||
allow services_munin_plugin_t self:udp_socket create_socket_perms;
|
||||
allow services_munin_plugin_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
@@ -255,13 +264,10 @@ corenet_tcp_connect_http_port(services_munin_plugin_t)
|
||||
dev_read_urand(services_munin_plugin_t)
|
||||
dev_read_rand(services_munin_plugin_t)
|
||||
|
||||
@ -26344,7 +26406,11 @@ index f17583b..bdeea89 100644
|
||||
sysnet_read_config(services_munin_plugin_t)
|
||||
|
||||
optional_policy(`
|
||||
@@ -286,6 +290,10 @@ optional_policy(`
|
||||
+ cups_read_config(services_munin_plugin_t)
|
||||
cups_stream_connect(services_munin_plugin_t)
|
||||
')
|
||||
|
||||
@@ -286,6 +292,10 @@ optional_policy(`
|
||||
snmp_read_snmp_var_lib_files(services_munin_plugin_t)
|
||||
')
|
||||
|
||||
@ -26355,7 +26421,13 @@ index f17583b..bdeea89 100644
|
||||
##################################
|
||||
#
|
||||
# local policy for system plugins
|
||||
@@ -298,10 +306,6 @@ rw_files_pattern(system_munin_plugin_t, munin_var_lib_t, munin_var_lib_t)
|
||||
@@ -295,13 +305,12 @@ allow system_munin_plugin_t self:udp_socket create_socket_perms;
|
||||
|
||||
rw_files_pattern(system_munin_plugin_t, munin_var_lib_t, munin_var_lib_t)
|
||||
|
||||
+# needed by munin_* plugins
|
||||
+allow system_munin_plugin_t munin_log_t:file r_file_perms;
|
||||
+
|
||||
kernel_read_network_state(system_munin_plugin_t)
|
||||
kernel_read_all_sysctls(system_munin_plugin_t)
|
||||
|
||||
@ -26366,10 +26438,11 @@ index f17583b..bdeea89 100644
|
||||
dev_read_sysfs(system_munin_plugin_t)
|
||||
dev_read_urand(system_munin_plugin_t)
|
||||
|
||||
@@ -313,3 +317,30 @@ init_read_utmp(system_munin_plugin_t)
|
||||
@@ -313,3 +322,31 @@ init_read_utmp(system_munin_plugin_t)
|
||||
sysnet_exec_ifconfig(system_munin_plugin_t)
|
||||
|
||||
term_getattr_unallocated_ttys(system_munin_plugin_t)
|
||||
+term_getattr_all_ttys(system_munin_plugin_t)
|
||||
+term_getattr_all_ptys(system_munin_plugin_t)
|
||||
+
|
||||
+################################
|
||||
@ -26616,10 +26689,18 @@ index 8581040..cfcdf10 100644
|
||||
|
||||
allow $1 nagios_t:process { ptrace signal_perms };
|
||||
diff --git a/policy/modules/services/nagios.te b/policy/modules/services/nagios.te
|
||||
index bf64a4c..55b3ce7 100644
|
||||
index bf64a4c..86c9cba 100644
|
||||
--- a/policy/modules/services/nagios.te
|
||||
+++ b/policy/modules/services/nagios.te
|
||||
@@ -107,13 +107,11 @@ files_read_etc_files(nagios_t)
|
||||
@@ -79,6 +79,7 @@ files_spool_filetrans(nagios_t, nagios_spool_t, fifo_file)
|
||||
|
||||
kernel_read_system_state(nagios_t)
|
||||
kernel_read_kernel_sysctls(nagios_t)
|
||||
+kernel_read_software_raid_state(nagios_t)
|
||||
|
||||
corecmd_exec_bin(nagios_t)
|
||||
corecmd_exec_shell(nagios_t)
|
||||
@@ -107,13 +108,11 @@ files_read_etc_files(nagios_t)
|
||||
files_read_etc_runtime_files(nagios_t)
|
||||
files_read_kernel_symbol_table(nagios_t)
|
||||
files_search_spool(nagios_t)
|
||||
@ -26634,7 +26715,7 @@ index bf64a4c..55b3ce7 100644
|
||||
auth_use_nsswitch(nagios_t)
|
||||
|
||||
logging_send_syslog_msg(nagios_t)
|
||||
@@ -124,10 +122,10 @@ userdom_dontaudit_use_unpriv_user_fds(nagios_t)
|
||||
@@ -124,10 +123,10 @@ userdom_dontaudit_use_unpriv_user_fds(nagios_t)
|
||||
userdom_dontaudit_search_user_home_dirs(nagios_t)
|
||||
|
||||
mta_send_mail(nagios_t)
|
||||
@ -26647,7 +26728,7 @@ index bf64a4c..55b3ce7 100644
|
||||
netutils_kill_ping(nagios_t)
|
||||
')
|
||||
|
||||
@@ -143,6 +141,7 @@ optional_policy(`
|
||||
@@ -143,6 +142,7 @@ optional_policy(`
|
||||
#
|
||||
# Nagios CGI local policy
|
||||
#
|
||||
@ -26655,7 +26736,7 @@ index bf64a4c..55b3ce7 100644
|
||||
optional_policy(`
|
||||
apache_content_template(nagios)
|
||||
typealias httpd_nagios_script_t alias nagios_cgi_t;
|
||||
@@ -180,11 +179,13 @@ optional_policy(`
|
||||
@@ -180,11 +180,13 @@ optional_policy(`
|
||||
#
|
||||
|
||||
allow nrpe_t self:capability { setuid setgid };
|
||||
@ -26670,7 +26751,7 @@ index bf64a4c..55b3ce7 100644
|
||||
domtrans_pattern(nrpe_t, nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t)
|
||||
|
||||
read_files_pattern(nrpe_t, nagios_etc_t, nagios_etc_t)
|
||||
@@ -201,7 +202,8 @@ corecmd_exec_shell(nrpe_t)
|
||||
@@ -201,7 +203,8 @@ corecmd_exec_shell(nrpe_t)
|
||||
|
||||
corenet_tcp_bind_generic_node(nrpe_t)
|
||||
corenet_tcp_bind_inetd_child_port(nrpe_t)
|
||||
@ -26680,7 +26761,7 @@ index bf64a4c..55b3ce7 100644
|
||||
|
||||
dev_read_sysfs(nrpe_t)
|
||||
dev_read_urand(nrpe_t)
|
||||
@@ -270,7 +272,6 @@ files_getattr_all_file_type_fs(nagios_admin_plugin_t)
|
||||
@@ -270,7 +273,6 @@ files_getattr_all_file_type_fs(nagios_admin_plugin_t)
|
||||
#
|
||||
|
||||
allow nagios_mail_plugin_t self:capability { setuid setgid dac_override };
|
||||
@ -26688,7 +26769,7 @@ index bf64a4c..55b3ce7 100644
|
||||
allow nagios_mail_plugin_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
allow nagios_mail_plugin_t self:tcp_socket create_stream_socket_perms;
|
||||
allow nagios_mail_plugin_t self:udp_socket create_socket_perms;
|
||||
@@ -299,7 +300,7 @@ optional_policy(`
|
||||
@@ -299,7 +301,7 @@ optional_policy(`
|
||||
|
||||
optional_policy(`
|
||||
postfix_stream_connect_master(nagios_mail_plugin_t)
|
||||
@ -26697,7 +26778,7 @@ index bf64a4c..55b3ce7 100644
|
||||
')
|
||||
|
||||
######################################
|
||||
@@ -310,6 +311,9 @@ optional_policy(`
|
||||
@@ -310,6 +312,9 @@ optional_policy(`
|
||||
# needed by ioctl()
|
||||
allow nagios_checkdisk_plugin_t self:capability { sys_admin sys_rawio };
|
||||
|
||||
@ -26707,7 +26788,7 @@ index bf64a4c..55b3ce7 100644
|
||||
files_read_etc_runtime_files(nagios_checkdisk_plugin_t)
|
||||
|
||||
fs_getattr_all_fs(nagios_checkdisk_plugin_t)
|
||||
@@ -323,7 +327,6 @@ storage_raw_read_fixed_disk(nagios_checkdisk_plugin_t)
|
||||
@@ -323,7 +328,6 @@ storage_raw_read_fixed_disk(nagios_checkdisk_plugin_t)
|
||||
|
||||
allow nagios_services_plugin_t self:capability { net_bind_service net_raw };
|
||||
allow nagios_services_plugin_t self:process { signal sigkill };
|
||||
@ -26715,7 +26796,7 @@ index bf64a4c..55b3ce7 100644
|
||||
allow nagios_services_plugin_t self:tcp_socket create_stream_socket_perms;
|
||||
allow nagios_services_plugin_t self:udp_socket create_socket_perms;
|
||||
|
||||
@@ -340,6 +343,8 @@ files_read_usr_files(nagios_services_plugin_t)
|
||||
@@ -340,6 +344,8 @@ files_read_usr_files(nagios_services_plugin_t)
|
||||
|
||||
optional_policy(`
|
||||
netutils_domtrans_ping(nagios_services_plugin_t)
|
||||
@ -28796,14 +28877,16 @@ index 9759ed8..07dd3ff 100644
|
||||
admin_pattern($1, plymouthd_var_run_t)
|
||||
')
|
||||
diff --git a/policy/modules/services/plymouthd.te b/policy/modules/services/plymouthd.te
|
||||
index fb8dc84..cf0e3d1 100644
|
||||
index fb8dc84..56cc327 100644
|
||||
--- a/policy/modules/services/plymouthd.te
|
||||
+++ b/policy/modules/services/plymouthd.te
|
||||
@@ -60,10 +60,18 @@ domain_use_interactive_fds(plymouthd_t)
|
||||
@@ -60,10 +60,20 @@ domain_use_interactive_fds(plymouthd_t)
|
||||
files_read_etc_files(plymouthd_t)
|
||||
files_read_usr_files(plymouthd_t)
|
||||
|
||||
+term_use_unallocated_ttys(plymouthd_t)
|
||||
+
|
||||
+logging_delete_generic_logs(plymouthd_t)
|
||||
+
|
||||
miscfiles_read_localization(plymouthd_t)
|
||||
miscfiles_read_fonts(plymouthd_t)
|
||||
@ -28818,7 +28901,7 @@ index fb8dc84..cf0e3d1 100644
|
||||
########################################
|
||||
#
|
||||
# Plymouth private policy
|
||||
@@ -74,6 +82,7 @@ allow plymouth_t self:fifo_file rw_file_perms;
|
||||
@@ -74,6 +84,7 @@ allow plymouth_t self:fifo_file rw_file_perms;
|
||||
allow plymouth_t self:unix_stream_socket create_stream_socket_perms;
|
||||
|
||||
kernel_read_system_state(plymouth_t)
|
||||
@ -28826,15 +28909,7 @@ index fb8dc84..cf0e3d1 100644
|
||||
|
||||
domain_use_interactive_fds(plymouth_t)
|
||||
|
||||
@@ -81,13 +90,15 @@ files_read_etc_files(plymouth_t)
|
||||
|
||||
term_use_ptmx(plymouth_t)
|
||||
|
||||
+logging_delete_generic_logs(plymouth_t)
|
||||
+
|
||||
miscfiles_read_localization(plymouth_t)
|
||||
|
||||
sysnet_read_config(plymouth_t)
|
||||
@@ -87,7 +98,7 @@ sysnet_read_config(plymouth_t)
|
||||
|
||||
plymouthd_stream_connect(plymouth_t)
|
||||
|
||||
@ -41371,7 +41446,7 @@ index a97a096..ab1e16a 100644
|
||||
/usr/bin/raw -- gen_context(system_u:object_r:fsadm_exec_t,s0)
|
||||
/usr/bin/scsi_unique_id -- gen_context(system_u:object_r:fsadm_exec_t,s0)
|
||||
diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te
|
||||
index a442acc..949f5ff 100644
|
||||
index a442acc..133f7f8 100644
|
||||
--- a/policy/modules/system/fstools.te
|
||||
+++ b/policy/modules/system/fstools.te
|
||||
@@ -55,6 +55,7 @@ allow fsadm_t swapfile_t:file { rw_file_perms swapon };
|
||||
@ -41438,10 +41513,14 @@ index a442acc..949f5ff 100644
|
||||
nis_use_ypbind(fsadm_t)
|
||||
')
|
||||
|
||||
@@ -175,6 +193,10 @@ optional_policy(`
|
||||
@@ -175,6 +193,14 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
+ udev_read_db(fsadm_t)
|
||||
+')
|
||||
+
|
||||
+optional_policy(`
|
||||
+ virt_read_blk_images(fsadm_t)
|
||||
+')
|
||||
+
|
||||
@ -45546,7 +45625,7 @@ index 170e2c7..bbaa8cf 100644
|
||||
+')
|
||||
+')
|
||||
diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
|
||||
index ff5d72d..9cd171a 100644
|
||||
index ff5d72d..f5fdb63 100644
|
||||
--- a/policy/modules/system/selinuxutil.te
|
||||
+++ b/policy/modules/system/selinuxutil.te
|
||||
@@ -22,6 +22,9 @@ attribute can_relabelto_binary_policy;
|
||||
@ -45626,6 +45705,15 @@ index ff5d72d..9cd171a 100644
|
||||
|
||||
miscfiles_read_localization(load_policy_t)
|
||||
|
||||
@@ -204,7 +218,7 @@ ifdef(`hide_broken_symptoms',`
|
||||
# Newrole local policy
|
||||
#
|
||||
|
||||
-allow newrole_t self:capability { fowner setuid setgid dac_override };
|
||||
+allow newrole_t self:capability { fowner setpcap setuid setgid dac_override };
|
||||
allow newrole_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack };
|
||||
allow newrole_t self:process setexec;
|
||||
allow newrole_t self:fd use;
|
||||
@@ -216,7 +230,7 @@ allow newrole_t self:msgq create_msgq_perms;
|
||||
allow newrole_t self:msg { send receive };
|
||||
allow newrole_t self:unix_dgram_socket sendto;
|
||||
@ -47610,7 +47698,7 @@ index db75976..392d1ee 100644
|
||||
+HOME_DIR/\.gvfs(/.*)? <<none>>
|
||||
+HOME_DIR/\.debug(/.*)? <<none>>
|
||||
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
|
||||
index 35f1476..1571559 100644
|
||||
index 28b88de..10340bc 100644
|
||||
--- a/policy/modules/system/userdomain.if
|
||||
+++ b/policy/modules/system/userdomain.if
|
||||
@@ -30,8 +30,9 @@ template(`userdom_base_user_template',`
|
||||
@ -48821,7 +48909,7 @@ index 35f1476..1571559 100644
|
||||
seutil_run_setfiles($1, $2)
|
||||
|
||||
optional_policy(`
|
||||
@@ -1275,12 +1510,15 @@ template(`userdom_security_admin_template',`
|
||||
@@ -1279,12 +1514,15 @@ template(`userdom_security_admin_template',`
|
||||
interface(`userdom_user_home_content',`
|
||||
gen_require(`
|
||||
type user_home_t;
|
||||
@ -48838,7 +48926,7 @@ index 35f1476..1571559 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1391,6 +1629,7 @@ interface(`userdom_search_user_home_dirs',`
|
||||
@@ -1395,6 +1633,7 @@ interface(`userdom_search_user_home_dirs',`
|
||||
')
|
||||
|
||||
allow $1 user_home_dir_t:dir search_dir_perms;
|
||||
@ -48846,7 +48934,7 @@ index 35f1476..1571559 100644
|
||||
files_search_home($1)
|
||||
')
|
||||
|
||||
@@ -1437,6 +1676,14 @@ interface(`userdom_list_user_home_dirs',`
|
||||
@@ -1441,6 +1680,14 @@ interface(`userdom_list_user_home_dirs',`
|
||||
|
||||
allow $1 user_home_dir_t:dir list_dir_perms;
|
||||
files_search_home($1)
|
||||
@ -48861,7 +48949,7 @@ index 35f1476..1571559 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1452,9 +1699,11 @@ interface(`userdom_list_user_home_dirs',`
|
||||
@@ -1456,9 +1703,11 @@ interface(`userdom_list_user_home_dirs',`
|
||||
interface(`userdom_dontaudit_list_user_home_dirs',`
|
||||
gen_require(`
|
||||
type user_home_dir_t;
|
||||
@ -48873,7 +48961,7 @@ index 35f1476..1571559 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1511,6 +1760,42 @@ interface(`userdom_relabelto_user_home_dirs',`
|
||||
@@ -1515,6 +1764,42 @@ interface(`userdom_relabelto_user_home_dirs',`
|
||||
allow $1 user_home_dir_t:dir relabelto;
|
||||
')
|
||||
|
||||
@ -48916,7 +49004,7 @@ index 35f1476..1571559 100644
|
||||
########################################
|
||||
## <summary>
|
||||
## Create directories in the home dir root with
|
||||
@@ -1585,6 +1870,8 @@ interface(`userdom_dontaudit_search_user_home_content',`
|
||||
@@ -1589,6 +1874,8 @@ interface(`userdom_dontaudit_search_user_home_content',`
|
||||
')
|
||||
|
||||
dontaudit $1 user_home_t:dir search_dir_perms;
|
||||
@ -48925,7 +49013,7 @@ index 35f1476..1571559 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1599,10 +1886,12 @@ interface(`userdom_dontaudit_search_user_home_content',`
|
||||
@@ -1603,10 +1890,12 @@ interface(`userdom_dontaudit_search_user_home_content',`
|
||||
#
|
||||
interface(`userdom_list_user_home_content',`
|
||||
gen_require(`
|
||||
@ -48940,7 +49028,7 @@ index 35f1476..1571559 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1645,30 +1934,49 @@ interface(`userdom_delete_user_home_content_dirs',`
|
||||
@@ -1649,30 +1938,49 @@ interface(`userdom_delete_user_home_content_dirs',`
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
@ -48997,7 +49085,7 @@ index 35f1476..1571559 100644
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
@@ -1696,12 +2004,32 @@ interface(`userdom_read_user_home_content_files',`
|
||||
@@ -1700,12 +2008,32 @@ interface(`userdom_read_user_home_content_files',`
|
||||
type user_home_dir_t, user_home_t;
|
||||
')
|
||||
|
||||
@ -49030,7 +49118,7 @@ index 35f1476..1571559 100644
|
||||
## Do not audit attempts to read user home files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
@@ -1712,11 +2040,14 @@ interface(`userdom_read_user_home_content_files',`
|
||||
@@ -1716,11 +2044,14 @@ interface(`userdom_read_user_home_content_files',`
|
||||
#
|
||||
interface(`userdom_dontaudit_read_user_home_content_files',`
|
||||
gen_require(`
|
||||
@ -49048,7 +49136,7 @@ index 35f1476..1571559 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1806,8 +2137,7 @@ interface(`userdom_read_user_home_content_symlinks',`
|
||||
@@ -1810,8 +2141,7 @@ interface(`userdom_read_user_home_content_symlinks',`
|
||||
type user_home_dir_t, user_home_t;
|
||||
')
|
||||
|
||||
@ -49058,7 +49146,7 @@ index 35f1476..1571559 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -1823,20 +2153,14 @@ interface(`userdom_read_user_home_content_symlinks',`
|
||||
@@ -1827,20 +2157,14 @@ interface(`userdom_read_user_home_content_symlinks',`
|
||||
#
|
||||
interface(`userdom_exec_user_home_content_files',`
|
||||
gen_require(`
|
||||
@ -49083,7 +49171,7 @@ index 35f1476..1571559 100644
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
@@ -2178,7 +2502,7 @@ interface(`userdom_dontaudit_read_user_tmp_files',`
|
||||
@@ -2182,7 +2506,7 @@ interface(`userdom_dontaudit_read_user_tmp_files',`
|
||||
type user_tmp_t;
|
||||
')
|
||||
|
||||
@ -49092,7 +49180,7 @@ index 35f1476..1571559 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -2431,13 +2755,14 @@ interface(`userdom_read_user_tmpfs_files',`
|
||||
@@ -2435,13 +2759,14 @@ interface(`userdom_read_user_tmpfs_files',`
|
||||
')
|
||||
|
||||
read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
|
||||
@ -49108,7 +49196,7 @@ index 35f1476..1571559 100644
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
@@ -2458,26 +2783,6 @@ interface(`userdom_rw_user_tmpfs_files',`
|
||||
@@ -2462,26 +2787,6 @@ interface(`userdom_rw_user_tmpfs_files',`
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
@ -49135,7 +49223,7 @@ index 35f1476..1571559 100644
|
||||
## Get the attributes of a user domain tty.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
@@ -2811,7 +3116,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
|
||||
@@ -2815,7 +3120,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
|
||||
|
||||
domain_entry_file_spec_domtrans($1, unpriv_userdomain)
|
||||
allow unpriv_userdomain $1:fd use;
|
||||
@ -49144,7 +49232,7 @@ index 35f1476..1571559 100644
|
||||
allow unpriv_userdomain $1:process sigchld;
|
||||
')
|
||||
|
||||
@@ -2827,11 +3132,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
|
||||
@@ -2831,11 +3136,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
|
||||
#
|
||||
interface(`userdom_search_user_home_content',`
|
||||
gen_require(`
|
||||
@ -49160,7 +49248,7 @@ index 35f1476..1571559 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -2913,7 +3220,7 @@ interface(`userdom_dontaudit_use_user_ptys',`
|
||||
@@ -2917,7 +3224,7 @@ interface(`userdom_dontaudit_use_user_ptys',`
|
||||
type user_devpts_t;
|
||||
')
|
||||
|
||||
@ -49169,7 +49257,7 @@ index 35f1476..1571559 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -2968,7 +3275,45 @@ interface(`userdom_write_user_tmp_files',`
|
||||
@@ -2972,7 +3279,45 @@ interface(`userdom_write_user_tmp_files',`
|
||||
type user_tmp_t;
|
||||
')
|
||||
|
||||
@ -49216,7 +49304,7 @@ index 35f1476..1571559 100644
|
||||
')
|
||||
|
||||
########################################
|
||||
@@ -3005,6 +3350,7 @@ interface(`userdom_read_all_users_state',`
|
||||
@@ -3009,6 +3354,7 @@ interface(`userdom_read_all_users_state',`
|
||||
')
|
||||
|
||||
read_files_pattern($1, userdomain, userdomain)
|
||||
@ -49224,7 +49312,7 @@ index 35f1476..1571559 100644
|
||||
kernel_search_proc($1)
|
||||
')
|
||||
|
||||
@@ -3135,3 +3481,873 @@ interface(`userdom_dbus_send_all_users',`
|
||||
@@ -3139,3 +3485,873 @@ interface(`userdom_dbus_send_all_users',`
|
||||
|
||||
allow $1 userdomain:dbus send_msg;
|
||||
')
|
||||
|
||||
@ -21,7 +21,7 @@
|
||||
Summary: SELinux policy configuration
|
||||
Name: selinux-policy
|
||||
Version: 3.9.11
|
||||
Release: 1%{?dist}
|
||||
Release: 2%{?dist}
|
||||
License: GPLv2+
|
||||
Group: System Environment/Base
|
||||
Source: serefpolicy-%{version}.tgz
|
||||
@ -471,6 +471,9 @@ exit 0
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Wed Dec 15 2010 Dan Walsh <dwalsh@redhat.com> 3.9.11-2
|
||||
- Update selinux policy to handle new /usr/share/sandbox/start script
|
||||
|
||||
* Wed Dec 15 2010 Miroslav Grepl <mgrepl@redhat.com> 3.9.11-1
|
||||
- Update to upstream
|
||||
- Fix version of policy in spec file
|
||||
|
||||
Loading…
Reference in New Issue
Block a user