418 lines
15 KiB
Diff
418 lines
15 KiB
Diff
diff -up serefpolicy-3.10.0/policy/modules/admin/rpm.te.execmem serefpolicy-3.10.0/policy/modules/admin/rpm.te
|
|
--- serefpolicy-3.10.0/policy/modules/admin/rpm.te.execmem 2011-11-04 16:05:06.562601281 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/admin/rpm.te 2011-11-04 16:05:07.166602835 -0400
|
|
@@ -419,14 +419,6 @@ optional_policy(`
|
|
unconfined_domain_noaudit(rpm_script_t)
|
|
unconfined_domtrans(rpm_script_t)
|
|
unconfined_execmem_domtrans(rpm_script_t)
|
|
-
|
|
- optional_policy(`
|
|
- java_domtrans_unconfined(rpm_script_t)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- mono_domtrans(rpm_script_t)
|
|
- ')
|
|
')
|
|
|
|
optional_policy(`
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/execmem.fc.execmem serefpolicy-3.10.0/policy/modules/apps/execmem.fc
|
|
--- serefpolicy-3.10.0/policy/modules/apps/execmem.fc.execmem 2011-11-04 16:05:06.586601343 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/execmem.fc 2011-11-04 16:05:07.167602836 -0400
|
|
@@ -47,3 +47,56 @@ ifdef(`distro_gentoo',`
|
|
/opt/Komodo-Edit-5/lib/mozilla/komodo-bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
/opt/Adobe/Reader9/Reader/intellinux/bin/acroread -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
/usr/local/Wolfram/Mathematica(/.*)?MathKernel -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+
|
|
+#
|
|
+# /opt
|
|
+#
|
|
+/opt/(.*/)?bin/java[^/]* -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/opt/ibm/java.*/(bin|javaws)(/.*)? -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/opt/local/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/opt/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/opt/local/MATLAB.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/opt/MATLAB.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+
|
|
+#
|
|
+# /usr
|
|
+#
|
|
+/usr/Aptana[^/]*/AptanaStudio -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/(.*/)?bin/java.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/bin/fastjar -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/bin/frysk -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/bin/gappletviewer -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/bin/gcj-dbtool -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/bin/gij -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/bin/gjarsigner -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/bin/gkeytool -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/bin/grmic -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/bin/grmiregistry -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/bin/jv-convert -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+
|
|
+/usr/lib(.*/)?bin/java[^/]* -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/lib/eclipse/eclipse -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/lib/jvm/java(.*/)bin(/.*)? -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/lib/opera(/.*)?/opera -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/lib/opera(/.*)?/works -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+
|
|
+/usr/local/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+
|
|
+/usr/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+
|
|
+/opt/ibm/lotus/Symphony/framework/rcp/eclipse/plugins(/.*)? -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/opt/ibm(/.*)?/eclipse/plugins(/.*)? -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+
|
|
+ifdef(`distro_redhat',`
|
|
+/usr/java/eclipse[^/]*/eclipse -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+')
|
|
+/usr/bin/mono.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+
|
|
+#
|
|
+# Conflicts with ada domain
|
|
+#
|
|
+/usr/bin/gnatbind -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/bin/gnatls -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/bin/gnatmake -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
+/usr/libexec/gcc(/.*)?/gnat1 -- gen_context(system_u:object_r:execmem_exec_t,s0)
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/execmem.if.execmem serefpolicy-3.10.0/policy/modules/apps/execmem.if
|
|
--- serefpolicy-3.10.0/policy/modules/apps/execmem.if.execmem 2011-11-04 16:05:06.587601346 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/execmem.if 2011-11-04 16:05:24.164646504 -0400
|
|
@@ -57,6 +57,7 @@ template(`execmem_role_template',`
|
|
role $2 types $1_execmem_t;
|
|
|
|
userdom_unpriv_usertype($1, $1_execmem_t)
|
|
+ userdom_common_user($1_execmem_t)
|
|
userdom_manage_tmp_role($2, $1_execmem_t)
|
|
userdom_manage_tmpfs_role($2, $1_execmem_t)
|
|
|
|
@@ -129,4 +130,3 @@ interface(`execmem_execmod',`
|
|
|
|
allow $1 execmem_exec_t:file execmod;
|
|
')
|
|
-
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/execmem.te.execmem serefpolicy-3.10.0/policy/modules/apps/execmem.te
|
|
--- serefpolicy-3.10.0/policy/modules/apps/execmem.te.execmem 2011-11-04 16:05:06.587601346 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/execmem.te 2011-11-04 16:05:07.169602840 -0400
|
|
@@ -4,7 +4,25 @@ policy_module(execmem, 1.0.0)
|
|
#
|
|
# Declarations
|
|
#
|
|
+attribute execmem_type;
|
|
|
|
-type execmem_exec_t alias unconfined_execmem_exec_t;
|
|
+type execmem_exec_t;
|
|
+typealias execmem_exec_t alias { unconfined_execmem_exec_t mono_exec_t java_exec_t };
|
|
application_executable_file(execmem_exec_t)
|
|
|
|
+allow execmem_type self:process { execmem execstack };
|
|
+files_execmod_tmp(execmem_type)
|
|
+execmem_execmod(execmem_type)
|
|
+
|
|
+optional_policy(`
|
|
+ gnome_read_usr_config(execmem_type)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ mozilla_execmod_user_home_files(execmem_type)
|
|
+')
|
|
+
|
|
+optional_policy(`
|
|
+ nsplugin_rw_shm(execmem_type)
|
|
+ nsplugin_rw_semaphores(execmem_type)
|
|
+')
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/mozilla.te.execmem serefpolicy-3.10.0/policy/modules/apps/mozilla.te
|
|
--- serefpolicy-3.10.0/policy/modules/apps/mozilla.te.execmem 2011-11-04 16:05:06.609601400 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/mozilla.te 2011-11-04 16:05:07.170602843 -0400
|
|
@@ -273,10 +273,6 @@ optional_policy(`
|
|
')
|
|
|
|
optional_policy(`
|
|
- java_domtrans(mozilla_t)
|
|
-')
|
|
-
|
|
-optional_policy(`
|
|
lpd_domtrans_lpr(mozilla_t)
|
|
')
|
|
|
|
@@ -456,7 +452,7 @@ optional_policy(`
|
|
')
|
|
|
|
optional_policy(`
|
|
- java_exec(mozilla_plugin_t)
|
|
+ execmem_exec(mozilla_plugin_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
diff -up serefpolicy-3.10.0/policy/modules/apps/podsleuth.te.execmem serefpolicy-3.10.0/policy/modules/apps/podsleuth.te
|
|
--- serefpolicy-3.10.0/policy/modules/apps/podsleuth.te.execmem 2011-06-27 14:18:04.000000000 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/apps/podsleuth.te 2011-11-04 16:05:07.171602846 -0400
|
|
@@ -85,5 +85,5 @@ optional_policy(`
|
|
')
|
|
|
|
optional_policy(`
|
|
- mono_exec(podsleuth_t)
|
|
+ execmem_exec(podsleuth_t)
|
|
')
|
|
diff -up serefpolicy-3.10.0/policy/modules/roles/staff.te.execmem serefpolicy-3.10.0/policy/modules/roles/staff.te
|
|
--- serefpolicy-3.10.0/policy/modules/roles/staff.te.execmem 2011-11-04 16:05:06.684601595 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/roles/staff.te 2011-11-04 16:05:07.172602849 -0400
|
|
@@ -266,10 +266,6 @@ ifndef(`distro_redhat',`
|
|
')
|
|
|
|
optional_policy(`
|
|
- java_role(staff_r, staff_t)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
lockdev_role(staff_r, staff_t)
|
|
')
|
|
|
|
diff -up serefpolicy-3.10.0/policy/modules/roles/sysadm.te.execmem serefpolicy-3.10.0/policy/modules/roles/sysadm.te
|
|
--- serefpolicy-3.10.0/policy/modules/roles/sysadm.te.execmem 2011-11-04 16:05:06.685601597 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/roles/sysadm.te 2011-11-04 16:05:07.173602852 -0400
|
|
@@ -530,10 +530,6 @@ ifndef(`distro_redhat',`
|
|
')
|
|
|
|
optional_policy(`
|
|
- java_role(sysadm_r, sysadm_t)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
lockdev_role(sysadm_r, sysadm_t)
|
|
')
|
|
|
|
diff -up serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te.execmem serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te
|
|
--- serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te.execmem 2011-11-04 16:05:07.157602811 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te 2011-11-04 16:05:07.173602852 -0400
|
|
@@ -302,10 +302,6 @@ optional_policy(`
|
|
')
|
|
|
|
optional_policy(`
|
|
- java_run_unconfined(unconfined_t, unconfined_r)
|
|
-')
|
|
-
|
|
-optional_policy(`
|
|
livecd_run(unconfined_t, unconfined_r)
|
|
')
|
|
|
|
@@ -322,13 +318,6 @@ optional_policy(`
|
|
')
|
|
|
|
optional_policy(`
|
|
- mono_role_template(unconfined, unconfined_r, unconfined_t)
|
|
- unconfined_domain_noaudit(unconfined_mono_t)
|
|
- role system_r types unconfined_mono_t;
|
|
-')
|
|
-
|
|
-
|
|
-optional_policy(`
|
|
mozilla_role_plugin(unconfined_r)
|
|
|
|
tunable_policy(`unconfined_mozilla_plugin_transition', `
|
|
diff -up serefpolicy-3.10.0/policy/modules/roles/unprivuser.te.execmem serefpolicy-3.10.0/policy/modules/roles/unprivuser.te
|
|
--- serefpolicy-3.10.0/policy/modules/roles/unprivuser.te.execmem 2011-11-04 16:05:06.688601603 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/roles/unprivuser.te 2011-11-04 16:05:07.174602855 -0400
|
|
@@ -152,10 +152,6 @@ ifndef(`distro_redhat',`
|
|
')
|
|
|
|
optional_policy(`
|
|
- java_role(user_r, user_t)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
lockdev_role(user_r, user_t)
|
|
')
|
|
|
|
diff -up serefpolicy-3.10.0/policy/modules/roles/xguest.te.execmem serefpolicy-3.10.0/policy/modules/roles/xguest.te
|
|
--- serefpolicy-3.10.0/policy/modules/roles/xguest.te.execmem 2011-11-04 16:05:06.690601610 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/roles/xguest.te 2011-11-04 16:05:07.175602857 -0400
|
|
@@ -107,14 +107,6 @@ optional_policy(`
|
|
')
|
|
|
|
optional_policy(`
|
|
- java_role_template(xguest, xguest_r, xguest_t)
|
|
-')
|
|
-
|
|
-optional_policy(`
|
|
- mono_role_template(xguest, xguest_r, xguest_t)
|
|
-')
|
|
-
|
|
-optional_policy(`
|
|
mozilla_run_plugin(xguest_usertype, xguest_r)
|
|
')
|
|
|
|
diff -up serefpolicy-3.10.0/policy/modules/services/boinc.te.execmem serefpolicy-3.10.0/policy/modules/services/boinc.te
|
|
--- serefpolicy-3.10.0/policy/modules/services/boinc.te.execmem 2011-11-04 16:05:06.724601698 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/services/boinc.te 2011-11-04 16:05:07.176602859 -0400
|
|
@@ -170,5 +170,5 @@ miscfiles_read_fonts(boinc_project_t)
|
|
miscfiles_read_localization(boinc_project_t)
|
|
|
|
optional_policy(`
|
|
- java_exec(boinc_project_t)
|
|
+ execmem_exec(boinc_project_t)
|
|
')
|
|
diff -up serefpolicy-3.10.0/policy/modules/services/cron.te.execmem serefpolicy-3.10.0/policy/modules/services/cron.te
|
|
--- serefpolicy-3.10.0/policy/modules/services/cron.te.execmem 2011-11-04 16:05:06.764601800 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/services/cron.te 2011-11-04 16:05:07.177602861 -0400
|
|
@@ -299,10 +299,6 @@ optional_policy(`
|
|
')
|
|
|
|
optional_policy(`
|
|
- mono_domtrans(crond_t)
|
|
-')
|
|
-
|
|
-optional_policy(`
|
|
amanda_search_var_lib(crond_t)
|
|
')
|
|
|
|
@@ -553,10 +549,6 @@ optional_policy(`
|
|
')
|
|
|
|
optional_policy(`
|
|
- mono_domtrans(system_cronjob_t)
|
|
-')
|
|
-
|
|
-optional_policy(`
|
|
mrtg_append_create_logs(system_cronjob_t)
|
|
')
|
|
|
|
@@ -710,11 +702,6 @@ tunable_policy(`fcron_crond',`
|
|
allow crond_t user_cron_spool_t:file manage_file_perms;
|
|
')
|
|
|
|
-# need a per-role version of this:
|
|
-#optional_policy(`
|
|
-# mono_domtrans(cronjob_t)
|
|
-#')
|
|
-
|
|
optional_policy(`
|
|
nis_use_ypbind(cronjob_t)
|
|
')
|
|
diff -up serefpolicy-3.10.0/policy/modules/services/hadoop.if.execmem serefpolicy-3.10.0/policy/modules/services/hadoop.if
|
|
--- serefpolicy-3.10.0/policy/modules/services/hadoop.if.execmem 2011-11-04 16:05:06.825601957 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/services/hadoop.if 2011-11-04 16:05:07.178602863 -0400
|
|
@@ -127,7 +127,7 @@ template(`hadoop_domain_template',`
|
|
|
|
hadoop_exec_config(hadoop_$1_t)
|
|
|
|
- java_exec(hadoop_$1_t)
|
|
+ execmem_exec(hadoop_$1_t)
|
|
|
|
kerberos_use(hadoop_$1_t)
|
|
|
|
diff -up serefpolicy-3.10.0/policy/modules/services/hadoop.te.execmem serefpolicy-3.10.0/policy/modules/services/hadoop.te
|
|
--- serefpolicy-3.10.0/policy/modules/services/hadoop.te.execmem 2011-11-04 16:05:06.826601961 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/services/hadoop.te 2011-11-04 16:05:07.179602865 -0400
|
|
@@ -167,7 +167,7 @@ miscfiles_read_localization(hadoop_t)
|
|
|
|
userdom_use_inherited_user_terminals(hadoop_t)
|
|
|
|
-java_exec(hadoop_t)
|
|
+execmem_exec(hadoop_t)
|
|
|
|
kerberos_use(hadoop_t)
|
|
|
|
@@ -342,7 +342,7 @@ sysnet_read_config(zookeeper_t)
|
|
userdom_use_inherited_user_terminals(zookeeper_t)
|
|
userdom_dontaudit_search_user_home_dirs(zookeeper_t)
|
|
|
|
-java_exec(zookeeper_t)
|
|
+execmem_exec(zookeeper_t)
|
|
|
|
########################################
|
|
#
|
|
@@ -427,4 +427,4 @@ miscfiles_read_localization(zookeeper_se
|
|
|
|
sysnet_read_config(zookeeper_server_t)
|
|
|
|
-java_exec(zookeeper_server_t)
|
|
+execmem_exec(zookeeper_server_t)
|
|
diff -up serefpolicy-3.10.0/policy/modules/services/xserver.te.execmem serefpolicy-3.10.0/policy/modules/services/xserver.te
|
|
--- serefpolicy-3.10.0/policy/modules/services/xserver.te.execmem 2011-11-04 16:05:07.050602537 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/services/xserver.te 2011-11-04 16:05:07.181602872 -0400
|
|
@@ -1250,10 +1250,6 @@ optional_policy(`
|
|
')
|
|
|
|
optional_policy(`
|
|
- mono_rw_shm(xserver_t)
|
|
-')
|
|
-
|
|
-optional_policy(`
|
|
rhgb_rw_shm(xserver_t)
|
|
rhgb_rw_tmpfs_files(xserver_t)
|
|
')
|
|
diff -up serefpolicy-3.10.0/policy/modules/system/init.te.execmem serefpolicy-3.10.0/policy/modules/system/init.te
|
|
--- serefpolicy-3.10.0/policy/modules/system/init.te.execmem 2011-11-04 16:05:07.073602594 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/system/init.te 2011-11-04 16:05:07.182602876 -0400
|
|
@@ -1196,10 +1196,6 @@ optional_policy(`
|
|
unconfined_dontaudit_rw_pipes(daemon)
|
|
')
|
|
|
|
- optional_policy(`
|
|
- mono_domtrans(initrc_t)
|
|
- ')
|
|
-
|
|
# Allow SELinux aware applications to request rpm_script_t execution
|
|
rpm_transition_script(initrc_t)
|
|
|
|
diff -up serefpolicy-3.10.0/policy/modules/system/userdomain.if.execmem serefpolicy-3.10.0/policy/modules/system/userdomain.if
|
|
--- serefpolicy-3.10.0/policy/modules/system/userdomain.if.execmem 2011-11-04 16:05:07.118602710 -0400
|
|
+++ serefpolicy-3.10.0/policy/modules/system/userdomain.if 2011-11-04 16:05:07.187602887 -0400
|
|
@@ -1281,14 +1281,6 @@ template(`userdom_unpriv_user_template',
|
|
')
|
|
|
|
optional_policy(`
|
|
- java_role_template($1, $1_r, $1_t)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
- mono_role_template($1, $1_r, $1_t)
|
|
- ')
|
|
-
|
|
- optional_policy(`
|
|
mount_run_fusermount($1_t, $1_r)
|
|
mount_read_pid_files($1_t)
|
|
')
|
|
@@ -5013,3 +5005,39 @@ interface(`userdom_rw_unpriv_user_semaph
|
|
|
|
allow $1 unpriv_userdomain:sem rw_sem_perms;
|
|
')
|
|
+
|
|
+#######################################
|
|
+## <summary>
|
|
+## The Interface gives a domain the privs of a unpriv_userdomain
|
|
+## </summary>
|
|
+## <param name="userdomain">
|
|
+## <summary>
|
|
+## The user domain
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+template(`userdom_unpriv_user',`
|
|
+ gen_require(`
|
|
+ attribute unpriv_userdomain;
|
|
+ ')
|
|
+
|
|
+ typeattribute $1 unpriv_userdomain;
|
|
+')
|
|
+
|
|
+#######################################
|
|
+## <summary>
|
|
+## The Interface gives a domain the privs of a common_userdomain
|
|
+## </summary>
|
|
+## <param name="userdomain">
|
|
+## <summary>
|
|
+## The user domain
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+template(`userdom_common_user',`
|
|
+ gen_require(`
|
|
+ attribute common_userdomain;
|
|
+ ')
|
|
+
|
|
+ typeattribute $1 common_userdomain;
|
|
+')
|