Commit Graph

271 Commits

Author SHA1 Message Date
Chris PeBenito 7fc72a02d9 Changelog and version bump for X object manager changes. 2009-12-03 10:40:42 -05:00
Chris PeBenito a404bc39a7 update VERSION and Changelog for release. 2009-11-17 10:17:43 -05:00
Chris PeBenito e6d8fd1e50 additional cleanup for e877913. 2009-11-11 11:28:50 -05:00
Chris PeBenito 222d5b5987 clean up 0bca409 and add changelog entry. 2009-11-03 09:25:37 -05:00
Chris PeBenito b04669aaea add tuned from miroslav grepl. 2009-10-26 09:42:11 -04:00
Chris PeBenito c5967300e2 add changelog entry for e4928c5f79 2009-10-22 09:22:14 -04:00
Chris PeBenito 4be8dd10b9 add seunshare from dan. 2009-09-28 15:40:06 -04:00
Chris PeBenito 5a6b1fe2b4 add dkim from stefan schulze frielinghaus. 2009-09-17 09:12:33 -04:00
Chris PeBenito 21b1d1096f add gnomeclock from dan. 2009-09-16 08:38:58 -04:00
Chris PeBenito ed70158a39 add rtkit from dan. 2009-09-15 09:53:24 -04:00
Chris PeBenito 1d3b9e384c clean up xscreensaver. 2009-09-15 09:41:42 -04:00
Chris PeBenito c141d835f1 add modemmanager from dan. 2009-09-14 09:48:13 -04:00
Chris PeBenito e3a90e358a add abrt from dan. 2009-09-14 09:22:24 -04:00
Chris PeBenito 81bca10b28 nslcd policy from dan. 2009-09-08 10:31:19 -04:00
Chris PeBenito dbed95369c add gitosis from miroslav grepl. 2009-09-03 09:52:08 -04:00
Chris PeBenito 625be1b4e6 add shorewall from dan. 2009-09-02 08:58:52 -04:00
Chris PeBenito 71965a1fc5 add kdump from dan. 2009-09-02 08:33:25 -04:00
Chris PeBenito aa83007d5a add hddtemp from dan. 2009-09-01 08:34:04 -04:00
Chris PeBenito 93c49bdb04 deprecate userdom_xwindows_client_template
The X policy for users is currently split between
userdom_xwindows_client_template() and xserver_role().  Deprecate
the former and put the rules into the latter.

For preserving restricted X roles (xguest), divide the rules
into xserver_restricted_role() and xserver_role().
2009-08-28 13:29:36 -04:00
Chris PeBenito 62c80e2546 module version bumps and changelog update for the previous 3 commits. 2009-08-18 13:20:01 -04:00
Chris PeBenito 909922027b Debian policykit fixes from Martin Orr.
The policykit binaries on Debian live in /usr/lib/policykit so add file
contexts for that.  Also a couple of policykit rules.
2009-08-18 09:49:31 -04:00
Chris PeBenito b2648249d9 Fix unconfined_r use of unconfined_java_t.
The unconfined role is running java in the unconfined_java_t.  The current
policy only has a domtrans interface, so the unconfined_java_t domain is not
added to unconfined_r.  Add a run interface and change the unconfined module
to use this new interface.
2009-08-17 13:19:26 -04:00
Chris PeBenito 4254cec711 Add missing x_device rules for XI2 functions, from Eamon Walsh.
> Whats the difference between add/remove and create/destroy?
>
> The devices are in a kind of hierarchy.  You can now create one or more
> "master devices" (mouse cursor and keyboard focus).  The physical input
> devices are "slave devices" that attach to master devices.
>
> Add/remove controls the ability to add/remove slave devices from a
> master device.  Create/destroy controls the ability to create new master
> devices.
2009-08-14 13:18:16 -04:00
Chris PeBenito 2a77737d4e Add missing rules to make unconfined_cronjob_t a valid cron job domain.
Unconfined_cronjob_t is not a valid cron job domain because the cron
module is lacking a transition from the crond to the unconfined_cronjob_t
domain.  This adds the transition and also a constraints exemption since
part of the transition is also a seuser and role change typically.
2009-08-12 14:15:39 -04:00
Chris PeBenito 0f5e26b620 Add btrfs and ext4 to labeling targets. 2009-08-11 09:01:58 -04:00
Chris PeBenito 90286f4292 Fix infrastructure to expand macros in initrc_context when installing.
The initrc_context file uses the mls_systemhigh macro and needs to be properly
expanded based on the build.conf settings.  Add makefile support to do this.
2009-08-10 14:00:34 -04:00
Chris PeBenito 02e594d5dc Handle unix_chkpwd usage by useradd and groupadd; fixes ticket #49. 2009-08-05 14:19:54 -04:00
Chris PeBenito e335910197 Add missing compatibility aliases for xdm_xserver*_t types.
When collapsing all of the xdm_xserver*_t types into xserver*_t, aliases for
compatibility were mistakenly not added to the policy.
2009-08-05 11:17:53 -04:00
Chris PeBenito 915dfa68b6 release 2.20090730 2009-07-30 14:35:47 -04:00
Chris PeBenito 64c7061e1a changelog entry for the previous gentoo fixes 2009-07-30 10:41:17 -04:00
Chris PeBenito 20c3ccee1a add fprintd module from dan. 2009-07-29 10:28:31 -04:00
Chris PeBenito 677c4c2fea add devicekit module from dan. 2009-07-29 10:02:06 -04:00
Chris PeBenito c7ae9ae1c8 Merge branch 'master' of ssh://oss.tresys.com/home/git/refpolicy 2009-07-28 08:00:03 -04:00
Chris PeBenito 5f6c30f8bd wm policy from dan 2009-07-27 15:11:22 -04:00
Chris PeBenito f4962ab15b add cpufreqselector from dan 2009-07-27 09:09:00 -04:00
Chris PeBenito 09516cb4be remove read_default_t tunable 2009-07-23 08:58:35 -04:00
Chris PeBenito 9b1907b217 add pulseaudio from dan. 2009-07-21 10:05:38 -04:00
Chris PeBenito dc0ab0f0c3 changelog for previous commit 2009-07-20 11:16:22 -04:00
Chris PeBenito 50824a99ca trunk: pads from dan. 2009-06-30 15:03:20 +00:00
Chris PeBenito 267d9c60c5 trunk: varnishd from dan. 2009-06-30 13:49:53 +00:00
Chris PeBenito c017ee17ab trunk: add sssd from dan. 2009-06-22 15:33:21 +00:00
Chris PeBenito c9c0d846de trunk: Greylist milter from Paul Howarth. 2009-06-18 14:36:35 +00:00
Chris PeBenito c7dc1c7222 trunk: Allow unix_update to change the security attributes associate with files so
that it can properly create the shadow file. Also allow it to read from
urandom so that it can add salt to the password hash.
2009-06-18 13:57:26 +00:00
Chris PeBenito df28a0c444 trunk: Misc fixes for unix_update from Brandon Whalen. 2009-06-18 13:36:40 +00:00
Chris PeBenito 95ea7d6986 trunk: Add x_device permissions for XI2 functions, from Eamon Walsh. 2009-06-18 13:07:23 +00:00
Chris PeBenito 16fd1fd814 trunk: MLS constraints for the x_selection class, from Eamon Walsh. 2009-06-05 13:36:19 +00:00
Chris PeBenito cca4a215fe trunk: add gpsd from miroslav grepl 2009-06-02 14:28:40 +00:00
Chris PeBenito 350ed89156 se-postgresql update from kaigai
- rework: Add a comment of "deprecated" for deprecated permissions.
- bugfix: MCS policy did not constrain the following permissions.
    db_database:{getattr}
    db_table:{getattr lock}
    db_column:{getattr}
    db_procedure:{drop getattr setattr}
    db_blob:{getattr import export}
- rework: db_table:{lock} is moved to reader side, because it makes
  impossible to refer read-only table with foreign-key constraint.
  (FK checks internally acquire explicit locks.)
- bugfix: some of permissions in db_procedure class are allowed
  on sepgsql_trusted_proc_t, but it is a domain, not a procedure.
  It should allow them on sepgsql_trusted_proc_exec_t.
  I also aliased sepgsql_proc_t as sepgsql_proc_exec_t to avoid
  such kind of confusion, as Chris suggested before.
- rework: we should not allow db_procedure:{install} on the
  sepgsql_trusted_proc_exec_t, because of a risk to invoke trusted
  procedure implicitly.
- bugfix: MLS policy dealt db_blob:{export} as writer-side permission,
  but it is required whrn the largeobject is refered.
- bugfix: MLS policy didn't constrain the db_procedure class.
2009-05-07 12:35:32 +00:00
Chris PeBenito da3ed0667f trunk: lircd from miroslav grepl 2009-05-06 15:09:46 +00:00
Chris PeBenito 3392356f36 trunk: 5 patches from dan. 2009-05-06 14:26:20 +00:00