rpms/selinux-policy-strict/devel policy-20050916.patch, 1.11, 1.12 selinux-policy-strict.spec, 1.385, 1.386
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Tue Sep 27 20:55:37 UTC 2005
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy-strict/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv23839
Modified Files:
policy-20050916.patch selinux-policy-strict.spec
Log Message:
* Tue Sep 27 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-9
- Fixes for Amanda and dhcpd
policy-20050916.patch:
Makefile | 22 +++++----
domains/program/crond.te | 2
domains/program/fsadm.te | 7 ++
domains/program/hostname.te | 2
domains/program/ifconfig.te | 3 -
domains/program/initrc.te | 17 ++++++-
domains/program/ldconfig.te | 3 -
domains/program/load_policy.te | 7 +-
domains/program/login.te | 21 +++++---
domains/program/modutil.te | 14 +++--
domains/program/mount.te | 5 +-
domains/program/netutils.te | 3 -
domains/program/passwd.te | 1
domains/program/restorecon.te | 3 -
domains/program/setfiles.te | 4 -
domains/program/ssh.te | 6 ++
domains/program/su.te | 9 +++
domains/program/syslogd.te | 6 +-
domains/program/unused/NetworkManager.te | 3 -
domains/program/unused/alsa.te | 2
domains/program/unused/amanda.te | 74 +++++++------------------------
domains/program/unused/anaconda.te | 5 --
domains/program/unused/apache.te | 9 ++-
domains/program/unused/apmd.te | 13 +++++
domains/program/unused/auditd.te | 2
domains/program/unused/automount.te | 4 +
domains/program/unused/bluetooth.te | 61 +++++++++++++++++++++++++
domains/program/unused/cups.te | 18 +++++--
domains/program/unused/cvs.te | 3 +
domains/program/unused/cyrus.te | 2
domains/program/unused/dbusd.te | 4 +
domains/program/unused/dhcpc.te | 5 +-
domains/program/unused/dhcpd.te | 3 -
domains/program/unused/dovecot.te | 4 +
domains/program/unused/hald.te | 2
domains/program/unused/hotplug.te | 5 +-
domains/program/unused/hwclock.te | 2
domains/program/unused/ipsec.te | 2
domains/program/unused/kudzu.te | 5 +-
domains/program/unused/mta.te | 8 +++
domains/program/unused/mysqld.te | 6 +-
domains/program/unused/named.te | 29 ++++++++++--
domains/program/unused/nscd.te | 1
domains/program/unused/ntpd.te | 7 +-
domains/program/unused/openct.te | 16 ++++++
domains/program/unused/pamconsole.te | 2
domains/program/unused/pegasus.te | 31 ++++++++++++
domains/program/unused/ping.te | 3 -
domains/program/unused/postfix.te | 24 ++++++----
domains/program/unused/pppd.te | 7 +-
domains/program/unused/procmail.te | 11 +++-
domains/program/unused/readahead.te | 21 ++++++++
domains/program/unused/rlogind.te | 4 +
domains/program/unused/roundup.te | 29 ++++++++++++
domains/program/unused/rpcd.te | 12 ++++-
domains/program/unused/samba.te | 11 +++-
domains/program/unused/snmpd.te | 5 +-
domains/program/unused/squid.te | 3 -
domains/program/unused/udev.te | 10 +++-
domains/program/unused/utempter.te | 2
domains/program/unused/webalizer.te | 3 +
domains/program/unused/winbind.te | 1
domains/program/unused/xdm.te | 3 +
domains/program/unused/yppasswdd.te | 40 ++++++++++++++++
domains/program/unused/ypserv.te | 1
domains/program/useradd.te | 5 +-
file_contexts/distros.fc | 1
file_contexts/program/bluetooth.fc | 3 +
file_contexts/program/dhcpc.fc | 2
file_contexts/program/dhcpd.fc | 1
file_contexts/program/ftpd.fc | 5 +-
file_contexts/program/games.fc | 11 +++-
file_contexts/program/ipsec.fc | 1
file_contexts/program/openct.fc | 2
file_contexts/program/pegasus.fc | 11 ++++
file_contexts/program/pppd.fc | 2
file_contexts/program/readahead.fc | 1
file_contexts/program/roundup.fc | 2
file_contexts/program/rpm.fc | 4 +
file_contexts/program/rsync.fc | 2
file_contexts/program/xdm.fc | 2
file_contexts/program/yppasswdd.fc | 2
file_contexts/program/ypserv.fc | 1
file_contexts/types.fc | 2
genfs_contexts | 2
macros/core_macros.te | 3 +
macros/global_macros.te | 16 +++++-
macros/network_macros.te | 17 ++++++-
macros/program/apache_macros.te | 13 ++++-
macros/program/cdrecord_macros.te | 2
macros/program/i18n_input_macros.te | 21 ++++++++
macros/program/mta_macros.te | 4 -
macros/program/newrole_macros.te | 2
macros/program/pyzor_macros.te | 2
macros/program/razor_macros.te | 2
macros/program/su_macros.te | 2
macros/program/uml_macros.te | 2
macros/user_macros.te | 1
man/man8/ftpd_selinux.8 | 10 ++--
man/man8/rsync_selinux.8 | 6 +-
mcs | 16 ++++++
net_contexts | 6 ++
targeted/appconfig/root_default_contexts | 4 +
targeted/domains/program/ssh.te | 3 +
targeted/domains/program/xdm.te | 4 +
targeted/domains/unconfined.te | 18 ++++++-
tunables/distro.tun | 2
tunables/tunable.tun | 4 -
types/devpts.te | 4 +
types/file.te | 15 ++++--
types/network.te | 12 ++---
types/security.te | 5 ++
112 files changed, 702 insertions(+), 209 deletions(-)
Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/policy-20050916.patch,v
retrieving revision 1.11
retrieving revision 1.12
diff -u -r1.11 -r1.12
--- policy-20050916.patch 26 Sep 2005 20:10:38 -0000 1.11
+++ policy-20050916.patch 27 Sep 2005 20:55:33 -0000 1.12
@@ -1,6 +1,6 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/crond.te policy-1.27.1/domains/program/crond.te
--- nsapolicy/domains/program/crond.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/crond.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/crond.te 2005-09-26 16:28:49.000000000 -0400
@@ -106,7 +106,7 @@
# Inherit and use descriptors from initrc for anacron.
@@ -12,7 +12,7 @@
allow system_crond_t self:capability { dac_read_search chown setgid setuid fowner net_bind_service fsetid };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/fsadm.te policy-1.27.1/domains/program/fsadm.te
--- nsapolicy/domains/program/fsadm.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/fsadm.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/fsadm.te 2005-09-26 16:28:49.000000000 -0400
@@ -102,10 +102,10 @@
allow fsadm_t kernel_t:system syslog_console;
@@ -35,7 +35,7 @@
+allow fsadm_t file_type:dir { getattr search };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/hostname.te policy-1.27.1/domains/program/hostname.te
--- nsapolicy/domains/program/hostname.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/hostname.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/hostname.te 2005-09-26 16:28:49.000000000 -0400
@@ -24,5 +24,5 @@
ifdef(`distro_redhat', `
allow hostname_t tmpfs_t:chr_file rw_file_perms;
@@ -45,7 +45,7 @@
allow hostname_t initrc_t:fd use;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/ifconfig.te policy-1.27.1/domains/program/ifconfig.te
--- nsapolicy/domains/program/ifconfig.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/ifconfig.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/ifconfig.te 2005-09-26 16:28:49.000000000 -0400
@@ -52,7 +52,8 @@
allow ifconfig_t self:udp_socket create_socket_perms;
@@ -58,7 +58,7 @@
allow ifconfig_t tun_tap_device_t:chr_file { read write };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/initrc.te policy-1.27.1/domains/program/initrc.te
--- nsapolicy/domains/program/initrc.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/initrc.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/initrc.te 2005-09-26 16:28:49.000000000 -0400
@@ -56,6 +56,10 @@
can_create_pty(initrc)
@@ -96,7 +96,7 @@
+r_dir_file(initrc_t, cert_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/ldconfig.te policy-1.27.1/domains/program/ldconfig.te
--- nsapolicy/domains/program/ldconfig.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/ldconfig.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/ldconfig.te 2005-09-26 16:28:49.000000000 -0400
@@ -16,7 +16,8 @@
domain_auto_trans({ sysadm_t initrc_t }, ldconfig_exec_t, ldconfig_t)
@@ -109,7 +109,7 @@
uses_shlib(ldconfig_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/load_policy.te policy-1.27.1/domains/program/load_policy.te
--- nsapolicy/domains/program/load_policy.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/load_policy.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/load_policy.te 2005-09-26 16:28:49.000000000 -0400
@@ -45,11 +45,12 @@
allow load_policy_t root_t:dir search;
allow load_policy_t etc_t:dir search;
@@ -128,7 +128,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/login.te policy-1.27.1/domains/program/login.te
--- nsapolicy/domains/program/login.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/login.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/login.te 2005-09-26 16:28:49.000000000 -0400
@@ -62,6 +62,11 @@
ifdef(`pamconsole.te', `
@@ -180,7 +180,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/modutil.te policy-1.27.1/domains/program/modutil.te
--- nsapolicy/domains/program/modutil.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/modutil.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/modutil.te 2005-09-26 16:28:49.000000000 -0400
@@ -59,7 +59,8 @@
allow depmod_t modules_object_t:file unlink;
@@ -233,7 +233,7 @@
allow update_modules_t urandom_device_t:chr_file { getattr read };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/mount.te policy-1.27.1/domains/program/mount.te
--- nsapolicy/domains/program/mount.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/mount.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/mount.te 2005-09-26 16:28:49.000000000 -0400
@@ -16,13 +16,14 @@
role sysadm_r types mount_t;
role system_r types mount_t;
@@ -253,7 +253,7 @@
allow mount_t file_type:dir search;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/netutils.te policy-1.27.1/domains/program/netutils.te
--- nsapolicy/domains/program/netutils.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/netutils.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/netutils.te 2005-09-26 16:28:49.000000000 -0400
@@ -55,7 +55,8 @@
# Access terminals.
@@ -266,7 +266,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/passwd.te policy-1.27.1/domains/program/passwd.te
--- nsapolicy/domains/program/passwd.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/passwd.te 2005-09-23 15:19:26.000000000 -0400
++++ policy-1.27.1/domains/program/passwd.te 2005-09-26 16:28:49.000000000 -0400
@@ -153,5 +153,4 @@
ifdef(`targeted_policy', `
@@ -275,7 +275,7 @@
')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/restorecon.te policy-1.27.1/domains/program/restorecon.te
--- nsapolicy/domains/program/restorecon.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/restorecon.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/restorecon.te 2005-09-26 16:28:49.000000000 -0400
@@ -19,7 +19,7 @@
role sysadm_r types restorecon_t;
role secadm_r types restorecon_t;
@@ -292,7 +292,7 @@
+allow restorecon_t autofs_t:dir search;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/setfiles.te policy-1.27.1/domains/program/setfiles.te
--- nsapolicy/domains/program/setfiles.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/setfiles.te 2005-09-26 16:09:45.000000000 -0400
++++ policy-1.27.1/domains/program/setfiles.te 2005-09-26 16:28:49.000000000 -0400
@@ -12,7 +12,7 @@
#
# needs auth_write attribute because it has relabelfrom/relabelto
@@ -313,7 +313,7 @@
allow setfiles_t self:unix_dgram_socket create_socket_perms;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/ssh.te policy-1.27.1/domains/program/ssh.te
--- nsapolicy/domains/program/ssh.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/ssh.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/ssh.te 2005-09-26 16:28:49.000000000 -0400
@@ -153,6 +153,7 @@
#
sshd_program_domain(sshd)
@@ -340,7 +340,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/su.te policy-1.27.1/domains/program/su.te
--- nsapolicy/domains/program/su.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/su.te 2005-09-23 15:22:36.000000000 -0400
++++ policy-1.27.1/domains/program/su.te 2005-09-26 16:28:49.000000000 -0400
@@ -12,3 +12,12 @@
# Everything else is in the su_domain macro in
@@ -356,7 +356,19 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/syslogd.te policy-1.27.1/domains/program/syslogd.te
--- nsapolicy/domains/program/syslogd.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/syslogd.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/syslogd.te 2005-09-27 08:23:37.000000000 -0400
+@@ -14,9 +14,9 @@
+ # by syslogd.
+ #
+ ifdef(`klogd.te', `
+-daemon_domain(syslogd, `, privkmsg')
++daemon_domain(syslogd, `, privkmsg. nscd_client_domain')
+ ', `
+-daemon_domain(syslogd, `, privmem, privkmsg')
++daemon_domain(syslogd, `, privmem, privkmsg, nscd_client_domain')
+ ')
+
+ # can_network is for the UDP socket
@@ -33,7 +33,7 @@
tmp_domain(syslogd)
@@ -368,7 +380,7 @@
allow syslogd_t self:capability { dac_override net_admin net_bind_service sys_resource sys_tty_config };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/alsa.te policy-1.27.1/domains/program/unused/alsa.te
--- nsapolicy/domains/program/unused/alsa.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/alsa.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/alsa.te 2005-09-26 16:28:49.000000000 -0400
@@ -11,6 +11,8 @@
allow alsa_t self:unix_stream_socket create_stream_socket_perms;
allow alsa_t self:unix_dgram_socket create_socket_perms;
@@ -380,7 +392,7 @@
allow alsa_t self:capability { setgid setuid ipc_owner };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/amanda.te policy-1.27.1/domains/program/unused/amanda.te
--- nsapolicy/domains/program/unused/amanda.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/amanda.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/amanda.te 2005-09-27 16:53:59.000000000 -0400
@@ -84,7 +84,6 @@
# configuration files -> read only
@@ -434,15 +446,26 @@
# access to fs_t
allow amanda_t fs_t:filesystem getattr;
-@@ -159,6 +133,8 @@
+@@ -158,7 +132,8 @@
+
allow amanda_t self:capability { chown dac_override setuid };
allow amanda_t self:process { fork sigchld setpgid signal };
- allow amanda_t self:unix_dgram_socket create;
+-allow amanda_t self:unix_dgram_socket create;
+allow amanda_t self:dir search;
+allow amanda_t self:file { getattr read };
###################################
+@@ -170,7 +145,8 @@
+ can_exec(amanda_t, sbin_t);
+
+ allow amanda_t self:fifo_file { getattr read write ioctl lock };
+-allow amanda_t self:unix_stream_socket { connect create read write };
++allow amanda_t self:unix_stream_socket create_stream_socket_perms;
++allow amanda_t self:unix_dgram_socket create_socket_perms;
+
+
+ ##########################
@@ -192,18 +168,8 @@
########################
@@ -531,7 +554,7 @@
+allow amanda_t file_type:fifo_file getattr;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/anaconda.te policy-1.27.1/domains/program/unused/anaconda.te
--- nsapolicy/domains/program/unused/anaconda.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/anaconda.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/anaconda.te 2005-09-26 16:28:49.000000000 -0400
@@ -17,11 +17,6 @@
role system_r types ldconfig_t;
domain_auto_trans(anaconda_t, ldconfig_exec_t, ldconfig_t)
@@ -546,7 +569,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/apache.te policy-1.27.1/domains/program/unused/apache.te
--- nsapolicy/domains/program/unused/apache.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/apache.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/apache.te 2005-09-26 16:28:49.000000000 -0400
@@ -113,9 +113,12 @@
can_network_server(httpd_t)
can_kerberos(httpd_t)
@@ -573,7 +596,7 @@
# connect to mysql
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/apmd.te policy-1.27.1/domains/program/unused/apmd.te
--- nsapolicy/domains/program/unused/apmd.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/apmd.te 2005-09-23 17:01:30.000000000 -0400
++++ policy-1.27.1/domains/program/unused/apmd.te 2005-09-26 16:28:49.000000000 -0400
@@ -47,6 +47,7 @@
# acpid also has a logfile
@@ -600,7 +623,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/auditd.te policy-1.27.1/domains/program/unused/auditd.te
--- nsapolicy/domains/program/unused/auditd.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/auditd.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/auditd.te 2005-09-26 16:28:49.000000000 -0400
@@ -65,3 +65,5 @@
allow auditctl_t privfd:fd use;
@@ -609,7 +632,7 @@
+can_exec(auditd_t, sbin_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/automount.te policy-1.27.1/domains/program/unused/automount.te
--- nsapolicy/domains/program/unused/automount.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/automount.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/automount.te 2005-09-26 16:28:49.000000000 -0400
@@ -34,7 +34,9 @@
can_exec(automount_t, { etc_t automount_etc_t })
@@ -635,7 +658,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/bluetooth.te policy-1.27.1/domains/program/unused/bluetooth.te
--- nsapolicy/domains/program/unused/bluetooth.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/bluetooth.te 2005-09-26 15:26:45.000000000 -0400
++++ policy-1.27.1/domains/program/unused/bluetooth.te 2005-09-26 16:28:49.000000000 -0400
@@ -11,11 +11,17 @@
daemon_domain(bluetooth)
@@ -662,7 +685,7 @@
# Read /etc/bluetooth
allow bluetooth_t bluetooth_conf_t:dir search;
-@@ -44,5 +51,53 @@
+@@ -44,5 +51,57 @@
allow bluetooth_t usbfs_t:dir r_dir_perms;
allow bluetooth_t usbfs_t:file rw_file_perms;
allow bluetooth_t bin_t:dir search;
@@ -699,8 +722,10 @@
+allow bluetooth_helper_t tmp_t:dir search;
+allow bluetooth_helper_t usr_t:file { getattr read };
+allow bluetooth_helper_t home_dir_type:dir search;
++ifdef(`xserver.te', `
+allow bluetooth_helper_t xserver_log_t:dir search;
+allow bluetooth_helper_t xserver_log_t:file { getattr read };
++')
+ifdef(`targeted_policy', `
+allow bluetooth_helper_t tmp_t:sock_file { read write };
+allow bluetooth_helper_t tmpfs_t:file { read write };
@@ -708,7 +733,9 @@
+allow bluetooth_t unconfined_t:dbus send_msg;
+allow unconfined_t bluetooth_t:dbus send_msg;
+', `
++ifdef(`xdm.te', `
+allow bluetooth_helper_t xdm_xserver_tmp_t:sock_file { read write };
++')
+allow bluetooth_t unpriv_userdomain:dbus send_msg;
+allow unpriv_userdomain bluetooth_t:dbus send_msg;
+')
@@ -719,7 +746,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/cups.te policy-1.27.1/domains/program/unused/cups.te
--- nsapolicy/domains/program/unused/cups.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/cups.te 2005-09-26 16:03:35.000000000 -0400
++++ policy-1.27.1/domains/program/unused/cups.te 2005-09-27 08:20:34.000000000 -0400
@@ -188,6 +188,7 @@
# Uses networking to talk to the daemons
allow hplip_t self:unix_dgram_socket create_socket_perms;
@@ -738,6 +765,15 @@
dontaudit cupsd_t selinux_config_t:dir search;
dontaudit cupsd_t selinux_config_t:file { getattr read };
+@@ -209,7 +213,7 @@
+ ')
+
+ # CUPS configuration daemon
+-daemon_domain(cupsd_config)
++daemon_domain(cupsd_config, `, nscd_client_domain')
+
+ allow cupsd_config_t devpts_t:dir search;
+ allow cupsd_config_t devpts_t:chr_file { getattr ioctl };
@@ -231,12 +235,13 @@
allow cupsd_config_t cupsd_t:{ file lnk_file } { getattr read };
can_ps(cupsd_config_t, cupsd_t)
@@ -775,7 +811,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/cvs.te policy-1.27.1/domains/program/unused/cvs.te
--- nsapolicy/domains/program/unused/cvs.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/cvs.te 2005-09-22 10:16:51.000000000 -0400
++++ policy-1.27.1/domains/program/unused/cvs.te 2005-09-26 16:28:49.000000000 -0400
@@ -23,6 +23,9 @@
allow cvs_t etc_runtime_t:file { getattr read };
allow system_mail_t cvs_data_t:file { getattr read };
@@ -788,7 +824,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/cyrus.te policy-1.27.1/domains/program/unused/cyrus.te
--- nsapolicy/domains/program/unused/cyrus.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/cyrus.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/cyrus.te 2005-09-26 16:28:49.000000000 -0400
@@ -42,7 +42,7 @@
create_dir_file(cyrus_t, mail_spool_t)
allow cyrus_t var_spool_t:dir search;
@@ -800,7 +836,7 @@
allow cyrus_t saslauthd_t:unix_stream_socket { connectto };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dbusd.te policy-1.27.1/domains/program/unused/dbusd.te
--- nsapolicy/domains/program/unused/dbusd.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dbusd.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/dbusd.te 2005-09-26 16:28:49.000000000 -0400
@@ -12,7 +12,7 @@
# dac_override: /var/run/dbus is owned by messagebus on Debian
@@ -818,7 +854,7 @@
+allow system_dbusd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dhcpc.te policy-1.27.1/domains/program/unused/dhcpc.te
--- nsapolicy/domains/program/unused/dhcpc.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dhcpc.te 2005-09-23 14:52:52.000000000 -0400
++++ policy-1.27.1/domains/program/unused/dhcpc.te 2005-09-26 16:28:49.000000000 -0400
@@ -120,6 +120,7 @@
allow dhcpc_t self:packet_socket create_socket_perms;
allow dhcpc_t var_lib_t:dir search;
@@ -852,7 +888,7 @@
')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dhcpd.te policy-1.27.1/domains/program/unused/dhcpd.te
--- nsapolicy/domains/program/unused/dhcpd.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dhcpd.te 2005-09-26 11:24:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/dhcpd.te 2005-09-26 16:28:49.000000000 -0400
@@ -17,8 +17,6 @@
#
daemon_domain(dhcpd, `, nscd_client_domain')
@@ -872,7 +908,7 @@
allow dhcpd_t self:unix_stream_socket create_socket_perms;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dovecot.te policy-1.27.1/domains/program/unused/dovecot.te
--- nsapolicy/domains/program/unused/dovecot.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dovecot.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/dovecot.te 2005-09-26 16:28:49.000000000 -0400
@@ -43,7 +43,9 @@
can_kerberos(dovecot_t)
@@ -886,7 +922,7 @@
allow dovecot_t mail_spool_t:lnk_file read;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/hald.te policy-1.27.1/domains/program/unused/hald.te
--- nsapolicy/domains/program/unused/hald.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/hald.te 2005-09-26 09:21:29.000000000 -0400
++++ policy-1.27.1/domains/program/unused/hald.te 2005-09-26 16:28:49.000000000 -0400
@@ -100,4 +100,4 @@
ifdef(`mount.te', `
domain_auto_trans(hald_t, mount_exec_t, mount_t)
@@ -895,7 +931,19 @@
+r_dir_file(hald_t, hwdata_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/hotplug.te policy-1.27.1/domains/program/unused/hotplug.te
--- nsapolicy/domains/program/unused/hotplug.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/hotplug.te 2005-09-23 17:02:56.000000000 -0400
++++ policy-1.27.1/domains/program/unused/hotplug.te 2005-09-27 08:20:01.000000000 -0400
+@@ -11,9 +11,9 @@
+ # hotplug_exec_t is the type of the hotplug executable.
+ #
+ ifdef(`unlimitedUtils', `
+-daemon_domain(hotplug, `, admin, etc_writer, fs_domain, privmem, auth_write, privowner, privmodule, domain, privlog, sysctl_kernel_writer')
++daemon_domain(hotplug, `, admin, etc_writer, fs_domain, privmem, auth_write, privowner, privmodule, domain, privlog, sysctl_kernel_writer, nscd_client_domain')
+ ', `
+-daemon_domain(hotplug, `, privmodule')
++daemon_domain(hotplug, `, privmodule, nscd_client_domain')
+ ')
+
+ etcdir_domain(hotplug)
@@ -132,6 +132,7 @@
allow hotplug_t sysfs_t:dir { getattr read search write };
allow hotplug_t sysfs_t:file rw_file_perms;
@@ -906,7 +954,7 @@
allow hotplug_t printer_device_t:chr_file setattr;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/hwclock.te policy-1.27.1/domains/program/unused/hwclock.te
--- nsapolicy/domains/program/unused/hwclock.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/hwclock.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/hwclock.te 2005-09-26 16:28:49.000000000 -0400
@@ -21,7 +21,6 @@
domain_auto_trans(sysadm_t, hwclock_exec_t, hwclock_t)
')
@@ -922,7 +970,7 @@
+r_dir_file(hwclock_t, etc_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ipsec.te policy-1.27.1/domains/program/unused/ipsec.te
--- nsapolicy/domains/program/unused/ipsec.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/ipsec.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/ipsec.te 2005-09-26 16:28:49.000000000 -0400
@@ -219,7 +219,7 @@
dontaudit ipsec_mgmt_t selinux_config_t:dir search;
dontaudit ipsec_t ttyfile:chr_file { read write };
@@ -934,7 +982,7 @@
allow ipsec_mgmt_t self:{ tcp_socket udp_socket } create_socket_perms;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/kudzu.te policy-1.27.1/domains/program/unused/kudzu.te
--- nsapolicy/domains/program/unused/kudzu.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/kudzu.te 2005-09-23 17:02:13.000000000 -0400
++++ policy-1.27.1/domains/program/unused/kudzu.te 2005-09-26 16:28:49.000000000 -0400
@@ -20,7 +20,7 @@
allow kudzu_t ramfs_t:dir search;
allow kudzu_t ramfs_t:sock_file write;
@@ -963,7 +1011,7 @@
allow kudzu_t initrc_t:unix_stream_socket connectto;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/mta.te policy-1.27.1/domains/program/unused/mta.te
--- nsapolicy/domains/program/unused/mta.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/mta.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/mta.te 2005-09-26 16:28:49.000000000 -0400
@@ -31,6 +31,10 @@
create_dir_file(system_mail_t, mail_spool_t)
allow system_mail_t mail_spool_t:fifo_file rw_file_perms;
@@ -985,7 +1033,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/mysqld.te policy-1.27.1/domains/program/unused/mysqld.te
--- nsapolicy/domains/program/unused/mysqld.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/mysqld.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/mysqld.te 2005-09-26 16:28:49.000000000 -0400
@@ -12,7 +12,7 @@
#
daemon_domain(mysqld, `, nscd_client_domain')
@@ -1015,7 +1063,7 @@
-allow mysqld_t self:netlink_route_socket r_netlink_socket_perms;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/named.te policy-1.27.1/domains/program/unused/named.te
--- nsapolicy/domains/program/unused/named.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/named.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/named.te 2005-09-27 12:59:02.000000000 -0400
@@ -36,7 +36,7 @@
allow named_t self:process { setsched setcap setrlimit };
@@ -1025,7 +1073,29 @@
# for primary zone files
type named_zone_t, file_type, sysadmfile;
-@@ -113,13 +113,19 @@
+@@ -101,6 +101,21 @@
+ # Use a pipe created by self.
+ allow named_t self:fifo_file rw_file_perms;
+
++# Enable named dbus support:
++ifdef(`dbusd.te', `
++dbusd_client(system, named)
++domain_auto_trans(system_dbusd_t, named_exec_t, named_t)
++allow named_t system_dbusd_t:dbus { acquire_svc send_msg };
++allow named_t self:dbus send_msg;
++allow { NetworkManager_t dhcpc_t initrc_t } named_t:dbus send_msg;
++allow named_t { NetworkManager_t dhcpc_t initrc_t }:dbus send_msg;
++ifdef(`unconfined.te', `
++allow unconfined_t named_t:dbus send_msg;
++allow named_t unconfined_t:dbus send_msg;
++')
++')
++
++
+ # Set own capabilities.
+ #A type for /usr/sbin/ndc
+ type ndc_exec_t, file_type,sysadmfile, exec_type;
+@@ -113,13 +128,19 @@
read_locale(ndc_t)
can_tcp_connect(ndc_t, named_t)
@@ -1047,7 +1117,7 @@
allow { ndc_t initrc_t } named_conf_t:file { getattr read };
allow ndc_t etc_t:dir r_dir_perms;
-@@ -161,3 +167,5 @@
+@@ -161,3 +182,5 @@
')
allow ndc_t self:netlink_route_socket r_netlink_socket_perms;
dontaudit ndc_t sysadm_tty_device_t:chr_file { ioctl };
@@ -1055,7 +1125,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/NetworkManager.te policy-1.27.1/domains/program/unused/NetworkManager.te
--- nsapolicy/domains/program/unused/NetworkManager.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/NetworkManager.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/NetworkManager.te 2005-09-26 16:28:49.000000000 -0400
@@ -11,7 +11,7 @@
# NetworkManager_t is the domain for the NetworkManager daemon.
# NetworkManager_exec_t is the type of the NetworkManager executable.
@@ -1072,7 +1142,7 @@
+dontaudit NetworkManager_t security_t:dir search;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/nscd.te policy-1.27.1/domains/program/unused/nscd.te
--- nsapolicy/domains/program/unused/nscd.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/nscd.te 2005-09-23 11:52:52.000000000 -0400
++++ policy-1.27.1/domains/program/unused/nscd.te 2005-09-26 16:28:49.000000000 -0400
@@ -76,3 +76,4 @@
log_domain(nscd)
r_dir_file(nscd_t, cert_t)
@@ -1080,7 +1150,7 @@
+allow nscd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ntpd.te policy-1.27.1/domains/program/unused/ntpd.te
--- nsapolicy/domains/program/unused/ntpd.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/ntpd.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/ntpd.te 2005-09-26 16:28:49.000000000 -0400
@@ -26,9 +26,10 @@
# for SSP
allow ntpd_t urandom_device_t:chr_file { getattr read };
@@ -1105,7 +1175,7 @@
can_exec(ntpd_t, initrc_exec_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/openct.te policy-1.27.1/domains/program/unused/openct.te
--- nsapolicy/domains/program/unused/openct.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/domains/program/unused/openct.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/openct.te 2005-09-26 16:28:49.000000000 -0400
@@ -0,0 +1,16 @@
+#DESC openct - read files in page cache
+#
@@ -1125,7 +1195,7 @@
+allow openct_t etc_t:file r_file_perms;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/pamconsole.te policy-1.27.1/domains/program/unused/pamconsole.te
--- nsapolicy/domains/program/unused/pamconsole.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/pamconsole.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/pamconsole.te 2005-09-26 16:28:49.000000000 -0400
@@ -25,6 +25,7 @@
# for /var/run/console.lock checking
allow pam_console_t { var_t var_run_t }:dir search;
@@ -1141,7 +1211,7 @@
+nsswitch_domain(pam_console_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/pegasus.te policy-1.27.1/domains/program/unused/pegasus.te
--- nsapolicy/domains/program/unused/pegasus.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/domains/program/unused/pegasus.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/pegasus.te 2005-09-26 16:28:49.000000000 -0400
@@ -0,0 +1,31 @@
+#DESC pegasus - The Open Group Pegasus CIM/WBEM Server
+#
@@ -1176,7 +1246,7 @@
+rw_dir_create_file(pegasus_conf_exec_t, pegasus_conf_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ping.te policy-1.27.1/domains/program/unused/ping.te
--- nsapolicy/domains/program/unused/ping.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/ping.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/ping.te 2005-09-26 16:28:49.000000000 -0400
@@ -37,6 +37,7 @@
uses_shlib(ping_t)
can_network_client(ping_t)
@@ -1195,7 +1265,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/postfix.te policy-1.27.1/domains/program/unused/postfix.te
--- nsapolicy/domains/program/unused/postfix.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/postfix.te 2005-09-26 15:58:21.000000000 -0400
++++ policy-1.27.1/domains/program/unused/postfix.te 2005-09-26 16:28:49.000000000 -0400
@@ -54,6 +54,8 @@
allow postfix_$1_t proc_net_t:dir search;
allow postfix_$1_t proc_net_t:file { getattr read };
@@ -1310,7 +1380,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/pppd.te policy-1.27.1/domains/program/unused/pppd.te
--- nsapolicy/domains/program/unused/pppd.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/pppd.te 2005-09-26 11:31:22.000000000 -0400
++++ policy-1.27.1/domains/program/unused/pppd.te 2005-09-26 16:28:49.000000000 -0400
@@ -14,7 +14,7 @@
#
bool pppd_for_user false;
@@ -1348,7 +1418,7 @@
can_exec(pptp_t, hostname_exec_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/procmail.te policy-1.27.1/domains/program/unused/procmail.te
--- nsapolicy/domains/program/unused/procmail.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/procmail.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/procmail.te 2005-09-26 16:28:49.000000000 -0400
@@ -19,8 +19,7 @@
uses_shlib(procmail_t)
allow procmail_t device_t:dir search;
@@ -1376,7 +1446,7 @@
# Search /var/run.
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/readahead.te policy-1.27.1/domains/program/unused/readahead.te
--- nsapolicy/domains/program/unused/readahead.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/domains/program/unused/readahead.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/readahead.te 2005-09-26 16:28:49.000000000 -0400
@@ -0,0 +1,21 @@
+#DESC readahead - read files in page cache
+#
@@ -1401,7 +1471,7 @@
+dontaudit readahead_t device_type:blk_file read;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/rlogind.te policy-1.27.1/domains/program/unused/rlogind.te
--- nsapolicy/domains/program/unused/rlogind.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/rlogind.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/rlogind.te 2005-09-26 16:28:49.000000000 -0400
@@ -35,4 +35,6 @@
allow rlogind_t default_t:dir search;
typealias rlogind_port_t alias rlogin_port_t;
@@ -1412,7 +1482,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/roundup.te policy-1.27.1/domains/program/unused/roundup.te
--- nsapolicy/domains/program/unused/roundup.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/domains/program/unused/roundup.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/roundup.te 2005-09-26 16:28:49.000000000 -0400
@@ -0,0 +1,29 @@
+# Roundup Issue Tracking System
+#
@@ -1445,7 +1515,7 @@
+allow roundup_t etc_t:file { getattr read };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/rpcd.te policy-1.27.1/domains/program/unused/rpcd.te
--- nsapolicy/domains/program/unused/rpcd.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/rpcd.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/rpcd.te 2005-09-26 16:28:49.000000000 -0400
@@ -19,7 +19,7 @@
can_network($1_t)
allow $1_t port_type:tcp_socket name_connect;
@@ -1471,7 +1541,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/samba.te policy-1.27.1/domains/program/unused/samba.te
--- nsapolicy/domains/program/unused/samba.te 2005-09-16 11:17:10.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/samba.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/samba.te 2005-09-26 16:28:49.000000000 -0400
@@ -25,6 +25,9 @@
# not sure why it needs this
tmp_domain(smbd)
@@ -1507,7 +1577,7 @@
# Access Samba shares.
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/snmpd.te policy-1.27.1/domains/program/unused/snmpd.te
--- nsapolicy/domains/program/unused/snmpd.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/snmpd.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/snmpd.te 2005-09-26 16:28:49.000000000 -0400
@@ -22,8 +22,9 @@
# for the .index file
@@ -1530,7 +1600,7 @@
allow snmpd_t { random_device_t urandom_device_t }:chr_file { getattr read };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/squid.te policy-1.27.1/domains/program/unused/squid.te
--- nsapolicy/domains/program/unused/squid.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/squid.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/squid.te 2005-09-26 16:28:49.000000000 -0400
@@ -60,7 +60,7 @@
can_tcp_connect(web_client_domain, squid_t)
@@ -1548,7 +1618,7 @@
')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/udev.te policy-1.27.1/domains/program/unused/udev.te
--- nsapolicy/domains/program/unused/udev.te 2005-09-16 11:17:10.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/udev.te 2005-09-23 14:49:34.000000000 -0400
++++ policy-1.27.1/domains/program/unused/udev.te 2005-09-26 16:28:49.000000000 -0400
@@ -28,12 +28,12 @@
type udev_tdb_t, file_type, sysadmfile, dev_fs;
typealias udev_tdb_t alias udev_tbl_t;
@@ -1580,7 +1650,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/utempter.te policy-1.27.1/domains/program/unused/utempter.te
--- nsapolicy/domains/program/unused/utempter.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/utempter.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/utempter.te 2005-09-26 16:28:49.000000000 -0400
@@ -19,6 +19,8 @@
type utempter_exec_t, file_type, sysadmfile, exec_type;
domain_auto_trans(userdomain, utempter_exec_t, utempter_t)
@@ -1592,7 +1662,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/webalizer.te policy-1.27.1/domains/program/unused/webalizer.te
--- nsapolicy/domains/program/unused/webalizer.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/webalizer.te 2005-09-23 17:23:00.000000000 -0400
++++ policy-1.27.1/domains/program/unused/webalizer.te 2005-09-26 16:28:49.000000000 -0400
@@ -20,6 +20,9 @@
#read apache log
allow webalizer_t var_log_t:dir r_dir_perms;
@@ -1605,7 +1675,7 @@
var_lib_domain(webalizer)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/winbind.te policy-1.27.1/domains/program/unused/winbind.te
--- nsapolicy/domains/program/unused/winbind.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/winbind.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/winbind.te 2005-09-26 16:28:49.000000000 -0400
@@ -44,6 +44,7 @@
r_dir_file(winbind_t, samba_etc_t)
allow winbind_helper_t self:unix_dgram_socket create_socket_perms;
@@ -1616,7 +1686,7 @@
allow winbind_helper_t privfd:fd use;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/xdm.te policy-1.27.1/domains/program/unused/xdm.te
--- nsapolicy/domains/program/unused/xdm.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/xdm.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/xdm.te 2005-09-26 16:28:49.000000000 -0400
@@ -371,3 +371,6 @@
dontaudit xdm_t ice_tmp_t:dir { getattr setattr };
@@ -1626,7 +1696,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/yppasswdd.te policy-1.27.1/domains/program/unused/yppasswdd.te
--- nsapolicy/domains/program/unused/yppasswdd.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/domains/program/unused/yppasswdd.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/yppasswdd.te 2005-09-26 16:28:49.000000000 -0400
@@ -0,0 +1,40 @@
+#DESC yppassdd - NIS password update daemon
+#
@@ -1670,7 +1740,7 @@
+rw_dir_create_file(yppasswdd_t, var_yp_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ypserv.te policy-1.27.1/domains/program/unused/ypserv.te
--- nsapolicy/domains/program/unused/ypserv.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/ypserv.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/ypserv.te 2005-09-26 16:28:49.000000000 -0400
@@ -39,3 +39,4 @@
')
allow ypserv_t reserved_port_t:{ udp_socket tcp_socket } name_bind;
@@ -1678,7 +1748,7 @@
+can_exec(ypserv_t, bin_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/useradd.te policy-1.27.1/domains/program/useradd.te
--- nsapolicy/domains/program/useradd.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/useradd.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/useradd.te 2005-09-26 16:28:49.000000000 -0400
@@ -55,7 +55,6 @@
# useradd/userdel request read/write for /var/log/lastlog, and read of /dev,
# but will operate without them.
@@ -1702,7 +1772,7 @@
read_sysctl(useradd_t)
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/distros.fc policy-1.27.1/file_contexts/distros.fc
--- nsapolicy/file_contexts/distros.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/distros.fc 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/file_contexts/distros.fc 2005-09-26 16:28:49.000000000 -0400
@@ -99,6 +99,7 @@
/usr/lib(64)?/.*/program/librecentfile\.so -- system_u:object_r:texrel_shlib_t
/usr/lib(64)?/.*/program/libsvx680li\.so -- system_u:object_r:texrel_shlib_t
@@ -1713,7 +1783,7 @@
/usr/lib/ladspa/analogue_osc_1416\.so -- system_u:object_r:texrel_shlib_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/bluetooth.fc policy-1.27.1/file_contexts/program/bluetooth.fc
--- nsapolicy/file_contexts/program/bluetooth.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/bluetooth.fc 2005-09-26 15:24:30.000000000 -0400
++++ policy-1.27.1/file_contexts/program/bluetooth.fc 2005-09-26 16:28:49.000000000 -0400
@@ -1,8 +1,11 @@
# bluetooth
/etc/bluetooth(/.*)? system_u:object_r:bluetooth_conf_t
@@ -1728,7 +1798,7 @@
+/var/lib/bluetooth(/.*)? system_u:object_r:bluetooth_var_lib_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/dhcpc.fc policy-1.27.1/file_contexts/program/dhcpc.fc
--- nsapolicy/file_contexts/program/dhcpc.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/dhcpc.fc 2005-09-23 17:32:37.000000000 -0400
++++ policy-1.27.1/file_contexts/program/dhcpc.fc 2005-09-26 16:28:49.000000000 -0400
@@ -4,9 +4,11 @@
/etc/dhclient.*conf -- system_u:object_r:dhcp_etc_t
/etc/dhclient-script -- system_u:object_r:dhcp_etc_t
@@ -1743,7 +1813,7 @@
# pump
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/dhcpd.fc policy-1.27.1/file_contexts/program/dhcpd.fc
--- nsapolicy/file_contexts/program/dhcpd.fc 2005-09-16 11:17:10.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/dhcpd.fc 2005-09-23 17:34:22.000000000 -0400
++++ policy-1.27.1/file_contexts/program/dhcpd.fc 2005-09-26 16:28:49.000000000 -0400
@@ -13,6 +13,7 @@
/etc/dhcp -d system_u:object_r:dhcp_etc_t
/etc/dhcp(/.*)? -- system_u:object_r:dhcp_etc_t
@@ -1754,7 +1824,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/ftpd.fc policy-1.27.1/file_contexts/program/ftpd.fc
--- nsapolicy/file_contexts/program/ftpd.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/ftpd.fc 2005-09-21 08:32:51.000000000 -0400
++++ policy-1.27.1/file_contexts/program/ftpd.fc 2005-09-26 16:28:49.000000000 -0400
@@ -10,7 +10,8 @@
/var/run/proftpd/proftpd\.scoreboard -- system_u:object_r:ftpd_var_run_t
/var/log/muddleftpd\.log.* -- system_u:object_r:xferlog_t
@@ -1768,7 +1838,7 @@
+/srv/([^/]*/)?ftp(/.*)? system_u:object_r:public_content_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/games.fc policy-1.27.1/file_contexts/program/games.fc
--- nsapolicy/file_contexts/program/games.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/games.fc 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/file_contexts/program/games.fc 2005-09-26 16:28:49.000000000 -0400
@@ -1,8 +1,10 @@
# games
-/usr/lib(64)?/games/.* -- system_u:object_r:games_exec_t
@@ -1793,7 +1863,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/ipsec.fc policy-1.27.1/file_contexts/program/ipsec.fc
--- nsapolicy/file_contexts/program/ipsec.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/ipsec.fc 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/file_contexts/program/ipsec.fc 2005-09-26 16:28:49.000000000 -0400
@@ -21,6 +21,7 @@
/usr/lib(64)?/ipsec/spi -- system_u:object_r:ipsec_exec_t
/usr/local/lib(64)?/ipsec/spi -- system_u:object_r:ipsec_exec_t
@@ -1804,13 +1874,13 @@
/usr/sbin/racoon -- system_u:object_r:ipsec_exec_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/openct.fc policy-1.27.1/file_contexts/program/openct.fc
--- nsapolicy/file_contexts/program/openct.fc 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/file_contexts/program/openct.fc 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/file_contexts/program/openct.fc 2005-09-26 16:28:49.000000000 -0400
@@ -0,0 +1,2 @@
+/usr/sbin/openct-control -- system_u:object_r:openct_exec_t
+/var/run/openct(/.*)? system_u:object_r:openct_var_run_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/pegasus.fc policy-1.27.1/file_contexts/program/pegasus.fc
--- nsapolicy/file_contexts/program/pegasus.fc 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/file_contexts/program/pegasus.fc 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/file_contexts/program/pegasus.fc 2005-09-26 16:28:49.000000000 -0400
@@ -0,0 +1,11 @@
+# File Contexts for The Open Group Pegasus (tog-pegasus) cimserver
+/usr/sbin/cimserver -- system_u:object_r:pegasus_exec_t
@@ -1825,7 +1895,7 @@
+/usr/share/Pegasus/mof(/.*)?/.*\.mof system_u:object_r:pegasus_mof_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/pppd.fc policy-1.27.1/file_contexts/program/pppd.fc
--- nsapolicy/file_contexts/program/pppd.fc 2005-09-16 11:17:11.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/pppd.fc 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/file_contexts/program/pppd.fc 2005-09-26 16:28:49.000000000 -0400
@@ -20,6 +20,6 @@
/etc/ppp/plugins/rp-pppoe\.so -- system_u:object_r:shlib_t
/etc/ppp/resolv\.conf -- system_u:object_r:pppd_etc_rw_t
@@ -1836,18 +1906,18 @@
/etc/ppp/(auth|ip(v6|x)?)-(up|down) -- system_u:object_r:pppd_script_exec_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/readahead.fc policy-1.27.1/file_contexts/program/readahead.fc
--- nsapolicy/file_contexts/program/readahead.fc 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/file_contexts/program/readahead.fc 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/file_contexts/program/readahead.fc 2005-09-26 16:28:49.000000000 -0400
@@ -0,0 +1 @@
+/usr/sbin/readahead -- system_u:object_r:readahead_exec_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/roundup.fc policy-1.27.1/file_contexts/program/roundup.fc
--- nsapolicy/file_contexts/program/roundup.fc 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/file_contexts/program/roundup.fc 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/file_contexts/program/roundup.fc 2005-09-26 16:28:49.000000000 -0400
@@ -0,0 +1,2 @@
+/usr/bin/roundup-server -- system_u:object_r:roundup_exec_t
+/var/lib/roundup(/.*)? -- system_u:object_r:roundup_var_lib_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/rpm.fc policy-1.27.1/file_contexts/program/rpm.fc
--- nsapolicy/file_contexts/program/rpm.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/rpm.fc 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/file_contexts/program/rpm.fc 2005-09-26 16:28:49.000000000 -0400
@@ -23,3 +23,7 @@
/var/lib/YaST2(/.*)? system_u:object_r:rpm_var_lib_t
/var/log/YaST2(/.*)? system_u:object_r:rpm_log_t
@@ -1858,7 +1928,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/rsync.fc policy-1.27.1/file_contexts/program/rsync.fc
--- nsapolicy/file_contexts/program/rsync.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/rsync.fc 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/file_contexts/program/rsync.fc 2005-09-26 16:28:49.000000000 -0400
@@ -1,3 +1,3 @@
# rsync program
/usr/bin/rsync -- system_u:object_r:rsync_exec_t
@@ -1866,7 +1936,7 @@
+/srv/([^/]*/)?rsync(/.*)? system_u:object_r:public_content_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/xdm.fc policy-1.27.1/file_contexts/program/xdm.fc
--- nsapolicy/file_contexts/program/xdm.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/xdm.fc 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/file_contexts/program/xdm.fc 2005-09-26 16:28:49.000000000 -0400
@@ -3,7 +3,7 @@
/usr/X11R6/bin/[xgkw]dm -- system_u:object_r:xdm_exec_t
/opt/kde3/bin/kdm -- system_u:object_r:xdm_exec_t
@@ -1878,13 +1948,13 @@
/var/log/[kw]dm\.log -- system_u:object_r:xserver_log_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/yppasswdd.fc policy-1.27.1/file_contexts/program/yppasswdd.fc
--- nsapolicy/file_contexts/program/yppasswdd.fc 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/file_contexts/program/yppasswdd.fc 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/file_contexts/program/yppasswdd.fc 2005-09-26 16:28:49.000000000 -0400
@@ -0,0 +1,2 @@
+# yppasswd
+/usr/sbin/rpc.yppasswdd -- system_u:object_r:yppasswdd_exec_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/ypserv.fc policy-1.27.1/file_contexts/program/ypserv.fc
--- nsapolicy/file_contexts/program/ypserv.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/ypserv.fc 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/file_contexts/program/ypserv.fc 2005-09-26 16:28:49.000000000 -0400
@@ -1,3 +1,4 @@
# ypserv
/usr/sbin/ypserv -- system_u:object_r:ypserv_exec_t
@@ -1892,7 +1962,7 @@
/etc/ypserv\.conf -- system_u:object_r:ypserv_conf_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/types.fc policy-1.27.1/file_contexts/types.fc
--- nsapolicy/file_contexts/types.fc 2005-09-16 11:17:10.000000000 -0400
-+++ policy-1.27.1/file_contexts/types.fc 2005-09-26 11:59:56.000000000 -0400
++++ policy-1.27.1/file_contexts/types.fc 2005-09-26 16:28:49.000000000 -0400
@@ -133,6 +133,7 @@
/dev/dcbri[0-9]+ -c system_u:object_r:tty_device_t
/dev/irlpt[0-9]+ -c system_u:object_r:printer_device_t
@@ -1911,7 +1981,7 @@
# initrd mount point, only used during boot
diff --exclude-from=exclude -N -u -r nsapolicy/genfs_contexts policy-1.27.1/genfs_contexts
--- nsapolicy/genfs_contexts 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/genfs_contexts 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/genfs_contexts 2005-09-26 16:28:49.000000000 -0400
@@ -94,7 +94,7 @@
genfscon debugfs / system_u:object_r:debugfs_t
genfscon inotifyfs / system_u:object_r:inotifyfs_t
@@ -1923,7 +1993,7 @@
genfscon eventpollfs / system_u:object_r:eventpollfs_t
diff --exclude-from=exclude -N -u -r nsapolicy/macros/core_macros.te policy-1.27.1/macros/core_macros.te
--- nsapolicy/macros/core_macros.te 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/macros/core_macros.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/macros/core_macros.te 2005-09-26 16:28:49.000000000 -0400
@@ -620,6 +620,9 @@
# Label pty files with a derived type.
type_transition $1_t devpts_t:chr_file $1_devpts_t;
@@ -1936,7 +2006,7 @@
')
diff --exclude-from=exclude -N -u -r nsapolicy/macros/global_macros.te policy-1.27.1/macros/global_macros.te
--- nsapolicy/macros/global_macros.te 2005-09-16 11:17:11.000000000 -0400
-+++ policy-1.27.1/macros/global_macros.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/macros/global_macros.te 2005-09-26 16:28:49.000000000 -0400
@@ -157,6 +157,11 @@
r_dir_file($1, locale_t)
')
@@ -1992,7 +2062,7 @@
allow $1 fs_type:filesystem *;
diff --exclude-from=exclude -N -u -r nsapolicy/macros/network_macros.te policy-1.27.1/macros/network_macros.te
--- nsapolicy/macros/network_macros.te 2005-09-16 11:17:11.000000000 -0400
-+++ policy-1.27.1/macros/network_macros.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/macros/network_macros.te 2005-09-26 16:28:49.000000000 -0400
@@ -153,7 +153,8 @@
')dnl end can_network definition
@@ -2023,7 +2093,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/apache_macros.te policy-1.27.1/macros/program/apache_macros.te
--- nsapolicy/macros/program/apache_macros.te 2005-09-16 11:17:11.000000000 -0400
-+++ policy-1.27.1/macros/program/apache_macros.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/macros/program/apache_macros.te 2005-09-26 16:28:49.000000000 -0400
@@ -38,7 +38,7 @@
allow httpd_$1_script_t etc_runtime_t:file { getattr read };
read_locale(httpd_$1_script_t)
@@ -2066,7 +2136,7 @@
')
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/cdrecord_macros.te policy-1.27.1/macros/program/cdrecord_macros.te
--- nsapolicy/macros/program/cdrecord_macros.te 2005-09-16 11:17:11.000000000 -0400
-+++ policy-1.27.1/macros/program/cdrecord_macros.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/macros/program/cdrecord_macros.te 2005-09-26 16:28:49.000000000 -0400
@@ -41,7 +41,7 @@
allow $1_cdrecord_t self:capability { ipc_lock sys_nice setuid dac_override sys_rawio };
@@ -2078,7 +2148,7 @@
allow $1_cdrecord_t $1_home_t:file r_file_perms;
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/i18n_input_macros.te policy-1.27.1/macros/program/i18n_input_macros.te
--- nsapolicy/macros/program/i18n_input_macros.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/macros/program/i18n_input_macros.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/macros/program/i18n_input_macros.te 2005-09-26 16:28:49.000000000 -0400
@@ -0,0 +1,21 @@
+#
+# Macros for i18n_input
@@ -2103,7 +2173,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/mta_macros.te policy-1.27.1/macros/program/mta_macros.te
--- nsapolicy/macros/program/mta_macros.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/macros/program/mta_macros.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/macros/program/mta_macros.te 2005-09-26 16:28:49.000000000 -0400
@@ -34,7 +34,7 @@
uses_shlib($1_mail_t)
@@ -2124,7 +2194,7 @@
# For when the user wants to send mail via port 25 localhost
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/newrole_macros.te policy-1.27.1/macros/program/newrole_macros.te
--- nsapolicy/macros/program/newrole_macros.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/macros/program/newrole_macros.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/macros/program/newrole_macros.te 2005-09-26 16:28:49.000000000 -0400
@@ -20,6 +20,8 @@
read_locale($1_t)
read_sysctl($1_t)
@@ -2136,7 +2206,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/pyzor_macros.te policy-1.27.1/macros/program/pyzor_macros.te
--- nsapolicy/macros/program/pyzor_macros.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/macros/program/pyzor_macros.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/macros/program/pyzor_macros.te 2005-09-26 16:28:49.000000000 -0400
@@ -64,6 +64,6 @@
# Allow pyzor to be run by hand. Needed by any action other than
@@ -2147,7 +2217,7 @@
')
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/razor_macros.te policy-1.27.1/macros/program/razor_macros.te
--- nsapolicy/macros/program/razor_macros.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/macros/program/razor_macros.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/macros/program/razor_macros.te 2005-09-26 16:28:49.000000000 -0400
@@ -70,6 +70,6 @@
# Allow razor to be run by hand. Needed by any action other than
@@ -2158,7 +2228,7 @@
')
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/su_macros.te policy-1.27.1/macros/program/su_macros.te
--- nsapolicy/macros/program/su_macros.te 2005-09-16 11:17:12.000000000 -0400
-+++ policy-1.27.1/macros/program/su_macros.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/macros/program/su_macros.te 2005-09-26 16:28:49.000000000 -0400
@@ -54,7 +54,7 @@
allow $1_su_t self:process { setsched setrlimit };
allow $1_su_t device_t:dir search;
@@ -2170,7 +2240,7 @@
dontaudit $1_su_t shadow_t:file { getattr read };
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/uml_macros.te policy-1.27.1/macros/program/uml_macros.te
--- nsapolicy/macros/program/uml_macros.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/macros/program/uml_macros.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/macros/program/uml_macros.te 2005-09-26 16:28:49.000000000 -0400
@@ -81,7 +81,7 @@
allow uml_net_t $1_uml_t:unix_stream_socket { read write };
allow uml_net_t $1_uml_t:unix_dgram_socket { read write };
@@ -2182,7 +2252,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/macros/user_macros.te policy-1.27.1/macros/user_macros.te
--- nsapolicy/macros/user_macros.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/macros/user_macros.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/macros/user_macros.te 2005-09-26 16:28:49.000000000 -0400
@@ -121,6 +121,7 @@
# user domains.
ifelse($1, sysadm, `',`
@@ -2193,7 +2263,7 @@
ifdef(`lockdev.te', `lockdev_domain($1)')
diff --exclude-from=exclude -N -u -r nsapolicy/Makefile policy-1.27.1/Makefile
--- nsapolicy/Makefile 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/Makefile 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/Makefile 2005-09-26 16:28:49.000000000 -0400
@@ -16,7 +16,7 @@
MLS=n
@@ -2269,7 +2339,7 @@
@mv Makefile.new Makefile
diff --exclude-from=exclude -N -u -r nsapolicy/man/man8/ftpd_selinux.8 policy-1.27.1/man/man8/ftpd_selinux.8
--- nsapolicy/man/man8/ftpd_selinux.8 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/man/man8/ftpd_selinux.8 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/man/man8/ftpd_selinux.8 2005-09-26 16:28:49.000000000 -0400
@@ -8,23 +8,23 @@
.SH FILE_CONTEXTS
SELinux requires files to have an extended attribute to define the file type.
@@ -2301,7 +2371,7 @@
SELinux ftp daemon policy is customizable based on least access required. So by
diff --exclude-from=exclude -N -u -r nsapolicy/man/man8/rsync_selinux.8 policy-1.27.1/man/man8/rsync_selinux.8
--- nsapolicy/man/man8/rsync_selinux.8 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/man/man8/rsync_selinux.8 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/man/man8/rsync_selinux.8 2005-09-26 16:28:49.000000000 -0400
@@ -8,16 +8,16 @@
.SH FILE_CONTEXTS
SELinux requires files to have an extended attribute to define the file type.
@@ -2324,7 +2394,7 @@
.TP
diff --exclude-from=exclude -N -u -r nsapolicy/mcs policy-1.27.1/mcs
--- nsapolicy/mcs 2005-09-15 16:13:03.000000000 -0400
-+++ policy-1.27.1/mcs 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/mcs 2005-09-26 16:28:49.000000000 -0400
@@ -200,9 +200,23 @@
#
# Only files are constrained by MCS at this stage.
@@ -2352,7 +2422,7 @@
#
diff --exclude-from=exclude -N -u -r nsapolicy/net_contexts policy-1.27.1/net_contexts
--- nsapolicy/net_contexts 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/net_contexts 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/net_contexts 2005-09-26 16:28:49.000000000 -0400
@@ -50,6 +50,10 @@
portcon tcp 53 system_u:object_r:dns_port_t
@@ -2375,7 +2445,7 @@
portcon tcp 6002 system_u:object_r:xserver_port_t
diff --exclude-from=exclude -N -u -r nsapolicy/targeted/appconfig/root_default_contexts policy-1.27.1/targeted/appconfig/root_default_contexts
--- nsapolicy/targeted/appconfig/root_default_contexts 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/targeted/appconfig/root_default_contexts 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/targeted/appconfig/root_default_contexts 2005-09-26 16:28:49.000000000 -0400
@@ -1,2 +1,6 @@
system_r:unconfined_t system_r:unconfined_t
system_r:initrc_t system_r:unconfined_t
@@ -2385,7 +2455,7 @@
+system_r:crond_t system_r:unconfined_t
diff --exclude-from=exclude -N -u -r nsapolicy/targeted/domains/program/ssh.te policy-1.27.1/targeted/domains/program/ssh.te
--- nsapolicy/targeted/domains/program/ssh.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/targeted/domains/program/ssh.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/targeted/domains/program/ssh.te 2005-09-26 16:28:49.000000000 -0400
@@ -17,3 +17,6 @@
type sshd_key_t, file_type, sysadmfile;
type sshd_var_run_t, file_type, sysadmfile;
@@ -2395,7 +2465,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/targeted/domains/program/xdm.te policy-1.27.1/targeted/domains/program/xdm.te
--- nsapolicy/targeted/domains/program/xdm.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/targeted/domains/program/xdm.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/targeted/domains/program/xdm.te 2005-09-26 16:28:49.000000000 -0400
@@ -20,3 +20,7 @@
type xdm_tmp_t, file_type, sysadmfile;
domain_auto_trans(initrc_t, xdm_exec_t, xdm_t)
@@ -2406,7 +2476,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/targeted/domains/unconfined.te policy-1.27.1/targeted/domains/unconfined.te
--- nsapolicy/targeted/domains/unconfined.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/targeted/domains/unconfined.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/targeted/domains/unconfined.te 2005-09-26 16:28:49.000000000 -0400
@@ -7,15 +7,14 @@
type unconfined_t, domain, privuser, privhome, privrole, privowner, admin, auth_write, fs_domain, privmem;
role system_r types unconfined_t;
@@ -2452,7 +2522,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/tunables/distro.tun policy-1.27.1/tunables/distro.tun
--- nsapolicy/tunables/distro.tun 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/tunables/distro.tun 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/tunables/distro.tun 2005-09-26 16:28:49.000000000 -0400
@@ -5,7 +5,7 @@
# appropriate ifdefs.
@@ -2464,7 +2534,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/tunables/tunable.tun policy-1.27.1/tunables/tunable.tun
--- nsapolicy/tunables/tunable.tun 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/tunables/tunable.tun 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/tunables/tunable.tun 2005-09-26 16:28:49.000000000 -0400
@@ -1,5 +1,5 @@
# Allow rpm to run unconfined.
-dnl define(`unlimitedRPM')
@@ -2483,7 +2553,7 @@
# Otherwise, only staff_r can do so.
diff --exclude-from=exclude -N -u -r nsapolicy/types/devpts.te policy-1.27.1/types/devpts.te
--- nsapolicy/types/devpts.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/types/devpts.te 2005-09-23 15:18:57.000000000 -0400
++++ policy-1.27.1/types/devpts.te 2005-09-26 16:28:49.000000000 -0400
@@ -18,4 +18,6 @@
#
type devpts_t, mount_point, fs_type;
@@ -2494,7 +2564,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/types/file.te policy-1.27.1/types/file.te
--- nsapolicy/types/file.te 2005-09-16 11:17:12.000000000 -0400
-+++ policy-1.27.1/types/file.te 2005-09-23 17:00:17.000000000 -0400
++++ policy-1.27.1/types/file.te 2005-09-26 16:28:49.000000000 -0400
@@ -307,8 +307,7 @@
type hugetlbfs_t, mount_point, fs_type, sysadmfile;
allow hugetlbfs_t self:filesystem associate;
@@ -2536,19 +2606,53 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/types/network.te policy-1.27.1/types/network.te
--- nsapolicy/types/network.te 2005-09-16 11:17:12.000000000 -0400
-+++ policy-1.27.1/types/network.te 2005-09-20 21:33:02.000000000 -0400
-@@ -120,6 +120,8 @@
++++ policy-1.27.1/types/network.te 2005-09-26 16:28:49.000000000 -0400
+@@ -18,7 +18,7 @@
+ type dhcpd_port_t, port_type, reserved_port_type;
+ type smbd_port_t, port_type, reserved_port_type;
+ type nmbd_port_t, port_type, reserved_port_type;
+-type http_cache_port_t, port_type, reserved_port_type;
++type http_cache_port_t, port_type;
+ type http_port_t, port_type, reserved_port_type;
+ type ipp_port_t, port_type, reserved_port_type;
+ type gopher_port_t, port_type, reserved_port_type;
+@@ -105,7 +105,7 @@
+ type printer_port_t, port_type, reserved_port_type;
+ type mysqld_port_t, port_type;
+ type postgresql_port_t, port_type;
+-type ptal_port_t, port_type, reserved_port_type;
++type ptal_port_t, port_type;
+ type howl_port_t, port_type;
+ type dict_port_t, port_type;
+ type syslogd_port_t, port_type, reserved_port_type;
+@@ -120,11 +120,13 @@
type zebra_port_t, port_type;
type i18n_input_port_t, port_type;
type vnc_port_t, port_type;
+type pegasus_http_port_t, port_type;
+type pegasus_https_port_t, port_type;
type openvpn_port_t, port_type;
- type clamd_port_t, port_type, reserved_port_type;
+-type clamd_port_t, port_type, reserved_port_type;
++type clamd_port_t, port_type;
type transproxy_port_t, port_type;
+ type clockspeed_port_t, port_type;
+-type pyzor_port_t, port_type, reserved_port_type;
++type pyzor_port_t, port_type;
+ type postgrey_port_t, port_type;
+ type asterisk_port_t, port_type;
+ type utcpserver_port_t, port_type;
+@@ -157,7 +159,7 @@
+ type telnetd_port_t, port_type, reserved_port_type;
+ type comsat_port_t, port_type, reserved_port_type;
+ type cvs_port_t, port_type;
+-type dbskkd_port_t, port_type, reserved_port_type;
++type dbskkd_port_t, port_type;
+ type inetd_child_port_t, port_type, reserved_port_type;
+ type ktalkd_port_t, port_type, reserved_port_type;
+ type rsync_port_t, port_type, reserved_port_type;
diff --exclude-from=exclude -N -u -r nsapolicy/types/security.te policy-1.27.1/types/security.te
--- nsapolicy/types/security.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/types/security.te 2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/types/security.te 2005-09-26 16:28:49.000000000 -0400
@@ -13,12 +13,17 @@
# applied to selinuxfs inodes.
#
Index: selinux-policy-strict.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/selinux-policy-strict.spec,v
retrieving revision 1.385
retrieving revision 1.386
diff -u -r1.385 -r1.386
--- selinux-policy-strict.spec 26 Sep 2005 20:10:38 -0000 1.385
+++ selinux-policy-strict.spec 27 Sep 2005 20:55:33 -0000 1.386
@@ -11,7 +11,7 @@
Summary: SELinux %{type} policy configuration
Name: selinux-policy-%{type}
Version: 1.27.1
-Release: 8
+Release: 9
License: GPL
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -242,6 +242,9 @@
exit 0
%changelog
+* Tue Sep 27 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-9
+- Fixes for Amanda and dhcpd
+
* Mon Sep 26 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-8
- Many fixes for postfix and bluetooth
More information about the fedora-cvs-commits
mailing list