Commit Graph

4465 Commits

Author SHA1 Message Date
Dan Walsh
c849c84305 - Allow cobblerd to list cobler appache content 2010-10-15 11:35:17 -04:00
Dan Walsh
d33e644851 - Fixup for the latest version of upowed
- Dontaudit sandbox sending SIGNULL to desktop apps
2010-10-15 10:26:39 -04:00
Dan Walsh
618ed7aec9 - Update to upstream 2010-10-13 10:00:44 -04:00
Dan Walsh
5a152bc135 - Update to upstream 2010-10-12 16:47:46 -04:00
Dan Walsh
f0a56ee31d -Mount command from a confined user generates setattr on /etc/mtab file, need to dontaudit this access
- dovecot-auth_t needs ipc_lock
- gpm needs to use the user terminal
- Allow system_mail_t to append ~/dead.letter
- Allow NetworkManager to edit /etc/NetworkManager/NetworkManager.conf
- Add pid file to vnstatd
- Allow mount to communicate with gfs_controld
- Dontaudit hal leaks in setfiles
2010-10-12 16:10:57 -04:00
Dan Walsh
dd20c25744 Rebuild with latest code 2010-10-08 17:00:50 -04:00
Dan Walsh
6f934680a8 - Allow smbd to use sys_admin
- Remove duplicate file context for tcfmgr
- Update to upstream
2010-10-07 14:55:49 -04:00
Dan Walsh
d618232c77 Merge branch 'master' of ssh://git.fedorahosted.org/git/selinux-policy 2010-10-07 14:11:24 -04:00
Dan Walsh
6f256d240d - Allow smbd to use sys_admin
- Remove duplicate file context for tcfmgr
2010-10-07 09:59:45 -04:00
Dan Walsh
3853925449 Remove duplicate filecontext for tcfmgr 2010-10-07 09:57:49 -04:00
Dan Walsh
b3e7610270 Allow smbd_t sys_admin capability so samba can change quota on users. 2010-10-07 09:31:35 -04:00
Dan Walsh
0daa8b731a - Fix fusefs handling
- Do not allow sandbox to manage nsplugin_rw_t
- Allow mozilla_plugin_t to connecto its parent
- Allow init_t to connect to plymouthd running as kernel_t
- Add mediawiki policy
- dontaudit sandbox sending signals to itself.  This can happen when they are running at different mcs.
- Disable transition from dbus_session_domain to telepathy for F14
- Allow boinc_project to use shm
- Allow certmonger to search through directories that contain certs
- Allow fail2ban the DAC Override so it can read log files owned by non root users
2010-10-07 09:19:43 -04:00
Dan Walsh
7ed755ab8b Put back transition change 2010-10-07 09:15:11 -04:00
Dan Walsh
3235a8bbe6 dontaudit sandbox sending signals to itself. This can happen when they are running at different mcs.
Disable transition from dbus_session_domain to telepathy for F14
Allow boinc_project to use shm
Allow certmonger to search through directories that contain certs
Allow fail2ban the DAC Override so it can read log files owned by non root users
2010-10-07 09:06:56 -04:00
Dan Walsh
039c65f92f Fix mozilla_run_plugin interface 2010-10-06 09:20:27 -04:00
Dan Walsh
596d86ad6c Merge branch 'master' of ssh://git.fedorahosted.org/git/selinux-policy 2010-10-06 09:05:02 -04:00
Dan Walsh
55e9f0e79c Fix fusefs handling
Do not allow sandbox to manage nsplugin_rw_t
Allow mozilla_plugin_t to connecto its parent
Allow init_t to connect to plymouthd running as kernel_t
2010-10-06 09:03:28 -04:00
Miroslav Grepl
d4d13d29c5 Fix version of mediawiki policy 2010-10-05 14:58:52 +02:00
Miroslav Grepl
13692730f0 Alllow vpnc to be able to read /root/.cert 2010-10-05 14:56:02 +02:00
Miroslav Grepl
0def274b96 Add policy for mediawiki 2010-10-05 14:47:38 +02:00
Dan Walsh
f73c8ed42e - Start adding support for use_fusefs_home_dirs
- Add /var/lib/syslog directory file context
- Add /etc/localtime as locale file context
2010-10-04 15:05:52 -04:00
Dan Walsh
b1cbbd0768 - Start adding support for use_fusefs_home_dirs
- Add /var/lib/syslog directory file context
- Add /etc/localtime as locale file context
2010-10-04 14:50:39 -04:00
Dan Walsh
d1c6ba20d5 Start adding support for use_fusefs_home_dirs
Add /var/lib/syslog directory file context
Add /etc/localtime as locale file context
2010-10-04 14:45:52 -04:00
Dan Walsh
991ee5f4d3 - Turn off default transition to mozilla_plugin and telepathy domains from unconfined user
- Turn off iptables from unconfined user
- Allow sudo to send signals to any domains the user could have transitioned to.
- Passwd in single user mode needs to talk to console_device_t
- Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio
- locate tried to read a symbolic link, will dontaudit
- New labels for telepathy-sunshine content in homedir
- Google is storing other binaries under /opt/google/talkplugin
- bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug
- Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15
- modemmanger and bluetooth send dbus messages to devicekit_power
- Samba needs to getquota on filesystems labeld samba_share_t
2010-10-03 07:52:48 -04:00
Dan Walsh
ddd1ccaa93 Allow unconfined_t to transition to alsa_t to make sure labels stay correct
Lots of fixes for mozilla_plugin nsplugin and mozilla_plugin are starting to merge
telepath_msn_t tries to read /proc/1/exe
Allow smokeping cgi scripts to create /var/lib/smokeping dirs.
Allow smbd_t to getquota on multiple file systems
2010-10-03 07:48:01 -04:00
Dan Walsh
fbd9ca071a - Turn off default transition to mozilla_plugin and telepathy domains from unconfined user
- Turn off iptables from unconfined user
- Allow sudo to send signals to any domains the user could have transitioned to.
- Passwd in single user mode needs to talk to console_device_t
- Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio
- locate tried to read a symbolic link, will dontaudit
- New labels for telepathy-sunshine content in homedir
- Google is storing other binaries under /opt/google/talkplugin
- bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug
- Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15
- modemmanger and bluetooth send dbus messages to devicekit_power
- Samba needs to getquota on filesystems labeld samba_share_t
2010-10-01 12:06:09 -04:00
Dan Walsh
b45aaab97c Allow sudo to send signals to any domains the user could have transitioned to.
Passwd in single user mode needs to talk to console_device_t
Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio
locate tried to read a symbolic link, will dontaudit
New labels for telepathy-sunshine content in homedir
Google is storing other binaries under /opt/google/talkplugin
bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug
Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15
modemmanger and bluetooth send dbus messages to devicekit_power
Samba needs to getquota on filesystems labeld samba_share_t
2010-10-01 11:58:15 -04:00
Dan Walsh
5ae8fb66d8 - Dontaudit attempts by xdm_t to write to bin_t for kdm
- Allow initrc_t to manage system_conf_t
2010-09-30 09:50:49 -04:00
Dan Walsh
20f707ce5e dontaudit attempts by xdm_t to write to bin_t for kdm 2010-09-29 15:03:51 -04:00
Dan Walsh
f6e966f3ae Allow nsplugin to sendto itself dgrams
Fix /root/.ssh labeling
2010-09-29 10:55:40 -04:00
Dan Walsh
79bff2bb38 Allow mozilla_plugin to manage all gnome config files
Allow nsplugin_t to read lnk files in nsplugin_rw_t
New labeling for packagekit scripts to bin_t
Allow mount_t to delete etc_t
Allow fsdaemon_t to read usr_t files
2010-09-28 16:24:56 -04:00
Dan Walsh
7c487e9739 - Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory.
- Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets
- Allow confined users to read xdm_etc_t files
- Allow xdm_t to transition to xauth_t for lxdm program
2010-09-27 10:31:36 -04:00
Dan Walsh
4e6b3f6dd9 Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory.
Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets
Allow confined users to read xdm_etc_t files
Allow xdm_t to transition to xauth_t for lxdm program
2010-09-27 10:21:54 -04:00
Dan Walsh
fd595eb487 Merge branch 'master' of ssh://git.fedorahosted.org/git/selinux-policy 2010-09-26 06:44:28 -04:00
Dan Walsh
5212892e22 Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home
Allow clamd to send signals to itself
Allow mozilla_plugin_t to read user home content.  And unlink pulseaudio shm.
2010-09-26 06:42:14 -04:00
Dominick Grift
e66aa74b4a Allow haze to connect to yahoo chat and messenger port tcp:5050.
Bz #637339
2010-09-25 16:57:48 +02:00
Dan Walsh
24ea653911 Allow guest to run ps command on its processes by allowing it to read /proc 2010-09-25 07:07:04 -04:00
Dan Walsh
ab8faf7dcf - Pull in cleanups from dgrift
- Allow mozilla_plugin_t to execute mozilla_home_t
- Allow rpc.quota to do quotamod
2010-09-25 06:35:22 -04:00
Dan Walsh
fb52482a1f Allow firewallgui to sys_rawio which seems to be required to setup masqerading
Allow all domains to search through default_t directories, in order to find differnet labels.  For example people serring up /foo/bar to be share via samba.
Add label for /var/log/slim.log
2010-09-25 06:23:04 -04:00
Dan Walsh
e25799116a - Pull in cleanups from dgrift
- Allow mozilla_plugin_t to execute mozilla_home_t
- Allow rpc.quota to do quotamod
2010-09-24 12:03:50 -04:00
Dan Walsh
f7307c60ba Merge branch 'master' of ssh://git.fedorahosted.org/git/selinux-policy 2010-09-24 11:55:35 -04:00
Dan Walsh
7cfb935473 Allow rpc.quota to do quotamod
Allow mozilla_plugin to execute mozilla_home_t
2010-09-24 11:55:05 -04:00
Miroslav Grepl
df488eda7b Move c2s to run in jabber_router_t domain
Other fixes for jabberd policy
2010-09-24 14:14:38 +02:00
Dominick Grift
ff9b16dc29 Merge branch 'base' 2010-09-24 12:52:43 +02:00
Dominick Grift
71f455a72e miscfiles_manage_cert_files is deprecated: Use miscfiles_manage_generic_cert_files. 2010-09-24 12:48:37 +02:00
Dominick Grift
7d1f5642b0 Use permission sets where possible.
Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.
2010-09-24 12:44:39 +02:00
Dominick Grift
7832131bae XML summary fixes.
XML summary fixes.
2010-09-24 12:44:37 +02:00
Dominick Grift
a25335e1fa Redundant brace nothing to expand here.
Redundant brace nothing to expand here.

Redundant brace nothing to expand here.

Redundant brace nothing to expand here.

Redundant brace nothing to expand here.

Redundant brace nothing to expand here.
2010-09-24 12:44:16 +02:00
Dominick Grift
4781493e45 Tunable, optional and if(n)def blocks go below.
Tunable, optional and if(n)def blocks go below.

Tunable, optional and if(n)def blocks go below.

Tunable, optional and if(n)def blocks go below.

Tunable, optional and if(n)def blocks go below.

Tunable, optional and if(n)def blocks go below.

Tunable, optional and if(n)def blocks go below.

Tunable, optional and if(n)def blocks go below.

Tunable, optional and if(n)def blocks go below.
2010-09-24 12:44:16 +02:00
Dominick Grift
e2d9aa29c5 Source is x_domain and not xserver_t. Moving to x_domain local policy. 2010-09-24 12:44:16 +02:00