rpms/selinux-policy/devel policy-F12.patch, 1.61, 1.62 selinux-policy.spec, 1.903, 1.904
Daniel J Walsh
dwalsh at fedoraproject.org
Wed Aug 26 12:12:39 UTC 2009
- Previous message (by thread): rpms/glibc/devel .cvsignore, 1.282, 1.283 glibc-fedora.patch, 1.316, 1.317 glibc.spec, 1.409, 1.410 import.log, 1.25, 1.26 sources, 1.307, 1.308
- Next message (by thread): rpms/kvirc/F-11 .cvsignore, 1.2, 1.3 kvirc.spec, 1.1, 1.2 sources, 1.2, 1.3 kvirc-flags.patch, 1.1, NONE
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv23398
Modified Files:
policy-F12.patch selinux-policy.spec
Log Message:
* Tue Aug 25 2009 Dan Walsh <dwalsh at redhat.com> 3.6.28-7
- Fixes for cdrecord, mdadm, and others
policy-F12.patch:
Makefile | 22
Rules.modular | 8
config/appconfig-mcs/default_contexts | 19
config/appconfig-mcs/failsafe_context | 2
config/appconfig-mcs/root_default_contexts | 8
config/appconfig-mcs/securetty_types | 5
config/appconfig-mcs/seusers | 4
config/appconfig-mcs/staff_u_default_contexts | 4
config/appconfig-mcs/unconfined_u_default_contexts | 4
config/appconfig-mcs/user_u_default_contexts | 5
config/appconfig-mcs/userhelper_context | 2
config/appconfig-mcs/virtual_domain_context | 1
config/appconfig-mcs/virtual_image_context | 2
config/appconfig-mls/default_contexts | 19
config/appconfig-mls/root_default_contexts | 12
config/appconfig-mls/virtual_domain_context | 1
config/appconfig-mls/virtual_image_context | 2
config/appconfig-standard/securetty_types | 5
man/man8/rsync_selinux.8 | 18
man/man8/samba_selinux.8 | 4
policy/flask/access_vectors | 2
policy/global_tunables | 24
policy/mcs | 10
policy/modules/admin/anaconda.te | 3
policy/modules/admin/certwatch.te | 1
policy/modules/admin/dmesg.fc | 2
policy/modules/admin/dmesg.te | 7
policy/modules/admin/kismet.if | 1
policy/modules/admin/kismet.te | 17
policy/modules/admin/logrotate.te | 13
policy/modules/admin/logwatch.te | 1
policy/modules/admin/mrtg.te | 7
policy/modules/admin/portage.te | 2
policy/modules/admin/prelink.if | 19
policy/modules/admin/readahead.te | 3
policy/modules/admin/rpm.fc | 16
policy/modules/admin/rpm.if | 176 ++
policy/modules/admin/rpm.te | 65
policy/modules/admin/smoltclient.fc | 4
policy/modules/admin/smoltclient.if | 1
policy/modules/admin/smoltclient.te | 66 +
policy/modules/admin/sudo.if | 41
policy/modules/admin/tmpreaper.te | 4
policy/modules/admin/usermanage.if | 5
policy/modules/admin/usermanage.te | 30
policy/modules/admin/vbetool.te | 14
policy/modules/apps/awstats.te | 4
policy/modules/apps/calamaris.te | 4
policy/modules/apps/cdrecord.te | 4
policy/modules/apps/cpufreqselector.te | 4
policy/modules/apps/gitosis.fc | 4
policy/modules/apps/gitosis.if | 96 +
policy/modules/apps/gitosis.te | 36
policy/modules/apps/gnome.fc | 12
policy/modules/apps/gnome.if | 170 ++
policy/modules/apps/gnome.te | 92 +
policy/modules/apps/gpg.if | 2
policy/modules/apps/gpg.te | 16
policy/modules/apps/java.fc | 17
policy/modules/apps/java.if | 111 +
policy/modules/apps/java.te | 12
policy/modules/apps/kdumpgui.fc | 2
policy/modules/apps/kdumpgui.if | 2
policy/modules/apps/kdumpgui.te | 64
policy/modules/apps/livecd.fc | 2
policy/modules/apps/livecd.if | 50
policy/modules/apps/livecd.te | 26
policy/modules/apps/mono.if | 101 +
policy/modules/apps/mono.te | 9
policy/modules/apps/mozilla.fc | 1
policy/modules/apps/mozilla.if | 13
policy/modules/apps/mozilla.te | 21
policy/modules/apps/nsplugin.fc | 12
policy/modules/apps/nsplugin.if | 313 ++++
policy/modules/apps/nsplugin.te | 288 ++++
policy/modules/apps/openoffice.fc | 3
policy/modules/apps/openoffice.if | 93 +
policy/modules/apps/openoffice.te | 14
policy/modules/apps/ptchown.fc | 2
policy/modules/apps/ptchown.if | 22
policy/modules/apps/ptchown.te | 39
policy/modules/apps/pulseaudio.if | 1
policy/modules/apps/pulseaudio.te | 17
policy/modules/apps/qemu.fc | 4
policy/modules/apps/qemu.if | 270 ++--
policy/modules/apps/qemu.te | 82 +
policy/modules/apps/sambagui.fc | 1
policy/modules/apps/sambagui.if | 2
policy/modules/apps/sambagui.te | 55
policy/modules/apps/sandbox.fc | 1
policy/modules/apps/sandbox.if | 143 ++
policy/modules/apps/sandbox.te | 274 ++++
policy/modules/apps/screen.if | 24
policy/modules/apps/vmware.fc | 1
policy/modules/apps/vmware.te | 1
policy/modules/apps/webalizer.te | 1
policy/modules/apps/wine.fc | 23
policy/modules/apps/wine.if | 59
policy/modules/apps/wine.te | 23
policy/modules/kernel/corecommands.fc | 23
policy/modules/kernel/corecommands.if | 1
policy/modules/kernel/corenetwork.te.in | 29
policy/modules/kernel/devices.fc | 5
policy/modules/kernel/devices.if | 164 ++
policy/modules/kernel/devices.te | 19
policy/modules/kernel/domain.if | 132 +-
policy/modules/kernel/domain.te | 87 +
policy/modules/kernel/files.fc | 3
policy/modules/kernel/files.if | 298 ++++
policy/modules/kernel/files.te | 6
policy/modules/kernel/filesystem.fc | 2
policy/modules/kernel/filesystem.if | 173 ++
policy/modules/kernel/filesystem.te | 8
policy/modules/kernel/kernel.if | 39
policy/modules/kernel/kernel.te | 29
policy/modules/kernel/selinux.if | 25
policy/modules/kernel/storage.fc | 1
policy/modules/kernel/storage.if | 2
policy/modules/kernel/terminal.fc | 1
policy/modules/kernel/terminal.if | 40
policy/modules/kernel/terminal.te | 1
policy/modules/roles/guest.te | 8
policy/modules/roles/staff.te | 124 -
policy/modules/roles/sysadm.te | 124 -
policy/modules/roles/unconfineduser.fc | 37
policy/modules/roles/unconfineduser.if | 638 +++++++++
policy/modules/roles/unconfineduser.te | 392 ++++++
policy/modules/roles/unprivuser.te | 131 --
policy/modules/roles/xguest.te | 18
policy/modules/services/abrt.fc | 13
policy/modules/services/abrt.if | 126 +
policy/modules/services/abrt.te | 124 +
policy/modules/services/afs.fc | 1
policy/modules/services/afs.te | 1
policy/modules/services/amavis.te | 2
policy/modules/services/apache.fc | 35
policy/modules/services/apache.if | 327 +++--
policy/modules/services/apache.te | 409 +++++-
policy/modules/services/apm.te | 2
policy/modules/services/automount.te | 1
policy/modules/services/bind.if | 40
policy/modules/services/bluetooth.te | 8
policy/modules/services/certmaster.te | 2
policy/modules/services/clamav.te | 12
policy/modules/services/consolekit.if | 39
policy/modules/services/consolekit.te | 18
policy/modules/services/courier.if | 18
policy/modules/services/courier.te | 1
policy/modules/services/cron.fc | 13
policy/modules/services/cron.if | 202 ++-
policy/modules/services/cron.te | 149 +-
policy/modules/services/cups.fc | 13
policy/modules/services/cups.te | 28
policy/modules/services/cvs.te | 1
policy/modules/services/dbus.fc | 5
policy/modules/services/dbus.if | 49
policy/modules/services/dbus.te | 25
policy/modules/services/dcc.te | 8
policy/modules/services/ddclient.if | 25
policy/modules/services/devicekit.fc | 2
policy/modules/services/devicekit.if | 22
policy/modules/services/devicekit.te | 50
policy/modules/services/dnsmasq.te | 8
policy/modules/services/dovecot.te | 7
policy/modules/services/exim.te | 4
policy/modules/services/fetchmail.te | 2
policy/modules/services/fprintd.te | 4
policy/modules/services/ftp.te | 58
policy/modules/services/gnomeclock.fc | 3
policy/modules/services/gnomeclock.if | 69 +
policy/modules/services/gnomeclock.te | 50
policy/modules/services/gpm.te | 3
policy/modules/services/gpsd.fc | 5
policy/modules/services/gpsd.if | 27
policy/modules/services/gpsd.te | 14
policy/modules/services/hal.fc | 1
policy/modules/services/hal.if | 18
policy/modules/services/hal.te | 46
policy/modules/services/hddtemp.fc | 4
policy/modules/services/hddtemp.if | 38
policy/modules/services/hddtemp.te | 40
policy/modules/services/kerberos.te | 13
policy/modules/services/kerneloops.te | 2
policy/modules/services/ktalk.te | 1
policy/modules/services/lircd.te | 11
policy/modules/services/mailman.te | 4
policy/modules/services/memcached.te | 2
policy/modules/services/modemmanager.fc | 2
policy/modules/services/modemmanager.if | 43
policy/modules/services/modemmanager.te | 46
policy/modules/services/mta.fc | 2
policy/modules/services/mta.if | 5
policy/modules/services/mta.te | 52
policy/modules/services/munin.fc | 3
policy/modules/services/munin.te | 3
policy/modules/services/mysql.te | 7
policy/modules/services/nagios.fc | 11
policy/modules/services/nagios.if | 70 -
policy/modules/services/nagios.te | 55
policy/modules/services/networkmanager.fc | 13
policy/modules/services/networkmanager.if | 45
policy/modules/services/networkmanager.te | 114 +
policy/modules/services/nis.fc | 5
policy/modules/services/nis.if | 87 +
policy/modules/services/nis.te | 13
policy/modules/services/nscd.if | 18
policy/modules/services/nscd.te | 11
policy/modules/services/nslcd.fc | 4
policy/modules/services/nslcd.if | 142 ++
policy/modules/services/nslcd.te | 48
policy/modules/services/ntp.if | 46
policy/modules/services/ntp.te | 7
policy/modules/services/nx.fc | 1
policy/modules/services/nx.if | 18
policy/modules/services/nx.te | 6
policy/modules/services/oddjob.if | 1
policy/modules/services/openvpn.te | 13
policy/modules/services/pcscd.te | 3
policy/modules/services/pegasus.te | 28
policy/modules/services/policykit.fc | 10
policy/modules/services/policykit.if | 49
policy/modules/services/policykit.te | 60
policy/modules/services/postfix.fc | 2
policy/modules/services/postfix.if | 150 ++
policy/modules/services/postfix.te | 136 +-
policy/modules/services/postgresql.fc | 1
policy/modules/services/postgresql.if | 43
policy/modules/services/postgresql.te | 7
policy/modules/services/ppp.if | 6
policy/modules/services/ppp.te | 12
policy/modules/services/privoxy.te | 3
policy/modules/services/procmail.te | 12
policy/modules/services/pyzor.fc | 4
policy/modules/services/pyzor.if | 47
policy/modules/services/pyzor.te | 37
policy/modules/services/razor.fc | 1
policy/modules/services/razor.if | 42
policy/modules/services/razor.te | 32
policy/modules/services/ricci.te | 5
policy/modules/services/rpc.if | 6
policy/modules/services/rpc.te | 10
policy/modules/services/rpcbind.if | 20
policy/modules/services/rsync.te | 23
policy/modules/services/rtkit_daemon.fc | 2
policy/modules/services/rtkit_daemon.if | 63
policy/modules/services/rtkit_daemon.te | 38
policy/modules/services/samba.fc | 4
policy/modules/services/samba.if | 104 +
policy/modules/services/samba.te | 83 +
policy/modules/services/sasl.te | 15
policy/modules/services/sendmail.if | 137 ++
policy/modules/services/sendmail.te | 87 +
policy/modules/services/setroubleshoot.fc | 2
policy/modules/services/setroubleshoot.if | 84 +
policy/modules/services/setroubleshoot.te | 60
policy/modules/services/shorewall.fc | 12
policy/modules/services/shorewall.if | 166 ++
policy/modules/services/shorewall.te | 95 +
policy/modules/services/smartmon.te | 12
policy/modules/services/spamassassin.fc | 14
policy/modules/services/spamassassin.if | 68 +
policy/modules/services/spamassassin.te | 129 +
policy/modules/services/squid.te | 9
policy/modules/services/ssh.fc | 2
policy/modules/services/ssh.if | 183 ++
policy/modules/services/ssh.te | 70 -
policy/modules/services/sssd.fc | 2
policy/modules/services/sssd.if | 43
policy/modules/services/sysstat.te | 2
policy/modules/services/uucp.te | 7
policy/modules/services/virt.fc | 11
policy/modules/services/virt.if | 131 +-
policy/modules/services/virt.te | 271 +++-
policy/modules/services/w3c.te | 7
policy/modules/services/xserver.fc | 29
policy/modules/services/xserver.if | 538 +++++++-
policy/modules/services/xserver.te | 306 +++-
policy/modules/system/application.if | 20
policy/modules/system/application.te | 11
policy/modules/system/authlogin.fc | 9
policy/modules/system/authlogin.if | 204 ++-
policy/modules/system/authlogin.te | 39
policy/modules/system/clock.te | 8
policy/modules/system/fstools.fc | 2
policy/modules/system/fstools.te | 67 -
policy/modules/system/getty.te | 16
policy/modules/system/hostname.te | 22
policy/modules/system/init.fc | 6
policy/modules/system/init.if | 156 ++
policy/modules/system/init.te | 268 +++-
policy/modules/system/ipsec.fc | 2
policy/modules/system/ipsec.if | 25
policy/modules/system/ipsec.te | 97 +
policy/modules/system/iptables.fc | 11
policy/modules/system/iptables.te | 5
policy/modules/system/iscsi.if | 40
policy/modules/system/iscsi.te | 6
policy/modules/system/kdump.fc | 8
policy/modules/system/kdump.if | 111 +
policy/modules/system/kdump.te | 38
policy/modules/system/libraries.fc | 153 +-
policy/modules/system/libraries.if | 4
policy/modules/system/libraries.te | 16
policy/modules/system/locallogin.te | 74 -
policy/modules/system/logging.fc | 11
policy/modules/system/logging.if | 4
policy/modules/system/logging.te | 34
policy/modules/system/lvm.te | 53
policy/modules/system/miscfiles.if | 19
policy/modules/system/modutils.te | 167 +-
policy/modules/system/mount.fc | 7
policy/modules/system/mount.te | 124 +
policy/modules/system/pcmcia.te | 19
policy/modules/system/raid.te | 27
policy/modules/system/selinuxutil.fc | 17
policy/modules/system/selinuxutil.if | 288 ++++
policy/modules/system/selinuxutil.te | 228 +--
policy/modules/system/setrans.if | 20
policy/modules/system/sysnetwork.fc | 9
policy/modules/system/sysnetwork.if | 117 +
policy/modules/system/sysnetwork.te | 107 +
policy/modules/system/udev.fc | 3
policy/modules/system/udev.if | 21
policy/modules/system/udev.te | 38
policy/modules/system/unconfined.fc | 15
policy/modules/system/unconfined.if | 446 ------
policy/modules/system/unconfined.te | 224 ---
policy/modules/system/userdomain.fc | 6
policy/modules/system/userdomain.if | 1370 ++++++++++++++++-----
policy/modules/system/userdomain.te | 50
policy/modules/system/xen.fc | 6
policy/modules/system/xen.if | 28
policy/modules/system/xen.te | 137 +-
policy/support/obj_perm_sets.spt | 14
policy/users | 13
support/Makefile.devel | 3
support/divert.m4 | 1
support/undivert.m4 | 1
338 files changed, 14572 insertions(+), 2988 deletions(-)
Index: policy-F12.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-F12.patch,v
retrieving revision 1.61
retrieving revision 1.62
diff -u -p -r1.61 -r1.62
--- policy-F12.patch 24 Aug 2009 13:09:08 -0000 1.61
+++ policy-F12.patch 26 Aug 2009 12:12:38 -0000 1.62
@@ -1376,9 +1376,24 @@ diff -b -B --ignore-all-space --exclude-
kismet_manage_log(tmpreaper_t)
')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.6.28/policy/modules/admin/usermanage.if
+--- nsaserefpolicy/policy/modules/admin/usermanage.if 2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/admin/usermanage.if 2009-08-25 14:37:45.000000000 -0400
+@@ -274,6 +274,11 @@
+ usermanage_domtrans_useradd($1)
+ role $2 types useradd_t;
+
++ # Add/remove user home directories
++ userdom_manage_home_role($2, useradd_t)
++
++ seutil_run_semanage(useradd_t, $2)
++
+ optional_policy(`
+ nscd_run(useradd_t, $2)
+ ')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.6.28/policy/modules/admin/usermanage.te
--- nsaserefpolicy/policy/modules/admin/usermanage.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/admin/usermanage.te 2009-08-21 18:56:06.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/admin/usermanage.te 2009-08-25 09:31:26.000000000 -0400
@@ -209,6 +209,7 @@
files_manage_etc_files(groupadd_t)
files_relabel_etc_files(groupadd_t)
@@ -1439,7 +1454,19 @@ diff -b -B --ignore-all-space --exclude-
init_use_fds(useradd_t)
init_rw_utmp(useradd_t)
-@@ -521,6 +518,12 @@
+@@ -494,10 +491,7 @@
+
+ userdom_use_unpriv_users_fds(useradd_t)
+ # Add/remove user home directories
+-userdom_manage_user_home_content_dirs(useradd_t)
+-userdom_manage_user_home_content_files(useradd_t)
+-userdom_home_filetrans_user_home_dir(useradd_t)
+-userdom_user_home_dir_filetrans_user_home_content(useradd_t, notdevfile_class_set)
++userdom_manage_home_role(system_r, useradd_t)
+
+ mta_manage_spool(useradd_t)
+
+@@ -521,6 +515,12 @@
')
optional_policy(`
@@ -1519,6 +1546,32 @@ diff -b -B --ignore-all-space --exclude-
+optional_policy(`
+ nscd_socket_use(calamaris_t)
+')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cdrecord.te serefpolicy-3.6.28/policy/modules/apps/cdrecord.te
+--- nsaserefpolicy/policy/modules/apps/cdrecord.te 2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/apps/cdrecord.te 2009-08-25 15:56:57.000000000 -0400
+@@ -28,12 +28,13 @@
+ #
+
+ allow cdrecord_t self:capability { ipc_lock sys_nice setuid dac_override sys_rawio };
+-allow cdrecord_t self:process { getsched setsched sigkill };
++allow cdrecord_t self:process { getcap getsched setsched sigkill };
+ allow cdrecord_t self:unix_dgram_socket create_socket_perms;
+ allow cdrecord_t self:unix_stream_socket create_stream_socket_perms;
+
+ # allow searching for cdrom-drive
+ dev_list_all_dev_nodes(cdrecord_t)
++dev_read_sysfs(cdrecord_t)
+
+ domain_interactive_fd(cdrecord_t)
+ domain_use_interactive_fds(cdrecord_t)
+@@ -44,6 +45,7 @@
+ term_list_ptys(cdrecord_t)
+
+ # allow cdrecord to write the CD
++storage_raw_read_removable_device(cdrecord_t)
+ storage_raw_write_removable_device(cdrecord_t)
+ storage_write_scsi_generic(cdrecord_t)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cpufreqselector.te serefpolicy-3.6.28/policy/modules/apps/cpufreqselector.te
--- nsaserefpolicy/policy/modules/apps/cpufreqselector.te 2009-07-28 13:28:33.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/apps/cpufreqselector.te 2009-08-21 18:56:06.000000000 -0400
@@ -3538,20 +3591,32 @@ diff -b -B --ignore-all-space --exclude-
+term_use_ptmx(ptchown_t)
+
+miscfiles_read_localization(ptchown_t)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.if serefpolicy-3.6.28/policy/modules/apps/pulseaudio.if
+--- nsaserefpolicy/policy/modules/apps/pulseaudio.if 2009-07-23 14:11:04.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/apps/pulseaudio.if 2009-08-25 15:59:29.000000000 -0400
+@@ -141,5 +141,6 @@
+ ')
+
+ allow $1 pulseaudio_t:process signull;
++ allow pulseaudio_t $1:process signull;
+ allow $1 pulseaudio_t:unix_stream_socket connectto;
+ ')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te
--- nsaserefpolicy/policy/modules/apps/pulseaudio.te 2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te 2009-08-22 07:48:07.000000000 -0400
-@@ -22,6 +22,9 @@
++++ serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te 2009-08-26 08:11:55.000000000 -0400
+@@ -22,7 +22,11 @@
allow pulseaudio_t self:unix_dgram_socket { sendto create_socket_perms };
allow pulseaudio_t self:tcp_socket create_stream_socket_perms;
allow pulseaudio_t self:udp_socket create_socket_perms;
+allow pulseaudio_t self:netlink_kobject_uevent_socket create_socket_perms;
-+
-+can_exec(pulseaudio_t, pulseaudio_exec_t)
++can_exec(pulseaudio_t, pulseaudio_exec_t)
++
++kernel_read_system_state(pulseaudio_t)
kernel_read_kernel_sysctls(pulseaudio_t)
-@@ -47,6 +50,7 @@
+ corecmd_exec_bin(pulseaudio_t)
+@@ -47,6 +51,7 @@
fs_rw_anon_inodefs_files(pulseaudio_t)
fs_getattr_tmpfs(pulseaudio_t)
@@ -3559,7 +3624,7 @@ diff -b -B --ignore-all-space --exclude-
term_use_all_user_ttys(pulseaudio_t)
term_use_all_user_ptys(pulseaudio_t)
-@@ -78,6 +82,15 @@
+@@ -78,6 +83,15 @@
policykit_domtrans_auth(pulseaudio_t)
policykit_read_lib(pulseaudio_t)
policykit_read_reload(pulseaudio_t)
@@ -3575,7 +3640,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -85,8 +98,7 @@
+@@ -85,8 +99,7 @@
')
optional_policy(`
@@ -4620,8 +4685,8 @@ diff -b -B --ignore-all-space --exclude-
-/opt/picasa/wine/bin/wine -- gen_context(system_u:object_r:wine_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.6.28/policy/modules/apps/wine.if
--- nsaserefpolicy/policy/modules/apps/wine.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/apps/wine.if 2009-08-21 18:56:07.000000000 -0400
-@@ -43,3 +43,63 @@
++++ serefpolicy-3.6.28/policy/modules/apps/wine.if 2009-08-25 15:59:59.000000000 -0400
+@@ -43,3 +43,62 @@
wine_domtrans($1)
role $2 types wine_t;
')
@@ -4683,11 +4748,10 @@ diff -b -B --ignore-all-space --exclude-
+ relabel_dirs_pattern($2, wine_home_t, wine_home_t)
+ relabel_files_pattern($2, wine_home_t, wine_home_t)
+ relabel_lnk_files_pattern($2, wine_home_t, wine_home_t)
-+
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.6.28/policy/modules/apps/wine.te
--- nsaserefpolicy/policy/modules/apps/wine.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/apps/wine.te 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/apps/wine.te 2009-08-25 16:00:27.000000000 -0400
@@ -9,20 +9,35 @@
type wine_t;
type wine_exec_t;
@@ -4933,7 +4997,7 @@ diff -b -B --ignore-all-space --exclude-
/dev/usb/mdc800.* -c gen_context(system_u:object_r:scanner_device_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.6.28/policy/modules/kernel/devices.if
--- nsaserefpolicy/policy/modules/kernel/devices.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/kernel/devices.if 2009-08-24 08:40:29.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/devices.if 2009-08-25 15:58:11.000000000 -0400
@@ -1655,6 +1655,78 @@
########################################
@@ -5954,7 +6018,7 @@ diff -b -B --ignore-all-space --exclude-
+/dev/shm -d gen_context(system_u:object_r:tmpfs_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.6.28/policy/modules/kernel/filesystem.if
--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/kernel/filesystem.if 2009-08-24 08:48:26.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/filesystem.if 2009-08-24 09:57:00.000000000 -0400
@@ -1537,6 +1537,24 @@
########################################
@@ -6377,6 +6441,29 @@ diff -b -B --ignore-all-space --exclude-
+ fs_type($1)
+ mls_trusted_object($1)
+')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.6.28/policy/modules/kernel/storage.fc
+--- nsaserefpolicy/policy/modules/kernel/storage.fc 2009-07-29 15:15:33.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/storage.fc 2009-08-24 10:07:26.000000000 -0400
+@@ -28,6 +28,7 @@
+ /dev/megadev.* -c gen_context(system_u:object_r:removable_device_t,s0)
+ /dev/mmcblk.* -b gen_context(system_u:object_r:removable_device_t,s0)
+ /dev/mspblk.* -b gen_context(system_u:object_r:removable_device_t,s0)
++/dev/mtd.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+ /dev/nb[^/]+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+ /dev/optcd -b gen_context(system_u:object_r:removable_device_t,s0)
+ /dev/p[fg][0-3] -b gen_context(system_u:object_r:removable_device_t,s0)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.6.28/policy/modules/kernel/storage.if
+--- nsaserefpolicy/policy/modules/kernel/storage.if 2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/storage.if 2009-08-25 15:56:31.000000000 -0400
+@@ -529,7 +529,7 @@
+
+ ')
+
+- dontaudit $1 removable_device_t:blk_file { getattr ioctl read };
++ dontaudit $1 removable_device_t:blk_file read_blk_file_perms;
+ ')
+
+ ########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.6.28/policy/modules/kernel/terminal.fc
--- nsaserefpolicy/policy/modules/kernel/terminal.fc 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/kernel/terminal.fc 2009-08-21 18:56:07.000000000 -0400
@@ -7680,8 +7767,8 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.te serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te
--- nsaserefpolicy/policy/modules/roles/unconfineduser.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te 2009-08-21 18:56:07.000000000 -0400
-@@ -0,0 +1,391 @@
++++ serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te 2009-08-25 09:40:01.000000000 -0400
+@@ -0,0 +1,392 @@
+policy_module(unconfineduser, 1.0.0)
+
+########################################
@@ -7937,9 +8024,9 @@ diff -b -B --ignore-all-space --exclude-
+ portmap_run_helper(unconfined_t, unconfined_r)
+')
+
-+optional_policy(`
-+ ppp_run(unconfined_t, unconfined_r)
-+')
++#optional_policy(`
++# ppp_run(unconfined_t, unconfined_r)
++#')
+
+optional_policy(`
+ qemu_role_notrans(unconfined_r, unconfined_t)
@@ -8012,6 +8099,7 @@ diff -b -B --ignore-all-space --exclude-
+allow unconfined_execmem_t self:process { execstack execmem };
+unconfined_domain_noaudit(unconfined_execmem_t)
+allow unconfined_execmem_t unconfined_t:process transition;
++rpm_transition_script(unconfined_execmem_t)
+
+optional_policy(`
+ init_dbus_chat_script(unconfined_execmem_t)
@@ -8548,6 +8636,28 @@ diff -b -B --ignore-all-space --exclude-
+
+permissive abrt_t;
+
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/afs.fc serefpolicy-3.6.28/policy/modules/services/afs.fc
+--- nsaserefpolicy/policy/modules/services/afs.fc 2009-07-23 14:11:04.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/afs.fc 2009-08-24 10:21:30.000000000 -0400
+@@ -25,6 +25,7 @@
+ /usr/vice/etc/afsd -- gen_context(system_u:object_r:afs_exec_t,s0)
+
+ /var/cache/afs(/.*)? gen_context(system_u:object_r:afs_cache_t,s0)
++/usr/vice/cache(/.*)? gen_context(system_u:object_r:afs_cache_t,s0)
+
+ /vicepa gen_context(system_u:object_r:afs_files_t,s0)
+ /vicepb gen_context(system_u:object_r:afs_files_t,s0)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/afs.te serefpolicy-3.6.28/policy/modules/services/afs.te
+--- nsaserefpolicy/policy/modules/services/afs.te 2009-08-14 16:14:31.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/afs.te 2009-08-24 09:19:56.000000000 -0400
+@@ -83,6 +83,7 @@
+
+ files_mounton_mnt(afs_t)
+ files_read_etc_files(afs_t)
++files_read_usr_files(afs_t)
+ files_rw_etc_runtime_files(afs_t)
+
+ fs_getattr_xattr_fs(afs_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.6.28/policy/modules/services/amavis.te
--- nsaserefpolicy/policy/modules/services/amavis.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/amavis.te 2009-08-21 18:56:07.000000000 -0400
@@ -11132,7 +11242,7 @@ diff -b -B --ignore-all-space --exclude-
/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.6.28/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/dbus.if 2009-08-23 12:50:58.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/dbus.if 2009-08-25 16:33:22.000000000 -0400
@@ -42,8 +42,10 @@
gen_require(`
class dbus { send_msg acquire_svc };
@@ -11251,11 +11361,11 @@ diff -b -B --ignore-all-space --exclude-
+#
+interface(`dbus_manage_lib_files',`
+ gen_require(`
-+ type system_dbus_var_lib_t;
++ type system_dbusd_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
-+ manage_files_pattern($1, system_dbus_var_lib_t, system_dbus_var_lib_t)
++ manage_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.6.28/policy/modules/services/dbus.te
@@ -15127,7 +15237,7 @@ diff -b -B --ignore-all-space --exclude-
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.6.28/policy/modules/services/ppp.te
--- nsaserefpolicy/policy/modules/services/ppp.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/ppp.te 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/ppp.te 2009-08-24 09:25:42.000000000 -0400
@@ -193,6 +193,8 @@
optional_policy(`
@@ -15137,6 +15247,15 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
+@@ -216,7 +218,7 @@
+ # PPTP Local policy
+ #
+
+-allow pptp_t self:capability { net_raw net_admin };
++allow pptp_t self:capability { dac_override dac_read_search net_raw net_admin };
+ dontaudit pptp_t self:capability sys_tty_config;
+ allow pptp_t self:process signal;
+ allow pptp_t self:fifo_file rw_fifo_file_perms;
@@ -295,6 +297,14 @@
')
@@ -15935,7 +16054,7 @@ diff -b -B --ignore-all-space --exclude-
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.6.28/policy/modules/services/samba.te
--- nsaserefpolicy/policy/modules/services/samba.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/samba.te 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/samba.te 2009-08-25 09:18:50.000000000 -0400
@@ -66,6 +66,13 @@
## </desc>
gen_tunable(samba_share_nfs, false)
@@ -15978,7 +16097,11 @@ diff -b -B --ignore-all-space --exclude-
# Allow samba to list mnt_t for potential mounted dirs
files_list_mnt(smbd_t)
-@@ -341,6 +352,8 @@
+@@ -338,9 +349,12 @@
+
+ userdom_use_unpriv_users_fds(smbd_t)
+ userdom_dontaudit_search_user_home_dirs(smbd_t)
++userdom_signal_all_users(smbd_t)
usermanage_read_crack_db(smbd_t)
@@ -15987,7 +16110,7 @@ diff -b -B --ignore-all-space --exclude-
ifdef(`hide_broken_symptoms', `
files_dontaudit_getattr_default_dirs(smbd_t)
files_dontaudit_getattr_boot_dirs(smbd_t)
-@@ -352,19 +365,19 @@
+@@ -352,19 +366,19 @@
')
tunable_policy(`samba_domain_controller',`
@@ -16013,7 +16136,7 @@ diff -b -B --ignore-all-space --exclude-
')
# Support Samba sharing of NFS mount points
-@@ -376,6 +389,15 @@
+@@ -376,6 +390,15 @@
fs_manage_nfs_named_sockets(smbd_t)
')
@@ -16029,7 +16152,7 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
cups_read_rw_config(smbd_t)
cups_stream_connect(smbd_t)
-@@ -391,6 +413,11 @@
+@@ -391,6 +414,11 @@
')
optional_policy(`
@@ -16041,7 +16164,7 @@ diff -b -B --ignore-all-space --exclude-
rpc_search_nfs_state_data(smbd_t)
')
-@@ -405,13 +432,15 @@
+@@ -405,13 +433,15 @@
tunable_policy(`samba_create_home_dirs',`
allow smbd_t self:capability chown;
userdom_create_user_home_dirs(smbd_t)
@@ -16058,7 +16181,7 @@ diff -b -B --ignore-all-space --exclude-
auth_read_all_files_except_shadow(nmbd_t)
')
-@@ -420,8 +449,8 @@
+@@ -420,8 +450,8 @@
auth_manage_all_files_except_shadow(smbd_t)
fs_read_noxattr_fs_files(nmbd_t)
auth_manage_all_files_except_shadow(nmbd_t)
@@ -16068,7 +16191,7 @@ diff -b -B --ignore-all-space --exclude-
########################################
#
-@@ -525,6 +554,7 @@
+@@ -525,6 +555,7 @@
allow smbcontrol_t winbind_t:process { signal signull };
@@ -16076,7 +16199,7 @@ diff -b -B --ignore-all-space --exclude-
samba_read_config(smbcontrol_t)
samba_rw_var_files(smbcontrol_t)
samba_search_var(smbcontrol_t)
-@@ -638,6 +668,10 @@
+@@ -638,6 +669,10 @@
allow swat_t smbd_var_run_t:file { lock unlink };
@@ -16087,7 +16210,7 @@ diff -b -B --ignore-all-space --exclude-
rw_files_pattern(swat_t, samba_etc_t, samba_etc_t)
read_lnk_files_pattern(swat_t, samba_etc_t, samba_etc_t)
-@@ -713,12 +747,23 @@
+@@ -713,12 +748,23 @@
kerberos_use(swat_t)
')
@@ -16112,7 +16235,7 @@ diff -b -B --ignore-all-space --exclude-
dontaudit winbind_t self:capability sys_tty_config;
allow winbind_t self:process { signal_perms getsched setsched };
allow winbind_t self:fifo_file rw_fifo_file_perms;
-@@ -866,6 +911,16 @@
+@@ -866,6 +912,16 @@
#
optional_policy(`
@@ -16129,7 +16252,7 @@ diff -b -B --ignore-all-space --exclude-
type samba_unconfined_script_t;
type samba_unconfined_script_exec_t;
domain_type(samba_unconfined_script_t)
-@@ -876,9 +931,12 @@
+@@ -876,9 +932,12 @@
allow smbd_t samba_unconfined_script_exec_t:dir search_dir_perms;
allow smbd_t samba_unconfined_script_exec_t:file ioctl;
@@ -23809,8 +23932,8 @@ diff -b -B --ignore-all-space --exclude-
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.6.28/policy/modules/system/raid.te
--- nsaserefpolicy/policy/modules/system/raid.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/raid.te 2009-08-21 18:56:07.000000000 -0400
-@@ -32,10 +32,6 @@
++++ serefpolicy-3.6.28/policy/modules/system/raid.te 2009-08-25 15:58:45.000000000 -0400
+@@ -32,11 +32,6 @@
kernel_rw_software_raid_state(mdadm_t)
kernel_getattr_core_if(mdadm_t)
@@ -23818,18 +23941,22 @@ diff -b -B --ignore-all-space --exclude-
-corecmd_exec_bin(mdadm_t)
-corecmd_exec_shell(mdadm_t)
-
- dev_read_sysfs(mdadm_t)
+-dev_read_sysfs(mdadm_t)
# Ignore attempts to read every device file
dev_dontaudit_getattr_all_blk_files(mdadm_t)
-@@ -45,24 +41,28 @@
+ dev_dontaudit_getattr_all_chr_files(mdadm_t)
+@@ -44,25 +39,31 @@
+ dev_dontaudit_getattr_generic_chr_files(mdadm_t)
dev_dontaudit_getattr_generic_blk_files(mdadm_t)
dev_read_realtime_clock(mdadm_t)
-
+-
-domain_use_interactive_fds(mdadm_t)
-
-files_read_etc_files(mdadm_t)
-files_read_etc_runtime_files(mdadm_t)
--
++dev_read_raw_memory(mdadm_t)
++dev_read_sysfs(mdadm_t)
+
fs_search_auto_mountpoints(mdadm_t)
fs_dontaudit_list_tmpfs(mdadm_t)
@@ -23902,7 +24029,7 @@ diff -b -B --ignore-all-space --exclude-
+/etc/share/selinux/mls(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.6.28/policy/modules/system/selinuxutil.if
--- nsaserefpolicy/policy/modules/system/selinuxutil.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/selinuxutil.if 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/selinuxutil.if 2009-08-25 15:30:03.000000000 -0400
@@ -535,6 +535,53 @@
########################################
@@ -26012,7 +26139,7 @@ diff -b -B --ignore-all-space --exclude-
+HOME_DIR/\.gvfs(/.*)? <<none>>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.28/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-24 08:49:32.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-25 09:28:37.000000000 -0400
@@ -30,8 +30,9 @@
')
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.903
retrieving revision 1.904
diff -u -p -r1.903 -r1.904
--- selinux-policy.spec 23 Aug 2009 13:55:48 -0000 1.903
+++ selinux-policy.spec 26 Aug 2009 12:12:39 -0000 1.904
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.6.28
-Release: 6%{?dist}
+Release: 7%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -475,6 +475,9 @@ exit 0
%endif
%changelog
+* Tue Aug 25 2009 Dan Walsh <dwalsh at redhat.com> 3.6.28-7
+- Fixes for cdrecord, mdadm, and others
+
* Sat Aug 22 2009 Dan Walsh <dwalsh at redhat.com> 3.6.28-6
- Add capability setting to dhcpc and gpm
- Previous message (by thread): rpms/glibc/devel .cvsignore, 1.282, 1.283 glibc-fedora.patch, 1.316, 1.317 glibc.spec, 1.409, 1.410 import.log, 1.25, 1.26 sources, 1.307, 1.308
- Next message (by thread): rpms/kvirc/F-11 .cvsignore, 1.2, 1.3 kvirc.spec, 1.1, 1.2 sources, 1.2, 1.3 kvirc-flags.patch, 1.1, NONE
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the fedora-extras-commits
mailing list