rpms/selinux-policy/F-11 policy-20090521.patch, 1.35, 1.36 selinux-policy.spec, 1.891, 1.892
Miroslav Grepl
mgrepl at fedoraproject.org
Fri Jul 31 08:41:13 UTC 2009
- Previous message (by thread): rpms/gdb/devel gdb.spec,1.366,1.367
- Next message (by thread): rpms/bltk/devel bltk-1.0.9-conf_home.patch, NONE, 1.1 bltk-1.0.9-bltk_paths.patch, 1.1, 1.2 bltk-1.0.9-cond_install.patch, 1.1, 1.2 bltk-1.0.9-installed.patch, 1.1, 1.2 bltk-1.0.9-opt_developer.patch, 1.1, 1.2 bltk-1.0.9-opt_game.patch, 1.1, 1.2 bltk-1.0.9-opt_office.patch, 1.1, 1.2 bltk-1.0.9-opt_player.patch, 1.1, 1.2 bltk-1.0.9-opt_reader.patch, 1.1, 1.2 bltk.spec, 1.5, 1.6
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: mgrepl
Update of /cvs/extras/rpms/selinux-policy/F-11
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv29116
Modified Files:
policy-20090521.patch selinux-policy.spec
Log Message:
- Allow lircd read/write input event devices
policy-20090521.patch:
mcs | 12 -
modules/admin/certwatch.te | 4
modules/admin/kismet.te | 16 ++
modules/admin/logrotate.te | 6
modules/admin/mrtg.te | 4
modules/admin/prelink.te | 9 -
modules/admin/readahead.te | 2
modules/admin/rpm.if | 18 ++
modules/admin/rpm.te | 4
modules/admin/shorewall.fc | 12 +
modules/admin/shorewall.if | 166 ++++++++++++++++++++++
modules/admin/shorewall.te | 103 +++++++++++++
modules/admin/usermanage.te | 1
modules/apps/gitosis.fc | 4
modules/apps/gitosis.if | 96 ++++++++++++
modules/apps/gitosis.te | 43 +++++
modules/apps/mozilla.if | 16 ++
modules/apps/mozilla.te | 14 +
modules/apps/nsplugin.if | 2
modules/apps/qemu.fc | 1
modules/apps/qemu.te | 5
modules/apps/sandbox.if | 134 +++++++++++++-----
modules/apps/sandbox.te | 274 ++++++++++++++++++++++++++++++++++---
modules/apps/vmware.fc | 1
modules/apps/vmware.te | 6
modules/kernel/corecommands.fc | 9 +
modules/kernel/corenetwork.te.in | 2
modules/kernel/devices.fc | 2
modules/kernel/devices.if | 145 +++++++++++++++++++
modules/kernel/devices.te | 13 +
modules/kernel/domain.if | 45 ++----
modules/kernel/domain.te | 30 +++-
modules/kernel/files.if | 3
modules/kernel/kernel.if | 2
modules/kernel/terminal.if | 19 ++
modules/roles/staff.te | 8 +
modules/roles/sysadm.if | 35 ++++
modules/roles/sysadm.te | 4
modules/roles/unconfineduser.te | 9 -
modules/roles/unprivuser.te | 4
modules/roles/xguest.te | 6
modules/services/apache.fc | 4
modules/services/automount.if | 18 ++
modules/services/avahi.te | 2
modules/services/bluetooth.te | 1
modules/services/clamav.te | 4
modules/services/consolekit.te | 3
modules/services/cron.if | 19 --
modules/services/cron.te | 2
modules/services/cups.te | 2
modules/services/dcc.te | 8 -
modules/services/ddclient.if | 25 +++
modules/services/devicekit.te | 6
modules/services/dnsmasq.te | 4
modules/services/exim.te | 4
modules/services/fetchmail.te | 2
modules/services/fprintd.te | 8 -
modules/services/ftp.te | 7
modules/services/gnomeclock.te | 1
modules/services/gpsd.fc | 3
modules/services/gpsd.te | 17 ++
modules/services/hal.te | 12 +
modules/services/kerberos.if | 2
modules/services/kerberos.te | 12 +
modules/services/lircd.te | 4
modules/services/mailman.if | 1
modules/services/mta.if | 1
modules/services/mysql.te | 4
modules/services/nis.te | 3
modules/services/nslcd.fc | 4
modules/services/nslcd.if | 145 +++++++++++++++++++
modules/services/nslcd.te | 50 ++++++
modules/services/openvpn.te | 1
modules/services/pcscd.te | 3
modules/services/polkit.fc | 2
modules/services/polkit.if | 2
modules/services/polkit.te | 1
modules/services/postfix.if | 19 ++
modules/services/postgresql.te | 2
modules/services/ppp.if | 6
modules/services/privoxy.te | 3
modules/services/pyzor.fc | 2
modules/services/pyzor.te | 2
modules/services/rpc.te | 12 +
modules/services/rsync.te | 2
modules/services/sendmail.if | 21 ++
modules/services/sendmail.te | 7
modules/services/setroubleshoot.te | 5
modules/services/shorewall.fc | 12 -
modules/services/shorewall.if | 166 ----------------------
modules/services/shorewall.te | 102 -------------
modules/services/spamassassin.fc | 4
modules/services/spamassassin.te | 1
modules/services/ssh.if | 23 ++-
modules/services/ssh.te | 4
modules/services/uucp.te | 2
modules/services/virt.te | 27 ++-
modules/services/xserver.fc | 2
modules/services/xserver.if | 19 ++
modules/services/xserver.te | 11 +
modules/system/authlogin.fc | 3
modules/system/authlogin.if | 222 ++++++++++++++++-------------
modules/system/authlogin.te | 27 +--
modules/system/init.fc | 2
modules/system/init.te | 2
modules/system/ipsec.te | 34 ++--
modules/system/iptables.te | 4
modules/system/iscsi.te | 1
modules/system/libraries.fc | 11 +
modules/system/locallogin.te | 6
modules/system/miscfiles.fc | 1
modules/system/sysnetwork.te | 17 +-
modules/system/udev.fc | 1
modules/system/udev.te | 6
modules/system/userdomain.if | 23 +--
modules/system/virtual.te | 5
modules/system/xen.te | 1
117 files changed, 1916 insertions(+), 580 deletions(-)
Index: policy-20090521.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-11/policy-20090521.patch,v
retrieving revision 1.35
retrieving revision 1.36
diff -u -p -r1.35 -r1.36
--- policy-20090521.patch 28 Jul 2009 14:20:07 -0000 1.35
+++ policy-20090521.patch 31 Jul 2009 08:41:12 -0000 1.36
@@ -1368,7 +1368,7 @@ diff -b -B --ignore-all-space --exclude-
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.6.12/policy/modules/kernel/corenetwork.te.in
--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2009-06-25 10:19:44.000000000 +0200
-+++ serefpolicy-3.6.12/policy/modules/kernel/corenetwork.te.in 2009-06-25 10:21:01.000000000 +0200
++++ serefpolicy-3.6.12/policy/modules/kernel/corenetwork.te.in 2009-07-31 09:37:03.000000000 +0200
@@ -134,7 +134,7 @@
network_port(ldap, tcp,389,s0, udp,389,s0, tcp,636,s0, udp,636,s0, tcp,3268,s0)
type lrrd_port_t, port_type; dnl network_port(lrrd_port_t) # no defined portcon
@@ -2087,6 +2087,18 @@ diff -b -B --ignore-all-space --exclude-
userdom_dontaudit_list_admin_dir($1)
role system_r types $1;
')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.6.12/policy/modules/services/cron.te
+--- nsaserefpolicy/policy/modules/services/cron.te 2009-06-25 10:19:44.000000000 +0200
++++ serefpolicy-3.6.12/policy/modules/services/cron.te 2009-07-30 17:13:52.000000000 +0200
+@@ -440,7 +440,7 @@
+ init_dontaudit_rw_utmp(system_cronjob_t)
+ # prelink tells init to restart it self, we either need to allow or dontaudit
+ init_telinit(system_cronjob_t)
+-init_spec_domtrans_script(system_cronjob_t)
++init_domtrans_script(system_cronjob_t)
+
+ auth_use_nsswitch(system_cronjob_t)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.6.12/policy/modules/services/cups.te
--- nsaserefpolicy/policy/modules/services/cups.te 2009-06-25 10:19:44.000000000 +0200
+++ serefpolicy-3.6.12/policy/modules/services/cups.te 2009-07-07 09:04:11.000000000 +0200
@@ -2492,12 +2504,13 @@ diff -b -B --ignore-all-space --exclude-
kerberos_use(kpropd_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lircd.te serefpolicy-3.6.12/policy/modules/services/lircd.te
--- nsaserefpolicy/policy/modules/services/lircd.te 2009-06-25 10:19:44.000000000 +0200
-+++ serefpolicy-3.6.12/policy/modules/services/lircd.te 2009-06-25 10:21:01.000000000 +0200
-@@ -45,6 +45,9 @@
++++ serefpolicy-3.6.12/policy/modules/services/lircd.te 2009-07-30 17:14:36.000000000 +0200
+@@ -45,6 +45,10 @@
dev_filetrans(lircd_t, lircd_sock_t, sock_file )
dev_read_generic_usb_dev(lircd_t)
+dev_filetrans_lirc(lircd_t)
++dev_rw_input_dev(lircd_t)
+dev_rw_lirc(lircd_t)
+
logging_send_syslog_msg(lircd_t)
@@ -4239,16 +4252,19 @@ diff -b -B --ignore-all-space --exclude-
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.6.12/policy/modules/system/libraries.fc
--- nsaserefpolicy/policy/modules/system/libraries.fc 2009-06-25 10:19:44.000000000 +0200
-+++ serefpolicy-3.6.12/policy/modules/system/libraries.fc 2009-07-15 09:44:42.000000000 +0200
-@@ -139,6 +139,7 @@
++++ serefpolicy-3.6.12/policy/modules/system/libraries.fc 2009-07-31 09:55:41.000000000 +0200
+@@ -139,8 +139,10 @@
/usr/lib(64)?/(nvidia/)?libGL(core)?\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/fglrx/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/libGLU\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?/libjackserver\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/libjs\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/libx264\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libnnz11.so(\.[^/]*)* gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/sse2/libx264\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -167,6 +168,8 @@
+ /usr/lib(64)?(/.*)?/libnvidia.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?(/.*)?/nvidia_drv.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+@@ -167,6 +169,8 @@
/usr/lib(64)?/xorg/modules/drivers/nvidia_drv\.o -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/xorg/modules/extensions/nvidia(-[^/]*)?/libglx\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -4257,7 +4273,7 @@ diff -b -B --ignore-all-space --exclude-
ifdef(`distro_debian',`
/usr/lib32 -l gen_context(system_u:object_r:lib_t,s0)
')
-@@ -190,6 +193,7 @@
+@@ -190,6 +194,7 @@
/usr/lib/firefox-[^/]*/plugins/nppdf.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/libFLAC\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/mozilla/plugins/nppdf\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -4265,7 +4281,7 @@ diff -b -B --ignore-all-space --exclude-
/usr/lib/maxima/[^/]+/binary-gcl/maxima -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/mozilla/plugins/libvlcplugin\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib/nx/libXcomp\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -284,6 +288,7 @@
+@@ -284,6 +289,7 @@
/usr/lib(64)?/python2.4/site-packages/M2Crypto/__m2crypto\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
# vmware
@@ -4273,7 +4289,16 @@ diff -b -B --ignore-all-space --exclude-
/usr/lib(64)?/vmware/lib(/.*)?/libgdk-x11-.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/vmware/lib(/.*)?/HConfig\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/vmware/(.*/)?VmPerl\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -366,9 +371,10 @@
+@@ -329,6 +335,8 @@
+
+ /var/mailman/pythonlib(/.*)?/.+\.so(\..*)? -- gen_context(system_u:object_r:lib_t,s0)
+
++/var/named/chroot/usr/lib/bind(/.*)? gen_context(system_u:object_r:lib_t,s0)
++
+ /var/lib/spamassassin/compiled/.*\.so.* -- gen_context(system_u:object_r:lib_t,s0)
+
+ ifdef(`distro_suse',`
+@@ -366,9 +374,10 @@
/usr/matlab.*\.so(\.[^/]*)* gen_context(system_u:object_r:textrel_shlib_t,s0)
/opt/local/matlab.*\.so(\.[^/]*)* gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/local/matlab.*\.so(\.[^/]*)* gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -4308,6 +4333,17 @@ diff -b -B --ignore-all-space --exclude-
ifdef(`sulogin_no_pam', `
allow sulogin_t self:capability sys_tty_config;
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.6.12/policy/modules/system/miscfiles.fc
+--- nsaserefpolicy/policy/modules/system/miscfiles.fc 2009-04-07 21:54:48.000000000 +0200
++++ serefpolicy-3.6.12/policy/modules/system/miscfiles.fc 2009-07-30 17:46:06.000000000 +0200
+@@ -11,6 +11,7 @@
+ /etc/avahi/etc/localtime -- gen_context(system_u:object_r:locale_t,s0)
+ /etc/localtime -- gen_context(system_u:object_r:locale_t,s0)
+ /etc/pki(/.*)? gen_context(system_u:object_r:cert_t,s0)
++/var/named/chroot/etc/pki(/.*)? gen_context(system_u:object_r:cert_t,s0)
+
+ ifdef(`distro_redhat',`
+ /etc/sysconfig/clock -- gen_context(system_u:object_r:locale_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.6.12/policy/modules/system/sysnetwork.te
--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2009-06-25 10:19:44.000000000 +0200
+++ serefpolicy-3.6.12/policy/modules/system/sysnetwork.te 2009-07-17 09:43:41.000000000 +0200
@@ -4366,10 +4402,29 @@ diff -b -B --ignore-all-space --exclude-
+ hal_dontaudit_rw_pipes(ifconfig_t)
+')
+
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.fc serefpolicy-3.6.12/policy/modules/system/udev.fc
+--- nsaserefpolicy/policy/modules/system/udev.fc 2009-04-07 21:54:48.000000000 +0200
++++ serefpolicy-3.6.12/policy/modules/system/udev.fc 2009-07-30 17:22:30.000000000 +0200
+@@ -5,6 +5,7 @@
+ /etc/dev\.d/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
+
+ /etc/hotplug\.d/default/udev.* -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
++/etc/udev/rules\.d(/.*)? gen_context(system_u:object_r:udev_var_run_t,s0)
+
+ /etc/udev/scripts/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.6.12/policy/modules/system/udev.te
--- nsaserefpolicy/policy/modules/system/udev.te 2009-06-25 10:19:44.000000000 +0200
-+++ serefpolicy-3.6.12/policy/modules/system/udev.te 2009-06-25 10:21:01.000000000 +0200
-@@ -112,6 +112,7 @@
++++ serefpolicy-3.6.12/policy/modules/system/udev.te 2009-07-30 17:17:23.000000000 +0200
+@@ -67,6 +67,7 @@
+
+ manage_dirs_pattern(udev_t,udev_var_run_t,udev_var_run_t)
+ manage_files_pattern(udev_t,udev_var_run_t,udev_var_run_t)
++manage_lnk_files_pattern(udev_t, udev_var_run_t, udev_var_run_t)
+ files_pid_filetrans(udev_t,udev_var_run_t,{ dir file })
+
+ kernel_read_system_state(udev_t)
+@@ -112,6 +113,7 @@
fs_getattr_all_fs(udev_t)
fs_list_inotifyfs(udev_t)
@@ -4377,7 +4432,7 @@ diff -b -B --ignore-all-space --exclude-
mcs_ptrace_all(udev_t)
-@@ -196,6 +197,10 @@
+@@ -196,6 +198,10 @@
')
optional_policy(`
@@ -4390,7 +4445,7 @@ diff -b -B --ignore-all-space --exclude-
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.12/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-06-25 10:19:44.000000000 +0200
-+++ serefpolicy-3.6.12/policy/modules/system/userdomain.if 2009-06-25 10:21:01.000000000 +0200
++++ serefpolicy-3.6.12/policy/modules/system/userdomain.if 2009-07-31 09:32:45.000000000 +0200
@@ -627,12 +627,6 @@
')
@@ -4421,7 +4476,15 @@ diff -b -B --ignore-all-space --exclude-
gnome_manage_config($1_usertype)
gnome_manage_gconf_home_files($1_usertype)
gnome_read_gconf_config($1_usertype)
-@@ -1880,7 +1884,7 @@
+@@ -1457,6 +1461,7 @@
+ ')
+
+ allow $1 user_home_dir_t:dir search_dir_perms;
++ allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
+ files_search_home($1)
+ ')
+
+@@ -1880,7 +1885,7 @@
type user_home_t;
')
@@ -4430,7 +4493,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -3317,10 +3321,6 @@
+@@ -3317,10 +3322,6 @@
seutil_run_newrole($1_t, $1_r)
optional_policy(`
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-11/selinux-policy.spec,v
retrieving revision 1.891
retrieving revision 1.892
diff -u -p -r1.891 -r1.892
--- selinux-policy.spec 28 Jul 2009 14:21:57 -0000 1.891
+++ selinux-policy.spec 31 Jul 2009 08:41:12 -0000 1.892
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.6.12
-Release: 70%{?dist}
+Release: 71%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -475,6 +475,9 @@ exit 0
%endif
%changelog
+* Fri Jul 31 2009 Miroslav Grepl <mgrepl at redhat.com> 3.6.12-71
+- Allow lircd read/write input event devices
+
* Tue Jul 28 2009 Miroslav Grepl <mgrepl at redhat.com> 3.6.12-70
- Dontaudit logrotate sys_ptrace capability
- Allow mrtg to transition to ping_t
- Previous message (by thread): rpms/gdb/devel gdb.spec,1.366,1.367
- Next message (by thread): rpms/bltk/devel bltk-1.0.9-conf_home.patch, NONE, 1.1 bltk-1.0.9-bltk_paths.patch, 1.1, 1.2 bltk-1.0.9-cond_install.patch, 1.1, 1.2 bltk-1.0.9-installed.patch, 1.1, 1.2 bltk-1.0.9-opt_developer.patch, 1.1, 1.2 bltk-1.0.9-opt_game.patch, 1.1, 1.2 bltk-1.0.9-opt_office.patch, 1.1, 1.2 bltk-1.0.9-opt_player.patch, 1.1, 1.2 bltk-1.0.9-opt_reader.patch, 1.1, 1.2 bltk.spec, 1.5, 1.6
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the fedora-extras-commits
mailing list