rpms/selinux-policy/devel policy-20071130.patch, 1.30, 1.31 selinux-policy.spec, 1.582, 1.583

Daniel J Walsh (dwalsh) fedora-extras-commits at redhat.com
Sun Jan 13 13:20:09 UTC 2008 

Author: dwalsh

Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv19278

Modified Files:
	policy-20071130.patch selinux-policy.spec 
Log Message:
* Sun Jan 13 2008 Dan Walsh <dwalsh at redhat.com> 3.2.5-11
- Fixes for xguest to run java plugin


policy-20071130.patch:

Index: policy-20071130.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20071130.patch,v
retrieving revision 1.30
retrieving revision 1.31
diff -u -r1.30 -r1.31
--- policy-20071130.patch	11 Jan 2008 19:45:47 -0000	1.30
+++ policy-20071130.patch	13 Jan 2008 13:20:05 -0000	1.31
@@ -957,7 +957,7 @@
  /var/lib/alternatives(/.*)?		gen_context(system_u:object_r:rpm_var_lib_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.2.5/policy/modules/admin/rpm.if
 --- nsaserefpolicy/policy/modules/admin/rpm.if	2007-05-18 11:12:44.000000000 -0400
-+++ serefpolicy-3.2.5/policy/modules/admin/rpm.if	2008-01-08 08:11:14.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/admin/rpm.if	2008-01-11 15:53:03.000000000 -0500
 @@ -152,6 +152,24 @@
  
  ########################################
@@ -1180,7 +1180,7 @@
 +
 +########################################
 +## <summary>
-+##	Transition to system_r when execute an init script
++##	Transition to system_r when execute an rpm script
 +## </summary>
 +## <desc>
 +##      <p>
@@ -2702,7 +2702,7 @@
 +/usr/bin/octave-[^/]*  	--	gen_context(system_u:object_r:java_exec_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.2.5/policy/modules/apps/java.if
 --- nsaserefpolicy/policy/modules/apps/java.if	2007-10-12 08:56:02.000000000 -0400
-+++ serefpolicy-3.2.5/policy/modules/apps/java.if	2007-12-22 07:16:08.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/apps/java.if	2008-01-13 08:11:05.000000000 -0500
 @@ -32,7 +32,7 @@
  ##	</summary>
  ## </param>
@@ -2712,23 +2712,33 @@
  	gen_require(`
  		type java_exec_t;
  	')
-@@ -57,7 +57,7 @@
+@@ -57,14 +57,16 @@
  	# Local policy
  	#
  
 -	allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem };
-+	allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem execstack };
++	allow $1_javaplugin_t self:process {  execmem execstack signal_perms getsched ptrace setsched };
  	allow $1_javaplugin_t self:fifo_file rw_fifo_file_perms;
- 	allow $1_javaplugin_t self:tcp_socket create_socket_perms;
+-	allow $1_javaplugin_t self:tcp_socket create_socket_perms;
++	allow $1_javaplugin_t self:tcp_socket create_stream_socket_perms;
  	allow $1_javaplugin_t self:udp_socket create_socket_perms;
-@@ -76,13 +76,10 @@
+ 	
++	allow $1_javaplugin_t $1_t:process signull;
++	allow $1_javaplugin_t $1_t:unix_stream_socket connectto;
++	allow $1_t $1_javaplugin_t:unix_stream_socket connectto;
+ 	allow $1_javaplugin_t $2:unix_stream_socket connectto;
+ 	allow $1_javaplugin_t $2:unix_stream_socket { read write };
+-	userdom_write_user_tmp_sockets($1,$1_javaplugin_t)
+ 
+ 	manage_dirs_pattern($1_javaplugin_t,$1_javaplugin_tmp_t,$1_javaplugin_tmp_t)
+ 	manage_files_pattern($1_javaplugin_t,$1_javaplugin_tmp_t,$1_javaplugin_tmp_t)
+@@ -76,13 +78,9 @@
  	manage_sock_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t)
  	fs_tmpfs_filetrans($1_javaplugin_t,$1_javaplugin_tmpfs_t,{ file lnk_file sock_file fifo_file })
  
 -	rw_files_pattern($1_javaplugin_t,$1_home_t,$1_home_t)
 -	read_files_pattern($1_javaplugin_t,$1_home_t,$1_home_t)
 -
-+	userdom_manage_unpriv_users_home_content_files($1_javaplugin_t)
  	can_exec($1_javaplugin_t, java_exec_t)
  	
 -	# The user role is authorized for this domain.
@@ -2737,11 +2747,65 @@
  	allow $1_javaplugin_t $2:fd use;
  	# Unrestricted inheritance from the caller.
  	allow $2 $1_javaplugin_t:process { noatsecure siginh rlimitinh };
-@@ -166,6 +163,62 @@
+@@ -94,7 +92,7 @@
+ 	kernel_read_system_state($1_javaplugin_t)
+ 
+ 	# Search bin directory under javaplugin for javaplugin executable
+-	corecmd_search_bin($1_javaplugin_t)
++	corecmd_exec_bin($1_javaplugin_t)
+ 
+ 	corenet_all_recvfrom_unlabeled($1_javaplugin_t)
+ 	corenet_all_recvfrom_netlabel($1_javaplugin_t)
+@@ -107,10 +105,12 @@
+ 	corenet_tcp_connect_all_ports($1_javaplugin_t)
+ 	corenet_sendrecv_all_client_packets($1_javaplugin_t)
+ 
++	dev_list_sysfs($1_javaplugin_t)
+ 	dev_read_sound($1_javaplugin_t)
+ 	dev_write_sound($1_javaplugin_t)
+ 	dev_read_urand($1_javaplugin_t)
+ 	dev_read_rand($1_javaplugin_t)
++	dev_write_rand($1_javaplugin_t)
+ 
+ 	files_read_etc_files($1_javaplugin_t)
+ 	files_read_usr_files($1_javaplugin_t)
+@@ -122,6 +122,9 @@
+ 
+ 	fs_getattr_xattr_fs($1_javaplugin_t)
+ 	fs_dontaudit_rw_tmpfs_files($1_javaplugin_t)
++	fs_getattr_tmpfs($1_javaplugin_t)
++
++	auth_use_nsswitch($1_javaplugin_t)
+ 
+ 	libs_use_ld_so($1_javaplugin_t)
+ 	libs_use_shared_libs($1_javaplugin_t)
+@@ -132,11 +135,14 @@
+ 	# Read global fonts and font config
+ 	miscfiles_read_fonts($1_javaplugin_t)
+ 
+-	sysnet_read_config($1_javaplugin_t)
+-
++	userdom_manage_unpriv_users_home_content_files($1_javaplugin_t)
+ 	userdom_dontaudit_use_user_terminals($1,$1_javaplugin_t)
+ 	userdom_dontaudit_setattr_user_home_content_files($1,$1_javaplugin_t)
+ 	userdom_dontaudit_exec_user_home_content_files($1,$1_javaplugin_t)
++	userdom_manage_user_tmp_dirs($1,$1_javaplugin_t)
++	userdom_manage_user_tmp_files($1,$1_javaplugin_t)
++	userdom_manage_user_tmp_sockets($1,$1_javaplugin_t)
++	userdom_read_user_tmpfs_files($1,$1_javaplugin_t)
+ 	userdom_manage_user_home_content_dirs($1,$1_javaplugin_t)
+ 	userdom_manage_user_home_content_files($1,$1_javaplugin_t)
+ 	userdom_manage_user_home_content_symlinks($1,$1_javaplugin_t)
+@@ -156,15 +162,63 @@
+ 	')
+ 
  	optional_policy(`
- 		xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
+-		nis_use_ypbind($1_javaplugin_t)
++		xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
  	')
-+
+ 
+-	optional_policy(`
+-		nscd_socket_use($1_javaplugin_t)
 +')
 +
 +#######################################
@@ -2774,8 +2838,8 @@
 +template(`java_per_role_template',`
 +	gen_require(`
 +		type java_exec_t;
-+	')
-+
+ 	')
+ 
 +	type $1_java_t;
 +	domain_type($1_java_t)
 +	domain_entry_file($1_java_t,java_exec_t)
@@ -2794,13 +2858,13 @@
 +
 +	fs_dontaudit_rw_tmpfs_files($1_java_t)
 +
-+	optional_policy(`
+ 	optional_policy(`
+-		xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
 +		xserver_xdm_rw_shm($1_java_t)
-+	')
+ 	')
  ')
  
- ########################################
-@@ -219,3 +272,67 @@
+@@ -219,3 +273,67 @@
  	corecmd_search_bin($1)
  	domtrans_pattern($1, java_exec_t, java_t)
  ')
@@ -3073,7 +3137,7 @@
  # /bin
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.2.5/policy/modules/apps/mozilla.if
 --- nsaserefpolicy/policy/modules/apps/mozilla.if	2007-10-29 07:52:48.000000000 -0400
-+++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if	2008-01-11 13:41:19.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if	2008-01-13 08:06:37.000000000 -0500
 @@ -35,7 +35,10 @@
  template(`mozilla_per_role_template',`
  	gen_require(`
@@ -4929,6 +4993,18 @@
  ')
  
  ########################################
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.2.5/policy/modules/kernel/kernel.te
+--- nsaserefpolicy/policy/modules/kernel/kernel.te	2007-12-19 05:32:07.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/kernel/kernel.te	2008-01-11 15:13:01.000000000 -0500
+@@ -363,7 +363,7 @@
+ 
+ allow kern_unconfined proc_type:{ dir file lnk_file } *;
+ 
+-allow kern_unconfined sysctl_t:{ dir file } *;
++allow kern_unconfined sysctl_type:{ dir file } *;
+ 
+ allow kern_unconfined kernel_t:system *;
+ 
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.2.5/policy/modules/kernel/selinux.if
 --- nsaserefpolicy/policy/modules/kernel/selinux.if	2007-11-16 13:45:14.000000000 -0500
 +++ serefpolicy-3.2.5/policy/modules/kernel/selinux.if	2007-12-19 05:38:09.000000000 -0500
@@ -16194,7 +16270,7 @@
  ')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.2.5/policy/modules/system/sysnetwork.if
 --- nsaserefpolicy/policy/modules/system/sysnetwork.if	2007-07-16 14:09:49.000000000 -0400
-+++ serefpolicy-3.2.5/policy/modules/system/sysnetwork.if	2007-12-19 05:38:09.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/system/sysnetwork.if	2008-01-11 15:56:47.000000000 -0500
 @@ -145,6 +145,25 @@
  
  ########################################
@@ -16241,7 +16317,7 @@
  ')
  
  ########################################
-@@ -556,3 +581,23 @@
+@@ -556,3 +581,49 @@
  	files_search_etc($1)
  	allow $1 net_conf_t:file read_file_perms;
  ')
@@ -16265,6 +16341,32 @@
 +	dontaudit $1 dhcpc_t:fd use;
 +')
 +
++########################################
++## <summary>
++##	Transition to system_r when execute an dhclient script
++## </summary>
++## <desc>
++##      <p>
++##	Execute dhclient script in a specified role
++##      </p>
++##      <p>
++##      No interprocess communication (signals, pipes,
++##      etc.) is provided by this interface since
++##      the domains are not owned by this module.
++##      </p>
++## </desc>
++## <param name="source_role">
++##	<summary>
++##	Role to transition from.
++##	</summary>
++## </param>
++interface(`sysnet_role_transition_dhcpc',`
++	gen_require(`
++		type dhclient_exec_t;
++	')
++
++	role_transition $1 dhcpc_exec_t system_r;
++')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.2.5/policy/modules/system/sysnetwork.te
 --- nsaserefpolicy/policy/modules/system/sysnetwork.te	2007-12-19 05:32:17.000000000 -0500
 +++ serefpolicy-3.2.5/policy/modules/system/sysnetwork.te	2007-12-19 05:38:09.000000000 -0500
@@ -16703,8 +16805,8 @@
  ')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.2.5/policy/modules/system/unconfined.te
 --- nsaserefpolicy/policy/modules/system/unconfined.te	2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.2.5/policy/modules/system/unconfined.te	2007-12-20 09:13:54.000000000 -0500
-@@ -9,32 +9,49 @@
++++ serefpolicy-3.2.5/policy/modules/system/unconfined.te	2008-01-11 15:57:35.000000000 -0500
+@@ -9,32 +9,48 @@
  # usage in this module of types created by these
  # calls is not correct, however we dont currently
  # have another method to add access to these types
@@ -16723,7 +16825,6 @@
 +allow system_r unconfined_r;
 +allow unconfined_r system_r;
 +init_script_role_transition(unconfined_r)
-+rpm_role_transition(unconfined_r)
  
  type unconfined_execmem_t;
  type unconfined_execmem_exec_t;
@@ -16758,7 +16859,7 @@
  
  libs_run_ldconfig(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
  
-@@ -42,7 +59,10 @@
+@@ -42,7 +58,10 @@
  logging_run_auditctl(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
  
  mount_run_unconfined(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
@@ -16769,7 +16870,7 @@
  seutil_run_setfiles(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
  seutil_run_semanage(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
  
-@@ -51,13 +71,13 @@
+@@ -51,13 +70,13 @@
  userdom_priveleged_home_dir_manager(unconfined_t)
  
  optional_policy(`
@@ -16785,7 +16886,7 @@
  	unconfined_domain(httpd_unconfined_script_t)
  ')
  
-@@ -69,11 +89,11 @@
+@@ -69,11 +88,11 @@
  	bootloader_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
  ')
  
@@ -16802,7 +16903,7 @@
  
  optional_policy(`
  	init_dbus_chat_script(unconfined_t)
-@@ -107,6 +127,10 @@
+@@ -107,6 +126,10 @@
  	optional_policy(`
  		oddjob_dbus_chat(unconfined_t)
  	')
@@ -16813,7 +16914,7 @@
  ')
  
  optional_policy(`
-@@ -118,11 +142,7 @@
+@@ -118,11 +141,7 @@
  ')
  
  optional_policy(`
@@ -16826,7 +16927,7 @@
  ')
  
  optional_policy(`
-@@ -134,14 +154,6 @@
+@@ -134,14 +153,6 @@
  ')
  
  optional_policy(`
@@ -16841,7 +16942,7 @@
  	oddjob_domtrans_mkhomedir(unconfined_t)
  ')
  
-@@ -154,33 +166,20 @@
+@@ -154,38 +165,27 @@
  ')
  
  optional_policy(`
@@ -16864,6 +16965,7 @@
  	rpm_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
 +	# Allow SELinux aware applications to request rpm_script execution
 +	rpm_transition_script(unconfined_t)
++	rpm_role_transition(unconfined_r)
  ')
  
  optional_policy(`
@@ -16879,7 +16981,13 @@
  ')
  
  optional_policy(`
-@@ -205,11 +204,30 @@
+ 	sysnet_run_dhcpc(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
+ 	sysnet_dbus_chat_dhcpc(unconfined_t)
++	sysnet_role_transition_dhcpc(unconfined_r)
+ ')
+ 
+ optional_policy(`
+@@ -205,11 +205,30 @@
  ')
  
  optional_policy(`
@@ -16912,7 +17020,7 @@
  ')
  
  ########################################
-@@ -219,14 +237,32 @@
+@@ -219,14 +238,32 @@
  
  allow unconfined_execmem_t self:process { execstack execmem };
  unconfined_domain_noaudit(unconfined_execmem_t)
@@ -20121,8 +20229,8 @@
 +## <summary>Policy for xguest user</summary>
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.te serefpolicy-3.2.5/policy/modules/users/xguest.te
 --- nsaserefpolicy/policy/modules/users/xguest.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.5/policy/modules/users/xguest.te	2007-12-19 16:36:37.000000000 -0500
-@@ -0,0 +1,66 @@
++++ serefpolicy-3.2.5/policy/modules/users/xguest.te	2008-01-13 08:07:34.000000000 -0500
+@@ -0,0 +1,71 @@
 +policy_module(xguest,1.0.1)
 +
 +## <desc>
@@ -20149,7 +20257,12 @@
 +userdom_restricted_xwindows_user_template(xguest)
 +
 +optional_policy(`
++	gen_require(`
++		type xguest_mozilla_t;
++	')
 +	mozilla_per_role_template(xguest, xguest_t, xguest_r)
++	dbus_user_bus_client_template(xguest,xguest_mozilla,xguest_mozilla_t)
++	dbus_connectto_user_bus(xguest,xguest_mozilla_t)
 +')
 +
 +optional_policy(`


Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.582
retrieving revision 1.583
diff -u -r1.582 -r1.583
--- selinux-policy.spec	11 Jan 2008 19:45:47 -0000	1.582
+++ selinux-policy.spec	13 Jan 2008 13:20:05 -0000	1.583
@@ -17,7 +17,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.2.5
-Release: 10%{?dist}
+Release: 11%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -387,6 +387,9 @@
 %endif
 
 %changelog
+* Sun Jan 13 2008 Dan Walsh <dwalsh at redhat.com> 3.2.5-11
+- Fixes for xguest to run java plugin
+
 * Mon Jan 7 2008 Dan Walsh <dwalsh at redhat.com> 3.2.5-10
 - dontaudit pam_t and dbusd writing to user_home_t

More information about the fedora-extras-commits mailing list