rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity
2,937 Commits 8 Branches 96 Tags 37 MiB
dcbbeeada3
Commit Graph

713 Commits

Author SHA1 Message Date
Dominick Grift
dcbbeeada3 Access to get attributes of target accountsd_t domain is included with ps_process_pattern. 
Permission to get attributes of target arpwatch_t domain is included with ps_process_pattern.

Access to get attributes of target asterisk_t domain is included with ps_process_pattern.

Permission to get attributes of target automount_t domain is included with ps_process_pattern.

Access to get attributes of target ntpd_t domain is included with ps_process_pattern.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
b6d0a79f2c Use admin_pattern. Allow nslcd_admin to search parent directories to be able to interact with nslcd content. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
eb12bc3076 Source is required to search generic pid directories to be able to interact with mysql sockets in var_run. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
f386b9002d Use the stream_connect_pattern. 
Use stream_connect_pattern.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
c5e7db7a71 Allow mpd_admin to manage mpd tmpfs content. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
0ba923e7d9 Source is required to search generic tmpfs directories to be able to interact with mpd tmpfs content. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
0ab415250b Redundant: mpd_search_lib already includes files_search_var_lib. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
7d34935ff2 Memcached_admin is required to search generic pid directories to be able to manage memcached pid content. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
aa5baa96ed Allow icecast_admin to ptrace and signal the icecast_t domain. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
4b81a55013 This is redundant since base user can search generic proc directories and included ps_process_pattern call permits all else. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
7d36c9fa13 Permission to search proc_t directories is required to be able to read abrt state. 
Signed-off-by: Dominick Grift <domg472@gmail.com>

Permission to search generic proc directories is required to read hald_t state.
 2010-09-15 17:42:28 +02:00
Dominick Grift
b36824efdf Permit fetchmail_admin to ptrace and signal the fetchmail_t domain. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
cf152b4953 Replace some type statements by comma delimiters. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
47cf98ddd5 Permission to get attributes of target devicekit_t, devicekit_disk_t and devicekit_power_t domains are included with ps_process_patterns. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
5ecaacae61 Type system_cronjob_var_run_t is not required here. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:27 +02:00
Dominick Grift
beb9c35b25 Types crontab_exec_t, cron_spool_t and user_cron_spool_t are required here. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:27 +02:00
Dominick Grift
d8d33a15bf Permission to search generic pid directories is included with files_pid_filetrans. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:27 +02:00
Dominick Grift
0540e22fcc Use ps_process_pattern to read state. Permission to seach proc_t directories is required to read automount state. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:27 +02:00
Miroslav Grepl
3b0a9c74bb Allow iscsid to manage tgtd semaphores 2010-09-15 16:50:07 +02:00
Dan Walsh
c2dae98501 Allow a couple of sandbox issues. 
Remove postgresl managing of etc_files, until I find out why it is needed.
Dontaudit leaks from rpm to mount
 2010-09-14 10:02:43 -04:00
Dan Walsh
5ef740e54b Fix gnome_setattr_config_home 
Allow exec of sandbox_file_type by calling apps
Fix typos
 2010-09-13 14:47:02 -04:00
Dan Walsh
3034a8d941 Fix some names in passenger policy 2010-09-13 10:26:10 -04:00
Miroslav Grepl
94820e4290 Move passenger policy to services 2010-09-13 15:10:30 +02:00
Dan Walsh
536f28a2bf Merge branch 'master' of ssh://git.fedorahosted.org/git/selinux-policy 2010-09-13 08:43:40 -04:00
Dan Walsh
1a40cbf63e Fix boolean descriptions 2010-09-13 08:43:35 -04:00
Miroslav Grepl
3a3212619a Allow dovecot-deliver to create tmp files 
Allow tor to send signals to itself
 2010-09-13 13:12:24 +02:00
Miroslav Grepl
d7de04f8d4 - Add passenger policy 2010-09-13 11:49:37 +02:00
Dan Walsh
366396d855 Fix cert calls in telepath, boinc, kerberos 
Add sys_admin to xend to allow it to start
Add oident calls to staff_t
 2010-09-10 13:18:49 -04:00
Dan Walsh
cab9bc9c58 Merge branch 'master' of ssh://git.fedorahosted.org/git/selinux-policy; branch 'master' of http://oss.tresys.com/git/refpolicy 
Conflicts:
	policy/modules/admin/amanda.if
	policy/modules/system/init.te
	policy/modules/system/miscfiles.if
	policy/modules/system/miscfiles.te
	policy/modules/system/userdomain.if
 2010-09-10 13:02:25 -04:00
Dan Walsh
0b8f4cfe16 More fixes for mozilla_plugin_t 
Allow telepathy domains to send themselves sigkill
Label /etc/httpd/alias/*db as cert_t
Allow fprintd to sys_nice
 2010-09-10 12:10:13 -04:00
Chris PeBenito
da12b54802 Module version bumps for cert patch. 2010-09-10 11:31:22 -04:00
Chris PeBenito
e9d6dfb8b1 Fix missed deprecated interface usage from the cert patch. Add back a few rolecap tags. 2010-09-10 11:31:00 -04:00
Dominick Grift
8340621920 Implement miscfiles_cert_type(). 
This is based on Fedoras' miscfiles_cert_type implementation.
The idea was that openvpn needs to be able read home certificates (home_cert_t) which is not implemented in refpolicy yet, as well as generic cert_t certificates.

Note that openvpn is allowed to read all cert_types, as i know that it needs access to both generic cert_t as well as (future) home_cert_t. Dwalsh noted that other domains may need this as well but because i do not know exactly which domains i will not changes any other domains call to generic cert type interfaces.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-10 11:05:46 -04:00
Dan Walsh
1a82786cc8 Allow hugetlbfs_t to be on device_t file system 
Allow sudo domains to signal user domains
Dontaudit xdm_t sending signals to all domains
Fix allow_exec* boolean descriptions
 2010-09-10 10:10:34 -04:00
Dan Walsh
8e47c02b16 fixes for openvpn suggested by dgrift 2010-09-09 10:35:27 -04:00
Dan Walsh
da07333345 Allow mozilla_plugin to create nsplugin_home_t directories 
Allow hugetlbfs_t to be on device_t file system
Fix for ajaxterm policy
Fix type in dbus_delete_pid_files
Change openvpn to only allow search of users home dir
 2010-09-09 09:55:31 -04:00
Dan Walsh
5f5963be01 add policy for ajaxterm 2010-09-09 07:11:32 -04:00
Dan Walsh
4c38170781 add policy for ajaxterm 2010-09-09 07:10:24 -04:00
Dan Walsh
ee4b1e0aad Allow crond to manage user_spool_cron_t link files 
Allow init to delete dbus message.pid
Allow init and udev to create hugetlbfs directories
 2010-09-08 17:54:31 -04:00
Dan Walsh
a75a591e52 Allow virt_domains to exec qumu_exec_t, add boolean to allow svirt_t to connect to x 2010-09-08 15:05:08 -04:00
Dan Walsh
dfe675b8f7 Mozilla_plugin needs to getattr on tmpfs and no longer needs to write to tmpfs_t 
cleanup of nsplugin interface definition
Latest pm-utils is causing lots of domains to see a leaked lock file
I want mplayer to run as unconfined_execmem_t
mountpoint is causing dbus and init apps to getattr on all filesystems directories
Miroslav update dkim-milter
NetworkManager dbus chats with init
Allow apps that can read user_fonts_t to read the symbolic link
udev needs to manage etc_t
 2010-09-08 12:06:20 -04:00
Dan Walsh
5dd0c28461 Cleanup warnings 2010-09-08 10:43:22 -04:00
Dan Walsh
689bfef3a8 Fix apache interface 2010-09-08 10:29:40 -04:00
Dan Walsh
f79af26649 fix bad patch in xserver 2010-09-08 10:25:03 -04:00
Dan Walsh
0745e42559 fix typo in xserver_stream_connect 2010-09-08 09:29:02 -04:00
Dan Walsh
db879987ca Fix pootle 2010-09-07 16:32:23 -04:00
Dan Walsh
f5b49a5e0b Allow iptables to read shorewall tmp files 
Change chfn and passwd to use auth_use_pam so they can send dbus messages to fprintd
label vlc as an execmem_exec_t
Lots of fixes for mozilla_plugin to run google vidio chat
Allow telepath_msn to execute ldconfig and its own tmp files
Fix labels on hugepages
Allow mdadm to read files on /dev
Remove permissive domains and change back to unconfined
Allow freshclam to execute shell and bin_t
Allow devicekit_power to transition to dhcpc
Add boolean to allow icecast to connect to any port
 2010-09-07 16:23:09 -04:00
Dan Walsh
ef98a37444 Allow gpg_pinentry_t to use fifo files of apps that transition to gpg_agent 
Add mozilla_plugin_tmp_t
Allow mozilla_plugin to interact with pulseaudio tmpfs_t
Add apache labels for poodle
Add boolean to allow apache to connect to memcache_port
nagious sends signal and sigkill to system_mail_t
 2010-09-03 17:06:40 -04:00
Dan Walsh
a668127367 Allow certmaster to read usr_t files. All python apps are going to need this. 
clvmd creates tmpfs files that corosync needs to communicate with
Allow dbus system services to search the cgroup_t directory
 2010-09-02 13:38:00 -04:00
Dan Walsh
cbadf720ba Merge branch 'master' of http://oss.tresys.com/git/refpolicy 
Conflicts:
	policy/modules/kernel/domain.if
	policy/modules/services/xserver.te
 2010-09-01 14:11:18 -04:00