rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity
3,158 Commits 9 Branches 105 Tags 34 MiB
b45aaab97c
Commit Graph

1545 Commits

Author SHA1 Message Date
Dan Walsh
a668127367 Allow certmaster to read usr_t files. All python apps are going to need this. 
clvmd creates tmpfs files that corosync needs to communicate with
Allow dbus system services to search the cgroup_t directory
 2010-09-02 13:38:00 -04:00
Dan Walsh
3a2e888584 cleanup mmap_low merge with upstream 2010-09-01 14:55:04 -04:00
Dan Walsh
cbadf720ba Merge branch 'master' of http://oss.tresys.com/git/refpolicy 
Conflicts:
	policy/modules/kernel/domain.if
	policy/modules/services/xserver.te
 2010-09-01 14:11:18 -04:00
Dan Walsh
02fb4a01f1 define /sys/fs/cgroup as a <<none>> file system 2010-09-01 10:12:53 -04:00
Chris PeBenito
785ee7988c Module version bump and changelog entry for conditional mmap_zero patch. 2010-09-01 10:08:09 -04:00
Chris PeBenito
a1b42052c9 Fix mmap_zero assertion violation in xserver. 2010-09-01 09:59:39 -04:00
Dan Walsh
09686dc8ee Allow all X apps to use direct dri if user_direct_dri boolean is turned on 2010-09-01 09:56:28 -04:00
Dan Walsh
03527520de firstboot is leaking a netlink_route socket into iptables. We need to dontaudit 
tmpfs_t/devpts_t files can be stored on device_t file system
unconfined_mono_t can pass file descriptors to chrome_sandbox, so need transition from all unoconfined users types
Hald can connect to user processes over streams
xdm_t now changes the brightness level on the system
mdadm needs to manage hugetlbfs filesystems
 2010-09-01 09:47:50 -04:00
Dominick Grift
623e4f0885 1/1] Make the ability to mmap zero conditional where this is fapplicable. 
Retry: forgot to include attribute mmap_low_domain_type attribute to domain_mmap_low()	:

Inspired by similar implementation in Fedora.
Wine and vbetool do not always actually need the ability to mmap a low area of the address space.
In some cases this can be silently denied.

Therefore introduce an interface that facilitates "mmap low" conditionally, and the corresponding boolean.
Also implement booleans for wine and vbetool that enables the ability to not audit attempts by wine and vbetool to mmap a low area of the address space.

Rename domain_mmap_low interface to domain_mmap_low_uncond.

Change call to domain_mmap_low to domain_mmap_low_uncond for xserver_t. Also move this call to distro redhat ifndef block because Redhat does not need this ability.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-01 09:41:56 -04:00
Dan Walsh
c6fa935fd5 Fix sandbox tcp_socket calls to create_stream_socket_perms 
Dontaudit sandbox_xserver_t trying to get the kernel to load modules
telepathy_msn sends dbus messages to networkmanager
mailman_t trys to read /root/.config
xserver tries to getpgid on processes that start it.
pam_systemd causes /var/run/users to be called for all login programs.  Must allow them to create directories
 2010-08-31 18:36:43 -04:00
Dan Walsh
4fccad906d Allow qmail to use uucpd 
Fixes found by Tom London for devicekit and udev using usbmuxd socket
 2010-08-31 10:51:10 -04:00
Dan Walsh
5fb4db53ad Add Miroslav Grepl patch for jabberd, adding new type for jabberd router. 2010-08-31 08:56:30 -04:00
Dan Walsh
3fdb12decd Allow prelink to read dbus config/Broken 
nsplugin_config wants the kernel to load modules for it.
mount writes into livecd_tmp_t directories
 2010-08-31 08:54:18 -04:00
Dan Walsh
5537e5558b Apply Dominick Grift typo fixes 2010-08-30 17:32:41 -04:00
Dan Walsh
079779a634 Allow hald to transition to netutils 
Block signal via mcs systems
 2010-08-30 15:15:03 -04:00
Dan Walsh
898c0de0b7 merge latest upstream 2010-08-30 13:41:40 -04:00
Dan Walsh
ddcd5d6350 Dontaudit signals from sandbox domains to domains that transition to them 2010-08-30 13:32:47 -04:00
Dan Walsh
8c8a10fcbe Dontaudit socket leaks when running semanage code 2010-08-30 11:37:02 -04:00
Dan Walsh
73f7d4f4a2 Fix spelling mistake 2010-08-30 11:30:00 -04:00
Dan Walsh
c71f02c02d More fixes 2010-08-30 11:15:53 -04:00
Dan Walsh
2d4a79a061 Policy fixes 2010-08-30 08:57:06 -04:00
Dan Walsh
ac498fa5d9 More fixes 2010-08-27 10:56:56 -04:00
Dan Walsh
08e567dc56 Latest fixes 2010-08-26 20:30:04 -04:00
Dan Walsh
9561b0ab08 Update f14 2010-08-26 15:42:17 -04:00
Dan Walsh
4765a595e8 Fixes for f14 2010-08-26 15:29:37 -04:00
Dan Walsh
46c24a359b ditto 2010-08-26 13:23:23 -04:00
Dan Walsh
aae38f05a6 whoya 2010-08-26 13:16:02 -04:00
Dan Walsh
2968e06818 Update f14 2010-08-26 12:55:57 -04:00
Dan Walsh
18549c23df Fix policy 2010-08-26 11:09:31 -04:00
Dan Walsh
507000a1db reset 2010-08-26 11:03:50 -04:00
Dan Walsh
8f4ec142d7 Modified amanda 2010-08-26 11:02:44 -04:00
Dan Walsh
09154bd53e Reset base 2010-08-26 11:01:06 -04:00
Dan Walsh
e15d0e76e3 Modify amanda 2010-08-26 10:59:43 -04:00
Dan Walsh
0aa4ecc332 F14 2010-08-26 10:56:06 -04:00
Dan Walsh
f9c5576c27 F14 2010-08-26 10:54:59 -04:00
Dan Walsh
e5e9b7bd43 F14 2010-08-26 10:50:47 -04:00
Dan Walsh
a61cba6e07 Rebase constraints 2010-08-26 10:45:39 -04:00
Dan Walsh
9afb2b166a Go with upstream 2010-08-26 10:40:06 -04:00
Dan Walsh
a947daf6df Update f14 2010-08-26 10:27:35 -04:00
Dan Walsh
83eff061a3 Latest f14 2010-08-26 10:26:28 -04:00
Dan Walsh
3eaa993945 UPdate for f14 policy 2010-08-26 09:41:21 -04:00
Chris PeBenito
76a9fe96e4 Module version bumps and changelog for devtmpfs patchset. 2010-08-25 11:19:27 -04:00
Chris PeBenito
0d24805fd0 Trivial tweaks to devtmpfs patches. 2010-08-25 11:18:25 -04:00
Jeremy Solt
2fc79f1ef4 Early devtmpfs access 
dontaudit attempts to read/write device_t chr files occurring before udev relabel
allow init_t and initrc_t read/write on device_t chr files (necessary to boot without unconfined)

Signed-off-by: Jeremy Solt <jsolt@tresys.com>
 2010-08-25 11:01:27 -04:00
Jeremy Solt
d6e1ef29cd Move devtmpfs to devices from filesystem 
Move devtmpfs to devices module (remove from filesystem module)
Make device_t a filesystem
Add interface for associating types with device_t filesystem (dev_associate)
Call dev_associate from dev_filetrans
Allow all device nodes associate with device_t filesystem
Remove dev_tmpfs_filetrans_dev from kernel_t
Remove fs_associate_tmpfs(initctl_t) - redundant, it was in dev_filetrans, now in dev_associate
Mounton interface, to allow the kernel to mounton device_t

Signed-off-by: Jeremy Solt <jsolt@tresys.com>
 2010-08-25 11:01:22 -04:00
Chris PeBenito
c62f1bef77 Dbadm updates from KaiGai Kohei. 2010-08-19 08:41:39 -04:00
Chris PeBenito
ab8f919e6f Part of gnome patch from Dan Walsh. 2010-08-12 09:21:36 -04:00
Chris PeBenito
a9539a063b Additional kdumpgui cleanup. 2010-08-10 09:21:01 -04:00
Jeremy Solt
46fc0d39e3 Policy for system-config-kdump gui from Dan Walsh 
Edits:
 - removed gnome_dontaudit_search_config
 - removed userdom_dontaudit_search_admin_dir
 - whitespace and style fixes
 2010-08-10 09:05:43 -04:00
Jeremy Solt
68e615ec5a system-config-samba dbus service policy from Dan Walsh 2010-08-09 09:37:29 -04:00
Jeremy Solt
c87e150280 roles patch from Dan Walsh to move unwanted interface calls into a ifndef 2010-08-09 09:20:31 -04:00
Chris PeBenito
00ca404a20 Remove unnecessary require on cgroup_admin(). 2010-08-09 09:10:24 -04:00
Chris PeBenito
d687db9b42 Whitespace fixes on cgroup. 2010-08-09 08:52:39 -04:00
Dominick Grift
61d7ee58a4 Confine /sbin/cgclear. 
Libcgroup moved cgclear to /sbin.
Confine it so that initrc_t can domain transition to the cgclear_t domain. That way we do not have to extend the initrc_t domains policy.
We might want to add cgroup_run_cgclear to sysadm module.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-08-09 08:47:15 -04:00
Dominick Grift
a0546c9d1c System layer xml fixes. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-08-05 09:25:55 -04:00
Dominick Grift
288845a638 Services layer xml files. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-08-05 09:25:29 -04:00
Chris PeBenito
97b990f86e Fix corecmd_dontaudit_exec_all_executables doc. 2010-08-05 09:24:41 -04:00
Dominick Grift
705f70f098 Kernel layer xml fixes. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-08-05 09:08:07 -04:00
Chris PeBenito
19ff03977d Fix usermanage_kill_passwd() parameter doc. 2010-08-05 08:56:31 -04:00
Dominick Grift
77e4b55f70 Admin layer xml fixes. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-08-05 08:46:44 -04:00
Dominick Grift
03b86663f0 apps: domain { allowed to transition, allowed access, to not audit }. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-08-05 08:20:59 -04:00
Chris PeBenito
8da88970be Accountsd cleanup. 2010-08-03 09:50:40 -04:00
Chris PeBenito
d0eebed0b7 Move accountsd to services. 2010-08-03 09:31:53 -04:00
Jeremy Solt
c4834a02d2 accountsd policy from Dan Walsh 
Edits:
 - Removed accountsd_manage_var_lib
 - Removed optional block for xserver - these interfaces didn't exist
 - It looks like sys_ptrace is needed because it reads /proc/pid/loginuid
 - Whitespace and style fixes
 2010-08-03 09:27:24 -04:00
Chris PeBenito
a7ee7f819a Docs standardizing on the role portion of run interfaces. Additional docs cleanup. 2010-08-03 09:20:22 -04:00
Chris PeBenito
9d4395a736 MojoMojo from Lain Arnell. 2010-08-02 09:28:06 -04:00
Chris PeBenito
a72e42f485 Interface documentation standardization patch from Dan Walsh. 2010-08-02 09:22:09 -04:00
Chris PeBenito
27eeb649cc Virtio disk file context update from Mika Pfluger. 2010-08-02 08:33:41 -04:00
Mika Pflüger
b3f7203d6a Take virtio disks into account. 
Signed-off-by: Mika Pflüger <debian@mikapflueger.de>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
 2010-08-02 08:25:14 -04:00
Chris PeBenito
64ef2df368 Module version bump for 5563d4c. 2010-07-22 09:13:11 -04:00
Jeremy Solt
5563d4c4d8 Removing seutil_domtrans_setsebool from anaconda patch - it doesn't exist 2010-07-22 08:49:32 -04:00
Jeremy Solt
b0a6f1b7c2 anaconda patch from Dan Walsh 
- Did not include the change to unconfined_domain_noaudit
 2010-07-22 08:49:32 -04:00
Chris PeBenito
21fdee9dd5 Increase bindreservport range to 512-1024 in corenetwork, from Dan Walsh. 
We went back and reread the bindreservport code in glibc.

Turns out the range or ports that this will reserve are 512-1024 rather
then 600-1024.

The code actually first tries to reserve a port from 600-1024 and if
they are ALL reserved will try 512-599.

So we need to change corenetwork to reflect this.
 2010-07-19 14:22:44 -04:00
Chris PeBenito
29f3bfa464 Fix JIT usage for freshclam. 
http://marc.info/?l=selinux&m=127893898208934&w=2
 2010-07-13 08:39:54 -04:00
Dominick Grift
48c3c37cf2 Remove some redundant attributes from user_home_t. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
 2010-07-12 14:35:22 -04:00
Chris PeBenito
4b76ea5f51 Module version bump for fa1847f. 2010-07-12 14:02:18 -04:00
Dominick Grift
fa1847f4a2 Add files_poly_member() to userdom_user_home_content() Remove redundant files_poly_member() calls. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
 2010-07-09 09:43:04 -04:00
Chris PeBenito
f7ffe6c2a9 Add missing ubac constraints on pulseaudio. 2010-07-09 09:14:35 -04:00
Chris PeBenito
c14aebd032 Remove old rbacsep role statements. 2010-07-09 08:38:05 -04:00
Chris PeBenito
072857c425 VMWare patch from Dan Walsh. 2010-07-08 13:43:50 -04:00
Chris PeBenito
f1618ffc6f Whitespace fix in userhelper. 2010-07-08 10:56:15 -04:00
Chris PeBenito
b70dfcdf8f RPM patch from Dan Walsh. 2010-07-08 10:53:28 -04:00
Chris PeBenito
2d839c6791 Whitespace fixes in RPM. 2010-07-08 10:12:24 -04:00
Chris PeBenito
7e265a8abb Add shutdown from Dan Walsh. 2010-07-07 11:10:56 -04:00
Chris PeBenito
b841dffda1 Add livecd from Dan Walsh. 2010-07-07 10:28:25 -04:00
Chris PeBenito
08690c84ad Remove ethereal module since the application was renamed to wireshark due to trademark issues. 2010-07-07 09:31:57 -04:00
Chris PeBenito
3c4e9fce8e Make spamassassin optional for milter, from Russell Coker. 2010-07-07 08:55:57 -04:00
Chris PeBenito
bca0cdb86e Remove duplicate/redundant rules, from Russell Coker. 2010-07-07 08:41:20 -04:00
Chris PeBenito
1db1836ab9 Remove improper usage of userdom_manage_home_role(), userdom_manage_tmp_role(), and userdom_manage_tmpfs_role(). 2010-07-06 13:17:05 -04:00
Chris PeBenito
a3b0dc5b3c GPG patch from Dan Walsh. 2010-07-06 10:58:40 -04:00
Chris PeBenito
3bcfe5beb7 Usermanage patch from Dan Walsh. 
Broken leaks of sockets

useradd runs semanage for -Z.

passwd_t needs sys_nice

useradd run within a samba_controler needs to append to the samba log.
 2010-07-06 10:56:20 -04:00
Chris PeBenito
cad4224e8e Guest patch from Dan Walsh. 
Dominic asked to remove mono and java from guest_t
 2010-07-06 08:35:56 -04:00
Chris PeBenito
ab62f3f1b1 Module version bump for a7521af. 2010-07-01 10:48:11 -04:00
Jeremy Solt
a7521af67d firstboot patch from Dan Walsh 
- Did not include gnome_admin_home_gconf_filetrans
- Whitespace fixes
 2010-07-01 10:36:31 -04:00
Dominick Grift
7e5463b58c fix cgroup_admin 
When cgroup policy was merged, some changes were made. One of these changes was the renaming of the type for cgroup rules engine daemon configuration file. The cgroup_admin interface was not modified to reflect this change.

Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
 2010-07-01 09:02:58 -04:00
Chris PeBenito
caf1666dc1 Module version bump for 5f04c91. 2010-06-29 11:26:16 -04:00
Jeremy Solt
5f04c91f30 gitosis patch from Dan Walsh 2010-06-29 11:25:37 -04:00
Chris PeBenito
ab4f820548 Module version bump for b5d89d0. 2010-06-29 11:03:56 -04:00
Jeremy Solt
b5d89d0325 vpn patch from Dan Walsh 
fixed gen_require in vpn_relabelfrom_tun_socket interface (wrong type)
removed userdom_read_home_certs (not in refpolicy)
 2010-06-29 11:02:45 -04:00
Chris PeBenito
155635e33d Create_lnk_perms fix from Russell Coker. 
Personally I'd rather dump all those old compatibility macros, make them all
just display a message indicating the new correct thing to do and abort the
build.  But if we are going to keep them then we need to update them and make
them work.

The attached patch adds write access to create_lnk_perms.
 2010-06-28 09:33:17 -04:00
Chris PeBenito
113d2e023d Minor tweaks and module version bump for a00fc1c. 2010-06-25 09:51:34 -04:00
Dominick Grift
a00fc1c317 hddtemp fixes. 
Clean up network control section.
Implement hddtemp_etc_t for /etc/sysconfig/hddtemp. The advantages are:
- hddtemp_t no longer needs access to read all generic etc_t files.
- allows us to implement a meaningful hddtemp_admin()

Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
 2010-06-25 09:43:54 -04:00
Chris PeBenito
0cec649be7 WM patch from Dan Walsh. 
Window manager policy changes needed for MLS policy.
 2010-06-25 09:00:19 -04:00
Chris PeBenito
3c79f954d1 Rearrage interfaces in filesystem. 2010-06-22 10:17:42 -04:00
Chris PeBenito
eab2cc89b4 Slocate patch from Dan Walsh. 
Locate attempts to look at network sate and does getattr on all blk/chr
and noxattr symlinks.
 2010-06-22 09:58:14 -04:00
Chris PeBenito
2c207dfa49 Qemu patch from Dan Walsh. 
Fix qemu labeling.

Additional qemu interfaces

Allow qemu to read/write removable devices
 2010-06-22 09:32:35 -04:00
Chris PeBenito
1fd3a8070f Pulseaudio patch from Dan Walsh. 
Dontaudit attempts to exec pulseaudio.  qemu does this and it causes
other avc's even though qemu can not use pulseaudio.

Allow other domains to use pulseiaudio
 2010-06-22 09:13:17 -04:00
Chris PeBenito
1ff703fc4a Podsleuth patch from Dan Walsh. 
podsleuth asks the kernel to load modules
Reads/write removable blk device.

Reads user_tmpfs
 2010-06-22 09:01:38 -04:00
Chris PeBenito
8a24097bff Mplayer patch from Dominick Grift through Dan Walsh. 2010-06-21 09:52:33 -04:00
Chris PeBenito
3c1e8ff6bb Mozilla patch from Dan Walsh. 
Various old fixes for mozilla.
 2010-06-21 09:36:39 -04:00
Chris PeBenito
ae1b7dedd7 Cpufreqselector patch from Dan Walsh. 
Needs to read localization
 2010-06-21 09:03:11 -04:00
Chris PeBenito
a99f69fd0e Loadkeys patch from Dan Walsh. 
Dontaudit leaked sockets
 2010-06-18 15:12:33 -04:00
Chris PeBenito
e08ac5acb3 Vbetool patch from Dan Walsh. 
vbetool needs mls overrides
 2010-06-18 14:56:27 -04:00
Chris PeBenito
3835c39a13 Sudo patch from Dan Walsh. 
sudo gets execed by apps that leak sockets
 2010-06-18 14:43:22 -04:00
Chris PeBenito
f7e3410aed Su patch from Dan Walsh. 
dontaudit leaked sockets
 2010-06-18 14:32:42 -04:00
Chris PeBenito
b9be5cccf1 Shorewall patch from Dan Walsh. 
Shorewall execs hostname
 2010-06-18 14:23:46 -04:00
Chris PeBenito
5116faa198 Quota patch from Dan Walsh. 
Quata needs to setshed on kernel processes
 2010-06-18 14:14:21 -04:00
Chris PeBenito
a9ef84b578 Prelink patch from Dan Walsh. 
Prelink has new directory under /var/lib

dontaudit leaks from domains that transition

cron job looks at all mount points.
 2010-06-18 14:07:53 -04:00
Chris PeBenito
9a4d292902 Netutils patch from Dan Walsh. 
ping gets leaked log descriptor from nagios.

Label send_arp as ping_exec_t
 2010-06-17 10:16:19 -04:00
Chris PeBenito
10c0104066 Kismet patch from Dan Walsh. 
Kismet searches user_home_dirs for kismet_home_t content.
 2010-06-17 08:24:21 -04:00
Chris PeBenito
e89f04fd17 Mcelog patch from Dan Walsh. 
mcelog needs mls override
 2010-06-17 08:23:48 -04:00
Chris PeBenito
0e30bca6d9 Consoletype patch from Dan Walsh. 
I am sick of every app in the known universe leaking socket descriptors.
  Dontaudit by default

consoletype is handed a write for hal log on resume from hibernate.
 2010-06-17 08:23:20 -04:00
Chris PeBenito
88a574d373 Alsa patch from Dan Walsh 
Alsa trys to talk to all types of terminals.  Dontaudit this access.
 2010-06-17 08:22:43 -04:00
Chris PeBenito
4db7790c60 Acct patch from Dan Walsh. 
acct needs to use generic ptys
 2010-06-17 08:22:17 -04:00
Chris PeBenito
48f99a81c0 Whitespace change: drop unnecessary blank line at the start of .te files. 2010-06-10 08:16:35 -04:00
Chris PeBenito
5c942ceb83 AFS patch from Dan Walsh. 2010-06-10 08:08:23 -04:00
Chris PeBenito
b521229560 Abrt patch from Dan Walsh. 
Abrt uses /var/spool/abrt now and changed the name of its lock

Now uses a stream socket

Installs debuginfo packages

sys_nice itself
 2010-06-10 07:58:00 -04:00
Chris PeBenito
48e0aa86c9 Files patch from Dan Walsh. 
Redhat does want /usr/local/src labeled src_t or /usr/src for that matter

Fix labels on chroot environments
 2010-06-09 09:09:34 -04:00
Chris PeBenito
135b1b4c54 Terminal patch from Dan Walsh. 2010-06-09 08:22:31 -04:00
Chris PeBenito
c54e7d63dc Module version bump for cgroup patchset. 2010-06-08 09:18:43 -04:00
Chris PeBenito
53f9abbe68 Clean up cgroup. Rename cgconfigparser to cgconfig. 2010-06-08 09:15:41 -04:00
Chris PeBenito
0041a78ef7 Remove cgroup_t usage in cgroup_admin() since it is not owned by the module. 2010-06-08 09:12:03 -04:00
Chris PeBenito
860c05d9de Rearrange cgroup interfaces in filesystem. 2010-06-08 09:10:45 -04:00
Chris PeBenito
04dcd73fe3 Whitespace fixes in cgroup and init. 2010-06-08 08:47:26 -04:00
Dominick Grift
e2b9add5f8 How users interact with cgroup. 
All login users can list cgroup.
Common users can read and write cgroup files (access governed by dac)

Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
 2010-06-08 08:38:33 -04:00
Dominick Grift
73f0985092 How libgroup init scripts interact with libcgroup. 
The libcgroup init scripts use tools in /usr/bin like cgexec and cgclear.

Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
 2010-06-08 08:38:29 -04:00
Dominick Grift
ddf821332f add libcg policy. 
Libcgroup automates cgroup management.

Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
 2010-06-08 08:38:22 -04:00
Dominick Grift
c0c635b3f3 cgroup in filesystem. 
Move cgroup_t declarations from kernel.te to filesystem.te
Redo cgroup interfaces in filesystem.if
Add file context specification for /cgroup mountpoint to filesystem.fc

Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
 2010-06-08 08:38:18 -04:00
Chris PeBenito
60f04fcb7a Kernel patch from Dan Walsh. 
Add ability to dontaudit requiests to load kernel modules.  If you
disable ipv6 every confined app that does ip, tries to get the kernel to
load the module.

Better handling of unlabeled files by the kernel interfaces
 2010-06-07 11:08:35 -04:00
Chris PeBenito
fb7caddb4f Devices patch from Dan Walsh. 
vhost_device_t added for libvirt/qemu

/dev/usbmon device added

lots of new interfaces.
 2010-06-07 09:20:18 -04:00
Chris PeBenito
46c0e57acf Corecommands patch from Dan Walsh. 
Lots of new places to stick bin_t files
 2010-06-07 09:04:08 -04:00
Chris PeBenito
8f0de5df68 Storage patch from Dan Walsh. 
Add /dev/hwcdrom
 2010-06-04 09:47:45 -04:00
Chris PeBenito
2a29628e40 Fix duplicate lines in kudzu. 2010-05-26 08:26:50 -04:00
Chris PeBenito
29af4c13e7 Bump module versions for release. 2010-05-24 15:32:01 -04:00
Chris PeBenito
91cbcc6602 Fix deprecated interface usage in rhel4 block in su.if. 2010-05-24 15:09:18 -04:00
Chris PeBenito
3d95ca2d82 Module version bump for 904f3d8. 2010-05-24 13:08:09 -04:00
Chris PeBenito
7934ac10d3 Module version bump for 1184392 and more. 
* module version bump
* make apache and unconfined portions optiona
* rearrange lines
 2010-05-24 13:08:09 -04:00
Chris PeBenito
ca28376c4d Module version bump for 7942f7f. 2010-05-24 13:08:09 -04:00
Chris PeBenito
bdf5e19931 Module version bump for 383bd32. 2010-05-24 13:08:09 -04:00
Chris PeBenito
213d35a07c Module version bump for 9e28f74. 2010-05-24 13:08:09 -04:00
Chris PeBenito
63583f4e29 Module version bump for f61ef24. 2010-05-24 13:08:09 -04:00
Chris PeBenito
c789f82bc5 Module version bump for d5170e5. 2010-05-24 13:08:09 -04:00
Chris PeBenito
d53a972879 Module version bump for cb1df6a. 2010-05-24 13:08:09 -04:00
Jeremy Solt
d8642cad29 readahead patch from Dan Walsh 
Edits:
 - Removed files_dontaudit_read_security_files and fs_dontaudit_read_tmpfs_blk_dev interface calls
 2010-05-24 13:08:08 -04:00
Chris PeBenito
fe74f71385 Fix deprecated interface usage that crept into lvm.if. 2010-05-24 13:08:08 -04:00
Chris PeBenito
ff1cae1f5e Move line in logrotate; module version bump. 2010-05-24 13:08:08 -04:00
Chris PeBenito
a107f875bd Remove redundant optional and libs_* calls in clogd. 2010-05-24 13:08:08 -04:00
Chris PeBenito
dcb7227286 Module version bump for 51ad76f. 2010-05-24 13:08:08 -04:00
Jeremy Solt
6430c79a29 whitespace fix for clogd 2010-05-24 13:08:08 -04:00
Jeremy Solt
6055ab8d1d clogd policy from Dan Walsh 
edits:
 - style and whitespace fixes
 - removed read_lnk_files_pattern from shm interface
 - removed permissive line
 2010-05-24 13:08:08 -04:00
Jeremy Solt
7a8e6a8fba whitespace fixes for cluster suite patch 2010-05-24 13:08:08 -04:00
Jeremy Solt
21d23c878e Removed unnecessary comments 
Removed 'SELinux policy for' from policy summaries
Removed rgmanager interface for semaphores (doesn't appear to be needed or used)
Removed redundant calls to libs_use_ld_so and libs_use_shared_libs
Fixed rhcs interface names to match naming rules
Merged tmpfs and semaphore/shm interfaces
 2010-05-24 13:08:08 -04:00
Jeremy Solt
538cf9ab83 Redhat Cluster Suite Policy from Dan Walsh 
Edits:
 - Style and whitespace fixes
 - Removed interfaces for default_t from ricci.te - this didn't seem right
 - Removed link files from rgmanager_manage_tmpfs_files
 - Removed rdisc.if patch. it was previously committed
 - Not including kernel_kill interface call for rgmanager
 - Not including ldap interfaces in rgmanager.te (currently not in refpolicy)
 - Not including files_create_var_run_dirs call for rgmanager (not in refpolicy)
 2010-05-24 13:08:08 -04:00
Jeremy Solt
b8c9879a8c logrotate patch from Dan Walsh 2010-05-24 13:08:08 -04:00
Jeremy Solt
fdc0d0f77c vpn patch from Dan Walsh 
Edits:
 - Removed userdom_read_home_certs
 2010-05-24 13:08:08 -04:00
Jeremy Solt
37194ac055 dnsmasq patch from Dan Walsh 
- cron_manage_pid_files call removed until further explanation
 2010-05-24 13:08:07 -04:00
Jeremy Solt
2483d7ae56 Replace apache_delete_cache with apache_delete_cache_files in tmpreaper.te 2010-05-24 13:08:07 -04:00
Jeremy Solt
8daddcf37e tmpreaper patch from Dan Walsh 2010-05-24 13:08:07 -04:00
Jeremy Solt
7605d2738c Remove call to nagios_rw_inherited_tmp_files 2010-05-24 13:08:07 -04:00
Jeremy Solt
44dc1b9c21 netutils patch from Dan Walsh 
Edits:
 - Dropping term_use_all_terms and user_ping tunables for ping and traceroute
 - Whitespace fixes
 2010-05-24 13:08:07 -04:00
Jeremy Solt
4ac0cd30fa Remove nagios_rw_inherited_tmp_files interface 2010-05-24 13:08:07 -04:00
Jeremy Solt
99bbe34881 Nagios patch from Dan Walsh 
Edits:
- Removed permissive lines
- Removed tunable for broken symptoms
- Style and whitespace fixes
 2010-05-24 13:08:07 -04:00
Jeremy Solt
599e8ff702 Create type and allow squid to manage its own tmpfs files 2010-05-24 13:08:07 -04:00
Jeremy Solt
d86c09846b squid patch from Dan Walsh 
Edits:
 - Added netport to corenetwork.te.in
 2010-05-24 13:08:07 -04:00
Jeremy Solt
fb543d0df1 remove rules for nx_server_home_ssh_t since they are already provided by the ssh template 2010-05-24 13:08:07 -04:00
Jeremy Solt
316cdb1d0d nx patch from Dan Walsh 
Edits:
 - Style and whitespace fixes
 - Removed read_lnk_files_pattern from nx_read_home_files
 - Delete declaration of nx_server_home_ssh_t and files_type since the template already does this
 2010-05-24 13:08:07 -04:00
Chris PeBenito
d9e4cbd2ce Postfix patch from Dan Walsh. 2010-05-21 08:56:49 -04:00
Chris PeBenito
9fe1b540b8 Prelink patch from Dan Walsh. 2010-05-20 08:54:51 -04:00
Chris PeBenito
9ea85eaa8b Sendmail patch from Dan Walsh. 2010-05-20 08:36:38 -04:00
Chris PeBenito
b276e36914 Procmail patch from Dan Walsh. 2010-05-20 08:17:06 -04:00
Chris PeBenito
e19b8d1c2e MTA patch from Dan Walsh. 2010-05-19 09:00:39 -04:00
Chris PeBenito
088b65e52b SSH patch from Dan Walsh. 2010-05-19 08:31:17 -04:00
Chris PeBenito
4e698b0fca Cups patch from Dan Walsh. 2010-05-18 10:59:37 -04:00
Chris PeBenito
e2c9450235 Remove excessive permission in udev_manage_rules_files() and move the interface up in the .if file. Module version bump for d56b33a. 2010-05-18 10:28:17 -04:00
Chris Richards
d56b33a1e4 Create new interface and type for managing /etc/udev/rules.d 
udev_var_run_t is used for managing files in /etc/udev/rules.d as well as other files, including udev pid files.  This patch creates a type specifically for rules.d files, and an interface for managing them.  It also gives access to this type to initrc_t so that rules can be properly populated during startup.  This also fixes a problem on Gentoo where udev rules are NOT properly populated on startup.

Signed-off-by: Chris Richards <gizmo@giz-works.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
 2010-05-18 10:20:55 -04:00
Chris PeBenito
1b2f08ea10 Abrt patch from Dan Walsh. 2010-05-18 10:18:12 -04:00
Chris PeBenito
e9e43f04b3 Plymouthd policy from Dan Walsh. 2010-05-18 09:54:18 -04:00
Chris PeBenito
b0c2cae14a Hal patch from Dan Walsh. 
Lots of random access for hal.
 2010-05-18 09:06:36 -04:00
Chris PeBenito
2e4e39d26a Loadkeys patch from Dan Walsh. 2010-05-14 11:40:26 -04:00
Chris PeBenito
84940a0995 Java patch from Dan Walsh. 
Additional java context

unconfined_Java apps needs to execmod any file since we do not know where the jave content will be labeled

We want unconfined java apps to transition to rpm when they execute rpm_exec_t.  To maintain proper labeling.
 2010-05-14 10:40:59 -04:00
Chris PeBenito
299db7080c CVS patch from Dan Walsh. 
cvs needs dac_override when it tries to read shadow
 2010-05-14 10:24:11 -04:00
Chris PeBenito
bcc6e65421 SETroubleshoot patch from Dan Walsh. 
Policy to handle the fixit button in setroubleshoot.
 2010-05-13 13:22:53 -04:00
Chris PeBenito
ada61e1529 Asterisk patch from Dan Walsh. 
asterisk_manage_lib_files(logrotate_t)
    asterisk_exec(logrotate_t)

Needs net_admin

Drops capabilities
connects to unix_stream

execs itself

Requests kernel load modules

Execs shells

Connects to postgresql and snmp ports

Reads urand and generic usb devices

Has mysql and postgresql back ends
sends mail
 2010-05-13 11:35:58 -04:00
Chris PeBenito
24e0b9b3a4 Munin patch from Dan Walsh. 2010-05-13 11:20:54 -04:00
Chris PeBenito
16070400a8 RPM patch from Dan Walsh. 2010-05-11 11:11:40 -04:00
Chris PeBenito
27afb97c29 Minor fixes on a2524cf. Module version bump. 2010-05-11 08:33:04 -04:00
Chris PeBenito
aeb7a4e180 Whitespace fixes on cobbler. 2010-05-11 08:23:02 -04:00
Jeremy Solt
a2524cfa77 cobbler patch from Dan Walsh 2010-05-11 08:17:33 -04:00
Chris PeBenito
fb3fc9e4f0 Cyrus patch from Dan Walsh. 2010-05-03 15:14:50 -04:00
Chris PeBenito
4804cd43a0 Clamav patch from Dan Walsh. 2010-05-03 15:01:35 -04:00
Chris PeBenito
d8eb3c71c6 Dovecot patch from Dan Walsh. 2010-05-03 14:37:19 -04:00
Chris PeBenito
baea7b1dc6 Networkmanager patch from Dan Walsh. 2010-05-03 14:01:26 -04:00
Chris PeBenito
03a6e03926 Add kernel access to devtmpfs. Also add workround while devtmpfs is tmpfs_t instead of device_t. 2010-05-03 11:17:16 -04:00
Chris PeBenito
a3108c60c0 Consolekit patch from Dan Walsh. 2010-05-03 10:21:48 -04:00
Chris PeBenito
b0076a1413 Arpwatch patch from Dan Walsh. 2010-05-03 09:49:33 -04:00
Chris PeBenito
98ac98623c Dbus patch from Dan Walsh. 2010-05-03 09:34:42 -04:00
Chris PeBenito
61738f11ec Devicekit patch from Dan Walsh. 2010-05-03 09:01:46 -04:00
Chris PeBenito
857d37e84a GPG patch from Dan Walsh. 2010-04-30 15:24:19 -04:00
Chris PeBenito
3b72786090 Add trusted object condition to unix socket connectto/sendto, to fix label translation. 2010-04-29 11:29:39 -04:00
Chris PeBenito
87a9469fc9 Add networking rules for spamd to connect to mysql/postgresql over the network, from Chris St. Pierre. 2010-04-27 10:31:47 -04:00
Chris PeBenito
45696ab282 Add missing secmark rules in ntop, from Dominick Grift. 2010-04-27 09:31:30 -04:00
Chris PeBenito
a53c6c65a4 FTP patch from Dan Walsh. 2010-04-26 15:15:23 -04:00
Chris PeBenito
d7ebbd9d22 Module version bump for 34838aa. 2010-04-26 13:40:21 -04:00
Jeremy Solt
34838aa62a Samba patch from Dan Walsh 
- signal interfaces
 - fusefs support
 - bug 566984: getattrs on all blk and chr files

Did not include:
 - changes related to samba_unconfined_script_t and samba_unconfined_net_t
 - samba_helper_template (didn't appear to be used)
 - manage_lnk_files_pattern in samba_manage_var_files
 - signal allow rule in samba_domtrans_winbind_helper
 - samba_role_notrans
 - userdom_manage_user_home_content

Some style and spacing fixes
 2010-04-26 13:28:21 -04:00
Chris Richards
9b3e798ea3 bootmisc init script, 2nd try 
Allow to create /var/lock/.keep.  This prevents Portage from destroying /var/lock under certain conditions.  This patch is Gentoo specific.

Signed-off-by: Chris Richards <gizmo@giz-works.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
 2010-04-26 12:59:12 -04:00
Chris PeBenito
05a2e3e2d7 Lircd patch from Dan Walsh. 2010-04-26 12:59:02 -04:00
Chris PeBenito
e07fbc004d Add DenyHosts from Dan Walsh. 2010-04-26 12:59:02 -04:00
Chris PeBenito
44b3808ba5 Djbdns patch from Dan Walsh. 2010-04-26 12:59:02 -04:00
Chris PeBenito
4a8bd017aa Module version bump and extra comments for 194d61f. 2010-04-24 08:10:43 -04:00
Chris Richards
194d61fd3c modutils patch for update-modules 
update-modules on Gentoo throws errors when run because it sources /etc/init.d/functions.sh, which always scans /var/lib/init.d to set SOFTLEVEL environment var.  This is never used by update-modules.

Signed-off-by: Chris Richards <gizmo@giz-works.com>
Signed-off-by: Chris PeBenito <pebenito@gentoo.org>
 2010-04-24 08:08:15 -04:00
Chris PeBenito
78352db924 Module version bump for 8c38fba. 2010-04-24 08:07:51 -04:00
Chris Richards
8c38fba0f0 allow syslog-ng to setrlimit 
syslog-ng wants to increase the number of permissible open files from 256 to 4096 on unix/linux systems.

Signed-off-by: Chris Richards <gizmo@giz-works.com>
Signed-off-by: Chris PeBenito <pebenito@gentoo.org>
 2010-04-24 08:02:23 -04:00
Chris PeBenito
5c3274d7bf Module version bump for 4b121a5. 2010-04-19 10:23:11 -04:00
Chris PeBenito
46879922d8 Additional whitespace fix in nis. 2010-04-19 10:20:19 -04:00
Jeremy Solt
f49fc19e5a Style changes 2010-04-19 10:19:46 -04:00
Jeremy Solt
4b121a5f53 nis patch from Dan Walsh 
Made a couple style changes.
Removed unnecessary require in nis_use_ypbind interface
 2010-04-19 10:19:44 -04:00
Chris PeBenito
da5940411c Additional whitespace fixes in certmonger. 2010-04-19 10:17:24 -04:00
Jeremy Solt
0e5494a3d9 Fix some whitespace and style issues. 2010-04-19 10:07:20 -04:00
Jeremy Solt
33793ec2ce certmonger policy from Dan Walsh 
Removed manage_var_run and manage_var_lib interfaces
Added missing requires to admin interface
Removed permissive line
Fixed some spacing / style issues
 2010-04-19 10:07:17 -04:00
Chris PeBenito
86ff008754 Module version bump for 4f7b413. 2010-04-19 10:05:22 -04:00
Jeremy Solt
e6e2a769ac Remove excess white space from ntop.te 
Move ntop ports declaration to correct location.
 2010-04-19 09:55:01 -04:00
Jeremy Solt
4f7b413cdc Ntop policy from Dan Walsh 
Added alias for ntop_http_content_t in apache
Pulled in ntop port from corenetwork patch
 2010-04-19 09:54:58 -04:00
Chris PeBenito
98759716fe Module version bump for 46e16a2. 2010-04-19 09:54:13 -04:00
Jeremy Solt
d86d4f6069 Move optional policy to correct location for style 2010-04-19 09:50:42 -04:00
Jeremy Solt
01bfe1d20e kerberos patch from Dan Walsh 2010-04-19 09:50:39 -04:00
Chris PeBenito
46e16a2d2a Use port range notation in corenetwork where it makes sense. 2010-04-13 11:55:04 -04:00
Chris PeBenito
3829eecb12 Clean up output of generated corenetwork.te. 2010-04-13 11:52:09 -04:00
Chris PeBenito
85e71c86da Fix network_port() in corenetwork to correctly handle port ranges. 2010-04-13 11:06:02 -04:00
KaiGai Kohei
ec8d32c8e9 [BUGFIX] lack of type transition on dbadm domain (Re: dbadm.pp is not available in selinux-policy package) 
I found out a bug when we initialize the database with dbadm_r:dbadm_t
which belongs to sepgsql_admin_type attribute.

In the case when sepgsql_admin_type create a new database objects,
it does not have valid type_transition rules. So, it was failed.
Sorry, I didn't find out it for a long time.

And db_procedure:{execute} on the sepgsql_proc_exec_t might be necessary
for the administrative domain independently from sepgsql_unconfined_dbadm,
because we need to execute some of system defined procedures to look up
system tables.
 2010-04-12 10:37:21 -04:00
Chris PeBenito
23ad802a9d Module version bump for 5d3214f and 795b733. 2010-04-12 10:01:39 -04:00
Jeremy Solt
795b733a71 pcscd patch from Dan Walsh: manage pub files and fifo files 2010-04-12 09:10:37 -04:00
Jeremy Solt
5d3214f5a9 gpsd path from Dan Walsh 2010-04-12 09:07:50 -04:00
Chris PeBenito
e399e3abea Add devtmpfs labeling. 2010-04-07 08:55:33 -04:00
Dominick Grift
91b12ad94c Move kernel_request_load_module(gssd_t) to the proper place. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-04-06 15:05:22 -04:00
Dominick Grift
6d9925c872 Fix requires for apache tmp interfaces. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-04-06 15:05:12 -04:00
Chris PeBenito
b577852a98 Portreserve patch from Dan Walsh. 2010-04-05 14:50:23 -04:00
Chris PeBenito
38db49c545 PPP patch from Dan Walsh. 2010-04-05 14:38:30 -04:00
Chris PeBenito
372acd0037 Rpc patch from Dan Walsh. 2010-04-05 14:26:21 -04:00
Chris PeBenito
20fa703294 Whitespace fixes on Apache. 2010-04-05 14:05:05 -04:00
Chris PeBenito
da0608ba38 Module version bump for 170a46d, f8b3b7f, and a49a82c. 2010-04-05 13:49:00 -04:00
Chris PeBenito
b7d3db1860 Tweak for 170a46d. 2010-04-05 13:48:01 -04:00
Jeremy Solt
a49a82c295 snort patch from Dan Walsh 
Didn't rearrange all the kernel calls, but did add the kernel_request_load_module.
Didn't include the usbmod (doesn't exist in refpolicy at this time).
Included the generic usb device permissions because snort uses libpcap, which can also be used to monitor USB traffic, so this may be a side effect.
From the red hat bug (559861), it sounds as though snort was failing without these permissions, so it doesn't look like a dontaudit would work.
 2010-04-05 13:46:11 -04:00
Jeremy Solt
f8b3b7fa48 Nut policy from Dan Walsh 
Dropped optional policy for shutdown_domtrans
Dropped commented can_exec line
 2010-04-05 13:45:31 -04:00
Jeremy Solt
170a46d6c5 memcached patch from Dan Walsh 
Moved term_dontaudits up for style
 2010-04-05 13:43:58 -04:00
Chris PeBenito
60def66b13 Second part of Apache patch from Dan Walsh. 2010-04-05 10:57:52 -04:00
Chris PeBenito
83caba3eb9 First part of apache patch from Dan Walsh: file context changes, including renaming script ro/ra/rw files. 2010-04-01 08:17:50 -04:00
Chris PeBenito
25d81d2655 Tor patch from Dan Walsh. 2010-03-29 14:30:52 -04:00
Chris PeBenito
2b93b88584 Sssd patch from Dan Walsh. 2010-03-29 14:08:52 -04:00
Chris PeBenito
ee2d2dda24 Add usbmuxd from Dan Walsh. 2010-03-29 13:29:18 -04:00
Chris PeBenito
6d4dbd20ae Vhostmd from Dan Walsh. 2010-03-29 11:25:06 -04:00
Chris PeBenito
bf54d5be44 Module version bumps for c586c1b, dcbb332, 4c05dff, 84ce9c3, 2b012ba, and 1868383. 2010-03-29 09:21:59 -04:00
Chris PeBenito
ad0071bbe4 Tweaks on pulseaudio 1868383, ksmtuned d279dd6, and smokeping f3c346c. 2010-03-29 09:19:40 -04:00
Jeremy Solt
f3c346cc07 Smokeping policy from Dan Walsh 
Made some style / spacing changes
Did not include read access to /etc/shadow
Removed manage_var_run and manage_var_lib interfaces
Removed permissive line
 2010-03-29 08:46:30 -04:00
Jeremy Solt
18683835fd pulseaudio patch from Dan Walsh 
Fixed template where it should have been interface
Replaced read_home and manage_home interfaces with read_home_files, manage_home_files and reduced access
Removed admin_dir reference
Replaced rtkit_daemon_system_domain with rtkit_scheduled
Fixed style / spacing issues
 2010-03-29 08:41:45 -04:00
Jeremy Solt
d279dd603f ksmtuned policy from Dan Walsh 
Couple style/space fixes.
Used ps_process_pattern in admin interface
 2010-03-29 08:36:53 -04:00
Jeremy Solt
2b012bacb6 Prelude patch from Dan Walsh 2010-03-29 08:36:15 -04:00
Jeremy Solt
84ce9c3333 Bluetooth patch (sys_admin and debugfs) from Dan Walsh 
Added comments to reference redhat bugs
 2010-03-29 08:36:05 -04:00
Jeremy Solt
4c05dff3d1 avahi patch from Dan Walsh 
Didn't include the file read in the dbus_chat interface.
 2010-03-29 08:36:00 -04:00
Jeremy Solt
dcbb332992 chronyd patch from Dan Walsh 
Fixed a couple style/spacing issues.
Added files_search_etc for chronyd_keys file
 2010-03-29 08:35:52 -04:00
Jeremy Solt
c586c1bfa6 Give dcc setgid from Dan Walsh 2010-03-29 08:35:34 -04:00
Chris PeBenito
7656af7a6f Module version bump for c37d843. 2010-03-23 08:07:19 -04:00
Chris PeBenito
be8311279e Minor bind XML tweaks. 2010-03-23 08:05:00 -04:00
Jeremy Solt
c37d843fa1 bind patch from Dan Walsh 
some fixes in interfaces, added bind_setattr_zone_dirs interface
sysnet_read_config not needed with auth_use_nsswitch

Did not include init_read_script_tmp_files for named_t
 2010-03-23 08:01:05 -04:00
Chris PeBenito
390b8a821b Radvd patch from Dan Walsh. 2010-03-22 15:19:50 -04:00
Chris PeBenito
1b22152c2c Rdisc patch from Dan Walsh. 2010-03-22 15:09:27 -04:00
Chris PeBenito
6c40309ef1 Module version bump for 1d348bd. 2010-03-22 13:53:24 -04:00
Jeremy Solt
1d348bd253 Afs needs sys_admin, sends signals, and resolves hostnames from Dan Walsh 2010-03-22 13:52:19 -04:00
Chris PeBenito
df29613c72 Module version bump for 75c8a69. 2010-03-22 13:51:35 -04:00
Jeremy Solt
75c8a691ee gitosis read/manage lib interfaces from Dan Walsh 
Only giving manage_files_pattern for gitosis_manage_lib_files
 2010-03-22 13:48:39 -04:00
Chris PeBenito
cf7eb082d2 Sasl patch from Dan Walsh. 2010-03-22 11:22:25 -04:00
Chris PeBenito
449d2069ac Snmp patch from Dan Walsh. 2010-03-22 11:08:31 -04:00
Chris PeBenito
08d7c7339b Sysstat patch from Dan Walsh. 2010-03-22 10:47:41 -04:00
Chris PeBenito
98ac3f5ace Telnet patch from Dan Walsh. 2010-03-22 10:40:37 -04:00
Chris PeBenito
461b53e028 Tuned patch from Dan Walsh. 2010-03-22 10:33:31 -04:00
Chris PeBenito
7630200e1b Virt patch from Dan Walsh. 2010-03-22 10:24:34 -04:00
Chris PeBenito
064d1b469e Rename rtkit_schedule() to rtkit_scheduled(). 2010-03-22 09:54:58 -04:00
Chris PeBenito
e13a9ef5fe Module version bump for ac19f1a. 2010-03-22 08:59:04 -04:00
Chris PeBenito
c7a4cf3179 Module version bump for 9681df1. 2010-03-22 08:58:41 -04:00
Chris PeBenito
32103f250f Module version bump for d3b5907. 2010-03-22 08:58:20 -04:00
Chris PeBenito
340af119b0 Minor tweaks on icecast. 2010-03-22 08:56:32 -04:00
Jeremy Solt
584dfaca45 icecast policy from Dan Walsh 
Fixed some style and spacing issues
Replace manage_var_run interface with manage_pid_files with fewer permissions
Replaced rkit_daemon_system_domain with rtkit_schedule
 2010-03-22 08:49:54 -04:00
Jeremy Solt
ac19f1ac26 rtkit patch from Dan Walsh: 
rtkit_daemon_system_domain interface allows domains to say rtkit can setsched on their process.
Needs sys_nice capability
Needs to getsched on all domains.
Fix bug in te file

Me:
changed interface name from rtkit_daemon_system_domain to rtkit_schedule
Already had sys_nice capability
 2010-03-22 08:41:42 -04:00
Jeremy Solt
9681df1c8d postgresql patch from Dan Walsh: 
"File context for /etc/sysconfig/pgsql and other bugs.
Sends audit messages connect to posgresql_server port
Reads its own process info"

Moved signal interface for style.
 2010-03-22 08:39:15 -04:00
Jeremy Solt
d3b5907ea4 openvpn needs ipc_lock capability, connects to http ports, 
and manages net_conf_t files - from Dan Walsh
 2010-03-22 08:36:47 -04:00
Chris PeBenito
47293bd8d6 Tftp patch from Dan Walsh. 2010-03-19 15:56:14 -04:00
Chris PeBenito
788ba75491 Uucp patch from Dan Walsh. 2010-03-19 15:49:12 -04:00
Chris PeBenito
bed0a44560 Zebra patch from Dan Walsh. 2010-03-19 15:45:25 -04:00
Chris PeBenito
bc31d12725 Libraries patch from Dan Walsh. 2010-03-19 14:21:23 -04:00
Chris PeBenito
0d86ea1d7b Xen patch from Dan Walsh. 2010-03-19 11:54:50 -04:00
Chris PeBenito
b60df9f57d Getty patch from Dan Walsh. 2010-03-19 11:05:56 -04:00
Chris PeBenito
1fa92b8a55 Sysnetwork patch from Dan Walsh. 2010-03-18 15:40:04 -04:00
Chris PeBenito
ddd786e404 Init patch from Dan Walsh. 2010-03-18 10:19:49 -04:00
Chris PeBenito
153ed8751a Authlogin patch from Dan Walsh. 2010-03-18 08:59:25 -04:00
Chris PeBenito
4fbcd778de Iptables patch from Dan Walsh. 2010-03-18 08:10:21 -04:00
Chris PeBenito
a124c0a81f Udev patch from Dan Walsh. 2010-03-17 15:17:48 -04:00
Chris PeBenito
7a8807b627 Logging patch from Dan Walsh. 2010-03-17 14:40:06 -04:00
Chris PeBenito
90e65feca5 Ipsec patch from Dan Walsh. 2010-03-17 13:52:07 -04:00
Chris PeBenito
d13c6758a4 Modutils patch from Dan Walsh. 2010-03-17 11:59:14 -04:00
Chris PeBenito
0417386142 Kernel patch from Dan Walsh. 2010-03-17 11:16:25 -04:00
Chris PeBenito
1f6d975502 Domain patch from Dan Walsh. 2010-03-17 10:02:07 -04:00
Chris PeBenito
7b50b7053d Module version bump for 6a03548. 2010-03-17 09:42:46 -04:00
Jeremy Solt
6a035482dc amavis uses uptime which reads utmp, and reads certs - from Dan Walsh 2010-03-17 09:41:18 -04:00
Chris PeBenito
827060cb04 Style fixes and module version bumps for 38fc1bd. 2010-03-17 09:28:18 -04:00
Dominick Grift
38fc1bd180 Likewise policy. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-03-17 08:48:45 -04:00
Chris PeBenito
2a62db7883 Module version bump for 414a570. 2010-03-16 15:28:36 -04:00
Jeremy Solt
414a5704df fetchmail executes programs in bin (uname), from Dan Walsh 2010-03-16 15:27:40 -04:00
Chris PeBenito
e8871c2092 Add additional documentation to kernel_request_load_module(). 2010-03-16 15:08:00 -04:00
Chris PeBenito
5911f3dbca Module version bump for 935151a. 2010-03-16 14:35:09 -04:00
Chris PeBenito
c6491af860 Module version bump for d12f18e. 2010-03-16 14:34:50 -04:00
Chris PeBenito
9a59893e5a Module version bump for d7ec247. 2010-03-16 14:34:23 -04:00
Chris PeBenito
9570fc108e Module version bump for 591af7b. 2010-03-16 14:34:05 -04:00
Chris PeBenito
ce693cbbec Module version bump for ae07c9e. 2010-03-16 14:33:43 -04:00
Chris PeBenito
1656bf730f Whitespace fixes in mailman. 2010-03-16 13:51:51 -04:00
Jeremy Solt
935151afcd Change kernel_load_module to kernel_request_load_module for howl from Dan Walsh 2010-03-16 13:44:55 -04:00
Jeremy Solt
d12f18e452 Change kernel_load_module to kernel_request_load_module from Dan Walsh 2010-03-16 13:44:52 -04:00
Jeremy Solt
d7ec24785b File context update for certmaster from Dan Walsh 2010-03-16 13:44:50 -04:00
Jeremy Solt
591af7be0c file context updates from Dan Walsh 2010-03-16 13:44:48 -04:00
Jeremy Solt
ae07c9e2e8 Screen needs to setattr on user_ttydevice_t from Dan Walsh 2010-03-16 13:36:45 -04:00
Chris PeBenito
fad6e761bf Whitespace fix for mcelog. 2010-03-16 13:15:38 -04:00
Chris PeBenito
fce868d074 Module version bump for f7d413a. 2010-03-16 13:15:00 -04:00
Chris PeBenito
bf140fc32c Rearrange interfaces in fail2ban. 2010-03-16 13:14:46 -04:00
Chris PeBenito
580279da88 Module version bump for 74b51e6. 2010-03-16 13:12:22 -04:00
Chris PeBenito
6bc64c4be7 Whitespace fixes for smoltclient. 2010-03-16 13:11:53 -04:00
Chris PeBenito
ba1c45337b Module version bump for 3137148. 2010-03-16 13:10:14 -04:00
Jeremy Solt
1484157201 mcelog policy from Dan Walsh 
Me: Removed permissive line, and fixed a couple style issues
 2010-03-16 11:47:07 -04:00
Jeremy Solt
f7d413af27 fail2ban_stream_connect and fail2ban_rw_stream_sockets from Dan Walsh 
Did not include dontaudit_leaks interface
Modified fail2ban_rw_stream_sockets to use rw_stream_socket_perms set
 2010-03-16 11:44:35 -04:00
Jeremy Solt
74b51e6db2 Firstboot sends dbus messages from Dan Walsh 
Not including the noaudit for the unconfined domain
Corrected tabbing for nested optional policy
 2010-03-16 11:43:36 -04:00
Jeremy Solt
257a2788cd Policy for smolt sendProfile client from Dan Walsh 2010-03-16 11:37:56 -04:00
Jeremy Solt
31371480b0 Run interface for ptchown from Dan Walsh 2010-03-16 11:34:58 -04:00
Chris PeBenito
37e2499ed1 Module version bump for 1d3d00b. 2010-03-12 11:43:09 -05:00
Chris PeBenito
ce0570dc6d Module version bump for e172614. 2010-03-12 11:42:28 -05:00
Chris PeBenito
7af0e9bc95 Filesystem patch from Dan Walsh. 2010-03-12 11:40:59 -05:00
Chris PeBenito
9e506eb236 Rearrange lines in alsa an mysql. 2010-03-12 08:59:23 -05:00
Chris PeBenito
e172614b57 Whitespace cleanup on mysql.if. 2010-03-12 08:55:34 -05:00
Jeremy Solt
1d3d00b279 Manage alsa writable config files interface from Dan Walsh 
Moved term_dontaudit_use_console for style.
 2010-03-12 08:54:29 -05:00
Jeremy Solt
12a6a53f63 mysql policy from Dan Walsh 
My changes to patch:
A couple changes to match style.
Removed files_dontaudit_search_all_mountpoints(mysqld_safe_t), it doesn't exist in refpolicy
 2010-03-12 08:54:29 -05:00
Chris PeBenito
2f0e3a4e7e Raid patch from Dan Walsh. 2010-03-09 15:33:29 -05:00
Chris PeBenito
30496b1575 Iscsi and tgtd patches from Dan Walsh. 2010-03-09 15:17:16 -05:00
Chris PeBenito
939eaf2f13 Fstools patch from Dan Walsh. 2010-03-09 14:32:17 -05:00
Chris PeBenito
d0a6df5c47 Miscfiles patch from Dan Walsh. 2010-03-09 10:44:55 -05:00