rpms/selinux-policy/devel policy-20070703.patch, 1.42, 1.43 selinux-policy.spec, 1.503, 1.504
Daniel J Walsh (dwalsh)
fedora-extras-commits at redhat.com
Fri Aug 24 14:21:08 UTC 2007
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv7688
Modified Files:
policy-20070703.patch selinux-policy.spec
Log Message:
* Fri Aug 24 2007 Dan Walsh <dwalsh at redhat.com> 3.0.6-2
- Allow xserver to be started by unconfined process and talk to tty
policy-20070703.patch:
Index: policy-20070703.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20070703.patch,v
retrieving revision 1.42
retrieving revision 1.43
diff -u -r1.42 -r1.43
--- policy-20070703.patch 23 Aug 2007 14:07:25 -0000 1.42
+++ policy-20070703.patch 24 Aug 2007 14:20:35 -0000 1.43
@@ -2226,7 +2226,7 @@
corenet_sendrecv_all_server_packets(vmware_host_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.0.6/policy/modules/apps/wine.if
--- nsaserefpolicy/policy/modules/apps/wine.if 2007-05-29 14:10:48.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/apps/wine.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.6/policy/modules/apps/wine.if 2007-08-24 10:17:01.000000000 -0400
@@ -18,3 +18,34 @@
corecmd_search_bin($1)
domtrans_pattern($1, wine_exec_t, wine_t)
@@ -7347,7 +7347,7 @@
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.0.6/policy/modules/services/samba.te
--- nsaserefpolicy/policy/modules/services/samba.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/samba.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.6/policy/modules/services/samba.te 2007-08-23 17:07:11.000000000 -0400
@@ -190,6 +190,8 @@
miscfiles_read_localization(samba_net_t)
@@ -7376,10 +7376,14 @@
domain_use_interactive_fds(smbd_t)
domain_dontaudit_list_all_domains_state(smbd_t)
-@@ -350,6 +353,10 @@
+@@ -350,6 +353,14 @@
')
optional_policy(`
++ kerberos_read_keytab(smbd_t)
++')
++
++optional_policy(`
+ lpd_exec_lpr(smbd_t)
+')
+
@@ -7387,7 +7391,7 @@
cups_read_rw_config(smbd_t)
cups_stream_connect(smbd_t)
')
-@@ -533,6 +540,7 @@
+@@ -533,6 +544,7 @@
storage_raw_write_fixed_disk(smbmount_t)
term_list_ptys(smbmount_t)
@@ -7395,7 +7399,7 @@
corecmd_list_bin(smbmount_t)
-@@ -556,6 +564,11 @@
+@@ -556,6 +568,11 @@
sysnet_read_config(smbmount_t)
userdom_use_all_users_fds(smbmount_t)
@@ -7407,7 +7411,7 @@
optional_policy(`
nis_use_ypbind(smbmount_t)
-@@ -570,15 +583,18 @@
+@@ -570,15 +587,18 @@
# SWAT Local policy
#
@@ -7429,7 +7433,7 @@
rw_files_pattern(swat_t,samba_etc_t,samba_etc_t)
-@@ -597,7 +613,9 @@
+@@ -597,7 +617,9 @@
manage_files_pattern(swat_t,swat_var_run_t,swat_var_run_t)
files_pid_filetrans(swat_t,swat_var_run_t,file)
@@ -7440,7 +7444,7 @@
kernel_read_kernel_sysctls(swat_t)
kernel_read_system_state(swat_t)
-@@ -622,17 +640,20 @@
+@@ -622,17 +644,20 @@
dev_read_urand(swat_t)
@@ -7461,7 +7465,7 @@
logging_search_logs(swat_t)
miscfiles_read_localization(swat_t)
-@@ -660,6 +681,24 @@
+@@ -660,6 +685,24 @@
nscd_socket_use(swat_t)
')
@@ -7486,7 +7490,7 @@
########################################
#
# Winbind local policy
-@@ -672,7 +711,6 @@
+@@ -672,7 +715,6 @@
allow winbind_t self:fifo_file { read write };
allow winbind_t self:unix_dgram_socket create_socket_perms;
allow winbind_t self:unix_stream_socket create_stream_socket_perms;
@@ -7494,7 +7498,7 @@
allow winbind_t self:tcp_socket create_stream_socket_perms;
allow winbind_t self:udp_socket create_socket_perms;
-@@ -709,6 +747,8 @@
+@@ -709,6 +751,8 @@
manage_sock_files_pattern(winbind_t,winbind_var_run_t,winbind_var_run_t)
files_pid_filetrans(winbind_t,winbind_var_run_t,file)
@@ -7503,7 +7507,7 @@
kernel_read_kernel_sysctls(winbind_t)
kernel_list_proc(winbind_t)
kernel_read_proc_symlinks(winbind_t)
-@@ -733,7 +773,9 @@
+@@ -733,7 +777,9 @@
fs_getattr_all_fs(winbind_t)
fs_search_auto_mountpoints(winbind_t)
@@ -7513,7 +7517,7 @@
domain_use_interactive_fds(winbind_t)
-@@ -746,9 +788,6 @@
+@@ -746,9 +792,6 @@
miscfiles_read_localization(winbind_t)
@@ -7523,7 +7527,7 @@
userdom_dontaudit_use_unpriv_user_fds(winbind_t)
userdom_dontaudit_search_sysadm_home_dirs(winbind_t)
userdom_priveleged_home_dir_manager(winbind_t)
-@@ -758,10 +797,6 @@
+@@ -758,10 +801,6 @@
')
optional_policy(`
@@ -7534,7 +7538,7 @@
seutil_sigchld_newrole(winbind_t)
')
-@@ -804,6 +839,7 @@
+@@ -804,6 +843,7 @@
optional_policy(`
squid_read_log(winbind_helper_t)
squid_append_log(winbind_helper_t)
@@ -8195,7 +8199,7 @@
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.6/policy/modules/services/xserver.if
--- nsaserefpolicy/policy/modules/services/xserver.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/services/xserver.if 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.6/policy/modules/services/xserver.if 2007-08-24 10:18:58.000000000 -0400
@@ -126,6 +126,8 @@
# read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev($1_xserver_t)
@@ -8416,7 +8420,45 @@
## Transition to a user Xauthority domain.
## </summary>
## <desc>
-@@ -1136,7 +1244,7 @@
+@@ -987,6 +1095,37 @@
+
+ ########################################
+ ## <summary>
++## Execute xsever in the xdm_xserver domain, and
++## allow the specified role the xdm_xserver domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## The type of the process performing this action.
++## </summary>
++## </param>
++## <param name="role">
++## <summary>
++## The role to be allowed the xdm_xserver domain.
++## </summary>
++## </param>
++## <param name="terminal">
++## <summary>
++## The type of the terminal allow the xdm_xserver domain to use.
++## </summary>
++## </param>
++#
++interface(`xserver_run_xdm_xserver',`
++ gen_require(`
++ type xdm_xserver_t;
++ ')
++
++ xserver_domtrans_xdm_xserver($1)
++ role $2 types xdm_xserver_t;
++ allow xdm_xserver_t $3:chr_file rw_term_perms;
++')
++
++########################################
++## <summary>
+ ## Make an X session script an entrypoint for the specified domain.
+ ## </summary>
+ ## <param name="domain">
+@@ -1136,7 +1275,7 @@
type xdm_xserver_tmp_t;
')
@@ -8425,7 +8467,7 @@
')
########################################
-@@ -1325,3 +1433,62 @@
+@@ -1325,3 +1464,62 @@
files_search_tmp($1)
stream_connect_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t,xdm_xserver_t)
')
@@ -11457,7 +11499,7 @@
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.6/policy/modules/system/unconfined.te
--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.6/policy/modules/system/unconfined.te 2007-08-22 08:03:53.000000000 -0400
++++ serefpolicy-3.0.6/policy/modules/system/unconfined.te 2007-08-24 10:16:34.000000000 -0400
@@ -5,28 +5,36 @@
#
# Declarations
@@ -11628,7 +11670,8 @@
')
optional_policy(`
- xserver_domtrans_xdm_xserver(unconfined_t)
+- xserver_domtrans_xdm_xserver(unconfined_t)
++ xserver_run_xdm_xserver(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t })
+ xserver_xdm_rw_shm(unconfined_t)
')
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.503
retrieving revision 1.504
diff -u -r1.503 -r1.504
--- selinux-policy.spec 23 Aug 2007 13:31:59 -0000 1.503
+++ selinux-policy.spec 24 Aug 2007 14:20:35 -0000 1.504
@@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.0.6
-Release: 1%{?dist}
+Release: 2%{?dist}
License: GPL
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -97,9 +97,6 @@
%{__mkdir} -p %{buildroot}/%{_sysconfdir}/selinux/%1/contexts/files \
touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.read.LOCK \
touch %{buildroot}/%{_sysconfdir}/selinux/%1/modules/semanage.trans.LOCK \
-make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 enableaudit \
-make -W base.conf NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 base.pp \
-install -m0644 base.pp %{buildroot}%{_usr}/share/selinux/%1/enableaudit.pp \
rm -rf %{buildroot}%{_sysconfdir}/selinux/%1/booleans \
touch %{buildroot}%{_sysconfdir}/selinux/%1/seusers \
touch %{buildroot}%{_sysconfdir}/selinux/%1/policy/policy.%{POLICYVER} \
@@ -360,6 +357,9 @@
%endif
%changelog
+* Fri Aug 24 2007 Dan Walsh <dwalsh at redhat.com> 3.0.6-2
+- Allow xserver to be started by unconfined process and talk to tty
+
* Wed Aug 22 2007 Dan Walsh <dwalsh at redhat.com> 3.0.6-1
- Upgrade to upstream to grab postgressql changes
More information about the fedora-extras-commits
mailing list