rpms/selinux-policy/devel .cvsignore, 1.181, 1.182 policy-F12.patch, 1.55, 1.56 selinux-policy.spec, 1.899, 1.900
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Aug 20 17:48:52 UTC 2009
- Previous message (by thread): rpms/gnome-keyring-sharp/devel .cvsignore, 1.3, 1.4 gnome-keyring-sharp.spec, 1.5, 1.6 sources, 1.3, 1.4
- Next message (by thread): rpms/shmpps/devel import.log, NONE, 1.1 shmpps.init, NONE, 1.1 shmpps.spec, NONE, 1.1 shmpps.sysconfig, NONE, 1.1 .cvsignore, 1.1, 1.2 sources, 1.1, 1.2
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv10043
Modified Files:
.cvsignore policy-F12.patch selinux-policy.spec
Log Message:
* Thu Aug 20 2009 Dan Walsh <dwalsh at redhat.com> 3.6.28-3
- Fix system-config-services policy
Index: .cvsignore
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/.cvsignore,v
retrieving revision 1.181
retrieving revision 1.182
diff -u -p -r1.181 -r1.182
--- .cvsignore 18 Aug 2009 22:43:34 -0000 1.181
+++ .cvsignore 20 Aug 2009 17:48:51 -0000 1.182
@@ -184,3 +184,4 @@ serefpolicy-3.6.25.tgz
serefpolicy-3.6.26.tgz
serefpolicy-3.6.27.tgz
serefpolicy-3.6.28.tgz
+setroubleshoot-2.2.21.tar.gz
policy-F12.patch:
Changelog | 3
Makefile | 22
Rules.modular | 8
config/appconfig-mcs/default_contexts | 19
config/appconfig-mcs/failsafe_context | 2
config/appconfig-mcs/root_default_contexts | 8
config/appconfig-mcs/securetty_types | 5
config/appconfig-mcs/seusers | 4
config/appconfig-mcs/staff_u_default_contexts | 4
config/appconfig-mcs/unconfined_u_default_contexts | 4
config/appconfig-mcs/user_u_default_contexts | 5
config/appconfig-mcs/userhelper_context | 2
config/appconfig-mcs/virtual_domain_context | 1
config/appconfig-mcs/virtual_image_context | 2
config/appconfig-mls/default_contexts | 19
config/appconfig-mls/root_default_contexts | 12
config/appconfig-mls/virtual_domain_context | 1
config/appconfig-mls/virtual_image_context | 2
config/appconfig-standard/securetty_types | 5
man/man8/rsync_selinux.8 | 18
man/man8/samba_selinux.8 | 4
policy/flask/access_vectors | 2
policy/global_tunables | 24
policy/mcs | 10
policy/modules/admin/anaconda.te | 3
policy/modules/admin/certwatch.te | 1
policy/modules/admin/dmesg.fc | 2
policy/modules/admin/dmesg.te | 7
policy/modules/admin/kismet.if | 1
policy/modules/admin/kismet.te | 17
policy/modules/admin/logrotate.te | 13
policy/modules/admin/logwatch.te | 1
policy/modules/admin/mrtg.te | 7
policy/modules/admin/portage.te | 5
policy/modules/admin/prelink.if | 19
policy/modules/admin/readahead.te | 3
policy/modules/admin/rpm.fc | 15
policy/modules/admin/rpm.if | 176 ++
policy/modules/admin/rpm.te | 65 -
policy/modules/admin/smoltclient.fc | 4
policy/modules/admin/smoltclient.if | 1
policy/modules/admin/smoltclient.te | 66 +
policy/modules/admin/sudo.if | 41
policy/modules/admin/tmpreaper.te | 4
policy/modules/admin/usermanage.te | 25
policy/modules/admin/vbetool.te | 14
policy/modules/apps/awstats.te | 4
policy/modules/apps/calamaris.te | 4
policy/modules/apps/cpufreqselector.te | 4
policy/modules/apps/gitosis.fc | 4
policy/modules/apps/gitosis.if | 96 +
policy/modules/apps/gitosis.te | 36
policy/modules/apps/gnome.fc | 12
policy/modules/apps/gnome.if | 170 ++
policy/modules/apps/gnome.te | 92 +
policy/modules/apps/gpg.if | 2
policy/modules/apps/gpg.te | 16
policy/modules/apps/java.fc | 17
policy/modules/apps/java.if | 111 +
policy/modules/apps/java.te | 12
policy/modules/apps/kdumpgui.fc | 2
policy/modules/apps/kdumpgui.if | 2
policy/modules/apps/kdumpgui.te | 64 +
policy/modules/apps/livecd.fc | 2
policy/modules/apps/livecd.if | 50
policy/modules/apps/livecd.te | 26
policy/modules/apps/mono.if | 101 +
policy/modules/apps/mono.te | 9
policy/modules/apps/mozilla.fc | 1
policy/modules/apps/mozilla.if | 13
policy/modules/apps/mozilla.te | 21
policy/modules/apps/nsplugin.fc | 12
policy/modules/apps/nsplugin.if | 313 +++++
policy/modules/apps/nsplugin.te | 286 ++++
policy/modules/apps/openoffice.fc | 3
policy/modules/apps/openoffice.if | 93 +
policy/modules/apps/openoffice.te | 14
policy/modules/apps/ptchown.fc | 2
policy/modules/apps/ptchown.if | 22
policy/modules/apps/ptchown.te | 39
policy/modules/apps/pulseaudio.te | 9
policy/modules/apps/qemu.fc | 4
policy/modules/apps/qemu.if | 270 +++-
policy/modules/apps/qemu.te | 82 +
policy/modules/apps/sambagui.fc | 1
policy/modules/apps/sambagui.if | 2
policy/modules/apps/sambagui.te | 55
policy/modules/apps/sandbox.fc | 1
policy/modules/apps/sandbox.if | 143 ++
policy/modules/apps/sandbox.te | 274 ++++
policy/modules/apps/screen.if | 24
policy/modules/apps/vmware.fc | 1
policy/modules/apps/vmware.te | 1
policy/modules/apps/webalizer.te | 1
policy/modules/apps/wine.fc | 23
policy/modules/apps/wine.if | 60
policy/modules/apps/wine.te | 23
policy/modules/kernel/corecommands.fc | 23
policy/modules/kernel/corecommands.if | 1
policy/modules/kernel/corenetwork.te.in | 29
policy/modules/kernel/devices.fc | 5
policy/modules/kernel/devices.if | 164 ++
policy/modules/kernel/devices.te | 19
policy/modules/kernel/domain.if | 132 +-
policy/modules/kernel/domain.te | 89 +
policy/modules/kernel/files.fc | 3
policy/modules/kernel/files.if | 297 ++++
policy/modules/kernel/files.te | 6
policy/modules/kernel/filesystem.fc | 2
policy/modules/kernel/filesystem.if | 155 ++
policy/modules/kernel/filesystem.te | 8
policy/modules/kernel/kernel.if | 39
policy/modules/kernel/kernel.te | 29
policy/modules/kernel/selinux.if | 25
policy/modules/kernel/terminal.fc | 1
policy/modules/kernel/terminal.if | 40
policy/modules/kernel/terminal.te | 1
policy/modules/roles/guest.te | 8
policy/modules/roles/staff.te | 123 -
policy/modules/roles/sysadm.te | 124 -
policy/modules/roles/unconfineduser.fc | 37
policy/modules/roles/unconfineduser.if | 638 ++++++++++
policy/modules/roles/unconfineduser.te | 391 ++++++
policy/modules/roles/unprivuser.te | 131 --
policy/modules/roles/xguest.te | 18
policy/modules/services/amavis.te | 2
policy/modules/services/apache.fc | 35
policy/modules/services/apache.if | 327 +++--
policy/modules/services/apache.te | 409 +++++-
policy/modules/services/apm.te | 2
policy/modules/services/automount.te | 1
policy/modules/services/bind.if | 40
policy/modules/services/bluetooth.te | 6
policy/modules/services/certmaster.te | 2
policy/modules/services/clamav.te | 12
policy/modules/services/consolekit.if | 39
policy/modules/services/consolekit.te | 18
policy/modules/services/courier.if | 18
policy/modules/services/courier.te | 1
policy/modules/services/cron.fc | 13
policy/modules/services/cron.if | 202 ++-
policy/modules/services/cron.te | 143 +-
policy/modules/services/cups.fc | 13
policy/modules/services/cups.te | 28
policy/modules/services/cvs.te | 1
policy/modules/services/dbus.fc | 5
policy/modules/services/dbus.if | 26
policy/modules/services/dbus.te | 27
policy/modules/services/dcc.te | 8
policy/modules/services/ddclient.if | 25
policy/modules/services/devicekit.fc | 2
policy/modules/services/devicekit.if | 22
policy/modules/services/devicekit.te | 50
policy/modules/services/dnsmasq.te | 8
policy/modules/services/dovecot.te | 7
policy/modules/services/exim.te | 4
policy/modules/services/fetchmail.te | 2
policy/modules/services/fprintd.te | 4
policy/modules/services/ftp.te | 50
policy/modules/services/gnomeclock.fc | 3
policy/modules/services/gnomeclock.if | 69 +
policy/modules/services/gnomeclock.te | 50
policy/modules/services/gpsd.fc | 5
policy/modules/services/gpsd.if | 27
policy/modules/services/gpsd.te | 14
policy/modules/services/hal.fc | 1
policy/modules/services/hal.if | 18
policy/modules/services/hal.te | 46
policy/modules/services/hddtemp.fc | 4
policy/modules/services/hddtemp.if | 38
policy/modules/services/hddtemp.te | 40
policy/modules/services/kerberos.te | 13
policy/modules/services/ktalk.te | 1
policy/modules/services/lircd.te | 11
policy/modules/services/mailman.te | 4
policy/modules/services/memcached.te | 2
policy/modules/services/modemmanager.fc | 2
policy/modules/services/modemmanager.if | 43
policy/modules/services/modemmanager.te | 46
policy/modules/services/mta.fc | 2
policy/modules/services/mta.if | 5
policy/modules/services/mta.te | 52
policy/modules/services/munin.fc | 3
policy/modules/services/munin.te | 3
policy/modules/services/mysql.te | 7
policy/modules/services/nagios.fc | 11
policy/modules/services/nagios.if | 70 -
policy/modules/services/nagios.te | 55
policy/modules/services/networkmanager.fc | 13
policy/modules/services/networkmanager.if | 45
policy/modules/services/networkmanager.te | 114 +
policy/modules/services/nis.fc | 5
policy/modules/services/nis.if | 87 +
policy/modules/services/nis.te | 13
policy/modules/services/nscd.if | 18
policy/modules/services/nscd.te | 11
policy/modules/services/nslcd.fc | 4
policy/modules/services/nslcd.if | 142 ++
policy/modules/services/nslcd.te | 48
policy/modules/services/ntp.if | 46
policy/modules/services/ntp.te | 7
policy/modules/services/nx.fc | 1
policy/modules/services/nx.if | 18
policy/modules/services/nx.te | 6
policy/modules/services/oddjob.if | 1
policy/modules/services/openvpn.te | 13
policy/modules/services/pcscd.te | 3
policy/modules/services/pegasus.te | 28
policy/modules/services/policykit.fc | 10
policy/modules/services/policykit.if | 46
policy/modules/services/policykit.te | 52
policy/modules/services/postfix.fc | 2
policy/modules/services/postfix.if | 150 ++
policy/modules/services/postfix.te | 138 +-
policy/modules/services/postgresql.fc | 1
policy/modules/services/postgresql.if | 43
policy/modules/services/postgresql.te | 7
policy/modules/services/ppp.if | 6
policy/modules/services/ppp.te | 10
policy/modules/services/privoxy.te | 3
policy/modules/services/procmail.te | 12
policy/modules/services/pyzor.fc | 4
policy/modules/services/pyzor.if | 47
policy/modules/services/pyzor.te | 39
policy/modules/services/razor.fc | 1
policy/modules/services/razor.if | 42
policy/modules/services/razor.te | 34
policy/modules/services/ricci.te | 5
policy/modules/services/rpc.if | 6
policy/modules/services/rpc.te | 10
policy/modules/services/rpcbind.if | 20
policy/modules/services/rsync.te | 23
policy/modules/services/rtkit_daemon.fc | 2
policy/modules/services/rtkit_daemon.if | 64 +
policy/modules/services/rtkit_daemon.te | 38
policy/modules/services/samba.fc | 4
policy/modules/services/samba.if | 104 +
policy/modules/services/samba.te | 82 +
policy/modules/services/sasl.te | 15
policy/modules/services/sendmail.if | 137 ++
policy/modules/services/sendmail.te | 87 +
policy/modules/services/setroubleshoot.fc | 2
policy/modules/services/setroubleshoot.if | 63 -
policy/modules/services/setroubleshoot.te | 60
policy/modules/services/shorewall.fc | 12
policy/modules/services/shorewall.if | 166 ++
policy/modules/services/shorewall.te | 95 +
policy/modules/services/smartmon.te | 12
policy/modules/services/spamassassin.fc | 14
policy/modules/services/spamassassin.if | 68 +
policy/modules/services/spamassassin.te | 129 +-
policy/modules/services/squid.te | 7
policy/modules/services/ssh.fc | 2
policy/modules/services/ssh.if | 163 ++
policy/modules/services/ssh.te | 70 -
policy/modules/services/sssd.fc | 2
policy/modules/services/sssd.if | 43
policy/modules/services/sysstat.te | 2
policy/modules/services/uucp.te | 3
policy/modules/services/virt.fc | 11
policy/modules/services/virt.if | 131 +-
policy/modules/services/virt.te | 271 ++++
policy/modules/services/w3c.te | 7
policy/modules/services/xserver.fc | 29
policy/modules/services/xserver.if | 538 ++++++++
policy/modules/services/xserver.te | 306 ++++
policy/modules/system/application.if | 20
policy/modules/system/application.te | 11
policy/modules/system/authlogin.fc | 9
policy/modules/system/authlogin.if | 204 ++-
policy/modules/system/authlogin.te | 39
policy/modules/system/clock.te | 8
policy/modules/system/fstools.fc | 2
policy/modules/system/fstools.te | 67 -
policy/modules/system/getty.te | 16
policy/modules/system/hostname.te | 22
policy/modules/system/init.fc | 6
policy/modules/system/init.if | 156 ++
policy/modules/system/init.te | 262 +++-
policy/modules/system/ipsec.fc | 2
policy/modules/system/ipsec.if | 25
policy/modules/system/ipsec.te | 97 +
policy/modules/system/iptables.fc | 11
policy/modules/system/iptables.te | 5
policy/modules/system/iscsi.if | 40
policy/modules/system/iscsi.te | 6
policy/modules/system/kdump.fc | 8
policy/modules/system/kdump.if | 111 +
policy/modules/system/kdump.te | 38
policy/modules/system/libraries.fc | 153 +-
policy/modules/system/libraries.if | 4
policy/modules/system/libraries.te | 16
policy/modules/system/locallogin.te | 74 -
policy/modules/system/logging.fc | 11
policy/modules/system/logging.if | 4
policy/modules/system/logging.te | 32
policy/modules/system/lvm.te | 53
policy/modules/system/miscfiles.if | 19
policy/modules/system/modutils.te | 167 +-
policy/modules/system/mount.fc | 7
policy/modules/system/mount.te | 124 +
policy/modules/system/pcmcia.te | 19
policy/modules/system/raid.te | 24
policy/modules/system/selinuxutil.fc | 16
policy/modules/system/selinuxutil.if | 288 ++++
policy/modules/system/selinuxutil.te | 227 +--
policy/modules/system/setrans.if | 20
policy/modules/system/sysnetwork.fc | 9
policy/modules/system/sysnetwork.if | 117 +
policy/modules/system/sysnetwork.te | 106 +
policy/modules/system/udev.fc | 3
policy/modules/system/udev.te | 38
policy/modules/system/unconfined.fc | 15
policy/modules/system/unconfined.if | 446 -------
policy/modules/system/unconfined.te | 224 ---
policy/modules/system/userdomain.fc | 5
policy/modules/system/userdomain.if | 1306 +++++++++++++++------
policy/modules/system/userdomain.te | 50
policy/modules/system/xen.fc | 6
policy/modules/system/xen.if | 28
policy/modules/system/xen.te | 139 +-
policy/support/obj_perm_sets.spt | 14
policy/users | 13
support/Makefile.devel | 3
support/divert.m4 | 1
support/undivert.m4 | 1
326 files changed, 14076 insertions(+), 2984 deletions(-)
Index: policy-F12.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-F12.patch,v
retrieving revision 1.55
retrieving revision 1.56
diff -u -p -r1.55 -r1.56
--- policy-F12.patch 20 Aug 2009 00:02:37 -0000 1.55
+++ policy-F12.patch 20 Aug 2009 17:48:51 -0000 1.56
@@ -440,7 +440,7 @@ diff -b -B --ignore-all-space --exclude-
(( h1 dom h2 ) or ( t1 == mcssetcats ));
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.6.28/policy/modules/admin/anaconda.te
--- nsaserefpolicy/policy/modules/admin/anaconda.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/admin/anaconda.te 2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/admin/anaconda.te 2009-08-20 08:51:33.000000000 -0400
@@ -31,6 +31,7 @@
modutils_domtrans_insmod(anaconda_t)
@@ -449,6 +449,15 @@ diff -b -B --ignore-all-space --exclude-
userdom_user_home_dir_filetrans_user_home_content(anaconda_t, { dir file lnk_file fifo_file sock_file })
+@@ -52,7 +53,7 @@
+ ')
+
+ optional_policy(`
+- unconfined_domain(anaconda_t)
++ unconfined_domain_noaudit(anaconda_t)
+ ')
+
+ optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/certwatch.te serefpolicy-3.6.28/policy/modules/admin/certwatch.te
--- nsaserefpolicy/policy/modules/admin/certwatch.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/admin/certwatch.te 2009-08-18 13:23:29.000000000 -0400
@@ -4730,8 +4739,16 @@ diff -b -B --ignore-all-space --exclude-
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.6.28/policy/modules/kernel/corecommands.fc
--- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2009-07-30 13:09:10.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/kernel/corecommands.fc 2009-08-18 13:23:29.000000000 -0400
-@@ -125,6 +125,7 @@
++++ serefpolicy-3.6.28/policy/modules/kernel/corecommands.fc 2009-08-20 08:44:10.000000000 -0400
+@@ -54,6 +54,7 @@
+ /etc/cron.weekly/.* -- gen_context(system_u:object_r:bin_t,s0)
+ /etc/cron.monthly/.* -- gen_context(system_u:object_r:bin_t,s0)
+
++/etc/dhcp/dhclient\.d(/.*)? gen_context(system_u:object_r:bin_t,s0)
+ /etc/hotplug/.*agent -- gen_context(system_u:object_r:bin_t,s0)
+ /etc/hotplug/.*rc -- gen_context(system_u:object_r:bin_t,s0)
+ /etc/hotplug/hotplug\.functions -- gen_context(system_u:object_r:bin_t,s0)
+@@ -125,6 +126,7 @@
/sbin/.* gen_context(system_u:object_r:bin_t,s0)
/sbin/mkfs\.cramfs -- gen_context(system_u:object_r:bin_t,s0)
/sbin/insmod_ksymoops_clean -- gen_context(system_u:object_r:bin_t,s0)
@@ -4739,7 +4756,7 @@ diff -b -B --ignore-all-space --exclude-
#
# /opt
-@@ -142,6 +143,9 @@
+@@ -142,6 +144,9 @@
/opt/vmware/workstation/lib/lib/wrapper-gtk24\.sh -- gen_context(system_u:object_r:bin_t,s0)
')
@@ -4749,7 +4766,7 @@ diff -b -B --ignore-all-space --exclude-
#
# /usr
#
-@@ -315,3 +319,21 @@
+@@ -315,3 +320,21 @@
ifdef(`distro_suse',`
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
')
@@ -4925,7 +4942,7 @@ diff -b -B --ignore-all-space --exclude-
/dev/usb/mdc800.* -c gen_context(system_u:object_r:scanner_device_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.6.28/policy/modules/kernel/devices.if
--- nsaserefpolicy/policy/modules/kernel/devices.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/kernel/devices.if 2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/devices.if 2009-08-20 09:16:58.000000000 -0400
@@ -1655,6 +1655,78 @@
########################################
@@ -5514,7 +5531,7 @@ diff -b -B --ignore-all-space --exclude-
/var/lib/nfs/rpc_pipefs(/.*)? <<none>>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.6.28/policy/modules/kernel/files.if
--- nsaserefpolicy/policy/modules/kernel/files.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/kernel/files.if 2009-08-18 13:38:01.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/files.if 2009-08-20 09:41:17.000000000 -0400
@@ -110,6 +110,11 @@
## </param>
#
@@ -5687,7 +5704,32 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -4955,7 +5047,7 @@
+@@ -4188,6 +4280,24 @@
+
+ ########################################
+ ## <summary>
++## Set the attributes of the /var/run directory.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`files_setattr_pid_dirs',`
++ gen_require(`
++ type var_run_t;
++ ')
++
++ allow $1 var_run_t:dir setattr;
++')
++
++########################################
++## <summary>
+ ## Search the /var/lib directory.
+ ## </summary>
+ ## <param name="domain">
+@@ -4955,7 +5065,7 @@
selinux_compute_member($1)
# Need sys_admin capability for mounting
@@ -5696,7 +5738,7 @@ diff -b -B --ignore-all-space --exclude-
# Need to give access to the directories to be polyinstantiated
allow $1 polydir:dir { create open getattr search write add_name setattr mounton rmdir };
-@@ -4977,12 +5069,15 @@
+@@ -4977,12 +5087,15 @@
allow $1 poly_t:dir { create mounton };
fs_unmount_xattr_fs($1)
@@ -5713,7 +5755,7 @@ diff -b -B --ignore-all-space --exclude-
')
')
-@@ -5003,3 +5098,173 @@
+@@ -5003,3 +5116,173 @@
typeattribute $1 files_unconfined_type;
')
@@ -7632,8 +7674,8 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.te serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te
--- nsaserefpolicy/policy/modules/roles/unconfineduser.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te 2009-08-18 13:23:29.000000000 -0400
-@@ -0,0 +1,395 @@
++++ serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te 2009-08-20 09:01:03.000000000 -0400
+@@ -0,0 +1,391 @@
+policy_module(unconfineduser, 1.0.0)
+
+########################################
@@ -7940,10 +7982,6 @@ diff -b -B --ignore-all-space --exclude-
+')
+
+optional_policy(`
-+ vbetool_run(unconfined_t, unconfined_r)
-+')
-+
-+optional_policy(`
+ vpn_run(unconfined_t, unconfined_r)
+')
+
@@ -9620,8 +9658,43 @@ diff -b -B --ignore-all-space --exclude-
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.if serefpolicy-3.6.28/policy/modules/services/bind.if
--- nsaserefpolicy/policy/modules/services/bind.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/bind.if 2009-08-18 13:23:29.000000000 -0400
-@@ -287,6 +287,25 @@
++++ serefpolicy-3.6.28/policy/modules/services/bind.if 2009-08-20 08:12:55.000000000 -0400
+@@ -235,7 +235,7 @@
+
+ ########################################
+ ## <summary>
+-## Do not audit attempts to set the attributes
++## Allow domain to set the attributes
+ ## of the BIND pid directory.
+ ## </summary>
+ ## <param name="domain">
+@@ -254,6 +254,25 @@
+
+ ########################################
+ ## <summary>
++## Allow domain to set attributes
++## of the BIND zone directory.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`bind_setattr_zone_dirs',`
++ gen_require(`
++ type named_zone_t;
++ ')
++
++ allow $1 named_zone_t:dir setattr;
++')
++
++########################################
++## <summary>
+ ## Read BIND zone files.
+ ## </summary>
+ ## <param name="domain">
+@@ -287,6 +306,25 @@
########################################
## <summary>
@@ -11024,7 +11097,7 @@ diff -b -B --ignore-all-space --exclude-
allow $1 devicekit_t:process { ptrace signal_perms getattr };
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.6.28/policy/modules/services/devicekit.te
--- nsaserefpolicy/policy/modules/services/devicekit.te 2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/devicekit.te 2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/devicekit.te 2009-08-20 09:17:41.000000000 -0400
@@ -36,12 +36,15 @@
manage_dirs_pattern(devicekit_t, devicekit_var_run_t, devicekit_var_run_t)
manage_files_pattern(devicekit_t, devicekit_var_run_t, devicekit_var_run_t)
@@ -11144,7 +11217,7 @@ diff -b -B --ignore-all-space --exclude-
dev_rw_generic_usb_dev(devicekit_power_t)
dev_rw_netcontrol(devicekit_power_t)
dev_rw_sysfs(devicekit_power_t)
-@@ -167,12 +195,16 @@
+@@ -167,12 +195,17 @@
files_read_etc_files(devicekit_power_t)
files_read_usr_files(devicekit_power_t)
@@ -11156,12 +11229,13 @@ diff -b -B --ignore-all-space --exclude-
miscfiles_read_localization(devicekit_power_t)
++sysnet_read_config(devicekit_power_t)
+sysnet_read_dhcp_config(devicekit_power_t)
+
userdom_read_all_users_state(devicekit_power_t)
optional_policy(`
-@@ -180,8 +212,11 @@
+@@ -180,8 +213,11 @@
')
optional_policy(`
@@ -11174,7 +11248,7 @@ diff -b -B --ignore-all-space --exclude-
allow devicekit_power_t devicekit_t:dbus send_msg;
optional_policy(`
-@@ -203,17 +238,23 @@
+@@ -203,17 +239,23 @@
optional_policy(`
hal_domtrans_mac(devicekit_power_t)
@@ -11587,8 +11661,8 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd.te serefpolicy-3.6.28/policy/modules/services/gpsd.te
--- nsaserefpolicy/policy/modules/services/gpsd.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/gpsd.te 2009-08-18 13:23:29.000000000 -0400
-@@ -11,9 +11,15 @@
++++ serefpolicy-3.6.28/policy/modules/services/gpsd.te 2009-08-20 08:28:36.000000000 -0400
+@@ -11,15 +11,21 @@
application_domain(gpsd_t, gpsd_exec_t)
init_daemon_domain(gpsd_t, gpsd_exec_t)
@@ -11604,6 +11678,13 @@ diff -b -B --ignore-all-space --exclude-
########################################
#
# gpsd local policy
+ #
+
+-allow gpsd_t self:capability { setuid sys_nice setgid fowner };
++allow gpsd_t self:capability { fsetid setuid sys_nice setgid fowner };
+ allow gpsd_t self:process setsched;
+ allow gpsd_t self:shm create_shm_perms;
+ allow gpsd_t self:unix_dgram_socket { create_socket_perms sendto };
@@ -29,6 +35,10 @@
manage_files_pattern(gpsd_t, gpsd_tmpfs_t, gpsd_tmpfs_t)
fs_tmpfs_filetrans(gpsd_t, gpsd_tmpfs_t, { dir file })
@@ -13459,9 +13540,45 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.fc serefpolicy-3.6.28/policy/modules/services/nx.fc
+--- nsaserefpolicy/policy/modules/services/nx.fc 2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/nx.fc 2009-08-20 08:55:05.000000000 -0400
+@@ -1,6 +1,7 @@
+ /opt/NX/bin/nxserver -- gen_context(system_u:object_r:nx_server_exec_t,s0)
+
+ /opt/NX/home/nx/\.ssh(/.*)? gen_context(system_u:object_r:nx_server_home_ssh_t,s0)
++/var/lib/nxserver/home/.ssh(/.*)? gen_context(system_u:object_r:nx_server_home_ssh_t,s0)
+
+ /opt/NX/var(/.*)? gen_context(system_u:object_r:nx_server_var_run_t,s0)
+
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.if serefpolicy-3.6.28/policy/modules/services/nx.if
+--- nsaserefpolicy/policy/modules/services/nx.if 2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/nx.if 2009-08-20 09:23:37.000000000 -0400
+@@ -17,3 +17,21 @@
+
+ spec_domtrans_pattern($1, nx_server_exec_t, nx_server_t)
+ ')
++
++########################################
++## <summary>
++## Read nx home directory content
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`nx_read_home_files',`
++ gen_require(`
++ type nx_server_home_ssh_t;
++ ')
++
++ read_files_pattern($1, nx_server_home_ssh_t, nx_server_home_ssh_t)
++')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.te serefpolicy-3.6.28/policy/modules/services/nx.te
--- nsaserefpolicy/policy/modules/services/nx.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/nx.te 2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/nx.te 2009-08-20 12:45:07.000000000 -0400
@@ -25,6 +25,9 @@
type nx_server_var_run_t;
files_pid_file(nx_server_var_run_t)
@@ -14608,7 +14725,7 @@ diff -b -B --ignore-all-space --exclude-
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.if serefpolicy-3.6.28/policy/modules/services/ppp.if
--- nsaserefpolicy/policy/modules/services/ppp.if 2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/ppp.if 2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/ppp.if 2009-08-20 08:37:53.000000000 -0400
@@ -177,10 +177,16 @@
interface(`ppp_run',`
gen_require(`
@@ -14628,7 +14745,7 @@ diff -b -B --ignore-all-space --exclude-
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.6.28/policy/modules/services/ppp.te
--- nsaserefpolicy/policy/modules/services/ppp.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/ppp.te 2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/ppp.te 2009-08-20 08:34:18.000000000 -0400
@@ -193,6 +193,8 @@
optional_policy(`
@@ -17076,7 +17193,7 @@ diff -b -B --ignore-all-space --exclude-
+/root/\.ssh(/.*)? gen_context(system_u:object_r:home_ssh_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.6.28/policy/modules/services/ssh.if
--- nsaserefpolicy/policy/modules/services/ssh.if 2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/ssh.if 2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/ssh.if 2009-08-20 12:45:06.000000000 -0400
@@ -36,6 +36,7 @@
gen_require(`
attribute ssh_server;
@@ -17379,7 +17496,7 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.6.28/policy/modules/services/ssh.te
--- nsaserefpolicy/policy/modules/services/ssh.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/ssh.te 2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/ssh.te 2009-08-20 09:24:08.000000000 -0400
@@ -41,6 +41,9 @@
files_tmp_file(sshd_tmp_t)
files_poly_parent(sshd_tmp_t)
@@ -17520,7 +17637,18 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -341,7 +355,11 @@
+@@ -331,6 +345,10 @@
+ ')
+
+ optional_policy(`
++ nx_read_home_files(sshd_t)
++')
++
++optional_policy(`
+ rpm_use_script_fds(sshd_t)
+ ')
+
+@@ -341,7 +359,11 @@
')
optional_policy(`
@@ -17533,7 +17661,7 @@ diff -b -B --ignore-all-space --exclude-
unconfined_shell_domtrans(sshd_t)
')
-@@ -400,15 +418,13 @@
+@@ -400,15 +422,13 @@
init_use_fds(ssh_keygen_t)
init_use_script_ptys(ssh_keygen_t)
@@ -19034,7 +19162,7 @@ diff -b -B --ignore-all-space --exclude-
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.28/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/xserver.te 2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/xserver.te 2009-08-20 07:54:04.000000000 -0400
@@ -34,6 +34,13 @@
## <desc>
@@ -20287,7 +20415,7 @@ diff -b -B --ignore-all-space --exclude-
/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.6.28/policy/modules/system/fstools.te
--- nsaserefpolicy/policy/modules/system/fstools.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/fstools.te 2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/fstools.te 2009-08-20 08:58:51.000000000 -0400
@@ -65,13 +65,7 @@
kernel_rw_unlabeled_dirs(fsadm_t)
kernel_rw_unlabeled_blk_files(fsadm_t)
@@ -20377,7 +20505,11 @@ diff -b -B --ignore-all-space --exclude-
init_use_fds(fsadm_t)
init_use_script_ptys(fsadm_t)
init_dontaudit_getattr_initctl(fsadm_t)
-@@ -147,8 +154,7 @@
+@@ -144,11 +151,11 @@
+ miscfiles_read_localization(fsadm_t)
+
+ modutils_read_module_config(fsadm_t)
++modutils_read_module_deps(fsadm_t)
seutil_read_config(fsadm_t)
@@ -20387,7 +20519,7 @@ diff -b -B --ignore-all-space --exclude-
ifdef(`distro_redhat',`
optional_policy(`
-@@ -177,4 +183,6 @@
+@@ -177,4 +184,6 @@
optional_policy(`
xen_append_log(fsadm_t)
@@ -20508,7 +20640,7 @@ diff -b -B --ignore-all-space --exclude-
#
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.6.28/policy/modules/system/init.if
--- nsaserefpolicy/policy/modules/system/init.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/init.if 2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/init.if 2009-08-20 08:05:39.000000000 -0400
@@ -174,6 +174,7 @@
role system_r types $1;
@@ -20748,7 +20880,7 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.6.28/policy/modules/system/init.te
--- nsaserefpolicy/policy/modules/system/init.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/init.te 2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/init.te 2009-08-20 09:41:30.000000000 -0400
@@ -17,6 +17,20 @@
## </desc>
gen_tunable(init_upstart, false)
@@ -20873,22 +21005,25 @@ diff -b -B --ignore-all-space --exclude-
files_tmp_filetrans(initrc_t, initrc_tmp_t, { file dir })
init_write_initctl(initrc_t)
-@@ -249,10 +287,12 @@
+@@ -249,10 +287,15 @@
kernel_rw_all_sysctls(initrc_t)
# for lsof which is used by alsa shutdown:
kernel_dontaudit_getattr_message_if(initrc_t)
+kernel_stream_connect(initrc_t)
+files_read_kernel_modules(initrc_t)
+files_read_config_files(initrc_t)
++files_read_var_lib_symlinks(initrc_t)
++files_setattr_pid_dirs(initrc_t)
files_read_kernel_symbol_table(initrc_t)
-
-corecmd_exec_all_executables(initrc_t)
+files_exec_etc_files(initrc_t)
++files_manage_etc_symlinks(initrc_t)
corenet_all_recvfrom_unlabeled(initrc_t)
corenet_all_recvfrom_netlabel(initrc_t)
-@@ -272,16 +312,62 @@
+@@ -272,16 +315,62 @@
dev_rw_sysfs(initrc_t)
dev_list_usbfs(initrc_t)
dev_read_framebuffer(initrc_t)
@@ -20952,7 +21087,7 @@ diff -b -B --ignore-all-space --exclude-
domain_kill_all_domains(initrc_t)
domain_signal_all_domains(initrc_t)
-@@ -291,7 +377,7 @@
+@@ -291,7 +380,7 @@
domain_sigchld_all_domains(initrc_t)
domain_read_all_domains_state(initrc_t)
domain_getattr_all_domains(initrc_t)
@@ -20961,7 +21096,7 @@ diff -b -B --ignore-all-space --exclude-
domain_getsession_all_domains(initrc_t)
domain_use_interactive_fds(initrc_t)
# for lsof which is used by alsa shutdown:
-@@ -306,14 +392,15 @@
+@@ -306,14 +395,15 @@
files_getattr_all_pipes(initrc_t)
files_getattr_all_sockets(initrc_t)
files_purge_tmp(initrc_t)
@@ -20979,7 +21114,7 @@ diff -b -B --ignore-all-space --exclude-
files_exec_etc_files(initrc_t)
files_read_usr_files(initrc_t)
files_manage_urandom_seed(initrc_t)
-@@ -325,47 +412,13 @@
+@@ -325,47 +415,13 @@
files_list_default(initrc_t)
files_mounton_default(initrc_t)
@@ -21029,7 +21164,7 @@ diff -b -B --ignore-all-space --exclude-
logging_send_syslog_msg(initrc_t)
logging_manage_generic_logs(initrc_t)
logging_read_all_logs(initrc_t)
-@@ -422,8 +475,6 @@
+@@ -422,8 +478,6 @@
# init scripts touch this
clock_dontaudit_write_adjtime(initrc_t)
@@ -21038,7 +21173,7 @@ diff -b -B --ignore-all-space --exclude-
# for integrated run_init to read run_init_type.
# happens during boot (/sbin/rc execs init scripts)
seutil_read_default_contexts(initrc_t)
-@@ -450,11 +501,9 @@
+@@ -450,11 +504,9 @@
# Red Hat systems seem to have a stray
# fd open from the initrd
@@ -21051,7 +21186,7 @@ diff -b -B --ignore-all-space --exclude-
# These seem to be from the initrd
# during device initialization:
dev_create_generic_dirs(initrc_t)
-@@ -464,6 +513,7 @@
+@@ -464,6 +516,7 @@
storage_raw_read_fixed_disk(initrc_t)
storage_raw_write_fixed_disk(initrc_t)
@@ -21059,7 +21194,13 @@ diff -b -B --ignore-all-space --exclude-
files_create_boot_flag(initrc_t)
files_rw_boot_symlinks(initrc_t)
# wants to read /.fonts directory
-@@ -497,6 +547,7 @@
+@@ -492,11 +545,13 @@
+ optional_policy(`
+ bind_manage_config_dirs(initrc_t)
+ bind_write_config(initrc_t)
++ bind_setattr_zone_dirs(initrc_t)
+ ')
+
optional_policy(`
#for /etc/rc.d/init.d/nfs to create /etc/exports
rpc_write_exports(initrc_t)
@@ -21067,7 +21208,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -515,6 +566,33 @@
+@@ -515,6 +570,33 @@
')
')
@@ -21101,7 +21242,7 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t)
-@@ -569,6 +647,10 @@
+@@ -569,8 +651,16 @@
dbus_read_config(initrc_t)
optional_policy(`
@@ -21111,8 +21252,14 @@ diff -b -B --ignore-all-space --exclude-
+ optional_policy(`
networkmanager_dbus_chat(initrc_t)
')
++
++ optional_policy(`
++ policykit_dbus_chat(initrc_t)
++ ')
')
-@@ -590,6 +672,10 @@
+
+ optional_policy(`
+@@ -590,6 +680,10 @@
')
optional_policy(`
@@ -21123,7 +21270,7 @@ diff -b -B --ignore-all-space --exclude-
dev_read_usbfs(initrc_t)
# init scripts run /etc/hotplug/usb.rc
-@@ -646,20 +732,20 @@
+@@ -646,20 +740,20 @@
')
optional_policy(`
@@ -21150,7 +21297,7 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
ifdef(`distro_redhat',`
-@@ -668,6 +754,7 @@
+@@ -668,6 +762,7 @@
mysql_stream_connect(initrc_t)
mysql_write_log(initrc_t)
@@ -21158,7 +21305,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -696,7 +783,6 @@
+@@ -696,7 +791,6 @@
')
optional_policy(`
@@ -21166,7 +21313,7 @@ diff -b -B --ignore-all-space --exclude-
fs_write_ramfs_sockets(initrc_t)
fs_search_ramfs(initrc_t)
-@@ -718,8 +804,6 @@
+@@ -718,8 +812,6 @@
# bash tries ioctl for some reason
files_dontaudit_ioctl_all_pids(initrc_t)
@@ -21175,7 +21322,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -732,10 +816,12 @@
+@@ -732,10 +824,12 @@
squid_manage_logs(initrc_t)
')
@@ -21188,7 +21335,7 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
ssh_dontaudit_read_server_keys(initrc_t)
-@@ -754,6 +840,15 @@
+@@ -754,6 +848,15 @@
')
optional_policy(`
@@ -21204,7 +21351,7 @@ diff -b -B --ignore-all-space --exclude-
unconfined_domain(initrc_t)
ifdef(`distro_redhat',`
-@@ -764,6 +859,13 @@
+@@ -764,6 +867,13 @@
optional_policy(`
mono_domtrans(initrc_t)
')
@@ -21218,7 +21365,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -789,3 +891,31 @@
+@@ -789,3 +899,31 @@
optional_policy(`
zebra_read_config(initrc_t)
')
@@ -21293,7 +21440,7 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.6.28/policy/modules/system/ipsec.te
--- nsaserefpolicy/policy/modules/system/ipsec.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/ipsec.te 2009-08-19 20:01:37.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/ipsec.te 2009-08-20 12:45:08.000000000 -0400
@@ -6,6 +6,13 @@
# Declarations
#
@@ -21525,12 +21672,13 @@ diff -b -B --ignore-all-space --exclude-
locallogin_use_fds(racoon_t)
logging_send_syslog_msg(racoon_t)
-@@ -328,6 +362,13 @@
+@@ -328,6 +362,14 @@
miscfiles_read_localization(racoon_t)
+auth_use_pam(racoon_t)
+
++
+auth_can_read_shadow_passwords(racoon_t)
+tunable_policy(`racoon_read_shadow',`
+ auth_tunable_read_shadow(racoon_t)
@@ -21539,7 +21687,7 @@ diff -b -B --ignore-all-space --exclude-
########################################
#
# Setkey local policy
-@@ -347,6 +388,7 @@
+@@ -347,6 +389,7 @@
files_read_etc_files(setkey_t)
init_dontaudit_use_fds(setkey_t)
@@ -24037,7 +24185,7 @@ diff -b -B --ignore-all-space --exclude-
+/etc/firestarter/firestarter\.sh gen_context(system_u:object_r:dhcpc_helper_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.6.28/policy/modules/system/sysnetwork.if
--- nsaserefpolicy/policy/modules/system/sysnetwork.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/sysnetwork.if 2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/sysnetwork.if 2009-08-20 12:45:07.000000000 -0400
@@ -43,6 +43,39 @@
sysnet_domtrans_dhcpc($1)
@@ -25362,7 +25510,7 @@ diff -b -B --ignore-all-space --exclude-
+/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.28/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-18 13:23:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-20 09:09:55.000000000 -0400
@@ -30,8 +30,9 @@
')
@@ -25727,7 +25875,7 @@ diff -b -B --ignore-all-space --exclude-
')
#######################################
-@@ -420,34 +424,41 @@
+@@ -420,34 +424,43 @@
## is the prefix for user_t).
## </summary>
## </param>
@@ -25761,6 +25909,8 @@ diff -b -B --ignore-all-space --exclude-
- dev_rw_usbfs($1_t)
+ dev_rw_usbfs($1)
+ dev_rw_generic_usb_dev($1)
++ dev_read_video_dev($1)
++ dev_write_video_dev($1)
- xserver_user_client($1_t, user_tmpfs_t)
- xserver_xsession_entry_type($1_t)
@@ -25787,7 +25937,7 @@ diff -b -B --ignore-all-space --exclude-
')
#######################################
-@@ -497,11 +508,7 @@
+@@ -497,11 +510,7 @@
attribute unpriv_userdomain;
')
@@ -25800,7 +25950,7 @@ diff -b -B --ignore-all-space --exclude-
##############################
#
-@@ -511,182 +518,195 @@
+@@ -511,182 +520,195 @@
# evolution and gnome-session try to create a netlink socket
dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
@@ -26072,7 +26222,7 @@ diff -b -B --ignore-all-space --exclude-
')
#######################################
-@@ -714,13 +734,26 @@
+@@ -714,13 +736,26 @@
userdom_base_user_template($1)
@@ -26104,7 +26254,7 @@ diff -b -B --ignore-all-space --exclude-
userdom_change_password_template($1)
-@@ -738,70 +771,71 @@
+@@ -738,70 +773,71 @@
allow $1_t self:context contains;
@@ -26209,7 +26359,7 @@ diff -b -B --ignore-all-space --exclude-
')
')
-@@ -838,6 +872,28 @@
+@@ -838,6 +874,28 @@
# Local policy
#
@@ -26238,7 +26388,7 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
loadkeys_run($1_t,$1_r)
')
-@@ -868,7 +924,10 @@
+@@ -868,7 +926,10 @@
userdom_restricted_user_template($1)
@@ -26250,7 +26400,7 @@ diff -b -B --ignore-all-space --exclude-
##############################
#
-@@ -876,14 +935,19 @@
+@@ -876,14 +937,19 @@
#
auth_role($1_r, $1_t)
@@ -26275,7 +26425,7 @@ diff -b -B --ignore-all-space --exclude-
logging_dontaudit_send_audit_msgs($1_t)
# Need to to this just so screensaver will work. Should be moved to screensaver domain
-@@ -891,28 +955,47 @@
+@@ -891,28 +957,47 @@
selinux_get_enforce_mode($1_t)
optional_policy(`
@@ -26330,7 +26480,7 @@ diff -b -B --ignore-all-space --exclude-
')
')
-@@ -946,8 +1029,8 @@
+@@ -946,8 +1031,8 @@
# Declarations
#
@@ -26340,7 +26490,7 @@ diff -b -B --ignore-all-space --exclude-
userdom_common_user_template($1)
##############################
-@@ -956,11 +1039,12 @@
+@@ -956,11 +1041,12 @@
#
# port access is audited even if dac would not have allowed it, so dontaudit it here
@@ -26355,7 +26505,7 @@ diff -b -B --ignore-all-space --exclude-
# cjp: why?
files_read_kernel_symbol_table($1_t)
-@@ -978,36 +1062,53 @@
+@@ -978,36 +1064,53 @@
')
')
@@ -26423,7 +26573,7 @@ diff -b -B --ignore-all-space --exclude-
')
')
-@@ -1042,7 +1143,7 @@
+@@ -1042,7 +1145,7 @@
#
template(`userdom_admin_user_template',`
gen_require(`
@@ -26432,7 +26582,7 @@ diff -b -B --ignore-all-space --exclude-
')
##############################
-@@ -1051,8 +1152,7 @@
+@@ -1051,8 +1154,7 @@
#
# Inherit rules for ordinary users.
@@ -26442,7 +26592,7 @@ diff -b -B --ignore-all-space --exclude-
domain_obj_id_change_exemption($1_t)
role system_r types $1_t;
-@@ -1075,7 +1175,8 @@
+@@ -1075,7 +1177,8 @@
# Skip authentication when pam_rootok is specified.
allow $1_t self:passwd rootok;
@@ -26452,7 +26602,7 @@ diff -b -B --ignore-all-space --exclude-
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
-@@ -1091,6 +1192,7 @@
+@@ -1091,6 +1194,7 @@
kernel_sigstop_unlabeled($1_t)
kernel_signull_unlabeled($1_t)
kernel_sigchld_unlabeled($1_t)
@@ -26460,7 +26610,7 @@ diff -b -B --ignore-all-space --exclude-
corenet_tcp_bind_generic_port($1_t)
# allow setting up tunnels
-@@ -1098,8 +1200,6 @@
+@@ -1098,8 +1202,6 @@
dev_getattr_generic_blk_files($1_t)
dev_getattr_generic_chr_files($1_t)
@@ -26469,7 +26619,7 @@ diff -b -B --ignore-all-space --exclude-
# Allow MAKEDEV to work
dev_create_all_blk_files($1_t)
dev_create_all_chr_files($1_t)
-@@ -1154,20 +1254,6 @@
+@@ -1154,20 +1256,6 @@
# But presently necessary for installing the file_contexts file.
seutil_manage_bin_policy($1_t)
@@ -26490,7 +26640,7 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
postgresql_unconfined($1_t)
')
-@@ -1213,6 +1299,7 @@
+@@ -1213,6 +1301,7 @@
dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1)
@@ -26498,7 +26648,7 @@ diff -b -B --ignore-all-space --exclude-
# Necessary for managing /boot/efi
fs_manage_dos_files($1)
-@@ -1278,11 +1365,15 @@
+@@ -1278,11 +1367,15 @@
interface(`userdom_user_home_content',`
gen_require(`
type user_home_t;
@@ -26514,7 +26664,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -1374,12 +1465,13 @@
+@@ -1374,12 +1467,13 @@
')
allow $1 user_home_dir_t:dir search_dir_perms;
@@ -26529,7 +26679,7 @@ diff -b -B --ignore-all-space --exclude-
## </summary>
## <param name="domain">
## <summary>
-@@ -1412,6 +1504,14 @@
+@@ -1412,6 +1506,14 @@
allow $1 user_home_dir_t:dir list_dir_perms;
files_search_home($1)
@@ -26544,7 +26694,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -1427,9 +1527,11 @@
+@@ -1427,9 +1529,11 @@
interface(`userdom_dontaudit_list_user_home_dirs',`
gen_require(`
type user_home_dir_t;
@@ -26556,7 +26706,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -1486,6 +1588,25 @@
+@@ -1486,6 +1590,25 @@
allow $1 user_home_dir_t:dir relabelto;
')
@@ -26582,7 +26732,7 @@ diff -b -B --ignore-all-space --exclude-
########################################
## <summary>
## Create directories in the home dir root with
-@@ -1560,6 +1681,8 @@
+@@ -1560,6 +1683,8 @@
')
dontaudit $1 user_home_t:dir search_dir_perms;
@@ -26591,7 +26741,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -1653,6 +1776,7 @@
+@@ -1653,6 +1778,7 @@
type user_home_dir_t, user_home_t;
')
@@ -26599,7 +26749,7 @@ diff -b -B --ignore-all-space --exclude-
read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
files_search_home($1)
')
-@@ -1780,19 +1904,32 @@
+@@ -1780,19 +1906,32 @@
#
interface(`userdom_exec_user_home_content_files',`
gen_require(`
@@ -26639,7 +26789,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -1827,6 +1964,7 @@
+@@ -1827,6 +1966,7 @@
interface(`userdom_manage_user_home_content_files',`
gen_require(`
type user_home_dir_t, user_home_t;
@@ -26647,7 +26797,7 @@ diff -b -B --ignore-all-space --exclude-
')
manage_files_pattern($1, user_home_t, user_home_t)
-@@ -2374,7 +2512,7 @@
+@@ -2374,7 +2514,7 @@
########################################
## <summary>
@@ -26656,7 +26806,7 @@ diff -b -B --ignore-all-space --exclude-
## </summary>
## <param name="domain">
## <summary>
-@@ -2728,11 +2866,32 @@
+@@ -2728,11 +2868,32 @@
#
interface(`userdom_search_user_home_content',`
gen_require(`
@@ -26691,7 +26841,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -2860,7 +3019,25 @@
+@@ -2860,7 +3021,25 @@
type user_tmp_t;
')
@@ -26718,7 +26868,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -2897,6 +3074,7 @@
+@@ -2897,6 +3076,7 @@
')
read_files_pattern($1, userdomain, userdomain)
@@ -26726,7 +26876,7 @@ diff -b -B --ignore-all-space --exclude-
kernel_search_proc($1)
')
-@@ -3027,3 +3205,501 @@
+@@ -3027,3 +3207,501 @@
allow $1 userdomain:dbus send_msg;
')
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.899
retrieving revision 1.900
diff -u -p -r1.899 -r1.900
--- selinux-policy.spec 20 Aug 2009 00:02:37 -0000 1.899
+++ selinux-policy.spec 20 Aug 2009 17:48:51 -0000 1.900
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.6.28
-Release: 2%{?dist}
+Release: 3%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -475,6 +475,9 @@ exit 0
%endif
%changelog
+* Thu Aug 20 2009 Dan Walsh <dwalsh at redhat.com> 3.6.28-3
+- Fix system-config-services policy
+
* Wed Aug 19 2009 Dan Walsh <dwalsh at redhat.com> 3.6.28-2
- Allow libvirt to change user componant of virt_domain
- Previous message (by thread): rpms/gnome-keyring-sharp/devel .cvsignore, 1.3, 1.4 gnome-keyring-sharp.spec, 1.5, 1.6 sources, 1.3, 1.4
- Next message (by thread): rpms/shmpps/devel import.log, NONE, 1.1 shmpps.init, NONE, 1.1 shmpps.spec, NONE, 1.1 shmpps.sysconfig, NONE, 1.1 .cvsignore, 1.1, 1.2 sources, 1.1, 1.2
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the fedora-extras-commits
mailing list