rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity
2,624 Commits 9 Branches 105 Tags 34 MiB
da5940411c
Commit Graph

559 Commits

Author SHA1 Message Date
Chris PeBenito
461b53e028 Tuned patch from Dan Walsh. 2010-03-22 10:33:31 -04:00
Chris PeBenito
7630200e1b Virt patch from Dan Walsh. 2010-03-22 10:24:34 -04:00
Chris PeBenito
064d1b469e Rename rtkit_schedule() to rtkit_scheduled(). 2010-03-22 09:54:58 -04:00
Chris PeBenito
e13a9ef5fe Module version bump for ac19f1a. 2010-03-22 08:59:04 -04:00
Chris PeBenito
c7a4cf3179 Module version bump for 9681df1. 2010-03-22 08:58:41 -04:00
Chris PeBenito
32103f250f Module version bump for d3b5907. 2010-03-22 08:58:20 -04:00
Chris PeBenito
340af119b0 Minor tweaks on icecast. 2010-03-22 08:56:32 -04:00
Jeremy Solt
584dfaca45 icecast policy from Dan Walsh 
Fixed some style and spacing issues
Replace manage_var_run interface with manage_pid_files with fewer permissions
Replaced rkit_daemon_system_domain with rtkit_schedule
 2010-03-22 08:49:54 -04:00
Jeremy Solt
ac19f1ac26 rtkit patch from Dan Walsh: 
rtkit_daemon_system_domain interface allows domains to say rtkit can setsched on their process.
Needs sys_nice capability
Needs to getsched on all domains.
Fix bug in te file

Me:
changed interface name from rtkit_daemon_system_domain to rtkit_schedule
Already had sys_nice capability
 2010-03-22 08:41:42 -04:00
Jeremy Solt
9681df1c8d postgresql patch from Dan Walsh: 
"File context for /etc/sysconfig/pgsql and other bugs.
Sends audit messages connect to posgresql_server port
Reads its own process info"

Moved signal interface for style.
 2010-03-22 08:39:15 -04:00
Jeremy Solt
d3b5907ea4 openvpn needs ipc_lock capability, connects to http ports, 
and manages net_conf_t files - from Dan Walsh
 2010-03-22 08:36:47 -04:00
Chris PeBenito
47293bd8d6 Tftp patch from Dan Walsh. 2010-03-19 15:56:14 -04:00
Chris PeBenito
788ba75491 Uucp patch from Dan Walsh. 2010-03-19 15:49:12 -04:00
Chris PeBenito
bed0a44560 Zebra patch from Dan Walsh. 2010-03-19 15:45:25 -04:00
Chris PeBenito
7b50b7053d Module version bump for 6a03548. 2010-03-17 09:42:46 -04:00
Jeremy Solt
6a035482dc amavis uses uptime which reads utmp, and reads certs - from Dan Walsh 2010-03-17 09:41:18 -04:00
Chris PeBenito
827060cb04 Style fixes and module version bumps for 38fc1bd. 2010-03-17 09:28:18 -04:00
Dominick Grift
38fc1bd180 Likewise policy. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-03-17 08:48:45 -04:00
Chris PeBenito
2a62db7883 Module version bump for 414a570. 2010-03-16 15:28:36 -04:00
Jeremy Solt
414a5704df fetchmail executes programs in bin (uname), from Dan Walsh 2010-03-16 15:27:40 -04:00
Chris PeBenito
5911f3dbca Module version bump for 935151a. 2010-03-16 14:35:09 -04:00
Chris PeBenito
9a59893e5a Module version bump for d7ec247. 2010-03-16 14:34:23 -04:00
Chris PeBenito
9570fc108e Module version bump for 591af7b. 2010-03-16 14:34:05 -04:00
Chris PeBenito
1656bf730f Whitespace fixes in mailman. 2010-03-16 13:51:51 -04:00
Jeremy Solt
935151afcd Change kernel_load_module to kernel_request_load_module for howl from Dan Walsh 2010-03-16 13:44:55 -04:00
Jeremy Solt
d7ec24785b File context update for certmaster from Dan Walsh 2010-03-16 13:44:50 -04:00
Jeremy Solt
591af7be0c file context updates from Dan Walsh 2010-03-16 13:44:48 -04:00
Chris PeBenito
fce868d074 Module version bump for f7d413a. 2010-03-16 13:15:00 -04:00
Chris PeBenito
bf140fc32c Rearrange interfaces in fail2ban. 2010-03-16 13:14:46 -04:00
Jeremy Solt
f7d413af27 fail2ban_stream_connect and fail2ban_rw_stream_sockets from Dan Walsh 
Did not include dontaudit_leaks interface
Modified fail2ban_rw_stream_sockets to use rw_stream_socket_perms set
 2010-03-16 11:44:35 -04:00
Chris PeBenito
ce0570dc6d Module version bump for e172614. 2010-03-12 11:42:28 -05:00
Chris PeBenito
9e506eb236 Rearrange lines in alsa an mysql. 2010-03-12 08:59:23 -05:00
Chris PeBenito
e172614b57 Whitespace cleanup on mysql.if. 2010-03-12 08:55:34 -05:00
Jeremy Solt
12a6a53f63 mysql policy from Dan Walsh 
My changes to patch:
A couple changes to match style.
Removed files_dontaudit_search_all_mountpoints(mysqld_safe_t), it doesn't exist in refpolicy
 2010-03-12 08:54:29 -05:00
Chris PeBenito
30496b1575 Iscsi and tgtd patches from Dan Walsh. 2010-03-09 15:17:16 -05:00
Dominick Grift
183f79e38e Fix cobbler_admin interface to require cobblerd_initrc_exec_t. 
As per: http://oss.tresys.com/pipermail/refpolicy/2010-March/002258.html

Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
 2010-03-04 14:12:41 -05:00
Chris PeBenito
ec0205ff73 Module version bump for e1e78df. 2010-03-04 09:18:04 -05:00
Chris PeBenito
b7070a9f3d Module version bump for 52b215f. 2010-03-04 09:18:04 -05:00
Chris PeBenito
cb6385d0ba Module version bump for cf5e81d. 2010-03-04 09:18:04 -05:00
Chris PeBenito
c4faa1db8e Module version bump for 96b7e9f. 2010-03-04 09:18:04 -05:00
Chris PeBenito
812f30af02 Module version bump for a005018. 2010-03-04 09:18:04 -05:00
Chris PeBenito
4931c57e4b Add additional comments for e1e78df. 2010-03-04 09:18:04 -05:00
Jeremy Solt
9a1f0d21e1 Seems reasonable that exim may need to manage these files when /etc/alternatives/mta points to exim 
Patch from Dan Walsh
 2010-03-04 09:18:03 -05:00
Jeremy Solt
15ae77bd77 Domain transition for apmd to vbetool from Dan Walsh 2010-03-04 09:18:03 -05:00
Jeremy Solt
a739053cf5 Changed amavis_initrc_domtrans domain summary to match style. 2010-03-04 09:18:03 -05:00
Jeremy Solt
6665c3c768 Changed arpwatch_initrc_domtrans domain summary to match style. 
Restored arpwatch_initrc_exec_t require because it's still used in arpwatch_admin interface
 2010-03-04 09:18:03 -05:00
Dominick Grift
d783374bc9 Various arpwatch fixes. 
Allow domains to search /var/lib to enable interaction with arpwatch data.
Allow domains to search /tmp to enable interaction with arpwatch tmp content.
Create arpwatch initrc domtrans.
Call arpwatch initrc domtrans from arpwatch_admin.
Remove obsolete require.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-03-04 09:18:03 -05:00
Jeremy Solt
6eed0aa57c Modified apcupsd_initrc_domtrans interface summary to match style. 
Restored apcupsd_initrc_exec_t require in apcupsd_admin interface (It is used here in the role_transition).
 2010-03-04 09:18:03 -05:00
Dominick Grift
eda6417669 Create apcupsd initrc domtrans. Call apcupsd initrc domtrans in apcupsd_admin. Remove obsolete require. Allow domains Various apcupsd fixes. 
Create apcupsd initrc domtrans.
Call apcupsd initrc domtrans in apcupsd_admin.
Remove obsolete require.
Allow domains to search bin to enable run apcupsd executable file.
Allow domains to search httpd system content to enable run apcupsd cgi script executables.
Allow domains to search var to enable run apcupsd content in /var/www/upcupsd.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-03-04 09:18:03 -05:00
Jeremy Solt
3b814894c7 Fixed typo in gen_require for amavis_initrc_domtrans (Appears to be a copy/paste mistake). 
Restored amavis_initrc_exec_t require in amavis_admin (still being used in this interface).
 2010-03-04 09:18:02 -05:00
Dominick Grift
88340b904a Various amavis fixes. 
Create amavis_initrc_domtrans.
Call amavis_initrc_domtrans from amavis_admin.
Remove obsolete require.
Allow domains to search bin to enable run amavis executable.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-03-04 09:18:02 -05:00
Chris PeBenito
0bbb165448 Improve the documentation of nis_use_ypbind(). 2010-03-03 10:37:15 -05:00
Chris PeBenito
d124921979 Module version bump for cd17345. 2010-02-24 10:13:12 -05:00
Dominick Grift
cd17345324 Various abrt fixes. 
Fix networking compatibility.
Allow domains to search bin to enable run abrt executables.

Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
 2010-02-24 10:11:51 -05:00
Chris PeBenito
2040268b01 Module version bump for 534e57b. 2010-02-24 10:08:41 -05:00
Dominick Grift
534e57b770 Various afs fixes. 
Fix afs_initrc_domtrans.
Remove obsolete require in afs_admin.
Allow domains to search var to enable read write cache.
Allow domains to search bin to enable run afs executable.

Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
 2010-02-24 10:07:28 -05:00
Dominick Grift
6306637c89 mysqlmanagerd_var_run_t is not a domain type. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
 2010-02-24 10:00:05 -05:00
Chris PeBenito
1021460884 Minor tweaks and module version bump for 68cda59. 2010-02-23 13:58:18 -05:00
Chris Richards
68cda59844 Add MySQL Manager to MySQL policy module 
Second submission to fix mistakes from first.

Signed-off-by: Chris Richards <gizmo@giz-works.com>
Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
 2010-02-23 13:23:42 -05:00
Chris PeBenito
1049180cd8 Automount patch from Dan Walsh. 2010-02-19 13:50:01 -05:00
Chris PeBenito
d08a3df046 Ssh key creation fix from Gentoo. 2010-02-17 20:32:08 -05:00
Chris PeBenito
a513794b4c Chronyd from Miroslav Grepl. 2010-02-16 14:53:59 -05:00
Chris PeBenito
3fb2b72c65 Ccs patch from Dan Walsh. 2010-02-16 11:28:08 -05:00
Chris PeBenito
0ab2c1eae9 Clear xserver TODO. 2010-02-12 10:29:41 -05:00
Chris PeBenito
6246e7d30a Non-drawing X client support for consolekit. 2010-02-12 10:29:00 -05:00
Chris PeBenito
c3c753f786 Remove concept of user from terminal module interfaces dealing with ptynode and ttynode since these attributes are not specific to users. 2010-02-11 14:20:10 -05:00
Chris PeBenito
21673b238a Hal patch from Dan Walsh. 2010-02-11 08:42:00 -05:00
Chris PeBenito
3079cbceb1 Virt/svirt patch from Dan Walsh. 2010-02-09 10:28:17 -05:00
Chris PeBenito
aa9e3b4b65 Ktalk patch from Dan Walsh. 2010-02-09 10:28:00 -05:00
Chris PeBenito
27eab81f2f Misc fixes for 1031ee6. 2010-02-08 13:38:48 -05:00
Chris PeBenito
7d2f96783c Module version number bump for 1031ee6. 2010-02-08 13:37:42 -05:00
Dominick Grift
1031ee6f6a Implement cobblerd policy. 
My previous version had a minor bug in admin_role where it was using cobblerd_var_log_t, and cobblerd_var_lib_t instead of cobbler_var_log_t, and cobbler_var_lib_t.

Whilst i was at it, i decided the implement a cobbler_etc_t for cobbler content in /etc. This because you cannot admin a cobbler environment witouth having access to cobbler config files and i dont want to give cobbler_admin access to manage etc_t.

As a consequence if this i also removed the files_read_etc_files(cobblerd_t), as i think that cobbler only needed it to read its own files in /etc. However this is not confirmed, and it may need read access to etc_t afteral.

Also i would like to underscore my reason for using public_content_rw_t. One of the reasons is that i do not want to give cobbler access to manage httpd_sys_content_rw_t. In general i do not want to depend on apache module at all.

Signed-off-by: Dominick Grift <domg472@gmail.com>
Signed-off-by: Chris PeBenito <pebenito@gentoo.org>
 2010-02-08 12:56:01 -05:00
Chris PeBenito
e526fca176 Add nut from Stefan Schulze Frielinghaus and Miroslav Grepl. 2010-02-08 11:29:12 -05:00
Chris PeBenito
4ebfec7303 Add pyicqt from Stefan Schulze Frielinghaus. 2010-02-08 10:58:16 -05:00
Chris PeBenito
22a2874dbf Add dbadm, from KaiGai Kohei. 2010-02-08 10:34:08 -05:00
Chris PeBenito
edc2f7dea4 Fix home_ssh_t usage. 2010-01-25 08:34:28 -05:00
Chris PeBenito
82b5d290cc PPP patch from Dan Walsh. 2010-01-15 15:46:07 -05:00
Chris PeBenito
cde15072d0 SSH patch from Dan Walsh. 2010-01-15 15:28:27 -05:00
Chris PeBenito
fee5bb73bc Uucp patch from Dan Walsh. 2010-01-08 10:37:47 -05:00
Chris PeBenito
c155e042d8 Sendmail patch from Dan Walsh. 2010-01-08 10:37:37 -05:00
Chris PeBenito
3624ef76d2 Mailman patch from Dan Walsh. 2010-01-08 10:37:23 -05:00
Chris PeBenito
8a8b24a4ba Lircd patch from Dan Walsh. 2010-01-08 10:37:13 -05:00
Chris PeBenito
07ba15168b Courier patch from Dan Walsh. 2010-01-08 10:37:01 -05:00
Chris PeBenito
d2acef78f4 Inetd patch from Dan Walsh. 2010-01-08 10:36:49 -05:00
Chris PeBenito
c292cb96ad Avahi patch from Dan Walsh. 2010-01-08 10:35:47 -05:00
Chris PeBenito
00808a9b13 Fprintd patch from Dan Walsh. 2010-01-07 11:51:17 -05:00
Chris PeBenito
ef6ea56c4b Fetchmail patch from Dan Walsh. 2010-01-07 11:51:05 -05:00
Chris PeBenito
84a45c9617 Exim patch from Dan Walsh. 2010-01-07 11:50:55 -05:00
Chris PeBenito
4dd84bbf0e Dovecot patch from Dan Walsh. 2010-01-07 11:50:47 -05:00
Chris PeBenito
14c7865f1f Ddclient patch from Dan Walsh. 2010-01-07 11:50:35 -05:00
Chris PeBenito
dcabb11eb5 DCC patch from Dan Walsh. 2010-01-07 11:50:20 -05:00
Chris PeBenito
30958fb7e7 Cyrus patch from Dan Walsh. 2010-01-07 11:49:55 -05:00
Chris PeBenito
192fb874f5 Clamav patch from Dan Walsh. 2010-01-07 11:49:44 -05:00
Chris PeBenito
c5155ac008 Bluetooth patch from Dan Walsh. 2010-01-07 11:49:32 -05:00
Chris PeBenito
96831fe421 Move rules from mta mailserver delivery from interface to .te to use the attribute. 2010-01-07 09:56:21 -05:00
Chris PeBenito
9c40673ff5 MTA patch from Dan Walsh. 2010-01-07 09:48:35 -05:00
Chris PeBenito
2650ca57ec Tftp patch from Dan Walsh. 2010-01-07 09:01:10 -05:00
Chris PeBenito
f3890b25db Sssd patch from Dan Walsh. 2010-01-07 09:00:59 -05:00
Chris PeBenito
207c4d1e6e Snmp patch from Dan Walsh. 2010-01-07 09:00:48 -05:00
Chris PeBenito
82cdffce58 ntp patch from Dan Walsh. 2010-01-07 09:00:39 -05:00