rpms/selinux-policy/devel policy-20071130.patch, 1.20, 1.21 selinux-policy.spec, 1.577, 1.578
Daniel J Walsh (dwalsh)
fedora-extras-commits at redhat.com
Sun Dec 30 14:55:43 UTC 2007
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv20718
Modified Files:
policy-20071130.patch selinux-policy.spec
Log Message:
* Mon Dec 24 2007 Dan Walsh <dwalsh at redhat.com> 3.2.5-6
- Fix role transition from unconfined_r to system_r when running rpm
- Allow unconfined_domains to communicate with user dbus instances
policy-20071130.patch:
Index: policy-20071130.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20071130.patch,v
retrieving revision 1.20
retrieving revision 1.21
diff -u -r1.20 -r1.21
--- policy-20071130.patch 24 Dec 2007 12:01:17 -0000 1.20
+++ policy-20071130.patch 30 Dec 2007 14:55:38 -0000 1.21
@@ -2437,7 +2437,7 @@
# /bin
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.2.5/policy/modules/apps/mozilla.if
--- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-10-29 07:52:48.000000000 -0400
-+++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if 2007-12-24 06:47:25.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if 2007-12-26 18:15:18.000000000 -0500
@@ -35,7 +35,10 @@
template(`mozilla_per_role_template',`
gen_require(`
@@ -4446,7 +4446,7 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.2.5/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.5/policy/modules/services/apache.te 2007-12-19 05:38:09.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/services/apache.te 2007-12-26 19:16:19.000000000 -0500
@@ -20,6 +20,8 @@
# Declarations
#
@@ -4643,7 +4643,18 @@
tunable_policy(`httpd_ssi_exec',`
corecmd_shell_domtrans(httpd_t,httpd_sys_script_t)
allow httpd_sys_script_t httpd_t:fd use;
-@@ -437,8 +505,14 @@
+@@ -425,6 +493,10 @@
+ ')
+
+ optional_policy(`
++ application_exec(httpd_t)
++')
++
++optional_policy(`
+ calamaris_read_www_files(httpd_t)
+ ')
+
+@@ -437,8 +509,14 @@
')
optional_policy(`
@@ -4659,7 +4670,7 @@
')
optional_policy(`
-@@ -450,19 +524,13 @@
+@@ -450,19 +528,13 @@
')
optional_policy(`
@@ -4680,7 +4691,7 @@
')
optional_policy(`
-@@ -472,13 +540,14 @@
+@@ -472,13 +544,14 @@
openca_kill(httpd_t)
')
@@ -4699,7 +4710,7 @@
')
optional_policy(`
-@@ -486,6 +555,7 @@
+@@ -486,6 +559,7 @@
')
optional_policy(`
@@ -4707,7 +4718,7 @@
snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
')
-@@ -521,6 +591,13 @@
+@@ -521,6 +595,13 @@
userdom_use_sysadm_terms(httpd_helper_t)
')
@@ -4721,7 +4732,7 @@
########################################
#
# Apache PHP script local policy
-@@ -550,18 +627,24 @@
+@@ -550,18 +631,24 @@
fs_search_auto_mountpoints(httpd_php_t)
@@ -4749,7 +4760,7 @@
')
########################################
-@@ -585,6 +668,8 @@
+@@ -585,6 +672,8 @@
manage_files_pattern(httpd_suexec_t,httpd_suexec_tmp_t,httpd_suexec_tmp_t)
files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir })
@@ -4758,7 +4769,7 @@
kernel_read_kernel_sysctls(httpd_suexec_t)
kernel_list_proc(httpd_suexec_t)
kernel_read_proc_symlinks(httpd_suexec_t)
-@@ -638,6 +723,12 @@
+@@ -638,6 +727,12 @@
fs_exec_nfs_files(httpd_suexec_t)
')
@@ -4771,7 +4782,7 @@
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_suexec_t)
fs_read_cifs_symlinks(httpd_suexec_t)
-@@ -655,10 +746,6 @@
+@@ -655,10 +750,6 @@
dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
')
@@ -4782,7 +4793,7 @@
########################################
#
# Apache system script local policy
-@@ -668,7 +755,8 @@
+@@ -668,7 +759,8 @@
dontaudit httpd_sys_script_t httpd_config_t:dir search;
@@ -4792,7 +4803,7 @@
allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms;
read_files_pattern(httpd_sys_script_t,squirrelmail_spool_t,squirrelmail_spool_t)
-@@ -682,15 +770,44 @@
+@@ -682,15 +774,44 @@
# Should we add a boolean?
apache_domtrans_rotatelogs(httpd_sys_script_t)
@@ -4804,15 +4815,15 @@
-tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
+tunable_policy(`httpd_use_nfs', `
-+ fs_read_nfs_files(httpd_sys_script_t)
-+ fs_read_nfs_symlinks(httpd_sys_script_t)
-+')
-+
-+tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs', `
fs_read_nfs_files(httpd_sys_script_t)
fs_read_nfs_symlinks(httpd_sys_script_t)
')
++tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs', `
++ fs_read_nfs_files(httpd_sys_script_t)
++ fs_read_nfs_symlinks(httpd_sys_script_t)
++')
++
+tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',`
+ allow httpd_sys_script_t self:tcp_socket create_stream_socket_perms;
+ allow httpd_sys_script_t self:udp_socket create_socket_perms;
@@ -4838,7 +4849,7 @@
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_sys_script_t)
fs_read_cifs_symlinks(httpd_sys_script_t)
-@@ -700,9 +817,15 @@
+@@ -700,9 +821,15 @@
clamav_domtrans_clamscan(httpd_sys_script_t)
')
@@ -4854,7 +4865,7 @@
')
########################################
-@@ -724,3 +847,46 @@
+@@ -724,3 +851,46 @@
logging_search_logs(httpd_rotatelogs_t)
miscfiles_read_localization(httpd_rotatelogs_t)
@@ -5473,7 +5484,7 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.2.5/policy/modules/services/cron.te
--- nsaserefpolicy/policy/modules/services/cron.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.5/policy/modules/services/cron.te 2007-12-19 05:38:09.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/services/cron.te 2007-12-27 07:19:39.000000000 -0500
@@ -50,6 +50,7 @@
type crond_tmp_t;
@@ -5532,7 +5543,14 @@
files_read_etc_files(crond_t)
files_read_generic_spool(crond_t)
-@@ -148,7 +156,9 @@
+@@ -142,13 +150,16 @@
+ files_search_default(crond_t)
+
+ init_rw_utmp(crond_t)
++init_spec_domtrans_script(crond_t)
+
+ auth_use_nsswitch(crond_t)
+
libs_use_ld_so(crond_t)
libs_use_shared_libs(crond_t)
@@ -5542,7 +5560,7 @@
seutil_read_config(crond_t)
seutil_read_default_contexts(crond_t)
-@@ -163,9 +173,6 @@
+@@ -163,9 +174,6 @@
mta_send_mail(crond_t)
ifdef(`distro_debian',`
@@ -5552,7 +5570,7 @@
optional_policy(`
# Debian logcheck has the home dir set to its cache
logwatch_search_cache_dir(crond_t)
-@@ -180,21 +187,45 @@
+@@ -180,21 +188,45 @@
')
')
@@ -5599,7 +5617,7 @@
')
optional_policy(`
-@@ -267,9 +298,16 @@
+@@ -267,9 +299,16 @@
filetrans_pattern(system_crond_t,crond_tmp_t,system_crond_tmp_t,{ file lnk_file })
files_tmp_filetrans(system_crond_t,system_crond_tmp_t,file)
@@ -5617,7 +5635,7 @@
kernel_read_kernel_sysctls(system_crond_t)
kernel_read_system_state(system_crond_t)
-@@ -323,7 +361,7 @@
+@@ -323,7 +362,7 @@
init_read_utmp(system_crond_t)
init_dontaudit_rw_utmp(system_crond_t)
# prelink tells init to restart it self, we either need to allow or dontaudit
@@ -5626,7 +5644,7 @@
auth_use_nsswitch(system_crond_t)
-@@ -333,6 +371,7 @@
+@@ -333,6 +372,7 @@
libs_exec_ld_so(system_crond_t)
logging_read_generic_logs(system_crond_t)
@@ -5634,7 +5652,7 @@
logging_send_syslog_msg(system_crond_t)
miscfiles_read_localization(system_crond_t)
-@@ -383,6 +422,14 @@
+@@ -383,6 +423,14 @@
')
optional_policy(`
@@ -5649,7 +5667,7 @@
mrtg_append_create_logs(system_crond_t)
')
-@@ -415,8 +462,7 @@
+@@ -415,8 +463,7 @@
')
optional_policy(`
@@ -5659,7 +5677,7 @@
')
optional_policy(`
-@@ -424,8 +470,13 @@
+@@ -424,8 +471,13 @@
')
optional_policy(`
@@ -6031,8 +6049,26 @@
-')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.5/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500
-+++ serefpolicy-3.2.5/policy/modules/services/dbus.if 2007-12-24 06:16:06.000000000 -0500
-@@ -91,7 +91,9 @@
++++ serefpolicy-3.2.5/policy/modules/services/dbus.if 2007-12-30 09:53:47.000000000 -0500
+@@ -53,6 +53,7 @@
+ gen_require(`
+ type system_dbusd_exec_t, system_dbusd_t, dbusd_etc_t;
+ class dbus { send_msg acquire_svc };
++ attribute dbusd_unconfined;
+ ')
+
+ ##############################
+@@ -84,6 +85,9 @@
+ allow $1_dbusd_t self:tcp_socket create_stream_socket_perms;
+ allow $1_dbusd_t self:netlink_selinux_socket create_socket_perms;
+
++ allow dbusd_unconfined $1_dbusd_t:dbus { send_msg acquire_svc };
++ allow $1_dbusd_t dbusd_unconfined:dbus send_msg;
++
+ # For connecting to the bus
+ allow $2 $1_dbusd_t:unix_stream_socket connectto;
+ type_change $2 $1_dbusd_t:dbus $1_dbusd_$1_t;
+@@ -91,7 +95,9 @@
# SE-DBus specific permissions
allow $1_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg;
allow $2 $1_dbusd_t:dbus { send_msg acquire_svc };
@@ -6043,7 +6079,7 @@
allow $1_dbusd_t dbusd_etc_t:dir list_dir_perms;
read_files_pattern($1_dbusd_t,dbusd_etc_t,dbusd_etc_t)
-@@ -104,8 +106,7 @@
+@@ -104,8 +110,7 @@
domtrans_pattern($2, system_dbusd_exec_t, $1_dbusd_t)
allow $2 $1_dbusd_t:process { sigkill signal };
@@ -6053,7 +6089,7 @@
allow $1_dbusd_t $2:process sigkill;
allow $2 $1_dbusd_t:fd use;
allow $2 $1_dbusd_t:fifo_file rw_fifo_file_perms;
-@@ -161,7 +162,9 @@
+@@ -161,7 +166,9 @@
seutil_read_config($1_dbusd_t)
seutil_read_default_contexts($1_dbusd_t)
@@ -6064,7 +6100,7 @@
ifdef(`hide_broken_symptoms', `
dontaudit $2 $1_dbusd_t:netlink_selinux_socket { read write };
-@@ -214,7 +217,7 @@
+@@ -214,7 +221,7 @@
# SE-DBus specific permissions
# allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg;
@@ -6073,7 +6109,15 @@
read_files_pattern($2, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
files_search_var_lib($2)
-@@ -263,6 +266,7 @@
+@@ -251,6 +258,7 @@
+ template(`dbus_user_bus_client_template',`
+ gen_require(`
+ type $1_dbusd_t;
++ attribute dbusd_unconfined;
+ class dbus send_msg;
+ ')
+
+@@ -263,6 +271,7 @@
# For connecting to the bus
allow $3 $1_dbusd_t:unix_stream_socket connectto;
@@ -6081,7 +6125,7 @@
')
########################################
-@@ -292,6 +296,59 @@
+@@ -292,6 +301,59 @@
########################################
## <summary>
@@ -6141,7 +6185,7 @@
## Read dbus configuration.
## </summary>
## <param name="domain">
-@@ -366,3 +423,53 @@
+@@ -366,3 +428,53 @@
allow $1 system_dbusd_t:dbus *;
')
@@ -7328,7 +7372,7 @@
+files_type(mailscanner_spool_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.2.5/policy/modules/services/mta.if
--- nsaserefpolicy/policy/modules/services/mta.if 2007-12-06 13:12:03.000000000 -0500
-+++ serefpolicy-3.2.5/policy/modules/services/mta.if 2007-12-19 05:38:09.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/services/mta.if 2007-12-27 11:44:00.000000000 -0500
@@ -133,6 +133,12 @@
sendmail_create_log($1_mail_t)
')
@@ -7415,7 +7459,15 @@
')
optional_policy(`
-@@ -438,20 +491,18 @@
+@@ -422,6 +475,7 @@
+ # apache should set close-on-exec
+ apache_dontaudit_rw_stream_sockets($1)
+ apache_dontaudit_rw_sys_script_stream_sockets($1)
++ apache_append_log($1)
+ ')
+ ')
+
+@@ -438,20 +492,18 @@
interface(`mta_send_mail',`
gen_require(`
attribute mta_user_agent;
@@ -7442,7 +7494,7 @@
')
########################################
-@@ -586,6 +637,25 @@
+@@ -586,6 +638,25 @@
files_search_etc($1)
allow $1 etc_aliases_t:file { rw_file_perms setattr };
')
@@ -7468,6 +7520,32 @@
#######################################
## <summary>
+@@ -837,6 +908,25 @@
+
+ ########################################
+ ## <summary>
++## read mail queue files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`mta_read_queue',`
++ gen_require(`
++ type mqueue_spool_t;
++ ')
++
++ files_search_spool($1)
++ read_files_pattern($1,mqueue_spool_t,mqueue_spool_t)
++')
++
++########################################
++## <summary>
+ ## Create, read, write, and delete
+ ## mail queue files.
+ ## </summary>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.2.5/policy/modules/services/mta.te
--- nsaserefpolicy/policy/modules/services/mta.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/services/mta.te 2007-12-19 05:38:09.000000000 -0500
@@ -7878,13 +7956,13 @@
+/var/log/wpa_supplicant\.log -- gen_context(system_u:object_r:NetworkManager_log_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.2.5/policy/modules/services/networkmanager.te
--- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.5/policy/modules/services/networkmanager.te 2007-12-19 05:38:09.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/services/networkmanager.te 2007-12-26 20:31:36.000000000 -0500
@@ -13,6 +13,9 @@
type NetworkManager_var_run_t;
files_pid_file(NetworkManager_var_run_t)
+type NetworkManager_log_t;
-+files_pid_file(NetworkManager_log_t)
++logging_log_file(NetworkManager_log_t)
+
########################################
#
@@ -8891,8 +8969,13 @@
optional_policy(`
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.2.5/policy/modules/services/procmail.te
--- nsaserefpolicy/policy/modules/services/procmail.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.5/policy/modules/services/procmail.te 2007-12-19 05:38:09.000000000 -0500
-@@ -133,3 +133,7 @@
++++ serefpolicy-3.2.5/policy/modules/services/procmail.te 2007-12-26 18:16:54.000000000 -0500
+@@ -129,7 +129,12 @@
+ corenet_udp_bind_generic_port(procmail_t)
+ corenet_dontaudit_udp_bind_all_ports(procmail_t)
+
++ spamassassin_read_user_home_files(procmail_t)
+ spamassassin_exec(procmail_t)
spamassassin_exec_client(procmail_t)
spamassassin_read_lib_files(procmail_t)
')
@@ -8942,7 +9025,7 @@
########################################
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.2.5/policy/modules/services/pyzor.te
--- nsaserefpolicy/policy/modules/services/pyzor.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.5/policy/modules/services/pyzor.te 2007-12-19 05:38:09.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/services/pyzor.te 2007-12-27 11:44:33.000000000 -0500
@@ -28,6 +28,9 @@
type pyzor_var_lib_t;
files_type(pyzor_var_lib_t)
@@ -8953,6 +9036,15 @@
########################################
#
# Pyzor local policy
+@@ -68,6 +71,8 @@
+
+ miscfiles_read_localization(pyzor_t)
+
++mta_read_queue(pyzor_t)
++
+ userdom_dontaudit_search_sysadm_home_dirs(pyzor_t)
+
+ optional_policy(`
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.fc serefpolicy-3.2.5/policy/modules/services/razor.fc
--- nsaserefpolicy/policy/modules/services/razor.fc 2007-10-12 08:56:07.000000000 -0400
+++ serefpolicy-3.2.5/policy/modules/services/razor.fc 2007-12-19 05:38:09.000000000 -0500
@@ -10149,7 +10241,7 @@
/usr/bin/spamassassin -- gen_context(system_u:object_r:spamassassin_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-3.2.5/policy/modules/services/spamassassin.if
--- nsaserefpolicy/policy/modules/services/spamassassin.if 2007-10-12 08:56:07.000000000 -0400
-+++ serefpolicy-3.2.5/policy/modules/services/spamassassin.if 2007-12-19 05:38:09.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/services/spamassassin.if 2007-12-26 18:16:14.000000000 -0500
@@ -38,6 +38,8 @@
gen_require(`
type spamc_exec_t, spamassassin_exec_t;
@@ -10253,7 +10345,56 @@
kernel_read_kernel_sysctls($1_spamassassin_t)
-@@ -528,3 +526,21 @@
+@@ -407,6 +405,40 @@
+
+ ########################################
+ ## <summary>
++## Read spamassassin per user homedir
++## </summary>
++## <desc>
++## <p>
++## Read spamassassin per user homedir
++## </p>
++## <p>
++## This is a templated interface, and should only
++## be called from a per-userdomain template.
++## </p>
++## </desc>
++## <param name="userdomain_prefix">
++## <summary>
++## The prefix of the user domain (e.g., user
++## is the prefix for user_t).
++## </summary>
++## </param>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++template(`spamassassin_read_user_home_files',`
++ gen_require(`
++ type user_spamassassin_home_t;
++ ')
++
++ allow $1 user_spamassassin_home_t:dir list_dir_perms;
++ allow $1 user_spamassassin_home_t:file read_file_perms;
++')
++
++########################################
++## <summary>
+ ## Execute the spamassassin client
+ ## program in the caller directory.
+ ## </summary>
+@@ -469,6 +501,7 @@
+ ')
+
+ files_search_var_lib($1)
++ read_dirs_pattern($1,spamd_var_lib_t,spamd_var_lib_t)
+ read_files_pattern($1,spamd_var_lib_t,spamd_var_lib_t)
+ ')
+
+@@ -528,3 +561,22 @@
dontaudit $1 spamd_tmp_t:sock_file getattr;
')
@@ -10275,6 +10416,7 @@
+
+ stream_connect_pattern($1,spamd_var_run_t,spamd_var_run_t,spamd_t)
+')
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.2.5/policy/modules/services/spamassassin.te
--- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/services/spamassassin.te 2007-12-19 05:38:09.000000000 -0500
@@ -10812,7 +10954,7 @@
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.2.5/policy/modules/services/xserver.if
--- nsaserefpolicy/policy/modules/services/xserver.if 2007-12-04 11:02:50.000000000 -0500
-+++ serefpolicy-3.2.5/policy/modules/services/xserver.if 2007-12-19 05:38:09.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/services/xserver.if 2007-12-27 11:37:04.000000000 -0500
@@ -45,7 +45,7 @@
# execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack
@@ -10822,7 +10964,7 @@
dontaudit $1_xserver_t self:capability chown;
allow $1_xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow $1_xserver_t self:memprotect mmap_zero;
-@@ -115,8 +115,7 @@
+@@ -115,18 +115,23 @@
dev_rw_agp($1_xserver_t)
dev_rw_framebuffer($1_xserver_t)
dev_manage_dri_dev($1_xserver_t)
@@ -10832,7 +10974,9 @@
# raw memory access is needed if not using the frame buffer
dev_read_raw_memory($1_xserver_t)
dev_wx_raw_memory($1_xserver_t)
-@@ -125,8 +124,13 @@
+ # for other device nodes such as the NVidia binary-only driver
+ dev_rw_xserver_misc($1_xserver_t)
++ dev_setattr_xserver_misc_dev($1_xserver_t)
# read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev($1_xserver_t)
dev_rwx_zero($1_xserver_t)
@@ -10846,7 +10990,7 @@
files_read_etc_files($1_xserver_t)
files_read_etc_runtime_files($1_xserver_t)
-@@ -140,12 +144,16 @@
+@@ -140,12 +145,16 @@
fs_getattr_xattr_fs($1_xserver_t)
fs_search_nfs($1_xserver_t)
fs_search_auto_mountpoints($1_xserver_t)
@@ -10864,7 +11008,7 @@
term_setattr_unallocated_ttys($1_xserver_t)
term_use_unallocated_ttys($1_xserver_t)
-@@ -232,39 +240,26 @@
+@@ -232,39 +241,26 @@
# Declarations
#
@@ -10911,7 +11055,7 @@
##############################
#
# $1_xserver_t Local policy
-@@ -272,12 +267,15 @@
+@@ -272,12 +268,15 @@
domtrans_pattern($1_xserver_t, xauth_exec_t, $1_xauth_t)
@@ -10928,7 +11072,7 @@
manage_dirs_pattern($2,$1_fonts_t,$1_fonts_t)
manage_files_pattern($2,$1_fonts_t,$1_fonts_t)
-@@ -307,6 +305,7 @@
+@@ -307,6 +306,7 @@
userdom_use_user_ttys($1,$1_xserver_t)
userdom_setattr_user_ttys($1,$1_xserver_t)
userdom_rw_user_tmpfs_files($1,$1_xserver_t)
@@ -10936,7 +11080,7 @@
xserver_use_user_fonts($1,$1_xserver_t)
xserver_rw_xdm_tmp_files($1_xauth_t)
-@@ -330,12 +329,12 @@
+@@ -330,12 +330,12 @@
allow $1_xauth_t self:process signal;
allow $1_xauth_t self:unix_stream_socket create_stream_socket_perms;
@@ -10954,7 +11098,7 @@
domtrans_pattern($2, xauth_exec_t, $1_xauth_t)
-@@ -344,12 +343,6 @@
+@@ -344,12 +344,6 @@
# allow ps to show xauth
ps_process_pattern($2,$1_xauth_t)
@@ -10967,7 +11111,7 @@
domain_use_interactive_fds($1_xauth_t)
files_read_etc_files($1_xauth_t)
-@@ -378,6 +371,14 @@
+@@ -378,6 +372,14 @@
')
optional_policy(`
@@ -10982,7 +11126,7 @@
ssh_sigchld($1_xauth_t)
ssh_read_pipes($1_xauth_t)
ssh_dontaudit_rw_tcp_sockets($1_xauth_t)
-@@ -390,16 +391,16 @@
+@@ -390,16 +392,16 @@
domtrans_pattern($2, iceauth_exec_t, $1_iceauth_t)
@@ -11004,7 +11148,7 @@
fs_search_auto_mountpoints($1_iceauth_t)
-@@ -523,17 +524,16 @@
+@@ -523,17 +525,16 @@
template(`xserver_user_client_template',`
gen_require(`
@@ -11029,7 +11173,7 @@
# for when /tmp/.X11-unix is created by the system
allow $2 xdm_t:fd use;
-@@ -542,25 +542,55 @@
+@@ -542,25 +543,55 @@
allow $2 xdm_tmp_t:sock_file { read write };
dontaudit $2 xdm_t:tcp_socket { read write };
@@ -11093,7 +11237,7 @@
')
')
-@@ -613,6 +643,24 @@
+@@ -613,6 +644,24 @@
########################################
## <summary>
@@ -11118,7 +11262,7 @@
## Transition to a user Xauthority domain.
## </summary>
## <desc>
-@@ -646,6 +694,73 @@
+@@ -646,6 +695,73 @@
########################################
## <summary>
@@ -11192,7 +11336,7 @@
## Transition to a user Xauthority domain.
## </summary>
## <desc>
-@@ -671,10 +786,10 @@
+@@ -671,10 +787,10 @@
#
template(`xserver_user_home_dir_filetrans_user_xauth',`
gen_require(`
@@ -11205,7 +11349,7 @@
')
########################################
-@@ -760,7 +875,7 @@
+@@ -760,7 +876,7 @@
type xconsole_device_t;
')
@@ -11214,7 +11358,7 @@
')
########################################
-@@ -860,6 +975,25 @@
+@@ -860,6 +976,25 @@
########################################
## <summary>
@@ -11240,7 +11384,7 @@
## Read xdm-writable configuration files.
## </summary>
## <param name="domain">
-@@ -914,6 +1048,7 @@
+@@ -914,6 +1049,7 @@
files_search_tmp($1)
allow $1 xdm_tmp_t:dir list_dir_perms;
create_sock_files_pattern($1,xdm_tmp_t,xdm_tmp_t)
@@ -11248,7 +11392,7 @@
')
########################################
-@@ -974,6 +1109,37 @@
+@@ -974,6 +1110,37 @@
########################################
## <summary>
@@ -11286,7 +11430,7 @@
## Make an X session script an entrypoint for the specified domain.
## </summary>
## <param name="domain">
-@@ -1123,7 +1289,7 @@
+@@ -1123,7 +1290,7 @@
type xdm_xserver_tmp_t;
')
@@ -11295,7 +11439,7 @@
')
########################################
-@@ -1312,3 +1478,45 @@
+@@ -1312,3 +1479,45 @@
files_search_tmp($1)
stream_connect_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t,xdm_xserver_t)
')
@@ -12467,8 +12611,26 @@
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.2.5/policy/modules/system/libraries.fc
--- nsaserefpolicy/policy/modules/system/libraries.fc 2007-12-12 11:35:28.000000000 -0500
-+++ serefpolicy-3.2.5/policy/modules/system/libraries.fc 2007-12-19 05:38:09.000000000 -0500
-@@ -292,6 +292,8 @@
++++ serefpolicy-3.2.5/policy/modules/system/libraries.fc 2007-12-27 11:40:35.000000000 -0500
+@@ -183,6 +183,7 @@
+ /usr/lib(64)?/libdv\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/helix/plugins/[^/]*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/helix/codecs/[^/]*\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libswscale\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/libSDL-.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/xorg/modules/dri/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/X11R6/lib/modules/dri/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+@@ -242,7 +243,8 @@
+
+ # Flash plugin, Macromedia
+ HOME_DIR/\.mozilla(/.*)?/plugins/libflashplayer\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+-HOME_DIR/.*/plugins/libflashplayer\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++HOME_DIR/\.mozilla(/.*)?/plugins/libflashplayer\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++HOME_DIR/.*/plugins/nppdf\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/.*/libflashplayer\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/local/(.*/)?libflashplayer\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ HOME_DIR/.*/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+@@ -292,6 +294,8 @@
#
# /var
#
@@ -12477,6 +12639,11 @@
/var/ftp/lib(64)?(/.*)? gen_context(system_u:object_r:lib_t,s0)
/var/ftp/lib(64)?/ld[^/]*\.so(\.[^/]*)* -- gen_context(system_u:object_r:ld_so_t,s0)
+@@ -304,3 +308,4 @@
+ /var/spool/postfix/lib(64)?(/.*)? gen_context(system_u:object_r:lib_t,s0)
+ /var/spool/postfix/usr(/.*)? gen_context(system_u:object_r:lib_t,s0)
+ /var/spool/postfix/lib(64)?/ld.*\.so.* -- gen_context(system_u:object_r:ld_so_t,s0)
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.2.5/policy/modules/system/libraries.te
--- nsaserefpolicy/policy/modules/system/libraries.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/system/libraries.te 2007-12-19 05:38:09.000000000 -0500
@@ -12710,7 +12877,7 @@
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.2.5/policy/modules/system/logging.te
--- nsaserefpolicy/policy/modules/system/logging.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.5/policy/modules/system/logging.te 2007-12-19 05:38:09.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/system/logging.te 2007-12-25 07:00:24.000000000 -0500
@@ -61,6 +61,12 @@
logging_log_file(var_log_t)
files_mountpoint(var_log_t)
@@ -12724,7 +12891,18 @@
ifdef(`enable_mls',`
init_ranged_daemon_domain(auditd_t,auditd_exec_t,mls_systemhigh)
')
-@@ -202,6 +208,7 @@
+@@ -165,6 +171,10 @@
+ userdom_dontaudit_search_sysadm_home_dirs(auditd_t)
+
+ optional_policy(`
++ mta_send_mail(auditd_t)
++')
++
++optional_policy(`
+ seutil_sigchld_newrole(auditd_t)
+ ')
+
+@@ -202,6 +212,7 @@
fs_getattr_all_fs(klogd_t)
fs_search_auto_mountpoints(klogd_t)
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.577
retrieving revision 1.578
diff -u -r1.577 -r1.578
--- selinux-policy.spec 24 Dec 2007 12:01:17 -0000 1.577
+++ selinux-policy.spec 30 Dec 2007 14:55:39 -0000 1.578
@@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.2.5
-Release: 5%{?dist}
+Release: 6%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -387,7 +387,8 @@
%changelog
* Mon Dec 24 2007 Dan Walsh <dwalsh at redhat.com> 3.2.5-6
-- Fix role transition fro unconfined_r to system_r when running rpm
+- Fix role transition from unconfined_r to system_r when running rpm
+- Allow unconfined_domains to communicate with user dbus instances
* Sat Dec 21 2007 Dan Walsh <dwalsh at redhat.com> 3.2.5-5
- Fixes for xguest
More information about the fedora-extras-commits
mailing list