Commit Graph

5216 Commits

Author SHA1 Message Date
Miroslav Grepl
3e0039f065 - Make unconfined_service_t valid in enforcing
- Remove transition for temp dirs created by init_t
- gdm-simple-slave uses use setsockopt
- Treat usermodehelper_t as a sysctl_type
- xdm communicates with geo
- Add lvm_read_metadata()
- Allow rabbitmq_beam to connect to jabber_interserver_port
- Allow logwatch_mail_t to transition to qmail_inject and queueu
- Added new rules to pcp policy
- Allow vmtools_helper_t to change role to system_r
- Allow NM to dbus chat with vmtools
2014-02-24 20:13:11 +01:00
Miroslav Grepl
74ec503d1c - Add labeling for /usr/sbin/amavi
- Colin asked for this program to be treated as cloud-init
- Allow ftp services to manage xferlog_t
- Fix vmtools policy to allow user roles to access vmtools_helper_t
- Allow block_suspend cap2 for ipa-otpd
- Allow certmonger to search home content
- Allow pkcsslotd to read users state
- Allow exim to use pam stack to check passwords
- Add labeling for /usr/sbin/amavi
- Colin asked for this program to be treated as cloud-init
- Allow ftp services to manage xferlog_t
- Fix vmtools policy to allow user roles to access vmtools_helper_t
- Allow block_suspend cap2 for ipa-otpd
- Allow certmonger to search home content
- Allow pkcsslotd to read users state
- Allow exim to use pam stack to check passwor
2014-02-21 17:01:54 +01:00
Miroslav Grepl
450ad890ec Fix lvm_read_metadata() 2014-02-18 18:16:00 +01:00
Miroslav Grepl
60668f6a35 * Tue Feb 18 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-25
- Add lvm_read_metadata()
- Allow auditadm to search /var/log/audit dir
- Add lvm_read_metadata() interface
- Allow confined users to run vmtools helpers
- Fix userdom_common_user_template()
- Generic systemd unit scripts do write check on /
- Allow init_t to create init_tmp_t in /tmp.This is for temporary content created by generic unit files
- Add additional fixes needed for init_t and setup script running in generic unit files
- Allow general users to create packet_sockets
- added connlcli port
- Add init_manage_transient_unit() interface
- Allow init_t (generic unit files) to manage rpc state date as we had it for initrc_t
- Fix userdomain.te to require passwd class
- devicekit_power sends out a signal to all processes on the message bus when power is going down
- Dontaudit rendom domains listing /proc and hittping system_map_t
- Dontauit leaks of var_t into ifconfig_t
- Allow domains that transition to ssh_t to manipulate its keyring
- Define oracleasm_t as a device node
- Change to handle /root as a symbolic link for os-tree
- Allow sysadm_t to create packet_socket, also move some rules to attributes
- Add label for openvswitch port
- Remove general transition for files/dirs created in /etc/mail which got etc_aliases_t label.
- Allow postfix_local to read .forward in pcp lib files
- Allow pegasus_openlmi_storage_t to read lvm metadata
- Add additional fixes for pegasus_openlmi_storage_t
- Allow bumblebee to manage debugfs
- Make bumblebee as unconfined domain
- Allow snmp to read etc_aliases_t
- Allow lscpu running in pegasus_openlmi_storage_t to read /dev/mem
- Allow pegasus_openlmi_storage_t to read /proc/1/environ
- Dontaudit read gconf files for cupsd_config_t
- make vmtools as unconfined domain
- Add vmtools_helper_t for helper scripts. Allow vmtools shutdonw a host and run ifconfig.
- Allow collectd_t to use a mysql database
- Allow ipa-otpd to perform DNS name resolution
- Added new policy for keepalived
- Allow openlmi-service provider to manage transitient units and allow stream connect to sssd
- Add additional fixes new pscs-lite+polkit support
- Add labeling for /run/krb5kdc
- Change w3c_validator_tmp_t to httpd_w3c_validator_tmp_t in F20
- Allow pcscd to read users proc info
- Dontaudit smbd_t sending out random signuls
- Add boolean to allow openshift domains to use nfs
- Allow w3c_validator to create content in /tmp
- zabbix_agent uses nsswitch
- Allow procmail and dovecot to work together to deliver mail
- Allow spamd to execute files in homedir if boolean turned on
- Allow openvswitch to listen on port 6634
- Add net_admin capability in collectd policy
- Fixed snapperd policy
- Fixed bugsfor pcp policy
- Allow dbus_system_domains to be started by init
- Fixed some interfaces
- Add kerberos_keytab_domain attribute
- Fix snapperd_conf_t def
2014-02-18 18:05:44 +01:00
Dan Walsh
0474cb579e Add nsplugin.pp and qemu.pp as two additional policies that we no longer ship 2014-02-18 10:19:40 -05:00
Miroslav Grepl
7741f63587 Remove /usr/local /usr equiv 2014-02-18 15:49:35 +01:00
Miroslav Grepl
3dc79f55af Fix selinux config file 2014-02-18 14:19:57 +01:00
Lukas Vrabec
1f5d742331 Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2014-02-17 13:44:17 +01:00
Lukas Vrabec
f2fd78e00e Add keepalived to modules-targeted-contrib 2014-02-17 13:42:02 +01:00
Dan Walsh
9a76d63b01 Add subs for /var/home and /var/root 2014-02-14 15:21:51 -05:00
Dan Walsh
fdaea44147 Make sure selinux-policy owns the rpmconfigdir and macros.d so it does not build a require for rpm 2014-02-14 14:51:42 -05:00
Miroslav Grepl
7a727702c0 - Dontaudit rendom domains listing /proc and hittping system_map_t
- devicekit_power sends out a signal to all processes on the message bus when power is going down
- Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true
- systemd_tmpfiles_t needs to _setcheckreqprot
- Add unconfined_server to be run by init_t when it executes files labeled bin_t, or usr_t, allow all domains to communicate with it
- Fixed snapperd policy
- Fixed broken interfaces
- Should use rw_socket_perms rather then sock_file on a unix_stream_socket
- Fixed bugsfor pcp policy
- pcscd seems to be using policy kit and looking at domains proc data that transition to it
- Allow dbus_system_domains to be started by init
- Fixed some interfaces
- Addopt corenet rules for unbound-anchor to rpm_script_t
- Allow runuser to send send audit messages.
- Allow postfix-local to search .forward in munin lib dirs
- Allow udisks to connect to D-Bus
- Allow spamd to connect to spamd port
- Fix syntax error in snapper.te
- Dontaudit osad to search gconf home files
- Allow rhsmcertd to manage /etc/sysconf/rhn director
- Fix pcp labeling to accept /usr/bin for all daemon binaries
- Fix mcelog_read_log() interface
- Allow iscsid to manage iscsi lib files
- Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it.
- Allow ABRT to read puppet certs
- Allow virtd_lxc_t to specify the label of a socket
- New version of docker requires more access
2014-02-14 13:09:05 +01:00
Miroslav Grepl
05a36cdcd0 - Addopt corenet rules for unbound-anchor to rpm_script_t
- Allow runuser to send send audit messages.
- Allow postfix-local to search .forward in munin lib dirs
- Allow udisks to connect to D-Bus
- Allow spamd to connect to spamd port
- Fix syntax error in snapper.te
- Dontaudit osad to search gconf home files
- Allow rhsmcertd to manage /etc/sysconf/rhn director
- Fix pcp labeling to accept /usr/bin for all daemon binaries
- Fix mcelog_read_log() interface
- Allow iscsid to manage iscsi lib files
- Allow snapper domtrans to lvm_t. Add support for /etc/snapper and allow snapperd to manage it.
- Make tuned_t as unconfined domain for RHEL7.0
- Allow ABRT to read puppet certs
- Add sys_time capability for virt-ga
- Allow gemu-ga to domtrans to hwclock_t
- Allow additional access for virt_qemu_ga_t processes to read system clock and send audit messages
- Fix some AVCs in pcp policy
- Add to bacula capability setgid and setuid and allow to bind to bacula ports
- Changed label from rhnsd_rw_conf_t to rhnsd_conf_t
- Add access rhnsd and osad to /etc/sysconfig/rhn
- drbdadm executes drbdmeta
- Fixes needed for docker
- Allow epmd to manage /var/log/rabbitmq/startup_err file
- Allow beam.smp connect to amqp port
- Modify xdm_write_home to allow create also links as xdm_home_t if the boolean is on true
- Allow init_t to manage pluto.ctl because of init_t instead of initrc_t
- Allow systemd_tmpfiles_t to manage all non security files on the system
- Added labels for bacula ports
- Fix label on /dev/vfio/vfio
- Add kernel_mounton_messages() interface
- init wants to manage lock files for iscsi
2014-02-11 20:28:28 +01:00
Miroslav Grepl
6383860028 - Fix /dev/vfio/vfio labeling 2014-02-05 15:57:57 +01:00
Miroslav Grepl
fc059db54d - Add kernel_mounton_messages() interface
- init wants to manage lock files for iscsi
- Add support for dey_sapi port
- Fixes needed for docker
- Allow epmd to manage /var/log/rabbitmq/startup_err file
- Allow beam.smp connect to amqp port
- drbdadm executes drbdmeta
- Added osad policy
- Allow postfix to deliver to procmail
- Allow vmtools to execute /usr/bin/lsb_release
- Allow geoclue to read /etc/passwd
- Allow docker to write system net ctrls
- Add support for rhnsd unit file
- Add dbus_chat_session_bus() interface
- Add dbus_stream_connect_session_bus() interface
- Fix pcp.te
- Fix logrotate_use_nfs boolean
- Add lot of pcp fixes found in RHEL7
- fix labeling for pmie for pcp pkg
- Change thumb_t to be allowed to chat/connect with session bus type
- Add logrotate_use_nfs boolean
- Allow setroubleshootd to read rpc sysctl
2014-02-05 08:52:08 +01:00
Lukas Vrabec
4cde844b7e Added osad to permissive domains 2014-02-03 14:09:01 +01:00
Lukas Vrabec
99989c2bfc Added osad to modules-targeted-contrib.conf 2014-02-03 10:22:22 +01:00
Miroslav Grepl
451a1078c0 Turn on rhnsd policy 2014-01-31 15:18:53 +01:00
Miroslav Grepl
98755aae81 Turn on bacula policy 2014-01-31 10:21:40 +01:00
Miroslav Grepl
21f72f0c5c Fix typo in geoclue.te 2014-01-30 13:45:46 +01:00
Miroslav Grepl
a853036f79 - Allow passwd_t to use ipc_lock, so that it can change the password in gnome-keyring
- Allow geoclue to create temporary files/dirs in /tmp
- Add httpd_dontaudit_search_dirs boolean
- Add support for winbind.service
- ALlow also fail2ban-client to read apache logs
- Allow vmtools to getattr on all fs
2014-01-30 13:26:17 +01:00
Dan Walsh
a960d06c0c Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2014-01-29 10:41:36 -05:00
Dan Walsh
b7aa0fd963 Fix writing of data to /sys/fs/selinux/checkreqprot 2014-01-29 10:40:20 -05:00
Miroslav Grepl
2b1129da49 - Add net_admin also for systemd_passwd_agent_t
- Allow Associate usermodehelper_t to sysfs filesystem
- Allow gdm to create /var/gdm with correct labeling
- Allow domains to append rkhunterl lib files. #1057982
- Allow systemd_tmpfiles_t net_admin to communicate with journald
- update libs_filetrans_named_content() to have support for /usr/lib/debug directory
- Adding a new service script to enable setcheckreqprot
- Add interface to getattr on an isid_type for any type of file
- Allow initrc_t domtrans to authconfig if unconfined is enabled
- Add labeling for snapper.log
- Allow tumbler to execute dbusd-daemon in thumb_t
- Add dbus_exec_dbusd()
- Add snapperd_data_t type
- Add additional fixes for snapperd
- FIx bad calling in samba.te
- Allow smbd to create tmpfs
- Allow rhsmcertd-worker send signull to rpm process
- Allow net_admin capability and send system log msgs
- Allow lldpad send dgram to NM
- Add networkmanager_dgram_send()
- rkhunter_var_lib_t is correct type
- Allow openlmi-storage to read removable devices
- Allow system cron jobs to manage rkhunter lib files
- Add rkhunter_manage_lib_files()
- Fix ftpd_use_fusefs boolean to allow manage also symlinks
- Allow smbcontrob block_suspend cap2
- Allow slpd to read network and system state info
- Allow NM domtrans to iscsid_t if iscsiadm is executed
- Allow slapd to send a signal itself
- Allow sslget running as pki_ra_t to contact port 8443, the secure port of the CA.
- Fix plymouthd_create_log() interface
- Add rkhunter policy with files type definition for /var/lib/rkhunter until it is fixed in rkhunter package
- Allow postfix and cyrus-imapd to work out of box
- Remove logwatch_can_sendmail which is no longer used
- Allow fcoemon to talk with unpriv user domain using unix_stream_socket
- snapperd is D-Bus service
- Allow OpenLMI PowerManagement to call 'systemctl --force reboot
2014-01-28 22:06:09 +01:00
Dan Walsh
98a685257a Fix the day of the week 2014-01-28 15:59:39 -05:00
Miroslav Grepl
4918dedb61 Add rkhunter policy 2014-01-27 11:24:48 +01:00
Miroslav Grepl
697404c561 Add boolean subs for logwatch_can_sendmail 2014-01-27 08:36:00 +01:00
Dan Walsh
aae7e9fea1 Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2014-01-25 14:52:05 -05:00
Dan Walsh
cafa00d43f Fix format of checkreqprot line in selinux-policy.conf, so it works. 2014-01-25 14:51:54 -05:00
Miroslav Grepl
f8d85476fd - Add haproxy_connect_any boolean
- Allow haproxy also to use http cache port by default
- Fix /usr/lib/firefox/plugin-container decl
- Allow haproxy to work as simple HTTP proxy. HAProxy For TCP And HTTP Based Applications
- Label also /usr/libexec/WebKitPluginProcess as mozilla_plugin_exec_t
- Fix type in docker.te
- Fix bs_filetrans_named_content() to have support for /usr/lib/debug directory
- Adding a new service script to enable setcheckreqprot
- Add interface to getattr on an isid_type for any type of file
- Allow initrc_t domtrans to authconfig if unconfined is enabled
type in docker.te
- Add mozilla_plugin_exec_t labeling for /usr/lib/firefox/plugin-container
2014-01-24 17:52:42 +01:00
Dan Walsh
c8df556a5f Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2014-01-24 11:20:15 -05:00
Dan Walsh
bd53c01332 Turn on checkreqprot flag for tighter SELinux Security 2014-01-24 11:20:00 -05:00
Miroslav Grepl
254b1593d0 - init calling needs to be optional in domain.te
- Allow docker and mount on devpts chr_file
- Allow docker to transition to unconfined_t if boolean set
- Label also /usr/libexec/WebKitPluginProcess as mozilla_plugin_exec_t
- Fix type in docker.te
- Add mozilla_plugin_exec_t labeling for /usr/lib/firefox/plugin-contai
- Allow docker to use the network and build images
- Allow docker to read selinux files for labeling, and mount on devpts
- Allow domains that transition to svirt_sandbox to send it signals
- Allow docker to transition to unconfined_t if boolean set
2014-01-23 11:03:30 +01:00
Miroslav Grepl
f4d3efd317 Remove conflict for pki-selinux 2014-01-22 13:15:32 +01:00
Miroslav Grepl
d7f0c3cf54 - New access needed to allow docker + lxc +SELinux to work together
- Allow apache to write to the owncloud data directory in /var/www/html...
- Cleanup sandbox X AVC's
- Allow consolekit to create log dir
- Add support for icinga CGI scripts
- Add support for icinga
- Allow kdumpctl_t to create kdump lock file
- Allow kdump to create lnk lock file
- Allow ABRT write core_pattern
- Allwo ABRT to read core_pattern
- Add policy for Geoclue. Geoclue is a D-Bus service that provides location information
- Allow nscd_t block_suspen capability
- Allow unconfined domain types to manage own transient unit file
- Allow systemd domains to handle transient init unit files
- No longer need the rpm_script_roles line since rpm_transition_script now does this for us
- Add/fix interfaces for usermodehelper_t
- Add interfaces to handle transient
- Fixes for new usermodehelper and proc_securit_t types
2014-01-22 13:00:17 +01:00
Miroslav Grepl
99d95cac6e Add geoclue policy 2014-01-21 12:22:50 +01:00
Dan Walsh
3397003331 Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2014-01-20 10:46:29 -05:00
Dan Walsh
3708ddf552 Fix /sys/kernel/uevent_helper to be a file rather then recursing a directory 2014-01-20 10:46:14 -05:00
Miroslav Grepl
3a0ebd8398 - Add cron unconfined role support for uncofined SELinux user
- Call kernel_rw_usermodehelper_state() in init.te
- Call corenet_udp_bind_all_ports() in milter.te
- Allow fence_virtd to connect to zented port
- Fix header for mirrormanager_admin()
- Allow dkim-milter to bind udp ports
- Allow milter domains to send signull itself
- Allow block_suspend for yum running as mock_t
- Allow beam.smp to manage couchdb files
- Add couchdb_manage_files()
- Add labeling for /var/log/php_errors.log
- Allow bumblebee to stream connect to xserver
- Allow bumblebee to send a signal to xserver
- gnome-thumbnail to stream connect to bumblebee
- Fix calling usermodehelper to use _state in interface name
- Allow xkbcomp running as bumblebee_t to execute  bin_t
- Allow logrotate to read squid.conf
- Additional rules to get docker and lxc to play well with SELinux
- Call kernel_read_usermodhelper/kernel_rw_usermodhelper
- Make rpm_transition_script accept a role
- Added new policy for pcp
- Allow bumbleed to connect to xserver port
- Allow pegasus_openlmi_storage_t to read hwdata
2014-01-20 11:41:09 +01:00
Miroslav Grepl
5dcd635c58 index.html and style.css should be in /usr/share/selinux/devel/htm 2014-01-20 11:24:03 +01:00
Miroslav Grepl
93e99e4693 Rename badly used userhelper_t in kernel.if to usermodehelper 2014-01-19 22:18:55 +01:00
Miroslav Grepl
fa5dd278c2 One more fix for unconfineduser.te 2014-01-19 21:39:40 +01:00
Miroslav Grepl
2b1fa01371 rpm_script_roles is attribute_role 2014-01-19 21:08:41 +01:00
Miroslav Grepl
9e62d1d3a9 Fix ipsec typo 2014-01-18 11:02:03 +01:00
Miroslav Grepl
06cfcd1c01 Add missing kernel_rw_security_state() 2014-01-17 22:42:04 +01:00
Miroslav Grepl
8155b37c25 Call kernel_rw_usermodehelper in devicekit.te 2014-01-17 22:21:54 +01:00
Miroslav Grepl
265b035e32 Fix kernel_read_usermodehelper 2014-01-17 22:07:50 +01:00
Miroslav Grepl
eeca65cd12 Call proper interfaces - usermodehelper 2014-01-17 21:45:33 +01:00
Miroslav Grepl
912db9180b ysctl_modprobe_t and sysctl_hotplug_t are now obsoleted by usermodhelper_t 2014-01-17 21:26:23 +01:00
Miroslav Grepl
438fa3b5de Fix definition for proc_security_t and usermodehelper_t 2014-01-17 17:23:06 +01:00