rpms/selinux-policy/devel policy-20061106.patch,1.45,1.46
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Thu Dec 21 19:36:42 UTC 2006
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv27388
Modified Files:
policy-20061106.patch
Log Message:
* Tue Dec 19 2006 Dan Walsh <dwalsh at redhat.com> 2.4.6-16
- Allow semanage to exec it self. Label genhomedircon as semanage_exec_t
Resolves: #219421
- Allow sysadm_lpr_t to manage other print spool jobs
Resolves: #220080
policy-20061106.patch:
Rules.modular | 10
config/appconfig-strict-mcs/seusers | 1
config/appconfig-strict-mls/seusers | 1
config/appconfig-strict/seusers | 1
policy/flask/access_vectors | 2
policy/global_tunables | 48 ++-
policy/mls | 31 +
policy/modules/admin/acct.te | 1
policy/modules/admin/amanda.if | 17 +
policy/modules/admin/amanda.te | 1
policy/modules/admin/bootloader.fc | 5
policy/modules/admin/bootloader.te | 7
policy/modules/admin/consoletype.te | 10
policy/modules/admin/dmesg.te | 1
policy/modules/admin/firstboot.if | 6
policy/modules/admin/logwatch.te | 2
policy/modules/admin/netutils.te | 2
policy/modules/admin/prelink.te | 9
policy/modules/admin/quota.fc | 7
policy/modules/admin/quota.te | 20 -
policy/modules/admin/rpm.fc | 3
policy/modules/admin/rpm.if | 24 +
policy/modules/admin/rpm.te | 46 +-
policy/modules/admin/su.if | 11
policy/modules/admin/sudo.if | 5
policy/modules/admin/usermanage.te | 21 +
policy/modules/apps/gpg.if | 1
policy/modules/apps/java.fc | 2
policy/modules/apps/java.te | 2
policy/modules/apps/loadkeys.if | 17 -
policy/modules/apps/slocate.te | 2
policy/modules/kernel/corecommands.fc | 4
policy/modules/kernel/corecommands.if | 36 ++
policy/modules/kernel/corenetwork.if.in | 78 ++++
policy/modules/kernel/corenetwork.te.in | 15
policy/modules/kernel/corenetwork.te.m4 | 4
policy/modules/kernel/devices.fc | 5
policy/modules/kernel/devices.te | 8
policy/modules/kernel/domain.te | 7
policy/modules/kernel/files.if | 180 +++++++++++
policy/modules/kernel/filesystem.te | 6
policy/modules/kernel/kernel.if | 61 +++
policy/modules/kernel/kernel.te | 4
policy/modules/kernel/mls.if | 28 +
policy/modules/kernel/mls.te | 6
policy/modules/kernel/terminal.fc | 1
policy/modules/kernel/terminal.if | 2
policy/modules/kernel/terminal.te | 1
policy/modules/services/apache.fc | 10
policy/modules/services/apache.te | 16 -
policy/modules/services/apm.te | 1
policy/modules/services/automount.fc | 1
policy/modules/services/automount.te | 9
policy/modules/services/avahi.if | 21 +
policy/modules/services/bind.fc | 1
policy/modules/services/clamav.te | 2
policy/modules/services/cron.fc | 2
policy/modules/services/cron.if | 92 +++--
policy/modules/services/cron.te | 30 +
policy/modules/services/cups.fc | 2
policy/modules/services/cups.te | 7
policy/modules/services/cvs.te | 1
policy/modules/services/dbus.fc | 1
policy/modules/services/dbus.if | 1
policy/modules/services/ftp.te | 13
policy/modules/services/hal.fc | 4
policy/modules/services/hal.if | 20 +
policy/modules/services/hal.te | 8
policy/modules/services/inetd.te | 9
policy/modules/services/irqbalance.te | 4
policy/modules/services/kerberos.if | 1
policy/modules/services/kerberos.te | 11
policy/modules/services/lpd.if | 55 +--
policy/modules/services/mta.if | 1
policy/modules/services/mta.te | 1
policy/modules/services/nis.fc | 1
policy/modules/services/nis.if | 8
policy/modules/services/nis.te | 14
policy/modules/services/nscd.if | 20 +
policy/modules/services/nscd.te | 15
policy/modules/services/oddjob.te | 3
policy/modules/services/pcscd.fc | 9
policy/modules/services/pcscd.if | 23 +
policy/modules/services/pcscd.te | 69 ++++
policy/modules/services/pegasus.if | 31 +
policy/modules/services/pegasus.te | 5
policy/modules/services/postfix.te | 13
policy/modules/services/procmail.te | 16 +
policy/modules/services/radvd.te | 2
policy/modules/services/rlogin.te | 10
policy/modules/services/rpc.te | 1
policy/modules/services/rsync.te | 1
policy/modules/services/samba.if | 2
policy/modules/services/samba.te | 8
policy/modules/services/sasl.te | 2
policy/modules/services/smartmon.te | 1
policy/modules/services/snmp.te | 4
policy/modules/services/spamassassin.te | 8
policy/modules/services/ssh.te | 7
policy/modules/services/telnet.te | 1
policy/modules/services/tftp.te | 2
policy/modules/services/uucp.fc | 1
policy/modules/services/uucp.if | 67 ++++
policy/modules/services/uucp.te | 44 ++
policy/modules/services/xserver.if | 40 ++
policy/modules/system/authlogin.if | 69 ++++
policy/modules/system/authlogin.te | 6
policy/modules/system/clock.te | 8
policy/modules/system/fstools.fc | 1
policy/modules/system/fstools.te | 2
policy/modules/system/getty.te | 3
policy/modules/system/hostname.te | 10
policy/modules/system/init.if | 3
policy/modules/system/init.te | 27 +
policy/modules/system/iptables.te | 7
policy/modules/system/libraries.fc | 28 -
policy/modules/system/libraries.te | 6
policy/modules/system/locallogin.if | 37 ++
policy/modules/system/logging.te | 9
policy/modules/system/lvm.fc | 1
policy/modules/system/lvm.te | 48 ++-
policy/modules/system/miscfiles.fc | 1
policy/modules/system/miscfiles.if | 79 +++++
policy/modules/system/modutils.te | 5
policy/modules/system/mount.te | 20 -
policy/modules/system/raid.te | 7
policy/modules/system/selinuxutil.fc | 2
policy/modules/system/selinuxutil.if | 113 +++++++
policy/modules/system/selinuxutil.te | 107 +-----
policy/modules/system/sysnetwork.te | 3
policy/modules/system/tzdata.fc | 3
policy/modules/system/tzdata.if | 23 +
policy/modules/system/tzdata.te | 34 ++
policy/modules/system/unconfined.fc | 4
policy/modules/system/unconfined.if | 19 +
policy/modules/system/unconfined.te | 19 +
policy/modules/system/userdomain.if | 504 ++++++++++++++++++++++++++++----
policy/modules/system/userdomain.te | 60 +--
policy/modules/system/xen.fc | 1
policy/modules/system/xen.te | 35 ++
140 files changed, 2355 insertions(+), 463 deletions(-)
Index: policy-20061106.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy/devel/policy-20061106.patch,v
retrieving revision 1.45
retrieving revision 1.46
diff -u -r1.45 -r1.46
--- policy-20061106.patch 20 Dec 2006 20:40:30 -0000 1.45
+++ policy-20061106.patch 21 Dec 2006 19:36:40 -0000 1.46
@@ -676,7 +676,7 @@
# file_type_auto_trans($1_su_t, staff_home_dir_t, staff_xauth_home_t, file)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-2.4.6/policy/modules/admin/usermanage.te
--- nsaserefpolicy/policy/modules/admin/usermanage.te 2006-11-16 17:15:26.000000000 -0500
-+++ serefpolicy-2.4.6/policy/modules/admin/usermanage.te 2006-12-19 13:57:11.000000000 -0500
++++ serefpolicy-2.4.6/policy/modules/admin/usermanage.te 2006-12-21 10:04:42.000000000 -0500
@@ -112,6 +112,7 @@
files_manage_etc_files(chfn_t)
files_read_etc_runtime_files(chfn_t)
@@ -702,17 +702,38 @@
allow useradd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow useradd_t self:process setfscreate;
allow useradd_t self:fd use;
-@@ -517,6 +519,9 @@
+@@ -486,6 +488,8 @@
+ fs_search_auto_mountpoints(useradd_t)
+ fs_getattr_xattr_fs(useradd_t)
+
++mls_file_upgrade(useradd_t)
++
+ # Allow access to context for shadow file
+ selinux_get_fs_mount(useradd_t)
+ selinux_validate_context(useradd_t)
+@@ -517,21 +521,28 @@
seutil_read_config(useradd_t)
seutil_read_file_contexts(useradd_t)
seutil_read_default_contexts(useradd_t)
+seutil_domtrans_semanage(useradd_t)
+seutil_domtrans_restorecon(useradd_t)
++# Required because semanage execs these and hands them useradd_t:fd
+seutil_domtrans_setfiles(useradd_t)
++seutil_domtrans_loadpolicy(useradd_t)
userdom_use_unpriv_users_fds(useradd_t)
# for when /root is the cwd
-@@ -532,6 +537,10 @@
+ userdom_dontaudit_search_sysadm_home_dirs(useradd_t)
+ # Add/remove user home directories
+ userdom_home_filetrans_generic_user_home_dir(useradd_t)
+-userdom_manage_generic_user_home_content_dirs(useradd_t)
+-userdom_manage_generic_user_home_content_files(useradd_t)
+-userdom_manage_generic_user_home_dirs(useradd_t)
+-userdom_manage_staff_home_dirs(useradd_t)
++userdom_manage_all_users_home_content_dirs(useradd_t)
++userdom_manage_all_users_home_content_files(useradd_t)
+ userdom_generic_user_home_dir_filetrans_generic_user_home_content(useradd_t,notdevfile_class_set)
+
mta_manage_spool(useradd_t)
optional_policy(`
@@ -1170,7 +1191,7 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-2.4.6/policy/modules/kernel/files.if
--- nsaserefpolicy/policy/modules/kernel/files.if 2006-11-16 17:15:04.000000000 -0500
-+++ serefpolicy-2.4.6/policy/modules/kernel/files.if 2006-12-14 17:00:22.000000000 -0500
++++ serefpolicy-2.4.6/policy/modules/kernel/files.if 2006-12-20 16:22:09.000000000 -0500
@@ -353,8 +353,7 @@
########################################
@@ -1296,7 +1317,7 @@
')
########################################
-@@ -4559,3 +4615,95 @@
+@@ -4559,3 +4615,115 @@
typealias etc_runtime_t alias $1;
')
@@ -1392,6 +1413,26 @@
+
+ typealias etc_t alias $1;
+')
++
++########################################
++## <summary>
++## read all tmp files
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`files_read_all_tmp_files',`
++ gen_require(`
++ attribute tmpfile;
++ ')
++
++ allow $1 tmpfile:dir search_dir_perms;
++ allow $1 tmpfile:file r_file_perms;
++')
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-2.4.6/policy/modules/kernel/filesystem.te
--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2006-11-16 17:15:04.000000000 -0500
+++ serefpolicy-2.4.6/policy/modules/kernel/filesystem.te 2006-12-12 15:19:22.000000000 -0500
@@ -1495,7 +1536,7 @@
## <desc>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-2.4.6/policy/modules/kernel/kernel.te
--- nsaserefpolicy/policy/modules/kernel/kernel.te 2006-11-16 17:15:04.000000000 -0500
-+++ serefpolicy-2.4.6/policy/modules/kernel/kernel.te 2006-12-12 15:19:22.000000000 -0500
++++ serefpolicy-2.4.6/policy/modules/kernel/kernel.te 2006-12-21 11:48:37.000000000 -0500
@@ -138,6 +138,8 @@
type unlabeled_t;
sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
@@ -1505,9 +1546,18 @@
# These initial sids are no longer used, and can be removed:
sid any_socket gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
sid file_labels gen_context(system_u:object_r:unlabeled_t,s0)
+@@ -345,7 +347,7 @@
+ # Rules for unconfined acccess to this module
+ #
+
+-allow kern_unconfined proc_type:{ dir file } *;
++allow kern_unconfined proc_type:{ dir file lnk_file } *;
+
+ allow kern_unconfined sysctl_t:{ dir file } *;
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-2.4.6/policy/modules/kernel/mls.if
--- nsaserefpolicy/policy/modules/kernel/mls.if 2006-11-16 17:15:04.000000000 -0500
-+++ serefpolicy-2.4.6/policy/modules/kernel/mls.if 2006-12-19 14:43:51.000000000 -0500
++++ serefpolicy-2.4.6/policy/modules/kernel/mls.if 2006-12-20 15:56:34.000000000 -0500
@@ -100,16 +100,16 @@
## </summary>
## <param name="domain">
@@ -2535,29 +2585,34 @@
allow ypxfr_t $1:process sigchld;
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-2.4.6/policy/modules/services/nis.te
--- nsaserefpolicy/policy/modules/services/nis.te 2006-11-16 17:15:20.000000000 -0500
-+++ serefpolicy-2.4.6/policy/modules/services/nis.te 2006-12-12 15:19:22.000000000 -0500
-@@ -329,6 +329,12 @@
++++ serefpolicy-2.4.6/policy/modules/services/nis.te 2006-12-21 14:34:44.000000000 -0500
+@@ -329,7 +329,15 @@
# ypxfr local policy
#
-+allow ypxfr_t var_yp_t:dir search_dir_perms;
-+allow ypxfr_t var_yp_t:file r_file_perms;
++allow ypxfr_t var_yp_t:dir rw_dir_perms;
++allow ypxfr_t var_yp_t:file create_file_perms;
+
+allow ypxfr_t ypserv_t:tcp_socket { read write };
+allow ypxfr_t ypserv_t:udp_socket { read write };
+
allow ypxfr_t self:unix_stream_socket create_stream_socket_perms;
++allow ypxfr_t self:tcp_socket connected_socket_perms;
++allow ypxfr_t self:udp_socket create_socket_perms;
corenet_non_ipsec_sendrecv(ypxfr_t)
-@@ -348,4 +354,8 @@
+ corenet_tcp_sendrecv_all_if(ypxfr_t)
+@@ -348,4 +356,10 @@
corenet_sendrecv_generic_server_packets(ypxfr_t)
corenet_sendrecv_all_client_packets(ypxfr_t)
++libs_use_ld_so(ypxfr_t)
+libs_use_shared_libs(ypxfr_t)
+
files_read_etc_files(ypxfr_t)
+files_search_usr(ypxfr_t)
+
++sysnet_read_config(ypxfr_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.if serefpolicy-2.4.6/policy/modules/services/nscd.if
--- nsaserefpolicy/policy/modules/services/nscd.if 2006-11-16 17:15:20.000000000 -0500
+++ serefpolicy-2.4.6/policy/modules/services/nscd.if 2006-12-12 15:19:22.000000000 -0500
@@ -4270,7 +4325,7 @@
# /var/run
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-2.4.6/policy/modules/system/selinuxutil.if
--- nsaserefpolicy/policy/modules/system/selinuxutil.if 2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.4.6/policy/modules/system/selinuxutil.if 2006-12-19 12:39:25.000000000 -0500
++++ serefpolicy-2.4.6/policy/modules/system/selinuxutil.if 2006-12-20 16:22:45.000000000 -0500
@@ -713,7 +713,7 @@
')
@@ -4289,7 +4344,7 @@
allow $1 default_context_t:file manage_file_perms;
')
-@@ -1121,3 +1121,110 @@
+@@ -1121,3 +1121,112 @@
allow $1 selinux_config_t:dir search_dir_perms;
allow $1 semanage_trans_lock_t:file rw_file_perms;
')
@@ -4345,6 +4400,8 @@
+ files_read_etc_runtime_files($1)
+ files_read_usr_files($1)
+ files_list_pids($1)
++ # Modules often created in /tmp dir
++ files_read_all_tmp_files($1)
+
+ mls_file_write_down($1)
+ mls_rangetrans_target($1)
@@ -4644,8 +4701,8 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/tzdata.te serefpolicy-2.4.6/policy/modules/system/tzdata.te
--- nsaserefpolicy/policy/modules/system/tzdata.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.4.6/policy/modules/system/tzdata.te 2006-12-20 13:32:30.000000000 -0500
-@@ -0,0 +1,32 @@
++++ serefpolicy-2.4.6/policy/modules/system/tzdata.te 2006-12-20 16:02:55.000000000 -0500
+@@ -0,0 +1,34 @@
+policy_module(tzdata,1.0.0)
+
+########################################
@@ -4673,6 +4730,8 @@
+miscfiles_manage_localization(tzdata_t)
+miscfiles_etc_filetrans_localization(tzdata_t)
+
++term_dontaudit_list_ptys(tzdata_t)
++
+ifdef(`targeted_policy',`
+ term_dontaudit_use_unallocated_ttys(tzdata_t)
+ term_dontaudit_use_generic_ptys(tzdata_t)
@@ -4783,7 +4842,7 @@
init_dbus_chat_script(unconfined_execmem_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-2.4.6/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2006-11-29 09:27:47.000000000 -0500
-+++ serefpolicy-2.4.6/policy/modules/system/userdomain.if 2006-12-20 09:58:02.000000000 -0500
++++ serefpolicy-2.4.6/policy/modules/system/userdomain.if 2006-12-21 11:23:32.000000000 -0500
@@ -22,9 +22,9 @@
## <rolebase/>
#
More information about the fedora-cvs-commits
mailing list