rpms/selinux-policy/devel policy-20070703.patch, 1.59, 1.60 selinux-policy.spec, 1.522, 1.523

[Daniel J Walsh (dwalsh)]

Author: dwalsh

Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv7306

Modified Files:
	policy-20070703.patch selinux-policy.spec 
Log Message:
* Tue Sep 18 2007 Dan Walsh <dwalsh at redhat.com> 3.0.8-2
- Remove hplip_etc_t change back to etc_t.


policy-20070703.patch:

Index: policy-20070703.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20070703.patch,v
retrieving revision 1.59
retrieving revision 1.60
diff -u -r1.59 -r1.60
--- policy-20070703.patch	18 Sep 2007 15:09:11 -0000	1.59
+++ policy-20070703.patch	19 Sep 2007 01:11:31 -0000	1.60
@@ -2425,6 +2425,17 @@
 +		kernel_udp_recvfrom_unlabeled(domain)
 +	')
 +')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-3.0.8/policy/modules/kernel/files.fc
+--- nsaserefpolicy/policy/modules/kernel/files.fc	2007-09-12 10:34:49.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/files.fc	2007-09-18 20:56:27.000000000 -0400
+@@ -210,6 +210,7 @@
+ /usr/lost\+found/.*		<<none>>
+ 
+ /usr/share(/.*)?/lib(64)?(/.*)?	gen_context(system_u:object_r:usr_t,s0)
++/usr/share/doc(/.*)?/README.*	gen_context(system_u:object_r:usr_t,s0)
+ 
+ /usr/src(/.*)?			gen_context(system_u:object_r:src_t,s0)
+ /usr/src/kernels/.+/lib(/.*)?	gen_context(system_u:object_r:usr_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.0.8/policy/modules/kernel/files.if
 --- nsaserefpolicy/policy/modules/kernel/files.if	2007-07-03 07:05:38.000000000 -0400
 +++ serefpolicy-3.0.8/policy/modules/kernel/files.if	2007-09-17 16:20:18.000000000 -0400
@@ -2686,7 +2697,7 @@
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.0.8/policy/modules/kernel/files.te
 --- nsaserefpolicy/policy/modules/kernel/files.te	2007-09-12 10:34:49.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/kernel/files.te	2007-09-17 16:20:18.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/kernel/files.te	2007-09-18 12:11:13.000000000 -0400
 @@ -1,5 +1,5 @@
  
 -policy_module(files,1.6.1)
@@ -2694,16 +2705,17 @@
  
  ########################################
  #
-@@ -55,6 +55,8 @@
+@@ -55,6 +55,9 @@
  # compatibility aliases for removed types:
  typealias etc_t alias automount_etc_t;
  typealias etc_t alias snmpd_etc_t;
 +typealias etc_t alias gconf_etc_t;
 +typealias etc_t alias soundd_etc_t;
++typealias etc_t alias hplip_etc_t;
  
  #
  # etc_runtime_t is the type of various
-@@ -188,6 +190,7 @@
+@@ -188,6 +191,7 @@
  fs_associate(file_type)
  fs_associate_noxattr(file_type)
  fs_associate_tmpfs(file_type)
@@ -4240,6 +4252,17 @@
  corenet_sendrecv_rndc_client_packets(ndc_t)
  
  fs_getattr_xattr_fs(ndc_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.0.8/policy/modules/services/bluetooth.te
+--- nsaserefpolicy/policy/modules/services/bluetooth.te	2007-08-02 08:17:27.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/bluetooth.te	2007-09-18 13:32:50.000000000 -0400
+@@ -128,6 +128,7 @@
+ 	dbus_system_bus_client_template(bluetooth,bluetooth_t)
+ 	dbus_connect_system_bus(bluetooth_t)
+ 	dbus_send_system_bus(bluetooth_t)
++	allow bluetooth_t self:dbus send_msg;
+ ')
+ 
+ optional_policy(`
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.0.8/policy/modules/services/clamav.te
 --- nsaserefpolicy/policy/modules/services/clamav.te	2007-09-12 10:34:50.000000000 -0400
 +++ serefpolicy-3.0.8/policy/modules/services/clamav.te	2007-09-17 16:20:18.000000000 -0400
@@ -4736,8 +4759,8 @@
  ifdef(`TODO',`
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.8/policy/modules/services/cups.fc
 --- nsaserefpolicy/policy/modules/services/cups.fc	2007-05-29 14:10:57.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/cups.fc	2007-09-18 10:39:32.000000000 -0400
-@@ -8,6 +8,7 @@
++++ serefpolicy-3.0.8/policy/modules/services/cups.fc	2007-09-18 12:31:53.000000000 -0400
+@@ -8,17 +8,14 @@
  /etc/cups/ppd/.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
  /etc/cups/ppds\.dat	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
  /etc/cups/printers\.conf.* --	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
@@ -4745,7 +4768,9 @@
  /etc/cups/certs		-d	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
  /etc/cups/certs/.*	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
  
-@@ -17,8 +18,6 @@
+-/etc/hp(/.*)?			gen_context(system_u:object_r:hplip_etc_t,s0)
+-
+ /etc/printcap.* 	--	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
  
  /usr/bin/cups-config-daemon --	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
  
@@ -4754,11 +4779,13 @@
  /usr/lib(64)?/cups/daemon/cups-lpd -- gen_context(system_u:object_r:cupsd_lpd_exec_t,s0)
  
  /usr/libexec/hal_lpadmin --	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
-@@ -26,6 +25,7 @@
+@@ -26,6 +23,9 @@
  /usr/sbin/cupsd		--	gen_context(system_u:object_r:cupsd_exec_t,s0)
  /usr/sbin/hal_lpadmin --	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
  /usr/sbin/hpiod		--	gen_context(system_u:object_r:hplip_exec_t,s0)
 +/usr/sbin/hp-[^/]+	--	gen_context(system_u:object_r:hplip_exec_t,s0)
++/usr/lib(64)?/cups/backend/hp.* -- gen_context(system_u:object_r:hplip_exec_t,s0)
++
  /usr/sbin/printconf-backend --	gen_context(system_u:object_r:cupsd_config_exec_t,s0)
  /usr/sbin/ptal-printd	--	gen_context(system_u:object_r:ptal_exec_t,s0)
  /usr/sbin/ptal-mlcd	--	gen_context(system_u:object_r:ptal_exec_t,s0)
@@ -4769,8 +4796,18 @@
 +/usr/local/Brother/inf(/.*)?	gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.8/policy/modules/services/cups.te
 --- nsaserefpolicy/policy/modules/services/cups.te	2007-09-12 10:34:50.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/cups.te	2007-09-18 10:43:40.000000000 -0400
-@@ -81,12 +81,11 @@
++++ serefpolicy-3.0.8/policy/modules/services/cups.te	2007-09-18 12:15:12.000000000 -0400
+@@ -49,9 +49,6 @@
+ type hplip_exec_t;
+ init_daemon_domain(hplip_t,hplip_exec_t)
+ 
+-type hplip_etc_t;
+-files_config_file(hplip_etc_t)
+-
+ type hplip_var_run_t;
+ files_pid_file(hplip_var_run_t)
+ 
+@@ -81,12 +78,11 @@
  # /usr/lib/cups/backend/serial needs sys_admin(?!)
  allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_resource sys_tty_config };
  dontaudit cupsd_t self:capability { sys_tty_config net_admin };
@@ -4784,7 +4821,7 @@
  allow cupsd_t self:tcp_socket create_stream_socket_perms;
  allow cupsd_t self:udp_socket create_socket_perms;
  allow cupsd_t self:appletalk_socket create_socket_perms;
-@@ -105,7 +104,7 @@
+@@ -105,7 +101,7 @@
  
  # allow cups to execute its backend scripts
  can_exec(cupsd_t, cupsd_exec_t)
@@ -4793,7 +4830,14 @@
  allow cupsd_t cupsd_exec_t:lnk_file read;
  
  manage_files_pattern(cupsd_t,cupsd_log_t,cupsd_log_t)
-@@ -129,6 +128,8 @@
+@@ -122,13 +118,13 @@
+ manage_sock_files_pattern(cupsd_t,cupsd_var_run_t,cupsd_var_run_t)
+ files_pid_filetrans(cupsd_t,cupsd_var_run_t,file)
+ 
+-read_files_pattern(cupsd_t,hplip_etc_t,hplip_etc_t)
+-
+ allow cupsd_t hplip_var_run_t:file { read getattr };
+ 
  stream_connect_pattern(cupsd_t,ptal_var_run_t,ptal_var_run_t,ptal_t)
  allow cupsd_t ptal_var_run_t : sock_file setattr;
  
@@ -4802,7 +4846,7 @@
  kernel_read_system_state(cupsd_t)
  kernel_read_network_state(cupsd_t)
  kernel_read_all_sysctls(cupsd_t)
-@@ -150,21 +151,26 @@
+@@ -150,21 +146,26 @@
  corenet_tcp_bind_reserved_port(cupsd_t)
  corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t)
  corenet_tcp_connect_all_ports(cupsd_t)
@@ -4830,7 +4874,7 @@
  mls_file_downgrade(cupsd_t)
  mls_file_write_all_levels(cupsd_t)
  mls_file_read_all_levels(cupsd_t)
-@@ -174,6 +180,7 @@
+@@ -174,6 +175,7 @@
  term_search_ptys(cupsd_t)
  
  auth_domtrans_chk_passwd(cupsd_t)
@@ -4838,7 +4882,7 @@
  auth_dontaudit_read_pam_pid(cupsd_t)
  
  # Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp
-@@ -187,7 +194,7 @@
+@@ -187,7 +189,7 @@
  # read python modules
  files_read_usr_files(cupsd_t)
  # for /var/lib/defoma
@@ -4847,7 +4891,7 @@
  files_list_world_readable(cupsd_t)
  files_read_world_readable_files(cupsd_t)
  files_read_world_readable_symlinks(cupsd_t)
-@@ -202,6 +209,7 @@
+@@ -202,6 +204,7 @@
  files_dontaudit_getattr_all_tmp_files(cupsd_t)
  
  selinux_compute_access_vector(cupsd_t)
@@ -4855,7 +4899,7 @@
  
  init_exec_script_files(cupsd_t)
  
-@@ -221,17 +229,37 @@
+@@ -221,17 +224,37 @@
  
  sysnet_read_config(cupsd_t)
  
@@ -4893,7 +4937,7 @@
  	apm_domtrans_client(cupsd_t)
  ')
  
-@@ -263,16 +291,16 @@
+@@ -263,16 +286,16 @@
  ')
  
  optional_policy(`
@@ -4914,7 +4958,7 @@
  	seutil_sigchld_newrole(cupsd_t)
  ')
  
-@@ -377,6 +405,14 @@
+@@ -377,6 +400,14 @@
  ')
  
  optional_policy(`
@@ -4929,7 +4973,19 @@
  	cron_system_entry(cupsd_config_t, cupsd_config_exec_t)
  ')
  
-@@ -560,7 +596,7 @@
+@@ -526,11 +557,6 @@
+ 
+ cups_stream_connect(hplip_t)
+ 
+-allow hplip_t hplip_etc_t:dir list_dir_perms;
+-read_files_pattern(hplip_t,hplip_etc_t,hplip_etc_t)
+-read_lnk_files_pattern(hplip_t,hplip_etc_t,hplip_etc_t)
+-files_search_etc(hplip_t)
+-
+ manage_files_pattern(hplip_t,hplip_var_run_t,hplip_var_run_t)
+ files_pid_filetrans(hplip_t,hplip_var_run_t,file)
+ 
+@@ -560,7 +586,7 @@
  dev_read_urand(hplip_t)
  dev_read_rand(hplip_t)
  dev_rw_generic_usb_dev(hplip_t)
@@ -4938,7 +4994,7 @@
  
  fs_getattr_all_fs(hplip_t)
  fs_search_auto_mountpoints(hplip_t)
-@@ -587,8 +623,6 @@
+@@ -587,8 +613,6 @@
  userdom_dontaudit_search_sysadm_home_dirs(hplip_t)
  userdom_dontaudit_search_all_users_home_content(hplip_t)
  


Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.522
retrieving revision 1.523
diff -u -r1.522 -r1.523
--- selinux-policy.spec	17 Sep 2007 23:26:58 -0000	1.522
+++ selinux-policy.spec	19 Sep 2007 01:11:31 -0000	1.523
@@ -17,7 +17,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.0.8
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -362,6 +362,10 @@
 %endif
 
 %changelog
+* Tue Sep 18 2007 Dan Walsh <dwalsh at redhat.com> 3.0.8-2
+- Remove hplip_etc_t change back to etc_t.
+
+
 * Mon Sep 17 2007 Dan Walsh <dwalsh at redhat.com> 3.0.8-1
 - Allow cron to search nfs and samba homedirs