Chris PeBenito
e08ac5acb3
Vbetool patch from Dan Walsh.
...
vbetool needs mls overrides
2010-06-18 14:56:27 -04:00
Chris PeBenito
3835c39a13
Sudo patch from Dan Walsh.
...
sudo gets execed by apps that leak sockets
2010-06-18 14:43:22 -04:00
Chris PeBenito
f7e3410aed
Su patch from Dan Walsh.
...
dontaudit leaked sockets
2010-06-18 14:32:42 -04:00
Chris PeBenito
b9be5cccf1
Shorewall patch from Dan Walsh.
...
Shorewall execs hostname
2010-06-18 14:23:46 -04:00
Chris PeBenito
5116faa198
Quota patch from Dan Walsh.
...
Quata needs to setshed on kernel processes
2010-06-18 14:14:21 -04:00
Chris PeBenito
a9ef84b578
Prelink patch from Dan Walsh.
...
Prelink has new directory under /var/lib
dontaudit leaks from domains that transition
cron job looks at all mount points.
2010-06-18 14:07:53 -04:00
Chris PeBenito
9a4d292902
Netutils patch from Dan Walsh.
...
ping gets leaked log descriptor from nagios.
Label send_arp as ping_exec_t
2010-06-17 10:16:19 -04:00
Chris PeBenito
10c0104066
Kismet patch from Dan Walsh.
...
Kismet searches user_home_dirs for kismet_home_t content.
2010-06-17 08:24:21 -04:00
Chris PeBenito
e89f04fd17
Mcelog patch from Dan Walsh.
...
mcelog needs mls override
2010-06-17 08:23:48 -04:00
Chris PeBenito
0e30bca6d9
Consoletype patch from Dan Walsh.
...
I am sick of every app in the known universe leaking socket descriptors.
Dontaudit by default
consoletype is handed a write for hal log on resume from hibernate.
2010-06-17 08:23:20 -04:00
Chris PeBenito
88a574d373
Alsa patch from Dan Walsh
...
Alsa trys to talk to all types of terminals. Dontaudit this access.
2010-06-17 08:22:43 -04:00
Chris PeBenito
4db7790c60
Acct patch from Dan Walsh.
...
acct needs to use generic ptys
2010-06-17 08:22:17 -04:00
Chris PeBenito
48f99a81c0
Whitespace change: drop unnecessary blank line at the start of .te files.
2010-06-10 08:16:35 -04:00
Chris PeBenito
5c942ceb83
AFS patch from Dan Walsh.
2010-06-10 08:08:23 -04:00
Chris PeBenito
b521229560
Abrt patch from Dan Walsh.
...
Abrt uses /var/spool/abrt now and changed the name of its lock
Now uses a stream socket
Installs debuginfo packages
sys_nice itself
2010-06-10 07:58:00 -04:00
Chris PeBenito
48e0aa86c9
Files patch from Dan Walsh.
...
Redhat does want /usr/local/src labeled src_t or /usr/src for that matter
Fix labels on chroot environments
2010-06-09 09:09:34 -04:00
Chris PeBenito
135b1b4c54
Terminal patch from Dan Walsh.
2010-06-09 08:22:31 -04:00
Chris PeBenito
c54e7d63dc
Module version bump for cgroup patchset.
2010-06-08 09:18:43 -04:00
Chris PeBenito
53f9abbe68
Clean up cgroup. Rename cgconfigparser to cgconfig.
2010-06-08 09:15:41 -04:00
Chris PeBenito
0041a78ef7
Remove cgroup_t usage in cgroup_admin() since it is not owned by the module.
2010-06-08 09:12:03 -04:00
Chris PeBenito
860c05d9de
Rearrange cgroup interfaces in filesystem.
2010-06-08 09:10:45 -04:00
Chris PeBenito
04dcd73fe3
Whitespace fixes in cgroup and init.
2010-06-08 08:47:26 -04:00
Dominick Grift
e2b9add5f8
How users interact with cgroup.
...
All login users can list cgroup.
Common users can read and write cgroup files (access governed by dac)
Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
2010-06-08 08:38:33 -04:00
Dominick Grift
73f0985092
How libgroup init scripts interact with libcgroup.
...
The libcgroup init scripts use tools in /usr/bin like cgexec and cgclear.
Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
2010-06-08 08:38:29 -04:00
Dominick Grift
ddf821332f
add libcg policy.
...
Libcgroup automates cgroup management.
Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
2010-06-08 08:38:22 -04:00
Dominick Grift
c0c635b3f3
cgroup in filesystem.
...
Move cgroup_t declarations from kernel.te to filesystem.te
Redo cgroup interfaces in filesystem.if
Add file context specification for /cgroup mountpoint to filesystem.fc
Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
2010-06-08 08:38:18 -04:00
Chris PeBenito
60f04fcb7a
Kernel patch from Dan Walsh.
...
Add ability to dontaudit requiests to load kernel modules. If you
disable ipv6 every confined app that does ip, tries to get the kernel to
load the module.
Better handling of unlabeled files by the kernel interfaces
2010-06-07 11:08:35 -04:00
Chris PeBenito
fb7caddb4f
Devices patch from Dan Walsh.
...
vhost_device_t added for libvirt/qemu
/dev/usbmon device added
lots of new interfaces.
2010-06-07 09:20:18 -04:00
Chris PeBenito
46c0e57acf
Corecommands patch from Dan Walsh.
...
Lots of new places to stick bin_t files
2010-06-07 09:04:08 -04:00
Chris PeBenito
8f0de5df68
Storage patch from Dan Walsh.
...
Add /dev/hwcdrom
2010-06-04 09:47:45 -04:00
Chris PeBenito
2a29628e40
Fix duplicate lines in kudzu.
2010-05-26 08:26:50 -04:00
Chris PeBenito
29af4c13e7
Bump module versions for release.
2010-05-24 15:32:01 -04:00
Chris PeBenito
91cbcc6602
Fix deprecated interface usage in rhel4 block in su.if.
2010-05-24 15:09:18 -04:00
Chris PeBenito
3d95ca2d82
Module version bump for 904f3d8.
2010-05-24 13:08:09 -04:00
Chris PeBenito
7934ac10d3
Module version bump for 1184392 and more.
...
* module version bump
* make apache and unconfined portions optiona
* rearrange lines
2010-05-24 13:08:09 -04:00
Chris PeBenito
ca28376c4d
Module version bump for 7942f7f.
2010-05-24 13:08:09 -04:00
Chris PeBenito
bdf5e19931
Module version bump for 383bd32.
2010-05-24 13:08:09 -04:00
Chris PeBenito
213d35a07c
Module version bump for 9e28f74.
2010-05-24 13:08:09 -04:00
Chris PeBenito
63583f4e29
Module version bump for f61ef24.
2010-05-24 13:08:09 -04:00
Chris PeBenito
c789f82bc5
Module version bump for d5170e5.
2010-05-24 13:08:09 -04:00
Chris PeBenito
d53a972879
Module version bump for cb1df6a.
2010-05-24 13:08:09 -04:00
Jeremy Solt
d8642cad29
readahead patch from Dan Walsh
...
Edits:
- Removed files_dontaudit_read_security_files and fs_dontaudit_read_tmpfs_blk_dev interface calls
2010-05-24 13:08:08 -04:00
Chris PeBenito
fe74f71385
Fix deprecated interface usage that crept into lvm.if.
2010-05-24 13:08:08 -04:00
Chris PeBenito
ff1cae1f5e
Move line in logrotate; module version bump.
2010-05-24 13:08:08 -04:00
Chris PeBenito
a107f875bd
Remove redundant optional and libs_* calls in clogd.
2010-05-24 13:08:08 -04:00
Chris PeBenito
dcb7227286
Module version bump for 51ad76f.
2010-05-24 13:08:08 -04:00
Jeremy Solt
6430c79a29
whitespace fix for clogd
2010-05-24 13:08:08 -04:00
Jeremy Solt
6055ab8d1d
clogd policy from Dan Walsh
...
edits:
- style and whitespace fixes
- removed read_lnk_files_pattern from shm interface
- removed permissive line
2010-05-24 13:08:08 -04:00
Jeremy Solt
7a8e6a8fba
whitespace fixes for cluster suite patch
2010-05-24 13:08:08 -04:00
Jeremy Solt
21d23c878e
Removed unnecessary comments
...
Removed 'SELinux policy for' from policy summaries
Removed rgmanager interface for semaphores (doesn't appear to be needed or used)
Removed redundant calls to libs_use_ld_so and libs_use_shared_libs
Fixed rhcs interface names to match naming rules
Merged tmpfs and semaphore/shm interfaces
2010-05-24 13:08:08 -04:00
Jeremy Solt
538cf9ab83
Redhat Cluster Suite Policy from Dan Walsh
...
Edits:
- Style and whitespace fixes
- Removed interfaces for default_t from ricci.te - this didn't seem right
- Removed link files from rgmanager_manage_tmpfs_files
- Removed rdisc.if patch. it was previously committed
- Not including kernel_kill interface call for rgmanager
- Not including ldap interfaces in rgmanager.te (currently not in refpolicy)
- Not including files_create_var_run_dirs call for rgmanager (not in refpolicy)
2010-05-24 13:08:08 -04:00
Jeremy Solt
b8c9879a8c
logrotate patch from Dan Walsh
2010-05-24 13:08:08 -04:00
Jeremy Solt
fdc0d0f77c
vpn patch from Dan Walsh
...
Edits:
- Removed userdom_read_home_certs
2010-05-24 13:08:08 -04:00
Jeremy Solt
37194ac055
dnsmasq patch from Dan Walsh
...
- cron_manage_pid_files call removed until further explanation
2010-05-24 13:08:07 -04:00
Jeremy Solt
2483d7ae56
Replace apache_delete_cache with apache_delete_cache_files in tmpreaper.te
2010-05-24 13:08:07 -04:00
Jeremy Solt
8daddcf37e
tmpreaper patch from Dan Walsh
2010-05-24 13:08:07 -04:00
Jeremy Solt
7605d2738c
Remove call to nagios_rw_inherited_tmp_files
2010-05-24 13:08:07 -04:00
Jeremy Solt
44dc1b9c21
netutils patch from Dan Walsh
...
Edits:
- Dropping term_use_all_terms and user_ping tunables for ping and traceroute
- Whitespace fixes
2010-05-24 13:08:07 -04:00
Jeremy Solt
4ac0cd30fa
Remove nagios_rw_inherited_tmp_files interface
2010-05-24 13:08:07 -04:00
Jeremy Solt
99bbe34881
Nagios patch from Dan Walsh
...
Edits:
- Removed permissive lines
- Removed tunable for broken symptoms
- Style and whitespace fixes
2010-05-24 13:08:07 -04:00
Jeremy Solt
599e8ff702
Create type and allow squid to manage its own tmpfs files
2010-05-24 13:08:07 -04:00
Jeremy Solt
d86c09846b
squid patch from Dan Walsh
...
Edits:
- Added netport to corenetwork.te.in
2010-05-24 13:08:07 -04:00
Jeremy Solt
fb543d0df1
remove rules for nx_server_home_ssh_t since they are already provided by the ssh template
2010-05-24 13:08:07 -04:00
Jeremy Solt
316cdb1d0d
nx patch from Dan Walsh
...
Edits:
- Style and whitespace fixes
- Removed read_lnk_files_pattern from nx_read_home_files
- Delete declaration of nx_server_home_ssh_t and files_type since the template already does this
2010-05-24 13:08:07 -04:00
Chris PeBenito
d9e4cbd2ce
Postfix patch from Dan Walsh.
2010-05-21 08:56:49 -04:00
Chris PeBenito
9fe1b540b8
Prelink patch from Dan Walsh.
2010-05-20 08:54:51 -04:00
Chris PeBenito
9ea85eaa8b
Sendmail patch from Dan Walsh.
2010-05-20 08:36:38 -04:00
Chris PeBenito
b276e36914
Procmail patch from Dan Walsh.
2010-05-20 08:17:06 -04:00
Chris PeBenito
e19b8d1c2e
MTA patch from Dan Walsh.
2010-05-19 09:00:39 -04:00
Chris PeBenito
088b65e52b
SSH patch from Dan Walsh.
2010-05-19 08:31:17 -04:00
Chris PeBenito
4e698b0fca
Cups patch from Dan Walsh.
2010-05-18 10:59:37 -04:00
Chris PeBenito
e2c9450235
Remove excessive permission in udev_manage_rules_files() and move the interface up in the .if file. Module version bump for d56b33a
.
2010-05-18 10:28:17 -04:00
Chris Richards
d56b33a1e4
Create new interface and type for managing /etc/udev/rules.d
...
udev_var_run_t is used for managing files in /etc/udev/rules.d as well as other files, including udev pid files. This patch creates a type specifically for rules.d files, and an interface for managing them. It also gives access to this type to initrc_t so that rules can be properly populated during startup. This also fixes a problem on Gentoo where udev rules are NOT properly populated on startup.
Signed-off-by: Chris Richards <gizmo@giz-works.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
2010-05-18 10:20:55 -04:00
Chris PeBenito
1b2f08ea10
Abrt patch from Dan Walsh.
2010-05-18 10:18:12 -04:00
Chris PeBenito
e9e43f04b3
Plymouthd policy from Dan Walsh.
2010-05-18 09:54:18 -04:00
Chris PeBenito
b0c2cae14a
Hal patch from Dan Walsh.
...
Lots of random access for hal.
2010-05-18 09:06:36 -04:00
Chris PeBenito
2e4e39d26a
Loadkeys patch from Dan Walsh.
2010-05-14 11:40:26 -04:00
Chris PeBenito
84940a0995
Java patch from Dan Walsh.
...
Additional java context
unconfined_Java apps needs to execmod any file since we do not know where the jave content will be labeled
We want unconfined java apps to transition to rpm when they execute rpm_exec_t. To maintain proper labeling.
2010-05-14 10:40:59 -04:00
Chris PeBenito
299db7080c
CVS patch from Dan Walsh.
...
cvs needs dac_override when it tries to read shadow
2010-05-14 10:24:11 -04:00
Chris PeBenito
bcc6e65421
SETroubleshoot patch from Dan Walsh.
...
Policy to handle the fixit button in setroubleshoot.
2010-05-13 13:22:53 -04:00
Chris PeBenito
ada61e1529
Asterisk patch from Dan Walsh.
...
asterisk_manage_lib_files(logrotate_t)
asterisk_exec(logrotate_t)
Needs net_admin
Drops capabilities
connects to unix_stream
execs itself
Requests kernel load modules
Execs shells
Connects to postgresql and snmp ports
Reads urand and generic usb devices
Has mysql and postgresql back ends
sends mail
2010-05-13 11:35:58 -04:00
Chris PeBenito
24e0b9b3a4
Munin patch from Dan Walsh.
2010-05-13 11:20:54 -04:00
Chris PeBenito
16070400a8
RPM patch from Dan Walsh.
2010-05-11 11:11:40 -04:00
Chris PeBenito
27afb97c29
Minor fixes on a2524cf
. Module version bump.
2010-05-11 08:33:04 -04:00
Chris PeBenito
aeb7a4e180
Whitespace fixes on cobbler.
2010-05-11 08:23:02 -04:00
Jeremy Solt
a2524cfa77
cobbler patch from Dan Walsh
2010-05-11 08:17:33 -04:00
Chris PeBenito
fb3fc9e4f0
Cyrus patch from Dan Walsh.
2010-05-03 15:14:50 -04:00
Chris PeBenito
4804cd43a0
Clamav patch from Dan Walsh.
2010-05-03 15:01:35 -04:00
Chris PeBenito
d8eb3c71c6
Dovecot patch from Dan Walsh.
2010-05-03 14:37:19 -04:00
Chris PeBenito
baea7b1dc6
Networkmanager patch from Dan Walsh.
2010-05-03 14:01:26 -04:00
Chris PeBenito
03a6e03926
Add kernel access to devtmpfs. Also add workround while devtmpfs is tmpfs_t instead of device_t.
2010-05-03 11:17:16 -04:00
Chris PeBenito
a3108c60c0
Consolekit patch from Dan Walsh.
2010-05-03 10:21:48 -04:00
Chris PeBenito
b0076a1413
Arpwatch patch from Dan Walsh.
2010-05-03 09:49:33 -04:00
Chris PeBenito
98ac98623c
Dbus patch from Dan Walsh.
2010-05-03 09:34:42 -04:00
Chris PeBenito
61738f11ec
Devicekit patch from Dan Walsh.
2010-05-03 09:01:46 -04:00
Chris PeBenito
857d37e84a
GPG patch from Dan Walsh.
2010-04-30 15:24:19 -04:00
Chris PeBenito
3b72786090
Add trusted object condition to unix socket connectto/sendto, to fix label translation.
2010-04-29 11:29:39 -04:00
Chris PeBenito
87a9469fc9
Add networking rules for spamd to connect to mysql/postgresql over the network, from Chris St. Pierre.
2010-04-27 10:31:47 -04:00
Chris PeBenito
45696ab282
Add missing secmark rules in ntop, from Dominick Grift.
2010-04-27 09:31:30 -04:00
Chris PeBenito
a53c6c65a4
FTP patch from Dan Walsh.
2010-04-26 15:15:23 -04:00