rpms/selinux-policy/devel policy-20071130.patch, 1.57, 1.58 selinux-policy.spec, 1.605, 1.606
Daniel J Walsh (dwalsh)
fedora-extras-commits at redhat.com
Tue Feb 12 17:48:09 UTC 2008
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv11342
Modified Files:
policy-20071130.patch selinux-policy.spec
Log Message:
* Thu Feb 5 2008 Dan Walsh <dwalsh at redhat.com> 3.2.7-3
- More fixes for polkit
policy-20071130.patch:
Index: policy-20071130.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20071130.patch,v
retrieving revision 1.57
retrieving revision 1.58
diff -u -r1.57 -r1.58
--- policy-20071130.patch 11 Feb 2008 22:53:26 -0000 1.57
+++ policy-20071130.patch 12 Feb 2008 17:47:56 -0000 1.58
@@ -2452,7 +2452,7 @@
########################################
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.2.7/policy/modules/apps/gpg.te
--- nsaserefpolicy/policy/modules/apps/gpg.te 2007-12-19 05:32:09.000000000 -0500
-+++ serefpolicy-3.2.7/policy/modules/apps/gpg.te 2008-02-11 14:16:30.000000000 -0500
++++ serefpolicy-3.2.7/policy/modules/apps/gpg.te 2008-02-12 12:01:08.000000000 -0500
@@ -7,15 +7,232 @@
#
@@ -2549,7 +2549,7 @@
+# GPG helper local policy
+#
+
-+allow gpg_helper_t self:process getsched;
++allow gpg_helper_t self:process { getsched setsched };
+
+# for helper programs (which automatically fetch keys)
+# Note: this is only tested with the hkp interface. If you use eg the
@@ -5647,7 +5647,7 @@
# etc_runtime_t is the type of various
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.2.7/policy/modules/kernel/filesystem.if
--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-10-24 15:00:24.000000000 -0400
-+++ serefpolicy-3.2.7/policy/modules/kernel/filesystem.if 2008-02-06 11:02:29.000000000 -0500
++++ serefpolicy-3.2.7/policy/modules/kernel/filesystem.if 2008-02-12 09:41:43.000000000 -0500
@@ -310,6 +310,25 @@
########################################
@@ -5735,6 +5735,90 @@
## Relabel block nodes on tmpfs filesystems.
## </summary>
## <param name="domain">
+@@ -3551,3 +3608,83 @@
+ relabelfrom_blk_files_pattern($1,noxattrfs,noxattrfs)
+ relabelfrom_chr_files_pattern($1,noxattrfs,noxattrfs)
+ ')
++
++########################################
++## <summary>
++## Create, read, write, and delete directories
++## on a FUSEFS filesystem.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <rolecap/>
++#
++interface(`fs_manage_fusefs_dirs',`
++ gen_require(`
++ type fusefs_t;
++ ')
++
++ allow $1 fusefs_t:dir manage_dir_perms;
++')
++
++########################################
++## <summary>
++## Do not audit attempts to create, read,
++## write, and delete directories
++## on a FUSEFS filesystem.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
++interface(`fs_dontaudit_manage_fusefs_dirs',`
++ gen_require(`
++ type fusefs_t;
++ ')
++
++ dontaudit $1 fusefs_t:dir manage_dir_perms;
++')
++
++########################################
++## <summary>
++## Create, read, write, and delete files
++## on a FUSEFS filesystem.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <rolecap/>
++#
++interface(`fs_manage_fusefs_files',`
++ gen_require(`
++ type fusefs_t;
++ ')
++
++ manage_files_pattern($1,fusefs_t,fusefs_t)
++')
++
++########################################
++## <summary>
++## Do not audit attempts to create,
++## read, write, and delete files
++## on a FUSEFS filesystem.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
++interface(`fs_dontaudit_manage_fusefs_files',`
++ gen_require(`
++ type fusefs_t;
++ ')
++
++ dontaudit $1 fusefs_t:file manage_file_perms;
++')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.2.7/policy/modules/kernel/filesystem.te
--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-12-19 05:32:07.000000000 -0500
+++ serefpolicy-3.2.7/policy/modules/kernel/filesystem.te 2008-02-06 11:02:29.000000000 -0500
@@ -9223,7 +9307,7 @@
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.2.7/policy/modules/services/cups.te
--- nsaserefpolicy/policy/modules/services/cups.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.7/policy/modules/services/cups.te 2008-02-06 11:02:29.000000000 -0500
++++ serefpolicy-3.2.7/policy/modules/services/cups.te 2008-02-12 10:06:49.000000000 -0500
@@ -43,14 +43,12 @@
type cupsd_var_run_t;
@@ -9443,7 +9527,15 @@
fs_getattr_all_fs(cupsd_config_t)
fs_search_auto_mountpoints(cupsd_config_t)
-@@ -372,6 +404,10 @@
+@@ -353,6 +385,7 @@
+ logging_send_syslog_msg(cupsd_config_t)
+
+ miscfiles_read_localization(cupsd_config_t)
++miscfiles_read_hwdata(cupsd_config_t)
+
+ seutil_dontaudit_search_config(cupsd_config_t)
+
+@@ -372,6 +405,10 @@
')
optional_policy(`
@@ -9454,7 +9546,7 @@
cron_system_entry(cupsd_config_t, cupsd_config_exec_t)
')
-@@ -387,6 +423,7 @@
+@@ -387,6 +424,7 @@
optional_policy(`
hal_domtrans(cupsd_config_t)
hal_read_tmp_files(cupsd_config_t)
@@ -9462,7 +9554,7 @@
')
optional_policy(`
-@@ -499,14 +536,12 @@
+@@ -499,14 +537,12 @@
allow hplip_t self:udp_socket create_socket_perms;
allow hplip_t self:rawip_socket create_socket_perms;
@@ -9481,7 +9573,7 @@
manage_files_pattern(hplip_t,hplip_var_run_t,hplip_var_run_t)
files_pid_filetrans(hplip_t,hplip_var_run_t,file)
-@@ -537,14 +572,14 @@
+@@ -537,14 +573,14 @@
dev_read_urand(hplip_t)
dev_read_rand(hplip_t)
dev_rw_generic_usb_dev(hplip_t)
@@ -9498,7 +9590,7 @@
domain_use_interactive_fds(hplip_t)
files_read_etc_files(hplip_t)
-@@ -565,6 +600,7 @@
+@@ -565,6 +601,7 @@
userdom_dontaudit_search_all_users_home_content(hplip_t)
lpd_read_config(cupsd_t)
@@ -9851,7 +9943,7 @@
# Local policy
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.7/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500
-+++ serefpolicy-3.2.7/policy/modules/services/dbus.if 2008-02-11 17:07:47.000000000 -0500
++++ serefpolicy-3.2.7/policy/modules/services/dbus.if 2008-02-12 12:42:53.000000000 -0500
@@ -53,6 +53,7 @@
gen_require(`
type system_dbusd_exec_t, system_dbusd_t, dbusd_etc_t;
@@ -9860,7 +9952,16 @@
')
##############################
-@@ -84,14 +85,20 @@
+@@ -64,8 +65,6 @@
+ domain_entry_file($1_dbusd_t,system_dbusd_exec_t)
+ role $3 types $1_dbusd_t;
+
+- type $1_dbusd_$1_t;
+-
+ type $1_dbusd_tmp_t;
+ files_tmp_file($1_dbusd_tmp_t)
+
+@@ -84,14 +83,18 @@
allow $1_dbusd_t self:tcp_socket create_stream_socket_perms;
allow $1_dbusd_t self:netlink_selinux_socket create_socket_perms;
@@ -9869,12 +9970,12 @@
+
# For connecting to the bus
- allow $2 $1_dbusd_t:unix_stream_socket connectto;
+- type_change $2 $1_dbusd_t:dbus $1_dbusd_$1_t;
+ allow $2 $1_dbusd_t:unix_stream_socket { getattr connectto };
+ allow $2 $1_dbusd_t:unix_dgram_socket getattr;
- type_change $2 $1_dbusd_t:dbus $1_dbusd_$1_t;
# SE-DBus specific permissions
- allow $1_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg;
+- allow $1_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg;
allow $2 $1_dbusd_t:dbus { send_msg acquire_svc };
- allow $1_t system_dbusd_t:dbus { send_msg acquire_svc };
+ allow $1_dbusd_t $2:dbus send_msg;
@@ -9883,7 +9984,7 @@
allow $1_dbusd_t dbusd_etc_t:dir list_dir_perms;
read_files_pattern($1_dbusd_t,dbusd_etc_t,dbusd_etc_t)
-@@ -102,10 +109,9 @@
+@@ -102,10 +105,9 @@
files_tmp_filetrans($1_dbusd_t, $1_dbusd_tmp_t, { file dir })
domtrans_pattern($2, system_dbusd_exec_t, $1_dbusd_t)
@@ -9896,7 +9997,7 @@
allow $1_dbusd_t $2:process sigkill;
allow $2 $1_dbusd_t:fd use;
allow $2 $1_dbusd_t:fifo_file rw_fifo_file_perms;
-@@ -139,6 +145,7 @@
+@@ -139,6 +141,7 @@
fs_getattr_romfs($1_dbusd_t)
fs_getattr_xattr_fs($1_dbusd_t)
@@ -9904,7 +10005,7 @@
selinux_get_fs_mount($1_dbusd_t)
selinux_validate_context($1_dbusd_t)
-@@ -161,12 +168,23 @@
+@@ -161,12 +164,23 @@
seutil_read_config($1_dbusd_t)
seutil_read_default_contexts($1_dbusd_t)
@@ -9912,7 +10013,7 @@
+ userdom_dontaudit_search_sysadm_home_dirs($1_dbusd_t)
+ userdom_read_unpriv_users_home_content_files($1_dbusd_t)
+ userdom_dontaudit_append_unpriv_home_content_files($1_dbusd_t)
-+ userdom_dontaudit_use_user_terminals($1, $1_dbusd_t)
++ term_dontaudit_use_all_user_ptys($1_dbusd_t)
ifdef(`hide_broken_symptoms', `
dontaudit $2 $1_dbusd_t:netlink_selinux_socket { read write };
@@ -9929,7 +10030,7 @@
tunable_policy(`read_default_t',`
files_list_default($1_dbusd_t)
files_read_default_files($1_dbusd_t)
-@@ -182,6 +200,7 @@
+@@ -182,6 +196,7 @@
optional_policy(`
xserver_use_xdm_fds($1_dbusd_t)
xserver_rw_xdm_pipes($1_dbusd_t)
@@ -9937,17 +10038,22 @@
')
')
-@@ -214,7 +233,8 @@
+@@ -209,12 +224,9 @@
+ class dbus send_msg;
+ ')
+-# type $1_dbusd_system_t;
+-# type_change $2 system_dbusd_t:dbus $1_dbusd_system_t;
+-
# SE-DBus specific permissions
- # allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg;
+-# allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg;
- allow $2 { system_dbusd_t self }:dbus send_msg;
+ allow $2 { system_dbusd_t $2 }:dbus send_msg;
+ allow system_dbusd_t $2:dbus send_msg;
read_files_pattern($2, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
files_search_var_lib($2)
-@@ -223,6 +243,10 @@
+@@ -223,6 +235,10 @@
files_search_pids($2)
stream_connect_pattern($2,system_dbusd_var_run_t,system_dbusd_var_run_t,system_dbusd_t)
dbus_read_config($2)
@@ -9958,7 +10064,7 @@
')
#######################################
-@@ -251,6 +275,7 @@
+@@ -251,18 +267,16 @@
template(`dbus_user_bus_client_template',`
gen_require(`
type $1_dbusd_t;
@@ -9966,7 +10072,12 @@
class dbus send_msg;
')
-@@ -263,6 +288,7 @@
+-# type $2_dbusd_$1_t;
+-# type_change $3 $1_dbusd_t:dbus $2_dbusd_$1_t;
+-
+ # SE-DBus specific permissions
+-# allow $2_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg;
+ allow $3 { $1_dbusd_t self }:dbus send_msg;
# For connecting to the bus
allow $3 $1_dbusd_t:unix_stream_socket connectto;
@@ -9974,7 +10085,7 @@
')
########################################
-@@ -292,6 +318,59 @@
+@@ -292,6 +306,59 @@
########################################
## <summary>
@@ -10034,7 +10145,7 @@
## Read dbus configuration.
## </summary>
## <param name="domain">
-@@ -366,3 +445,55 @@
+@@ -366,3 +433,55 @@
allow $1 system_dbusd_t:dbus *;
')
@@ -16181,8 +16292,8 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.te serefpolicy-3.2.7/policy/modules/services/prelude.te
--- nsaserefpolicy/policy/modules/services/prelude.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.7/policy/modules/services/prelude.te 2008-02-08 14:54:04.000000000 -0500
-@@ -0,0 +1,140 @@
++++ serefpolicy-3.2.7/policy/modules/services/prelude.te 2008-02-12 12:37:44.000000000 -0500
+@@ -0,0 +1,142 @@
+policy_module(prelude,1.0.0)
+
+########################################
@@ -16250,6 +16361,8 @@
+manage_dirs_pattern(prelude_t,prelude_spool_t,prelude_spool_t)
+manage_files_pattern(prelude_t,prelude_spool_t,prelude_spool_t)
+
++auth_use_nsswitch(prelude_t)
++
+libs_use_ld_so(prelude_t)
+libs_use_shared_libs(prelude_t)
+
@@ -18021,7 +18134,7 @@
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.2.7/policy/modules/services/samba.te
--- nsaserefpolicy/policy/modules/services/samba.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.7/policy/modules/services/samba.te 2008-02-08 14:53:50.000000000 -0500
++++ serefpolicy-3.2.7/policy/modules/services/samba.te 2008-02-12 09:43:12.000000000 -0500
@@ -26,28 +26,28 @@
## <desc>
@@ -18055,7 +18168,21 @@
## </p>
## </desc>
gen_tunable(samba_run_unconfined,false)
-@@ -73,11 +73,9 @@
+@@ -59,6 +59,13 @@
+ ## </desc>
+ gen_tunable(samba_share_nfs,false)
+
++## <desc>
++## <p>
++## Allow samba to export ntfs/fusefs volumes.
++## </p>
++## </desc>
++gen_tunable(samba_share_fusefs,false)
++
+ type nmbd_t;
+ type nmbd_exec_t;
+ init_daemon_domain(nmbd_t,nmbd_exec_t)
+@@ -73,11 +80,9 @@
logging_log_file(samba_log_t)
type samba_net_t;
@@ -18069,7 +18196,7 @@
type samba_net_tmp_t;
files_tmp_file(samba_net_tmp_t)
-@@ -139,6 +137,14 @@
+@@ -139,6 +144,14 @@
type winbind_var_run_t;
files_pid_file(winbind_var_run_t)
@@ -18084,7 +18211,7 @@
########################################
#
# Samba net local policy
-@@ -193,7 +199,10 @@
+@@ -193,7 +206,10 @@
miscfiles_read_localization(samba_net_t)
@@ -18095,7 +18222,7 @@
optional_policy(`
kerberos_use(samba_net_t)
-@@ -213,7 +222,7 @@
+@@ -213,7 +229,7 @@
allow smbd_t self:msgq create_msgq_perms;
allow smbd_t self:sem create_sem_perms;
allow smbd_t self:shm create_shm_perms;
@@ -18104,7 +18231,7 @@
allow smbd_t self:tcp_socket create_stream_socket_perms;
allow smbd_t self:udp_socket create_socket_perms;
allow smbd_t self:unix_dgram_socket { create_socket_perms sendto };
-@@ -221,10 +230,8 @@
+@@ -221,10 +237,8 @@
allow smbd_t samba_etc_t:file { rw_file_perms setattr };
@@ -18117,7 +18244,7 @@
allow smbd_t samba_net_tmp_t:file getattr;
-@@ -234,6 +241,7 @@
+@@ -234,6 +248,7 @@
manage_dirs_pattern(smbd_t,samba_share_t,samba_share_t)
manage_files_pattern(smbd_t,samba_share_t,samba_share_t)
manage_lnk_files_pattern(smbd_t,samba_share_t,samba_share_t)
@@ -18125,7 +18252,7 @@
manage_dirs_pattern(smbd_t,samba_var_t,samba_var_t)
manage_files_pattern(smbd_t,samba_var_t,samba_var_t)
-@@ -251,7 +259,7 @@
+@@ -251,7 +266,7 @@
manage_sock_files_pattern(smbd_t,smbd_var_run_t,smbd_var_run_t)
files_pid_filetrans(smbd_t,smbd_var_run_t,file)
@@ -18134,7 +18261,7 @@
kernel_getattr_core_if(smbd_t)
kernel_getattr_message_if(smbd_t)
-@@ -320,6 +328,8 @@
+@@ -320,6 +335,8 @@
userdom_dontaudit_use_unpriv_user_fds(smbd_t)
userdom_use_unpriv_users_fds(smbd_t)
@@ -18143,7 +18270,7 @@
ifdef(`hide_broken_symptoms', `
files_dontaudit_getattr_default_dirs(smbd_t)
files_dontaudit_getattr_boot_dirs(smbd_t)
-@@ -340,6 +350,17 @@
+@@ -340,6 +357,23 @@
tunable_policy(`samba_share_nfs',`
fs_manage_nfs_dirs(smbd_t)
fs_manage_nfs_files(smbd_t)
@@ -18152,6 +18279,12 @@
+ fs_manage_nfs_named_sockets(smbd_t)
+')
+
++# Support Samba sharing of ntfs/fusefs mount points
++tunable_policy(`samba_share_fusefs',`
++ fs_manage_fusefs_dirs(smbd_t)
++ fs_manage_fusefs_files(smbd_t)
++')
++
+optional_policy(`
+ kerberos_read_keytab(smbd_t)
+')
@@ -18161,7 +18294,7 @@
')
optional_policy(`
-@@ -391,7 +412,7 @@
+@@ -391,7 +425,7 @@
allow nmbd_t self:msgq create_msgq_perms;
allow nmbd_t self:sem create_sem_perms;
allow nmbd_t self:shm create_shm_perms;
@@ -18170,7 +18303,7 @@
allow nmbd_t self:tcp_socket create_stream_socket_perms;
allow nmbd_t self:udp_socket create_socket_perms;
allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto };
-@@ -403,8 +424,7 @@
+@@ -403,8 +437,7 @@
read_files_pattern(nmbd_t,samba_etc_t,samba_etc_t)
manage_dirs_pattern(nmbd_t,samba_log_t,samba_log_t)
@@ -18180,7 +18313,7 @@
read_files_pattern(nmbd_t,samba_log_t,samba_log_t)
create_files_pattern(nmbd_t,samba_log_t,samba_log_t)
-@@ -439,6 +459,7 @@
+@@ -439,6 +472,7 @@
dev_getattr_mtrr_dev(nmbd_t)
fs_getattr_all_fs(nmbd_t)
@@ -18188,7 +18321,7 @@
fs_search_auto_mountpoints(nmbd_t)
domain_use_interactive_fds(nmbd_t)
-@@ -522,6 +543,7 @@
+@@ -522,6 +556,7 @@
storage_raw_write_fixed_disk(smbmount_t)
term_list_ptys(smbmount_t)
@@ -18196,7 +18329,7 @@
corecmd_list_bin(smbmount_t)
-@@ -546,28 +568,37 @@
+@@ -546,28 +581,37 @@
userdom_use_all_users_fds(smbmount_t)
@@ -18241,7 +18374,7 @@
allow swat_t smbd_var_run_t:file read;
manage_dirs_pattern(swat_t,swat_tmp_t,swat_tmp_t)
-@@ -577,7 +608,9 @@
+@@ -577,7 +621,9 @@
manage_files_pattern(swat_t,swat_var_run_t,swat_var_run_t)
files_pid_filetrans(swat_t,swat_var_run_t,file)
@@ -18252,7 +18385,7 @@
kernel_read_kernel_sysctls(swat_t)
kernel_read_system_state(swat_t)
-@@ -602,6 +635,7 @@
+@@ -602,6 +648,7 @@
dev_read_urand(swat_t)
@@ -18260,7 +18393,7 @@
files_read_etc_files(swat_t)
files_search_home(swat_t)
files_read_usr_files(swat_t)
-@@ -614,6 +648,7 @@
+@@ -614,6 +661,7 @@
libs_use_shared_libs(swat_t)
logging_send_syslog_msg(swat_t)
@@ -18268,7 +18401,7 @@
logging_search_logs(swat_t)
miscfiles_read_localization(swat_t)
-@@ -631,6 +666,17 @@
+@@ -631,6 +679,17 @@
kerberos_use(swat_t)
')
@@ -18286,7 +18419,7 @@
########################################
#
# Winbind local policy
-@@ -679,6 +725,8 @@
+@@ -679,6 +738,8 @@
manage_sock_files_pattern(winbind_t,winbind_var_run_t,winbind_var_run_t)
files_pid_filetrans(winbind_t,winbind_var_run_t,file)
@@ -18295,7 +18428,7 @@
kernel_read_kernel_sysctls(winbind_t)
kernel_list_proc(winbind_t)
kernel_read_proc_symlinks(winbind_t)
-@@ -766,6 +814,7 @@
+@@ -766,6 +827,7 @@
optional_policy(`
squid_read_log(winbind_helper_t)
squid_append_log(winbind_helper_t)
@@ -18303,7 +18436,7 @@
')
########################################
-@@ -790,3 +839,37 @@
+@@ -790,3 +852,37 @@
domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t)
')
')
@@ -20992,7 +21125,7 @@
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.2.7/policy/modules/services/xserver.if
--- nsaserefpolicy/policy/modules/services/xserver.if 2007-12-04 11:02:50.000000000 -0500
-+++ serefpolicy-3.2.7/policy/modules/services/xserver.if 2008-02-06 11:02:30.000000000 -0500
++++ serefpolicy-3.2.7/policy/modules/services/xserver.if 2008-02-12 12:15:41.000000000 -0500
@@ -15,6 +15,7 @@
template(`xserver_common_domain_template',`
gen_require(`
@@ -21714,7 +21847,7 @@
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.2.7/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.7/policy/modules/services/xserver.te 2008-02-11 14:21:09.000000000 -0500
++++ serefpolicy-3.2.7/policy/modules/services/xserver.te 2008-02-12 12:43:50.000000000 -0500
@@ -16,6 +16,13 @@
## <desc>
@@ -21919,31 +22052,36 @@
xserver_rw_session_template(xdm,xdm_t,xdm_tmpfs_t)
-@@ -304,7 +363,23 @@
+@@ -304,7 +363,27 @@
')
optional_policy(`
+- consolekit_dbus_chat(xdm_t)
+ bootloader_domtrans(xdm_t)
+')
+
+optional_policy(`
+ consolekit_read_log(xdm_t)
-+')
+
+optional_policy(`
- consolekit_dbus_chat(xdm_t)
-+ dbus_system_bus_client_template(xdm, xdm_t)
+ dbus_per_role_template(xdm, xdm_t, system_r)
++ dbus_system_bus_client_template(xdm, xdm_t)
++
++ optional_policy(`
++ consolekit_dbus_chat(xdm_t)
++ ')
++
+ optional_policy(`
+ hal_dbus_chat(xdm_t)
+ ')
++
+ optional_policy(`
+ networkmanager_dbus_chat(xdm_t)
+ ')
')
optional_policy(`
-@@ -322,6 +397,10 @@
+@@ -322,6 +401,10 @@
')
optional_policy(`
@@ -21954,7 +22092,7 @@
loadkeys_exec(xdm_t)
')
-@@ -335,6 +414,11 @@
+@@ -335,6 +418,11 @@
')
optional_policy(`
@@ -21966,7 +22104,7 @@
seutil_sigchld_newrole(xdm_t)
')
-@@ -343,8 +427,8 @@
+@@ -343,8 +431,8 @@
')
optional_policy(`
@@ -21976,7 +22114,7 @@
ifndef(`distro_redhat',`
allow xdm_t self:process { execheap execmem };
-@@ -380,7 +464,7 @@
+@@ -380,7 +468,7 @@
allow xdm_xserver_t xdm_var_lib_t:file { getattr read };
dontaudit xdm_xserver_t xdm_var_lib_t:dir search;
@@ -21985,7 +22123,7 @@
# Label pid and temporary files with derived types.
manage_files_pattern(xdm_xserver_t,xdm_tmp_t,xdm_tmp_t)
-@@ -392,6 +476,15 @@
+@@ -392,6 +480,15 @@
can_exec(xdm_xserver_t, xkb_var_lib_t)
files_search_var_lib(xdm_xserver_t)
@@ -22001,7 +22139,7 @@
# VNC v4 module in X server
corenet_tcp_bind_vnc_port(xdm_xserver_t)
-@@ -404,6 +497,7 @@
+@@ -404,6 +501,7 @@
# to read ROLE_home_t - examine this in more detail
# (xauth?)
userdom_read_unpriv_users_home_content_files(xdm_xserver_t)
@@ -22009,7 +22147,7 @@
xserver_use_all_users_fonts(xdm_xserver_t)
-@@ -420,6 +514,14 @@
+@@ -420,6 +518,14 @@
')
optional_policy(`
@@ -22024,7 +22162,7 @@
resmgr_stream_connect(xdm_t)
')
-@@ -429,47 +531,103 @@
+@@ -429,47 +535,103 @@
')
optional_policy(`
@@ -22048,6 +22186,15 @@
+ # xserver signals unconfined user on startx
+ unconfined_signal(xdm_xserver_t)
+ unconfined_getpgid(xdm_xserver_t)
++')
++
++
++tunable_policy(`allow_xserver_execmem', `
++ allow xdm_xserver_t self:process { execheap execmem execstack };
++')
++
++ifndef(`distro_redhat',`
++ allow xdm_xserver_t self:process { execheap execmem };
')
-ifdef(`TODO',`
@@ -22071,19 +22218,10 @@
-allow xdm_t polymember:lnk_file { create unlink };
-# xdm needs access for copying .Xauthority into new home
-allow xdm_t polymember:file { create getattr write };
-+
-+tunable_policy(`allow_xserver_execmem', `
-+ allow xdm_xserver_t self:process { execheap execmem execstack };
- ')
-
-+ifndef(`distro_redhat',`
-+ allow xdm_xserver_t self:process { execheap execmem };
-+')
-+
+ifdef(`distro_rhel4',`
+ allow xdm_xserver_t self:process { execheap execmem };
-+')
-+
+ ')
+
+##############################
#
-# Wants to delete .xsession-errors file
@@ -25316,8 +25454,16 @@
xen_append_log(ifconfig_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.2.7/policy/modules/system/udev.te
--- nsaserefpolicy/policy/modules/system/udev.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.7/policy/modules/system/udev.te 2008-02-06 11:02:30.000000000 -0500
-@@ -96,9 +96,6 @@
++++ serefpolicy-3.2.7/policy/modules/system/udev.te 2008-02-12 12:02:58.000000000 -0500
+@@ -83,6 +83,7 @@
+ kernel_rw_unix_dgram_sockets(udev_t)
+ kernel_dgram_send(udev_t)
+ kernel_signal(udev_t)
++kernel_search_debugfs(udev_t)
+
+ #https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235182
+ kernel_rw_net_sysctls(udev_t)
+@@ -96,9 +97,6 @@
dev_delete_generic_files(udev_t)
dev_search_usbfs(udev_t)
dev_relabel_all_dev_nodes(udev_t)
@@ -25327,7 +25473,7 @@
domain_read_all_domains_state(udev_t)
domain_dontaudit_ptrace_all_domains(udev_t) #pidof triggers these
-@@ -189,6 +186,7 @@
+@@ -189,6 +187,7 @@
optional_policy(`
alsa_domtrans(udev_t)
@@ -25335,7 +25481,7 @@
alsa_read_rw_config(udev_t)
')
-@@ -197,6 +195,10 @@
+@@ -197,6 +196,10 @@
')
optional_policy(`
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.605
retrieving revision 1.606
diff -u -r1.605 -r1.606
--- selinux-policy.spec 11 Feb 2008 22:53:26 -0000 1.605
+++ selinux-policy.spec 12 Feb 2008 17:47:57 -0000 1.606
@@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.2.7
-Release: 3%{?dist}
+Release: 4%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
More information about the fedora-extras-commits
mailing list