rpms/selinux-policy/F-9 policy-20071130.patch, 1.212, 1.213 selinux-policy.spec, 1.709, 1.710
Daniel J Walsh
dwalsh at fedoraproject.org
Tue Sep 23 13:27:34 UTC 2008
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/F-9
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv11215
Modified Files:
policy-20071130.patch selinux-policy.spec
Log Message:
* Mon Sep 22 2008 Dan Walsh <dwalsh at redhat.com> 3.3.1-93
- Add /dev/msp* support
- Update prewikka support
policy-20071130.patch:
Index: policy-20071130.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-9/policy-20071130.patch,v
retrieving revision 1.212
retrieving revision 1.213
diff -u -r1.212 -r1.213
--- policy-20071130.patch 19 Sep 2008 14:42:25 -0000 1.212
+++ policy-20071130.patch 23 Sep 2008 13:27:34 -0000 1.213
@@ -2205,7 +2205,7 @@
-')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.3.1/policy/modules/admin/logrotate.te
--- nsaserefpolicy/policy/modules/admin/logrotate.te 2008-06-12 23:38:01.000000000 -0400
-+++ serefpolicy-3.3.1/policy/modules/admin/logrotate.te 2008-09-08 11:45:12.000000000 -0400
++++ serefpolicy-3.3.1/policy/modules/admin/logrotate.te 2008-09-23 08:36:21.000000000 -0400
@@ -96,9 +96,11 @@
files_read_etc_files(logrotate_t)
files_read_etc_runtime_files(logrotate_t)
@@ -2218,6 +2218,15 @@
# cjp: why is this needed?
init_domtrans_script(logrotate_t)
+@@ -161,7 +163,7 @@
+ ')
+
+ optional_policy(`
+- mailman_exec(logrotate_t)
++ mailman_domtrans(logrotate_t)
+ mailman_search_data(logrotate_t)
+ mailman_manage_log(logrotate_t)
+ ')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.3.1/policy/modules/admin/logwatch.te
--- nsaserefpolicy/policy/modules/admin/logwatch.te 2008-06-12 23:38:01.000000000 -0400
+++ serefpolicy-3.3.1/policy/modules/admin/logwatch.te 2008-09-08 11:45:12.000000000 -0400
@@ -14502,7 +14511,7 @@
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.3.1/policy/modules/services/cups.te
--- nsaserefpolicy/policy/modules/services/cups.te 2008-06-12 23:38:02.000000000 -0400
-+++ serefpolicy-3.3.1/policy/modules/services/cups.te 2008-09-12 13:42:32.000000000 -0400
++++ serefpolicy-3.3.1/policy/modules/services/cups.te 2008-09-22 14:18:58.000000000 -0400
@@ -43,14 +43,13 @@
type cupsd_var_run_t;
@@ -14599,7 +14608,7 @@
allow cupsd_t hplip_var_run_t:file { read getattr };
stream_connect_pattern(cupsd_t,ptal_var_run_t,ptal_var_run_t,ptal_t)
-@@ -149,32 +171,35 @@
+@@ -149,32 +171,36 @@
corenet_tcp_bind_reserved_port(cupsd_t)
corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t)
corenet_tcp_connect_all_ports(cupsd_t)
@@ -14613,6 +14622,7 @@
dev_read_urand(cupsd_t)
dev_read_sysfs(cupsd_t)
-dev_read_usbfs(cupsd_t)
++dev_rw_input_dev(cupsd_t) #447878
+dev_rw_generic_usb_dev(cupsd_t)
+dev_rw_usbfs(cupsd_t)
dev_getattr_printer_dev(cupsd_t)
@@ -14639,7 +14649,7 @@
# Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp
corecmd_exec_shell(cupsd_t)
corecmd_exec_bin(cupsd_t)
-@@ -186,7 +211,7 @@
+@@ -186,7 +212,7 @@
# read python modules
files_read_usr_files(cupsd_t)
# for /var/lib/defoma
@@ -14648,7 +14658,7 @@
files_list_world_readable(cupsd_t)
files_read_world_readable_files(cupsd_t)
files_read_world_readable_symlinks(cupsd_t)
-@@ -195,15 +220,16 @@
+@@ -195,15 +221,16 @@
files_read_var_symlinks(cupsd_t)
# for /etc/printcap
files_dontaudit_write_etc_files(cupsd_t)
@@ -14669,7 +14679,7 @@
auth_use_nsswitch(cupsd_t)
libs_use_ld_so(cupsd_t)
-@@ -219,17 +245,22 @@
+@@ -219,17 +246,22 @@
miscfiles_read_fonts(cupsd_t)
seutil_read_config(cupsd_t)
@@ -14694,7 +14704,7 @@
')
optional_policy(`
-@@ -242,12 +273,21 @@
+@@ -242,12 +274,21 @@
optional_policy(`
dbus_system_bus_client_template(cupsd,cupsd_t)
@@ -14716,7 +14726,7 @@
')
optional_policy(`
-@@ -263,6 +303,10 @@
+@@ -263,6 +304,10 @@
')
optional_policy(`
@@ -14727,7 +14737,7 @@
# cups execs smbtool which reads samba_etc_t files
samba_read_config(cupsd_t)
samba_rw_var_files(cupsd_t)
-@@ -281,7 +325,7 @@
+@@ -281,7 +326,7 @@
# Cups configuration daemon local policy
#
@@ -14736,7 +14746,7 @@
dontaudit cupsd_config_t self:capability sys_tty_config;
allow cupsd_config_t self:process signal_perms;
allow cupsd_config_t self:fifo_file rw_fifo_file_perms;
-@@ -326,6 +370,7 @@
+@@ -326,6 +371,7 @@
dev_read_sysfs(cupsd_config_t)
dev_read_urand(cupsd_config_t)
dev_read_rand(cupsd_config_t)
@@ -14744,7 +14754,7 @@
fs_getattr_all_fs(cupsd_config_t)
fs_search_auto_mountpoints(cupsd_config_t)
-@@ -353,6 +398,7 @@
+@@ -353,6 +399,7 @@
logging_send_syslog_msg(cupsd_config_t)
miscfiles_read_localization(cupsd_config_t)
@@ -14752,7 +14762,7 @@
seutil_dontaudit_search_config(cupsd_config_t)
-@@ -372,6 +418,10 @@
+@@ -372,6 +419,10 @@
')
optional_policy(`
@@ -14763,7 +14773,7 @@
cron_system_entry(cupsd_config_t, cupsd_config_exec_t)
')
-@@ -387,6 +437,7 @@
+@@ -387,6 +438,7 @@
optional_policy(`
hal_domtrans(cupsd_config_t)
hal_read_tmp_files(cupsd_config_t)
@@ -14771,7 +14781,7 @@
')
optional_policy(`
-@@ -499,15 +550,10 @@
+@@ -499,15 +551,10 @@
allow hplip_t self:udp_socket create_socket_perms;
allow hplip_t self:rawip_socket create_socket_perms;
@@ -14788,7 +14798,7 @@
manage_files_pattern(hplip_t,hplip_var_run_t,hplip_var_run_t)
files_pid_filetrans(hplip_t,hplip_var_run_t,file)
-@@ -537,14 +583,14 @@
+@@ -537,14 +584,14 @@
dev_read_urand(hplip_t)
dev_read_rand(hplip_t)
dev_rw_generic_usb_dev(hplip_t)
@@ -14805,7 +14815,7 @@
domain_use_interactive_fds(hplip_t)
files_read_etc_files(hplip_t)
-@@ -564,7 +610,8 @@
+@@ -564,7 +611,8 @@
userdom_dontaudit_search_sysadm_home_dirs(hplip_t)
userdom_dontaudit_search_all_users_home_content(hplip_t)
@@ -14815,7 +14825,7 @@
optional_policy(`
seutil_sigchld_newrole(hplip_t)
-@@ -645,3 +692,45 @@
+@@ -645,3 +693,45 @@
optional_policy(`
udev_read_db(ptal_t)
')
@@ -16985,13 +16995,15 @@
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.fc serefpolicy-3.3.1/policy/modules/services/fail2ban.fc
--- nsaserefpolicy/policy/modules/services/fail2ban.fc 2008-06-12 23:38:01.000000000 -0400
-+++ serefpolicy-3.3.1/policy/modules/services/fail2ban.fc 2008-09-08 11:45:12.000000000 -0400
-@@ -1,3 +1,7 @@
++++ serefpolicy-3.3.1/policy/modules/services/fail2ban.fc 2008-09-19 11:19:39.000000000 -0400
+@@ -1,3 +1,8 @@
/usr/bin/fail2ban -- gen_context(system_u:object_r:fail2ban_exec_t,s0)
+/usr/bin/fail2ban-server -- gen_context(system_u:object_r:fail2ban_exec_t,s0)
/var/log/fail2ban\.log -- gen_context(system_u:object_r:fail2ban_log_t,s0)
- /var/run/fail2ban\.pid -- gen_context(system_u:object_r:fail2ban_var_run_t,s0)
-+/var/run/fail2ban\.sock -s gen_context(system_u:object_r:fail2ban_var_run_t,s0)
+-/var/run/fail2ban\.pid -- gen_context(system_u:object_r:fail2ban_var_run_t,s0)
++
++/var/run/fail2ban.* gen_context(system_u:object_r:fail2ban_var_run_t,s0)
++
+/etc/rc\.d/init\.d/fail2ban -- gen_context(system_u:object_r:fail2ban_script_exec_t,s0)
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.if serefpolicy-3.3.1/policy/modules/services/fail2ban.if
@@ -17068,7 +17080,7 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.te serefpolicy-3.3.1/policy/modules/services/fail2ban.te
--- nsaserefpolicy/policy/modules/services/fail2ban.te 2008-06-12 23:38:01.000000000 -0400
-+++ serefpolicy-3.3.1/policy/modules/services/fail2ban.te 2008-09-08 11:45:12.000000000 -0400
++++ serefpolicy-3.3.1/policy/modules/services/fail2ban.te 2008-09-19 11:19:08.000000000 -0400
@@ -18,6 +18,9 @@
type fail2ban_var_run_t;
files_pid_file(fail2ban_var_run_t)
@@ -17088,18 +17100,19 @@
# log files
allow fail2ban_t fail2ban_log_t:dir setattr;
-@@ -33,8 +36,9 @@
+@@ -33,8 +36,10 @@
logging_log_filetrans(fail2ban_t,fail2ban_log_t,file)
# pid file
++manage_dirs_pattern(fail2ban_t, fail2ban_var_run_t, fail2ban_var_run_t)
+manage_sock_files_pattern(fail2ban_t,fail2ban_var_run_t,fail2ban_var_run_t)
manage_files_pattern(fail2ban_t,fail2ban_var_run_t,fail2ban_var_run_t)
-files_pid_filetrans(fail2ban_t,fail2ban_var_run_t, file)
-+files_pid_filetrans(fail2ban_t,fail2ban_var_run_t, { file sock_file })
++files_pid_filetrans(fail2ban_t,fail2ban_var_run_t, { dir file sock_file })
kernel_read_system_state(fail2ban_t)
-@@ -46,15 +50,26 @@
+@@ -46,15 +51,26 @@
domain_use_interactive_fds(fail2ban_t)
files_read_etc_files(fail2ban_t)
@@ -17127,7 +17140,7 @@
optional_policy(`
apache_read_log(fail2ban_t)
')
-@@ -64,5 +79,11 @@
+@@ -64,5 +80,11 @@
')
optional_policy(`
@@ -22242,7 +22255,7 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.3.1/policy/modules/services/postfix.te
--- nsaserefpolicy/policy/modules/services/postfix.te 2008-06-12 23:38:02.000000000 -0400
-+++ serefpolicy-3.3.1/policy/modules/services/postfix.te 2008-09-08 11:45:12.000000000 -0400
++++ serefpolicy-3.3.1/policy/modules/services/postfix.te 2008-09-23 09:11:49.000000000 -0400
@@ -6,6 +6,14 @@
# Declarations
#
@@ -22331,7 +22344,18 @@
optional_policy(`
cyrus_stream_connect(postfix_master_t)
-@@ -248,6 +271,10 @@
+@@ -189,6 +212,10 @@
+ ')
+
+ optional_policy(`
++ postgrey_search_spool(postfix_master_t)
++')
++
++optional_policy(`
+ sendmail_signal(postfix_master_t)
+ ')
+
+@@ -248,6 +275,10 @@
corecmd_exec_bin(postfix_cleanup_t)
@@ -22342,7 +22366,7 @@
########################################
#
# Postfix local local policy
-@@ -273,18 +300,25 @@
+@@ -273,18 +304,25 @@
files_read_etc_files(postfix_local_t)
@@ -22368,7 +22392,7 @@
')
optional_policy(`
-@@ -295,8 +329,7 @@
+@@ -295,8 +333,7 @@
#
# Postfix map local policy
#
@@ -22378,7 +22402,7 @@
allow postfix_map_t self:unix_stream_socket create_stream_socket_perms;
allow postfix_map_t self:unix_dgram_socket create_socket_perms;
allow postfix_map_t self:tcp_socket create_stream_socket_perms;
-@@ -346,8 +379,6 @@
+@@ -346,8 +383,6 @@
miscfiles_read_localization(postfix_map_t)
@@ -22387,7 +22411,7 @@
tunable_policy(`read_default_t',`
files_list_default(postfix_map_t)
files_read_default_files(postfix_map_t)
-@@ -360,6 +391,11 @@
+@@ -360,6 +395,11 @@
locallogin_dontaudit_use_fds(postfix_map_t)
')
@@ -22399,7 +22423,7 @@
########################################
#
# Postfix pickup local policy
-@@ -384,6 +420,7 @@
+@@ -384,6 +424,7 @@
#
allow postfix_pipe_t self:fifo_file rw_fifo_file_perms;
@@ -22407,7 +22431,7 @@
write_sock_files_pattern(postfix_pipe_t,postfix_private_t,postfix_private_t)
-@@ -391,6 +428,12 @@
+@@ -391,6 +432,12 @@
rw_files_pattern(postfix_pipe_t,postfix_spool_t,postfix_spool_t)
@@ -22420,7 +22444,7 @@
optional_policy(`
procmail_domtrans(postfix_pipe_t)
')
-@@ -400,6 +443,10 @@
+@@ -400,6 +447,10 @@
')
optional_policy(`
@@ -22431,7 +22455,7 @@
uucp_domtrans_uux(postfix_pipe_t)
')
-@@ -436,8 +483,7 @@
+@@ -436,8 +487,7 @@
')
optional_policy(`
@@ -22441,7 +22465,7 @@
')
#######################################
-@@ -463,6 +509,15 @@
+@@ -463,6 +513,15 @@
init_sigchld_script(postfix_postqueue_t)
init_use_script_fds(postfix_postqueue_t)
@@ -22457,7 +22481,7 @@
########################################
#
# Postfix qmgr local policy
-@@ -532,9 +587,6 @@
+@@ -532,9 +591,6 @@
# connect to master process
stream_connect_pattern(postfix_smtpd_t,{ postfix_private_t postfix_public_t },{ postfix_private_t postfix_public_t },postfix_master_t)
@@ -22467,7 +22491,7 @@
# for prng_exch
allow postfix_smtpd_t postfix_spool_t:file rw_file_perms;
allow postfix_smtpd_t postfix_prng_t:file rw_file_perms;
-@@ -557,6 +609,10 @@
+@@ -557,6 +613,10 @@
sasl_connect(postfix_smtpd_t)
')
@@ -22478,7 +22502,7 @@
########################################
#
# Postfix virtual local policy
-@@ -572,7 +628,7 @@
+@@ -572,7 +632,7 @@
files_tmp_filetrans(postfix_virtual_t, postfix_virtual_tmp_t, { file dir })
# connect to master process
@@ -23251,7 +23275,7 @@
+kernel_relabelfrom_unlabeled_database(sepgsql_unconfined_type)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgrey.fc serefpolicy-3.3.1/policy/modules/services/postgrey.fc
--- nsaserefpolicy/policy/modules/services/postgrey.fc 2008-06-12 23:38:01.000000000 -0400
-+++ serefpolicy-3.3.1/policy/modules/services/postgrey.fc 2008-09-08 11:45:12.000000000 -0400
++++ serefpolicy-3.3.1/policy/modules/services/postgrey.fc 2008-09-23 09:06:46.000000000 -0400
@@ -7,3 +7,7 @@
/var/run/postgrey(/.*)? gen_context(system_u:object_r:postgrey_var_run_t,s0)
@@ -23262,8 +23286,8 @@
+/var/spool/postfix/postgrey(/.*)? gen_context(system_u:object_r:postgrey_spool_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgrey.if serefpolicy-3.3.1/policy/modules/services/postgrey.if
--- nsaserefpolicy/policy/modules/services/postgrey.if 2008-06-12 23:38:01.000000000 -0400
-+++ serefpolicy-3.3.1/policy/modules/services/postgrey.if 2008-09-19 10:23:53.000000000 -0400
-@@ -12,10 +12,82 @@
++++ serefpolicy-3.3.1/policy/modules/services/postgrey.if 2008-09-23 09:13:12.000000000 -0400
+@@ -12,10 +12,100 @@
#
interface(`postgrey_stream_connect',`
gen_require(`
@@ -23280,6 +23304,24 @@
+
+########################################
+## <summary>
++## Search the spool directory
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access
++## </summary>
++## </param>
++#
++interface(`postgrey_search_spool',`
++ gen_require(`
++ type postgrey_spool_t;
++ ')
++
++ allow $1 postgrey_spool_t:dir search_dir_perms;
++')
++
++########################################
++## <summary>
+## Execute postgrey server in the postgrey domain.
+## </summary>
+## <param name="domain">
@@ -23569,8 +23611,8 @@
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.fc serefpolicy-3.3.1/policy/modules/services/prelude.fc
--- nsaserefpolicy/policy/modules/services/prelude.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/services/prelude.fc 2008-09-08 11:45:12.000000000 -0400
-@@ -0,0 +1,20 @@
++++ serefpolicy-3.3.1/policy/modules/services/prelude.fc 2008-09-22 09:14:58.000000000 -0400
+@@ -0,0 +1,24 @@
+/sbin/audisp-prelude -- gen_context(system_u:object_r:prelude_audisp_exec_t,s0)
+
+/usr/bin/prelude-manager -- gen_context(system_u:object_r:prelude_exec_t,s0)
@@ -23588,9 +23630,13 @@
+/usr/bin/prelude-lml -- gen_context(system_u:object_r:prelude_lml_exec_t,s0)
+/var/run/prelude-lml.pid -- gen_context(system_u:object_r:prelude_lml_var_run_t,s0)
+
++/etc/rc\.d/init\.d/prelude-correlator -- gen_context(system_u:object_r:prelude_correlator_script_exec_t, s0)
+/etc/rc\.d/init\.d/prelude-lml -- gen_context(system_u:object_r:prelude_lml_script_exec_t,s0)
+/etc/rc\.d/init\.d/prelude-manager -- gen_context(system_u:object_r:prelude_script_exec_t,s0)
+
++/etc/prelude-correlator(/.*)? gen_context(system_u:object_r:prelude_correlator_config_t, s0)
++/usr/bin/prelude-correlator -- gen_context(system_u:object_r:prelude_correlator_exec_t, s0)
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.if serefpolicy-3.3.1/policy/modules/services/prelude.if
--- nsaserefpolicy/policy/modules/services/prelude.if 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/services/prelude.if 2008-09-08 11:45:12.000000000 -0400
@@ -23788,8 +23834,8 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.te serefpolicy-3.3.1/policy/modules/services/prelude.te
--- nsaserefpolicy/policy/modules/services/prelude.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/services/prelude.te 2008-09-19 10:06:47.000000000 -0400
-@@ -0,0 +1,260 @@
++++ serefpolicy-3.3.1/policy/modules/services/prelude.te 2008-09-22 09:14:34.000000000 -0400
+@@ -0,0 +1,325 @@
+
+policy_module(prelude, 1.0.0)
+
@@ -23842,6 +23888,22 @@
+
+########################################
+#
++# prelude_correlator declarations
++#
++
++type prelude_correlator_t;
++type prelude_correlator_exec_t;
++init_daemon_domain(prelude_correlator_t, prelude_correlator_exec_t)
++role system_r types prelude_correlator_t;
++
++type prelude_correlator_script_exec_t;
++init_script_file(prelude_correlator_script_exec_t)
++
++type prelude_correlator_config_t;
++files_config_file(prelude_correlator_config_t)
++
++########################################
++#
+# prelude local policy
+#
+
@@ -23875,15 +23937,19 @@
+corenet_tcp_bind_all_nodes(prelude_t)
+corenet_tcp_bind_prelude_port(prelude_t)
+corenet_tcp_connect_prelude_port(prelude_t)
++corenet_tcp_connect_postgresql_port(prelude_t)
+
+dev_read_rand(prelude_t)
+dev_read_urand(prelude_t)
+
++kernel_read_sysctl(prelude_t)
++
+# Init script handling
+domain_use_interactive_fds(prelude_t)
+
+files_read_etc_files(prelude_t)
+files_read_usr_files(prelude_t)
++files_search_tmp(prelude_t)
+
+fs_rw_anon_inodefs_files(prelude_t)
+
@@ -23939,6 +24005,8 @@
+# Init script handling
+domain_use_interactive_fds(prelude_audisp_t)
+
++kernel_read_sysctl(prelude_audisp_t)
++
+files_read_etc_files(prelude_audisp_t)
+
+libs_use_ld_so(prelude_audisp_t)
@@ -23953,13 +24021,49 @@
+
+########################################
+#
++# prelude_correlator local policy
++#
++
++allow prelude_correlator_t self:netlink_route_socket r_netlink_socket_perms;
++allow prelude_correlator_t self:tcp_socket create_stream_socket_perms;
++allow prelude_correlator_t self:unix_dgram_socket create_socket_perms;
++
++read_files_pattern(prelude_correlator_t, prelude_correlator_config_t, prelude_correlator_config_t)
++
++prelude_manage_spool(prelude_correlator_t)
++
++corecmd_search_sbin(prelude_correlator_t)
++
++corenet_all_recvfrom_unlabeled(prelude_correlator_t)
++corenet_all_recvfrom_netlabel(prelude_correlator_t)
++corenet_tcp_sendrecv_all_if(prelude_correlator_t)
++corenet_tcp_sendrecv_all_nodes(prelude_correlator_t)
++corenet_tcp_connect_prelude_port(prelude_correlator_t)
++
++dev_read_rand(prelude_correlator_t)
++dev_read_urand(prelude_correlator_t)
++
++files_read_etc_files(prelude_correlator_t)
++files_read_usr_files(prelude_correlator_t)
++files_search_spool(prelude_correlator_t)
++
++libs_use_ld_so(prelude_correlator_t)
++libs_use_shared_libs(prelude_correlator_t)
++
++logging_send_syslog_msg(prelude_correlator_t)
++
++miscfiles_read_localization(prelude_correlator_t)
++
++sysnet_dns_name_resolve(prelude_correlator_t)
++
++########################################
++#
+# prelude_lml local declarations
+#
+
+allow prelude_lml_t self:capability dac_override;
+
+# Init script handling
-+# Test me
+domain_use_interactive_fds(prelude_lml_t)
+
+allow prelude_lml_t self:tcp_socket { write getattr setopt read create connect };
@@ -24017,6 +24121,8 @@
+
+miscfiles_read_localization(prelude_lml_t)
+
++sysnet_dns_name_resolve(prelude_lml_t)
++
+optional_policy(`
+ gamin_exec(prelude_lml_t)
+')
@@ -24033,8 +24139,13 @@
+
+optional_policy(`
+ apache_content_template(prewikka)
++ files_search_tmp(httpd_prewikka_script_t)
+ files_read_etc_files(httpd_prewikka_script_t)
+
++ apache_search_sys_content(httpd_prewikka_script_t)
++
++ corenet_tcp_connect_postgresql_port(httpd_prewikka_script_t)
++
+ auth_use_nsswitch(httpd_prewikka_script_t)
+
+ logging_send_syslog_msg(httpd_prewikka_script_t)
@@ -33690,7 +33801,7 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.3.1/policy/modules/system/logging.te
--- nsaserefpolicy/policy/modules/system/logging.te 2008-06-12 23:38:01.000000000 -0400
-+++ serefpolicy-3.3.1/policy/modules/system/logging.te 2008-09-15 13:03:33.000000000 -0400
++++ serefpolicy-3.3.1/policy/modules/system/logging.te 2008-09-23 08:51:57.000000000 -0400
@@ -61,10 +61,29 @@
logging_log_file(var_log_t)
files_mountpoint(var_log_t)
@@ -33756,7 +33867,16 @@
# Needs to be able to run dispatcher. see /etc/audit/auditd.conf
# Probably want a transition, and a new auditd_helper app
corecmd_exec_bin(auditd_t)
-@@ -158,9 +188,12 @@
+@@ -150,6 +180,8 @@
+
+ logging_set_audit_parameters(auditd_t)
+ logging_send_syslog_msg(auditd_t)
++logging_domtrans_audisp(auditd_t)
++logging_audisp_signal(auditd_t)
+
+ libs_use_ld_so(auditd_t)
+ libs_use_shared_libs(auditd_t)
+@@ -158,9 +190,12 @@
mls_file_read_all_levels(auditd_t)
mls_file_write_all_levels(auditd_t) # Need to be able to write to /var/run/ directory
@@ -33769,7 +33889,7 @@
userdom_dontaudit_use_unpriv_user_fds(auditd_t)
userdom_dontaudit_search_sysadm_home_dirs(auditd_t)
-@@ -171,6 +204,10 @@
+@@ -171,6 +206,10 @@
')
optional_policy(`
@@ -33780,7 +33900,7 @@
seutil_sigchld_newrole(auditd_t)
')
-@@ -208,6 +245,7 @@
+@@ -208,6 +247,7 @@
fs_getattr_all_fs(klogd_t)
fs_search_auto_mountpoints(klogd_t)
@@ -33788,7 +33908,7 @@
domain_use_interactive_fds(klogd_t)
-@@ -252,7 +290,6 @@
+@@ -252,7 +292,6 @@
dontaudit syslogd_t self:capability sys_tty_config;
# setpgid for metalog
allow syslogd_t self:process { signal_perms setpgid };
@@ -33796,7 +33916,7 @@
# receive messages to be logged
allow syslogd_t self:unix_dgram_socket create_socket_perms;
allow syslogd_t self:unix_stream_socket create_stream_socket_perms;
-@@ -262,7 +299,7 @@
+@@ -262,7 +301,7 @@
allow syslogd_t self:tcp_socket create_stream_socket_perms;
allow syslogd_t syslog_conf_t:file read_file_perms;
@@ -33805,7 +33925,7 @@
# Create and bind to /dev/log or /var/run/log.
allow syslogd_t devlog_t:sock_file manage_sock_file_perms;
files_pid_filetrans(syslogd_t,devlog_t,sock_file)
-@@ -274,6 +311,9 @@
+@@ -274,6 +313,9 @@
# Allow access for syslog-ng
allow syslogd_t var_log_t:dir { create setattr };
@@ -33815,7 +33935,7 @@
# manage temporary files
manage_dirs_pattern(syslogd_t,syslogd_tmp_t,syslogd_tmp_t)
manage_files_pattern(syslogd_t,syslogd_tmp_t,syslogd_tmp_t)
-@@ -289,12 +329,14 @@
+@@ -289,12 +331,14 @@
manage_files_pattern(syslogd_t,syslogd_var_run_t,syslogd_var_run_t)
files_pid_filetrans(syslogd_t,syslogd_var_run_t,file)
@@ -33830,7 +33950,7 @@
dev_filetrans(syslogd_t,devlog_t,sock_file)
dev_read_sysfs(syslogd_t)
-@@ -327,6 +369,8 @@
+@@ -327,6 +371,8 @@
# Allow users to define additional syslog ports to connect to
corenet_tcp_bind_syslogd_port(syslogd_t)
corenet_tcp_connect_syslogd_port(syslogd_t)
@@ -33839,7 +33959,7 @@
# syslog-ng can send or receive logs
corenet_sendrecv_syslogd_client_packets(syslogd_t)
-@@ -339,19 +383,20 @@
+@@ -339,19 +385,20 @@
domain_use_interactive_fds(syslogd_t)
files_read_etc_files(syslogd_t)
@@ -33862,7 +33982,7 @@
miscfiles_read_localization(syslogd_t)
userdom_dontaudit_use_unpriv_user_fds(syslogd_t)
-@@ -380,15 +425,11 @@
+@@ -380,15 +427,11 @@
')
optional_policy(`
@@ -33880,7 +34000,7 @@
')
optional_policy(`
-@@ -399,3 +440,67 @@
+@@ -399,3 +442,66 @@
# log to the xconsole
xserver_rw_console(syslogd_t)
')
@@ -33918,8 +34038,7 @@
+corecmd_search_bin(audisp_t)
+allow audisp_t self:unix_dgram_socket create_socket_perms;
+
-+logging_domtrans_audisp(auditd_t)
-+logging_audisp_signal(auditd_t)
++sysnet_dns_name_resolve(audisp_t)
+
+########################################
+#
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-9/selinux-policy.spec,v
retrieving revision 1.709
retrieving revision 1.710
diff -u -r1.709 -r1.710
--- selinux-policy.spec 19 Sep 2008 13:54:22 -0000 1.709
+++ selinux-policy.spec 23 Sep 2008 13:27:34 -0000 1.710
@@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.3.1
-Release: 92%{?dist}
+Release: 93%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -386,6 +386,10 @@
%endif
%changelog
+* Mon Sep 22 2008 Dan Walsh <dwalsh at redhat.com> 3.3.1-93
+- Add /dev/msp* support
+- Update prewikka support
+
* Tue Sep 18 2008 Dan Walsh <dwalsh at redhat.com> 3.3.1-92
- Dontaudit attempts to write user_tmp_t by gssd_t
More information about the fedora-extras-commits
mailing list