rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Add kernel_mounton_messages() interface 

- init wants to manage lock files for iscsi
- Add support for dey_sapi port
- Fixes needed for docker
- Allow epmd to manage /var/log/rabbitmq/startup_err file
- Allow beam.smp connect to amqp port
- drbdadm executes drbdmeta
- Added osad policy
- Allow postfix to deliver to procmail
- Allow vmtools to execute /usr/bin/lsb_release
- Allow geoclue to read /etc/passwd
- Allow docker to write system net ctrls
- Add support for rhnsd unit file
- Add dbus_chat_session_bus() interface
- Add dbus_stream_connect_session_bus() interface
- Fix pcp.te
- Fix logrotate_use_nfs boolean
- Add lot of pcp fixes found in RHEL7
- fix labeling for pmie for pcp pkg
- Change thumb_t to be allowed to chat/connect with session bus type
- Add logrotate_use_nfs boolean
- Allow setroubleshootd to read rpc sysctl
This commit is contained in:
Miroslav Grepl 2014-02-05 08:52:08 +01:00
parent 4cde844b7e
commit fc059db54d
3 changed files with 1155 additions and 551 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

226
policy-rawhide-base.patch
View File

@ -5410,7 +5410,7 @@ index 8e0f9cd..b9f45b9 100644
define(`create_packet_interfaces',`` define(`create_packet_interfaces',``
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
index b191055..51daa72 100644 index b191055..b60c687 100644
--- a/policy/modules/kernel/corenetwork.te.in --- a/policy/modules/kernel/corenetwork.te.in
+++ b/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in
@@ -5,6 +5,7 @@ policy_module(corenetwork, 1.19.2) @@ -5,6 +5,7 @@ policy_module(corenetwork, 1.19.2)
@ -5497,7 +5497,7 @@ index b191055..51daa72 100644
network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0) network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0)
network_port(audit, tcp,60,s0) network_port(audit, tcp,60,s0)
network_port(auth, tcp,113,s0) network_port(auth, tcp,113,s0)
@@ -96,19 +119,20 @@ network_port(boinc, tcp,31416,s0) @@ -96,43 +119,53 @@ network_port(boinc, tcp,31416,s0)
network_port(boinc_client, tcp,1043,s0, udp,1034,s0) network_port(boinc_client, tcp,1043,s0, udp,1034,s0)
network_port(biff) # no defined portcon network_port(biff) # no defined portcon
network_port(certmaster, tcp,51235,s0) network_port(certmaster, tcp,51235,s0)
@ -5521,7 +5521,11 @@ index b191055..51daa72 100644
network_port(cvs, tcp,2401,s0, udp,2401,s0) network_port(cvs, tcp,2401,s0, udp,2401,s0)
network_port(cyphesis, tcp,6767,s0, tcp,6769,s0, tcp,6780-6799,s0, udp,32771,s0) network_port(cyphesis, tcp,6767,s0, tcp,6769,s0, tcp,6780-6799,s0, udp,32771,s0)
network_port(daap, tcp,3689,s0, udp,3689,s0) network_port(daap, tcp,3689,s0, udp,3689,s0)
@@ -119,20 +143,28 @@ network_port(dhcpc, udp,68,s0, tcp,68,s0, udp,546,s0, tcp, 546,s0, udp,5546,s0, network_port(dbskkd, tcp,1178,s0)
network_port(dcc, udp,6276,s0, udp,6277,s0)
network_port(dccm, tcp,5679,s0, udp,5679,s0)
+network_port(dey_sapi, tcp,4330,s0)
network_port(dhcpc, udp,68,s0, tcp,68,s0, udp,546,s0, tcp, 546,s0, udp,5546,s0, tcp,5546,s0)
network_port(dhcpd, udp,67,s0, udp,547,s0, tcp, 547,s0, udp,548,s0, tcp, 548,s0, tcp,647,s0, udp,647,s0, tcp,847,s0, udp,847,s0, tcp,7911,s0) network_port(dhcpd, udp,67,s0, udp,547,s0, tcp, 547,s0, udp,548,s0, tcp, 548,s0, tcp,647,s0, udp,647,s0, tcp,847,s0, udp,847,s0, tcp,7911,s0)
network_port(dict, tcp,2628,s0) network_port(dict, tcp,2628,s0)
network_port(distccd, tcp,3632,s0) network_port(distccd, tcp,3632,s0)
@ -5552,7 +5556,7 @@ index b191055..51daa72 100644
network_port(gopher, tcp,70,s0, udp,70,s0) network_port(gopher, tcp,70,s0, udp,70,s0)
network_port(gpsd, tcp,2947,s0) network_port(gpsd, tcp,2947,s0)
network_port(hadoop_datanode, tcp,50010,s0) network_port(hadoop_datanode, tcp,50010,s0)
@@ -140,45 +172,52 @@ network_port(hadoop_namenode, tcp,8020,s0) @@ -140,45 +173,52 @@ network_port(hadoop_namenode, tcp,8020,s0)
network_port(hddtemp, tcp,7634,s0) network_port(hddtemp, tcp,7634,s0)
network_port(howl, tcp,5335,s0, udp,5353,s0) network_port(howl, tcp,5335,s0, udp,5353,s0)
network_port(hplip, tcp,1782,s0, tcp,2207,s0, tcp,2208,s0, tcp, 8290,s0, tcp,50000,s0, tcp,50002,s0, tcp,8292,s0, tcp,9100,s0, tcp,9101,s0, tcp,9102,s0, tcp,9220,s0, tcp,9221,s0, tcp,9222,s0, tcp,9280,s0, tcp,9281,s0, tcp,9282,s0, tcp,9290,s0, tcp,9291,s0) network_port(hplip, tcp,1782,s0, tcp,2207,s0, tcp,2208,s0, tcp, 8290,s0, tcp,50000,s0, tcp,50002,s0, tcp,8292,s0, tcp,9100,s0, tcp,9101,s0, tcp,9102,s0, tcp,9220,s0, tcp,9221,s0, tcp,9222,s0, tcp,9280,s0, tcp,9281,s0, tcp,9282,s0, tcp,9290,s0, tcp,9291,s0)
@ -5619,7 +5623,7 @@ index b191055..51daa72 100644
network_port(msnp, tcp,1863,s0, udp,1863,s0) network_port(msnp, tcp,1863,s0, udp,1863,s0)
network_port(mssql, tcp,1433-1434,s0, udp,1433-1434,s0) network_port(mssql, tcp,1433-1434,s0, udp,1433-1434,s0)
network_port(ms_streaming, tcp,1755,s0, udp,1755,s0) network_port(ms_streaming, tcp,1755,s0, udp,1755,s0)
@@ -186,26 +225,35 @@ network_port(munin, tcp,4949,s0, udp,4949,s0) @@ -186,26 +226,35 @@ network_port(munin, tcp,4949,s0, udp,4949,s0)
network_port(mxi, tcp,8005,s0, udp,8005,s0) network_port(mxi, tcp,8005,s0, udp,8005,s0)
network_port(mysqld, tcp,1186,s0, tcp,3306,s0, tcp,63132-63164,s0) network_port(mysqld, tcp,1186,s0, tcp,3306,s0, tcp,63132-63164,s0)
network_port(mysqlmanagerd, tcp,2273,s0) network_port(mysqlmanagerd, tcp,2273,s0)
@ -5659,7 +5663,7 @@ index b191055..51daa72 100644
network_port(portmap, udp,111,s0, tcp,111,s0) network_port(portmap, udp,111,s0, tcp,111,s0)
network_port(postfix_policyd, tcp,10031,s0) network_port(postfix_policyd, tcp,10031,s0)
network_port(postgresql, tcp,5432,s0) network_port(postgresql, tcp,5432,s0)
@@ -215,39 +263,45 @@ network_port(prelude, tcp,4690,s0, udp,4690,s0) @@ -215,39 +264,45 @@ network_port(prelude, tcp,4690,s0, udp,4690,s0)
network_port(presence, tcp,5298-5299,s0, udp,5298-5299,s0) network_port(presence, tcp,5298-5299,s0, udp,5298-5299,s0)
network_port(printer, tcp,515,s0) network_port(printer, tcp,515,s0)
network_port(ptal, tcp,5703,s0) network_port(ptal, tcp,5703,s0)
@ -5712,7 +5716,7 @@ index b191055..51daa72 100644
network_port(ssh, tcp,22,s0) network_port(ssh, tcp,22,s0)
network_port(stunnel) # no defined portcon network_port(stunnel) # no defined portcon
network_port(svn, tcp,3690,s0, udp,3690,s0) network_port(svn, tcp,3690,s0, udp,3690,s0)
@@ -259,8 +313,9 @@ network_port(syslog_tls, tcp,6514,s0, udp,6514,s0) @@ -259,8 +314,9 @@ network_port(syslog_tls, tcp,6514,s0, udp,6514,s0)
network_port(tcs, tcp, 30003, s0) network_port(tcs, tcp, 30003, s0)
network_port(telnetd, tcp,23,s0) network_port(telnetd, tcp,23,s0)
network_port(tftp, udp,69,s0) network_port(tftp, udp,69,s0)
@ -5723,7 +5727,7 @@ index b191055..51daa72 100644
network_port(transproxy, tcp,8081,s0) network_port(transproxy, tcp,8081,s0)
network_port(trisoap, tcp,10200,s0, udp,10200,s0) network_port(trisoap, tcp,10200,s0, udp,10200,s0)
network_port(trivnet1, tcp, 8200, s0, udp, 8200, s0) network_port(trivnet1, tcp, 8200, s0, udp, 8200, s0)
@@ -271,10 +326,10 @@ network_port(varnishd, tcp,6081-6082,s0) @@ -271,10 +327,10 @@ network_port(varnishd, tcp,6081-6082,s0)
network_port(virt, tcp,16509,s0, udp,16509,s0, tcp,16514,s0, udp,16514,s0) network_port(virt, tcp,16509,s0, udp,16509,s0, tcp,16514,s0, udp,16514,s0)
network_port(virtual_places, tcp,1533,s0, udp,1533,s0) network_port(virtual_places, tcp,1533,s0, udp,1533,s0)
network_port(virt_migration, tcp,49152-49216,s0) network_port(virt_migration, tcp,49152-49216,s0)
@ -5736,7 +5740,7 @@ index b191055..51daa72 100644
network_port(winshadow, tcp,3161,s0, udp,3261,s0) network_port(winshadow, tcp,3161,s0, udp,3261,s0)
network_port(wsdapi, tcp,5357,s0, udp,5357,s0) network_port(wsdapi, tcp,5357,s0, udp,5357,s0)
network_port(wsicopy, tcp,3378,s0, udp,3378,s0) network_port(wsicopy, tcp,3378,s0, udp,3378,s0)
@@ -288,19 +343,23 @@ network_port(zabbix_agent, tcp,10050,s0) @@ -288,19 +344,23 @@ network_port(zabbix_agent, tcp,10050,s0)
network_port(zookeeper_client, tcp,2181,s0) network_port(zookeeper_client, tcp,2181,s0)
network_port(zookeeper_election, tcp,3888,s0) network_port(zookeeper_election, tcp,3888,s0)
network_port(zookeeper_leader, tcp,2888,s0) network_port(zookeeper_leader, tcp,2888,s0)
@ -5763,7 +5767,7 @@ index b191055..51daa72 100644
######################################## ########################################
# #
@@ -333,6 +392,8 @@ sid netif gen_context(system_u:object_r:netif_t,s0 - mls_systemhigh) @@ -333,6 +393,8 @@ sid netif gen_context(system_u:object_r:netif_t,s0 - mls_systemhigh)
build_option(`enable_mls',` build_option(`enable_mls',`
network_interface(lo, lo, s0 - mls_systemhigh) network_interface(lo, lo, s0 - mls_systemhigh)
@ -5772,7 +5776,7 @@ index b191055..51daa72 100644
',` ',`
typealias netif_t alias { lo_netif_t netif_lo_t }; typealias netif_t alias { lo_netif_t netif_lo_t };
') ')
@@ -345,9 +406,28 @@ typealias netif_t alias { lo_netif_t netif_lo_t }; @@ -345,9 +407,28 @@ typealias netif_t alias { lo_netif_t netif_lo_t };
allow corenet_unconfined_type node_type:node *; allow corenet_unconfined_type node_type:node *;
allow corenet_unconfined_type netif_type:netif *; allow corenet_unconfined_type netif_type:netif *;
allow corenet_unconfined_type packet_type:packet *; allow corenet_unconfined_type packet_type:packet *;
@ -14917,7 +14921,7 @@ index 7be4ddf..d5ef507 100644
+/sys/class/net/ib.* gen_context(system_u:object_r:sysctl_net_t,s0) +/sys/class/net/ib.* gen_context(system_u:object_r:sysctl_net_t,s0)
+/sys/kernel/uevent_helper -- gen_context(system_u:object_r:usermodehelper_t,s0) +/sys/kernel/uevent_helper -- gen_context(system_u:object_r:usermodehelper_t,s0)
diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
index e100d88..6f745f0 100644 index e100d88..ee4c057 100644
--- a/policy/modules/kernel/kernel.if --- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if +++ b/policy/modules/kernel/kernel.if
@@ -286,7 +286,7 @@ interface(`kernel_rw_unix_dgram_sockets',` @@ -286,7 +286,7 @@ interface(`kernel_rw_unix_dgram_sockets',`
@ -15031,7 +15035,33 @@ index e100d88..6f745f0 100644
## Do not audit attempts by caller to ## Do not audit attempts by caller to
## read system state information in proc. ## read system state information in proc.
## </summary> ## </summary>
@@ -1477,6 +1529,24 @@ interface(`kernel_dontaudit_list_all_proc',` @@ -1208,6 +1260,25 @@ interface(`kernel_read_messages',`
########################################
## <summary>
+## Allow caller to read kernel messages
+## using the /proc/kmsg interface.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`kernel_mounton_messages',`
+ gen_require(`
+ type proc_kmsg_t, proc_t;
+ ')
+
+ allow $1 proc_kmsg_t:dir mounton;
+')
+
+########################################
+## <summary>
## Allow caller to get the attributes of kernel message
## interface (/proc/kmsg).
## </summary>
@@ -1477,6 +1548,24 @@ interface(`kernel_dontaudit_list_all_proc',`
######################################## ########################################
## <summary> ## <summary>
@ -15056,7 +15086,7 @@ index e100d88..6f745f0 100644
## Do not audit attempts by caller to search ## Do not audit attempts by caller to search
## the base directory of sysctls. ## the base directory of sysctls.
## </summary> ## </summary>
@@ -1750,16 +1820,9 @@ interface(`kernel_rw_unix_sysctls',` @@ -1750,16 +1839,9 @@ interface(`kernel_rw_unix_sysctls',`
## Domain allowed access. ## Domain allowed access.
## </summary> ## </summary>
## </param> ## </param>
@ -15074,7 +15104,7 @@ index e100d88..6f745f0 100644
') ')
######################################## ########################################
@@ -1771,16 +1834,9 @@ interface(`kernel_read_hotplug_sysctls',` @@ -1771,16 +1853,9 @@ interface(`kernel_read_hotplug_sysctls',`
## Domain allowed access. ## Domain allowed access.
## </summary> ## </summary>
## </param> ## </param>
@ -15092,7 +15122,7 @@ index e100d88..6f745f0 100644
') ')
######################################## ########################################
@@ -1792,16 +1848,9 @@ interface(`kernel_rw_hotplug_sysctls',` @@ -1792,16 +1867,9 @@ interface(`kernel_rw_hotplug_sysctls',`
## Domain allowed access. ## Domain allowed access.
## </summary> ## </summary>
## </param> ## </param>
@ -15110,7 +15140,7 @@ index e100d88..6f745f0 100644
') ')
######################################## ########################################
@@ -1813,16 +1862,9 @@ interface(`kernel_read_modprobe_sysctls',` @@ -1813,16 +1881,9 @@ interface(`kernel_read_modprobe_sysctls',`
## Domain allowed access. ## Domain allowed access.
## </summary> ## </summary>
## </param> ## </param>
@ -15128,7 +15158,7 @@ index e100d88..6f745f0 100644
') ')
######################################## ########################################
@@ -2085,7 +2127,7 @@ interface(`kernel_dontaudit_list_all_sysctls',` @@ -2085,7 +2146,7 @@ interface(`kernel_dontaudit_list_all_sysctls',`
') ')
dontaudit $1 sysctl_type:dir list_dir_perms; dontaudit $1 sysctl_type:dir list_dir_perms;
@ -15137,7 +15167,7 @@ index e100d88..6f745f0 100644
') ')
######################################## ########################################
@@ -2282,6 +2324,25 @@ interface(`kernel_list_unlabeled',` @@ -2282,6 +2343,25 @@ interface(`kernel_list_unlabeled',`
######################################## ########################################
## <summary> ## <summary>
@ -15163,7 +15193,7 @@ index e100d88..6f745f0 100644
## Read the process state (/proc/pid) of all unlabeled_t. ## Read the process state (/proc/pid) of all unlabeled_t.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -2306,7 +2367,7 @@ interface(`kernel_read_unlabeled_state',` @@ -2306,7 +2386,7 @@ interface(`kernel_read_unlabeled_state',`
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@ -15172,7 +15202,7 @@ index e100d88..6f745f0 100644
## </summary> ## </summary>
## </param> ## </param>
# #
@@ -2488,6 +2549,24 @@ interface(`kernel_rw_unlabeled_blk_files',` @@ -2488,6 +2568,24 @@ interface(`kernel_rw_unlabeled_blk_files',`
######################################## ########################################
## <summary> ## <summary>
@ -15197,7 +15227,7 @@ index e100d88..6f745f0 100644
## Do not audit attempts by caller to get attributes for ## Do not audit attempts by caller to get attributes for
## unlabeled character devices. ## unlabeled character devices.
## </summary> ## </summary>
@@ -2525,6 +2604,24 @@ interface(`kernel_relabelfrom_unlabeled_dirs',` @@ -2525,6 +2623,24 @@ interface(`kernel_relabelfrom_unlabeled_dirs',`
######################################## ########################################
## <summary> ## <summary>
@ -15222,7 +15252,7 @@ index e100d88..6f745f0 100644
## Allow caller to relabel unlabeled files. ## Allow caller to relabel unlabeled files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -2667,6 +2764,24 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',` @@ -2667,6 +2783,24 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',`
######################################## ########################################
## <summary> ## <summary>
@ -15247,7 +15277,7 @@ index e100d88..6f745f0 100644
## Receive TCP packets from an unlabeled connection. ## Receive TCP packets from an unlabeled connection.
## </summary> ## </summary>
## <desc> ## <desc>
@@ -2694,6 +2809,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',` @@ -2694,6 +2828,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',`
######################################## ########################################
## <summary> ## <summary>
@ -15273,7 +15303,7 @@ index e100d88..6f745f0 100644
## Do not audit attempts to receive TCP packets from an unlabeled ## Do not audit attempts to receive TCP packets from an unlabeled
## connection. ## connection.
## </summary> ## </summary>
@@ -2803,6 +2937,33 @@ interface(`kernel_raw_recvfrom_unlabeled',` @@ -2803,6 +2956,33 @@ interface(`kernel_raw_recvfrom_unlabeled',`
allow $1 unlabeled_t:rawip_socket recvfrom; allow $1 unlabeled_t:rawip_socket recvfrom;
') ')
@ -15307,7 +15337,7 @@ index e100d88..6f745f0 100644
######################################## ########################################
## <summary> ## <summary>
@@ -2958,6 +3119,24 @@ interface(`kernel_relabelfrom_unlabeled_database',` @@ -2958,6 +3138,24 @@ interface(`kernel_relabelfrom_unlabeled_database',`
######################################## ########################################
## <summary> ## <summary>
@ -15332,7 +15362,7 @@ index e100d88..6f745f0 100644
## Unconfined access to kernel module resources. ## Unconfined access to kernel module resources.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -2972,5 +3151,565 @@ interface(`kernel_unconfined',` @@ -2972,5 +3170,565 @@ interface(`kernel_unconfined',`
') ')
typeattribute $1 kern_unconfined; typeattribute $1 kern_unconfined;
@ -29278,7 +29308,7 @@ index 79a45f6..9a14d49 100644
+ files_etc_filetrans($1, machineid_t, file, "machine-id" ) + files_etc_filetrans($1, machineid_t, file, "machine-id" )
+') +')
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 17eda24..fdd335a 100644 index 17eda24..17932ac 100644
--- a/policy/modules/system/init.te --- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te +++ b/policy/modules/system/init.te
@@ -11,10 +11,31 @@ gen_require(` @@ -11,10 +11,31 @@ gen_require(`
@ -29526,7 +29556,7 @@ index 17eda24..fdd335a 100644
ifdef(`distro_gentoo',` ifdef(`distro_gentoo',`
allow init_t self:process { getcap setcap }; allow init_t self:process { getcap setcap };
@@ -186,29 +286,212 @@ ifdef(`distro_gentoo',` @@ -186,29 +286,213 @@ ifdef(`distro_gentoo',`
') ')
ifdef(`distro_redhat',` ifdef(`distro_redhat',`
@ -29571,6 +29601,7 @@ index 17eda24..fdd335a 100644
+ +
+optional_policy(` +optional_policy(`
+ iscsi_read_lib_files(init_t) + iscsi_read_lib_files(init_t)
+ iscsi_manage_lock(init_t)
+') +')
+ +
+optional_policy(` +optional_policy(`
@ -29747,7 +29778,7 @@ index 17eda24..fdd335a 100644
') ')
optional_policy(` optional_policy(`
@@ -216,7 +499,30 @@ optional_policy(` @@ -216,7 +500,30 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -29778,7 +29809,7 @@ index 17eda24..fdd335a 100644
') ')
######################################## ########################################
@@ -225,9 +531,9 @@ optional_policy(` @@ -225,9 +532,9 @@ optional_policy(`
# #
allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched }; allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
@ -29790,7 +29821,7 @@ index 17eda24..fdd335a 100644
allow initrc_t self:passwd rootok; allow initrc_t self:passwd rootok;
allow initrc_t self:key manage_key_perms; allow initrc_t self:key manage_key_perms;
@@ -258,12 +564,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t) @@ -258,12 +565,16 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t)
allow initrc_t initrc_var_run_t:file manage_file_perms; allow initrc_t initrc_var_run_t:file manage_file_perms;
files_pid_filetrans(initrc_t, initrc_var_run_t, file) files_pid_filetrans(initrc_t, initrc_var_run_t, file)
@ -29807,7 +29838,7 @@ index 17eda24..fdd335a 100644
manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t) manage_dirs_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t) manage_files_pattern(initrc_t, initrc_var_log_t, initrc_var_log_t)
@@ -279,23 +589,36 @@ kernel_change_ring_buffer_level(initrc_t) @@ -279,23 +590,36 @@ kernel_change_ring_buffer_level(initrc_t)
kernel_clear_ring_buffer(initrc_t) kernel_clear_ring_buffer(initrc_t)
kernel_get_sysvipc_info(initrc_t) kernel_get_sysvipc_info(initrc_t)
kernel_read_all_sysctls(initrc_t) kernel_read_all_sysctls(initrc_t)
@ -29850,7 +29881,7 @@ index 17eda24..fdd335a 100644
corenet_tcp_sendrecv_all_ports(initrc_t) corenet_tcp_sendrecv_all_ports(initrc_t)
corenet_udp_sendrecv_all_ports(initrc_t) corenet_udp_sendrecv_all_ports(initrc_t)
corenet_tcp_connect_all_ports(initrc_t) corenet_tcp_connect_all_ports(initrc_t)
@@ -303,9 +626,11 @@ corenet_sendrecv_all_client_packets(initrc_t) @@ -303,9 +627,11 @@ corenet_sendrecv_all_client_packets(initrc_t)
dev_read_rand(initrc_t) dev_read_rand(initrc_t)
dev_read_urand(initrc_t) dev_read_urand(initrc_t)
@ -29862,7 +29893,7 @@ index 17eda24..fdd335a 100644
dev_rw_sysfs(initrc_t) dev_rw_sysfs(initrc_t)
dev_list_usbfs(initrc_t) dev_list_usbfs(initrc_t)
dev_read_framebuffer(initrc_t) dev_read_framebuffer(initrc_t)
@@ -313,8 +638,10 @@ dev_write_framebuffer(initrc_t) @@ -313,8 +639,10 @@ dev_write_framebuffer(initrc_t)
dev_read_realtime_clock(initrc_t) dev_read_realtime_clock(initrc_t)
dev_read_sound_mixer(initrc_t) dev_read_sound_mixer(initrc_t)
dev_write_sound_mixer(initrc_t) dev_write_sound_mixer(initrc_t)
@ -29873,7 +29904,7 @@ index 17eda24..fdd335a 100644
dev_delete_lvm_control_dev(initrc_t) dev_delete_lvm_control_dev(initrc_t)
dev_manage_generic_symlinks(initrc_t) dev_manage_generic_symlinks(initrc_t)
dev_manage_generic_files(initrc_t) dev_manage_generic_files(initrc_t)
@@ -322,8 +649,7 @@ dev_manage_generic_files(initrc_t) @@ -322,8 +650,7 @@ dev_manage_generic_files(initrc_t)
dev_delete_generic_symlinks(initrc_t) dev_delete_generic_symlinks(initrc_t)
dev_getattr_all_blk_files(initrc_t) dev_getattr_all_blk_files(initrc_t)
dev_getattr_all_chr_files(initrc_t) dev_getattr_all_chr_files(initrc_t)
@ -29883,7 +29914,7 @@ index 17eda24..fdd335a 100644
domain_kill_all_domains(initrc_t) domain_kill_all_domains(initrc_t)
domain_signal_all_domains(initrc_t) domain_signal_all_domains(initrc_t)
@@ -332,7 +658,6 @@ domain_sigstop_all_domains(initrc_t) @@ -332,7 +659,6 @@ domain_sigstop_all_domains(initrc_t)
domain_sigchld_all_domains(initrc_t) domain_sigchld_all_domains(initrc_t)
domain_read_all_domains_state(initrc_t) domain_read_all_domains_state(initrc_t)
domain_getattr_all_domains(initrc_t) domain_getattr_all_domains(initrc_t)
@ -29891,7 +29922,7 @@ index 17eda24..fdd335a 100644
domain_getsession_all_domains(initrc_t) domain_getsession_all_domains(initrc_t)
domain_use_interactive_fds(initrc_t) domain_use_interactive_fds(initrc_t)
# for lsof which is used by alsa shutdown: # for lsof which is used by alsa shutdown:
@@ -340,6 +665,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t) @@ -340,6 +666,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t)
domain_dontaudit_getattr_all_tcp_sockets(initrc_t) domain_dontaudit_getattr_all_tcp_sockets(initrc_t)
domain_dontaudit_getattr_all_dgram_sockets(initrc_t) domain_dontaudit_getattr_all_dgram_sockets(initrc_t)
domain_dontaudit_getattr_all_pipes(initrc_t) domain_dontaudit_getattr_all_pipes(initrc_t)
@ -29899,7 +29930,7 @@ index 17eda24..fdd335a 100644
files_getattr_all_dirs(initrc_t) files_getattr_all_dirs(initrc_t)
files_getattr_all_files(initrc_t) files_getattr_all_files(initrc_t)
@@ -347,14 +673,15 @@ files_getattr_all_symlinks(initrc_t) @@ -347,14 +674,15 @@ files_getattr_all_symlinks(initrc_t)
files_getattr_all_pipes(initrc_t) files_getattr_all_pipes(initrc_t)
files_getattr_all_sockets(initrc_t) files_getattr_all_sockets(initrc_t)
files_purge_tmp(initrc_t) files_purge_tmp(initrc_t)
@ -29917,7 +29948,7 @@ index 17eda24..fdd335a 100644
files_read_usr_files(initrc_t) files_read_usr_files(initrc_t)
files_manage_urandom_seed(initrc_t) files_manage_urandom_seed(initrc_t)
files_manage_generic_spool(initrc_t) files_manage_generic_spool(initrc_t)
@@ -364,8 +691,12 @@ files_list_isid_type_dirs(initrc_t) @@ -364,8 +692,12 @@ files_list_isid_type_dirs(initrc_t)
files_mounton_isid_type_dirs(initrc_t) files_mounton_isid_type_dirs(initrc_t)
files_list_default(initrc_t) files_list_default(initrc_t)
files_mounton_default(initrc_t) files_mounton_default(initrc_t)
@ -29931,7 +29962,7 @@ index 17eda24..fdd335a 100644
fs_list_inotifyfs(initrc_t) fs_list_inotifyfs(initrc_t)
fs_register_binary_executable_type(initrc_t) fs_register_binary_executable_type(initrc_t)
# rhgb-console writes to ramfs # rhgb-console writes to ramfs
@@ -375,10 +706,11 @@ fs_mount_all_fs(initrc_t) @@ -375,10 +707,11 @@ fs_mount_all_fs(initrc_t)
fs_unmount_all_fs(initrc_t) fs_unmount_all_fs(initrc_t)
fs_remount_all_fs(initrc_t) fs_remount_all_fs(initrc_t)
fs_getattr_all_fs(initrc_t) fs_getattr_all_fs(initrc_t)
@ -29945,7 +29976,7 @@ index 17eda24..fdd335a 100644
mcs_process_set_categories(initrc_t) mcs_process_set_categories(initrc_t)
mls_file_read_all_levels(initrc_t) mls_file_read_all_levels(initrc_t)
@@ -387,8 +719,10 @@ mls_process_read_up(initrc_t) @@ -387,8 +720,10 @@ mls_process_read_up(initrc_t)
mls_process_write_down(initrc_t) mls_process_write_down(initrc_t)
mls_rangetrans_source(initrc_t) mls_rangetrans_source(initrc_t)
mls_fd_share_all_levels(initrc_t) mls_fd_share_all_levels(initrc_t)
@ -29956,7 +29987,7 @@ index 17eda24..fdd335a 100644
storage_getattr_fixed_disk_dev(initrc_t) storage_getattr_fixed_disk_dev(initrc_t)
storage_setattr_fixed_disk_dev(initrc_t) storage_setattr_fixed_disk_dev(initrc_t)
@@ -398,6 +732,7 @@ term_use_all_terms(initrc_t) @@ -398,6 +733,7 @@ term_use_all_terms(initrc_t)
term_reset_tty_labels(initrc_t) term_reset_tty_labels(initrc_t)
auth_rw_login_records(initrc_t) auth_rw_login_records(initrc_t)
@ -29964,7 +29995,7 @@ index 17eda24..fdd335a 100644
auth_setattr_login_records(initrc_t) auth_setattr_login_records(initrc_t)
auth_rw_lastlog(initrc_t) auth_rw_lastlog(initrc_t)
auth_read_pam_pid(initrc_t) auth_read_pam_pid(initrc_t)
@@ -416,20 +751,18 @@ logging_read_all_logs(initrc_t) @@ -416,20 +752,18 @@ logging_read_all_logs(initrc_t)
logging_append_all_logs(initrc_t) logging_append_all_logs(initrc_t)
logging_read_audit_config(initrc_t) logging_read_audit_config(initrc_t)
@ -29988,7 +30019,7 @@ index 17eda24..fdd335a 100644
ifdef(`distro_debian',` ifdef(`distro_debian',`
dev_setattr_generic_dirs(initrc_t) dev_setattr_generic_dirs(initrc_t)
@@ -451,7 +784,6 @@ ifdef(`distro_gentoo',` @@ -451,7 +785,6 @@ ifdef(`distro_gentoo',`
allow initrc_t self:process setfscreate; allow initrc_t self:process setfscreate;
dev_create_null_dev(initrc_t) dev_create_null_dev(initrc_t)
dev_create_zero_dev(initrc_t) dev_create_zero_dev(initrc_t)
@ -29996,7 +30027,7 @@ index 17eda24..fdd335a 100644
term_create_console_dev(initrc_t) term_create_console_dev(initrc_t)
# unfortunately /sbin/rc does stupid tricks # unfortunately /sbin/rc does stupid tricks
@@ -486,6 +818,10 @@ ifdef(`distro_gentoo',` @@ -486,6 +819,10 @@ ifdef(`distro_gentoo',`
sysnet_setattr_config(initrc_t) sysnet_setattr_config(initrc_t)
optional_policy(` optional_policy(`
@ -30007,7 +30038,7 @@ index 17eda24..fdd335a 100644
alsa_read_lib(initrc_t) alsa_read_lib(initrc_t)
') ')
@@ -506,7 +842,7 @@ ifdef(`distro_redhat',` @@ -506,7 +843,7 @@ ifdef(`distro_redhat',`
# Red Hat systems seem to have a stray # Red Hat systems seem to have a stray
# fd open from the initrd # fd open from the initrd
@ -30016,7 +30047,7 @@ index 17eda24..fdd335a 100644
files_dontaudit_read_root_files(initrc_t) files_dontaudit_read_root_files(initrc_t)
# These seem to be from the initrd # These seem to be from the initrd
@@ -521,6 +857,7 @@ ifdef(`distro_redhat',` @@ -521,6 +858,7 @@ ifdef(`distro_redhat',`
files_create_boot_dirs(initrc_t) files_create_boot_dirs(initrc_t)
files_create_boot_flag(initrc_t) files_create_boot_flag(initrc_t)
files_rw_boot_symlinks(initrc_t) files_rw_boot_symlinks(initrc_t)
@ -30024,7 +30055,7 @@ index 17eda24..fdd335a 100644
# wants to read /.fonts directory # wants to read /.fonts directory
files_read_default_files(initrc_t) files_read_default_files(initrc_t)
files_mountpoint(initrc_tmp_t) files_mountpoint(initrc_tmp_t)
@@ -541,6 +878,7 @@ ifdef(`distro_redhat',` @@ -541,6 +879,7 @@ ifdef(`distro_redhat',`
miscfiles_rw_localization(initrc_t) miscfiles_rw_localization(initrc_t)
miscfiles_setattr_localization(initrc_t) miscfiles_setattr_localization(initrc_t)
miscfiles_relabel_localization(initrc_t) miscfiles_relabel_localization(initrc_t)
@ -30032,7 +30063,7 @@ index 17eda24..fdd335a 100644
miscfiles_read_fonts(initrc_t) miscfiles_read_fonts(initrc_t)
miscfiles_read_hwdata(initrc_t) miscfiles_read_hwdata(initrc_t)
@@ -550,8 +888,44 @@ ifdef(`distro_redhat',` @@ -550,8 +889,44 @@ ifdef(`distro_redhat',`
') ')
optional_policy(` optional_policy(`
@ -30077,7 +30108,7 @@ index 17eda24..fdd335a 100644
') ')
optional_policy(` optional_policy(`
@@ -559,14 +933,31 @@ ifdef(`distro_redhat',` @@ -559,14 +934,31 @@ ifdef(`distro_redhat',`
rpc_write_exports(initrc_t) rpc_write_exports(initrc_t)
rpc_manage_nfs_state_data(initrc_t) rpc_manage_nfs_state_data(initrc_t)
') ')
@ -30109,7 +30140,7 @@ index 17eda24..fdd335a 100644
') ')
') ')
@@ -577,6 +968,39 @@ ifdef(`distro_suse',` @@ -577,6 +969,39 @@ ifdef(`distro_suse',`
') ')
') ')
@ -30149,7 +30180,7 @@ index 17eda24..fdd335a 100644
optional_policy(` optional_policy(`
amavis_search_lib(initrc_t) amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t) amavis_setattr_pid_files(initrc_t)
@@ -589,6 +1013,8 @@ optional_policy(` @@ -589,6 +1014,8 @@ optional_policy(`
optional_policy(` optional_policy(`
apache_read_config(initrc_t) apache_read_config(initrc_t)
apache_list_modules(initrc_t) apache_list_modules(initrc_t)
@ -30158,7 +30189,7 @@ index 17eda24..fdd335a 100644
') ')
optional_policy(` optional_policy(`
@@ -610,6 +1036,7 @@ optional_policy(` @@ -610,6 +1037,7 @@ optional_policy(`
optional_policy(` optional_policy(`
cgroup_stream_connect_cgred(initrc_t) cgroup_stream_connect_cgred(initrc_t)
@ -30166,7 +30197,7 @@ index 17eda24..fdd335a 100644
') ')
optional_policy(` optional_policy(`
@@ -626,6 +1053,17 @@ optional_policy(` @@ -626,6 +1054,17 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30184,7 +30215,7 @@ index 17eda24..fdd335a 100644
dev_getattr_printer_dev(initrc_t) dev_getattr_printer_dev(initrc_t)
cups_read_log(initrc_t) cups_read_log(initrc_t)
@@ -642,9 +1080,13 @@ optional_policy(` @@ -642,9 +1081,13 @@ optional_policy(`
dbus_connect_system_bus(initrc_t) dbus_connect_system_bus(initrc_t)
dbus_system_bus_client(initrc_t) dbus_system_bus_client(initrc_t)
dbus_read_config(initrc_t) dbus_read_config(initrc_t)
@ -30198,7 +30229,7 @@ index 17eda24..fdd335a 100644
') ')
optional_policy(` optional_policy(`
@@ -657,15 +1099,11 @@ optional_policy(` @@ -657,15 +1100,11 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30216,7 +30247,7 @@ index 17eda24..fdd335a 100644
') ')
optional_policy(` optional_policy(`
@@ -686,6 +1124,15 @@ optional_policy(` @@ -686,6 +1125,15 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30232,7 +30263,7 @@ index 17eda24..fdd335a 100644
inn_exec_config(initrc_t) inn_exec_config(initrc_t)
') ')
@@ -726,6 +1173,7 @@ optional_policy(` @@ -726,6 +1174,7 @@ optional_policy(`
lpd_list_spool(initrc_t) lpd_list_spool(initrc_t)
lpd_read_config(initrc_t) lpd_read_config(initrc_t)
@ -30240,7 +30271,7 @@ index 17eda24..fdd335a 100644
') ')
optional_policy(` optional_policy(`
@@ -743,7 +1191,13 @@ optional_policy(` @@ -743,7 +1192,13 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30255,7 +30286,7 @@ index 17eda24..fdd335a 100644
mta_dontaudit_read_spool_symlinks(initrc_t) mta_dontaudit_read_spool_symlinks(initrc_t)
') ')
@@ -766,6 +1220,10 @@ optional_policy(` @@ -766,6 +1221,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30266,7 +30297,7 @@ index 17eda24..fdd335a 100644
postgresql_manage_db(initrc_t) postgresql_manage_db(initrc_t)
postgresql_read_config(initrc_t) postgresql_read_config(initrc_t)
') ')
@@ -775,10 +1233,20 @@ optional_policy(` @@ -775,10 +1234,20 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30287,7 +30318,7 @@ index 17eda24..fdd335a 100644
quota_manage_flags(initrc_t) quota_manage_flags(initrc_t)
') ')
@@ -787,6 +1255,10 @@ optional_policy(` @@ -787,6 +1256,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30298,7 +30329,7 @@ index 17eda24..fdd335a 100644
fs_write_ramfs_sockets(initrc_t) fs_write_ramfs_sockets(initrc_t)
fs_search_ramfs(initrc_t) fs_search_ramfs(initrc_t)
@@ -808,8 +1280,6 @@ optional_policy(` @@ -808,8 +1281,6 @@ optional_policy(`
# bash tries ioctl for some reason # bash tries ioctl for some reason
files_dontaudit_ioctl_all_pids(initrc_t) files_dontaudit_ioctl_all_pids(initrc_t)
@ -30307,7 +30338,7 @@ index 17eda24..fdd335a 100644
') ')
optional_policy(` optional_policy(`
@@ -818,6 +1288,10 @@ optional_policy(` @@ -818,6 +1289,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30318,7 +30349,7 @@ index 17eda24..fdd335a 100644
# shorewall-init script run /var/lib/shorewall/firewall # shorewall-init script run /var/lib/shorewall/firewall
shorewall_lib_domtrans(initrc_t) shorewall_lib_domtrans(initrc_t)
') ')
@@ -827,10 +1301,12 @@ optional_policy(` @@ -827,10 +1302,12 @@ optional_policy(`
squid_manage_logs(initrc_t) squid_manage_logs(initrc_t)
') ')
@ -30331,7 +30362,7 @@ index 17eda24..fdd335a 100644
optional_policy(` optional_policy(`
ssh_dontaudit_read_server_keys(initrc_t) ssh_dontaudit_read_server_keys(initrc_t)
@@ -857,21 +1333,60 @@ optional_policy(` @@ -857,21 +1334,60 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30393,7 +30424,7 @@ index 17eda24..fdd335a 100644
') ')
optional_policy(` optional_policy(`
@@ -887,6 +1402,10 @@ optional_policy(` @@ -887,6 +1403,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -30404,7 +30435,7 @@ index 17eda24..fdd335a 100644
# Set device ownerships/modes. # Set device ownerships/modes.
xserver_setattr_console_pipes(initrc_t) xserver_setattr_console_pipes(initrc_t)
@@ -897,3 +1416,218 @@ optional_policy(` @@ -897,3 +1417,218 @@ optional_policy(`
optional_policy(` optional_policy(`
zebra_read_config(initrc_t) zebra_read_config(initrc_t)
') ')
@ -32364,7 +32395,7 @@ index b50c5fe..e55a556 100644
+/var/webmin(/.*)? gen_context(system_u:object_r:var_log_t,s0) +/var/webmin(/.*)? gen_context(system_u:object_r:var_log_t,s0)
+ +
diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
index 4e94884..6118015 100644 index 4e94884..b144ffe 100644
--- a/policy/modules/system/logging.if --- a/policy/modules/system/logging.if
+++ b/policy/modules/system/logging.if +++ b/policy/modules/system/logging.if
@@ -233,7 +233,7 @@ interface(`logging_run_auditd',` @@ -233,7 +233,7 @@ interface(`logging_run_auditd',`
@ -32516,12 +32547,19 @@ index 4e94884..6118015 100644
+interface(`logging_read_syslog_pid',` +interface(`logging_read_syslog_pid',`
+ gen_require(` + gen_require(`
+ type syslogd_var_run_t; + type syslogd_var_run_t;
+ ') ')
+
- allow $1 devlog_t:lnk_file read_lnk_file_perms;
- allow $1 devlog_t:sock_file write_sock_file_perms;
+ read_files_pattern($1, syslogd_var_run_t, syslogd_var_run_t) + read_files_pattern($1, syslogd_var_run_t, syslogd_var_run_t)
+ list_dirs_pattern($1, syslogd_var_run_t, syslogd_var_run_t) + list_dirs_pattern($1, syslogd_var_run_t, syslogd_var_run_t)
+') +')
+
- # the type of socket depends on the syslog daemon
- allow $1 syslogd_t:unix_dgram_socket sendto;
- allow $1 syslogd_t:unix_stream_socket connectto;
- allow $1 self:unix_dgram_socket create_socket_perms;
- allow $1 self:unix_stream_socket create_socket_perms;
+######################################## +########################################
+## <summary> +## <summary>
+## Relabel the syslog pid sock_file. +## Relabel the syslog pid sock_file.
@ -32535,18 +32573,15 @@ index 4e94884..6118015 100644
+interface(`logging_relabel_syslog_pid_socket',` +interface(`logging_relabel_syslog_pid_socket',`
+ gen_require(` + gen_require(`
+ type syslogd_var_run_t; + type syslogd_var_run_t;
') + ')
- allow $1 devlog_t:lnk_file read_lnk_file_perms; - # If syslog is down, the glibc syslog() function
- allow $1 devlog_t:sock_file write_sock_file_perms; - # will write to the console.
- term_write_console($1)
- term_dontaudit_read_console($1)
+ allow $1 syslogd_var_run_t:sock_file relabel_sock_file_perms; + allow $1 syslogd_var_run_t:sock_file relabel_sock_file_perms;
+') +')
+
- # the type of socket depends on the syslog daemon
- allow $1 syslogd_t:unix_dgram_socket sendto;
- allow $1 syslogd_t:unix_stream_socket connectto;
- allow $1 self:unix_dgram_socket create_socket_perms;
- allow $1 self:unix_stream_socket create_socket_perms;
+######################################## +########################################
+## <summary> +## <summary>
+## Connect to the syslog control unix stream socket. +## Connect to the syslog control unix stream socket.
@ -32561,11 +32596,7 @@ index 4e94884..6118015 100644
+ gen_require(` + gen_require(`
+ type syslogd_t, syslogd_var_run_t; + type syslogd_t, syslogd_var_run_t;
+ ') + ')
+
- # If syslog is down, the glibc syslog() function
- # will write to the console.
- term_write_console($1)
- term_dontaudit_read_console($1)
+ files_search_pids($1) + files_search_pids($1)
+ stream_connect_pattern($1, syslogd_var_run_t, syslogd_var_run_t, syslogd_t) + stream_connect_pattern($1, syslogd_var_run_t, syslogd_var_run_t, syslogd_t)
') ')
@ -32808,13 +32839,32 @@ index 4e94884..6118015 100644
init_labeled_script_domtrans($1, syslogd_initrc_exec_t) init_labeled_script_domtrans($1, syslogd_initrc_exec_t)
domain_system_change_exemption($1) domain_system_change_exemption($1)
@@ -1085,3 +1380,35 @@ interface(`logging_admin',` @@ -1085,3 +1380,54 @@ interface(`logging_admin',`
logging_admin_audit($1, $2) logging_admin_audit($1, $2)
logging_admin_syslog($1, $2) logging_admin_syslog($1, $2)
') ')
+ +
+######################################## +########################################
+## <summary> +## <summary>
+## Transition to syslog.conf
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`logging_filetrans_named_conf',`
+ gen_require(`
+ type syslog_conf_t;
+ ')
+
+ files_etc_filetrans($1, syslog_conf_t, file, "syslog.conf")
+ files_etc_filetrans($1, syslog_conf_t, file, "rsyslog.conf")
+')
+
+########################################
+## <summary>
+## Transition to logging named content +## Transition to logging named content
+## </summary> +## </summary>
+## <param name="domain"> +## <param name="domain">

1454
policy-rawhide-contrib.patch
View File

File diff suppressed because it is too large Load Diff

26
selinux-policy.spec
View File

@ -19,7 +19,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.13.1 Version: 3.13.1
Release: 20%{?dist} Release: 21%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -578,6 +578,30 @@ SELinux Reference policy mls base module.
%endif %endif
%changelog %changelog
* Wed Feb 5 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-21
- Add kernel_mounton_messages() interface
- init wants to manage lock files for iscsi
- Add support for dey_sapi port
- Fixes needed for docker
- Allow epmd to manage /var/log/rabbitmq/startup_err file
- Allow beam.smp connect to amqp port
- drbdadm executes drbdmeta
- Added osad policy
- Allow postfix to deliver to procmail
- Allow vmtools to execute /usr/bin/lsb_release
- Allow geoclue to read /etc/passwd
- Allow docker to write system net ctrls
- Add support for rhnsd unit file
- Add dbus_chat_session_bus() interface
- Add dbus_stream_connect_session_bus() interface
- Fix pcp.te
- Fix logrotate_use_nfs boolean
- Add lot of pcp fixes found in RHEL7
- fix labeling for pmie for pcp pkg
- Change thumb_t to be allowed to chat/connect with session bus type
- Add logrotate_use_nfs boolean
- Allow setroubleshootd to read rpc sysctl
* Thu Jan 30 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-20 * Thu Jan 30 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-20
- Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring - Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring
- Allow geoclue to create temporary files/dirs in /tmp - Allow geoclue to create temporary files/dirs in /tmp