rpms/selinux-policy/devel booleans-minimum.conf, 1.5, 1.6 booleans-targeted.conf, 1.47, 1.48 policy-F12.patch, 1.32, 1.33 selinux-policy.spec, 1.882, 1.883
Daniel J Walsh
dwalsh at fedoraproject.org
Mon Jul 27 22:09:57 UTC 2009
- Previous message (by thread): rpms/setroubleshoot/devel .cvsignore, 1.113, 1.114 setroubleshoot.spec, 1.149, 1.150 sources, 1.125, 1.126
- Next message (by thread): rpms/gnome-media/devel .cvsignore, 1.55, 1.56 gnome-media.spec, 1.173, 1.174 sources, 1.54, 1.55
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv29102
Modified Files:
booleans-minimum.conf booleans-targeted.conf policy-F12.patch
selinux-policy.spec
Log Message:
* Mon Jul 27 2009 Dan Walsh <dwalsh at redhat.com> 3.6.23-2
- Allow certmaster to override dac permissions
Index: booleans-minimum.conf
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/booleans-minimum.conf,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -p -r1.5 -r1.6
--- booleans-minimum.conf 18 Apr 2009 12:13:35 -0000 1.5
+++ booleans-minimum.conf 27 Jul 2009 22:09:56 -0000 1.6
@@ -243,10 +243,6 @@ allow_nsplugin_execmem=true
#
allow_unconfined_nsplugin_transition=true
-# Allow unconfined domains mmap low kernel memory
-#
-allow_unconfined_mmap_low = false
-
# System uses init upstart program
#
init_upstart = true
Index: booleans-targeted.conf
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/booleans-targeted.conf,v
retrieving revision 1.47
retrieving revision 1.48
diff -u -p -r1.47 -r1.48
--- booleans-targeted.conf 18 Apr 2009 12:13:36 -0000 1.47
+++ booleans-targeted.conf 27 Jul 2009 22:09:56 -0000 1.48
@@ -243,10 +243,6 @@ allow_nsplugin_execmem=true
#
allow_unconfined_nsplugin_transition=true
-# Allow unconfined domains mmap low kernel memory
-#
-allow_unconfined_mmap_low = false
-
# System uses init upstart program
#
init_upstart = true
policy-F12.patch:
Makefile | 30
Rules.modular | 8
config/appconfig-mcs/default_contexts | 19
config/appconfig-mcs/failsafe_context | 2
config/appconfig-mcs/root_default_contexts | 8
config/appconfig-mcs/securetty_types | 5
config/appconfig-mcs/seusers | 4
config/appconfig-mcs/staff_u_default_contexts | 4
config/appconfig-mcs/unconfined_u_default_contexts | 4
config/appconfig-mcs/user_u_default_contexts | 5
config/appconfig-mcs/userhelper_context | 2
config/appconfig-mcs/virtual_domain_context | 1
config/appconfig-mcs/virtual_image_context | 2
config/appconfig-mls/default_contexts | 19
config/appconfig-mls/root_default_contexts | 12
config/appconfig-mls/virtual_domain_context | 1
config/appconfig-mls/virtual_image_context | 2
config/appconfig-standard/securetty_types | 5
policy/global_tunables | 24
policy/mcs | 10
policy/modules/admin/anaconda.te | 1
policy/modules/admin/certwatch.te | 1
policy/modules/admin/dmesg.fc | 2
policy/modules/admin/dmesg.te | 7
policy/modules/admin/kismet.if | 1
policy/modules/admin/kismet.te | 17
policy/modules/admin/logrotate.te | 11
policy/modules/admin/logwatch.te | 1
policy/modules/admin/mrtg.te | 1
policy/modules/admin/prelink.if | 19
policy/modules/admin/readahead.fc | 6
policy/modules/admin/readahead.te | 21
policy/modules/admin/rpm.fc | 15
policy/modules/admin/rpm.if | 304 ++++
policy/modules/admin/rpm.te | 63
policy/modules/admin/sudo.if | 67 -
policy/modules/admin/sudo.te | 1
policy/modules/admin/tmpreaper.te | 23
policy/modules/admin/usermanage.te | 9
policy/modules/admin/vbetool.te | 10
policy/modules/apps/awstats.te | 2
policy/modules/apps/cpufreqselector.fc | 1
policy/modules/apps/cpufreqselector.if | 2
policy/modules/apps/cpufreqselector.te | 43
policy/modules/apps/gitosis.fc | 4
policy/modules/apps/gitosis.if | 96 +
policy/modules/apps/gitosis.te | 43
policy/modules/apps/gnome.fc | 12
policy/modules/apps/gnome.if | 170 ++
policy/modules/apps/gnome.te | 99 +
policy/modules/apps/gpg.te | 15
policy/modules/apps/java.fc | 17
policy/modules/apps/java.if | 129 +
policy/modules/apps/java.te | 17
policy/modules/apps/livecd.fc | 2
policy/modules/apps/livecd.if | 50
policy/modules/apps/livecd.te | 26
policy/modules/apps/mono.if | 101 +
policy/modules/apps/mono.te | 9
policy/modules/apps/mozilla.fc | 3
policy/modules/apps/mozilla.if | 15
policy/modules/apps/mozilla.te | 23
policy/modules/apps/nsplugin.fc | 12
policy/modules/apps/nsplugin.if | 313 ++++
policy/modules/apps/nsplugin.te | 287 ++++
policy/modules/apps/openoffice.fc | 3
policy/modules/apps/openoffice.if | 93 +
policy/modules/apps/openoffice.te | 14
policy/modules/apps/qemu.fc | 5
policy/modules/apps/qemu.if | 270 ++--
policy/modules/apps/qemu.te | 88 +
policy/modules/apps/sambagui.fc | 4
policy/modules/apps/sambagui.if | 2
policy/modules/apps/sambagui.te | 57
policy/modules/apps/sandbox.fc | 1
policy/modules/apps/sandbox.if | 145 ++
policy/modules/apps/sandbox.te | 274 ++++
policy/modules/apps/screen.if | 21
policy/modules/apps/vmware.fc | 2
policy/modules/apps/vmware.te | 31
policy/modules/apps/webalizer.te | 1
policy/modules/apps/wine.fc | 23
policy/modules/apps/wine.if | 60
policy/modules/apps/wine.te | 23
policy/modules/apps/wm.fc | 3
policy/modules/apps/wm.if | 108 +
policy/modules/apps/wm.te | 9
policy/modules/kernel/corecommands.fc | 21
policy/modules/kernel/corecommands.if | 1
policy/modules/kernel/corenetwork.te.in | 30
policy/modules/kernel/devices.fc | 2
policy/modules/kernel/devices.if | 146 ++
policy/modules/kernel/devices.te | 13
policy/modules/kernel/domain.if | 132 +-
policy/modules/kernel/domain.te | 94 +
policy/modules/kernel/files.fc | 6
policy/modules/kernel/files.if | 279 ++++
policy/modules/kernel/files.te | 4
policy/modules/kernel/filesystem.fc | 2
policy/modules/kernel/filesystem.if | 20
policy/modules/kernel/kernel.if | 40
policy/modules/kernel/kernel.te | 31
policy/modules/kernel/selinux.if | 25
policy/modules/kernel/storage.fc | 2
policy/modules/kernel/terminal.fc | 1
policy/modules/kernel/terminal.if | 40
policy/modules/roles/guest.te | 8
policy/modules/roles/staff.te | 123 -
policy/modules/roles/sysadm.te | 125 -
policy/modules/roles/unconfineduser.fc | 37
policy/modules/roles/unconfineduser.if | 638 +++++++++
policy/modules/roles/unconfineduser.te | 410 ++++++
policy/modules/roles/unprivuser.te | 131 --
policy/modules/roles/webadm.te | 2
policy/modules/roles/xguest.te | 18
policy/modules/services/amavis.te | 2
policy/modules/services/apache.fc | 35
policy/modules/services/apache.if | 393 ++++--
policy/modules/services/apache.te | 391 +++++-
policy/modules/services/apm.te | 2
policy/modules/services/automount.if | 19
policy/modules/services/automount.te | 6
policy/modules/services/avahi.te | 2
policy/modules/services/bind.if | 19
policy/modules/services/bluetooth.te | 1
policy/modules/services/certmaster.te | 2
policy/modules/services/clamav.te | 12
policy/modules/services/consolekit.if | 20
policy/modules/services/consolekit.te | 32
policy/modules/services/courier.if | 18
policy/modules/services/courier.te | 1
policy/modules/services/cron.fc | 13
policy/modules/services/cron.if | 202 ++-
policy/modules/services/cron.te | 132 +-
policy/modules/services/cups.fc | 32
policy/modules/services/cups.if | 106 +
policy/modules/services/cups.te | 190 ++
policy/modules/services/cvs.te | 1
policy/modules/services/dbus.fc | 3
policy/modules/services/dbus.if | 147 ++
policy/modules/services/dbus.te | 61
policy/modules/services/dcc.te | 8
policy/modules/services/ddclient.if | 25
policy/modules/services/devicekit.fc | 9
policy/modules/services/devicekit.if | 197 +++
policy/modules/services/devicekit.te | 244 +++
policy/modules/services/dnsmasq.te | 8
policy/modules/services/dovecot.te | 7
policy/modules/services/exim.te | 4
policy/modules/services/fetchmail.te | 2
policy/modules/services/fprintd.fc | 4
policy/modules/services/fprintd.if | 43
policy/modules/services/fprintd.te | 55
policy/modules/services/ftp.te | 50
policy/modules/services/gnomeclock.fc | 3
policy/modules/services/gnomeclock.if | 69 +
policy/modules/services/gnomeclock.te | 50
policy/modules/services/gpsd.fc | 5
policy/modules/services/gpsd.if | 27
policy/modules/services/gpsd.te | 10
policy/modules/services/hal.fc | 1
policy/modules/services/hal.if | 100 +
policy/modules/services/hal.te | 108 +
policy/modules/services/kerberos.te | 13
policy/modules/services/kerneloops.te | 3
policy/modules/services/ktalk.te | 1
policy/modules/services/lircd.te | 10
policy/modules/services/mailman.te | 4
policy/modules/services/memcached.te | 2
policy/modules/services/mta.fc | 11
policy/modules/services/mta.if | 41
policy/modules/services/mta.te | 69 -
policy/modules/services/munin.fc | 3
policy/modules/services/munin.te | 26
policy/modules/services/mysql.te | 4
policy/modules/services/nagios.fc | 11
policy/modules/services/nagios.if | 70 -
policy/modules/services/nagios.te | 55
policy/modules/services/networkmanager.fc | 13
policy/modules/services/networkmanager.if | 45
policy/modules/services/networkmanager.te | 112 +
policy/modules/services/nis.fc | 5
policy/modules/services/nis.if | 87 +
policy/modules/services/nis.te | 13
policy/modules/services/nscd.if | 18
policy/modules/services/nscd.te | 10
policy/modules/services/nslcd.fc | 4
policy/modules/services/nslcd.if | 142 ++
policy/modules/services/nslcd.te | 50
policy/modules/services/ntp.if | 71 +
policy/modules/services/ntp.te | 7
policy/modules/services/nx.te | 6
policy/modules/services/oddjob.fc | 2
policy/modules/services/oddjob.if | 26
policy/modules/services/oddjob.te | 28
policy/modules/services/openvpn.te | 1
policy/modules/services/pcscd.te | 3
policy/modules/services/pegasus.te | 28
policy/modules/services/policykit.fc | 2
policy/modules/services/policykit.if | 30
policy/modules/services/policykit.te | 34
policy/modules/services/postfix.fc | 2
policy/modules/services/postfix.if | 150 ++
policy/modules/services/postfix.te | 136 +-
policy/modules/services/postgresql.fc | 1
policy/modules/services/postgresql.if | 43
policy/modules/services/postgresql.te | 7
policy/modules/services/ppp.if | 6
policy/modules/services/ppp.te | 14
policy/modules/services/privoxy.te | 3
policy/modules/services/procmail.te | 12
policy/modules/services/pyzor.fc | 4
policy/modules/services/pyzor.if | 47
policy/modules/services/pyzor.te | 37
policy/modules/services/razor.fc | 1
policy/modules/services/razor.if | 42
policy/modules/services/razor.te | 32
policy/modules/services/ricci.te | 4
policy/modules/services/rpc.if | 6
policy/modules/services/rpc.te | 29
policy/modules/services/rpcbind.if | 20
policy/modules/services/rsync.te | 22
policy/modules/services/rtkit_daemon.fc | 2
policy/modules/services/rtkit_daemon.if | 64
policy/modules/services/rtkit_daemon.te | 36
policy/modules/services/samba.fc | 8
policy/modules/services/samba.if | 344 +++++
policy/modules/services/samba.te | 193 ++
policy/modules/services/sasl.te | 15
policy/modules/services/sendmail.if | 137 ++
policy/modules/services/sendmail.te | 87 +
policy/modules/services/setroubleshoot.fc | 2
policy/modules/services/setroubleshoot.if | 63
policy/modules/services/setroubleshoot.te | 59
policy/modules/services/shorewall.fc | 12
policy/modules/services/shorewall.if | 166 ++
policy/modules/services/shorewall.te | 102 +
policy/modules/services/smartmon.te | 12
policy/modules/services/snort.if | 1
policy/modules/services/snort.te | 9
policy/modules/services/spamassassin.fc | 14
policy/modules/services/spamassassin.if | 68 +
policy/modules/services/spamassassin.te | 131 +-
policy/modules/services/squid.te | 7
policy/modules/services/ssh.fc | 2
policy/modules/services/ssh.if | 163 +-
policy/modules/services/ssh.te | 68 -
policy/modules/services/sssd.fc | 2
policy/modules/services/sssd.if | 43
policy/modules/services/uucp.te | 3
policy/modules/services/virt.fc | 11
policy/modules/services/virt.if | 118 +
policy/modules/services/virt.te | 212 +++
policy/modules/services/w3c.te | 7
policy/modules/services/xserver.fc | 28
policy/modules/services/xserver.if | 518 +++++++
policy/modules/services/xserver.te | 312 ++++
policy/modules/system/application.if | 20
policy/modules/system/application.te | 11
policy/modules/system/authlogin.fc | 9
policy/modules/system/authlogin.if | 203 ++-
policy/modules/system/authlogin.te | 9
policy/modules/system/fstools.fc | 2
policy/modules/system/fstools.te | 9
policy/modules/system/hostname.te | 4
policy/modules/system/init.fc | 6
policy/modules/system/init.if | 138 +-
policy/modules/system/init.te | 174 ++
policy/modules/system/ipsec.fc | 2
policy/modules/system/ipsec.if | 25
policy/modules/system/ipsec.te | 28
policy/modules/system/iptables.fc | 11
policy/modules/system/iptables.te | 5
policy/modules/system/iscsi.if | 40
policy/modules/system/iscsi.te | 6
policy/modules/system/libraries.fc | 85 +
policy/modules/system/libraries.if | 6
policy/modules/system/libraries.te | 18
policy/modules/system/locallogin.te | 28
policy/modules/system/logging.fc | 11
policy/modules/system/logging.if | 4
policy/modules/system/logging.te | 32
policy/modules/system/lvm.te | 17
policy/modules/system/miscfiles.if | 19
policy/modules/system/modutils.te | 36
policy/modules/system/mount.fc | 7
policy/modules/system/mount.if | 22
policy/modules/system/mount.te | 98 +
policy/modules/system/selinuxutil.fc | 16
policy/modules/system/selinuxutil.if | 349 +++++
policy/modules/system/selinuxutil.te | 228 +--
policy/modules/system/setrans.if | 20
policy/modules/system/sysnetwork.fc | 9
policy/modules/system/sysnetwork.if | 115 +
policy/modules/system/sysnetwork.te | 73 -
policy/modules/system/udev.fc | 2
policy/modules/system/udev.te | 33
policy/modules/system/unconfined.fc | 15
policy/modules/system/unconfined.if | 439 ------
policy/modules/system/unconfined.te | 226 ---
policy/modules/system/userdomain.fc | 5
policy/modules/system/userdomain.if | 1361 ++++++++++++++++-----
policy/modules/system/userdomain.te | 50
policy/modules/system/virtual.fc | 1
policy/modules/system/virtual.if | 119 +
policy/modules/system/virtual.te | 75 +
policy/modules/system/xen.fc | 6
policy/modules/system/xen.if | 50
policy/modules/system/xen.te | 134 +-
policy/support/obj_perm_sets.spt | 14
policy/users | 13
support/Makefile.devel | 3
312 files changed, 15140 insertions(+), 2725 deletions(-)
Index: policy-F12.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-F12.patch,v
retrieving revision 1.32
retrieving revision 1.33
diff -u -p -r1.32 -r1.33
--- policy-F12.patch 23 Jul 2009 21:47:40 -0000 1.32
+++ policy-F12.patch 27 Jul 2009 22:09:56 -0000 1.33
@@ -262,7 +262,7 @@ diff -b -B --ignore-all-space --exclude-
$(verbose) $(INSTALL) -m 644 $< $@
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.6.23/policy/global_tunables
--- nsaserefpolicy/policy/global_tunables 2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.23/policy/global_tunables 2009-07-23 16:39:09.000000000 -0400
++++ serefpolicy-3.6.23/policy/global_tunables 2009-07-27 13:55:41.000000000 -0400
@@ -61,15 +61,6 @@
## <desc>
@@ -293,10 +293,10 @@ diff -b -B --ignore-all-space --exclude-
+
+## <desc>
+## <p>
-+## Allow unconfined domain to map low memory in the kernel
++## Allow certain domains to map low memory in the kernel
+## </p>
+## </desc>
-+gen_tunable(allow_unconfined_mmap_low, false)
++gen_tunable(mmap_low_allowed, false)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mcs serefpolicy-3.6.23/policy/mcs
--- nsaserefpolicy/policy/mcs 2009-07-14 14:19:57.000000000 -0400
@@ -1488,16 +1488,20 @@ diff -b -B --ignore-all-space --exclude-
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.6.23/policy/modules/admin/vbetool.te
--- nsaserefpolicy/policy/modules/admin/vbetool.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.23/policy/modules/admin/vbetool.te 2009-07-23 16:39:09.000000000 -0400
-@@ -23,6 +23,7 @@
++++ serefpolicy-3.6.23/policy/modules/admin/vbetool.te 2009-07-27 13:54:52.000000000 -0400
+@@ -23,7 +23,11 @@
dev_rwx_zero(vbetool_t)
dev_read_sysfs(vbetool_t)
+domain_mmap_low_type(vbetool_t)
++tunable_policy(`mmap_low_allowed',`
domain_mmap_low(vbetool_t)
++')
++
term_use_unallocated_ttys(vbetool_t)
-@@ -34,3 +35,9 @@
+
+@@ -34,3 +38,9 @@
hal_write_log(vbetool_t)
hal_dontaudit_append_lib_files(vbetool_t)
')
@@ -4650,8 +4654,8 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.6.23/policy/modules/apps/wine.te
--- nsaserefpolicy/policy/modules/apps/wine.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.23/policy/modules/apps/wine.te 2009-07-23 16:39:09.000000000 -0400
-@@ -9,20 +9,33 @@
++++ serefpolicy-3.6.23/policy/modules/apps/wine.te 2009-07-27 13:54:28.000000000 -0400
+@@ -9,20 +9,35 @@
type wine_t;
type wine_exec_t;
application_domain(wine_t, wine_exec_t)
@@ -4669,7 +4673,9 @@ diff -b -B --ignore-all-space --exclude-
- unconfined_domain_noaudit(wine_t)
+
+domain_mmap_low_type(wine_t)
-+domain_mmap_low(wine_t)
++tunable_policy(`mmap_low_allowed',`
++ domain_mmap_low(wine_t)
++')
+
files_execmod_all_files(wine_t)
@@ -8754,7 +8760,7 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.6.23/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.23/policy/modules/services/apache.te 2009-07-23 16:39:09.000000000 -0400
++++ serefpolicy-3.6.23/policy/modules/services/apache.te 2009-07-27 14:13:27.000000000 -0400
@@ -19,6 +19,8 @@
# Declarations
#
@@ -8798,7 +8804,21 @@ diff -b -B --ignore-all-space --exclude-
## Allow HTTPD scripts and modules to connect to the network using TCP.
## </p>
## </desc>
-@@ -108,6 +124,29 @@
+@@ -87,6 +103,13 @@
+
+ ## <desc>
+ ## <p>
++## Allow httpd to read user content
++## </p>
++## </desc>
++gen_tunable(httpd_read_user_content, false)
++
++## <desc>
++## <p>
+ ## Allow HTTPD to run SSI executables in the same domain as system CGI scripts.
+ ## </p>
+ ## </desc>
+@@ -108,6 +131,29 @@
## </desc>
gen_tunable(httpd_unified, false)
@@ -8828,7 +8848,7 @@ diff -b -B --ignore-all-space --exclude-
attribute httpdcontent;
attribute httpd_user_content_type;
-@@ -140,6 +179,9 @@
+@@ -140,6 +186,9 @@
domain_entry_file(httpd_helper_t, httpd_helper_exec_t)
role system_r types httpd_helper_t;
@@ -8838,7 +8858,7 @@ diff -b -B --ignore-all-space --exclude-
type httpd_lock_t;
files_lock_file(httpd_lock_t)
-@@ -180,6 +222,10 @@
+@@ -180,6 +229,10 @@
# setup the system domain for system CGI scripts
apache_content_template(sys)
@@ -8849,7 +8869,7 @@ diff -b -B --ignore-all-space --exclude-
type httpd_tmp_t;
files_tmp_file(httpd_tmp_t)
-@@ -187,15 +233,20 @@
+@@ -187,15 +240,20 @@
files_tmpfs_file(httpd_tmpfs_t)
apache_content_template(user)
@@ -8873,7 +8893,7 @@ diff -b -B --ignore-all-space --exclude-
typealias httpd_user_content_t alias { httpd_auditadm_content_t httpd_secadm_content_t };
typealias httpd_user_htaccess_t alias { httpd_staff_htaccess_t httpd_sysadm_htaccess_t };
typealias httpd_user_htaccess_t alias { httpd_auditadm_htaccess_t httpd_secadm_htaccess_t };
-@@ -230,7 +281,7 @@
+@@ -230,7 +288,7 @@
# Apache server local policy
#
@@ -8882,7 +8902,7 @@ diff -b -B --ignore-all-space --exclude-
dontaudit httpd_t self:capability { net_admin sys_tty_config };
allow httpd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow httpd_t self:fd use;
-@@ -272,6 +323,7 @@
+@@ -272,6 +330,7 @@
allow httpd_t httpd_modules_t:dir list_dir_perms;
mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
read_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t)
@@ -8890,7 +8910,7 @@ diff -b -B --ignore-all-space --exclude-
apache_domtrans_rotatelogs(httpd_t)
# Apache-httpd needs to be able to send signals to the log rotate procs.
-@@ -283,9 +335,9 @@
+@@ -283,9 +342,9 @@
allow httpd_t httpd_suexec_exec_t:file read_file_perms;
@@ -8903,7 +8923,7 @@ diff -b -B --ignore-all-space --exclude-
manage_dirs_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
manage_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
-@@ -301,6 +353,7 @@
+@@ -301,6 +360,7 @@
manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t)
files_var_lib_filetrans(httpd_t, httpd_var_lib_t, file)
@@ -8911,7 +8931,7 @@ diff -b -B --ignore-all-space --exclude-
manage_files_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
manage_sock_files_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
files_pid_filetrans(httpd_t, httpd_var_run_t, { file sock_file })
-@@ -312,6 +365,7 @@
+@@ -312,6 +372,7 @@
kernel_read_kernel_sysctls(httpd_t)
# for modules that want to access /proc/meminfo
kernel_read_system_state(httpd_t)
@@ -8919,7 +8939,7 @@ diff -b -B --ignore-all-space --exclude-
corenet_all_recvfrom_unlabeled(httpd_t)
corenet_all_recvfrom_netlabel(httpd_t)
-@@ -322,6 +376,7 @@
+@@ -322,6 +383,7 @@
corenet_tcp_sendrecv_all_ports(httpd_t)
corenet_udp_sendrecv_all_ports(httpd_t)
corenet_tcp_bind_generic_node(httpd_t)
@@ -8927,7 +8947,7 @@ diff -b -B --ignore-all-space --exclude-
corenet_tcp_bind_http_port(httpd_t)
corenet_tcp_bind_http_cache_port(httpd_t)
corenet_sendrecv_http_server_packets(httpd_t)
-@@ -335,12 +390,11 @@
+@@ -335,12 +397,11 @@
fs_getattr_all_fs(httpd_t)
fs_search_auto_mountpoints(httpd_t)
@@ -8942,7 +8962,7 @@ diff -b -B --ignore-all-space --exclude-
domain_use_interactive_fds(httpd_t)
-@@ -358,6 +412,10 @@
+@@ -358,6 +419,10 @@
files_read_var_lib_symlinks(httpd_t)
fs_search_auto_mountpoints(httpd_sys_script_t)
@@ -8953,7 +8973,7 @@ diff -b -B --ignore-all-space --exclude-
libs_read_lib_files(httpd_t)
-@@ -372,18 +430,33 @@
+@@ -372,18 +437,33 @@
userdom_use_unpriv_users_fds(httpd_t)
@@ -8991,7 +9011,7 @@ diff -b -B --ignore-all-space --exclude-
')
')
-@@ -391,20 +464,54 @@
+@@ -391,20 +471,54 @@
corenet_tcp_connect_all_ports(httpd_t)
')
@@ -9047,7 +9067,7 @@ diff -b -B --ignore-all-space --exclude-
manage_dirs_pattern(httpd_t, httpdcontent, httpdcontent)
manage_files_pattern(httpd_t, httpdcontent, httpdcontent)
-@@ -415,20 +522,28 @@
+@@ -415,20 +529,28 @@
corenet_tcp_bind_ftp_port(httpd_t)
')
@@ -9080,7 +9100,7 @@ diff -b -B --ignore-all-space --exclude-
tunable_policy(`httpd_ssi_exec',`
corecmd_shell_domtrans(httpd_t, httpd_sys_script_t)
allow httpd_sys_script_t httpd_t:fd use;
-@@ -451,6 +566,10 @@
+@@ -451,6 +573,10 @@
')
optional_policy(`
@@ -9091,7 +9111,7 @@ diff -b -B --ignore-all-space --exclude-
cron_system_entry(httpd_t, httpd_exec_t)
')
-@@ -459,8 +578,13 @@
+@@ -459,8 +585,13 @@
')
optional_policy(`
@@ -9107,7 +9127,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -468,22 +592,18 @@
+@@ -468,22 +599,18 @@
mailman_domtrans_cgi(httpd_t)
# should have separate types for public and private archives
mailman_search_data(httpd_t)
@@ -9132,7 +9152,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -494,12 +614,23 @@
+@@ -494,12 +621,23 @@
')
optional_policy(`
@@ -9156,7 +9176,7 @@ diff -b -B --ignore-all-space --exclude-
')
')
-@@ -508,6 +639,7 @@
+@@ -508,6 +646,7 @@
')
optional_policy(`
@@ -9164,7 +9184,7 @@ diff -b -B --ignore-all-space --exclude-
snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
')
-@@ -535,6 +667,22 @@
+@@ -535,6 +674,22 @@
userdom_use_user_terminals(httpd_helper_t)
@@ -9187,7 +9207,7 @@ diff -b -B --ignore-all-space --exclude-
########################################
#
# Apache PHP script local policy
-@@ -564,20 +712,25 @@
+@@ -564,20 +719,25 @@
fs_search_auto_mountpoints(httpd_php_t)
@@ -9219,7 +9239,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -595,23 +748,24 @@
+@@ -595,23 +755,24 @@
append_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
read_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
@@ -9248,7 +9268,7 @@ diff -b -B --ignore-all-space --exclude-
files_read_etc_files(httpd_suexec_t)
files_read_usr_files(httpd_suexec_t)
-@@ -624,6 +778,7 @@
+@@ -624,6 +785,7 @@
logging_send_syslog_msg(httpd_suexec_t)
miscfiles_read_localization(httpd_suexec_t)
@@ -9256,7 +9276,7 @@ diff -b -B --ignore-all-space --exclude-
tunable_policy(`httpd_can_network_connect',`
allow httpd_suexec_t self:tcp_socket create_stream_socket_perms;
-@@ -641,12 +796,20 @@
+@@ -641,12 +803,20 @@
corenet_sendrecv_all_client_packets(httpd_suexec_t)
')
@@ -9280,7 +9300,7 @@ diff -b -B --ignore-all-space --exclude-
')
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -672,15 +835,14 @@
+@@ -672,15 +842,14 @@
dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
')
@@ -9299,7 +9319,7 @@ diff -b -B --ignore-all-space --exclude-
allow httpd_sys_script_t httpd_t:tcp_socket { read write };
dontaudit httpd_sys_script_t httpd_config_t:dir search;
-@@ -699,12 +861,24 @@
+@@ -699,12 +868,24 @@
# Should we add a boolean?
apache_domtrans_rotatelogs(httpd_sys_script_t)
@@ -9326,7 +9346,7 @@ diff -b -B --ignore-all-space --exclude-
')
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -712,6 +886,35 @@
+@@ -712,6 +893,35 @@
fs_read_nfs_symlinks(httpd_sys_script_t)
')
@@ -9362,7 +9382,7 @@ diff -b -B --ignore-all-space --exclude-
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_sys_script_t)
fs_read_cifs_symlinks(httpd_sys_script_t)
-@@ -724,6 +927,10 @@
+@@ -724,6 +934,10 @@
optional_policy(`
mysql_stream_connect(httpd_sys_script_t)
mysql_rw_db_sockets(httpd_sys_script_t)
@@ -9373,7 +9393,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -735,6 +942,8 @@
+@@ -735,6 +949,8 @@
# httpd_rotatelogs local policy
#
@@ -9382,7 +9402,7 @@ diff -b -B --ignore-all-space --exclude-
manage_files_pattern(httpd_rotatelogs_t, httpd_log_t, httpd_log_t)
kernel_read_kernel_sysctls(httpd_rotatelogs_t)
-@@ -754,6 +963,12 @@
+@@ -754,6 +970,12 @@
tunable_policy(`httpd_enable_cgi && httpd_unified',`
allow httpd_user_script_t httpdcontent:file entrypoint;
@@ -9395,11 +9415,20 @@ diff -b -B --ignore-all-space --exclude-
')
# allow accessing files/dirs below the users home dir
-@@ -762,3 +977,67 @@
+@@ -762,3 +984,76 @@
userdom_search_user_home_dirs(httpd_suexec_t)
userdom_search_user_home_dirs(httpd_user_script_t)
')
+
++tunable_policy(`httpd_read_user_content',`
++ userdom_read_user_home_content_files(httpd_user_script_t)
++ userdom_read_user_home_content_files(httpd_suexec_t)
++')
++
++tunable_policy(`httpd_read_user_content && httpd_builtin_scripting',`
++ userdom_read_user_home_content_files(httpd_t)
++')
++
+#============= bugzilla policy ==============
+apache_content_template(bugzilla)
+
@@ -9607,6 +9636,18 @@ diff -b -B --ignore-all-space --exclude-
read_files_pattern(bluetooth_t, bluetooth_conf_t, bluetooth_conf_t)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmaster.te serefpolicy-3.6.23/policy/modules/services/certmaster.te
+--- nsaserefpolicy/policy/modules/services/certmaster.te 2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.6.23/policy/modules/services/certmaster.te 2009-07-27 14:06:05.000000000 -0400
+@@ -30,7 +30,7 @@
+ # certmaster local policy
+ #
+
+-allow certmaster_t self:capability sys_tty_config;
++allow certmaster_t self:capability { dac_read_search dac_override sys_tty_config };
+ allow certmaster_t self:tcp_socket create_stream_socket_perms;
+
+ # config files
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.6.23/policy/modules/services/clamav.te
--- nsaserefpolicy/policy/modules/services/clamav.te 2009-07-23 14:11:04.000000000 -0400
+++ serefpolicy-3.6.23/policy/modules/services/clamav.te 2009-07-23 16:39:09.000000000 -0400
@@ -10486,8 +10527,8 @@ diff -b -B --ignore-all-space --exclude-
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.6.23/policy/modules/services/cups.fc
--- nsaserefpolicy/policy/modules/services/cups.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.23/policy/modules/services/cups.fc 2009-07-23 16:39:09.000000000 -0400
-@@ -5,27 +5,40 @@
++++ serefpolicy-3.6.23/policy/modules/services/cups.fc 2009-07-27 13:42:47.000000000 -0400
+@@ -5,27 +5,38 @@
/etc/cups/classes\.conf.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
/etc/cups/cupsd\.conf.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
/etc/cups/lpoptions.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
@@ -10526,13 +10567,11 @@ diff -b -B --ignore-all-space --exclude-
+# keep as separate lines to ensure proper sorting
+/usr/lib/cups/backend/hp.* -- gen_context(system_u:object_r:hplip_exec_t,s0)
+/usr/lib64/cups/backend/hp.* -- gen_context(system_u:object_r:hplip_exec_t,s0)
-+/usr/lib/cups/filter/hp.* -- gen_context(system_u:object_r:hplip_exec_t,s0)
-+/usr/lib64/cups/filter/hp.* -- gen_context(system_u:object_r:hplip_exec_t,s0)
+
/usr/sbin/printconf-backend -- gen_context(system_u:object_r:cupsd_config_exec_t,s0)
/usr/sbin/ptal-printd -- gen_context(system_u:object_r:ptal_exec_t,s0)
/usr/sbin/ptal-mlcd -- gen_context(system_u:object_r:ptal_exec_t,s0)
-@@ -33,7 +46,7 @@
+@@ -33,7 +44,7 @@
/usr/share/cups(/.*)? gen_context(system_u:object_r:cupsd_etc_t,s0)
/usr/share/foomatic/db/oldprinterids -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
@@ -10541,7 +10580,7 @@ diff -b -B --ignore-all-space --exclude-
/var/cache/alchemist/printconf.* gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
/var/cache/foomatic(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-@@ -43,10 +56,19 @@
+@@ -43,10 +54,19 @@
/var/lib/cups/certs/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
/var/log/cups(/.*)? gen_context(system_u:object_r:cupsd_log_t,s0)
@@ -14810,13 +14849,13 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.fc serefpolicy-3.6.23/policy/modules/services/policykit.fc
--- nsaserefpolicy/policy/modules/services/policykit.fc 2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.23/policy/modules/services/policykit.fc 2009-07-23 16:39:09.000000000 -0400
++++ serefpolicy-3.6.23/policy/modules/services/policykit.fc 2009-07-27 09:04:55.000000000 -0400
@@ -1,7 +1,7 @@
/usr/libexec/polkit-read-auth-helper -- gen_context(system_u:object_r:policykit_auth_exec_t,s0)
/usr/libexec/polkit-grant-helper.* -- gen_context(system_u:object_r:policykit_grant_exec_t,s0)
/usr/libexec/polkit-resolve-exe-helper.* -- gen_context(system_u:object_r:policykit_resolve_exec_t,s0)
-/usr/libexec/polkitd -- gen_context(system_u:object_r:policykit_exec_t,s0)
-+/usr/libexec/polkitd.* -- gen_context(system_u:object_r:policykit_exec_t,s0)
++/usr/libexec/polkitd.* gen_context(system_u:object_r:policykit_exec_t,s0)
/var/lib/misc/PolicyKit.reload gen_context(system_u:object_r:policykit_reload_t,s0)
/var/lib/PolicyKit(/.*)? gen_context(system_u:object_r:policykit_var_lib_t,s0)
@@ -14874,7 +14913,7 @@ diff -b -B --ignore-all-space --exclude-
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.6.23/policy/modules/services/policykit.te
--- nsaserefpolicy/policy/modules/services/policykit.te 2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.23/policy/modules/services/policykit.te 2009-07-23 16:39:09.000000000 -0400
++++ serefpolicy-3.6.23/policy/modules/services/policykit.te 2009-07-27 11:48:01.000000000 -0400
@@ -38,9 +38,10 @@
allow policykit_t self:capability { setgid setuid };
@@ -14888,8 +14927,11 @@ diff -b -B --ignore-all-space --exclude-
policykit_domtrans_auth(policykit_t)
-@@ -70,6 +71,14 @@
+@@ -68,8 +69,17 @@
+
+ miscfiles_read_localization(policykit_t)
++userdom_getattr_all_users(policykit_t)
userdom_read_all_users_state(policykit_t)
+optional_policy(`
@@ -14903,7 +14945,7 @@ diff -b -B --ignore-all-space --exclude-
########################################
#
# polkit_auth local policy
-@@ -77,7 +86,8 @@
+@@ -77,7 +87,8 @@
allow policykit_auth_t self:capability setgid;
allow policykit_auth_t self:process getattr;
@@ -14913,7 +14955,7 @@ diff -b -B --ignore-all-space --exclude-
allow policykit_auth_t self:unix_dgram_socket create_socket_perms;
allow policykit_auth_t self:unix_stream_socket create_stream_socket_perms;
-@@ -104,6 +114,8 @@
+@@ -104,6 +115,8 @@
userdom_dontaudit_read_user_home_content_files(policykit_auth_t)
optional_policy(`
@@ -14922,7 +14964,7 @@ diff -b -B --ignore-all-space --exclude-
dbus_session_bus_client(policykit_auth_t)
optional_policy(`
-@@ -116,6 +128,10 @@
+@@ -116,6 +129,10 @@
hal_read_state(policykit_auth_t)
')
@@ -14933,7 +14975,7 @@ diff -b -B --ignore-all-space --exclude-
########################################
#
# polkit_grant local policy
-@@ -123,7 +139,8 @@
+@@ -123,7 +140,8 @@
allow policykit_grant_t self:capability setuid;
allow policykit_grant_t self:process getattr;
@@ -14943,7 +14985,7 @@ diff -b -B --ignore-all-space --exclude-
allow policykit_grant_t self:unix_dgram_socket create_socket_perms;
allow policykit_grant_t self:unix_stream_socket create_stream_socket_perms;
-@@ -153,9 +170,12 @@
+@@ -153,9 +171,12 @@
userdom_read_all_users_state(policykit_grant_t)
optional_policy(`
@@ -14957,7 +14999,7 @@ diff -b -B --ignore-all-space --exclude-
consolekit_dbus_chat(policykit_grant_t)
')
')
-@@ -167,7 +187,8 @@
+@@ -167,7 +188,8 @@
allow policykit_resolve_t self:capability { setuid sys_nice sys_ptrace };
allow policykit_resolve_t self:process getattr;
@@ -15234,7 +15276,7 @@ diff -b -B --ignore-all-space --exclude-
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.6.23/policy/modules/services/postfix.te
--- nsaserefpolicy/policy/modules/services/postfix.te 2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.23/policy/modules/services/postfix.te 2009-07-23 16:39:09.000000000 -0400
++++ serefpolicy-3.6.23/policy/modules/services/postfix.te 2009-07-27 09:06:16.000000000 -0400
@@ -6,6 +6,15 @@
# Declarations
#
@@ -16840,7 +16882,7 @@ diff -b -B --ignore-all-space --exclude-
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.6.23/policy/modules/services/samba.te
--- nsaserefpolicy/policy/modules/services/samba.te 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.23/policy/modules/services/samba.te 2009-07-23 16:39:09.000000000 -0400
++++ serefpolicy-3.6.23/policy/modules/services/samba.te 2009-07-27 11:16:18.000000000 -0400
@@ -66,6 +66,13 @@
## </desc>
gen_tunable(samba_share_nfs, false)
@@ -17001,13 +17043,14 @@ diff -b -B --ignore-all-space --exclude-
ifdef(`hide_broken_symptoms', `
files_dontaudit_getattr_default_dirs(smbd_t)
files_dontaudit_getattr_boot_dirs(smbd_t)
-@@ -333,25 +361,33 @@
+@@ -333,25 +361,34 @@
tunable_policy(`samba_domain_controller',`
usermanage_domtrans_passwd(smbd_t)
+ usermanage_kill_passwd(smbd_t)
usermanage_domtrans_useradd(smbd_t)
usermanage_domtrans_groupadd(smbd_t)
++ allow smbd_t self:passwd passwd;
')
tunable_policy(`samba_enable_home_dirs',`
@@ -17041,7 +17084,7 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
cups_read_rw_config(smbd_t)
cups_stream_connect(smbd_t)
-@@ -359,6 +395,16 @@
+@@ -359,6 +396,16 @@
optional_policy(`
kerberos_use(smbd_t)
@@ -17058,7 +17101,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -376,13 +422,15 @@
+@@ -376,13 +423,15 @@
tunable_policy(`samba_create_home_dirs',`
allow smbd_t self:capability chown;
userdom_create_user_home_dirs(smbd_t)
@@ -17075,7 +17118,7 @@ diff -b -B --ignore-all-space --exclude-
auth_read_all_files_except_shadow(nmbd_t)
')
-@@ -391,8 +439,8 @@
+@@ -391,8 +440,8 @@
auth_manage_all_files_except_shadow(smbd_t)
fs_read_noxattr_fs_files(nmbd_t)
auth_manage_all_files_except_shadow(nmbd_t)
@@ -17085,7 +17128,7 @@ diff -b -B --ignore-all-space --exclude-
########################################
#
-@@ -417,14 +465,11 @@
+@@ -417,14 +466,11 @@
files_pid_filetrans(nmbd_t, nmbd_var_run_t, file)
read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
@@ -17101,7 +17144,7 @@ diff -b -B --ignore-all-space --exclude-
manage_files_pattern(nmbd_t, samba_var_t, samba_var_t)
allow nmbd_t smbd_var_run_t:dir rw_dir_perms;
-@@ -553,21 +598,36 @@
+@@ -553,21 +599,36 @@
userdom_use_user_terminals(smbmount_t)
userdom_use_all_users_fds(smbmount_t)
@@ -17141,7 +17184,7 @@ diff -b -B --ignore-all-space --exclude-
append_files_pattern(swat_t, samba_log_t, samba_log_t)
-@@ -585,6 +645,9 @@
+@@ -585,6 +646,9 @@
files_pid_filetrans(swat_t, swat_var_run_t, file)
allow swat_t winbind_exec_t:file mmap_file_perms;
@@ -17151,7 +17194,7 @@ diff -b -B --ignore-all-space --exclude-
kernel_read_kernel_sysctls(swat_t)
kernel_read_system_state(swat_t)
-@@ -609,6 +672,7 @@
+@@ -609,6 +673,7 @@
dev_read_urand(swat_t)
@@ -17159,7 +17202,7 @@ diff -b -B --ignore-all-space --exclude-
files_read_etc_files(swat_t)
files_search_home(swat_t)
files_read_usr_files(swat_t)
-@@ -618,6 +682,7 @@
+@@ -618,6 +683,7 @@
auth_use_nsswitch(swat_t)
logging_send_syslog_msg(swat_t)
@@ -17167,7 +17210,7 @@ diff -b -B --ignore-all-space --exclude-
logging_search_logs(swat_t)
miscfiles_read_localization(swat_t)
-@@ -635,14 +700,25 @@
+@@ -635,14 +701,25 @@
kerberos_use(swat_t)
')
@@ -17195,7 +17238,7 @@ diff -b -B --ignore-all-space --exclude-
allow winbind_t self:fifo_file rw_fifo_file_perms;
allow winbind_t self:unix_dgram_socket create_socket_perms;
allow winbind_t self:unix_stream_socket create_stream_socket_perms;
-@@ -683,9 +759,10 @@
+@@ -683,9 +760,10 @@
manage_sock_files_pattern(winbind_t, winbind_var_run_t, winbind_var_run_t)
files_pid_filetrans(winbind_t, winbind_var_run_t, file)
@@ -17208,7 +17251,7 @@ diff -b -B --ignore-all-space --exclude-
corenet_all_recvfrom_unlabeled(winbind_t)
corenet_all_recvfrom_netlabel(winbind_t)
-@@ -709,10 +786,12 @@
+@@ -709,10 +787,12 @@
auth_domtrans_chk_passwd(winbind_t)
auth_use_nsswitch(winbind_t)
@@ -17221,7 +17264,7 @@ diff -b -B --ignore-all-space --exclude-
logging_send_syslog_msg(winbind_t)
-@@ -768,8 +847,13 @@
+@@ -768,8 +848,13 @@
userdom_use_user_terminals(winbind_helper_t)
optional_policy(`
@@ -17235,7 +17278,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -778,6 +862,16 @@
+@@ -778,6 +863,16 @@
#
optional_policy(`
@@ -17252,7 +17295,7 @@ diff -b -B --ignore-all-space --exclude-
type samba_unconfined_script_t;
type samba_unconfined_script_exec_t;
domain_type(samba_unconfined_script_t)
-@@ -788,9 +882,43 @@
+@@ -788,9 +883,43 @@
allow smbd_t samba_unconfined_script_exec_t:dir search_dir_perms;
allow smbd_t samba_unconfined_script_exec_t:file ioctl;
@@ -19889,7 +19932,7 @@ diff -b -B --ignore-all-space --exclude-
corenet_tcp_connect_http_port(httpd_w3c_validator_script_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.6.23/policy/modules/services/xserver.fc
--- nsaserefpolicy/policy/modules/services/xserver.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.23/policy/modules/services/xserver.fc 2009-07-23 16:39:09.000000000 -0400
++++ serefpolicy-3.6.23/policy/modules/services/xserver.fc 2009-07-27 13:50:30.000000000 -0400
@@ -3,12 +3,16 @@
#
HOME_DIR/\.fonts\.conf -- gen_context(system_u:object_r:user_fonts_config_t,s0)
@@ -19953,7 +19996,7 @@ diff -b -B --ignore-all-space --exclude-
/var/run/[gx]dm\.pid -- gen_context(system_u:object_r:xdm_var_run_t,s0)
/var/run/xdmctl(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
+/var/run/xauth(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
-+/var/run/slim.auth -- gen_context(system_u:object_r:xdm_var_run_t,s0)
++/var/run/slim\.auth -- gen_context(system_u:object_r:xdm_var_run_t,s0)
+
+/var/run/video.rom -- gen_context(system_u:object_r:xserver_var_run_t,s0)
+/var/run/xorg(/.*)? gen_context(system_u:object_r:xserver_var_run_t,s0)
@@ -25143,7 +25186,7 @@ diff -b -B --ignore-all-space --exclude-
-')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.6.23/policy/modules/system/unconfined.if
--- nsaserefpolicy/policy/modules/system/unconfined.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.23/policy/modules/system/unconfined.if 2009-07-23 16:39:09.000000000 -0400
++++ serefpolicy-3.6.23/policy/modules/system/unconfined.if 2009-07-27 13:54:34.000000000 -0400
@@ -12,14 +12,13 @@
#
interface(`unconfined_domain_noaudit',`
@@ -25188,7 +25231,7 @@ diff -b -B --ignore-all-space --exclude-
+
+ ubac_process_exempt($1)
+
-+ tunable_policy(`allow_unconfined_mmap_low',`
++ tunable_policy(`mmap_low_allowed',`
+ domain_mmap_low($1)
+ ')
+
@@ -25888,7 +25931,7 @@ diff -b -B --ignore-all-space --exclude-
+/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.23/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.23/policy/modules/system/userdomain.if 2009-07-23 16:39:09.000000000 -0400
++++ serefpolicy-3.6.23/policy/modules/system/userdomain.if 2009-07-27 14:11:20.000000000 -0400
@@ -30,8 +30,9 @@
')
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.882
retrieving revision 1.883
diff -u -p -r1.882 -r1.883
--- selinux-policy.spec 23 Jul 2009 21:47:41 -0000 1.882
+++ selinux-policy.spec 27 Jul 2009 22:09:57 -0000 1.883
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.6.23
-Release: 1%{?dist}
+Release: 2%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -475,6 +475,9 @@ exit 0
%endif
%changelog
+* Mon Jul 27 2009 Dan Walsh <dwalsh at redhat.com> 3.6.23-2
+- Allow certmaster to override dac permissions
+
* Thu Jul 22 2009 Dan Walsh <dwalsh at redhat.com> 3.6.23-1
- Update to upstream
- Previous message (by thread): rpms/setroubleshoot/devel .cvsignore, 1.113, 1.114 setroubleshoot.spec, 1.149, 1.150 sources, 1.125, 1.126
- Next message (by thread): rpms/gnome-media/devel .cvsignore, 1.55, 1.56 gnome-media.spec, 1.173, 1.174 sources, 1.54, 1.55
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the fedora-extras-commits
mailing list