rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy

Browse Source
This commit is contained in:
Dan Walsh 2012-08-01 15:30:03 -04:00
commit f9f0731de4
3 changed files with 105 additions and 80 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

157
policy-rawhide.patch
View File

@ -71844,7 +71844,7 @@ index 7be4ddf..f7021a0 100644
+
+/sys/class/net/ib.* gen_context(system_u:object_r:sysctl_net_t,s0)
diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index 4bf45cb..9c71d8e 100644
index 4bf45cb..30e39df 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -267,7 +267,7 @@ interface(`kernel_rw_unix_dgram_sockets',`
@ -72106,12 +72106,12 @@ index 4bf45cb..9c71d8e 100644
+## </summary>
+## </param>
+#
+interface(`kernel_stream_getattr',`
+interface(`kernel_stream_read',`
+ gen_require(`
+ type kernel_t;
+ ')
+
+ allow $1 kernel_t:unix_stream_socket getattr;
+ allow $1 kernel_t:unix_stream_socket { read getattr };
+')
+
+########################################
@ -82876,7 +82876,7 @@ index d26fe81..3f3a57f 100644
+ allow $1 init_t:system undefined;
+')
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 5fb9683..dfa38ad 100644
index 5fb9683..13860f3 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -16,6 +16,34 @@ gen_require(`
@ -83047,7 +83047,7 @@ index 5fb9683..dfa38ad 100644
mcs_process_set_categories(init_t)
mcs_killall(init_t)
@@ -156,22 +222,42 @@ mls_file_read_all_levels(init_t)
@@ -156,22 +222,41 @@ mls_file_read_all_levels(init_t)
mls_file_write_all_levels(init_t)
mls_process_write_down(init_t)
mls_fd_use_all_levels(init_t)
@ -83076,7 +83076,6 @@ index 5fb9683..dfa38ad 100644
+logging_send_audit_msgs(init_t)
logging_rw_generic_logs(init_t)
+logging_relabel_devlog_dev(init_t)
+logging_stream_connect_syslog(init_t)
seutil_read_config(init_t)
+seutil_read_module_store(init_t)
@ -83091,7 +83090,7 @@ index 5fb9683..dfa38ad 100644
ifdef(`distro_gentoo',`
allow init_t self:process { getcap setcap };
@@ -180,12 +266,15 @@ ifdef(`distro_gentoo',`
@@ -180,12 +265,18 @@ ifdef(`distro_gentoo',`
')
ifdef(`distro_redhat',`
@ -83101,6 +83100,9 @@ index 5fb9683..dfa38ad 100644
fs_read_tmpfs_symlinks(init_t)
fs_rw_tmpfs_chr_files(init_t)
fs_tmpfs_filetrans(init_t, initctl_t, fifo_file)
+
+ logging_stream_connect_syslog(init_t)
+ logging_relabel_syslog_pid_socket(init_t)
')
-tunable_policy(`init_upstart',`
@ -83108,7 +83110,7 @@ index 5fb9683..dfa38ad 100644
corecmd_shell_domtrans(init_t, initrc_t)
',`
# Run the shell in the sysadm role for single-user mode.
@@ -193,16 +282,148 @@ tunable_policy(`init_upstart',`
@@ -193,16 +284,148 @@ tunable_policy(`init_upstart',`
sysadm_shell_domtrans(init_t)
')
@ -83259,7 +83261,7 @@ index 5fb9683..dfa38ad 100644
')
optional_policy(`
@@ -210,6 +431,18 @@ optional_policy(`
@@ -210,6 +433,18 @@ optional_policy(`
')
optional_policy(`
@ -83278,7 +83280,7 @@ index 5fb9683..dfa38ad 100644
unconfined_domain(init_t)
')
@@ -219,8 +452,8 @@ optional_policy(`
@@ -219,8 +454,8 @@ optional_policy(`
#
allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
@ -83289,7 +83291,7 @@ index 5fb9683..dfa38ad 100644
allow initrc_t self:passwd rootok;
allow initrc_t self:key manage_key_perms;
@@ -248,12 +481,15 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
@@ -248,12 +483,15 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
allow initrc_t initrc_var_run_t:file manage_file_perms;
files_pid_filetrans(initrc_t, initrc_var_run_t, file)
@ -83305,7 +83307,7 @@ index 5fb9683..dfa38ad 100644
init_write_initctl(initrc_t)
@@ -265,20 +501,34 @@ kernel_change_ring_buffer_level(initrc_t)
@@ -265,20 +503,34 @@ kernel_change_ring_buffer_level(initrc_t)
kernel_clear_ring_buffer(initrc_t)
kernel_get_sysvipc_info(initrc_t)
kernel_read_all_sysctls(initrc_t)
@ -83345,7 +83347,7 @@ index 5fb9683..dfa38ad 100644
corenet_tcp_sendrecv_all_ports(initrc_t)
corenet_udp_sendrecv_all_ports(initrc_t)
corenet_tcp_connect_all_ports(initrc_t)
@@ -286,6 +536,7 @@ corenet_sendrecv_all_client_packets(initrc_t)
@@ -286,6 +538,7 @@ corenet_sendrecv_all_client_packets(initrc_t)
dev_read_rand(initrc_t)
dev_read_urand(initrc_t)
@ -83353,7 +83355,7 @@ index 5fb9683..dfa38ad 100644
dev_write_kmsg(initrc_t)
dev_write_rand(initrc_t)
dev_write_urand(initrc_t)
@@ -296,8 +547,10 @@ dev_write_framebuffer(initrc_t)
@@ -296,8 +549,10 @@ dev_write_framebuffer(initrc_t)
dev_read_realtime_clock(initrc_t)
dev_read_sound_mixer(initrc_t)
dev_write_sound_mixer(initrc_t)
@ -83364,7 +83366,7 @@ index 5fb9683..dfa38ad 100644
dev_delete_lvm_control_dev(initrc_t)
dev_manage_generic_symlinks(initrc_t)
dev_manage_generic_files(initrc_t)
@@ -305,17 +558,16 @@ dev_manage_generic_files(initrc_t)
@@ -305,17 +560,16 @@ dev_manage_generic_files(initrc_t)
dev_delete_generic_symlinks(initrc_t)
dev_getattr_all_blk_files(initrc_t)
dev_getattr_all_chr_files(initrc_t)
@ -83384,7 +83386,7 @@ index 5fb9683..dfa38ad 100644
domain_getsession_all_domains(initrc_t)
domain_use_interactive_fds(initrc_t)
# for lsof which is used by alsa shutdown:
@@ -323,6 +575,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
@@ -323,6 +577,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
domain_dontaudit_getattr_all_tcp_sockets(initrc_t)
domain_dontaudit_getattr_all_dgram_sockets(initrc_t)
domain_dontaudit_getattr_all_pipes(initrc_t)
@ -83392,7 +83394,7 @@ index 5fb9683..dfa38ad 100644
files_getattr_all_dirs(initrc_t)
files_getattr_all_files(initrc_t)
@@ -330,8 +583,10 @@ files_getattr_all_symlinks(initrc_t)
@@ -330,8 +585,10 @@ files_getattr_all_symlinks(initrc_t)
files_getattr_all_pipes(initrc_t)
files_getattr_all_sockets(initrc_t)
files_purge_tmp(initrc_t)
@ -83404,7 +83406,7 @@ index 5fb9683..dfa38ad 100644
files_delete_all_pids(initrc_t)
files_delete_all_pid_dirs(initrc_t)
files_read_etc_files(initrc_t)
@@ -347,8 +602,12 @@ files_list_isid_type_dirs(initrc_t)
@@ -347,8 +604,12 @@ files_list_isid_type_dirs(initrc_t)
files_mounton_isid_type_dirs(initrc_t)
files_list_default(initrc_t)
files_mounton_default(initrc_t)
@ -83418,7 +83420,7 @@ index 5fb9683..dfa38ad 100644
fs_list_inotifyfs(initrc_t)
fs_register_binary_executable_type(initrc_t)
# rhgb-console writes to ramfs
@@ -358,9 +617,12 @@ fs_mount_all_fs(initrc_t)
@@ -358,9 +619,12 @@ fs_mount_all_fs(initrc_t)
fs_unmount_all_fs(initrc_t)
fs_remount_all_fs(initrc_t)
fs_getattr_all_fs(initrc_t)
@ -83432,7 +83434,7 @@ index 5fb9683..dfa38ad 100644
mcs_killall(initrc_t)
mcs_process_set_categories(initrc_t)
@@ -370,6 +632,7 @@ mls_process_read_up(initrc_t)
@@ -370,6 +634,7 @@ mls_process_read_up(initrc_t)
mls_process_write_down(initrc_t)
mls_rangetrans_source(initrc_t)
mls_fd_share_all_levels(initrc_t)
@ -83440,7 +83442,7 @@ index 5fb9683..dfa38ad 100644
selinux_get_enforce_mode(initrc_t)
@@ -381,6 +644,7 @@ term_use_all_terms(initrc_t)
@@ -381,6 +646,7 @@ term_use_all_terms(initrc_t)
term_reset_tty_labels(initrc_t)
auth_rw_login_records(initrc_t)
@ -83448,7 +83450,7 @@ index 5fb9683..dfa38ad 100644
auth_setattr_login_records(initrc_t)
auth_rw_lastlog(initrc_t)
auth_read_pam_pid(initrc_t)
@@ -401,18 +665,17 @@ logging_read_audit_config(initrc_t)
@@ -401,18 +667,17 @@ logging_read_audit_config(initrc_t)
miscfiles_read_localization(initrc_t)
# slapd needs to read cert files from its initscript
@ -83470,7 +83472,7 @@ index 5fb9683..dfa38ad 100644
ifdef(`distro_debian',`
dev_setattr_generic_dirs(initrc_t)
@@ -465,6 +728,10 @@ ifdef(`distro_gentoo',`
@@ -465,6 +730,10 @@ ifdef(`distro_gentoo',`
sysnet_setattr_config(initrc_t)
optional_policy(`
@ -83481,7 +83483,7 @@ index 5fb9683..dfa38ad 100644
alsa_read_lib(initrc_t)
')
@@ -485,7 +752,7 @@ ifdef(`distro_redhat',`
@@ -485,7 +754,7 @@ ifdef(`distro_redhat',`
# Red Hat systems seem to have a stray
# fd open from the initrd
@ -83490,7 +83492,7 @@ index 5fb9683..dfa38ad 100644
files_dontaudit_read_root_files(initrc_t)
# These seem to be from the initrd
@@ -500,6 +767,7 @@ ifdef(`distro_redhat',`
@@ -500,6 +769,7 @@ ifdef(`distro_redhat',`
files_create_boot_dirs(initrc_t)
files_create_boot_flag(initrc_t)
files_rw_boot_symlinks(initrc_t)
@ -83498,7 +83500,7 @@ index 5fb9683..dfa38ad 100644
# wants to read /.fonts directory
files_read_default_files(initrc_t)
files_mountpoint(initrc_tmp_t)
@@ -520,6 +788,7 @@ ifdef(`distro_redhat',`
@@ -520,6 +790,7 @@ ifdef(`distro_redhat',`
miscfiles_rw_localization(initrc_t)
miscfiles_setattr_localization(initrc_t)
miscfiles_relabel_localization(initrc_t)
@ -83506,7 +83508,7 @@ index 5fb9683..dfa38ad 100644
miscfiles_read_fonts(initrc_t)
miscfiles_read_hwdata(initrc_t)
@@ -529,8 +798,35 @@ ifdef(`distro_redhat',`
@@ -529,8 +800,35 @@ ifdef(`distro_redhat',`
')
optional_policy(`
@ -83542,7 +83544,7 @@ index 5fb9683..dfa38ad 100644
')
optional_policy(`
@@ -538,14 +834,27 @@ ifdef(`distro_redhat',`
@@ -538,14 +836,27 @@ ifdef(`distro_redhat',`
rpc_write_exports(initrc_t)
rpc_manage_nfs_state_data(initrc_t)
')
@ -83570,7 +83572,7 @@ index 5fb9683..dfa38ad 100644
')
')
@@ -556,6 +865,39 @@ ifdef(`distro_suse',`
@@ -556,6 +867,39 @@ ifdef(`distro_suse',`
')
')
@ -83610,7 +83612,7 @@ index 5fb9683..dfa38ad 100644
optional_policy(`
amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t)
@@ -568,6 +910,8 @@ optional_policy(`
@@ -568,6 +912,8 @@ optional_policy(`
optional_policy(`
apache_read_config(initrc_t)
apache_list_modules(initrc_t)
@ -83619,7 +83621,7 @@ index 5fb9683..dfa38ad 100644
')
optional_policy(`
@@ -589,6 +933,7 @@ optional_policy(`
@@ -589,6 +935,7 @@ optional_policy(`
optional_policy(`
cgroup_stream_connect_cgred(initrc_t)
@ -83627,7 +83629,7 @@ index 5fb9683..dfa38ad 100644
')
optional_policy(`
@@ -601,6 +946,17 @@ optional_policy(`
@@ -601,6 +948,17 @@ optional_policy(`
')
optional_policy(`
@ -83645,7 +83647,7 @@ index 5fb9683..dfa38ad 100644
dev_getattr_printer_dev(initrc_t)
cups_read_log(initrc_t)
@@ -617,9 +973,13 @@ optional_policy(`
@@ -617,9 +975,13 @@ optional_policy(`
dbus_connect_system_bus(initrc_t)
dbus_system_bus_client(initrc_t)
dbus_read_config(initrc_t)
@ -83659,7 +83661,7 @@ index 5fb9683..dfa38ad 100644
')
optional_policy(`
@@ -644,6 +1004,10 @@ optional_policy(`
@@ -644,6 +1006,10 @@ optional_policy(`
')
optional_policy(`
@ -83670,7 +83672,7 @@ index 5fb9683..dfa38ad 100644
gpm_setattr_gpmctl(initrc_t)
')
@@ -661,6 +1025,15 @@ optional_policy(`
@@ -661,6 +1027,15 @@ optional_policy(`
')
optional_policy(`
@ -83686,7 +83688,7 @@ index 5fb9683..dfa38ad 100644
inn_exec_config(initrc_t)
')
@@ -701,6 +1074,7 @@ optional_policy(`
@@ -701,6 +1076,7 @@ optional_policy(`
lpd_list_spool(initrc_t)
lpd_read_config(initrc_t)
@ -83694,7 +83696,7 @@ index 5fb9683..dfa38ad 100644
')
optional_policy(`
@@ -718,7 +1092,13 @@ optional_policy(`
@@ -718,7 +1094,13 @@ optional_policy(`
')
optional_policy(`
@ -83708,7 +83710,7 @@ index 5fb9683..dfa38ad 100644
mta_dontaudit_read_spool_symlinks(initrc_t)
')
@@ -741,6 +1121,10 @@ optional_policy(`
@@ -741,6 +1123,10 @@ optional_policy(`
')
optional_policy(`
@ -83719,7 +83721,7 @@ index 5fb9683..dfa38ad 100644
postgresql_manage_db(initrc_t)
postgresql_read_config(initrc_t)
')
@@ -750,10 +1134,20 @@ optional_policy(`
@@ -750,10 +1136,20 @@ optional_policy(`
')
optional_policy(`
@ -83740,7 +83742,7 @@ index 5fb9683..dfa38ad 100644
quota_manage_flags(initrc_t)
')
@@ -762,6 +1156,10 @@ optional_policy(`
@@ -762,6 +1158,10 @@ optional_policy(`
')
optional_policy(`
@ -83751,7 +83753,7 @@ index 5fb9683..dfa38ad 100644
fs_write_ramfs_sockets(initrc_t)
fs_search_ramfs(initrc_t)
@@ -783,8 +1181,6 @@ optional_policy(`
@@ -783,8 +1183,6 @@ optional_policy(`
# bash tries ioctl for some reason
files_dontaudit_ioctl_all_pids(initrc_t)
@ -83760,7 +83762,7 @@ index 5fb9683..dfa38ad 100644
')
optional_policy(`
@@ -793,6 +1189,10 @@ optional_policy(`
@@ -793,6 +1191,10 @@ optional_policy(`
')
optional_policy(`
@ -83771,7 +83773,7 @@ index 5fb9683..dfa38ad 100644
# shorewall-init script run /var/lib/shorewall/firewall
shorewall_lib_domtrans(initrc_t)
')
@@ -802,10 +1202,12 @@ optional_policy(`
@@ -802,10 +1204,12 @@ optional_policy(`
squid_manage_logs(initrc_t)
')
@ -83784,7 +83786,7 @@ index 5fb9683..dfa38ad 100644
optional_policy(`
ssh_dontaudit_read_server_keys(initrc_t)
@@ -817,7 +1219,6 @@ optional_policy(`
@@ -817,7 +1221,6 @@ optional_policy(`
')
optional_policy(`
@ -83792,7 +83794,7 @@ index 5fb9683..dfa38ad 100644
udev_manage_pid_files(initrc_t)
udev_manage_rules_files(initrc_t)
')
@@ -827,12 +1228,30 @@ optional_policy(`
@@ -827,12 +1230,30 @@ optional_policy(`
')
optional_policy(`
@ -83825,7 +83827,7 @@ index 5fb9683..dfa38ad 100644
ifdef(`distro_redhat',`
# system-config-services causes avc messages that should be dontaudited
@@ -842,6 +1261,18 @@ optional_policy(`
@@ -842,6 +1263,18 @@ optional_policy(`
optional_policy(`
mono_domtrans(initrc_t)
')
@ -83844,7 +83846,7 @@ index 5fb9683..dfa38ad 100644
')
optional_policy(`
@@ -857,6 +1288,10 @@ optional_policy(`
@@ -857,6 +1290,10 @@ optional_policy(`
')
optional_policy(`
@ -83855,7 +83857,7 @@ index 5fb9683..dfa38ad 100644
# Set device ownerships/modes.
xserver_setattr_console_pipes(initrc_t)
@@ -867,3 +1302,165 @@ optional_policy(`
@@ -867,3 +1304,165 @@ optional_policy(`
optional_policy(`
zebra_read_config(initrc_t)
')
@ -85350,7 +85352,7 @@ index 02f4c97..be8c9a1 100644
+/var/webmin(/.*)? gen_context(system_u:object_r:var_log_t,s0)
+
diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
index 321bb13..7b4e560 100644
index 321bb13..e7fd936 100644
--- a/policy/modules/system/logging.if
+++ b/policy/modules/system/logging.if
@@ -233,7 +233,7 @@ interface(`logging_run_auditd',`
@ -85435,7 +85437,7 @@ index 321bb13..7b4e560 100644
########################################
## <summary>
## Send system log messages.
@@ -546,6 +603,66 @@ interface(`logging_send_syslog_msg',`
@@ -546,6 +603,84 @@ interface(`logging_send_syslog_msg',`
# will write to the console.
term_write_console($1)
term_dontaudit_read_console($1)
@ -85484,6 +85486,24 @@ index 321bb13..7b4e560 100644
+
+########################################
+## <summary>
+## Relabel the syslog pid sock_file.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`logging_relabel_syslog_pid_socket',`
+ gen_require(`
+ type devlog_t;
+ ')
+
+ allow $1 syslogd_var_run_t:sock_file relabel_sock_file_perms;
+')
+
+########################################
+## <summary>
+## Connect to the syslog control unix stream socket.
+## </summary>
+## <param name="domain">
@ -85502,7 +85522,7 @@ index 321bb13..7b4e560 100644
')
########################################
@@ -739,7 +856,25 @@ interface(`logging_append_all_logs',`
@@ -739,7 +874,25 @@ interface(`logging_append_all_logs',`
')
files_search_var($1)
@ -85529,7 +85549,7 @@ index 321bb13..7b4e560 100644
')
########################################
@@ -822,7 +957,7 @@ interface(`logging_manage_all_logs',`
@@ -822,7 +975,7 @@ interface(`logging_manage_all_logs',`
files_search_var($1)
manage_files_pattern($1, logfile, logfile)
@ -85538,7 +85558,7 @@ index 321bb13..7b4e560 100644
')
########################################
@@ -848,6 +983,44 @@ interface(`logging_read_generic_logs',`
@@ -848,6 +1001,44 @@ interface(`logging_read_generic_logs',`
########################################
## <summary>
@ -85583,7 +85603,7 @@ index 321bb13..7b4e560 100644
## Write generic log files.
## </summary>
## <param name="domain">
@@ -947,11 +1120,16 @@ interface(`logging_admin_audit',`
@@ -947,11 +1138,16 @@ interface(`logging_admin_audit',`
type auditd_t, auditd_etc_t, auditd_log_t;
type auditd_var_run_t;
type auditd_initrc_exec_t;
@ -85601,7 +85621,7 @@ index 321bb13..7b4e560 100644
manage_dirs_pattern($1, auditd_etc_t, auditd_etc_t)
manage_files_pattern($1, auditd_etc_t, auditd_etc_t)
@@ -967,6 +1145,33 @@ interface(`logging_admin_audit',`
@@ -967,6 +1163,33 @@ interface(`logging_admin_audit',`
domain_system_change_exemption($1)
role_transition $2 auditd_initrc_exec_t system_r;
allow $2 system_r;
@ -85635,7 +85655,7 @@ index 321bb13..7b4e560 100644
')
########################################
@@ -995,10 +1200,15 @@ interface(`logging_admin_syslog',`
@@ -995,10 +1218,15 @@ interface(`logging_admin_syslog',`
type syslogd_initrc_exec_t;
')
@ -85653,7 +85673,7 @@ index 321bb13..7b4e560 100644
manage_dirs_pattern($1, klogd_var_run_t, klogd_var_run_t)
manage_files_pattern($1, klogd_var_run_t, klogd_var_run_t)
@@ -1020,6 +1230,8 @@ interface(`logging_admin_syslog',`
@@ -1020,6 +1248,8 @@ interface(`logging_admin_syslog',`
manage_files_pattern($1, syslogd_var_run_t, syslogd_var_run_t)
logging_manage_all_logs($1)
@ -85662,7 +85682,7 @@ index 321bb13..7b4e560 100644
init_labeled_script_domtrans($1, syslogd_initrc_exec_t)
domain_system_change_exemption($1)
@@ -1048,3 +1260,29 @@ interface(`logging_admin',`
@@ -1048,3 +1278,29 @@ interface(`logging_admin',`
logging_admin_audit($1, $2)
logging_admin_syslog($1, $2)
')
@ -85693,7 +85713,7 @@ index 321bb13..7b4e560 100644
+ init_named_pid_filetrans($1, syslogd_var_run_t, dir, "journal")
+')
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 92555db..6970a23 100644
index 92555db..bec9a0b 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -5,6 +5,20 @@ policy_module(logging, 1.18.2)
@ -85897,7 +85917,7 @@ index 92555db..6970a23 100644
manage_files_pattern(syslogd_t, syslogd_var_run_t, syslogd_var_run_t)
files_pid_filetrans(syslogd_t, syslogd_var_run_t, file)
+kernel_stream_getattr(syslogd_t)
+kernel_stream_read(syslogd_t)
kernel_read_system_state(syslogd_t)
kernel_read_kernel_sysctls(syslogd_t)
kernel_read_proc_symlinks(syslogd_t)
@ -86200,7 +86220,7 @@ index 58bc27f..51e9872 100644
+ allow $1 lvm_var_run_t:fifo_file rw_inherited_fifo_file_perms;
+')
diff --git a/policy/modules/system/lvm.te b/policy/modules/system/lvm.te
index 7b6bcb9..61aa1ce 100644
index 7b6bcb9..08b4b7e 100644
--- a/policy/modules/system/lvm.te
+++ b/policy/modules/system/lvm.te
@@ -12,6 +12,9 @@ init_daemon_domain(clvmd_t, clvmd_exec_t)
@ -86359,16 +86379,17 @@ index 7b6bcb9..61aa1ce 100644
init_use_fds(lvm_t)
init_dontaudit_getattr_initctl(lvm_t)
@@ -292,6 +314,8 @@ init_read_script_state(lvm_t)
@@ -291,6 +313,9 @@ init_use_script_ptys(lvm_t)
init_read_script_state(lvm_t)
logging_send_syslog_msg(lvm_t)
+authlogin_rw_pipes(lvm_t)
+logging_stream_connect_syslog(lvm_t)
+
+authlogin_rw_pipes(lvm_t)
miscfiles_read_localization(lvm_t)
seutil_read_config(lvm_t)
@@ -299,7 +323,10 @@ seutil_read_file_contexts(lvm_t)
@@ -299,7 +324,10 @@ seutil_read_file_contexts(lvm_t)
seutil_search_default_contexts(lvm_t)
seutil_sigchld_newrole(lvm_t)
@ -86379,7 +86400,7 @@ index 7b6bcb9..61aa1ce 100644
ifdef(`distro_redhat',`
# this is from the initrd:
@@ -311,6 +338,11 @@ ifdef(`distro_redhat',`
@@ -311,6 +339,11 @@ ifdef(`distro_redhat',`
')
optional_policy(`
@ -86391,7 +86412,7 @@ index 7b6bcb9..61aa1ce 100644
bootloader_rw_tmp_files(lvm_t)
')
@@ -331,14 +363,27 @@ optional_policy(`
@@ -331,14 +364,27 @@ optional_policy(`
')
optional_policy(`

23
policy_contrib-rawhide.patch
View File

@ -40986,7 +40986,7 @@ index 9759ed8..17c097d 100644
admin_pattern($1, plymouthd_var_run_t)
')
diff --git a/plymouthd.te b/plymouthd.te
index 86700ed..9ee1a3f 100644
index 86700ed..1600742 100644
--- a/plymouthd.te
+++ b/plymouthd.te
@@ -1,4 +1,4 @@
@ -41029,11 +41029,13 @@ index 86700ed..9ee1a3f 100644
manage_dirs_pattern(plymouthd_t, plymouthd_var_run_t, plymouthd_var_run_t)
manage_files_pattern(plymouthd_t, plymouthd_var_run_t, plymouthd_var_run_t)
files_pid_filetrans(plymouthd_t, plymouthd_var_run_t, { file dir })
@@ -60,10 +68,32 @@ domain_use_interactive_fds(plymouthd_t)
@@ -60,10 +68,34 @@ domain_use_interactive_fds(plymouthd_t)
files_read_etc_files(plymouthd_t)
files_read_usr_files(plymouthd_t)
+term_use_unallocated_ttys(plymouthd_t)
+term_getattr_pty_fs(plymouthd_t)
+term_use_all_terms(plymouthd_t)
+term_use_ptmx(plymouthd_t)
+
+init_signal(plymouthd_t)
+
@ -41062,7 +41064,7 @@ index 86700ed..9ee1a3f 100644
########################################
#
# Plymouth private policy
@@ -74,6 +104,7 @@ allow plymouth_t self:fifo_file rw_file_perms;
@@ -74,6 +106,7 @@ allow plymouth_t self:fifo_file rw_file_perms;
allow plymouth_t self:unix_stream_socket create_stream_socket_perms;
kernel_read_system_state(plymouth_t)
@ -61994,7 +61996,7 @@ index 7c5d8d8..9883b66 100644
+ files_pid_filetrans($1, virt_lxc_var_run_t, dir, "libvirt-sandbox")
')
diff --git a/virt.te b/virt.te
index ad3068a..1157058 100644
index ad3068a..dcde4ba 100644
--- a/virt.te
+++ b/virt.te
@@ -5,56 +5,87 @@ policy_module(virt, 1.4.2)
@ -62615,7 +62617,7 @@ index ad3068a..1157058 100644
files_read_usr_files(virt_domain)
files_read_var_files(virt_domain)
files_search_all(virt_domain)
@@ -449,25 +662,442 @@ files_search_all(virt_domain)
@@ -449,25 +662,441 @@ files_search_all(virt_domain)
fs_getattr_tmpfs(virt_domain)
fs_rw_anon_inodefs_files(virt_domain)
fs_rw_tmpfs_files(virt_domain)
@ -62623,12 +62625,12 @@ index ad3068a..1157058 100644
+fs_rw_inherited_nfs_files(virt_domain)
+fs_rw_inherited_cifs_files(virt_domain)
+fs_rw_inherited_noxattr_fs_files(virt_domain)
+
-term_use_all_terms(virt_domain)
+# I think we need these for now.
+miscfiles_read_public_files(virt_domain)
+storage_raw_read_removable_device(virt_domain)
-term_use_all_terms(virt_domain)
+
+term_use_all_inherited_terms(virt_domain)
term_getattr_pty_fs(virt_domain)
term_use_generic_ptys(virt_domain)
@ -62878,7 +62880,7 @@ index ad3068a..1157058 100644
+#
+# virt_lxc_domain local policy
+#
+allow svirt_lxc_domain self:capability { kill setuid setgid dac_override };
+allow svirt_lxc_domain self:capability { kill setuid setgid dac_override sys_boot };
+
+allow virtd_t svirt_lxc_domain:unix_stream_socket { create_stream_socket_perms connectto };
+allow virtd_t svirt_lxc_domain:process { signal_perms };
@ -63059,7 +63061,6 @@ index ad3068a..1157058 100644
+
+corenet_rw_tun_tap_dev(virt_bridgehelper_t)
+
+
+userdom_use_inherited_user_ptys(virt_bridgehelper_t)
diff --git a/vlock.te b/vlock.te
index 2511093..9e5625e 100644

5
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.11.0
Release: 14%{?dist}
Release: 15%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@ -491,6 +491,9 @@ SELinux Reference policy mls base module.
%endif
%changelog
* Mon Jul 30 2012 Miroslav Grepl <mgrepl@redhat.com> 3.11.0-15
- More fixes for systemd to make rawhide booting from Dan Walsh
* Mon Jul 30 2012 Miroslav Grepl <mgrepl@redhat.com> 3.11.0-14
- Add systemd fixes to make rawhide booting