rpms/selinux-policy/devel policy-F12.patch,1.60,1.61
Daniel J Walsh
dwalsh at fedoraproject.org
Mon Aug 24 13:09:09 UTC 2009
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv22081
Modified Files:
policy-F12.patch
Log Message:
* Sat Aug 22 2009 Dan Walsh <dwalsh at redhat.com> 3.6.28-6
- Add capability setting to dhcpc and gpm
policy-F12.patch:
Makefile | 22
Rules.modular | 8
config/appconfig-mcs/default_contexts | 19
config/appconfig-mcs/failsafe_context | 2
config/appconfig-mcs/root_default_contexts | 8
config/appconfig-mcs/securetty_types | 5
config/appconfig-mcs/seusers | 4
config/appconfig-mcs/staff_u_default_contexts | 4
config/appconfig-mcs/unconfined_u_default_contexts | 4
config/appconfig-mcs/user_u_default_contexts | 5
config/appconfig-mcs/userhelper_context | 2
config/appconfig-mcs/virtual_domain_context | 1
config/appconfig-mcs/virtual_image_context | 2
config/appconfig-mls/default_contexts | 19
config/appconfig-mls/root_default_contexts | 12
config/appconfig-mls/virtual_domain_context | 1
config/appconfig-mls/virtual_image_context | 2
config/appconfig-standard/securetty_types | 5
man/man8/rsync_selinux.8 | 18
man/man8/samba_selinux.8 | 4
policy/flask/access_vectors | 2
policy/global_tunables | 24
policy/mcs | 10
policy/modules/admin/anaconda.te | 3
policy/modules/admin/certwatch.te | 1
policy/modules/admin/dmesg.fc | 2
policy/modules/admin/dmesg.te | 7
policy/modules/admin/kismet.if | 1
policy/modules/admin/kismet.te | 17
policy/modules/admin/logrotate.te | 13
policy/modules/admin/logwatch.te | 1
policy/modules/admin/mrtg.te | 7
policy/modules/admin/portage.te | 2
policy/modules/admin/prelink.if | 19
policy/modules/admin/readahead.te | 3
policy/modules/admin/rpm.fc | 16
policy/modules/admin/rpm.if | 176 ++
policy/modules/admin/rpm.te | 65
policy/modules/admin/smoltclient.fc | 4
policy/modules/admin/smoltclient.if | 1
policy/modules/admin/smoltclient.te | 66 +
policy/modules/admin/sudo.if | 41
policy/modules/admin/tmpreaper.te | 4
policy/modules/admin/usermanage.te | 25
policy/modules/admin/vbetool.te | 14
policy/modules/apps/awstats.te | 4
policy/modules/apps/calamaris.te | 4
policy/modules/apps/cpufreqselector.te | 4
policy/modules/apps/gitosis.fc | 4
policy/modules/apps/gitosis.if | 96 +
policy/modules/apps/gitosis.te | 36
policy/modules/apps/gnome.fc | 12
policy/modules/apps/gnome.if | 170 ++
policy/modules/apps/gnome.te | 92 +
policy/modules/apps/gpg.if | 2
policy/modules/apps/gpg.te | 16
policy/modules/apps/java.fc | 17
policy/modules/apps/java.if | 111 +
policy/modules/apps/java.te | 12
policy/modules/apps/kdumpgui.fc | 2
policy/modules/apps/kdumpgui.if | 2
policy/modules/apps/kdumpgui.te | 64
policy/modules/apps/livecd.fc | 2
policy/modules/apps/livecd.if | 50
policy/modules/apps/livecd.te | 26
policy/modules/apps/mono.if | 101 +
policy/modules/apps/mono.te | 9
policy/modules/apps/mozilla.fc | 1
policy/modules/apps/mozilla.if | 13
policy/modules/apps/mozilla.te | 21
policy/modules/apps/nsplugin.fc | 12
policy/modules/apps/nsplugin.if | 313 ++++
policy/modules/apps/nsplugin.te | 288 ++++
policy/modules/apps/openoffice.fc | 3
policy/modules/apps/openoffice.if | 93 +
policy/modules/apps/openoffice.te | 14
policy/modules/apps/ptchown.fc | 2
policy/modules/apps/ptchown.if | 22
policy/modules/apps/ptchown.te | 39
policy/modules/apps/pulseaudio.te | 16
policy/modules/apps/qemu.fc | 4
policy/modules/apps/qemu.if | 270 ++--
policy/modules/apps/qemu.te | 82 +
policy/modules/apps/sambagui.fc | 1
policy/modules/apps/sambagui.if | 2
policy/modules/apps/sambagui.te | 55
policy/modules/apps/sandbox.fc | 1
policy/modules/apps/sandbox.if | 143 ++
policy/modules/apps/sandbox.te | 274 ++++
policy/modules/apps/screen.if | 24
policy/modules/apps/vmware.fc | 1
policy/modules/apps/vmware.te | 1
policy/modules/apps/webalizer.te | 1
policy/modules/apps/wine.fc | 23
policy/modules/apps/wine.if | 60
policy/modules/apps/wine.te | 23
policy/modules/kernel/corecommands.fc | 23
policy/modules/kernel/corecommands.if | 1
policy/modules/kernel/corenetwork.te.in | 29
policy/modules/kernel/devices.fc | 5
policy/modules/kernel/devices.if | 164 ++
policy/modules/kernel/devices.te | 19
policy/modules/kernel/domain.if | 132 +-
policy/modules/kernel/domain.te | 87 +
policy/modules/kernel/files.fc | 3
policy/modules/kernel/files.if | 298 ++++
policy/modules/kernel/files.te | 6
policy/modules/kernel/filesystem.fc | 2
policy/modules/kernel/filesystem.if | 173 ++
policy/modules/kernel/filesystem.te | 8
policy/modules/kernel/kernel.if | 39
policy/modules/kernel/kernel.te | 29
policy/modules/kernel/selinux.if | 25
policy/modules/kernel/terminal.fc | 1
policy/modules/kernel/terminal.if | 40
policy/modules/kernel/terminal.te | 1
policy/modules/roles/guest.te | 8
policy/modules/roles/staff.te | 124 -
policy/modules/roles/sysadm.te | 124 -
policy/modules/roles/unconfineduser.fc | 37
policy/modules/roles/unconfineduser.if | 638 +++++++++
policy/modules/roles/unconfineduser.te | 391 +++++
policy/modules/roles/unprivuser.te | 131 --
policy/modules/roles/xguest.te | 18
policy/modules/services/abrt.fc | 13
policy/modules/services/abrt.if | 126 +
policy/modules/services/abrt.te | 124 +
policy/modules/services/amavis.te | 2
policy/modules/services/apache.fc | 35
policy/modules/services/apache.if | 327 +++--
policy/modules/services/apache.te | 409 +++++-
policy/modules/services/apm.te | 2
policy/modules/services/automount.te | 1
policy/modules/services/bind.if | 40
policy/modules/services/bluetooth.te | 8
policy/modules/services/certmaster.te | 2
policy/modules/services/clamav.te | 12
policy/modules/services/consolekit.if | 39
policy/modules/services/consolekit.te | 18
policy/modules/services/courier.if | 18
policy/modules/services/courier.te | 1
policy/modules/services/cron.fc | 13
policy/modules/services/cron.if | 202 ++-
policy/modules/services/cron.te | 149 +-
policy/modules/services/cups.fc | 13
policy/modules/services/cups.te | 28
policy/modules/services/cvs.te | 1
policy/modules/services/dbus.fc | 5
policy/modules/services/dbus.if | 49
policy/modules/services/dbus.te | 25
policy/modules/services/dcc.te | 8
policy/modules/services/ddclient.if | 25
policy/modules/services/devicekit.fc | 2
policy/modules/services/devicekit.if | 22
policy/modules/services/devicekit.te | 50
policy/modules/services/dnsmasq.te | 8
policy/modules/services/dovecot.te | 7
policy/modules/services/exim.te | 4
policy/modules/services/fetchmail.te | 2
policy/modules/services/fprintd.te | 4
policy/modules/services/ftp.te | 58
policy/modules/services/gnomeclock.fc | 3
policy/modules/services/gnomeclock.if | 69 +
policy/modules/services/gnomeclock.te | 50
policy/modules/services/gpm.te | 3
policy/modules/services/gpsd.fc | 5
policy/modules/services/gpsd.if | 27
policy/modules/services/gpsd.te | 14
policy/modules/services/hal.fc | 1
policy/modules/services/hal.if | 18
policy/modules/services/hal.te | 46
policy/modules/services/hddtemp.fc | 4
policy/modules/services/hddtemp.if | 38
policy/modules/services/hddtemp.te | 40
policy/modules/services/kerberos.te | 13
policy/modules/services/kerneloops.te | 2
policy/modules/services/ktalk.te | 1
policy/modules/services/lircd.te | 11
policy/modules/services/mailman.te | 4
policy/modules/services/memcached.te | 2
policy/modules/services/modemmanager.fc | 2
policy/modules/services/modemmanager.if | 43
policy/modules/services/modemmanager.te | 46
policy/modules/services/mta.fc | 2
policy/modules/services/mta.if | 5
policy/modules/services/mta.te | 52
policy/modules/services/munin.fc | 3
policy/modules/services/munin.te | 3
policy/modules/services/mysql.te | 7
policy/modules/services/nagios.fc | 11
policy/modules/services/nagios.if | 70 -
policy/modules/services/nagios.te | 55
policy/modules/services/networkmanager.fc | 13
policy/modules/services/networkmanager.if | 45
policy/modules/services/networkmanager.te | 114 +
policy/modules/services/nis.fc | 5
policy/modules/services/nis.if | 87 +
policy/modules/services/nis.te | 13
policy/modules/services/nscd.if | 18
policy/modules/services/nscd.te | 11
policy/modules/services/nslcd.fc | 4
policy/modules/services/nslcd.if | 142 ++
policy/modules/services/nslcd.te | 48
policy/modules/services/ntp.if | 46
policy/modules/services/ntp.te | 7
policy/modules/services/nx.fc | 1
policy/modules/services/nx.if | 18
policy/modules/services/nx.te | 6
policy/modules/services/oddjob.if | 1
policy/modules/services/openvpn.te | 13
policy/modules/services/pcscd.te | 3
policy/modules/services/pegasus.te | 28
policy/modules/services/policykit.fc | 10
policy/modules/services/policykit.if | 49
policy/modules/services/policykit.te | 60
policy/modules/services/postfix.fc | 2
policy/modules/services/postfix.if | 150 ++
policy/modules/services/postfix.te | 136 +-
policy/modules/services/postgresql.fc | 1
policy/modules/services/postgresql.if | 43
policy/modules/services/postgresql.te | 7
policy/modules/services/ppp.if | 6
policy/modules/services/ppp.te | 10
policy/modules/services/privoxy.te | 3
policy/modules/services/procmail.te | 12
policy/modules/services/pyzor.fc | 4
policy/modules/services/pyzor.if | 47
policy/modules/services/pyzor.te | 37
policy/modules/services/razor.fc | 1
policy/modules/services/razor.if | 42
policy/modules/services/razor.te | 32
policy/modules/services/ricci.te | 5
policy/modules/services/rpc.if | 6
policy/modules/services/rpc.te | 10
policy/modules/services/rpcbind.if | 20
policy/modules/services/rsync.te | 23
policy/modules/services/rtkit_daemon.fc | 2
policy/modules/services/rtkit_daemon.if | 63
policy/modules/services/rtkit_daemon.te | 38
policy/modules/services/samba.fc | 4
policy/modules/services/samba.if | 104 +
policy/modules/services/samba.te | 82 +
policy/modules/services/sasl.te | 15
policy/modules/services/sendmail.if | 137 ++
policy/modules/services/sendmail.te | 87 +
policy/modules/services/setroubleshoot.fc | 2
policy/modules/services/setroubleshoot.if | 84 +
policy/modules/services/setroubleshoot.te | 60
policy/modules/services/shorewall.fc | 12
policy/modules/services/shorewall.if | 166 ++
policy/modules/services/shorewall.te | 95 +
policy/modules/services/smartmon.te | 12
policy/modules/services/spamassassin.fc | 14
policy/modules/services/spamassassin.if | 68 +
policy/modules/services/spamassassin.te | 129 +
policy/modules/services/squid.te | 9
policy/modules/services/ssh.fc | 2
policy/modules/services/ssh.if | 183 ++
policy/modules/services/ssh.te | 70 -
policy/modules/services/sssd.fc | 2
policy/modules/services/sssd.if | 43
policy/modules/services/sysstat.te | 2
policy/modules/services/uucp.te | 7
policy/modules/services/virt.fc | 11
policy/modules/services/virt.if | 131 +-
policy/modules/services/virt.te | 271 +++-
policy/modules/services/w3c.te | 7
policy/modules/services/xserver.fc | 29
policy/modules/services/xserver.if | 538 +++++++-
policy/modules/services/xserver.te | 306 +++-
policy/modules/system/application.if | 20
policy/modules/system/application.te | 11
policy/modules/system/authlogin.fc | 9
policy/modules/system/authlogin.if | 204 ++-
policy/modules/system/authlogin.te | 39
policy/modules/system/clock.te | 8
policy/modules/system/fstools.fc | 2
policy/modules/system/fstools.te | 67 -
policy/modules/system/getty.te | 16
policy/modules/system/hostname.te | 22
policy/modules/system/init.fc | 6
policy/modules/system/init.if | 156 ++
policy/modules/system/init.te | 268 +++-
policy/modules/system/ipsec.fc | 2
policy/modules/system/ipsec.if | 25
policy/modules/system/ipsec.te | 97 +
policy/modules/system/iptables.fc | 11
policy/modules/system/iptables.te | 5
policy/modules/system/iscsi.if | 40
policy/modules/system/iscsi.te | 6
policy/modules/system/kdump.fc | 8
policy/modules/system/kdump.if | 111 +
policy/modules/system/kdump.te | 38
policy/modules/system/libraries.fc | 153 +-
policy/modules/system/libraries.if | 4
policy/modules/system/libraries.te | 16
policy/modules/system/locallogin.te | 74 -
policy/modules/system/logging.fc | 11
policy/modules/system/logging.if | 4
policy/modules/system/logging.te | 34
policy/modules/system/lvm.te | 53
policy/modules/system/miscfiles.if | 19
policy/modules/system/modutils.te | 167 +-
policy/modules/system/mount.fc | 7
policy/modules/system/mount.te | 124 +
policy/modules/system/pcmcia.te | 19
policy/modules/system/raid.te | 24
policy/modules/system/selinuxutil.fc | 17
policy/modules/system/selinuxutil.if | 288 ++++
policy/modules/system/selinuxutil.te | 228 +--
policy/modules/system/setrans.if | 20
policy/modules/system/sysnetwork.fc | 9
policy/modules/system/sysnetwork.if | 117 +
policy/modules/system/sysnetwork.te | 107 +
policy/modules/system/udev.fc | 3
policy/modules/system/udev.if | 21
policy/modules/system/udev.te | 38
policy/modules/system/unconfined.fc | 15
policy/modules/system/unconfined.if | 446 ------
policy/modules/system/unconfined.te | 224 ---
policy/modules/system/userdomain.fc | 6
policy/modules/system/userdomain.if | 1370 ++++++++++++++++-----
policy/modules/system/userdomain.te | 50
policy/modules/system/xen.fc | 6
policy/modules/system/xen.if | 28
policy/modules/system/xen.te | 137 +-
policy/support/obj_perm_sets.spt | 14
policy/users | 13
support/Makefile.devel | 3
support/divert.m4 | 1
support/undivert.m4 | 1
331 files changed, 14553 insertions(+), 2980 deletions(-)
Index: policy-F12.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-F12.patch,v
retrieving revision 1.60
retrieving revision 1.61
diff -u -p -r1.60 -r1.61
--- policy-F12.patch 23 Aug 2009 17:39:51 -0000 1.60
+++ policy-F12.patch 24 Aug 2009 13:09:08 -0000 1.61
@@ -4933,7 +4933,7 @@ diff -b -B --ignore-all-space --exclude-
/dev/usb/mdc800.* -c gen_context(system_u:object_r:scanner_device_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.6.28/policy/modules/kernel/devices.if
--- nsaserefpolicy/policy/modules/kernel/devices.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/kernel/devices.if 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/devices.if 2009-08-24 08:40:29.000000000 -0400
@@ -1655,6 +1655,78 @@
########################################
@@ -5954,7 +5954,7 @@ diff -b -B --ignore-all-space --exclude-
+/dev/shm -d gen_context(system_u:object_r:tmpfs_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.6.28/policy/modules/kernel/filesystem.if
--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/kernel/filesystem.if 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/filesystem.if 2009-08-24 08:48:26.000000000 -0400
@@ -1537,6 +1537,24 @@
########################################
@@ -5980,10 +5980,28 @@ diff -b -B --ignore-all-space --exclude-
## Search inotifyfs filesystem.
## </summary>
## <param name="domain">
-@@ -2542,6 +2560,24 @@
+@@ -2542,6 +2560,42 @@
########################################
## <summary>
++## List NFS server directories.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`fs_list_nfsd_fs',`
++ gen_require(`
++ type nfsd_fs_t;
++ ')
++
++ allow $1 nfsd_fs_t:dir list_dir_perms;
++')
++
++########################################
++## <summary>
+## Getattr files on an nfsd filesystem
+## </summary>
+## <param name="domain">
@@ -6005,7 +6023,7 @@ diff -b -B --ignore-all-space --exclude-
## Read and write NFS server files.
## </summary>
## <param name="domain">
-@@ -3971,3 +4007,122 @@
+@@ -3971,3 +4025,122 @@
relabelfrom_blk_files_pattern($1, noxattrfs, noxattrfs)
relabelfrom_chr_files_pattern($1, noxattrfs, noxattrfs)
')
@@ -11930,11 +11948,13 @@ diff -b -B --ignore-all-space --exclude-
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpm.te serefpolicy-3.6.28/policy/modules/services/gpm.te
--- nsaserefpolicy/policy/modules/services/gpm.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/gpm.te 2009-08-22 09:46:40.000000000 -0400
-@@ -28,6 +28,7 @@
++++ serefpolicy-3.6.28/policy/modules/services/gpm.te 2009-08-24 08:51:22.000000000 -0400
+@@ -27,7 +27,8 @@
+ # Local policy
#
- allow gpm_t self:capability { setuid dac_override sys_admin sys_tty_config };
+-allow gpm_t self:capability { setuid dac_override sys_admin sys_tty_config };
++allow gpm_t self:capability { setpcap setuid dac_override sys_admin sys_tty_config };
+allow gpm_t self:process { getcap setcap };
allow gpm_t self:unix_stream_socket create_stream_socket_perms;
@@ -14116,7 +14136,7 @@ diff -b -B --ignore-all-space --exclude-
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.if serefpolicy-3.6.28/policy/modules/services/policykit.if
--- nsaserefpolicy/policy/modules/services/policykit.if 2009-08-18 18:39:50.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/policykit.if 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/policykit.if 2009-08-24 08:45:46.000000000 -0400
@@ -17,6 +17,8 @@
class dbus send_msg;
')
@@ -14134,7 +14154,17 @@ diff -b -B --ignore-all-space --exclude-
## allow the specified role the policy_auth domain,
## </summary>
## <param name="domain">
-@@ -206,4 +207,47 @@
+@@ -62,6 +63,9 @@
+
+ policykit_domtrans_auth($1)
+ role $2 types policykit_auth_t;
++
++ allow $1 policykit_auth_t:process signal;
++ ps_process_pattern(policykit_auth_t, $1)
+ ')
+
+ ########################################
+@@ -206,4 +209,47 @@
files_search_var_lib($1)
read_files_pattern($1, policykit_var_lib_t, policykit_var_lib_t)
@@ -14184,7 +14214,7 @@ diff -b -B --ignore-all-space --exclude-
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.6.28/policy/modules/services/policykit.te
--- nsaserefpolicy/policy/modules/services/policykit.te 2009-08-18 11:41:14.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/policykit.te 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/policykit.te 2009-08-24 08:38:20.000000000 -0400
@@ -36,11 +36,12 @@
# policykit local policy
#
@@ -14201,7 +14231,7 @@ diff -b -B --ignore-all-space --exclude-
policykit_domtrans_auth(policykit_t)
-@@ -62,13 +63,25 @@
+@@ -62,27 +63,46 @@
files_read_etc_files(policykit_t)
files_read_usr_files(policykit_t)
@@ -14223,16 +14253,21 @@ diff -b -B --ignore-all-space --exclude-
+ optional_policy(`
+ consolekit_dbus_chat(policykit_t)
+ ')
++
++ optional_policy(`
++ rpm_dbus_chat(policykit_t)
++ ')
+')
########################################
#
-@@ -76,13 +89,16 @@
+ # polkit_auth local policy
#
- allow policykit_auth_t self:capability setgid;
+-allow policykit_auth_t self:capability setgid;
-allow policykit_auth_t self:process getattr;
-allow policykit_auth_t self:fifo_file rw_file_perms;
++allow policykit_auth_t self:capability { setgid setuid };
+allow policykit_auth_t self:process { getattr getsched };
+allow policykit_auth_t self:fifo_file rw_fifo_file_perms;
+
@@ -14247,7 +14282,7 @@ diff -b -B --ignore-all-space --exclude-
rw_files_pattern(policykit_auth_t, policykit_reload_t, policykit_reload_t)
-@@ -92,12 +108,13 @@
+@@ -92,12 +112,13 @@
manage_files_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t)
files_pid_filetrans(policykit_auth_t, policykit_var_run_t, { file dir })
@@ -14263,7 +14298,7 @@ diff -b -B --ignore-all-space --exclude-
logging_send_syslog_msg(policykit_auth_t)
-@@ -106,7 +123,7 @@
+@@ -106,7 +127,7 @@
userdom_dontaudit_read_user_home_content_files(policykit_auth_t)
optional_policy(`
@@ -14272,7 +14307,7 @@ diff -b -B --ignore-all-space --exclude-
dbus_session_bus_client(policykit_auth_t)
optional_policy(`
-@@ -119,6 +136,14 @@
+@@ -119,6 +140,14 @@
hal_read_state(policykit_auth_t)
')
@@ -14287,7 +14322,7 @@ diff -b -B --ignore-all-space --exclude-
########################################
#
# polkit_grant local policy
-@@ -126,7 +151,8 @@
+@@ -126,7 +155,8 @@
allow policykit_grant_t self:capability setuid;
allow policykit_grant_t self:process getattr;
@@ -14297,7 +14332,7 @@ diff -b -B --ignore-all-space --exclude-
allow policykit_grant_t self:unix_dgram_socket create_socket_perms;
allow policykit_grant_t self:unix_stream_socket create_stream_socket_perms;
-@@ -156,9 +182,12 @@
+@@ -156,9 +186,12 @@
userdom_read_all_users_state(policykit_grant_t)
optional_policy(`
@@ -14311,7 +14346,7 @@ diff -b -B --ignore-all-space --exclude-
consolekit_dbus_chat(policykit_grant_t)
')
')
-@@ -170,7 +199,8 @@
+@@ -170,7 +203,8 @@
allow policykit_resolve_t self:capability { setuid sys_nice sys_ptrace };
allow policykit_resolve_t self:process getattr;
@@ -22967,7 +23002,7 @@ diff -b -B --ignore-all-space --exclude-
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.6.28/policy/modules/system/logging.te
--- nsaserefpolicy/policy/modules/system/logging.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/logging.te 2009-08-23 09:54:54.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/logging.te 2009-08-24 08:36:53.000000000 -0400
@@ -123,10 +123,10 @@
allow auditd_t self:capability { chown fsetid sys_nice sys_resource };
@@ -22997,7 +23032,7 @@ diff -b -B --ignore-all-space --exclude-
-allow audisp_t self:capability sys_nice;
-allow audisp_t self:process setsched;
-allow audisp_t self:fifo_file rw_file_perms;
-+allow audisp_t self:capability { dac_override sys_nice };
++allow audisp_t self:capability { dac_override setpcap sys_nice };
+allow audisp_t self:process { getcap signal_perms setcap setsched };
+allow audisp_t self:fifo_file rw_fifo_file_perms;
allow audisp_t self:unix_stream_socket create_stream_socket_perms;
@@ -24801,7 +24836,7 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.6.28/policy/modules/system/sysnetwork.te
--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/sysnetwork.te 2009-08-22 09:47:05.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/sysnetwork.te 2009-08-24 08:37:08.000000000 -0400
@@ -20,6 +20,9 @@
init_daemon_domain(dhcpc_t, dhcpc_exec_t)
role system_r types dhcpc_t;
@@ -24818,7 +24853,7 @@ diff -b -B --ignore-all-space --exclude-
#
-allow dhcpc_t self:capability { dac_override fsetid net_admin net_raw net_bind_service sys_resource sys_tty_config };
-dontaudit dhcpc_t self:capability sys_tty_config;
-+allow dhcpc_t self:capability { dac_override fsetid net_admin net_raw net_bind_service sys_nice sys_resource sys_tty_config };
++allow dhcpc_t self:capability { dac_override fsetid net_admin net_raw net_bind_service setpcap sys_nice sys_resource sys_tty_config };
+dontaudit dhcpc_t self:capability { sys_tty_config sys_ptrace };
# for access("/etc/bashrc", X_OK) on Red Hat
dontaudit dhcpc_t self:capability { dac_read_search sys_module };
@@ -25063,7 +25098,7 @@ diff -b -B --ignore-all-space --exclude-
/sbin/udev -- gen_context(system_u:object_r:udev_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.if serefpolicy-3.6.28/policy/modules/system/udev.if
--- nsaserefpolicy/policy/modules/system/udev.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/udev.if 2009-08-23 12:54:42.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/udev.if 2009-08-24 08:41:52.000000000 -0400
@@ -168,4 +168,25 @@
dev_list_all_dev_nodes($1)
@@ -25977,7 +26012,7 @@ diff -b -B --ignore-all-space --exclude-
+HOME_DIR/\.gvfs(/.*)? <<none>>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.28/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-23 13:00:14.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-24 08:49:32.000000000 -0400
@@ -30,8 +30,9 @@
')
@@ -26342,7 +26377,7 @@ diff -b -B --ignore-all-space --exclude-
')
#######################################
-@@ -420,34 +424,43 @@
+@@ -420,34 +424,48 @@
## is the prefix for user_t).
## </summary>
## </param>
@@ -26378,13 +26413,18 @@ diff -b -B --ignore-all-space --exclude-
+ dev_rw_generic_usb_dev($1)
+ dev_read_video_dev($1)
+ dev_write_video_dev($1)
++ dev_rw_wireless($1)
++
++ miscfiles_dontaudit_write_fonts($1)
++
++ optional_policy(`
++ udev_read_db($1)
++ ')
- xserver_user_client($1_t, user_tmpfs_t)
- xserver_xsession_entry_type($1_t)
- xserver_dontaudit_write_log($1_t)
- xserver_stream_connect_xdm($1_t)
-+ miscfiles_dontaudit_write_fonts($1)
-+
+ optional_policy(`
+ xserver_user_client($1, user_tmpfs_t)
+ xserver_xsession_entry_type($1)
@@ -26404,7 +26444,7 @@ diff -b -B --ignore-all-space --exclude-
')
#######################################
-@@ -497,11 +510,7 @@
+@@ -497,11 +515,7 @@
attribute unpriv_userdomain;
')
@@ -26417,7 +26457,7 @@ diff -b -B --ignore-all-space --exclude-
##############################
#
-@@ -511,182 +520,195 @@
+@@ -511,182 +525,195 @@
# evolution and gnome-session try to create a netlink socket
dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
@@ -26438,26 +26478,26 @@ diff -b -B --ignore-all-space --exclude-
+ kernel_get_sysvipc_info($1_usertype)
# Find CDROM devices:
- kernel_read_device_sysctls($1_t)
+-
+- corecmd_exec_bin($1_t)
+ kernel_read_device_sysctls($1_usertype)
-- corecmd_exec_bin($1_t)
+- corenet_udp_bind_generic_node($1_t)
+- corenet_udp_bind_generic_port($1_t)
+ corenet_udp_bind_generic_node($1_usertype)
+ corenet_udp_bind_generic_port($1_usertype)
-- corenet_udp_bind_generic_node($1_t)
-- corenet_udp_bind_generic_port($1_t)
+- dev_read_rand($1_t)
+- dev_write_sound($1_t)
+- dev_read_sound($1_t)
+- dev_read_sound_mixer($1_t)
+- dev_write_sound_mixer($1_t)
+ dev_read_rand($1_usertype)
+ dev_write_sound($1_usertype)
+ dev_read_sound($1_usertype)
+ dev_read_sound_mixer($1_usertype)
+ dev_write_sound_mixer($1_usertype)
-- dev_read_rand($1_t)
-- dev_write_sound($1_t)
-- dev_read_sound($1_t)
-- dev_read_sound_mixer($1_t)
-- dev_write_sound_mixer($1_t)
--
- files_exec_etc_files($1_t)
- files_search_locks($1_t)
+ files_exec_etc_files($1_usertype)
@@ -26650,16 +26690,16 @@ diff -b -B --ignore-all-space --exclude-
- postgresql_stream_connect($1_t)
- postgresql_tcp_connect($1_t)
+ postgresql_stream_connect($1_usertype)
++ ')
')
++
++ optional_policy(`
++ # to allow monitoring of pcmcia status
++ pcmcia_read_pid($1_usertype)
')
optional_policy(`
- resmgr_stream_connect($1_t)
-+ # to allow monitoring of pcmcia status
-+ pcmcia_read_pid($1_usertype)
-+ ')
-+
-+ optional_policy(`
+ pcscd_read_pub_files($1_usertype)
+ pcscd_stream_connect($1_usertype)
')
@@ -26689,18 +26729,20 @@ diff -b -B --ignore-all-space --exclude-
')
#######################################
-@@ -714,13 +736,26 @@
+@@ -714,13 +741,26 @@
userdom_base_user_template($1)
- userdom_manage_home_role($1_r, $1_t)
+ userdom_manage_home_role($1_r, $1_usertype)
-+
-+ userdom_manage_tmp_role($1_r, $1_usertype)
-+ userdom_manage_tmpfs_role($1_r, $1_usertype)
- userdom_manage_tmp_role($1_r, $1_t)
- userdom_manage_tmpfs_role($1_r, $1_t)
++ userdom_manage_tmp_role($1_r, $1_usertype)
++ userdom_manage_tmpfs_role($1_r, $1_usertype)
+
+- userdom_exec_user_tmp_files($1_t)
+- userdom_exec_user_home_content_files($1_t)
+ ifelse(`$1',`unconfined',`',`
+ gen_tunable(allow_$1_exec_content, true)
+
@@ -26711,9 +26753,7 @@ diff -b -B --ignore-all-space --exclude-
+ tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
+ fs_exec_nfs_files($1_usertype)
+ ')
-
-- userdom_exec_user_tmp_files($1_t)
-- userdom_exec_user_home_content_files($1_t)
++
+ tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
+ fs_exec_cifs_files($1_usertype)
+ ')
@@ -26721,7 +26761,7 @@ diff -b -B --ignore-all-space --exclude-
userdom_change_password_template($1)
-@@ -738,70 +773,71 @@
+@@ -738,70 +778,71 @@
allow $1_t self:context contains;
@@ -26826,7 +26866,7 @@ diff -b -B --ignore-all-space --exclude-
')
')
-@@ -838,6 +874,28 @@
+@@ -838,6 +879,28 @@
# Local policy
#
@@ -26855,7 +26895,7 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
loadkeys_run($1_t,$1_r)
')
-@@ -868,7 +926,10 @@
+@@ -868,7 +931,10 @@
userdom_restricted_user_template($1)
@@ -26867,18 +26907,18 @@ diff -b -B --ignore-all-space --exclude-
##############################
#
-@@ -876,14 +937,19 @@
+@@ -876,14 +942,19 @@
#
auth_role($1_r, $1_t)
- auth_search_pam_console_data($1_t)
+ auth_search_pam_console_data($1_usertype)
-+
-+ xserver_role($1_r, $1_t)
-+ xserver_communicate($1_usertype, $1_usertype)
- dev_read_sound($1_t)
- dev_write_sound($1_t)
++ xserver_role($1_r, $1_t)
++ xserver_communicate($1_usertype, $1_usertype)
++
+ dev_read_sound($1_usertype)
+ dev_write_sound($1_usertype)
# gnome keyring wants to read this.
@@ -26892,7 +26932,7 @@ diff -b -B --ignore-all-space --exclude-
logging_dontaudit_send_audit_msgs($1_t)
# Need to to this just so screensaver will work. Should be moved to screensaver domain
-@@ -891,28 +957,47 @@
+@@ -891,28 +962,47 @@
selinux_get_enforce_mode($1_t)
optional_policy(`
@@ -26908,15 +26948,15 @@ diff -b -B --ignore-all-space --exclude-
+ devicekit_dbus_chat($1_usertype)
+ devicekit_dbus_chat_disk($1_usertype)
+ devicekit_dbus_chat_power($1_usertype)
-+ ')
-+
-+ optional_policy(`
-+ fprintd_dbus_chat($1_t)
')
optional_policy(`
- dbus_role_template($1, $1_r, $1_t)
- dbus_system_bus_client($1_t)
++ fprintd_dbus_chat($1_t)
++ ')
++
++ optional_policy(`
+ gnomeclock_dbus_chat($1_t)
+ ')
@@ -26947,7 +26987,7 @@ diff -b -B --ignore-all-space --exclude-
')
')
-@@ -946,8 +1031,8 @@
+@@ -946,8 +1036,8 @@
# Declarations
#
@@ -26957,7 +26997,7 @@ diff -b -B --ignore-all-space --exclude-
userdom_common_user_template($1)
##############################
-@@ -956,11 +1041,12 @@
+@@ -956,11 +1046,12 @@
#
# port access is audited even if dac would not have allowed it, so dontaudit it here
@@ -26972,7 +27012,7 @@ diff -b -B --ignore-all-space --exclude-
# cjp: why?
files_read_kernel_symbol_table($1_t)
-@@ -978,36 +1064,53 @@
+@@ -978,36 +1069,53 @@
')
')
@@ -27040,7 +27080,7 @@ diff -b -B --ignore-all-space --exclude-
')
')
-@@ -1042,7 +1145,7 @@
+@@ -1042,7 +1150,7 @@
#
template(`userdom_admin_user_template',`
gen_require(`
@@ -27049,7 +27089,7 @@ diff -b -B --ignore-all-space --exclude-
')
##############################
-@@ -1051,8 +1154,7 @@
+@@ -1051,8 +1159,7 @@
#
# Inherit rules for ordinary users.
@@ -27059,7 +27099,7 @@ diff -b -B --ignore-all-space --exclude-
domain_obj_id_change_exemption($1_t)
role system_r types $1_t;
-@@ -1075,7 +1177,8 @@
+@@ -1075,7 +1182,8 @@
# Skip authentication when pam_rootok is specified.
allow $1_t self:passwd rootok;
@@ -27069,7 +27109,7 @@ diff -b -B --ignore-all-space --exclude-
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
-@@ -1091,6 +1194,7 @@
+@@ -1091,6 +1199,7 @@
kernel_sigstop_unlabeled($1_t)
kernel_signull_unlabeled($1_t)
kernel_sigchld_unlabeled($1_t)
@@ -27077,7 +27117,7 @@ diff -b -B --ignore-all-space --exclude-
corenet_tcp_bind_generic_port($1_t)
# allow setting up tunnels
-@@ -1098,8 +1202,6 @@
+@@ -1098,8 +1207,6 @@
dev_getattr_generic_blk_files($1_t)
dev_getattr_generic_chr_files($1_t)
@@ -27086,7 +27126,15 @@ diff -b -B --ignore-all-space --exclude-
# Allow MAKEDEV to work
dev_create_all_blk_files($1_t)
dev_create_all_chr_files($1_t)
-@@ -1154,20 +1256,6 @@
+@@ -1126,6 +1233,7 @@
+ files_exec_usr_src_files($1_t)
+
+ fs_getattr_all_fs($1_t)
++ fs_list_all($1_t)
+ fs_set_all_quotas($1_t)
+ fs_exec_noxattr($1_t)
+
+@@ -1154,20 +1262,6 @@
# But presently necessary for installing the file_contexts file.
seutil_manage_bin_policy($1_t)
@@ -27107,7 +27155,7 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
postgresql_unconfined($1_t)
')
-@@ -1213,6 +1301,7 @@
+@@ -1213,6 +1307,7 @@
dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1)
@@ -27115,7 +27163,7 @@ diff -b -B --ignore-all-space --exclude-
# Necessary for managing /boot/efi
fs_manage_dos_files($1)
-@@ -1278,11 +1367,15 @@
+@@ -1278,11 +1373,15 @@
interface(`userdom_user_home_content',`
gen_require(`
type user_home_t;
@@ -27131,7 +27179,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -1374,12 +1467,13 @@
+@@ -1374,12 +1473,13 @@
')
allow $1 user_home_dir_t:dir search_dir_perms;
@@ -27146,7 +27194,7 @@ diff -b -B --ignore-all-space --exclude-
## </summary>
## <param name="domain">
## <summary>
-@@ -1412,6 +1506,14 @@
+@@ -1412,6 +1512,14 @@
allow $1 user_home_dir_t:dir list_dir_perms;
files_search_home($1)
@@ -27161,7 +27209,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -1427,9 +1529,11 @@
+@@ -1427,9 +1535,11 @@
interface(`userdom_dontaudit_list_user_home_dirs',`
gen_require(`
type user_home_dir_t;
@@ -27173,7 +27221,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -1486,6 +1590,25 @@
+@@ -1486,6 +1596,25 @@
allow $1 user_home_dir_t:dir relabelto;
')
@@ -27199,7 +27247,7 @@ diff -b -B --ignore-all-space --exclude-
########################################
## <summary>
## Create directories in the home dir root with
-@@ -1560,6 +1683,8 @@
+@@ -1560,6 +1689,8 @@
')
dontaudit $1 user_home_t:dir search_dir_perms;
@@ -27208,7 +27256,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -1653,6 +1778,7 @@
+@@ -1653,6 +1784,7 @@
type user_home_dir_t, user_home_t;
')
@@ -27216,7 +27264,7 @@ diff -b -B --ignore-all-space --exclude-
read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
files_search_home($1)
')
-@@ -1780,19 +1906,32 @@
+@@ -1780,19 +1912,32 @@
#
interface(`userdom_exec_user_home_content_files',`
gen_require(`
@@ -27256,7 +27304,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -1827,6 +1966,7 @@
+@@ -1827,6 +1972,7 @@
interface(`userdom_manage_user_home_content_files',`
gen_require(`
type user_home_dir_t, user_home_t;
@@ -27264,7 +27312,7 @@ diff -b -B --ignore-all-space --exclude-
')
manage_files_pattern($1, user_home_t, user_home_t)
-@@ -2374,7 +2514,7 @@
+@@ -2374,7 +2520,7 @@
########################################
## <summary>
@@ -27273,7 +27321,7 @@ diff -b -B --ignore-all-space --exclude-
## </summary>
## <param name="domain">
## <summary>
-@@ -2728,11 +2868,32 @@
+@@ -2728,11 +2874,32 @@
#
interface(`userdom_search_user_home_content',`
gen_require(`
@@ -27308,7 +27356,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -2860,7 +3021,25 @@
+@@ -2860,7 +3027,25 @@
type user_tmp_t;
')
@@ -27335,7 +27383,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -2897,6 +3076,7 @@
+@@ -2897,6 +3082,7 @@
')
read_files_pattern($1, userdomain, userdomain)
@@ -27343,7 +27391,7 @@ diff -b -B --ignore-all-space --exclude-
kernel_search_proc($1)
')
-@@ -3027,3 +3207,559 @@
+@@ -3027,3 +3213,559 @@
allow $1 userdomain:dbus send_msg;
')
More information about the fedora-extras-commits
mailing list