rpms/selinux-policy/devel modules-targeted.conf, 1.81, 1.82 policy-20071130.patch, 1.52, 1.53 selinux-policy.spec, 1.601, 1.602
Daniel J Walsh (dwalsh)
fedora-extras-commits at redhat.com
Tue Feb 5 18:26:25 UTC 2008
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv25633
Modified Files:
modules-targeted.conf policy-20071130.patch
selinux-policy.spec
Log Message:
* Tue Feb 5 2008 Dan Walsh <dwalsh at redhat.com> 3.2.6-6
- Add policy for kerneloops
- Add policy for gnomeclock
Index: modules-targeted.conf
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/modules-targeted.conf,v
retrieving revision 1.81
retrieving revision 1.82
diff -u -r1.81 -r1.82
--- modules-targeted.conf 2 Feb 2008 06:30:04 -0000 1.81
+++ modules-targeted.conf 5 Feb 2008 18:25:42 -0000 1.82
@@ -473,6 +473,13 @@
gnome = module
# Layer: services
+# Module: gnomeclock
+#
+# gnomeclock used by dbus/polkit to set time
+#
+gnomeclock = module
+
+# Layer: services
# Module: hal
#
# Hardware abstraction layer
@@ -1613,3 +1620,10 @@
#
prelude = module
+# Layer: services
+# Module: kerneloops
+#
+# program to collect and submit kernel oopses to kerneloops.org
+#
+kerneloops = module
+
policy-20071130.patch:
Index: policy-20071130.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20071130.patch,v
retrieving revision 1.52
retrieving revision 1.53
diff -u -r1.52 -r1.53
--- policy-20071130.patch 4 Feb 2008 21:41:59 -0000 1.52
+++ policy-20071130.patch 5 Feb 2008 18:25:42 -0000 1.53
@@ -6429,7 +6429,7 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.2.6/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.6/policy/modules/services/apache.te 2008-02-01 16:01:42.000000000 -0500
++++ serefpolicy-3.2.6/policy/modules/services/apache.te 2008-02-05 13:01:09.000000000 -0500
@@ -20,6 +20,8 @@
# Declarations
#
@@ -7516,7 +7516,7 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.2.6/policy/modules/services/avahi.te
--- nsaserefpolicy/policy/modules/services/avahi.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.6/policy/modules/services/avahi.te 2008-02-01 16:01:42.000000000 -0500
++++ serefpolicy-3.2.6/policy/modules/services/avahi.te 2008-02-05 13:17:08.000000000 -0500
@@ -13,6 +13,9 @@
type avahi_var_run_t;
files_pid_file(avahi_var_run_t)
@@ -8223,7 +8223,7 @@
Binary files nsaserefpolicy/policy/modules/services/consolekit.pp and serefpolicy-3.2.6/policy/modules/services/consolekit.pp differ
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.2.6/policy/modules/services/consolekit.te
--- nsaserefpolicy/policy/modules/services/consolekit.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.6/policy/modules/services/consolekit.te 2008-02-04 11:52:57.000000000 -0500
++++ serefpolicy-3.2.6/policy/modules/services/consolekit.te 2008-02-05 13:20:29.000000000 -0500
@@ -13,6 +13,9 @@
type consolekit_var_run_t;
files_pid_file(consolekit_var_run_t)
@@ -8261,7 +8261,7 @@
# needs to read /var/lib/dbus/machine-id
files_read_var_lib_files(consolekit_t)
-@@ -47,15 +56,31 @@
+@@ -47,16 +56,32 @@
auth_use_nsswitch(consolekit_t)
@@ -8282,18 +8282,21 @@
+hal_ptrace(consolekit_t)
+mcs_ptrace_all(consolekit_t)
+
-+optional_policy(`
+ optional_policy(`
+- dbus_system_bus_client_template(consolekit, consolekit_t)
+- dbus_connect_system_bus(consolekit_t)
+ cron_read_system_job_lib_files(consolekit_t)
+')
-+
- optional_policy(`
- dbus_system_bus_client_template(consolekit, consolekit_t)
- dbus_connect_system_bus(consolekit_t)
--
+
+- hal_dbus_chat(consolekit_t)
++optional_policy(`
+ dbus_system_domain(consolekit_t, consolekit_exec_t)
- hal_dbus_chat(consolekit_t)
++ optional_policy(`
++ hal_dbus_chat(consolekit_t)
++ ')
optional_policy(`
+ unconfined_dbus_chat(consolekit_t)
@@ -64,6 +89,33 @@
')
@@ -9659,7 +9662,7 @@
# Local policy
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.6/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500
-+++ serefpolicy-3.2.6/policy/modules/services/dbus.if 2008-02-01 16:01:42.000000000 -0500
++++ serefpolicy-3.2.6/policy/modules/services/dbus.if 2008-02-05 13:18:08.000000000 -0500
@@ -53,6 +53,7 @@
gen_require(`
type system_dbusd_exec_t, system_dbusd_t, dbusd_etc_t;
@@ -9840,7 +9843,7 @@
## Read dbus configuration.
## </summary>
## <param name="domain">
-@@ -366,3 +443,52 @@
+@@ -366,3 +443,55 @@
allow $1 system_dbusd_t:dbus *;
')
@@ -9892,10 +9895,13 @@
+
+ domtrans_pattern(system_dbusd_t,$2,$1)
+
++ dbus_system_bus_client_template($1,$1)
++ dbus_connect_system_bus($1)
++
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.2.6/policy/modules/services/dbus.te
--- nsaserefpolicy/policy/modules/services/dbus.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.6/policy/modules/services/dbus.te 2008-02-01 16:01:42.000000000 -0500
++++ serefpolicy-3.2.6/policy/modules/services/dbus.te 2008-02-05 13:15:48.000000000 -0500
@@ -9,6 +9,7 @@
#
# Delcarations
@@ -9921,6 +9927,27 @@
selinux_get_fs_mount(system_dbusd_t)
selinux_validate_context(system_dbusd_t)
+@@ -121,9 +123,20 @@
+ ')
+
+ optional_policy(`
++ polkit_domtrans_auth(system_dbusd_t)
++ polkit_search_lib(system_dbusd_t)
++')
++
++optional_policy(`
+ sysnet_domtrans_dhcpc(system_dbusd_t)
+ ')
+
+ optional_policy(`
+ udev_read_db(system_dbusd_t)
+ ')
++
++optional_policy(`
++ consolekit_dbus_chat(system_dbusd_t)
++')
++
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.if serefpolicy-3.2.6/policy/modules/services/dcc.if
--- nsaserefpolicy/policy/modules/services/dcc.if 2007-03-26 10:39:05.000000000 -0400
+++ serefpolicy-3.2.6/policy/modules/services/dcc.if 2008-02-01 16:01:42.000000000 -0500
@@ -11510,6 +11537,146 @@
')
optional_policy(`
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.fc serefpolicy-3.2.6/policy/modules/services/gnomeclock.fc
+--- nsaserefpolicy/policy/modules/services/gnomeclock.fc 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.2.6/policy/modules/services/gnomeclock.fc 2008-02-05 13:14:26.000000000 -0500
+@@ -0,0 +1,2 @@
++
++/usr/libexec/gnome-clock-applet-mechanism -- gen_context(system_u:object_r:gnomeclock_exec_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.if serefpolicy-3.2.6/policy/modules/services/gnomeclock.if
+--- nsaserefpolicy/policy/modules/services/gnomeclock.if 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.2.6/policy/modules/services/gnomeclock.if 2008-02-05 13:14:26.000000000 -0500
+@@ -0,0 +1,75 @@
++
++## <summary>policy for gnomeclock</summary>
++
++########################################
++## <summary>
++## Execute a domain transition to run gnomeclock.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`gnomeclock_domtrans',`
++ gen_require(`
++ type gnomeclock_t;
++ type gnomeclock_exec_t;
++ ')
++
++ domtrans_pattern($1,gnomeclock_exec_t,gnomeclock_t)
++')
++
++
++########################################
++## <summary>
++## Execute gnomeclock in the gnomeclock domain, and
++## allow the specified role the gnomeclock domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access
++## </summary>
++## </param>
++## <param name="role">
++## <summary>
++## The role to be allowed the gnomeclock domain.
++## </summary>
++## </param>
++## <param name="terminal">
++## <summary>
++## The type of the role's terminal.
++## </summary>
++## </param>
++#
++interface(`gnomeclock_run',`
++ gen_require(`
++ type gnomeclock_t;
++ ')
++
++ gnomeclock_domtrans($1)
++ role $2 types gnomeclock_t;
++ dontaudit gnomeclock_t $3:chr_file rw_term_perms;
++')
++
++
++########################################
++## <summary>
++## Send and receive messages from
++## gnomeclock over dbus.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`gnomeclock_dbus_chat',`
++ gen_require(`
++ type gnomeclock_t;
++ class dbus send_msg;
++ ')
++
++ allow $1 gnomeclock_t:dbus send_msg;
++ allow gnomeclock_t $1:dbus send_msg;
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gnomeclock.te serefpolicy-3.2.6/policy/modules/services/gnomeclock.te
+--- nsaserefpolicy/policy/modules/services/gnomeclock.te 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.2.6/policy/modules/services/gnomeclock.te 2008-02-05 13:21:34.000000000 -0500
+@@ -0,0 +1,51 @@
++policy_module(gnomeclock,1.0.0)
++########################################
++#
++# Declarations
++#
++
++type gnomeclock_t;
++type gnomeclock_exec_t;
++dbus_system_domain(gnomeclock_t, gnomeclock_exec_t)
++
++
++########################################
++#
++# gnomeclock local policy
++#
++allow gnomeclock_t self:capability sys_time;
++allow gnomeclock_t self:process getsched;
++
++## internal communication is often done using fifo and unix sockets.
++allow gnomeclock_t self:fifo_file rw_file_perms;
++allow gnomeclock_t self:unix_stream_socket create_stream_socket_perms;
++
++corecmd_search_bin(gnomeclock_t)
++
++files_read_etc_files(gnomeclock_t)
++files_read_usr_files(gnomeclock_t)
++
++fs_list_inotifyfs(gnomeclock_t)
++
++auth_use_nsswitch(gnomeclock_t)
++
++libs_use_ld_so(gnomeclock_t)
++libs_use_shared_libs(gnomeclock_t)
++
++miscfiles_read_localization(gnomeclock_t)
++
++userdom_read_all_users_state(gnomeclock_t)
++
++optional_policy(`
++ consolekit_dbus_chat(gnomeclock_t)
++')
++
++optional_policy(`
++ clock_domtrans(gnomeclock_t)
++')
++
++optional_policy(`
++ polkit_domtrans_auth(gnomeclock_t)
++ polkit_read_lib(gnomeclock_t)
++')
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.2.6/policy/modules/services/hal.fc
--- nsaserefpolicy/policy/modules/services/hal.fc 2007-11-14 08:17:58.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/hal.fc 2008-02-01 16:01:42.000000000 -0500
@@ -12154,7 +12321,7 @@
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.2.6/policy/modules/services/kerberos.te
--- nsaserefpolicy/policy/modules/services/kerberos.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.6/policy/modules/services/kerberos.te 2008-02-01 16:01:42.000000000 -0500
++++ serefpolicy-3.2.6/policy/modules/services/kerberos.te 2008-02-05 11:26:22.000000000 -0500
@@ -54,6 +54,12 @@
type krb5kdc_var_run_t;
files_pid_file(krb5kdc_var_run_t)
@@ -12228,7 +12395,7 @@
userdom_dontaudit_use_unpriv_user_fds(krb5kdc_t)
userdom_dontaudit_search_sysadm_home_dirs(krb5kdc_t)
-@@ -233,6 +246,7 @@
+@@ -233,8 +246,10 @@
optional_policy(`
seutil_sigchld_newrole(krb5kdc_t)
@@ -12236,6 +12403,185 @@
')
optional_policy(`
+ udev_read_db(krb5kdc_t)
+ ')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.fc serefpolicy-3.2.6/policy/modules/services/kerneloops.fc
+--- nsaserefpolicy/policy/modules/services/kerneloops.fc 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.2.6/policy/modules/services/kerneloops.fc 2008-02-05 13:14:34.000000000 -0500
+@@ -0,0 +1,4 @@
++
++/usr/sbin/kerneloops -- gen_context(system_u:object_r:kerneloops_exec_t,s0)
++
++/etc/rc.d/init.d/kerneloops -- gen_context(system_u:object_r:kerneloops_script_exec_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.if serefpolicy-3.2.6/policy/modules/services/kerneloops.if
+--- nsaserefpolicy/policy/modules/services/kerneloops.if 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.2.6/policy/modules/services/kerneloops.if 2008-02-05 13:14:34.000000000 -0500
+@@ -0,0 +1,104 @@
++
++## <summary>policy for kerneloops</summary>
++
++########################################
++## <summary>
++## Execute a domain transition to run kerneloops.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`kerneloops_domtrans',`
++ gen_require(`
++ type kerneloops_t;
++ type kerneloops_exec_t;
++ ')
++
++ domtrans_pattern($1,kerneloops_exec_t,kerneloops_t)
++')
++
++
++########################################
++## <summary>
++## Execute kerneloops server in the kerneloops domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## The type of the process performing this action.
++## </summary>
++## </param>
++#
++interface(`kerneloops_script_domtrans',`
++ gen_require(`
++ type kerneloops_script_exec_t;
++ ')
++
++ init_script_domtrans_spec($1,kerneloops_script_exec_t)
++')
++
++########################################
++## <summary>
++## Send and receive messages from
++## kerneloops over dbus.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`kerneloops_dbus_chat',`
++ gen_require(`
++ type kerneloops_t;
++ class dbus send_msg;
++ ')
++
++ allow $1 kerneloops_t:dbus send_msg;
++ allow kerneloops_t $1:dbus send_msg;
++')
++
++########################################
++## <summary>
++## All of the rules required to administrate
++## an kerneloops environment
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <param name="role">
++## <summary>
++## The role to be allowed to manage the kerneloops domain.
++## </summary>
++## </param>
++## <param name="terminal">
++## <summary>
++## The type of the user terminal.
++## </summary>
++## </param>
++## <rolecap/>
++#
++interface(`kerneloops_admin',`
++ gen_require(`
++ type kerneloops_t;
++ ')
++
++ allow $1 kerneloops_t:process { ptrace signal_perms getattr };
++ read_files_pattern($1, kerneloops_t, kerneloops_t)
++
++
++ gen_require(`
++ type kerneloops_script_exec_t;
++ ')
++
++ # Allow kerneloops_t to restart the apache service
++ kerneloops_script_domtrans($1)
++ domain_system_change_exemption($1)
++ role_transition $2 kerneloops_script_exec_t system_r;
++ allow $2 system_r;
++
++')
+Binary files nsaserefpolicy/policy/modules/services/kerneloops.pp and serefpolicy-3.2.6/policy/modules/services/kerneloops.pp differ
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.te serefpolicy-3.2.6/policy/modules/services/kerneloops.te
+--- nsaserefpolicy/policy/modules/services/kerneloops.te 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.2.6/policy/modules/services/kerneloops.te 2008-02-05 13:14:35.000000000 -0500
+@@ -0,0 +1,55 @@
++policy_module(kerneloops,1.0.0)
++
++########################################
++#
++# Declarations
++#
++
++type kerneloops_t;
++type kerneloops_exec_t;
++domain_type(kerneloops_t)
++init_daemon_domain(kerneloops_t, kerneloops_exec_t)
++
++type kerneloops_script_exec_t;
++init_script_type(kerneloops_script_exec_t)
++
++########################################
++#
++# kerneloops local policy
++#
++allow kerneloops_t self:capability sys_nice;
++allow kerneloops_t self:process { setsched getsched };
++
++# Init script handling
++domain_use_interactive_fds(kerneloops_t)
++
++## internal communication is often done using fifo and unix sockets.
++allow kerneloops_t self:fifo_file rw_file_perms;
++allow kerneloops_t self:unix_stream_socket create_stream_socket_perms;
++
++corenet_all_recvfrom_unlabeled(kerneloops_t)
++corenet_all_recvfrom_netlabel(kerneloops_t)
++corenet_tcp_sendrecv_all_if(kerneloops_t)
++corenet_tcp_sendrecv_all_nodes(kerneloops_t)
++corenet_tcp_sendrecv_all_ports(kerneloops_t)
++corenet_tcp_bind_http_port(kerneloops_t)
++
++files_read_etc_files(kerneloops_t)
++
++kernel_read_ring_buffer(kerneloops_t)
++
++libs_use_ld_so(kerneloops_t)
++libs_use_shared_libs(kerneloops_t)
++
++logging_send_syslog_msg(kerneloops_t)
++logging_read_generic_logs(kerneloops_t)
++
++miscfiles_read_localization(kerneloops_t)
++
++sysnet_dns_name_resolve(kerneloops_t)
++
++optional_policy(`
++ dbus_system_bus_client_template(kerneloops,kerneloops_t)
++ dbus_connect_system_bus(kerneloops_t)
++')
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.fc serefpolicy-3.2.6/policy/modules/services/ldap.fc
--- nsaserefpolicy/policy/modules/services/ldap.fc 2006-11-16 17:15:20.000000000 -0500
+++ serefpolicy-3.2.6/policy/modules/services/ldap.fc 2008-02-01 16:01:42.000000000 -0500
@@ -14390,10 +14736,11 @@
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.fc serefpolicy-3.2.6/policy/modules/services/polkit.fc
--- nsaserefpolicy/policy/modules/services/polkit.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.6/policy/modules/services/polkit.fc 2008-02-01 16:01:42.000000000 -0500
-@@ -0,0 +1,7 @@
++++ serefpolicy-3.2.6/policy/modules/services/polkit.fc 2008-02-05 13:14:51.000000000 -0500
+@@ -0,0 +1,8 @@
+
+/usr/libexec/polkit-read-auth-helper -- gen_context(system_u:object_r:polkit_auth_exec_t,s0)
++/usr/libexec/polkit-grant-helper.* -- gen_context(system_u:object_r:polkit_grant_exec_t,s0)
+/usr/libexec/polkitd -- gen_context(system_u:object_r:polkit_exec_t,s0)
+
+/var/lib/PolicyKit(/.*)? gen_context(system_u:object_r:polkit_var_lib_t,s0)
@@ -14401,8 +14748,8 @@
+/var/lib/PolicyKit-public(/.*)? gen_context(system_u:object_r:polkit_var_lib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.if serefpolicy-3.2.6/policy/modules/services/polkit.if
--- nsaserefpolicy/policy/modules/services/polkit.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.6/policy/modules/services/polkit.if 2008-02-04 11:48:36.000000000 -0500
-@@ -0,0 +1,62 @@
++++ serefpolicy-3.2.6/policy/modules/services/polkit.if 2008-02-05 13:14:52.000000000 -0500
+@@ -0,0 +1,119 @@
+
+## <summary>policy for polkit_auth</summary>
+
@@ -14465,10 +14812,67 @@
+ # Broken placement
+ cron_read_system_job_lib_files($1)
+')
++
++########################################
++## <summary>
++## Execute a domain transition to run polkit_grant.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`polkit_domtrans_grant',`
++ gen_require(`
++ type polkit_grant_t;
++ type polkit_grant_exec_t;
++ ')
++
++ domtrans_pattern($1,polkit_grant_exec_t,polkit_grant_t)
++')
++
++########################################
++## <summary>
++## Execute a policy_grant in the policy_grant domain, and
++## allow the specified role the policy_grant domain,
++## and use the caller's terminal.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <param name="role">
++## <summary>
++## The role to be allowed the load_policy domain.
++## </summary>
++## </param>
++## <param name="terminal">
++## <summary>
++## The type of the terminal allow the load_policy domain to use.
++## </summary>
++## </param>
++## <rolecap/>
++#
++interface(`polkit_run_grant',`
++ gen_require(`
++ type polkit_grant_t;
++ type polkit_auth_t;
++ ')
++
++ polkit_domtrans_grant($1)
++ role $2 types polkit_grant_t;
++ role $2 types polkit_auth_t;
++ allow polkit_grant_t $3:chr_file rw_term_perms;
++ allow $1 polkit_grant_t:process signal;
++ read_files_pattern(polkit_grant_t, $1, $1)
++ allow polkit_grant_t $1:process getattr;
++')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.te serefpolicy-3.2.6/policy/modules/services/polkit.te
--- nsaserefpolicy/policy/modules/services/polkit.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.6/policy/modules/services/polkit.te 2008-02-01 16:01:42.000000000 -0500
-@@ -0,0 +1,110 @@
++++ serefpolicy-3.2.6/policy/modules/services/polkit.te 2008-02-05 13:20:13.000000000 -0500
+@@ -0,0 +1,154 @@
+policy_module(polkit_auth,1.0.0)
+
+########################################
@@ -14478,12 +14882,14 @@
+
+type polkit_t;
+type polkit_exec_t;
-+domain_type(polkit_t)
+init_daemon_domain(polkit_t, polkit_exec_t)
+
++type polkit_grant_t;
++type polkit_grant_exec_t;
++init_system_domain(polkit_grant_t, polkit_grant_exec_t)
++
+type polkit_auth_t;
+type polkit_auth_exec_t;
-+domain_type(polkit_auth_t)
+init_daemon_domain(polkit_auth_t, polkit_auth_exec_t)
+
+type polkit_var_lib_t;
@@ -14528,9 +14934,10 @@
+files_pid_filetrans(polkit_t,polkit_var_run_t, { file dir })
+
+optional_policy(`
-+ dbus_system_bus_client_template(polkit, polkit_t)
-+ consolekit_dbus_chat(polkit_t)
+ dbus_system_domain(polkit_t, polkit_exec_t)
++ optional_policy(`
++ consolekit_dbus_chat(polkit_t)
++ ')
+')
+
+########################################
@@ -14579,6 +14986,47 @@
+ hal_read_state(polkit_auth_t)
+')
+
++########################################
++#
++# polkit_grant local policy
++#
++
++allow polkit_grant_t self:capability setuid;
++allow polkit_grant_t self:process getattr;
++
++allow polkit_grant_t self:unix_dgram_socket create_socket_perms;
++allow polkit_grant_t self:fifo_file rw_file_perms;
++allow polkit_grant_t self:unix_stream_socket create_stream_socket_perms;
++
++can_exec(polkit_grant_t, polkit_grant_exec_t)
++corecmd_search_bin(polkit_grant_t)
++
++files_read_etc_files(polkit_grant_t)
++files_read_usr_files(polkit_grant_t)
++
++auth_use_nsswitch(polkit_grant_t)
++auth_domtrans_chk_passwd(polkit_grant_t)
++
++libs_use_ld_so(polkit_grant_t)
++libs_use_shared_libs(polkit_grant_t)
++
++miscfiles_read_localization(polkit_grant_t)
++
++logging_send_syslog_msg(polkit_grant_t)
++
++polkit_domtrans_auth(polkit_grant_t)
++
++manage_files_pattern(polkit_grant_t, polkit_var_lib_t, polkit_var_lib_t)
++
++optional_policy(`
++ dbus_system_bus_client_template(polkit_grant, polkit_grant_t)
++ consolekit_dbus_chat(polkit_grant_t)
++')
++
++gen_require(`
++ type system_crond_var_lib_t;
++')
++manage_files_pattern(polkit_grant_t, system_crond_var_lib_t, system_crond_var_lib_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.2.6/policy/modules/services/postfix.fc
--- nsaserefpolicy/policy/modules/services/postfix.fc 2007-09-12 10:34:18.000000000 -0400
+++ serefpolicy-3.2.6/policy/modules/services/postfix.fc 2008-02-01 16:01:42.000000000 -0500
@@ -24828,7 +25276,7 @@
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.2.6/policy/modules/system/unconfined.te
--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.6/policy/modules/system/unconfined.te 2008-02-02 00:21:41.000000000 -0500
++++ serefpolicy-3.2.6/policy/modules/system/unconfined.te 2008-02-05 09:47:51.000000000 -0500
@@ -6,35 +6,59 @@
# Declarations
#
@@ -24949,7 +25397,17 @@
optional_policy(`
init_dbus_chat_script(unconfined_t)
-@@ -107,6 +146,10 @@
+@@ -101,12 +140,20 @@
+ ')
+
+ optional_policy(`
++ kerneloops_dbus_chat(unconfined_t)
++ ')
++
++ optional_policy(`
+ networkmanager_dbus_chat(unconfined_t)
+ ')
+
optional_policy(`
oddjob_dbus_chat(unconfined_t)
')
@@ -24960,7 +25418,7 @@
')
optional_policy(`
-@@ -118,11 +161,7 @@
+@@ -118,11 +165,7 @@
')
optional_policy(`
@@ -24973,7 +25431,7 @@
')
optional_policy(`
-@@ -134,14 +173,6 @@
+@@ -134,14 +177,6 @@
')
optional_policy(`
@@ -24988,7 +25446,7 @@
oddjob_domtrans_mkhomedir(unconfined_t)
')
-@@ -154,38 +185,32 @@
+@@ -154,38 +189,32 @@
')
optional_policy(`
@@ -25034,7 +25492,7 @@
')
optional_policy(`
-@@ -205,11 +230,30 @@
+@@ -205,11 +234,30 @@
')
optional_policy(`
@@ -25044,14 +25502,14 @@
+
+optional_policy(`
+ java_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
++')
++
++optional_policy(`
++ mono_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
')
optional_policy(`
- xserver_domtrans_xdm_xserver(unconfined_t)
-+ mono_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
-+')
-+
-+optional_policy(`
+ mozilla_per_role_template(unconfined, unconfined_t, unconfined_r)
+ unconfined_domain(unconfined_mozilla_t)
+ allow unconfined_mozilla_t self:process { execstack execmem };
@@ -25067,7 +25525,7 @@
')
########################################
-@@ -219,14 +263,34 @@
+@@ -219,14 +267,34 @@
allow unconfined_execmem_t self:process { execstack execmem };
unconfined_domain_noaudit(unconfined_execmem_t)
@@ -25087,7 +25545,7 @@
- ')
+optional_policy(`
+ avahi_dbus_chat(unconfined_execmem_t)
-+')
+ ')
+
+optional_policy(`
+ hal_dbus_chat(unconfined_execmem_t)
@@ -25095,7 +25553,7 @@
+
+optional_policy(`
+ xserver_xdm_rw_shm(unconfined_execmem_t)
- ')
++')
+
+########################################
+#
@@ -28810,8 +29268,8 @@
+## <summary>Policy for staff user</summary>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.te serefpolicy-3.2.6/policy/modules/users/staff.te
--- nsaserefpolicy/policy/modules/users/staff.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.6/policy/modules/users/staff.te 2008-02-04 08:26:47.000000000 -0500
-@@ -0,0 +1,51 @@
++++ serefpolicy-3.2.6/policy/modules/users/staff.te 2008-02-05 09:47:25.000000000 -0500
+@@ -0,0 +1,55 @@
+policy_module(staff,1.0.1)
+userdom_unpriv_user_template(staff)
+
@@ -28843,6 +29301,10 @@
+')
+
+optional_policy(`
++ kerneloops_dbus_chat(staff_t)
++')
++
++optional_policy(`
+ mono_per_role_template(staff, staff_t, staff_r)
+')
+
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.601
retrieving revision 1.602
diff -u -r1.601 -r1.602
--- selinux-policy.spec 4 Feb 2008 21:41:59 -0000 1.601
+++ selinux-policy.spec 5 Feb 2008 18:25:42 -0000 1.602
@@ -387,6 +387,10 @@
%endif
%changelog
+* Tue Feb 5 2008 Dan Walsh <dwalsh at redhat.com> 3.2.6-6
+- Add policy for kerneloops
+- Add policy for gnomeclock
+
* Mon Feb 4 2008 Dan Walsh <dwalsh at redhat.com> 3.2.6-5
- Fixes for libvirt
More information about the fedora-extras-commits
mailing list