Chris PeBenito
5be35f2acd
tmpreaper patch from dan.
2009-07-27 09:11:38 -04:00
Chris PeBenito
06625d302c
mozilla patch from dan.
2009-07-27 09:11:12 -04:00
Chris PeBenito
f4962ab15b
add cpufreqselector from dan
2009-07-27 09:09:00 -04:00
Chris PeBenito
09516cb4be
remove read_default_t tunable
2009-07-23 08:58:35 -04:00
Chris PeBenito
5bb5ec1d40
podsleuth patch from dan.
2009-07-21 10:11:16 -04:00
Chris PeBenito
13306f56b6
afs client patch from dan.
2009-07-21 10:11:03 -04:00
Chris PeBenito
b93a7dacca
bluetooth patch from dan.
2009-07-21 10:10:47 -04:00
Chris PeBenito
ad0aea536b
clamav patch from dan.
2009-07-21 10:10:31 -04:00
Chris PeBenito
92f08c7130
mailman patch from dan.
2009-07-21 10:10:17 -04:00
Chris PeBenito
1847443ea3
ricci patch from dan.
2009-07-21 10:10:00 -04:00
Chris PeBenito
d8822462c4
fix policykit interface
2009-07-21 10:09:14 -04:00
Chris PeBenito
e4f73afb8e
gpg patch from dan
2009-07-21 10:07:38 -04:00
Chris PeBenito
5271dd30bc
module version bump for 9b1907b217
2009-07-21 10:07:10 -04:00
Chris PeBenito
9b1907b217
add pulseaudio from dan.
2009-07-21 10:05:38 -04:00
Chris PeBenito
7395f80119
ppp patch from dan
2009-07-20 15:41:19 -04:00
Chris PeBenito
4aa075262a
kerberos patch from dan
2009-07-20 15:41:08 -04:00
Chris PeBenito
8f17f7c2ee
dnsmasq patch from dan.
2009-07-20 15:40:57 -04:00
Chris PeBenito
93d300831d
dhcp patch from dan
2009-07-20 15:40:41 -04:00
Chris PeBenito
af5374d3a5
policykit.if whitespace fix
2009-07-20 11:37:22 -04:00
Chris PeBenito
adea587572
4 patches from dan.
2009-07-20 11:34:46 -04:00
Chris PeBenito
edb7b90d89
add kismet and pulseaudio ports. fix sorting of ports.
2009-07-20 11:17:31 -04:00
Chris PeBenito
9e90ce33db
add policykit from dan.
2009-07-20 11:15:09 -04:00
Chris PeBenito
b67201eae7
fix bad varnishd interface names
2009-07-20 09:44:25 -04:00
Chris PeBenito
7694abdff7
module version bump for f2583aa83b
2009-07-15 09:30:08 -04:00
Manoj Srivastava
f2583aa83b
Remove duplicate distro_redhat context
...
A recent update added an generic context for the lock files, so the
entry in distro_redhat can be removed.
Signed-off-by: Manoj Srivastava <srivasta@debian.org>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
2009-07-15 09:27:36 -04:00
Chris PeBenito
ce6fee6575
5 patches from dan
2009-07-14 10:30:22 -04:00
Chris PeBenito
10b03f376b
three debian patches from manoj
2009-07-14 09:05:59 -04:00
Chris PeBenito
84d88df579
trunk: fix typo in guest role decl.
2009-07-08 15:23:29 +00:00
Chris PeBenito
9ac9739087
trunk: update policycaps comments for sock_file open perm.
2009-07-01 13:34:54 +00:00
Chris PeBenito
bb88161284
trunk: 3 patches from dan.
2009-06-30 19:27:21 +00:00
Chris PeBenito
45b975db5b
trunk: add missing varnish port.
2009-06-30 17:48:15 +00:00
Chris PeBenito
50824a99ca
trunk: pads from dan.
2009-06-30 15:03:20 +00:00
Chris PeBenito
46e2fa6d39
trunk: prelude patch from dan.
2009-06-30 14:44:50 +00:00
Chris PeBenito
267d9c60c5
trunk: varnishd from dan.
2009-06-30 13:49:53 +00:00
Chris PeBenito
3f67f722bb
trunk: whitespace fixes
2009-06-26 14:40:13 +00:00
Chris PeBenito
20272c2b27
trunk: 7 patches from dan.
2009-06-26 13:22:39 +00:00
Chris PeBenito
c989807d4a
trunk: nis patch from dan.
2009-06-25 15:16:29 +00:00
Chris PeBenito
c017ee17ab
trunk: add sssd from dan.
2009-06-22 15:33:21 +00:00
Chris PeBenito
26410ddf54
trunk: remove unnecessary semicolons after interface/template calls.
2009-06-19 13:52:33 +00:00
Chris PeBenito
c9c0d846de
trunk: Greylist milter from Paul Howarth.
2009-06-18 14:36:35 +00:00
Chris PeBenito
c7dc1c7222
trunk: Allow unix_update to change the security attributes associate with files so
...
that it can properly create the shadow file. Also allow it to read from
urandom so that it can add salt to the password hash.
2009-06-18 13:57:26 +00:00
Chris PeBenito
df28a0c444
trunk: Misc fixes for unix_update from Brandon Whalen.
2009-06-18 13:36:40 +00:00
Chris PeBenito
95ea7d6986
trunk: Add x_device permissions for XI2 functions, from Eamon Walsh.
2009-06-18 13:07:23 +00:00
Chris PeBenito
45515556d4
trunk: 10 patches from dan.
2009-06-12 19:44:10 +00:00
Chris PeBenito
30425aa876
trunk: 1 patch from dan.
2009-06-12 15:30:15 +00:00
Chris PeBenito
a65fd90a50
trunk: 6 patches from dan.
2009-06-11 15:00:48 +00:00
Chris PeBenito
731008ad85
trunk: 2 patches from dan.
2009-06-08 17:18:26 +00:00
Chris PeBenito
16fd1fd814
trunk: MLS constraints for the x_selection class, from Eamon Walsh.
2009-06-05 13:36:19 +00:00
Chris PeBenito
cca4a215fe
trunk: add gpsd from miroslav grepl
2009-06-02 14:28:40 +00:00
Chris PeBenito
63f0a71c8a
trunk: 9 patches from dan.
2009-06-01 16:03:42 +00:00
Chris PeBenito
22894e33c4
trunk: add libjackserver.so textrel fc.
2009-06-01 13:04:40 +00:00
Chris PeBenito
996779dfad
trunk:
...
The attached patch allows unprivileged clients to export from or import
to the largeobject owned by themselves.
The current security policy does not allow them to import/export any
largeobjects without any clear reason.
NOTE: Export of the largeobject means that it dumps whole of the
largeobject into a local file, so SE-PostgreSQL checks both of
db_blob:{read export} on the largeobject and file:{write} on the
local file. Import is a reversal behavior.
KaiGai Kohei
2009-05-22 13:37:32 +00:00
Chris PeBenito
e0ea7b15ca
trunk:
...
The attached patch fixes incorrect behavior in sepgsql_enable_users_ddl.
The current policy allows users/unprivs to run ALTER TABLE statement
unconditionally, because db_table/db_column:{setattr} is allowed outside
of the boolean. It should be moved to conditional section.
In addition, they are also allowed to db_procedure:{create drop setattr}
for xxxx_sepgsql_proc_exec_t, but it means we allows them to create, drop
or alter definition of the functions unconditionally. So, it also should
be moved to conditional section.
The postgresql.te allows sepgsql_client_type to modify sepgsql_table_t
and sepgsql_sysobj_t when sepgsql_enable_users_ddl is enabled, but
it should not be allowed.
KaiGai Kohei
2009-05-21 11:49:33 +00:00
Chris PeBenito
a01a4a7183
trunk:
...
OK, the attached patch adds the following types for unprivileged clients.
- unpriv_sepgsql_table_t
- unpriv_sepgsql_sysobj_t
- unpriv_sepgsql_proc_exec_t
- unpriv_sepgsql_blob_t
These types are the default for unprivileged and unprefixed domains,
such as httpd_t and others.
In addition, TYPE_TRANSITION rules are moved to outside of tunable
of the sepgsql_enable_users_ddl. IIRC, it was enclosed within the
tunable because UBAC domains (user_t and so on) were allowed to
create sepgsql_table_t, and its default was pointed to this type
when sepgsql_enable_users_ddl is disabled.
However, it has different meanings now, so the TYPE_TRANSITION rules
should be unconditional.
KaiGai Kohei
2009-05-21 11:28:14 +00:00
Chris PeBenito
80348b73a0
trunk: 4 patches from dan.
2009-05-14 14:41:50 +00:00
Chris PeBenito
a47eb527e5
trunk: whitespace fix for squid.fc.
2009-05-11 12:07:07 +00:00
Chris PeBenito
350ed89156
se-postgresql update from kaigai
...
- rework: Add a comment of "deprecated" for deprecated permissions.
- bugfix: MCS policy did not constrain the following permissions.
db_database:{getattr}
db_table:{getattr lock}
db_column:{getattr}
db_procedure:{drop getattr setattr}
db_blob:{getattr import export}
- rework: db_table:{lock} is moved to reader side, because it makes
impossible to refer read-only table with foreign-key constraint.
(FK checks internally acquire explicit locks.)
- bugfix: some of permissions in db_procedure class are allowed
on sepgsql_trusted_proc_t, but it is a domain, not a procedure.
It should allow them on sepgsql_trusted_proc_exec_t.
I also aliased sepgsql_proc_t as sepgsql_proc_exec_t to avoid
such kind of confusion, as Chris suggested before.
- rework: we should not allow db_procedure:{install} on the
sepgsql_trusted_proc_exec_t, because of a risk to invoke trusted
procedure implicitly.
- bugfix: MLS policy dealt db_blob:{export} as writer-side permission,
but it is required whrn the largeobject is refered.
- bugfix: MLS policy didn't constrain the db_procedure class.
2009-05-07 12:35:32 +00:00
Chris PeBenito
da3ed0667f
trunk: lircd from miroslav grepl
2009-05-06 15:09:46 +00:00
Chris PeBenito
c0f5fa011a
trunk: whitespace fixes.
2009-05-06 14:44:57 +00:00
Chris PeBenito
3392356f36
trunk: 5 patches from dan.
2009-05-06 14:26:20 +00:00
Chris PeBenito
0cf1d56018
trunk: Milter state directory patch from Paul Howarth.
2009-04-21 20:40:45 +00:00
Chris PeBenito
a5ef553c2d
trunk: 5 modules from dan.
2009-04-20 19:03:15 +00:00
Chris PeBenito
153fe24bdc
trunk: 5 patches from dan.
2009-04-07 14:09:43 +00:00
Chris PeBenito
09125ae411
trunk: module version bump for previous commit.
2009-04-03 14:15:53 +00:00
Chris PeBenito
d6605bc48b
trunk: 3 patches from dan.
2009-04-03 14:14:43 +00:00
Chris PeBenito
42d567c3f4
trunk: 6 patches from dan.
2009-03-31 13:40:59 +00:00
Chris PeBenito
8f800d48df
trunk: 14 patches from dan.
2009-03-23 14:56:43 +00:00
Chris PeBenito
244b45d225
trunk: 3 patches from dan.
2009-03-20 13:58:15 +00:00
Chris PeBenito
3c9b2e9bc6
trunk: 6 patches from dan.
2009-03-19 17:56:10 +00:00
Chris PeBenito
d3cdc3d07c
trunk: add open perm to sock_file.
2009-03-11 14:58:03 +00:00
Chris PeBenito
79a5a8084d
trunk: 2 patches from dan.
2009-03-11 14:19:50 +00:00
Chris PeBenito
c90440a7cd
trunk: 4 patches from dan.
2009-03-11 13:32:23 +00:00
Chris PeBenito
e21bd28bc8
trunk: add mysql db lnk_file transition.
2009-03-11 11:59:04 +00:00
Chris PeBenito
da04234f32
trunk: 5 patches from dan.
2009-03-10 19:32:04 +00:00
Chris PeBenito
11c944faf1
trunk: fix typo in devices file contexts.
2009-03-05 17:46:22 +00:00
Chris PeBenito
2c664e7fb8
trunk: storage patch from dan.
2009-03-05 15:49:41 +00:00
Chris PeBenito
7b76207e37
trunk: devices patch from dan.
2009-03-05 15:36:41 +00:00
Chris PeBenito
be5aaebfd6
trunk: corecommands patch from dan.
2009-03-05 14:43:03 +00:00
Chris PeBenito
b4ad699e57
trunk: add nlmsg_tty_audit permission.
2009-03-05 14:11:24 +00:00
Chris PeBenito
c45fdad85b
trunk: filesystem patch from dan.
2009-03-04 15:53:07 +00:00
Chris PeBenito
e1a70f1dde
trunk: add MLS constrains for ingress/egress permissions from Paul Moore.
...
Add MLS constraints for several network related access controls including
the new ingress/egress controls and the older Secmark controls. Based on
the following post to the SELinux Reference Policy mailing list:
* http://oss.tresys.com/pipermail/refpolicy/2009-February/000579.html
2009-03-02 15:16:49 +00:00
Chris PeBenito
156204a385
trunk: Drop write permission from fs_read_rpc_sockets().
2009-02-24 20:00:15 +00:00
Chris PeBenito
81fa19ed73
trunk: remove unused udev_runtime_t type.
2009-02-24 19:31:08 +00:00
Chris PeBenito
f3fcadfe04
trunk: Patch for RadSec port from Glen Turner.
2009-02-23 13:41:28 +00:00
Chris PeBenito
f79314234a
trunk: 6 patches from dan.
2009-02-11 19:28:30 +00:00
Chris PeBenito
c1e501136b
trunk: add context contains to setrans.
2009-02-09 13:58:22 +00:00
Chris PeBenito
7722c29e88
trunk: Enable network_peer_controls policy capability from Paul Moore.
2009-02-03 15:45:30 +00:00
Chris PeBenito
805f34ed09
trunk: btrfs from Paul Moore.
2009-01-30 13:44:14 +00:00
Chris PeBenito
466e22a8ba
trunk: Add db_procedure install permission from KaiGai Kohei.
2009-01-23 19:49:36 +00:00
Chris PeBenito
019dfaf9dc
trunk: Add support for network interfaces with access controlled by a Boolean from the CLIP project.
2009-01-15 20:31:06 +00:00
Chris PeBenito
64daa85393
trunk: add sysadm_entry_spec_domtrans_to() interface from clip.
2009-01-15 15:07:37 +00:00
Chris PeBenito
9e7a338509
trunk: su fixes from clip.
2009-01-13 19:44:23 +00:00
Chris PeBenito
f0435b1ac4
trunk: add support for labeled booleans.
2009-01-13 13:01:48 +00:00
Chris PeBenito
c1262146e0
trunk: Remove node definitions and change node usage to generic nodes.
2009-01-09 19:48:02 +00:00
Chris PeBenito
668b3093ff
trunk: change network interface access from all to generic network interfaces.
2009-01-06 20:24:10 +00:00
Chris PeBenito
59d599642e
trunk: fix certwatch version number.
2009-01-06 19:33:24 +00:00
Chris PeBenito
347a701119
trunk: Add kernel_service access vectors, from Stephen Smalley.
2009-01-05 21:44:33 +00:00
Chris PeBenito
17ec8c1f84
trunk: bump module versions for release.
2008-12-10 19:38:10 +00:00
Chris PeBenito
3196971ae8
trunk: Fix consistency of audioentropy and iscsi module naming.
2008-12-09 16:47:33 +00:00
Chris PeBenito
9ff89c44e7
trunk: 2 patches from dan.
2008-12-04 15:01:12 +00:00
Chris PeBenito
f657cb14e5
trunk: fix role change constraint.
2008-12-03 20:16:08 +00:00
Chris PeBenito
ff8f0a63f4
trunk: whitespace fixes in xml blocks.
2008-12-03 19:16:20 +00:00
Chris PeBenito
6073ea1e13
trunk: whitespace fix changing multiple spaces into tabs.
2008-12-03 18:33:19 +00:00
Chris PeBenito
a057e0462e
trunk: fix missing xml parameter.
2008-12-03 15:51:53 +00:00
Chris PeBenito
fb4826f424
trunk: 3 patches from dan.
2008-12-03 15:21:33 +00:00
Chris PeBenito
14c0edc7e9
trunk: 2 patches from dan.
2008-12-02 22:40:49 +00:00
Chris PeBenito
b3eb124654
trunk: Debian file context fix for xen from Russell Coker.
2008-11-24 15:34:54 +00:00
Chris PeBenito
b9e5238a24
trunk: add milter module from Paul Howarth.
2008-11-24 15:06:58 +00:00
Chris PeBenito
b3b607eb43
trunk: a fix on the previous commit.
2008-11-19 16:02:13 +00:00
Chris PeBenito
fcee22ad0d
trunk: 5 patches from dan.
2008-11-19 15:24:10 +00:00
Chris PeBenito
01e9e7dbf5
trunk: 4 patches from dan.
2008-11-18 19:55:10 +00:00
Chris PeBenito
659c8650c7
trunk 2 patches from dan.
2008-11-17 15:48:12 +00:00
Chris PeBenito
7f49194215
trunk: Xserver MLS fix from Eamon Walsh.
2008-11-17 13:49:19 +00:00
Chris PeBenito
7a4c282536
trunk: fix logging admin interfaces.
2008-11-14 13:53:21 +00:00
Chris PeBenito
23d5ab8de7
trunk: fix disable ubac condition for process perms.
2008-11-14 13:17:51 +00:00
Chris PeBenito
73c77e2c9b
trunk: 2 fixes from martin orr.
2008-11-13 18:44:23 +00:00
Chris PeBenito
99282e6be0
trunk: add omapi port for dhcpcd.
2008-11-12 13:11:00 +00:00
Chris PeBenito
5843d066b6
trunk: 10 patches from dan.
2008-11-11 16:38:34 +00:00
Chris PeBenito
27337d8c21
trunk: patch from Mike Edenfield to add udevadm fc entry.
2008-11-11 15:03:06 +00:00
Chris PeBenito
657c226c40
trunk: 7 patches from dan.
2008-11-06 22:36:50 +00:00
Chris PeBenito
ba796982df
trunk: tweaks from russell and martin orr.
2008-11-06 15:01:15 +00:00
Chris PeBenito
0003940ff2
trunk: add missing ubac module.
2008-11-05 16:11:27 +00:00
Chris PeBenito
296273a719
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
Chris PeBenito
932c3536f8
trunk: additional open fixes.
2008-11-04 14:37:05 +00:00
Chris PeBenito
82d2775c92
trunk: more open perm fixes.
2008-10-20 16:10:42 +00:00
Chris PeBenito
6e68e6bb5e
trunk: Move shared library calls from individual modules to the domain module.
2008-10-17 17:36:56 +00:00
Chris PeBenito
2cca6b79b4
trunk: remove redundant shared lib calls.
2008-10-17 17:31:04 +00:00
Chris PeBenito
2a98379a24
trunk: additional whitespace fixes.
2008-10-17 15:52:39 +00:00
Chris PeBenito
88cf0a9c2b
trunk: whitespace fix; collapse multiple blank lines into one.
2008-10-17 15:29:51 +00:00
Chris PeBenito
0b36a2146e
trunk: Enable open permission checks policy capability.
2008-10-16 16:09:20 +00:00
Chris PeBenito
aea3f28e40
trunk: Remove hierarchy from portage module as it is not a good example of hieararchy.
2008-10-15 19:56:33 +00:00
Chris PeBenito
5d4f4b5375
trunk: bump version numbers for release.
2008-10-14 15:46:36 +00:00
Chris PeBenito
74993c4dae
trunk: 8 patches from dan.
2008-10-13 15:06:23 +00:00
Chris PeBenito
aa7c463e5d
trunk: a pile of misc fixes.
2008-10-13 13:36:50 +00:00
Chris PeBenito
06099da657
trunk: 3 patches from dan.
2008-10-09 18:06:24 +00:00
Chris PeBenito
04d2861035
trunk: missing bits from dan's previous round of patches.
2008-10-09 14:01:53 +00:00
Chris PeBenito
967fd1ba3f
trunk: 8 patches from dan.
2008-10-08 20:03:24 +00:00
Chris PeBenito
e87221cefe
trunk: 21 patches from dan.
2008-10-08 15:50:03 +00:00
Chris PeBenito
ed8ae5ebeb
trunk: fix typo
2008-10-06 18:33:44 +00:00
Chris PeBenito
12c61f36f4
trunk: 7 patches from dan, 1 from eamon.
2008-10-06 17:27:49 +00:00
Chris PeBenito
73edbc9101
trunk: add oident from dominick grift.
2008-10-06 14:01:59 +00:00
Chris PeBenito
6d8af27cad
trunk: fix dupe fc.
2008-10-03 13:17:56 +00:00
Chris PeBenito
4bdf192962
trunk: firstboot update from dan.
2008-10-02 17:32:03 +00:00
Chris PeBenito
bf9f3480e5
trunk: readahead fix from dan.
2008-09-23 13:07:28 +00:00
Chris PeBenito
3daef6999a
trunk: cvs update from dan.
2008-09-23 12:56:00 +00:00
Chris PeBenito
4a475507be
trunk: remove stale pax class comments as that class was removed.
2008-09-22 19:06:34 +00:00
Chris PeBenito
88c02e0538
trunk: init script for setrans.
2008-09-18 18:20:31 +00:00
Chris PeBenito
658f4d3dd9
trunk: rpcbind update from dan.
2008-09-18 18:09:34 +00:00
Chris PeBenito
fd49feff49
trunk: last bit of wpa_supplicant update from martin orr.
2008-09-18 15:06:29 +00:00
Chris PeBenito
c9824ec5ce
trunk: remove incomplete sshd_extern.
2008-09-18 14:06:30 +00:00