Commit Graph

5181 Commits

Author SHA1 Message Date
Miroslav Grepl
99d95cac6e Add geoclue policy 2014-01-21 12:22:50 +01:00
Dan Walsh
3397003331 Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2014-01-20 10:46:29 -05:00
Dan Walsh
3708ddf552 Fix /sys/kernel/uevent_helper to be a file rather then recursing a directory 2014-01-20 10:46:14 -05:00
Miroslav Grepl
3a0ebd8398 - Add cron unconfined role support for uncofined SELinux user
- Call kernel_rw_usermodehelper_state() in init.te
- Call corenet_udp_bind_all_ports() in milter.te
- Allow fence_virtd to connect to zented port
- Fix header for mirrormanager_admin()
- Allow dkim-milter to bind udp ports
- Allow milter domains to send signull itself
- Allow block_suspend for yum running as mock_t
- Allow beam.smp to manage couchdb files
- Add couchdb_manage_files()
- Add labeling for /var/log/php_errors.log
- Allow bumblebee to stream connect to xserver
- Allow bumblebee to send a signal to xserver
- gnome-thumbnail to stream connect to bumblebee
- Fix calling usermodehelper to use _state in interface name
- Allow xkbcomp running as bumblebee_t to execute  bin_t
- Allow logrotate to read squid.conf
- Additional rules to get docker and lxc to play well with SELinux
- Call kernel_read_usermodhelper/kernel_rw_usermodhelper
- Make rpm_transition_script accept a role
- Added new policy for pcp
- Allow bumbleed to connect to xserver port
- Allow pegasus_openlmi_storage_t to read hwdata
2014-01-20 11:41:09 +01:00
Miroslav Grepl
5dcd635c58 index.html and style.css should be in /usr/share/selinux/devel/htm 2014-01-20 11:24:03 +01:00
Miroslav Grepl
93e99e4693 Rename badly used userhelper_t in kernel.if to usermodehelper 2014-01-19 22:18:55 +01:00
Miroslav Grepl
fa5dd278c2 One more fix for unconfineduser.te 2014-01-19 21:39:40 +01:00
Miroslav Grepl
2b1fa01371 rpm_script_roles is attribute_role 2014-01-19 21:08:41 +01:00
Miroslav Grepl
9e62d1d3a9 Fix ipsec typo 2014-01-18 11:02:03 +01:00
Miroslav Grepl
06cfcd1c01 Add missing kernel_rw_security_state() 2014-01-17 22:42:04 +01:00
Miroslav Grepl
8155b37c25 Call kernel_rw_usermodehelper in devicekit.te 2014-01-17 22:21:54 +01:00
Miroslav Grepl
265b035e32 Fix kernel_read_usermodehelper 2014-01-17 22:07:50 +01:00
Miroslav Grepl
eeca65cd12 Call proper interfaces - usermodehelper 2014-01-17 21:45:33 +01:00
Miroslav Grepl
912db9180b ysctl_modprobe_t and sysctl_hotplug_t are now obsoleted by usermodhelper_t 2014-01-17 21:26:23 +01:00
Miroslav Grepl
438fa3b5de Fix definition for proc_security_t and usermodehelper_t 2014-01-17 17:23:06 +01:00
Miroslav Grepl
71a28bab65 Remove dup interface 2014-01-17 17:02:44 +01:00
Miroslav Grepl
368fb803a8 See spec file 2014-01-17 16:40:25 +01:00
Dan Walsh
f264f9cf08 Need to fix label on /sys/kernel/uevent_handler 2014-01-17 10:03:23 -05:00
Miroslav Grepl
5bd1f1afd6 * Mon Jan 13 2014 Miroslav Grepl<mgrepl@redhat.com> 3.13.1-13
- Remove file_t from the system and realias it with unlabeled_
2014-01-13 12:25:57 +01:00
Miroslav Grepl
0a96c38442 Add latest changes from selinux-policy.git 2014-01-10 14:55:21 +01:00
Miroslav Grepl
01969cfc26 Don't transition roles when executing daemons from unconfined_t 2014-01-09 23:12:05 +01:00
Miroslav Grepl
af2dcd6ac0 Revert Try to change ssh_exec to ssh_basic_client for glusterd_t 2014-01-09 16:48:21 +01:00
Miroslav Grepl
9b85087129 - Add gluster fixes
- Remove ability to transition to unconfined_t from confined domains
- Additional allow rules to get libvirt-lxc containers working with docker
2014-01-09 15:11:05 +01:00
Miroslav Grepl
c0bc504789 Use userdom_filetrans_type instead of userdom_filetrans_domain in userdomain.te 2014-01-06 09:14:52 +01:00
Miroslav Grepl
9d88e18305 - Allow mozilla plugin to chat with policykit, needed for spice
- Allow gssprozy to change user and gid, as well as read user keyrings
- Allow sandbox apps to attempt to set and get capabilties
- Label upgrades directory under /var/www as httpd_sys_rw_content_t, add other filetrans rules to label content correctly
- allow modemmanger to read /dev/urand
- Allow polipo to connect to http_cache_ports
- Allow cron jobs to manage apache var lib content
- Allow yppassword to manage the passwd_file_t
- Allow showall_t to send itself signals
- Allow cobbler to restart dhcpc, dnsmasq and bind services
- Allow rsync_t to manage all non auth files
- Allow certmonger to manage home cert files
- Allow user_mail_domains to write certain files to the /root and ~/ directories
- Allow apcuspd_t to status and start the power unit file
- Allow cgroupdrulesengd to create content in cgoups directories
- Add new access for mythtv
- Allow irc_t to execute shell and bin-t files:
- Allow smbd_t to signull cluster
- Allow sssd to read systemd_login_var_run_t
- Allow gluster daemon to create fifo files in glusterd_brick_t and sock_file in glusterd_var_lib_t
- Add label for /var/spool/cron.aquota.user
- Allow sandbox_x domains to use work with the mozilla plugin semaphore
- Added new policy for speech-dispatcher
- Added dontaudit rule for insmod_exec_t  in rasdaemon policy
- Updated rasdaemon policy
- Allow virt_domains to read cert files
- Allow system_mail_t to transition to postfix_postdrop_t
- Clean up mirrormanager policy
- Allow subscription-manager running as sosreport_t to manage rhsmcertd
- Remove ability to do mount/sys_admin by default in virt_sandbox domains
- New rules required to run docker images within libivrt
- Fixed bumblebee_admin() and mip6d_admin()
- Add log support for sensord
- Add label for ~/.cvsignore
- Change mirrormanager to be run by cron
- Add mirrormanager policy
- Additional fixes for docker.te
- Allow cobblerd to read/write undionly.kpxe located in /var/lib/tftpboot
- Add tftp_write_rw_content/tftp_read_rw_content interfaces
- Allow amanda to do backups over UDP
2014-01-06 07:31:14 +01:00
Miroslav Grepl
804870d8a3 policy-rawhide-contrib-apache-content.patch is no longer needed. Merged to policy-rawhide-contrib.patch. 2014-01-06 06:56:06 +01:00
Dan Walsh
70c60d82d0 Fix usage of semanage import line 2014-01-02 14:17:35 -05:00
Lukas Vrabec
162a2c3802 Added speech-dispatcher to modules-targeted-contrib.conf 2013-12-20 15:28:27 +01:00
Miroslav Grepl
e0c1a1b49f Turn on mirrormanager policy 2013-12-19 21:10:46 +01:00
Miroslav Grepl
a8441cafab Fix userdom_manage_home_texlive() interface 2013-12-16 14:10:25 +01:00
Miroslav Grepl
b305c2adc0 Fix mozilla.te 2013-12-16 13:42:56 +01:00
Miroslav Grepl
fa3915aa88 Additional fixes for docker.te 2013-12-16 12:38:58 +01:00
Miroslav Grepl
1fe4113ea7 Fix docker policy 2013-12-16 12:25:11 +01:00
Miroslav Grepl
c9394c3ea7 Add selinux/minimum/contexts/users/sysadm_u also for minimum policy 2013-12-16 12:05:05 +01:00
Miroslav Grepl
74b303ea26 Fix spec file 2013-12-13 15:10:55 +01:00
Miroslav Grepl
2397102af8 - Allow freeipmi_ipmidetectd_t to use freeipmi port
- Update freeipmi_domain_template()
- Allow journalctl running as ABRT to read /run/log/journal
- Allow NM to read dispatcher.d directory
- Update freeipmi policy
- Type transitions with a filename not allowed inside conditionals
- Allow tor to bind to hplip port
- Make new type to texlive files in homedir
- Allow zabbix_agent to transition to dmidecode
- Add rules for docker
- Allow sosreport to send signull to unconfined_t
- Add virt_noatsecure and virt_rlimitinh interfaces
- Fix labeling in thumb.fc to add support for /usr/lib64/tumbler-1/tumblerddd support for freeipm
- Add sysadm_u_default_contexts
- Add logging_read_syslog_pid()
- Fix userdom_manage_home_texlive() interface
- Make new type to texlive files in homedir
- Add filename transitions for /run and /lock links
- Allow virtd to inherit rlimit information
2013-12-12 17:23:54 +01:00
Lukas Vrabec
0dc67d04d6 Added vmtools to modules-targeted-contrib.conf 2013-12-10 11:26:08 +01:00
Miroslav Grepl
4b8334da4c - DRM master and input event devices are used by the TakeDevice API
- Clean up bumblebee policy
- Update pegasus_openlmi_storage_t policy
- opensm policy clean up
- openwsman policy clean up
- ninfod policy clean up
- Allow conman to connect to freeipmi services and clean up conman policy
- Allow conmand just bind on 7890 port
- Add freeipmi_stream_connect() interface
- Allow logwatch read madm.conf to support RAID setup
- Add raid_read_conf_files() interface
- Allow up2date running as rpm_t create up2date log file with rpm_log_t labeling
- add rpm_named_filetrans_log_files() interface
- Added policy for conmand
- Allow dkim-milter to create files/dirs in /tmp
- update freeipmi policy
- Add policy for freeipmi services
- Added rdisc_admin and rdisc_systemctl interfaces
- Fix aliases in pegasus.te
- Allow chrome sandbox to read generic cache files in homedir
- Dontaudit mandb searching all mountpoints
- Make sure wine domains create .wine with the correct label
- Add proper aliases for pegasus_openlmi_services_exec_t and pegasus_openlmi_services_t
- Allow windbind the kill capability
- DRM master and input event devices are used by  the TakeDevice API
- add dev_rw_inherited_dri() and dev_rw_inherited_input_dev()
- Added support for default conman port
- Add interfaces for ipmi devices
- Make sure wine domains create .wine with the correct label
- Allow manage dirs in kernel_manage_debugfs interface.
- Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service
- Label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t
- Fix userdom_confined_admin_template()
- Add back exec_content boolean for secadm, logadm, auditadm
- Fix files_filetrans_system_db_named_files() interface
- Allow sulogin to getattr on /proc/kcore
- Add filename transition also for servicelog.db-journal
- Add files_dontaudit_access_check_root()
- Add lvm_dontaudit_access_check_lock() interface
2013-12-09 08:16:07 +01:00
Lukas Vrabec
5689bdb03b Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2013-12-06 11:18:21 +01:00
Lukas Vrabec
d487bf5144 Added conman to modules-targeted-contrib.conf 2013-12-06 11:17:48 +01:00
Miroslav Grepl
6de8b20964 Add freeipmi policy 2013-12-06 10:00:23 +01:00
Lukas Vrabec
65289ba44b Added ninfod and openwsman to modules-targeted-contrib.conf 2013-12-05 15:43:22 +01:00
Miroslav Grepl
676f0e4eb9 - Add back fixes for gnome_role_template()
- Label /usr/sbin/htcacheclean as httpd_exec_t
- Add missing alias for pegasus_openlmi_service_exec_t
- Added support for rdisc unit file
- Added new policy for ninfod
- Added new policy for openwsman
- Add antivirus_db_t labeling for /var/lib/clamav-unofficial-sigs
- Allow runuser running as logrotate connections to system DBUS
- Add connectto perm for NM unix stream socket
- Allow watchdog to be executed from cron
- Allow cloud_init to transition to rpm_script_t
- Allow lsmd_plugin_t send system log messages
- Label /var/log/up2date as rpm_log_t and allow sosreport to manage rpm log/pid/cache files which is a part of ABRT polic
- Added new capabilities for mip6d policy
- Label bcache devices as fixed_disk_device_t
- Allow systemctl running in ipsec_mgmt_t to access /usr/lib/systemd/system/ipsec.service
- label /usr/lib/systemd/system/ipsec.service as ipsec_mgmt_unit_file_t
2013-12-03 22:01:54 +01:00
Miroslav Grepl
d61adff49b - Add lsmd_plugin_t for lsm plugins
- Allow dovecot-deliver to search mountpoints
- Add labeling for /etc/mdadm.conf
- Allow opelmi admin providers to dbus chat with init_t
- Allow sblim domain to read /dev/urandom and /dev/random
- Add back exec_content boolean for secadm, logadm, auditadm
- Allow sulogin to getattr on /proc/kcore
2013-11-26 18:41:01 +01:00
Miroslav Grepl
04c55cf070 Add glusterd_brick_t type 2013-11-26 13:12:08 +01:00
Miroslav Grepl
c9b9ed2c4d - Add filename transition also for servicelog.db-journal
- Add files_dontaudit_access_check_root()
- Add lvm_dontaudit_access_check_lock() interface
- Allow mount to manage mount_var_run_t files/dirs
- Allow updapwd_t to ignore mls levels for writign shadow_t at a lower level
- Make sure boot.log is created with the correct label
- call logging_relabel_all_log_dirs() in systemd.te
- Allow systemd_tmpfiles to relabel log directories
- Allow staff_t to run frequency command
- Allow staff_t to read xserver_log file
- This reverts commit c0f9f125291f189271cbbca033f87131dab1e22f.
- Label hsperfdata_root as tmp_t
- Add plymouthd_create_log()
- Dontaudit leaks from openshift domains into mail domains, needs back port to RHEL6
- Allow sssd to request the kernel loads modules
- Allow gpg_agent to use ssh-add
- Allow gpg_agent to use ssh-add
- Dontaudit access check on /root for myslqd_safe_t
- Add glusterd_brick_t files type
- Allow ctdb to getattr on al filesystems
- Allow abrt to stream connect to syslog
- Allow dnsmasq to list dnsmasq.d directory
- Watchdog opens the raw socket
- Allow watchdog to read network state info
- Dontaudit access check on lvm lock dir
- Allow sosreport to send signull to setroubleshootd
- Add setroubleshoot_signull() interface
- Fix ldap_read_certs() interface
- Allow sosreport all signal perms
- Allow sosreport to run systemctl
- Allow sosreport to dbus chat with rpm
- Allow zabbix_agentd to read all domain state
- Allow sblim_sfcbd_t to read from /dev/random and /dev/urandom
- Allow smoltclient to execute ldconfig
- Allow sosreport to request the kernel to load a module
- Clean up rtas.if
- Clean up docker.if
- drop /var/lib/glpi/files labeling in cron.fc
- Added new policy for rasdaemon
2013-11-26 11:42:42 +01:00
Miroslav Grepl
6789507ff9 Turn on docker policy 2013-11-22 11:42:15 +01:00
Lukas Vrabec
a2db29cc4f Merge branch 'master' of ssh://pkgs.fedoraproject.org/selinux-policy 2013-11-21 17:36:29 +01:00
Lukas Vrabec
3e4e5fbcd1 Added rasdaemon module to modules-targeted-contrib.conf 2013-11-21 17:35:26 +01:00
Dan Walsh
ae07faa147 Turn off F20 permissive domains, add docker 2013-11-21 09:20:24 -05:00