rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity
3,150 Commits 9 Branches 105 Tags 34 MiB
e66aa74b4a
Commit Graph

912 Commits

Author SHA1 Message Date
Dominick Grift
f66acfd9f2 Use permission sets where possible. 
Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.
 2010-09-20 18:15:57 +02:00
Dominick Grift
db775a32ca Redundant; unused interface plus ypbind_t is not a pid file type. 2010-09-20 18:15:57 +02:00
Dominick Grift
ce87242fca Search parent directory to be able to interact with targets content. 
Search parent directory to be able to interact with targets content.

Search parent directory to be able to interact with targets content.

Search parent directory to be able to interact with targets content.

Search parent directory to be able to interact with targets content.

Search parent directory to be able to interact with targets content.

Search parent directory to be able to interact with targets content.

Search parent directory to be able to interact with targets content.

Fix typo.
Squash me with f7691806b4a54f3debfabaa403e1472acc17427e
 2010-09-20 18:15:55 +02:00
Dominick Grift
dc47bf2b65 Onlt distro redhat currently implements admin_home_t. 2010-09-20 18:15:30 +02:00
Dominick Grift
4e8c6986a2 This type is not required here. 2010-09-20 18:15:30 +02:00
Dominick Grift
d017064d51 Missing required type. 2010-09-20 18:15:29 +02:00
Dominick Grift
1976ddda24 Whitespace, newline and tab fixes. 
Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.
 2010-09-20 18:15:28 +02:00
Dominick Grift
e8ea772d89 Allow users to ptrace and send any signal to their lpd agent. 
Allow users to ptrace and send any signal to their mock agent.
 2010-09-20 18:13:53 +02:00
Dominick Grift
c0ad94be4a Reduntant: getattr_sock_files_pattern already permit this. 2010-09-20 18:13:53 +02:00
Dominick Grift
1c45e20097 Reduntant: stream_connect_pattern already permits this. 2010-09-20 18:13:53 +02:00
Dominick Grift
74d74b9c2c Reduntant: unused, use hal_read_state instead if possible. 2010-09-20 18:13:53 +02:00
Dominick Grift
bece7c48bb Use stream connect pattern. 
Use stream connect pattern.
 2010-09-20 18:13:50 +02:00
Dominick Grift
ab33cc0cf1 I made a mistake in 618ce85f86, but as it turns out this interface is not required at all. 2010-09-17 15:05:25 +02:00
Dominick Grift
9fa4defbd4 Use permission sets where possible. 
Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Squash with 84812bc8dd814709734c2b6d1ef2ff2b84adc35d
Syntax error.
 2010-09-17 14:32:48 +02:00
Dominick Grift
4b1644f447 Whitespace, newline and tab fixes. 
Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.
 2010-09-17 14:32:47 +02:00
Dominick Grift
3c484f5bdc XML summary fixes. 
XML summary fixes.

XML summary fixes.

XML summary fixes.

XML summary fixes.

XML summary fixes.

XML summary fixes.

XML summary fixes.

XML summary fixes.

XML summary fixes.

XML summary fixes.

XML summary fixes.

XML summary fixes.

XML summary fixes.
 2010-09-17 14:32:47 +02:00
Dominick Grift
86f9f96664 The ps_process_pattern includes permission to get attributes of target domain. 2010-09-17 14:32:47 +02:00
Dominick Grift
6bb4d401ee Replace type and attributes statements by comma delimiters where possible. 
Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.
 2010-09-17 14:32:47 +02:00
Dominick Grift
25e284d727 This is a role capability. 
This is a role capability.

This is a role capability.

This is a role capability.

This is a role capability.

This is a role capability.

This is a role capability.
 2010-09-17 14:32:47 +02:00
Dominick Grift
f6bcb24b48 Tunable and optional policy goes below. 
Tunable and optional policy goes below.
 2010-09-17 14:32:47 +02:00
Dominick Grift
b11ba46f38 Use entry_file as entry_point to domain transition. 
Squash with e9f4178aa052c15ac7919a06e0c226b846ef7c7b
Duplicate TE rule.
 2010-09-17 14:32:47 +02:00
Dominick Grift
28fdb87aed Move system type alias statements to system declarations. 
Squash me with 81a5e7c5394ee93d99df472199737cd61f3c24eb
Without this build fails because at the point httpd_var_run_t is not yet declared.
 2010-09-17 14:32:47 +02:00
Dominick Grift
b5d5518bb4 Add file context specification for HOME_DIR/\.gitaliases. May not be required but cannot hurt either. 2010-09-17 14:32:47 +02:00
Dominick Grift
618ce85f86 Use can_exec. 2010-09-17 14:32:47 +02:00
Dominick Grift
1e92803c62 Search parent directory to be able to interact with targets content. 
Search parent directory to be able to interact with targets content.

Search parent directory to be able to interact with targets content.

Search parent directory to be able to interact with targets content.

Search parent directory to be able to interact with targets content.

Search parent directory to be able to interact with targets content.

Search parent directory to be able to interact with targets content.

Search parent directory to be able to interact with targets content.

Search parent directory to be able to interact with targets content.

Search parent directory to be able to interact with targets content.
 2010-09-17 14:32:47 +02:00
Dominick Grift
89bb445d84 This is not a role capability. 2010-09-17 14:32:47 +02:00
Dominick Grift
dd0d453cdf Allow users to ptrace and send any signal to their bluetooth helper agent. 
Allow users to prtrace and send any signal to their cron job.

Allow users to prtrace and send any signal to their cron job.

Allow users to prtrace and send any signal to their cron job.

Allow users to ps, ptrace and send any signal to their session bus.
 2010-09-17 14:32:47 +02:00
Dominick Grift
2d6615cf20 Class is supposed to be fifo_file according to summary. 2010-09-17 14:32:47 +02:00
Dominick Grift
eb0e0bcca5 Use domtrans_pattern. 2010-09-17 14:32:47 +02:00
Dominick Grift
0293695add Use stream connect pattern. 2010-09-17 14:32:46 +02:00
Dominick Grift
9b26005b06 Clean up (network) connect DB. 2010-09-17 14:32:46 +02:00
Dominick Grift
7fa5a68a82 Boolean declarations go above. 2010-09-17 14:32:46 +02:00
Dominick Grift
c5eae5f83c Whitespace, newline and tab fixes. 
Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.
 2010-09-17 14:32:43 +02:00
Dominick Grift
1b1f7d01a9 This is a leftover from refpolicy implementation of this functionality. 2010-09-17 14:29:50 +02:00
Dominick Grift
bbdbce34c2 No need for httpd_builtin_scripting to be set for httpd_t to be allowed to read files. 2010-09-17 14:29:50 +02:00
Dominick Grift
c53b75bdd2 Change this functionality to our implementation of this functionality. 2010-09-17 14:29:50 +02:00
Dan Walsh
8c47ad04ba Remove accedentlay added ~ files 2010-09-16 17:48:39 -04:00
Dan Walsh
0a394bf04f Add vnstat policy 
allow logrotate to mail syslog files
Allow chrom-sandbox to search nfs_t
Allow libvirt to send audit messages
Dontaudit leaked console to xauth
 2010-09-16 17:46:06 -04:00
Miroslav Grepl
be5142fc6f Fixes for cluster policy 2010-09-16 13:44:53 +02:00
Dan Walsh
14ffaf836d Merge upstream 2010-09-16 07:05:26 -04:00
Dan Walsh
a55bb56954 Merge branch 'master' of ssh://git.fedorahosted.org/git/selinux-policy 2010-09-16 06:38:13 -04:00
Dominick Grift
9c9e4c8180 This is a role capability. 
This is a role capability.

This is a role capability.

Signed-off-by: Dominick Grift <domg472@gmail.com>

This is a role capability.

This is a role capability.
 2010-09-16 12:18:34 +02:00
Dominick Grift
0dacd040c3 Whitespace, newline and tab fixes. 2010-09-16 12:18:34 +02:00
Dominick Grift
23ac318d30 Requires system_r role. 2010-09-16 12:18:33 +02:00
Dominick Grift
2f94f46028 Replace type and attributes statements by comma delimiters where possible. 
Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.

Signed-off-by: Dominick Grift <domg472@gmail.com>

Replace type and attributes statements by comma delimiters where possible.

Replace type and attributes statements by comma delimiters where possible.
 2010-09-16 12:18:33 +02:00
Dominick Grift
2de2341198 Use ps_process_pattern to read state. 
Signed-off-by: Dominick Grift <domg472@gmail.com>

Use ps_process_pattern to read state.

Use ps_process_pattern to read state.
 2010-09-16 12:18:33 +02:00
Dominick Grift
819518c273 The ps_process_pattern includes permission to get attributes of target domain. 
The ps_process_pattern includes permission to get attributes of target domain.

The ps_process_pattern includes permission to get attributes of target domain.

The ps_process_pattern includes permission to get attributes of target domain.

Signed-off-by: Dominick Grift <domg472@gmail.com>

The ps_process_pattern includes permission to get attributes of target domain.

The ps_process_pattern includes permission to get attributes of target domain.

The ps_process_pattern includes permission to get attributes of target domain.

The ps_process_pattern includes permission to get attributes of target domain.

The ps_process_pattern includes permission to get attributes of target domain.
 2010-09-16 12:18:33 +02:00
Dominick Grift
dcf87460eb Whitespace, newline and tab fixes. 
Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Signed-off-by: Dominick Grift <domg472@gmail.com>

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.
 2010-09-16 12:18:33 +02:00
Dominick Grift
59c0340548 Use permission sets where possible. 
Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Signed-off-by: Dominick Grift <domg472@gmail.com>

Use permission sets where possible.

Signed-off-by: Dominick Grift <domg472@gmail.com>

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.

Use permission sets where possible.
 2010-09-16 12:18:33 +02:00
Dominick Grift
ba6db03dc0 Redundant: mta_sendmail_domtrans calls domtrans_pattern which already includes these permissions. 2010-09-16 12:18:33 +02:00
Dominick Grift
b35d259348 XML summary ffixes. 
XML summary fixes.

Signed-off-by: Dominick Grift <domg472@gmail.com>

XML summary fixes.
 2010-09-16 12:18:33 +02:00
Dominick Grift
f92662114a Search parent directory to be able to interact with target content. 
Search parent directory to be able to interact with target content.

Search parent directory to be able to interact with target content.

Signed-off-by: Dominick Grift <domg472@gmail.com>

Search parent directory to be able to interact with target content.

Search parent directory to be able to interact with target content.

Signed-off-by: Dominick Grift <domg472@gmail.com>

Search parent directory to be able to interact with target content.

Search parent directory to be able to interact with target content.

Search parent directory to be able to interact with target content.
 2010-09-16 12:18:33 +02:00
Dominick Grift
4ff4ddfaa3 Allow users to ptrace and send any kind of signal to spamassassin agents. 2010-09-16 12:18:33 +02:00
Dominick Grift
c5caddd673 This type is not required here. 2010-09-16 12:18:33 +02:00
Dominick Grift
b0e9aaafb9 This is not a role capability. 
This is not a role capability.

Signed-off-by: Dominick Grift <domg472@gmail.com>

This is not a role capability.
 2010-09-16 12:18:31 +02:00
Dominick Grift
a3d20a3c3a Use relabel permission sets where possible. 2010-09-16 12:18:31 +02:00
Dominick Grift
9a2fd7d144 Redundant: This is included with userdom_read_user_home_content_files. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-16 12:18:31 +02:00
Dominick Grift
50e85752ad Allow users to ptrace and send any kind of signal to their ssh agent instead of only a generic signal. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-16 12:18:31 +02:00
Dominick Grift
f416df73dd Redundant: This is included with userdom_search_user_home_content. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-16 12:18:31 +02:00
Dominick Grift
a87e8f736c Redundant: domtrans_pattern includes these. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-16 12:18:31 +02:00
Dominick Grift
d0b7562f02 Do not audit interface should not provide permission to read parent directories. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-16 12:18:31 +02:00
Dominick Grift
5ebd1a52a5 Use domtrans_pattern because it include permission the sigchld target domain and other required access to domain transition. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-16 12:18:31 +02:00
Dominick Grift
2d102f8402 Whitespace, newline and tab fixes. 
Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Whitespace, newline and tab fixes.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-16 12:18:31 +02:00
Dominick Grift
60d27bf8ab Tunable, optional, if(n)def block go below. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-16 10:43:14 +02:00
Dominick Grift
2e2a24e07d Use stream_connect_pattern. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-16 10:43:14 +02:00
Dan Walsh
4d71bc3534 Merge branch 'master' of ssh://git.fedorahosted.org/git/selinux-policy 2010-09-15 16:06:43 -04:00
Dominick Grift
83029ff3c5 Use relabel permission sets where possible. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:29 +02:00
Dominick Grift
4ec4a49e8a Add missing admin_patterns to rpcbind_admin. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:29 +02:00
Dominick Grift
ac13ad949b Use stream connect pattern. 
Use stream_connect_pattern.

Use stream_connect_pattern.

Use stream_connect_pattern.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:29 +02:00
Dominick Grift
ad424545db Use ps_process_pattern to read state. 
Use ps_process_pattern.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:29 +02:00
Dominick Grift
87cd6eef3a Reduntant: Is already included with userdom_search_user_home_dirs. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:29 +02:00
Dominick Grift
4eaffd271f Access to get attributes of target pppd_t domain is included with ps_process_pattern. 
Access to get attributes of target privoxy_t domain is included with ps_process_pattern.

Access to get attributes of target radiusd_t domain is included with ps_process_pattern.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:29 +02:00
Dominick Grift
39e118bc15 Use ps_process_pattern to read state. Access to get attributes of target afs_t domain is included with ps_process_pattern. 
Use ps_process_pattern to read state. Access to get attributes of target boinc_t domain is included with ps_process_pattern.

Use ps_process_pattern to read state. Access to get attributes of target cobblerd_t domain is included with ps_process_pattern.

Use ps_process_pattern to read state. Permission to get attributes of target exim_t domain is included with ps_process_pattern.

Use ps_process_pattern to read state. Access to get attributes of target plymouthd_t domain is included with ps_process_pattern.

Use ps_process_pattern to read state. Access to get attributes of target pportreserve_t domain is included with ps_process_pattern.

Use ps_process_pattern to read state. Access to get attributes of target postfix domains is included with ps_process_pattern.

Use ps_process_pattern to read state. Permission to get attributes of target qpidd_t domain is included with ps_process_pattern.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
1215dfb87c Allow pads_admin to search parent directories to be able to interact with pads content. 
Allow plymouthd_admin to search parent directories to be able to interact with plymouthd content.

Allow postgresql admin to search parent directories to be able to manage postgresql content.

Allow prelude_admin to search parent directories to be able to manage prelude content.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
d183137edb XML summary fix. 
XML summary fix.

XML summary fix.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
dcbbeeada3 Access to get attributes of target accountsd_t domain is included with ps_process_pattern. 
Permission to get attributes of target arpwatch_t domain is included with ps_process_pattern.

Access to get attributes of target asterisk_t domain is included with ps_process_pattern.

Permission to get attributes of target automount_t domain is included with ps_process_pattern.

Access to get attributes of target ntpd_t domain is included with ps_process_pattern.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
b6d0a79f2c Use admin_pattern. Allow nslcd_admin to search parent directories to be able to interact with nslcd content. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
eb12bc3076 Source is required to search generic pid directories to be able to interact with mysql sockets in var_run. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
f386b9002d Use the stream_connect_pattern. 
Use stream_connect_pattern.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
c5e7db7a71 Allow mpd_admin to manage mpd tmpfs content. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
0ba923e7d9 Source is required to search generic tmpfs directories to be able to interact with mpd tmpfs content. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
0ab415250b Redundant: mpd_search_lib already includes files_search_var_lib. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
7d34935ff2 Memcached_admin is required to search generic pid directories to be able to manage memcached pid content. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
aa5baa96ed Allow icecast_admin to ptrace and signal the icecast_t domain. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
4b81a55013 This is redundant since base user can search generic proc directories and included ps_process_pattern call permits all else. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
7d36c9fa13 Permission to search proc_t directories is required to be able to read abrt state. 
Signed-off-by: Dominick Grift <domg472@gmail.com>

Permission to search generic proc directories is required to read hald_t state.
 2010-09-15 17:42:28 +02:00
Dominick Grift
b36824efdf Permit fetchmail_admin to ptrace and signal the fetchmail_t domain. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
cf152b4953 Replace some type statements by comma delimiters. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
47cf98ddd5 Permission to get attributes of target devicekit_t, devicekit_disk_t and devicekit_power_t domains are included with ps_process_patterns. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:28 +02:00
Dominick Grift
5ecaacae61 Type system_cronjob_var_run_t is not required here. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:27 +02:00
Dominick Grift
beb9c35b25 Types crontab_exec_t, cron_spool_t and user_cron_spool_t are required here. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:27 +02:00
Dominick Grift
d8d33a15bf Permission to search generic pid directories is included with files_pid_filetrans. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:27 +02:00
Dominick Grift
0540e22fcc Use ps_process_pattern to read state. Permission to seach proc_t directories is required to read automount state. 
Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-15 17:42:27 +02:00
Dan Walsh
9461b60657 Add the ability to send audit messages to confined admin policies 
Remove permissive domain from cmirrord and dontaudit sys_tty_config
Split out unconfined_domain() calls from other unconfined_ calls so we can disable unconfined.pp and leave unconfineduser
virt needs to be able to read processes to clearance for MLS
 2010-09-15 11:31:20 -04:00
Miroslav Grepl
3b0a9c74bb Allow iscsid to manage tgtd semaphores 2010-09-15 16:50:07 +02:00
Chris PeBenito
fee48647ac Module version bump for c17ad38 5271920 2a2b6a7 01c4413 c4fbfae a831710 
67effb0 483be01 c6c63f6 b0d8d59 5b082e4 b8097d6 689d954 5afc3d3 f3c5e77
a59e50c cf87233 17759c7 dc1db54 e9bf16d 4f95198 bf40792 622c63b c20842c
dc7cc4d 792d448
 2010-09-15 10:42:34 -04:00
Jeremy Solt
792d44840c radvd patch from Dan Walsh 2010-09-15 09:14:55 -04:00
Jeremy Solt
dc7cc4d5c1 snort patch from Dan Walsh 2010-09-15 09:14:55 -04:00
Jeremy Solt
c20842caf8 stunnel patch from Dan Walsh 2010-09-15 09:14:55 -04:00
Jeremy Solt
622c63b4e3 zabbix patch from Dan Walsh 2010-09-15 09:14:55 -04:00
Jeremy Solt
bf40792ae5 zebra patch from Dan Walsh 2010-09-15 09:14:54 -04:00
Jeremy Solt
e9bf16d2d9 certmaster patch from Dan Walsh 2010-09-15 09:14:54 -04:00
Jeremy Solt
dc1db5407a pcscd patch from Dan Walsh 
Edit: removed the dev_list_sysfs call, dev_read_sysfs takes care of it
 2010-09-15 09:14:54 -04:00
Jeremy Solt
17759c7326 postgresql patch from Dan Walsh 2010-09-15 09:14:54 -04:00
Jeremy Solt
cf872339b2 postgrey patch from Dan Walsh 2010-09-15 09:14:54 -04:00
Jeremy Solt
a59e50c12c prelude patch from Dan Walsh 2010-09-15 09:14:54 -04:00
Jeremy Solt
b8097d6ec4 amavis patch from Dan Walsh 2010-09-15 09:14:53 -04:00
Jeremy Solt
5b082e4acf arpwatch patch from Dan Walsh 2010-09-15 09:14:53 -04:00
Jeremy Solt
b0d8d59ff0 canna patch from Dan Walsh 2010-09-15 09:14:53 -04:00
Jeremy Solt
c6c63f63c7 certmonger patch from Dan Walsh 2010-09-15 09:14:53 -04:00
Jeremy Solt
483be01302 courier patch from Dan Walsh 2010-09-15 09:14:53 -04:00
Jeremy Solt
67effb0450 dcc patch from Dan Walsh 2010-09-15 09:14:53 -04:00
Jeremy Solt
a831710a6a style change to djbdns.te 2010-09-15 09:14:52 -04:00
Jeremy Solt
c4fbfaecdd fetchmail patch from Dan Walsh 2010-09-15 09:14:52 -04:00
Jeremy Solt
01c441355e icecast patch from Dan Walsh 2010-09-15 09:14:52 -04:00
Jeremy Solt
2a2b6a79fa nslcd patch from Dan Walsh 2010-09-15 09:14:52 -04:00
Jeremy Solt
5271920764 nut patch from Dan Walsh 2010-09-15 09:14:52 -04:00
Jeremy Solt
c17ad385ac openct patch from Dan Walsh 2010-09-15 09:14:52 -04:00
Dan Walsh
c2dae98501 Allow a couple of sandbox issues. 
Remove postgresl managing of etc_files, until I find out why it is needed.
Dontaudit leaks from rpm to mount
 2010-09-14 10:02:43 -04:00
Dan Walsh
5ef740e54b Fix gnome_setattr_config_home 
Allow exec of sandbox_file_type by calling apps
Fix typos
 2010-09-13 14:47:02 -04:00
Dan Walsh
3034a8d941 Fix some names in passenger policy 2010-09-13 10:26:10 -04:00
Miroslav Grepl
94820e4290 Move passenger policy to services 2010-09-13 15:10:30 +02:00
Dan Walsh
536f28a2bf Merge branch 'master' of ssh://git.fedorahosted.org/git/selinux-policy 2010-09-13 08:43:40 -04:00
Dan Walsh
1a40cbf63e Fix boolean descriptions 2010-09-13 08:43:35 -04:00
Miroslav Grepl
3a3212619a Allow dovecot-deliver to create tmp files 
Allow tor to send signals to itself
 2010-09-13 13:12:24 +02:00
Miroslav Grepl
d7de04f8d4 - Add passenger policy 2010-09-13 11:49:37 +02:00
Dan Walsh
366396d855 Fix cert calls in telepath, boinc, kerberos 
Add sys_admin to xend to allow it to start
Add oident calls to staff_t
 2010-09-10 13:18:49 -04:00
Dan Walsh
cab9bc9c58 Merge branch 'master' of ssh://git.fedorahosted.org/git/selinux-policy; branch 'master' of http://oss.tresys.com/git/refpolicy 
Conflicts:
	policy/modules/admin/amanda.if
	policy/modules/system/init.te
	policy/modules/system/miscfiles.if
	policy/modules/system/miscfiles.te
	policy/modules/system/userdomain.if
 2010-09-10 13:02:25 -04:00
Dan Walsh
0b8f4cfe16 More fixes for mozilla_plugin_t 
Allow telepathy domains to send themselves sigkill
Label /etc/httpd/alias/*db as cert_t
Allow fprintd to sys_nice
 2010-09-10 12:10:13 -04:00
Chris PeBenito
da12b54802 Module version bumps for cert patch. 2010-09-10 11:31:22 -04:00
Chris PeBenito
e9d6dfb8b1 Fix missed deprecated interface usage from the cert patch. Add back a few rolecap tags. 2010-09-10 11:31:00 -04:00
Dominick Grift
8340621920 Implement miscfiles_cert_type(). 
This is based on Fedoras' miscfiles_cert_type implementation.
The idea was that openvpn needs to be able read home certificates (home_cert_t) which is not implemented in refpolicy yet, as well as generic cert_t certificates.

Note that openvpn is allowed to read all cert_types, as i know that it needs access to both generic cert_t as well as (future) home_cert_t. Dwalsh noted that other domains may need this as well but because i do not know exactly which domains i will not changes any other domains call to generic cert type interfaces.

Signed-off-by: Dominick Grift <domg472@gmail.com>
 2010-09-10 11:05:46 -04:00
Dan Walsh
1a82786cc8 Allow hugetlbfs_t to be on device_t file system 
Allow sudo domains to signal user domains
Dontaudit xdm_t sending signals to all domains
Fix allow_exec* boolean descriptions
 2010-09-10 10:10:34 -04:00
Dan Walsh
8e47c02b16 fixes for openvpn suggested by dgrift 2010-09-09 10:35:27 -04:00
Dan Walsh
da07333345 Allow mozilla_plugin to create nsplugin_home_t directories 
Allow hugetlbfs_t to be on device_t file system
Fix for ajaxterm policy
Fix type in dbus_delete_pid_files
Change openvpn to only allow search of users home dir
 2010-09-09 09:55:31 -04:00
Dan Walsh
5f5963be01 add policy for ajaxterm 2010-09-09 07:11:32 -04:00
Dan Walsh
4c38170781 add policy for ajaxterm 2010-09-09 07:10:24 -04:00
Dan Walsh
ee4b1e0aad Allow crond to manage user_spool_cron_t link files 
Allow init to delete dbus message.pid
Allow init and udev to create hugetlbfs directories
 2010-09-08 17:54:31 -04:00
Dan Walsh
a75a591e52 Allow virt_domains to exec qumu_exec_t, add boolean to allow svirt_t to connect to x 2010-09-08 15:05:08 -04:00
Dan Walsh
dfe675b8f7 Mozilla_plugin needs to getattr on tmpfs and no longer needs to write to tmpfs_t 
cleanup of nsplugin interface definition
Latest pm-utils is causing lots of domains to see a leaked lock file
I want mplayer to run as unconfined_execmem_t
mountpoint is causing dbus and init apps to getattr on all filesystems directories
Miroslav update dkim-milter
NetworkManager dbus chats with init
Allow apps that can read user_fonts_t to read the symbolic link
udev needs to manage etc_t
 2010-09-08 12:06:20 -04:00
Dan Walsh
5dd0c28461 Cleanup warnings 2010-09-08 10:43:22 -04:00
Dan Walsh
689bfef3a8 Fix apache interface 2010-09-08 10:29:40 -04:00
Dan Walsh
f79af26649 fix bad patch in xserver 2010-09-08 10:25:03 -04:00
Dan Walsh
0745e42559 fix typo in xserver_stream_connect 2010-09-08 09:29:02 -04:00
Dan Walsh
db879987ca Fix pootle 2010-09-07 16:32:23 -04:00
Dan Walsh
f5b49a5e0b Allow iptables to read shorewall tmp files 
Change chfn and passwd to use auth_use_pam so they can send dbus messages to fprintd
label vlc as an execmem_exec_t
Lots of fixes for mozilla_plugin to run google vidio chat
Allow telepath_msn to execute ldconfig and its own tmp files
Fix labels on hugepages
Allow mdadm to read files on /dev
Remove permissive domains and change back to unconfined
Allow freshclam to execute shell and bin_t
Allow devicekit_power to transition to dhcpc
Add boolean to allow icecast to connect to any port
 2010-09-07 16:23:09 -04:00
Dan Walsh
ef98a37444 Allow gpg_pinentry_t to use fifo files of apps that transition to gpg_agent 
Add mozilla_plugin_tmp_t
Allow mozilla_plugin to interact with pulseaudio tmpfs_t
Add apache labels for poodle
Add boolean to allow apache to connect to memcache_port
nagious sends signal and sigkill to system_mail_t
 2010-09-03 17:06:40 -04:00
Dan Walsh
a668127367 Allow certmaster to read usr_t files. All python apps are going to need this. 
clvmd creates tmpfs files that corosync needs to communicate with
Allow dbus system services to search the cgroup_t directory
 2010-09-02 13:38:00 -04:00
Dan Walsh
cbadf720ba Merge branch 'master' of http://oss.tresys.com/git/refpolicy 
Conflicts:
	policy/modules/kernel/domain.if
	policy/modules/services/xserver.te
 2010-09-01 14:11:18 -04:00
Chris PeBenito
785ee7988c Module version bump and changelog entry for conditional mmap_zero patch. 2010-09-01 10:08:09 -04:00