rpms/selinux-policy/F-8 policy-20070703.patch, 1.159, 1.160 selinux-policy.spec, 1.597, 1.598
Daniel J Walsh (dwalsh)
fedora-extras-commits at redhat.com
Sat Dec 22 12:15:49 UTC 2007
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/F-8
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv8198
Modified Files:
policy-20070703.patch selinux-policy.spec
Log Message:
* Sat Dec 22 2007 Dan Walsh <dwalsh at redhat.com> 3.0.8-72
- Fixes to make confined mozilla work better
policy-20070703.patch:
Index: policy-20070703.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-8/policy-20070703.patch,v
retrieving revision 1.159
retrieving revision 1.160
diff -u -r1.159 -r1.160
--- policy-20070703.patch 21 Dec 2007 21:46:09 -0000 1.159
+++ policy-20070703.patch 22 Dec 2007 12:15:41 -0000 1.160
@@ -2925,7 +2925,7 @@
+/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:java_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.0.8/policy/modules/apps/java.if
--- nsaserefpolicy/policy/modules/apps/java.if 2007-10-22 13:21:40.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/apps/java.if 2007-12-02 21:15:34.000000000 -0500
++++ serefpolicy-3.0.8/policy/modules/apps/java.if 2007-12-22 07:13:05.000000000 -0500
@@ -32,7 +32,7 @@
## </summary>
## </param>
@@ -2935,6 +2935,15 @@
gen_require(`
type java_exec_t;
')
+@@ -57,7 +57,7 @@
+ # Local policy
+ #
+
+- allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem };
++ allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem execstack };
+ allow $1_javaplugin_t self:fifo_file rw_fifo_file_perms;
+ allow $1_javaplugin_t self:tcp_socket create_socket_perms;
+ allow $1_javaplugin_t self:udp_socket create_socket_perms;
@@ -81,8 +81,7 @@
can_exec($1_javaplugin_t, java_exec_t)
@@ -3250,7 +3259,7 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.0.8/policy/modules/apps/mozilla.if
--- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-10-22 13:21:40.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/apps/mozilla.if 2007-12-21 16:45:12.000000000 -0500
++++ serefpolicy-3.0.8/policy/modules/apps/mozilla.if 2007-12-22 07:11:43.000000000 -0500
@@ -36,6 +36,8 @@
gen_require(`
type mozilla_conf_t, mozilla_exec_t;
@@ -3295,7 +3304,7 @@
# X access, Home files
manage_dirs_pattern($1_mozilla_t,$1_mozilla_home_t,$1_mozilla_home_t)
manage_files_pattern($1_mozilla_t,$1_mozilla_home_t,$1_mozilla_home_t)
-@@ -96,15 +111,39 @@
+@@ -96,15 +111,41 @@
relabel_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
relabel_lnk_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
@@ -3314,6 +3323,7 @@
+ can_exec($2, mozilla_exec_t)
+ ')
+
++ userdom_read_user_tmpfs_files($1,$1_mozilla_t)
+ userdom_read_user_home_content_files($1,$1_mozilla_t)
+ userdom_read_user_home_content_symlinks($1,$1_mozilla_t)
+ userdom_read_user_tmp_files($1,$1_mozilla_t)
@@ -3333,6 +3343,7 @@
+ userdom_manage_user_home_content_dirs($1,$1_mozilla_t)
+ userdom_manage_user_home_content_files($1,$1_mozilla_t)
+ userdom_read_user_home_content_symlinks($1,$1_mozilla_t)
++ userdom_manage_user_home_content_pipes($1,$1_mozilla_t)
+ userdom_user_home_dir_filetrans_user_home_content($1,$1_mozilla_t, { file dir })
+ ', `
+ # helper apps will try to create .files
@@ -3342,7 +3353,7 @@
# Unrestricted inheritance from the caller.
allow $2 $1_mozilla_t:process { noatsecure siginh rlimitinh };
-@@ -113,10 +152,12 @@
+@@ -113,10 +154,12 @@
allow $2 $1_mozilla_t:process signal_perms;
kernel_read_kernel_sysctls($1_mozilla_t)
@@ -3357,7 +3368,7 @@
# Look for plugins
corecmd_list_bin($1_mozilla_t)
-@@ -165,10 +206,23 @@
+@@ -165,10 +208,23 @@
files_read_var_files($1_mozilla_t)
files_read_var_symlinks($1_mozilla_t)
files_dontaudit_getattr_boot_dirs($1_mozilla_t)
@@ -3381,7 +3392,7 @@
term_dontaudit_getattr_pty_dirs($1_mozilla_t)
-@@ -184,16 +238,13 @@
+@@ -184,16 +240,13 @@
sysnet_dns_name_resolve($1_mozilla_t)
sysnet_read_config($1_mozilla_t)
@@ -3401,7 +3412,7 @@
tunable_policy(`allow_execmem',`
allow $1_mozilla_t self:process { execmem execstack };
-@@ -211,131 +262,8 @@
+@@ -211,131 +264,8 @@
fs_manage_cifs_symlinks($1_mozilla_t)
')
@@ -3535,7 +3546,7 @@
')
optional_policy(`
-@@ -350,21 +278,27 @@
+@@ -350,21 +280,27 @@
optional_policy(`
cups_read_rw_config($1_mozilla_t)
cups_dbus_chat($1_mozilla_t)
@@ -3567,7 +3578,7 @@
')
optional_policy(`
-@@ -384,25 +318,6 @@
+@@ -384,25 +320,6 @@
thunderbird_domtrans_user_thunderbird($1, $1_mozilla_t)
')
@@ -3593,7 +3604,7 @@
')
########################################
-@@ -575,3 +490,27 @@
+@@ -575,3 +492,27 @@
allow $2 $1_mozilla_t:tcp_socket rw_socket_perms;
')
@@ -19137,7 +19148,7 @@
/tmp/gconfd-USER -d gen_context(system_u:object_r:ROLE_tmp_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.8/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-10-22 13:21:40.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/userdomain.if 2007-12-12 16:38:48.000000000 -0500
++++ serefpolicy-3.0.8/policy/modules/system/userdomain.if 2007-12-22 07:12:33.000000000 -0500
@@ -29,8 +29,9 @@
')
@@ -20141,7 +20152,64 @@
')
files_tmp_filetrans($2,$1_tmp_t,$3)
-@@ -4410,6 +4556,7 @@
+@@ -3086,11 +3232,11 @@
+
+ ########################################
+ ## <summary>
+-## Read user tmpfs files.
++## Read/write user tmpfs files.
+ ## </summary>
+ ## <desc>
+ ## <p>
+-## Read user tmpfs files.
++## Read/Write user tmpfs files.
+ ## </p>
+ ## <p>
+ ## This is a templated interface, and should only
+@@ -3122,6 +3268,42 @@
+
+ ########################################
+ ## <summary>
++## Read user tmpfs files.
++## </summary>
++## <desc>
++## <p>
++## Read user tmpfs files.
++## </p>
++## <p>
++## This is a templated interface, and should only
++## be called from a per-userdomain template.
++## </p>
++## </desc>
++## <param name="userdomain_prefix">
++## <summary>
++## The prefix of the user domain (e.g., user
++## is the prefix for user_t).
++## </summary>
++## </param>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++template(`userdom_read_user_tmpfs_files',`
++ gen_require(`
++ type $1_tmpfs_t;
++ ')
++
++ fs_search_tmpfs($2)
++ allow $2 $1_tmpfs_t:dir list_dir_perms;
++ read_files_pattern($2,$1_tmpfs_t,$1_tmpfs_t)
++ read_lnk_files_pattern($2,$1_tmpfs_t,$1_tmpfs_t)
++')
++
++########################################
++## <summary>
+ ## List users untrusted directories.
+ ## </summary>
+ ## <desc>
+@@ -4410,6 +4592,7 @@
')
dontaudit $1 sysadm_home_dir_t:dir getattr;
@@ -20149,7 +20217,7 @@
')
########################################
-@@ -4574,6 +4721,7 @@
+@@ -4574,6 +4757,7 @@
allow $1 { sysadm_home_dir_t sysadm_home_t }:dir list_dir_perms;
read_files_pattern($1,{ sysadm_home_dir_t sysadm_home_t },sysadm_home_t)
read_lnk_files_pattern($1,{ sysadm_home_dir_t sysadm_home_t },sysadm_home_t)
@@ -20157,7 +20225,7 @@
')
########################################
-@@ -4609,11 +4757,29 @@
+@@ -4609,11 +4793,29 @@
#
interface(`userdom_search_all_users_home_dirs',`
gen_require(`
@@ -20188,7 +20256,7 @@
')
########################################
-@@ -4633,6 +4799,14 @@
+@@ -4633,6 +4835,14 @@
files_list_home($1)
allow $1 home_dir_type:dir list_dir_perms;
@@ -20203,7 +20271,7 @@
')
########################################
-@@ -5323,7 +5497,7 @@
+@@ -5323,7 +5533,7 @@
attribute user_tmpfile;
')
@@ -20212,7 +20280,7 @@
')
########################################
-@@ -5346,6 +5520,25 @@
+@@ -5346,6 +5556,25 @@
########################################
## <summary>
@@ -20238,7 +20306,7 @@
## Write all unprivileged users files in /tmp
## </summary>
## <param name="domain">
-@@ -5529,6 +5722,24 @@
+@@ -5529,6 +5758,24 @@
########################################
## <summary>
@@ -20263,7 +20331,7 @@
## Send a dbus message to all user domains.
## </summary>
## <param name="domain">
-@@ -5559,3 +5770,419 @@
+@@ -5559,3 +5806,419 @@
interface(`userdom_unconfined',`
refpolicywarn(`$0($*) has been deprecated.')
')
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-8/selinux-policy.spec,v
retrieving revision 1.597
retrieving revision 1.598
diff -u -r1.597 -r1.598
--- selinux-policy.spec 21 Dec 2007 21:46:09 -0000 1.597
+++ selinux-policy.spec 22 Dec 2007 12:15:41 -0000 1.598
@@ -382,6 +382,9 @@
%endif
%changelog
+* Sat Dec 22 2007 Dan Walsh <dwalsh at redhat.com> 3.0.8-72
+- Fixes to make confined mozilla work better
+
* Fri Dec 21 2007 Dan Walsh <dwalsh at redhat.com> 3.0.8-71
- add file context for nspluginwrapper
More information about the fedora-extras-commits
mailing list