rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Allow libvirt to change user componant of virt_domain

Browse Source
This commit is contained in:
Daniel J Walsh 2009-08-20 00:02:37 +00:00
parent 40243d944f
commit fc8ff2feac
2 changed files with 156 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

193
policy-F12.patch
View File

@ -1,3 +1,13 @@
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/Changelog serefpolicy-3.6.28/Changelog
--- nsaserefpolicy/Changelog 2009-08-18 18:39:50.000000000 -0400
+++ serefpolicy-3.6.28/Changelog 2009-08-18 13:23:29.000000000 -0400
@@ -1,6 +1,3 @@
-- Misc Gentoo fixes from Corentin Labbe.
-- Debian policykit fixes from Martin Orr.
-- Fix unconfined_r use of unconfined_java_t.
- Add missing x_device rules for XI2 functions, from Eamon Walsh.
- Add missing rules to make unconfined_cronjob_t a valid cron job domain.
- Add btrfs and ext4 to labeling targets.
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_contexts serefpolicy-3.6.28/config/appconfig-mcs/default_contexts diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_contexts serefpolicy-3.6.28/config/appconfig-mcs/default_contexts
--- nsaserefpolicy/config/appconfig-mcs/default_contexts 2009-07-14 14:19:57.000000000 -0400 --- nsaserefpolicy/config/appconfig-mcs/default_contexts 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/config/appconfig-mcs/default_contexts 2009-08-18 13:23:29.000000000 -0400 +++ serefpolicy-3.6.28/config/appconfig-mcs/default_contexts 2009-08-18 13:23:29.000000000 -0400
@ -632,6 +642,21 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage.te serefpolicy-3.6.28/policy/modules/admin/portage.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage.te serefpolicy-3.6.28/policy/modules/admin/portage.te
--- nsaserefpolicy/policy/modules/admin/portage.te 2009-08-18 18:39:50.000000000 -0400 --- nsaserefpolicy/policy/modules/admin/portage.te 2009-08-18 18:39:50.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/admin/portage.te 2009-08-18 13:23:29.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/admin/portage.te 2009-08-18 13:23:29.000000000 -0400
@@ -1,5 +1,5 @@
-policy_module(portage, 1.8.1)
+policy_module(portage, 1.8.0)
########################################
#
@@ -119,7 +119,6 @@
# - setfscreate for merging to live fs
# - setexec to run portage fetch
allow portage_t self:process { setfscreate setexec };
-allow portage_t self:capability sys_nice;
allow portage_t portage_log_t:file manage_file_perms;
logging_log_filetrans(portage_t, portage_log_t, file)
@@ -196,7 +195,7 @@ @@ -196,7 +195,7 @@
# - for rsync and distfile fetching # - for rsync and distfile fetching
# #
@ -3482,8 +3507,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ptchown.te serefpolicy-3.6.28/policy/modules/apps/ptchown.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ptchown.te serefpolicy-3.6.28/policy/modules/apps/ptchown.te
--- nsaserefpolicy/policy/modules/apps/ptchown.te 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/apps/ptchown.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.28/policy/modules/apps/ptchown.te 2009-08-18 13:23:29.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/apps/ptchown.te 2009-08-19 17:37:18.000000000 -0400
@@ -0,0 +1,38 @@ @@ -0,0 +1,39 @@
+policy_module(ptchown,1.0.0) +policy_module(ptchown,1.0.0)
+ +
+######################################## +########################################
@ -3503,7 +3528,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+# ptchown local policy +# ptchown local policy
+# +#
+ +
+allow ptchown_t self:capability { fowner chown setuid }; +allow ptchown_t self:capability { chown fowner fsetid setuid };
+allow ptchown_t self:process { getcap setcap }; +allow ptchown_t self:process { getcap setcap };
+ +
+# Init script handling +# Init script handling
@ -3517,9 +3542,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ +
+fs_rw_anon_inodefs_files(ptchown_t) +fs_rw_anon_inodefs_files(ptchown_t)
+ +
+term_use_generic_ptys(ptchown_t)
+term_setattr_generic_ptys(ptchown_t) +term_setattr_generic_ptys(ptchown_t)
+term_setattr_all_user_ptys(ptchown_t) +term_setattr_all_user_ptys(ptchown_t)
+term_use_generic_ptys(ptchown_t)
+term_use_ptmx(ptchown_t)
+ +
+miscfiles_read_localization(ptchown_t) +miscfiles_read_localization(ptchown_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te
@ -5137,7 +5163,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.6.28/policy/modules/kernel/domain.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.6.28/policy/modules/kernel/domain.if
--- nsaserefpolicy/policy/modules/kernel/domain.if 2009-07-14 14:19:57.000000000 -0400 --- nsaserefpolicy/policy/modules/kernel/domain.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/kernel/domain.if 2009-08-18 13:23:29.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/kernel/domain.if 2009-08-19 16:58:54.000000000 -0400
@@ -44,34 +44,6 @@ @@ -44,34 +44,6 @@
interface(`domain_type',` interface(`domain_type',`
# start with basic domain # start with basic domain
@ -10709,6 +10735,25 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
manage_files_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t) manage_files_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t)
+ files_tmp_filetrans(httpd_cvs_script_t, cvs_tmp_t, { file dir }) + files_tmp_filetrans(httpd_cvs_script_t, cvs_tmp_t, { file dir })
') ')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.fc serefpolicy-3.6.28/policy/modules/services/dbus.fc
--- nsaserefpolicy/policy/modules/services/dbus.fc 2009-08-18 18:39:50.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/dbus.fc 2009-08-18 11:41:45.000000000 -0400
@@ -1,13 +1,12 @@
/etc/dbus-1(/.*)? gen_context(system_u:object_r:dbusd_etc_t,s0)
+# Sorting does not work correctly if I combine these next two roles
+/usr/bin/dbus-daemon(-1)? -- gen_context(system_u:object_r:dbusd_exec_t,s0)
/bin/dbus-daemon -- gen_context(system_u:object_r:dbusd_exec_t,s0)
/lib/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
/lib64/dbus-1/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
-/usr/bin/dbus-daemon(-1)? -- gen_context(system_u:object_r:dbusd_exec_t,s0)
-/usr/libexec/dbus-daemon-launch-helper -- gen_context(system_u:object_r:dbusd_exec_t,s0)
-
/var/lib/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_lib_t,s0)
/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.6.28/policy/modules/services/dbus.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.6.28/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2009-07-28 13:28:33.000000000 -0400 --- nsaserefpolicy/policy/modules/services/dbus.if 2009-07-28 13:28:33.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/dbus.if 2009-08-18 13:23:29.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/services/dbus.if 2009-08-18 13:23:29.000000000 -0400
@ -10806,6 +10851,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.6.28/policy/modules/services/dbus.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.6.28/policy/modules/services/dbus.te
--- nsaserefpolicy/policy/modules/services/dbus.te 2009-08-18 18:39:50.000000000 -0400 --- nsaserefpolicy/policy/modules/services/dbus.te 2009-08-18 18:39:50.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/dbus.te 2009-08-18 13:23:29.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/services/dbus.te 2009-08-18 13:23:29.000000000 -0400
@@ -1,5 +1,5 @@
-policy_module(dbus, 1.11.1)
+policy_module(dbus, 1.11.0)
gen_require(`
class dbus all_dbus_perms;
@@ -86,6 +86,7 @@ @@ -86,6 +86,7 @@
dev_read_sysfs(system_dbusd_t) dev_read_sysfs(system_dbusd_t)
@ -13443,7 +13495,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
######################################## ########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.6.28/policy/modules/services/openvpn.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.6.28/policy/modules/services/openvpn.te
--- nsaserefpolicy/policy/modules/services/openvpn.te 2009-08-14 16:14:31.000000000 -0400 --- nsaserefpolicy/policy/modules/services/openvpn.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/openvpn.te 2009-08-18 13:23:29.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/services/openvpn.te 2009-08-19 17:17:15.000000000 -0400
@@ -86,6 +86,7 @@ @@ -86,6 +86,7 @@
corenet_udp_bind_openvpn_port(openvpn_t) corenet_udp_bind_openvpn_port(openvpn_t)
corenet_tcp_connect_openvpn_port(openvpn_t) corenet_tcp_connect_openvpn_port(openvpn_t)
@ -13452,7 +13504,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_rw_tun_tap_dev(openvpn_t) corenet_rw_tun_tap_dev(openvpn_t)
corenet_sendrecv_openvpn_server_packets(openvpn_t) corenet_sendrecv_openvpn_server_packets(openvpn_t)
corenet_sendrecv_openvpn_client_packets(openvpn_t) corenet_sendrecv_openvpn_client_packets(openvpn_t)
@@ -114,6 +115,16 @@ @@ -98,6 +99,8 @@
files_read_etc_files(openvpn_t)
files_read_etc_runtime_files(openvpn_t)
+auth_use_pam(openvpn_t)
+
logging_send_syslog_msg(openvpn_t)
miscfiles_read_localization(openvpn_t)
@@ -114,6 +117,16 @@
userdom_read_user_home_content_files(openvpn_t) userdom_read_user_home_content_files(openvpn_t)
') ')
@ -13598,6 +13659,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow $1 policykit_t:dbus send_msg; allow $1 policykit_t:dbus send_msg;
allow policykit_t $1:dbus send_msg; allow policykit_t $1:dbus send_msg;
') ')
@@ -41,7 +43,6 @@
########################################
## <summary>
-## Execute a policy_auth in the policy_auth domain, and
## allow the specified role the policy_auth domain,
## </summary>
## <param name="domain">
@@ -206,4 +207,47 @@ @@ -206,4 +207,47 @@
files_search_var_lib($1) files_search_var_lib($1)
@ -15590,7 +15659,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.6.28/policy/modules/services/sasl.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.6.28/policy/modules/services/sasl.te
--- nsaserefpolicy/policy/modules/services/sasl.te 2009-08-14 16:14:31.000000000 -0400 --- nsaserefpolicy/policy/modules/services/sasl.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/sasl.te 2009-08-18 13:25:10.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/services/sasl.te 2009-08-19 17:16:45.000000000 -0400
@@ -31,7 +31,7 @@ @@ -31,7 +31,7 @@
# Local policy # Local policy
# #
@ -17610,7 +17679,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+/var/run/libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_var_run_t,s0) +/var/run/libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.6.28/policy/modules/services/virt.if diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.6.28/policy/modules/services/virt.if
--- nsaserefpolicy/policy/modules/services/virt.if 2009-07-14 14:19:57.000000000 -0400 --- nsaserefpolicy/policy/modules/services/virt.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/virt.if 2009-08-18 13:23:29.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/services/virt.if 2009-08-19 17:01:25.000000000 -0400
@@ -103,7 +103,7 @@ @@ -103,7 +103,7 @@
######################################## ########################################
@ -17708,7 +17777,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## All of the rules required to administrate ## All of the rules required to administrate
## an virt environment ## an virt environment
## </summary> ## </summary>
@@ -327,3 +364,77 @@ @@ -327,3 +364,79 @@
virt_manage_log($1) virt_manage_log($1)
') ')
@ -17734,6 +17803,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ domain_type($1_t) + domain_type($1_t)
+ role system_r types $1_t; + role system_r types $1_t;
+ +
+ domain_user_exemption_target($1_t)
+
+ type $1_tmp_t; + type $1_tmp_t;
+ files_tmp_file($1_tmp_t) + files_tmp_file($1_tmp_t)
+ +
@ -17788,7 +17859,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.28/policy/modules/services/virt.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.28/policy/modules/services/virt.te
--- nsaserefpolicy/policy/modules/services/virt.te 2009-08-14 16:14:31.000000000 -0400 --- nsaserefpolicy/policy/modules/services/virt.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/virt.te 2009-08-18 13:23:29.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/services/virt.te 2009-08-19 17:26:56.000000000 -0400
@@ -20,6 +20,28 @@ @@ -20,6 +20,28 @@
## </desc> ## </desc>
gen_tunable(virt_use_samba, false) gen_tunable(virt_use_samba, false)
@ -17897,7 +17968,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corecmd_exec_bin(virtd_t) corecmd_exec_bin(virtd_t)
corecmd_exec_shell(virtd_t) corecmd_exec_shell(virtd_t)
@@ -96,30 +152,51 @@ @@ -96,30 +152,52 @@
corenet_tcp_sendrecv_generic_node(virtd_t) corenet_tcp_sendrecv_generic_node(virtd_t)
corenet_tcp_sendrecv_all_ports(virtd_t) corenet_tcp_sendrecv_all_ports(virtd_t)
corenet_tcp_bind_generic_node(virtd_t) corenet_tcp_bind_generic_node(virtd_t)
@ -17934,6 +18005,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+files_manage_etc_files(virtd_t) +files_manage_etc_files(virtd_t)
+ +
+modutils_read_module_deps(virtd_t) +modutils_read_module_deps(virtd_t)
+modutils_read_module_config(virtd_t)
fs_list_auto_mountpoints(virtd_t) fs_list_auto_mountpoints(virtd_t)
+fs_getattr_xattr_fs(virtd_t) +fs_getattr_xattr_fs(virtd_t)
@ -17952,7 +18024,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
term_use_ptmx(virtd_t) term_use_ptmx(virtd_t)
auth_use_nsswitch(virtd_t) auth_use_nsswitch(virtd_t)
@@ -129,7 +206,14 @@ @@ -129,7 +207,14 @@
logging_send_syslog_msg(virtd_t) logging_send_syslog_msg(virtd_t)
@ -17967,7 +18039,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
tunable_policy(`virt_use_nfs',` tunable_policy(`virt_use_nfs',`
fs_manage_nfs_dirs(virtd_t) fs_manage_nfs_dirs(virtd_t)
@@ -167,22 +251,35 @@ @@ -167,22 +252,35 @@
dnsmasq_domtrans(virtd_t) dnsmasq_domtrans(virtd_t)
dnsmasq_signal(virtd_t) dnsmasq_signal(virtd_t)
dnsmasq_kill(virtd_t) dnsmasq_kill(virtd_t)
@ -18008,7 +18080,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
') ')
optional_policy(` optional_policy(`
@@ -195,8 +292,159 @@ @@ -195,8 +293,159 @@
xen_stream_connect(virtd_t) xen_stream_connect(virtd_t)
xen_stream_connect_xenstore(virtd_t) xen_stream_connect_xenstore(virtd_t)
@ -21221,7 +21293,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.6.28/policy/modules/system/ipsec.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.6.28/policy/modules/system/ipsec.te
--- nsaserefpolicy/policy/modules/system/ipsec.te 2009-08-14 16:14:31.000000000 -0400 --- nsaserefpolicy/policy/modules/system/ipsec.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/ipsec.te 2009-08-18 13:42:27.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/system/ipsec.te 2009-08-19 20:01:37.000000000 -0400
@@ -6,6 +6,13 @@ @@ -6,6 +6,13 @@
# Declarations # Declarations
# #
@ -21246,7 +21318,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# type for file(s) containing ipsec keys - RSA or preshared # type for file(s) containing ipsec keys - RSA or preshared
type ipsec_key_file_t; type ipsec_key_file_t;
files_type(ipsec_key_file_t) files_type(ipsec_key_file_t)
@@ -53,21 +63,23 @@ @@ -43,6 +53,9 @@
init_daemon_domain(racoon_t, racoon_exec_t)
role system_r types racoon_t;
+type racoon_tmp_t;
+files_tmp_file(racoon_tmp_t)
+
type setkey_t;
type setkey_exec_t;
init_system_domain(setkey_t, setkey_exec_t)
@@ -53,21 +66,23 @@
# ipsec Local policy # ipsec Local policy
# #
@ -21273,7 +21355,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
read_lnk_files_pattern(ipsec_t, ipsec_key_file_t, ipsec_key_file_t) read_lnk_files_pattern(ipsec_t, ipsec_key_file_t, ipsec_key_file_t)
manage_files_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t) manage_files_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t)
@@ -76,7 +88,7 @@ @@ -76,13 +91,13 @@
can_exec(ipsec_t, ipsec_mgmt_exec_t) can_exec(ipsec_t, ipsec_mgmt_exec_t)
@ -21282,7 +21364,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# a shell script, we need to find a way to make things work without # a shell script, we need to find a way to make things work without
# letting all sorts of stuff possibly be run... # letting all sorts of stuff possibly be run...
# so try flipping back into the ipsec_mgmt_t domain # so try flipping back into the ipsec_mgmt_t domain
@@ -95,9 +107,6 @@ corecmd_shell_domtrans(ipsec_t, ipsec_mgmt_t)
allow ipsec_mgmt_t ipsec_t:fd use;
-allow ipsec_mgmt_t ipsec_t:fifo_file rw_file_perms;
+allow ipsec_mgmt_t ipsec_t:fifo_file rw_fifo_file_perms;
allow ipsec_mgmt_t ipsec_t:process sigchld;
kernel_read_kernel_sysctls(ipsec_t)
@@ -95,9 +110,6 @@
kernel_getattr_core_if(ipsec_t) kernel_getattr_core_if(ipsec_t)
kernel_getattr_message_if(ipsec_t) kernel_getattr_message_if(ipsec_t)
@ -21292,7 +21381,20 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Pluto needs network access # Pluto needs network access
corenet_all_recvfrom_unlabeled(ipsec_t) corenet_all_recvfrom_unlabeled(ipsec_t)
corenet_tcp_sendrecv_all_if(ipsec_t) corenet_tcp_sendrecv_all_if(ipsec_t)
@@ -118,21 +127,26 @@ @@ -107,10 +119,11 @@
corenet_tcp_sendrecv_all_ports(ipsec_t)
corenet_tcp_bind_all_nodes(ipsec_t)
corenet_udp_bind_all_nodes(ipsec_t)
+corenet_udp_bind_isakmp_port(ipsec_t)
corenet_tcp_bind_reserved_port(ipsec_t)
corenet_tcp_bind_isakmp_port(ipsec_t)
-corenet_udp_bind_isakmp_port(ipsec_t)
corenet_udp_bind_ipsecnat_port(ipsec_t)
+
corenet_sendrecv_generic_server_packets(ipsec_t)
corenet_sendrecv_isakmp_server_packets(ipsec_t)
@@ -118,21 +131,26 @@
dev_read_rand(ipsec_t) dev_read_rand(ipsec_t)
dev_read_urand(ipsec_t) dev_read_urand(ipsec_t)
@ -21324,7 +21426,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
logging_send_syslog_msg(ipsec_t) logging_send_syslog_msg(ipsec_t)
miscfiles_read_localization(ipsec_t) miscfiles_read_localization(ipsec_t)
@@ -154,12 +168,12 @@ @@ -154,12 +172,12 @@
# #
allow ipsec_mgmt_t self:capability { net_admin sys_tty_config dac_override dac_read_search }; allow ipsec_mgmt_t self:capability { net_admin sys_tty_config dac_override dac_read_search };
@ -21339,7 +21441,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow ipsec_mgmt_t ipsec_mgmt_lock_t:file manage_file_perms; allow ipsec_mgmt_t ipsec_mgmt_lock_t:file manage_file_perms;
files_lock_filetrans(ipsec_mgmt_t, ipsec_mgmt_lock_t, file) files_lock_filetrans(ipsec_mgmt_t, ipsec_mgmt_lock_t, file)
@@ -209,15 +223,21 @@ @@ -209,15 +227,21 @@
files_read_kernel_symbol_table(ipsec_mgmt_t) files_read_kernel_symbol_table(ipsec_mgmt_t)
files_getattr_kernel_modules(ipsec_mgmt_t) files_getattr_kernel_modules(ipsec_mgmt_t)
@ -21364,7 +21466,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
domain_use_interactive_fds(ipsec_mgmt_t) domain_use_interactive_fds(ipsec_mgmt_t)
# denials when ps tries to search /proc. Do not audit these denials. # denials when ps tries to search /proc. Do not audit these denials.
domain_dontaudit_list_all_domains_state(ipsec_mgmt_t) domain_dontaudit_list_all_domains_state(ipsec_mgmt_t)
@@ -232,12 +252,6 @@ @@ -232,12 +256,6 @@
files_dontaudit_getattr_default_dirs(ipsec_mgmt_t) files_dontaudit_getattr_default_dirs(ipsec_mgmt_t)
files_dontaudit_getattr_default_files(ipsec_mgmt_t) files_dontaudit_getattr_default_files(ipsec_mgmt_t)
@ -21377,17 +21479,21 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
init_use_script_ptys(ipsec_mgmt_t) init_use_script_ptys(ipsec_mgmt_t)
init_exec_script_files(ipsec_mgmt_t) init_exec_script_files(ipsec_mgmt_t)
init_use_fds(ipsec_mgmt_t) init_use_fds(ipsec_mgmt_t)
@@ -280,6 +294,9 @@ @@ -280,6 +298,13 @@
allow racoon_t self:netlink_selinux_socket { bind create read }; allow racoon_t self:netlink_selinux_socket { bind create read };
allow racoon_t self:udp_socket create_socket_perms; allow racoon_t self:udp_socket create_socket_perms;
allow racoon_t self:key_socket create_socket_perms; allow racoon_t self:key_socket create_socket_perms;
+allow racoon_t self:fifo_file rw_fifo_file_perms; +allow racoon_t self:fifo_file rw_fifo_file_perms;
+ +
+manage_dirs_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t)
+manage_files_pattern(racoon_t, racoon_tmp_t, racoon_tmp_t)
+files_tmp_filetrans(racoon_t, racoon_tmp_t, { dir file })
+
+can_exec(racoon_t, setkey_exec_t) +can_exec(racoon_t, setkey_exec_t)
# manage pid file # manage pid file
manage_files_pattern(racoon_t, ipsec_var_run_t, ipsec_var_run_t) manage_files_pattern(racoon_t, ipsec_var_run_t, ipsec_var_run_t)
@@ -297,6 +314,13 @@ @@ -297,6 +322,13 @@
kernel_read_system_state(racoon_t) kernel_read_system_state(racoon_t)
kernel_read_network_state(racoon_t) kernel_read_network_state(racoon_t)
@ -21401,7 +21507,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_all_recvfrom_unlabeled(racoon_t) corenet_all_recvfrom_unlabeled(racoon_t)
corenet_tcp_sendrecv_all_if(racoon_t) corenet_tcp_sendrecv_all_if(racoon_t)
corenet_udp_sendrecv_all_if(racoon_t) corenet_udp_sendrecv_all_if(racoon_t)
@@ -314,13 +338,15 @@ @@ -314,13 +346,15 @@
files_read_etc_files(racoon_t) files_read_etc_files(racoon_t)
@ -21419,10 +21525,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
locallogin_use_fds(racoon_t) locallogin_use_fds(racoon_t)
logging_send_syslog_msg(racoon_t) logging_send_syslog_msg(racoon_t)
@@ -328,6 +354,11 @@ @@ -328,6 +362,13 @@
miscfiles_read_localization(racoon_t) miscfiles_read_localization(racoon_t)
+auth_use_pam(racoon_t)
+
+auth_can_read_shadow_passwords(racoon_t) +auth_can_read_shadow_passwords(racoon_t)
+tunable_policy(`racoon_read_shadow',` +tunable_policy(`racoon_read_shadow',`
+ auth_tunable_read_shadow(racoon_t) + auth_tunable_read_shadow(racoon_t)
@ -21431,7 +21539,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
######################################## ########################################
# #
# Setkey local policy # Setkey local policy
@@ -347,6 +378,7 @@ @@ -347,6 +388,7 @@
files_read_etc_files(setkey_t) files_read_etc_files(setkey_t)
init_dontaudit_use_fds(setkey_t) init_dontaudit_use_fds(setkey_t)
@ -27293,7 +27401,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+') +')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.6.28/policy/modules/system/xen.te diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.6.28/policy/modules/system/xen.te
--- nsaserefpolicy/policy/modules/system/xen.te 2009-08-14 16:14:31.000000000 -0400 --- nsaserefpolicy/policy/modules/system/xen.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/xen.te 2009-08-18 18:28:36.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/system/xen.te 2009-08-19 17:23:15.000000000 -0400
@@ -1,11 +1,18 @@ @@ -1,11 +1,18 @@
-policy_module(xen, 1.9.0) -policy_module(xen, 1.9.0)
@ -27432,16 +27540,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
consoletype_exec(xend_t) consoletype_exec(xend_t)
') ')
@@ -239,6 +270,8 @@ @@ -239,6 +270,10 @@
files_read_usr_files(xenconsoled_t) files_read_usr_files(xenconsoled_t)
+fs_list_tmpfs(xenconsoled_t) +fs_list_tmpfs(xenconsoled_t)
+fs_manage_xenfs_dirs(xenconsoled_t)
+fs_manage_xenfs_files(xenconsoled_t)
+ +
term_create_pty(xenconsoled_t, xen_devpts_t) term_create_pty(xenconsoled_t, xen_devpts_t)
term_use_generic_ptys(xenconsoled_t) term_use_generic_ptys(xenconsoled_t)
term_use_console(xenconsoled_t) term_use_console(xenconsoled_t)
@@ -248,7 +281,7 @@ @@ -248,7 +283,7 @@
miscfiles_read_localization(xenconsoled_t) miscfiles_read_localization(xenconsoled_t)
@ -27450,7 +27560,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
xen_stream_connect_xenstore(xenconsoled_t) xen_stream_connect_xenstore(xenconsoled_t)
######################################## ########################################
@@ -256,21 +289,33 @@ @@ -256,21 +291,33 @@
# Xen store local policy # Xen store local policy
# #
@ -27485,7 +27595,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_write_xen_state(xenstored_t) kernel_write_xen_state(xenstored_t)
kernel_read_xen_state(xenstored_t) kernel_read_xen_state(xenstored_t)
@@ -304,6 +349,7 @@ @@ -304,6 +351,7 @@
# #
allow xm_t self:capability { dac_override ipc_lock sys_tty_config }; allow xm_t self:capability { dac_override ipc_lock sys_tty_config };
@ -27493,7 +27603,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# internal communication is often done using fifo and unix sockets. # internal communication is often done using fifo and unix sockets.
allow xm_t self:fifo_file rw_fifo_file_perms; allow xm_t self:fifo_file rw_fifo_file_perms;
@@ -312,24 +358,28 @@ @@ -312,24 +360,28 @@
manage_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t) manage_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t)
manage_fifo_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t) manage_fifo_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t)
@ -27523,11 +27633,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_read_etc_runtime_files(xm_t) files_read_etc_runtime_files(xm_t)
files_read_usr_files(xm_t) files_read_usr_files(xm_t)
@@ -339,15 +389,69 @@ @@ -339,15 +391,70 @@
storage_raw_read_fixed_disk(xm_t) storage_raw_read_fixed_disk(xm_t)
+fs_getattr_all_fs(xm_t) +fs_getattr_all_fs(xm_t)
+fs_manage_xenfs_dirs(xm_t)
+fs_manage_xenfs_files(xm_t)
+ +
term_use_all_terms(xm_t) term_use_all_terms(xm_t)
@ -27557,6 +27669,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+kernel_read_xen_state(xm_ssh_t) +kernel_read_xen_state(xm_ssh_t)
+kernel_write_xen_state(xm_ssh_t) +kernel_write_xen_state(xm_ssh_t)
+ +
+fs_manage_xenfs_dirs(xm_ssh_t)
+fs_manage_xenfs_files(xm_ssh_t)
+
+userdom_search_admin_dir(xm_ssh_t) +userdom_search_admin_dir(xm_ssh_t)
+ +
+#Should have a boolean wrapping these +#Should have a boolean wrapping these
@ -27564,6 +27679,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+files_search_mnt(xend_t) +files_search_mnt(xend_t)
+fs_getattr_all_fs(xend_t) +fs_getattr_all_fs(xend_t)
+fs_read_dos_files(xend_t) +fs_read_dos_files(xend_t)
+fs_manage_xenfs_dirs(xend_t)
+fs_manage_xenfs_files(xend_t)
+ +
+tunable_policy(`xen_use_nfs',` +tunable_policy(`xen_use_nfs',`
+ fs_manage_nfs_files(xend_t) + fs_manage_nfs_files(xend_t)
@ -27588,12 +27705,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+manage_sock_files_pattern(evtchnd_t,evtchnd_var_run_t,evtchnd_var_run_t) +manage_sock_files_pattern(evtchnd_t,evtchnd_var_run_t,evtchnd_var_run_t)
+files_pid_filetrans(evtchnd_t, evtchnd_var_run_t, { file sock_file dir }) +files_pid_filetrans(evtchnd_t, evtchnd_var_run_t, { file sock_file dir })
+ +
+fs_manage_xenfs_dirs(xend_t)
+fs_manage_xenfs_files(xend_t)
+fs_manage_xenfs_dirs(xenstored_t)
+fs_manage_xenfs_files(xenstored_t)
+fs_manage_xenfs_dirs(xm_t)
+fs_manage_xenfs_files(xm_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.6.28/policy/support/obj_perm_sets.spt diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.6.28/policy/support/obj_perm_sets.spt
--- nsaserefpolicy/policy/support/obj_perm_sets.spt 2009-07-14 14:19:57.000000000 -0400 --- nsaserefpolicy/policy/support/obj_perm_sets.spt 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/support/obj_perm_sets.spt 2009-08-18 13:23:29.000000000 -0400 +++ serefpolicy-3.6.28/policy/support/obj_perm_sets.spt 2009-08-18 13:23:29.000000000 -0400

5
selinux-policy.spec
View File

@ -20,7 +20,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.6.28 Version: 3.6.28
Release: 1%{?dist} Release: 2%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -475,6 +475,9 @@ exit 0
%endif %endif
%changelog %changelog
* Wed Aug 19 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-2
- Allow libvirt to change user componant of virt_domain
* Tue Aug 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-1 * Tue Aug 18 2009 Dan Walsh <dwalsh@redhat.com> 3.6.28-1
- Allow cupsd_config_t to be started by dbus - Allow cupsd_config_t to be started by dbus
- Add smoltclient policy - Add smoltclient policy