rpms/selinux-policy/devel booleans-targeted.conf, 1.27, 1.28 modules-targeted.conf, 1.61, 1.62 policy-20070525.patch, 1.1, 1.2 securetty_types-targeted, 1.1, 1.2 selinux-policy.spec, 1.459, 1.460
Daniel J Walsh (dwalsh)
fedora-extras-commits at redhat.com
Fri Jun 22 19:21:40 UTC 2007
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv20090
Modified Files:
booleans-targeted.conf modules-targeted.conf
policy-20070525.patch securetty_types-targeted
selinux-policy.spec
Log Message:
* Fri May 25 2007 Dan Walsh <dwalsh at redhat.com> 3.0.1-1
- Remove ifdef strict policy from upstream
Index: booleans-targeted.conf
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/booleans-targeted.conf,v
retrieving revision 1.27
retrieving revision 1.28
diff -u -r1.27 -r1.28
--- booleans-targeted.conf 7 May 2007 18:07:26 -0000 1.27
+++ booleans-targeted.conf 22 Jun 2007 19:21:00 -0000 1.28
@@ -1,6 +1,6 @@
# Allow making anonymous memory executable, e.g.for runtime-code generation or executable stack.
#
-allow_execmem = true
+allow_execmem = false
# Allow making a modified private filemapping executable (text relocation).
#
@@ -8,7 +8,7 @@
# Allow making the stack executable via mprotect.Also requires allow_execmem.
#
-allow_execstack = true
+allow_execstack = false
# Allow ftpd to read cifs directories.
#
@@ -242,3 +242,6 @@
#
samba_run_unconfined = true
+# Allows XServer to execute writable memory
+#
+allow_xserver_execmem = true
Index: modules-targeted.conf
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/modules-targeted.conf,v
retrieving revision 1.61
retrieving revision 1.62
diff -u -r1.61 -r1.62
--- modules-targeted.conf 31 May 2007 18:37:01 -0000 1.61
+++ modules-targeted.conf 22 Jun 2007 19:21:00 -0000 1.62
@@ -378,13 +378,6 @@
#
ethereal = module
-# Layer: apps
-# Module: evolution
-#
-# Evolution email client
-#
-evolution = module
-
# Layer: services
# Module: fail2ban
#
@@ -674,6 +667,14 @@
#
mailman = base
+
+# Layer: services
+# Module: mailscanner
+#
+# Anti-Virus and Anti-Spam Filter
+#
+mailscanner = module
+
# Layer: kernel
# Module: mcs
# Required in base
@@ -1252,13 +1253,6 @@
#
userhelper = module
-# Layer: apps
-# Module: thunderbird
-#
-# Thunderbird email client
-#
-thunderbird = module
-
# Layer: services
# Module: tor
#
@@ -1405,7 +1399,7 @@
#
# Manage temporary directory sizes and file ages
#
-tmpreaper = off
+tmpreaper = module
# Layer: admin
# Module: amtu
@@ -1470,3 +1464,23 @@
#
vmware = module
+# Layer: users
+# Module: guest
+#
+# Minimally privs guest account on tty logins
+#
+guest = module
+
+# Layer: users
+# Module: logadm
+#
+# Minimally prived root role for managing logging system
+#
+logadm = module
+
+# Layer: users
+# Module: webadm
+#
+# Minimally prived root role for managing apache
+#
+webadm = module
policy-20070525.patch:
View full diff with command:
/usr/bin/cvs -f diff -kk -u -N -r 1.1 -r 1.2 policy-20070525.patch
Index: policy-20070525.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20070525.patch,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- policy-20070525.patch 31 May 2007 18:40:35 -0000 1.1
+++ policy-20070525.patch 22 Jun 2007 19:21:00 -0000 1.2
@@ -1,6 +1,83 @@
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/staff_u_default_contexts serefpolicy-3.0.1/config/appconfig-strict-mls/staff_u_default_contexts
+--- nsaserefpolicy/config/appconfig-strict-mls/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.0.1/config/appconfig-strict-mls/staff_u_default_contexts 2007-06-19 17:06:27.000000000 -0400
+@@ -0,0 +1,9 @@
++system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
++system_r:remote_login_t:s0 staff_r:staff_t:s0
++system_r:sshd_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
++system_r:crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 mailman_r:user_crond_t:s0
++system_r:xdm_t:s0 staff_r:staff_t:s0
++staff_r:staff_su_t:s0 staff_r:staff_t:s0
++staff_r:staff_sudo_t:s0 staff_r:staff_t:s0
++sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0
++sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/user_u_default_contexts serefpolicy-3.0.1/config/appconfig-strict-mls/user_u_default_contexts
+--- nsaserefpolicy/config/appconfig-strict-mls/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.0.1/config/appconfig-strict-mls/user_u_default_contexts 2007-06-19 17:06:27.000000000 -0400
+@@ -0,0 +1,7 @@
++system_r:local_login_t:s0 user_r:user_t:s0
++system_r:remote_login_t:s0 user_r:user_t:s0
++system_r:sshd_t:s0 user_r:user_t:s0
++system_r:crond_t:s0 user_r:user_crond_t:s0
++system_r:xdm_t:s0 user_r:user_t:s0
++user_r:user_su_t:s0 user_r:user_t:s0
++user_r:user_sudo_t:s0 user_r:user_t:s0
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/default_type serefpolicy-3.0.1/config/appconfig-targeted-mcs/default_type
+--- nsaserefpolicy/config/appconfig-targeted-mcs/default_type 2007-05-25 09:09:09.000000000 -0400
++++ serefpolicy-3.0.1/config/appconfig-targeted-mcs/default_type 2007-06-19 17:06:27.000000000 -0400
+@@ -1 +1,4 @@
+ system_r:unconfined_t
++sysadm_r:sysadm_t
++staff_r:staff_t
++user_r:user_t
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/guest_u_default_contexts serefpolicy-3.0.1/config/appconfig-targeted-mcs/guest_u_default_contexts
+--- nsaserefpolicy/config/appconfig-targeted-mcs/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.0.1/config/appconfig-targeted-mcs/guest_u_default_contexts 2007-06-19 17:06:27.000000000 -0400
+@@ -0,0 +1,4 @@
++system_r:local_login_t:s0 guest_r:guest_t:s0
++system_r:remote_login_t:s0 guest_r:guest_t:s0
++system_r:sshd_t:s0 guest_r:guest_t:s0
++system_r:crond_t:s0 guest_r:guest_crond_t:s0
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/initrc_context serefpolicy-3.0.1/config/appconfig-targeted-mcs/initrc_context
+--- nsaserefpolicy/config/appconfig-targeted-mcs/initrc_context 2007-05-25 09:09:09.000000000 -0400
++++ serefpolicy-3.0.1/config/appconfig-targeted-mcs/initrc_context 2007-06-19 17:06:27.000000000 -0400
+@@ -1 +1 @@
+-user_u:system_r:initrc_t:s0
++system_u:system_r:initrc_t:s0
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/seusers serefpolicy-3.0.1/config/appconfig-targeted-mcs/seusers
+--- nsaserefpolicy/config/appconfig-targeted-mcs/seusers 2007-05-31 15:35:39.000000000 -0400
++++ serefpolicy-3.0.1/config/appconfig-targeted-mcs/seusers 2007-06-19 17:06:27.000000000 -0400
+@@ -1,2 +1,2 @@
+ root:root:s0-mcs_systemhigh
+-__default__:user_u:s0
++__default__:system_u:s0
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/staff_u_default_contexts serefpolicy-3.0.1/config/appconfig-targeted-mcs/staff_u_default_contexts
+--- nsaserefpolicy/config/appconfig-targeted-mcs/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.0.1/config/appconfig-targeted-mcs/staff_u_default_contexts 2007-06-19 17:06:27.000000000 -0400
+@@ -0,0 +1,9 @@
++system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
++system_r:remote_login_t:s0 staff_r:staff_t:s0
++system_r:sshd_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0
++system_r:crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 mailman_r:user_crond_t:s0
++system_r:xdm_t:s0 staff_r:staff_t:s0
++staff_r:staff_su_t:s0 staff_r:staff_t:s0
++staff_r:staff_sudo_t:s0 staff_r:staff_t:s0
++sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0
++sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/user_u_default_contexts serefpolicy-3.0.1/config/appconfig-targeted-mcs/user_u_default_contexts
+--- nsaserefpolicy/config/appconfig-targeted-mcs/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.0.1/config/appconfig-targeted-mcs/user_u_default_contexts 2007-06-19 17:06:27.000000000 -0400
+@@ -0,0 +1,7 @@
++system_r:local_login_t:s0 user_r:user_t:s0
++system_r:remote_login_t:s0 user_r:user_t:s0
++system_r:sshd_t:s0 user_r:user_t:s0
++system_r:crond_t:s0 user_r:user_crond_t:s0
++system_r:xdm_t:s0 user_r:user_t:s0
++user_r:user_su_t:s0 user_r:user_t:s0
++user_r:user_sudo_t:s0 user_r:user_t:s0
diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.0.1/Makefile
--- nsaserefpolicy/Makefile 2007-05-29 13:53:56.000000000 -0400
-+++ serefpolicy-3.0.1/Makefile 2007-05-30 15:54:27.000000000 -0400
++++ serefpolicy-3.0.1/Makefile 2007-06-19 17:06:27.000000000 -0400
@@ -158,8 +158,18 @@
headerdir = $(modpkgdir)/include
docsdir = $(prefix)/share/doc/$(PKGNAME)
@@ -32,7 +109,7 @@
CHECKMODULE += -M
diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-3.0.1/man/man8/ftpd_selinux.8
--- nsaserefpolicy/man/man8/ftpd_selinux.8 2007-05-25 09:09:10.000000000 -0400
-+++ serefpolicy-3.0.1/man/man8/ftpd_selinux.8 2007-05-30 15:12:50.000000000 -0400
++++ serefpolicy-3.0.1/man/man8/ftpd_selinux.8 2007-06-19 17:06:27.000000000 -0400
@@ -12,7 +12,7 @@
.TP
chcon -R -t public_content_t /var/ftp
@@ -43,8 +120,8 @@
chcon -t public_content_rw_t /var/ftp/incoming
.TP
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.0.1/policy/flask/access_vectors
---- nsaserefpolicy/policy/flask/access_vectors 2007-05-29 14:10:47.000000000 -0400
-+++ serefpolicy-3.0.1/policy/flask/access_vectors 2007-05-30 15:12:50.000000000 -0400
+--- nsaserefpolicy/policy/flask/access_vectors 2007-06-19 16:23:34.000000000 -0400
++++ serefpolicy-3.0.1/policy/flask/access_vectors 2007-06-22 14:07:33.000000000 -0400
@@ -598,6 +598,8 @@
shmempwd
shmemgrp
@@ -63,9 +140,14 @@
}
class key
+@@ -653,3 +657,4 @@
+ {
+ mmap_zero
+ }
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.0.1/policy/global_tunables
--- nsaserefpolicy/policy/global_tunables 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.1/policy/global_tunables 2007-05-30 15:12:50.000000000 -0400
++++ serefpolicy-3.0.1/policy/global_tunables 2007-06-19 17:06:27.000000000 -0400
@@ -133,3 +133,10 @@
## </desc>
gen_tunable(write_untrusted_content,false)
@@ -79,7 +161,7 @@
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-3.0.1/policy/mls
--- nsaserefpolicy/policy/mls 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.1/policy/mls 2007-05-30 15:12:50.000000000 -0400
++++ serefpolicy-3.0.1/policy/mls 2007-06-19 17:06:27.000000000 -0400
@@ -89,12 +89,14 @@
mlsconstrain { file lnk_file fifo_file dir chr_file blk_file sock_file } { write create setattr relabelfrom append unlink link rename mounton }
(( l1 eq l2 ) or
@@ -153,7 +235,7 @@
mlsconstrain association { polmatch }
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-3.0.1/policy/modules/admin/acct.te
--- nsaserefpolicy/policy/modules/admin/acct.te 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.1/policy/modules/admin/acct.te 2007-05-30 15:12:50.000000000 -0400
++++ serefpolicy-3.0.1/policy/modules/admin/acct.te 2007-06-19 17:06:27.000000000 -0400
@@ -9,6 +9,7 @@
type acct_t;
type acct_exec_t;
@@ -164,7 +246,7 @@
logging_log_file(acct_data_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-3.0.1/policy/modules/admin/alsa.fc
--- nsaserefpolicy/policy/modules/admin/alsa.fc 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.1/policy/modules/admin/alsa.fc 2007-05-30 15:12:50.000000000 -0400
++++ serefpolicy-3.0.1/policy/modules/admin/alsa.fc 2007-06-19 17:06:27.000000000 -0400
@@ -1,4 +1,7 @@
/etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0)
@@ -175,7 +257,7 @@
+/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.0.1/policy/modules/admin/alsa.te
--- nsaserefpolicy/policy/modules/admin/alsa.te 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.1/policy/modules/admin/alsa.te 2007-05-30 15:12:50.000000000 -0400
++++ serefpolicy-3.0.1/policy/modules/admin/alsa.te 2007-06-19 17:06:27.000000000 -0400
@@ -20,20 +20,24 @@
# Local policy
#
@@ -221,7 +303,7 @@
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.te serefpolicy-3.0.1/policy/modules/admin/amanda.te
--- nsaserefpolicy/policy/modules/admin/amanda.te 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.1/policy/modules/admin/amanda.te 2007-05-30 15:12:50.000000000 -0400
++++ serefpolicy-3.0.1/policy/modules/admin/amanda.te 2007-06-19 17:06:27.000000000 -0400
@@ -70,7 +70,7 @@
allow amanda_t self:capability { chown dac_override setuid kill };
@@ -255,134 +337,23 @@
manage_files_pattern(amanda_t,amanda_log_t,amanda_log_t)
manage_dirs_pattern(amanda_t,amanda_log_t,amanda_log_t)
logging_log_filetrans(amanda_t,amanda_log_t,{ file dir })
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.fc serefpolicy-3.0.1/policy/modules/admin/amtu.fc
---- nsaserefpolicy/policy/modules/admin/amtu.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.1/policy/modules/admin/amtu.fc 2007-05-30 15:12:50.000000000 -0400
-@@ -0,0 +1,3 @@
-+
-+/usr/bin/amtu -- gen_context(system_u:object_r:amtu_exec_t,s0)
-+
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amtu.if serefpolicy-3.0.1/policy/modules/admin/amtu.if
---- nsaserefpolicy/policy/modules/admin/amtu.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.0.1/policy/modules/admin/amtu.if 2007-05-30 15:12:50.000000000 -0400
-@@ -0,0 +1,53 @@
-+## <summary>
-+## abstract Machine Test Utility
-+## </summary>
-+
-+########################################
-+## <summary>
-+## Execute amtu in the amtu domain.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## The type of the process performing this action.
[...9475 lines suppressed...]
++allow logadm_t self:capability { dac_override dac_read_search kill sys_ptrace sys_nice };
++
++logging_manage_all_logs(logadm_t)
++seutil_run_runinit(logadm_t, logadm_r, { logadm_tty_device_t logadm_devpts_t })
++domain_kill_all_domains(logadm_t)
++seutil_read_bin_policy(logadm_t)
++corecmd_exec_shell(logadm_t)
++logging_send_syslog_msg(logadm_t)
++logging_read_generic_logs(logadm_t)
++logging_manage_audit_log(logadm_t)
++logging_manage_audit_config(logadm_t)
++logging_run_auditctl(logadm_t,logadm_r,{ logadm_tty_device_t logadm_devpts_t })
++logging_run_auditd(logadm_t, logadm_r, { logadm_tty_device_t logadm_devpts_t })
++userdom_dontaudit_read_sysadm_home_content_files(logadm_t)
++consoletype_exec(logadm_t)
++
++kernel_read_ring_buffer(logadm_t)
++dmesg_exec(logadm_t)
++
++files_dontaudit_search_all_dirs(logadm_t)
++files_dontaudit_getattr_all_files(logadm_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.0.1/policy/modules/users/metadata.xml
+--- nsaserefpolicy/policy/modules/users/metadata.xml 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.0.1/policy/modules/users/metadata.xml 2007-06-19 17:06:27.000000000 -0400
+@@ -0,0 +1 @@
++<summary>Policy modules for users</summary>
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.0.1/policy/modules/users/webadm.fc
+--- nsaserefpolicy/policy/modules/users/webadm.fc 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.0.1/policy/modules/users/webadm.fc 2007-06-19 17:06:27.000000000 -0400
+@@ -0,0 +1 @@
++# No webadm file contexts.
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.0.1/policy/modules/users/webadm.if
+--- nsaserefpolicy/policy/modules/users/webadm.if 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.0.1/policy/modules/users/webadm.if 2007-06-19 17:06:27.000000000 -0400
+@@ -0,0 +1 @@
++## <summary>Policy for webadm user</summary>
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.1/policy/modules/users/webadm.te
+--- nsaserefpolicy/policy/modules/users/webadm.te 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.0.1/policy/modules/users/webadm.te 2007-06-19 17:06:27.000000000 -0400
+@@ -0,0 +1,70 @@
++policy_module(webadm,1.0.0)
++
++########################################
++#
++# webadmin local policy
++#
++
++userdom_login_user_template(webadm)
++allow webadm_t self:capability { dac_override dac_read_search kill sys_ptrace sys_nice };
++
++# Allow webadm_t to restart the apache service
++domain_dontaudit_search_all_domains_state(webadm_t)
++apache_domtrans(webadm_t)
++init_exec_script_files(webadm_t)
++domain_role_change_exemption(webadm_t)
++domain_obj_id_change_exemption(webadm_t)
++role_transition webadm_r httpd_exec_t system_r;
++allow webadm_r system_r;
++
++apache_manage_all_content(webadm_t)
++apache_manage_config(webadm_t)
++apache_manage_log(webadm_t)
++apache_manage_modules(webadm_t)
++apache_manage_lock(webadm_t)
++apache_manage_pid(webadm_t)
++apache_read_state(webadm_t)
++apache_signal(webadm_t)
++apache_getattr(webadm_t)
++apache_relabel(webadm_t)
++
++seutil_domtrans_restorecon(webadm_t)
++
++files_dontaudit_search_all_dirs(webadm_t)
++files_dontaudit_getattr_all_files(webadm_t)
++files_manage_generic_locks(webadm_t)
++files_list_var(webadm_t)
++selinux_get_enforce_mode(webadm_t)
++
++
++logging_send_syslog_msg(webadm_t)
++
++ifdef(`targeted_policy',`
++ term_use_generic_ptys(webadm_t)
++ term_use_unallocated_ttys(webadm_t)
++')
++
++userdom_dontaudit_search_sysadm_home_dirs(webadm_t)
++userdom_dontaudit_search_generic_user_home_dirs(webadm_t)
++
++bool webadm_read_user_files false;
++bool webadm_manage_user_files false;
++
++if (webadm_read_user_files) {
++ userdom_read_unpriv_users_home_content_files(webadm_t)
++ userdom_read_unpriv_users_tmp_files(webadm_t)
++}
++
++if (webadm_manage_user_files) {
++ userdom_manage_unpriv_users_home_content_dirs(webadm_t)
++ userdom_read_unpriv_users_tmp_files(webadm_t)
++ userdom_write_unpriv_users_tmp_files(webadm_t)
++}
++
++gen_require(`
++ type gadmin_t;
++')
++allow gadmin_t webadm_t:process transition;
++allow webadm_t gadmin_t:dir getattr;
++
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.0.1/policy/support/obj_perm_sets.spt
--- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.1/policy/support/obj_perm_sets.spt 2007-05-30 15:12:50.000000000 -0400
-@@ -203,7 +203,6 @@
++++ serefpolicy-3.0.1/policy/support/obj_perm_sets.spt 2007-06-21 13:44:03.000000000 -0400
+@@ -201,7 +201,7 @@
+ define(`search_dir_perms',`{ getattr search }')
+ define(`list_dir_perms',`{ getattr search read lock ioctl }')
define(`add_entry_dir_perms',`{ getattr search lock ioctl write add_name }')
- define(`del_entry_dir_perms',`{ getattr search lock ioctl write remove_name }')
+-define(`del_entry_dir_perms',`{ getattr search lock ioctl write remove_name }')
++define(`del_entry_dir_perms',`{ getattr search lock ioctl read write remove_name }')
define(`create_dir_perms',`{ getattr create }')
--define(`rename_dir_perms',`{ getattr rename }')
+ define(`rename_dir_perms',`{ getattr rename }')
define(`delete_dir_perms',`{ getattr rmdir }')
- define(`manage_dir_perms',`{ create getattr setattr read write link unlink rename search add_name remove_name reparent rmdir lock ioctl }')
- define(`relabelfrom_dir_perms',`{ getattr relabelfrom }')
-@@ -216,7 +215,7 @@
+@@ -216,7 +216,7 @@
define(`getattr_file_perms',`{ getattr }')
define(`setattr_file_perms',`{ setattr }')
define(`read_file_perms',`{ getattr read lock ioctl }')
@@ -8962,7 +10981,7 @@
define(`exec_file_perms',`{ getattr read execute execute_no_trans }')
define(`append_file_perms',`{ getattr append lock ioctl }')
define(`write_file_perms',`{ getattr write append lock ioctl }')
-@@ -325,3 +324,13 @@
+@@ -325,3 +325,13 @@
#
define(`client_stream_socket_perms', `{ create ioctl read getattr write setattr append bind getopt setopt shutdown }')
define(`server_stream_socket_perms', `{ client_stream_socket_perms listen accept }')
@@ -8977,27 +10996,29 @@
+
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0.1/policy/users
---- nsaserefpolicy/policy/users 2007-05-29 14:10:59.000000000 -0400
-+++ serefpolicy-3.0.1/policy/users 2007-05-30 15:12:50.000000000 -0400
-@@ -36,8 +36,12 @@
- # role should use the staff_r role instead of the user_r role when
- # not in the sysadm_r.
- #
--ifdef(`direct_sysadm_daemon',`
-- gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)
-+ifdef(`targeted_policy',`
-+ gen_user(root, user, user_r sysadm_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
- ',`
-- gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
-+ ifdef(`direct_sysadm_daemon',`
-+ gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)
-+ ',`
-+ gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
-+ ')
- ')
+--- nsaserefpolicy/policy/users 2007-05-31 15:36:08.000000000 -0400
++++ serefpolicy-3.0.1/policy/users 2007-06-19 17:06:27.000000000 -0400
+@@ -16,7 +16,7 @@
+ # and a user process should never be assigned the system user
+ # identity.
+ #
+-gen_user(system_u,, system_r, s0, s0 - mls_systemhigh, mcs_allcats)
++gen_user(system_u, user, system_r, s0, s0 - mls_systemhigh, mcs_allcats)
+
+ #
+ # user_u is a generic user identity for Linux users who have no
+@@ -25,7 +25,7 @@
+ # SELinux user identity for a Linux user. If you do not want to
+ # permit any access to such users, then remove this entry.
+ #
+-gen_user(user_u, user, user_r, s0, s0)
++gen_user(user_u, user, user_r system_r, s0, s0)
+ gen_user(staff_u, staff, staff_r sysadm_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
+ gen_user(sysadm_u, sysadm, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats)
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.1/Rules.modular
--- nsaserefpolicy/Rules.modular 2007-05-25 09:09:10.000000000 -0400
-+++ serefpolicy-3.0.1/Rules.modular 2007-05-30 15:12:50.000000000 -0400
++++ serefpolicy-3.0.1/Rules.modular 2007-06-19 17:06:27.000000000 -0400
@@ -167,7 +167,7 @@
# these have to run individually because order matters:
$(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true
@@ -9026,7 +11047,7 @@
clean:
diff --exclude-from=exclude -N -u -r nsaserefpolicy/support/Makefile.devel serefpolicy-3.0.1/support/Makefile.devel
--- nsaserefpolicy/support/Makefile.devel 2007-05-29 13:53:56.000000000 -0400
-+++ serefpolicy-3.0.1/support/Makefile.devel 2007-05-31 06:38:16.000000000 -0400
++++ serefpolicy-3.0.1/support/Makefile.devel 2007-06-19 17:06:27.000000000 -0400
@@ -24,7 +24,7 @@
XMLLINT := $(BINDIR)/xmllint
Index: securetty_types-targeted
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/securetty_types-targeted,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- securetty_types-targeted 11 Jan 2007 22:43:22 -0000 1.1
+++ securetty_types-targeted 22 Jun 2007 19:21:00 -0000 1.2
@@ -0,0 +1,3 @@
+sysadm_tty_device_t
+user_tty_device_t
+staff_tty_device_t
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.459
retrieving revision 1.460
diff -u -r1.459 -r1.460
--- selinux-policy.spec 31 May 2007 18:37:01 -0000 1.459
+++ selinux-policy.spec 22 Jun 2007 19:21:00 -0000 1.460
@@ -4,13 +4,16 @@
%if %{?BUILD_TARGETED:0}%{!?BUILD_TARGETED:1}
%define BUILD_TARGETED 1
%endif
+%if %{?BUILD_OLPC:0}%{!?BUILD_OLPC:1}
+%define BUILD_OLPC 0
+%endif
%if %{?BUILD_MLS:0}%{!?BUILD_MLS:1}
%define BUILD_MLS 1
%endif
%define POLICYVER 21
-%define libsepolver 2.0.1-2
-%define POLICYCOREUTILSVER 2.0.7-5
-%define CHECKPOLICYVER 2.0.1-2
+%define libsepolver 2.0.3-2
+%define POLICYCOREUTILSVER 2.0.21-1
+%define CHECKPOLICYVER 2.0.3-1
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.0.1
@@ -26,6 +29,10 @@
Source5: modules-mls.conf
Source6: booleans-mls.conf
Source8: setrans-mls.conf
+Source9: modules-olpc.conf
+Source10: booleans-olpc.conf
+Source11: setrans-olpc.conf
+Source12: securetty_types-olpc
Source13: policygentool
Source14: securetty_types-targeted
Source15: securetty_types-mls
@@ -68,6 +75,7 @@
%post devel
[ -x /usr/sbin/sepolgen-ifgen ] && /usr/sbin/sepolgen-ifgen > /dev/null
+exit 0
%define setupCmds() \
make NAME=%1 TYPE=%2 DISTRO=%{distro} DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 bare \
@@ -132,7 +140,10 @@
%ghost %{_sysconfdir}/selinux/%1/contexts/files/file_contexts.homedirs \
%config %{_sysconfdir}/selinux/%1/contexts/files/media \
%dir %{_sysconfdir}/selinux/%1/contexts/users \
-%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/root
+%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/root \
+%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/guest_u \
+%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/user_u \
+%config(noreplace) %{_sysconfdir}/selinux/%1/contexts/users/staff_u
%define saveFileContext() \
if [ -s /etc/selinux/config ]; then \
@@ -143,7 +154,7 @@
fi \
fi
-%define rebuildpolicy() \
+%define loadpolicy() \
( cd /usr/share/selinux/%1; \
semodule -b base.pp %{expand:%%moduleList %1} -s %1; \
);\
@@ -161,7 +172,7 @@
%description
SELinux Reference Policy - modular.
-Based off of reference policy: Checked out revision 2312.
+Based off of reference policy: Checked out revision 2336.
%prep
%setup -q -n serefpolicy-%{version}
@@ -185,17 +196,24 @@
%if %{BUILD_TARGETED}
# Build targeted policy
# Commented out because only targeted ref policy currently builds
-%setupCmds targeted targeted-mcs y y
-%installCmds targeted targeted-mcs y y
+%setupCmds targeted targeted-mcs n y
+%installCmds targeted targeted-mcs n y
%endif
%if %{BUILD_MLS}
# Build mls policy
-%setupCmds mls strict-mls y y
-%installCmds mls strict-mls y y
+%setupCmds mls strict-mls n y
+%installCmds mls strict-mls n y
+%endif
+
+%if %{BUILD_OLPC}
+# Build targeted policy
+# Commented out because only targeted ref policy currently builds
+%setupCmds olpc targeted-mcs n y
+%installCmds olpc targeted-mcs n y
%endif
-make NAME=targeted TYPE=targeted-mcs DISTRO=%{distro} DIRECT_INITRC=y MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name}-%{version} POLY=y MLS_CATS=1024 MCS_CATS=1024 install-headers install-docs
+make NAME=targeted TYPE=targeted-mcs DISTRO=%{distro} DIRECT_INITRC=n MONOLITHIC=%{monolithic} DESTDIR=%{buildroot} PKGNAME=%{name}-%{version} POLY=y MLS_CATS=1024 MCS_CATS=1024 install-headers install-docs
mkdir %{buildroot}%{_usr}/share/selinux/devel/
mv %{buildroot}%{_usr}/share/selinux/targeted/include %{buildroot}%{_usr}/share/selinux/devel/include
install -m 755 ${RPM_SOURCE_DIR}/policygentool %{buildroot}%{_usr}/share/selinux/devel/
@@ -251,6 +269,7 @@
sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config
fi
fi
+exit 0
%if %{BUILD_TARGETED}
%package targeted
@@ -269,14 +288,42 @@
%saveFileContext targeted
%post targeted
-%rebuildpolicy targeted
+%loadpolicy targeted
%relabel targeted
+exit 0
-%triggerpostun targeted -- selinux-policy-targeted <= 2.0.7
-%rebuildpolicy targeted
+%triggerpostun targeted -- selinux-policy-targeted < 3.0.1
+semanage login -m -s "system_u" __default__ 2> /dev/null
+semanage user -a -P unconfined -R "unconfined_r system_r" unconfined_u 2> /dev/null
+restorecon -R /root 2> /dev/null
+exit 0
%files targeted
%fileList targeted
+%endif
+
+%if %{BUILD_OLPC}
+%package olpc
+Summary: SELinux olpc base policy
+Group: System Environment/Base
+Provides: selinux-policy-base
+Prereq: policycoreutils >= %{POLICYCOREUTILSVER}
+Prereq: coreutils
+Prereq: selinux-policy = %{version}-%{release}
+
+%description olpc
+SELinux Reference policy olpc base module.
+
+%pre olpc
+%saveFileContext olpc
+
+%post olpc
+%loadpolicy olpc
+%relabel olpc
+exit 0
+
+%files olpc
+%fileList olpc
%endif
@@ -298,8 +345,9 @@
%saveFileContext mls
%post mls
-%rebuildpolicy mls
+%loadpolicy mls
%relabel mls
+exit 0
%files mls
%fileList mls
More information about the fedora-extras-commits
mailing list