rpms/selinux-policy/devel policy-20070501.patch, 1.5, 1.6 selinux-policy.spec, 1.451, 1.452
Daniel J Walsh (dwalsh)
fedora-extras-commits at redhat.com
Wed May 16 19:32:08 UTC 2007
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv28911
Modified Files:
policy-20070501.patch selinux-policy.spec
Log Message:
* Wed May 16 2007 Dan Walsh <dwalsh at redhat.com> 2.6.4-2
- Allow unconfined_t to transition to NetworkManager_t
- Fix netlabel policy
policy-20070501.patch:
Index: policy-20070501.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20070501.patch,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- policy-20070501.patch 14 May 2007 19:54:57 -0000 1.5
+++ policy-20070501.patch 16 May 2007 19:31:34 -0000 1.6
@@ -1009,8 +1009,13 @@
dev_dontaudit_rw_dri($1_mozilla_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-2.6.4/policy/modules/apps/slocate.te
--- nsaserefpolicy/policy/modules/apps/slocate.te 2007-04-30 11:25:12.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/apps/slocate.te 2007-05-08 09:59:33.000000000 -0400
-@@ -43,7 +43,7 @@
++++ serefpolicy-2.6.4/policy/modules/apps/slocate.te 2007-05-15 11:05:16.000000000 -0400
+@@ -39,11 +39,12 @@
+
+ files_list_all(locate_t)
+ files_getattr_all_files(locate_t)
++files_getattr_all_sockets(locate_t)
+ files_read_etc_runtime_files(locate_t)
files_read_etc_files(locate_t)
fs_getattr_all_fs(locate_t)
@@ -1653,8 +1658,8 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-2.6.4/policy/modules/kernel/filesystem.te
--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-04-23 09:35:56.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.te 2007-05-08 09:59:33.000000000 -0400
-@@ -54,17 +54,30 @@
++++ serefpolicy-2.6.4/policy/modules/kernel/filesystem.te 2007-05-16 09:21:57.000000000 -0400
+@@ -54,17 +54,29 @@
type capifs_t;
fs_type(capifs_t)
@@ -1676,7 +1681,6 @@
#genfscon eventpollfs / gen_context(system_u:object_r:eventpollfs_t,s0)
+type fusefs_t;
-+fs_type(fusefs_t)
+fs_noxattr_type(fusefs_t)
+allow fusefs_t self:filesystem associate;
+genfscon fuse / gen_context(system_u:object_r:fusefs_t,s0)
@@ -1685,12 +1689,11 @@
type futexfs_t;
fs_type(futexfs_t)
genfscon futexfs / gen_context(system_u:object_r:futexfs_t,s0)
-@@ -83,6 +96,12 @@
+@@ -83,6 +95,11 @@
fs_type(inotifyfs_t)
genfscon inotifyfs / gen_context(system_u:object_r:inotifyfs_t,s0)
+type mvfs_t;
-+fs_type(mvfs_t)
+fs_noxattr_type(mvfs_t)
+allow mvfs_t self:filesystem associate;
+genfscon mvfs / gen_context(system_u:object_r:mvfs_t,s0)
@@ -1698,6 +1701,18 @@
type nfsd_fs_t;
fs_type(nfsd_fs_t)
genfscon nfsd / gen_context(system_u:object_r:nfsd_fs_t,s0)
+@@ -105,6 +122,11 @@
+ genfscon rpc_pipefs / gen_context(system_u:object_r:rpc_pipefs_t,s0)
+ files_mountpoint(rpc_pipefs_t)
+
++type vxfs_t;
++fs_noxattr_type(vxfs_t)
++files_mountpoint(vxfs_t)
++genfscon vxfs / gen_context(system_u:object_r:vxfs_t,s0)
++
+ #
+ # tmpfs_t is the type for tmpfs filesystems
+ #
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-2.6.4/policy/modules/kernel/kernel.if
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-05-02 15:04:46.000000000 -0400
+++ serefpolicy-2.6.4/policy/modules/kernel/kernel.if 2007-05-08 09:59:33.000000000 -0400
@@ -2502,6 +2517,18 @@
dev_read_urand(automount_t)
domain_use_interactive_fds(automount_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-2.6.4/policy/modules/services/avahi.te
+--- nsaserefpolicy/policy/modules/services/avahi.te 2007-05-03 08:50:57.000000000 -0400
++++ serefpolicy-2.6.4/policy/modules/services/avahi.te 2007-05-15 11:02:52.000000000 -0400
+@@ -18,7 +18,7 @@
+ # Local policy
+ #
+
+-allow avahi_t self:capability { dac_override setgid chown kill setuid sys_chroot };
++allow avahi_t self:capability { dac_override setgid chown fowner kill setuid sys_chroot };
+ dontaudit avahi_t self:capability sys_tty_config;
+ allow avahi_t self:process { setrlimit signal_perms setcap };
+ allow avahi_t self:fifo_file { read write };
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-2.6.4/policy/modules/services/bind.te
--- nsaserefpolicy/policy/modules/services/bind.te 2007-04-23 09:36:01.000000000 -0400
+++ serefpolicy-2.6.4/policy/modules/services/bind.te 2007-05-08 09:59:33.000000000 -0400
@@ -2925,7 +2952,7 @@
optional_policy(`
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-2.6.4/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-03-26 10:39:04.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/services/dbus.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.4/policy/modules/services/dbus.if 2007-05-14 15:57:48.000000000 -0400
@@ -49,6 +49,12 @@
## </param>
#
@@ -2981,7 +3008,15 @@
miscfiles_read_localization($1_dbusd_t)
-@@ -273,6 +290,31 @@
+@@ -204,6 +221,7 @@
+ # For connecting to the bus
+ files_search_pids($2)
+ stream_connect_pattern($2,system_dbusd_var_run_t,system_dbusd_var_run_t,system_dbusd_t)
++ dbus_read_config($2)
+ ')
+
+ #######################################
+@@ -273,6 +291,31 @@
########################################
## <summary>
@@ -3013,7 +3048,7 @@
## Read dbus configuration.
## </summary>
## <param name="domain">
-@@ -286,6 +328,7 @@
+@@ -286,6 +329,7 @@
type dbusd_etc_t;
')
@@ -3021,7 +3056,7 @@
allow $1 dbusd_etc_t:file read_file_perms;
')
-@@ -346,3 +389,23 @@
+@@ -346,3 +390,23 @@
allow $1 system_dbusd_t:dbus *;
')
@@ -3334,7 +3369,7 @@
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-2.6.4/policy/modules/services/hal.if
--- nsaserefpolicy/policy/modules/services/hal.if 2007-02-19 11:32:53.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/hal.if 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.4/policy/modules/services/hal.if 2007-05-14 15:45:53.000000000 -0400
@@ -208,3 +208,98 @@
files_search_pids($1)
allow $1 hald_var_run_t:file rw_file_perms;
@@ -3788,6 +3823,32 @@
# apache should set close-on-exec
apache_dontaudit_append_log(system_mail_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-2.6.4/policy/modules/services/networkmanager.if
+--- nsaserefpolicy/policy/modules/services/networkmanager.if 2006-11-16 17:15:20.000000000 -0500
++++ serefpolicy-2.6.4/policy/modules/services/networkmanager.if 2007-05-16 08:30:20.000000000 -0400
+@@ -78,3 +78,22 @@
+ allow $1 NetworkManager_t:dbus send_msg;
+ allow NetworkManager_t $1:dbus send_msg;
+ ')
++
++########################################
++## <summary>
++## Transition to NetworkManager
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`networkmanager_domtrans',`
++ gen_require(`
++ type NetworkManager_t, NetworkManager_exec_t;
++ ')
++ corecmd_search_bin($1)
++ domtrans_pattern($1,NetworkManager_exec_t,NetworkManager_t)
++
++')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-2.6.4/policy/modules/services/nis.if
--- nsaserefpolicy/policy/modules/services/nis.if 2007-03-26 10:39:04.000000000 -0400
+++ serefpolicy-2.6.4/policy/modules/services/nis.if 2007-05-08 09:59:33.000000000 -0400
@@ -4708,8 +4769,16 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-2.6.4/policy/modules/services/samba.fc
--- nsaserefpolicy/policy/modules/services/samba.fc 2007-02-23 16:50:01.000000000 -0500
-+++ serefpolicy-2.6.4/policy/modules/services/samba.fc 2007-05-08 09:59:33.000000000 -0400
-@@ -27,6 +27,9 @@
++++ serefpolicy-2.6.4/policy/modules/services/samba.fc 2007-05-16 08:24:46.000000000 -0400
+@@ -3,6 +3,7 @@
+ # /etc
+ #
+ /etc/samba/MACHINE\.SID -- gen_context(system_u:object_r:samba_secrets_t,s0)
++/etc/samba/passdb.tdb -- gen_context(system_u:object_r:samba_secrets_t,s0)
+ /etc/samba/secrets\.tdb -- gen_context(system_u:object_r:samba_secrets_t,s0)
+ /etc/samba/smbpasswd -- gen_context(system_u:object_r:samba_secrets_t,s0)
+ /etc/samba(/.*)? gen_context(system_u:object_r:samba_etc_t,s0)
+@@ -27,6 +28,9 @@
/var/cache/samba/winbindd_privileged(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0)
/var/lib/samba(/.*)? gen_context(system_u:object_r:samba_var_t,s0)
@@ -5377,6 +5446,22 @@
ifdef(`TODO',`
tunable_policy(`ssh_sysadm_login',`
# Relabel and access ptys created by sshd
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-2.6.4/policy/modules/services/tftp.te
+--- nsaserefpolicy/policy/modules/services/tftp.te 2007-04-23 09:36:01.000000000 -0400
++++ serefpolicy-2.6.4/policy/modules/services/tftp.te 2007-05-14 16:13:37.000000000 -0400
+@@ -69,6 +69,7 @@
+ logging_send_syslog_msg(tftpd_t)
+
+ miscfiles_read_localization(tftpd_t)
++miscfiles_read_public_files(tftpd_t)
+
+ sysnet_read_config(tftpd_t)
+ sysnet_use_ldap(tftpd_t)
+@@ -102,3 +103,4 @@
+ optional_policy(`
+ udev_read_db(tftpd_t)
+ ')
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-2.6.4/policy/modules/services/w3c.fc
--- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-2.6.4/policy/modules/services/w3c.fc 2007-05-08 09:59:33.000000000 -0400
@@ -6905,6 +6990,20 @@
+ term_use_generic_ptys(mount_ntfs_t)
+')
+
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-2.6.4/policy/modules/system/netlabel.te
+--- nsaserefpolicy/policy/modules/system/netlabel.te 2006-11-16 17:15:24.000000000 -0500
++++ serefpolicy-2.6.4/policy/modules/system/netlabel.te 2007-05-15 21:07:39.000000000 -0400
+@@ -20,6 +20,10 @@
+ allow netlabel_mgmt_t self:capability net_admin;
+ allow netlabel_mgmt_t self:netlink_socket create_socket_perms;
+
++init_use_script_ptys(netlabel_mgmt_t)
++
++files_read_etc_files(netlabel_mgmt_t)
++
+ kernel_read_network_state(netlabel_mgmt_t)
+
+ libs_use_ld_so(netlabel_mgmt_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-2.6.4/policy/modules/system/raid.te
--- nsaserefpolicy/policy/modules/system/raid.te 2007-04-23 09:36:02.000000000 -0400
+++ serefpolicy-2.6.4/policy/modules/system/raid.te 2007-05-08 09:59:33.000000000 -0400
@@ -7321,7 +7420,7 @@
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-2.6.4/policy/modules/system/unconfined.te
--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-04-23 09:36:02.000000000 -0400
-+++ serefpolicy-2.6.4/policy/modules/system/unconfined.te 2007-05-08 09:59:33.000000000 -0400
++++ serefpolicy-2.6.4/policy/modules/system/unconfined.te 2007-05-16 08:28:37.000000000 -0400
@@ -6,6 +6,15 @@
# Declarations
#
@@ -7358,7 +7457,15 @@
init_dbus_chat_script(unconfined_t)
dbus_stub(unconfined_t)
-@@ -153,6 +160,8 @@
+@@ -93,6 +100,7 @@
+
+ optional_policy(`
+ networkmanager_dbus_chat(unconfined_t)
++ networkmanager_domtrans(unconfined_t)
+ ')
+
+ optional_policy(`
+@@ -153,6 +161,8 @@
optional_policy(`
rpm_domtrans(unconfined_t)
@@ -7367,7 +7474,7 @@
')
optional_policy(`
-@@ -192,6 +201,9 @@
+@@ -192,6 +202,9 @@
optional_policy(`
xserver_domtrans_xdm_xserver(unconfined_t)
')
@@ -7377,7 +7484,7 @@
')
########################################
-@@ -200,10 +212,18 @@
+@@ -200,10 +213,18 @@
#
ifdef(`targeted_policy',`
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.451
retrieving revision 1.452
diff -u -r1.451 -r1.452
--- selinux-policy.spec 14 May 2007 19:54:57 -0000 1.451
+++ selinux-policy.spec 16 May 2007 19:31:34 -0000 1.452
@@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 2.6.4
-Release: 1%{?dist}
+Release: 2%{?dist}
License: GPL
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -359,6 +359,10 @@
%endif
%changelog
+* Wed May 16 2007 Dan Walsh <dwalsh at redhat.com> 2.6.4-2
+- Allow unconfined_t to transition to NetworkManager_t
+- Fix netlabel policy
+
* Mon May 14 2007 Dan Walsh <dwalsh at redhat.com> 2.6.4-1
- Update to latest from upstream
More information about the fedora-extras-commits
mailing list