rpms/selinux-policy/devel policy-20090105.patch, 1.63, 1.64 selinux-policy.spec, 1.806, 1.807
Daniel J Walsh
dwalsh at fedoraproject.org
Tue Mar 17 19:52:35 UTC 2009
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv4656
Modified Files:
policy-20090105.patch selinux-policy.spec
Log Message:
* Tue Mar 17 2009 Dan Walsh <dwalsh at redhat.com> 3.6.9-3
- Change to svirt to only access svirt_image_t
policy-20090105.patch:
Index: policy-20090105.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20090105.patch,v
retrieving revision 1.63
retrieving revision 1.64
diff -u -r1.63 -r1.64
--- policy-20090105.patch 16 Mar 2009 16:02:20 -0000 1.63
+++ policy-20090105.patch 17 Mar 2009 19:52:34 -0000 1.64
@@ -125,9 +125,9 @@
+system_u:system_r:svirt_t:s0
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/virtual_image_context serefpolicy-3.6.9/config/appconfig-mcs/virtual_image_context
--- nsaserefpolicy/config/appconfig-mcs/virtual_image_context 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.9/config/appconfig-mcs/virtual_image_context 2009-03-12 13:35:00.000000000 -0400
++++ serefpolicy-3.6.9/config/appconfig-mcs/virtual_image_context 2009-03-16 14:03:57.000000000 -0400
@@ -0,0 +1 @@
-+system_u:object_r:virt_image_t:s0
++system_u:object_r:svirt_image_t:s0
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts serefpolicy-3.6.9/config/appconfig-mcs/xguest_u_default_contexts
--- nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.9/config/appconfig-mcs/xguest_u_default_contexts 2009-03-12 13:35:00.000000000 -0400
@@ -338,18 +338,17 @@
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mcs serefpolicy-3.6.9/policy/mcs
--- nsaserefpolicy/policy/mcs 2009-02-03 22:50:50.000000000 -0500
-+++ serefpolicy-3.6.9/policy/mcs 2009-03-12 13:35:00.000000000 -0400
-@@ -67,7 +67,8 @@
++++ serefpolicy-3.6.9/policy/mcs 2009-03-17 15:25:30.000000000 -0400
+@@ -67,7 +67,7 @@
# Note that getattr on files is always permitted.
#
mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom }
- ( h1 dom h2 );
-+ ((( h1 dom h2 ) or ( t1 == mlsfilewrite ))
-+ and ((t1 != virtualseparateddomain) or (t2 != virtual_image_type) or (h1 == h2)));
++ (( h1 dom h2 ) or ( t1 == mlsfilewrite ));
mlsconstrain dir { create getattr setattr read write link unlink rename search add_name remove_name reparent rmdir lock ioctl }
(( h1 dom h2 ) or ( t2 == domain ) or ( t1 == mlsfileread ));
-@@ -75,19 +76,22 @@
+@@ -75,7 +75,7 @@
# New filesystem object labels must be dominated by the relabeling subject
# clearance, also the objects are single-level.
mlsconstrain file { create relabelto }
@@ -358,12 +357,7 @@
# At this time we do not restrict "ps" type operations via MCS. This
# will probably change in future.
- mlsconstrain file { read }
-- (( h1 dom h2 ) or ( t2 == domain ) or ( t1 == mlsfileread ));
-+ ((( h1 dom h2 ) or ( t1 == mlsfileread ))
-+ and ((t1 != virtualseparateddomain) or (t2 != virtual_image_type) or (h1 == h2)));
-+# ((( h1 dom h2 ) or ( t2 == domain ) or ( t1 == mlsfileread ))
-+# and ((t1 != virtualseparateddomain) or (t2 != virtual_image_type) or (h1 == h2)));
+@@ -84,10 +84,10 @@
# new file labels must be dominated by the relabeling subject clearance
mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }
@@ -3383,8 +3377,8 @@
+/usr/bin/pulseaudio -- gen_context(system_u:object_r:pulseaudio_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.if serefpolicy-3.6.9/policy/modules/apps/pulseaudio.if
--- nsaserefpolicy/policy/modules/apps/pulseaudio.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.9/policy/modules/apps/pulseaudio.if 2009-03-12 13:35:00.000000000 -0400
-@@ -0,0 +1,86 @@
++++ serefpolicy-3.6.9/policy/modules/apps/pulseaudio.if 2009-03-17 14:36:39.000000000 -0400
+@@ -0,0 +1,105 @@
+
+## <summary>policy for pulseaudio</summary>
+
@@ -3435,6 +3429,24 @@
+
+########################################
+## <summary>
++## Execute a pulseaudio in the current domain
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`pulseaudio_exec',`
++ gen_require(`
++ type pulseaudio_exec_t;
++ ')
++
++ can_exec($1,pulseaudio_exec_t)
++')
++
++########################################
++## <summary>
+## Role access for pulseaudio
+## </summary>
+## <param name="role">
@@ -3471,10 +3483,11 @@
+ userdom_manage_tmp_role($1, pulseaudio_t)
+ userdom_manage_tmpfs_role($1, pulseaudio_t)
+')
++
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.9/policy/modules/apps/pulseaudio.te
--- nsaserefpolicy/policy/modules/apps/pulseaudio.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.9/policy/modules/apps/pulseaudio.te 2009-03-12 13:35:00.000000000 -0400
-@@ -0,0 +1,88 @@
++++ serefpolicy-3.6.9/policy/modules/apps/pulseaudio.te 2009-03-17 14:30:29.000000000 -0400
+@@ -0,0 +1,97 @@
+policy_module(pulseaudio,1.0.0)
+
+########################################
@@ -3514,6 +3527,8 @@
+dev_read_sysfs(pulseaudio_t)
+dev_read_urand(pulseaudio_t)
+
++kernel_read_kernel_sysctls(pulseaudio_t)
++
+files_read_etc_files(pulseaudio_t)
+files_read_usr_files(pulseaudio_t)
+
@@ -3547,6 +3562,12 @@
+')
+
+optional_policy(`
++ polkit_domtrans_auth(pulseaudio_t)
++ polkit_read_lib(pulseaudio_t)
++ polkit_read_reload(pulseaudio_t)
++')
++
++optional_policy(`
+ udev_read_db(pulseaudio_t)
+')
+
@@ -3554,6 +3575,7 @@
+ xserver_common_app(pulseaudio_t)
+ xserver_read_xdm_pid(pulseaudio_t)
+ xserver_stream_connect(pulseaudio_t)
++ xserver_manage_xdm_tmp_files(pulseaudio_t)
+')
+
+tunable_policy(`pulseaudio_network',`
@@ -5199,9 +5221,32 @@
')
########################################
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.6.9/policy/modules/kernel/filesystem.te
+--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2009-03-04 15:43:10.000000000 -0500
++++ serefpolicy-3.6.9/policy/modules/kernel/filesystem.te 2009-03-17 14:10:23.000000000 -0400
+@@ -206,6 +206,10 @@
+ genfscon ntfs-3g / gen_context(system_u:object_r:dosfs_t,s0)
+ genfscon ntfs / gen_context(system_u:object_r:dosfs_t,s0)
+ genfscon vfat / gen_context(system_u:object_r:dosfs_t,s0)
++# Labeling dosfs_t since these are removable file systems with the i
++# same security properties as dosfs_t
++genfscon hfs / gen_context(system_u:object_r:dosfs_t,s0)
++genfscon hfsplus / gen_context(system_u:object_r:dosfs_t,s0)
+
+ type fusefs_t;
+ fs_noxattr_type(fusefs_t)
+@@ -244,8 +248,6 @@
+ genfscon afs / gen_context(system_u:object_r:nfs_t,s0)
+ genfscon dazukofs / gen_context(system_u:object_r:nfs_t,s0)
+ genfscon coda / gen_context(system_u:object_r:nfs_t,s0)
+-genfscon hfs / gen_context(system_u:object_r:nfs_t,s0)
+-genfscon hfsplus / gen_context(system_u:object_r:nfs_t,s0)
+ genfscon lustre / gen_context(system_u:object_r:nfs_t,s0)
+ genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0)
+ genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.6.9/policy/modules/kernel/kernel.if
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2009-01-05 15:39:38.000000000 -0500
-+++ serefpolicy-3.6.9/policy/modules/kernel/kernel.if 2009-03-12 13:35:00.000000000 -0400
++++ serefpolicy-3.6.9/policy/modules/kernel/kernel.if 2009-03-17 14:28:38.000000000 -0400
@@ -1197,6 +1197,26 @@
')
@@ -10991,8 +11036,8 @@
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.6.9/policy/modules/services/devicekit.te
--- nsaserefpolicy/policy/modules/services/devicekit.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.9/policy/modules/services/devicekit.te 2009-03-16 11:44:53.000000000 -0400
-@@ -0,0 +1,202 @@
++++ serefpolicy-3.6.9/policy/modules/services/devicekit.te 2009-03-17 15:39:17.000000000 -0400
+@@ -0,0 +1,209 @@
+policy_module(devicekit,1.0.0)
+
+########################################
@@ -11053,7 +11098,7 @@
+#
+# DeviceKit-Power local policy
+#
-+allow devicekit_power_t self:capability { sys_tty_config dac_override };
++allow devicekit_power_t self:capability { dac_override sys_tty_config sys_nice };
+allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
+allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
+
@@ -11163,12 +11208,16 @@
+
+fs_list_inotifyfs(devicekit_disk_t)
+
-+storage_getattr_fixed_disk_dev(devicekit_disk_t)
++storage_raw_read_fixed_disk(devicekit_disk_t)
+storage_raw_read_removable_device(devicekit_disk_t)
+storage_raw_write_removable_device(devicekit_disk_t)
+
+term_use_all_terms(devicekit_disk_t)
+
++auth_use_nsswitch(devicekit_disk_t)
++
++miscfiles_read_localization(devicekit_disk_t)
++
+userdom_read_all_users_state(devicekit_disk_t)
+
+optional_policy(`
@@ -11176,6 +11225,10 @@
+')
+
+optional_policy(`
++ lvm_domtrans(devicekit_disk_t)
++')
++
++optional_policy(`
+ polkit_domtrans_auth(devicekit_disk_t)
+ polkit_read_lib(devicekit_disk_t)
+ polkit_read_reload(devicekit_disk_t)
@@ -11194,7 +11247,6 @@
+ consolekit_dbus_chat(devicekit_disk_t)
+ ')
+')
-+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.if serefpolicy-3.6.9/policy/modules/services/dhcp.if
--- nsaserefpolicy/policy/modules/services/dhcp.if 2008-11-18 18:57:20.000000000 -0500
+++ serefpolicy-3.6.9/policy/modules/services/dhcp.if 2009-03-12 13:35:00.000000000 -0400
@@ -21566,7 +21618,7 @@
+/var/run/libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.6.9/policy/modules/services/virt.if
--- nsaserefpolicy/policy/modules/services/virt.if 2009-01-05 15:39:43.000000000 -0500
-+++ serefpolicy-3.6.9/policy/modules/services/virt.if 2009-03-12 13:35:00.000000000 -0400
++++ serefpolicy-3.6.9/policy/modules/services/virt.if 2009-03-17 10:31:34.000000000 -0400
@@ -2,28 +2,6 @@
########################################
@@ -21714,7 +21766,7 @@
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.9/policy/modules/services/virt.te
--- nsaserefpolicy/policy/modules/services/virt.te 2009-01-19 11:06:49.000000000 -0500
-+++ serefpolicy-3.6.9/policy/modules/services/virt.te 2009-03-12 14:17:50.000000000 -0400
++++ serefpolicy-3.6.9/policy/modules/services/virt.te 2009-03-17 10:32:36.000000000 -0400
@@ -8,20 +8,18 @@
## <desc>
@@ -21796,19 +21848,20 @@
read_files_pattern(virtd_t, virt_etc_t, virt_etc_t)
read_lnk_files_pattern(virtd_t, virt_etc_t, virt_etc_t)
-@@ -67,7 +92,10 @@
+@@ -67,7 +92,11 @@
manage_lnk_files_pattern(virtd_t, virt_etc_rw_t, virt_etc_rw_t)
filetrans_pattern(virtd_t, virt_etc_t, virt_etc_rw_t, dir)
-manage_files_pattern(virtd_t, virt_image_type, virt_image_type)
+virtual_manage_image(virtd_t)
++virtual_manage_relabel(virtd_t)
+
+manage_dirs_pattern(virtd_t, virt_content_t, virt_content_t)
+manage_files_pattern(virtd_t, virt_content_t, virt_content_t)
manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t)
manage_files_pattern(virtd_t, virt_log_t, virt_log_t)
-@@ -86,6 +114,7 @@
+@@ -86,6 +115,7 @@
kernel_read_network_state(virtd_t)
kernel_rw_net_sysctls(virtd_t)
kernel_load_module(virtd_t)
@@ -21816,7 +21869,7 @@
corecmd_exec_bin(virtd_t)
corecmd_exec_shell(virtd_t)
-@@ -96,7 +125,7 @@
+@@ -96,7 +126,7 @@
corenet_tcp_sendrecv_generic_node(virtd_t)
corenet_tcp_sendrecv_all_ports(virtd_t)
corenet_tcp_bind_generic_node(virtd_t)
@@ -21825,10 +21878,11 @@
corenet_tcp_bind_vnc_port(virtd_t)
corenet_tcp_connect_vnc_port(virtd_t)
corenet_tcp_connect_soundd_port(virtd_t)
-@@ -104,21 +133,37 @@
+@@ -104,21 +134,38 @@
dev_read_sysfs(virtd_t)
dev_read_rand(virtd_t)
++dev_read_kvm(virtd_t)
+dev_getattr_all_chr_files(virtd_t)
# Init script handling
@@ -21864,7 +21918,7 @@
term_getattr_pty_fs(virtd_t)
term_use_ptmx(virtd_t)
-@@ -129,6 +174,11 @@
+@@ -129,6 +176,11 @@
logging_send_syslog_msg(virtd_t)
@@ -21876,7 +21930,7 @@
userdom_read_all_users_state(virtd_t)
tunable_policy(`virt_use_nfs',`
-@@ -167,22 +217,34 @@
+@@ -167,22 +219,34 @@
dnsmasq_domtrans(virtd_t)
dnsmasq_signal(virtd_t)
dnsmasq_kill(virtd_t)
@@ -21895,9 +21949,8 @@
+optional_policy(`
+ kerberos_keytab_template(virtd, virtd_t)
+')
-
- optional_policy(`
-- qemu_domtrans(virtd_t)
++
++optional_policy(`
+ lvm_domtrans(virtd_t)
+')
+
@@ -21906,8 +21959,9 @@
+ polkit_domtrans_resolve(virtd_t)
+ polkit_read_lib(virtd_t)
+')
-+
-+optional_policy(`
+
+ optional_policy(`
+- qemu_domtrans(virtd_t)
+ qemu_spec_domtrans(virtd_t, svirt_t)
qemu_read_state(virtd_t)
qemu_signal(virtd_t)
@@ -21916,7 +21970,7 @@
')
optional_policy(`
-@@ -198,5 +260,73 @@
+@@ -198,5 +262,73 @@
')
optional_policy(`
@@ -21949,6 +22003,10 @@
+manage_lnk_files_pattern(svirt_t, svirt_var_run_t, svirt_var_run_t)
+files_pid_filetrans(svirt_t, svirt_var_run_t, { dir file })
+
++allow svirt_t svirt_image_t:dir search_dir_perms;
++manage_dirs_pattern(svirt_t, svirt_image_t, svirt_image_t)
++manage_files_pattern(svirt_t, svirt_image_t, svirt_image_t)
++
+storage_raw_write_removable_device(svirt_t)
+storage_raw_read_removable_device(svirt_t)
+
@@ -21981,10 +22039,6 @@
+')
+
+optional_policy(`
-+ virt_manage_images(svirt_t)
-+')
-+
-+optional_policy(`
+ xen_rw_image_files(svirt_t)
+')
+
@@ -22085,7 +22139,7 @@
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.6.9/policy/modules/services/xserver.if
--- nsaserefpolicy/policy/modules/services/xserver.if 2009-01-05 15:39:43.000000000 -0500
-+++ serefpolicy-3.6.9/policy/modules/services/xserver.if 2009-03-12 13:35:00.000000000 -0400
++++ serefpolicy-3.6.9/policy/modules/services/xserver.if 2009-03-17 14:33:04.000000000 -0400
@@ -90,7 +90,7 @@
allow $2 xauth_home_t:file manage_file_perms;
allow $2 xauth_home_t:file { relabelfrom relabelto };
@@ -22095,10 +22149,12 @@
##############################
#
-@@ -116,6 +116,7 @@
+@@ -115,7 +115,8 @@
+ # write: gnome-settings-daemon RANDR:SelectInput
# setattr: gnome-settings-daemon X11:GrabKey
# manage: metacity X11:ChangeWindowAttributes
- allow $2 rootwindow_t:x_drawable { read write manage setattr };
+- allow $2 rootwindow_t:x_drawable { read write manage setattr };
++ allow $2 rootwindow_t:x_drawable { read write manage get_property getattr setattr };
+ allow $2 $2:x_drawable all_x_drawable_perms;
# setattr: metacity X11:InstallColormap
@@ -22259,10 +22315,29 @@
')
########################################
-@@ -779,6 +799,31 @@
+@@ -779,6 +799,50 @@
########################################
## <summary>
++## Read XDM var lib files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`xserver_manage_xdm_lib_files',`
++ gen_require(`
++ type xdm_var_lib_t;
++ ')
++
++ manage_files_pattern($1, xdm_var_lib_t, xdm_var_lib_t)
++ read_lnk_files_pattern($1, xdm_var_lib_t, xdm_var_lib_t)
++')
++
++########################################
++## <summary>
+## Execute xsever in the xserver domain, and
+## allow the specified role the xserver domain.
+## </summary>
@@ -22291,7 +22366,7 @@
## Make an X session script an entrypoint for the specified domain.
## </summary>
## <param name="domain">
-@@ -872,6 +917,27 @@
+@@ -872,6 +936,27 @@
########################################
## <summary>
@@ -22319,7 +22394,7 @@
## Do not audit attempts to write the X server
## log files.
## </summary>
-@@ -1018,10 +1084,11 @@
+@@ -1018,10 +1103,11 @@
#
interface(`xserver_domtrans',`
gen_require(`
@@ -22332,7 +22407,7 @@
domtrans_pattern($1, xserver_exec_t, xserver_t)
')
-@@ -1159,6 +1226,275 @@
+@@ -1159,6 +1245,275 @@
########################################
## <summary>
@@ -22608,7 +22683,7 @@
## Interface to provide X object permissions on a given X server to
## an X client domain. Gives the domain complete control over the
## display.
-@@ -1172,7 +1508,102 @@
+@@ -1172,7 +1527,102 @@
interface(`xserver_unconfined',`
gen_require(`
attribute xserver_unconfined_type;
@@ -22713,7 +22788,7 @@
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.9/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2009-01-19 11:06:49.000000000 -0500
-+++ serefpolicy-3.6.9/policy/modules/services/xserver.te 2009-03-12 13:35:00.000000000 -0400
++++ serefpolicy-3.6.9/policy/modules/services/xserver.te 2009-03-17 14:38:53.000000000 -0400
@@ -34,6 +34,13 @@
## <desc>
@@ -22914,7 +22989,7 @@
# Allow gdm to run gdm-binary
can_exec(xdm_t, xdm_exec_t)
-@@ -329,6 +360,8 @@
+@@ -329,22 +360,38 @@
manage_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
manage_sock_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
files_tmp_filetrans(xdm_t, xdm_tmp_t, { file dir sock_file })
@@ -22923,10 +22998,10 @@
manage_dirs_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
manage_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
-@@ -336,15 +369,30 @@
+ manage_lnk_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
manage_fifo_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
manage_sock_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)
- fs_tmpfs_filetrans(xdm_t, xdm_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
+-fs_tmpfs_filetrans(xdm_t, xdm_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
+fs_getattr_all_fs(xdm_t)
+fs_search_inotifyfs(xdm_t)
+fs_read_noxattr_fs_files(xdm_t)
@@ -22956,7 +23031,7 @@
allow xdm_t xserver_t:process signal;
allow xdm_t xserver_t:unix_stream_socket connectto;
-@@ -358,6 +406,7 @@
+@@ -358,6 +405,7 @@
allow xdm_t xserver_t:process { noatsecure siginh rlimitinh signal sigkill };
allow xdm_t xserver_t:shm rw_shm_perms;
@@ -22964,7 +23039,7 @@
# connect to xdm xserver over stream socket
stream_connect_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t,xserver_t)
-@@ -366,10 +415,14 @@
+@@ -366,10 +414,14 @@
delete_files_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t)
delete_sock_files_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t)
@@ -22980,7 +23055,7 @@
kernel_read_system_state(xdm_t)
kernel_read_kernel_sysctls(xdm_t)
-@@ -389,11 +442,13 @@
+@@ -389,11 +441,13 @@
corenet_udp_sendrecv_all_ports(xdm_t)
corenet_tcp_bind_generic_node(xdm_t)
corenet_udp_bind_generic_node(xdm_t)
@@ -22994,7 +23069,7 @@
dev_read_rand(xdm_t)
dev_read_sysfs(xdm_t)
dev_getattr_framebuffer_dev(xdm_t)
-@@ -401,6 +456,7 @@
+@@ -401,6 +455,7 @@
dev_getattr_mouse_dev(xdm_t)
dev_setattr_mouse_dev(xdm_t)
dev_rw_apm_bios(xdm_t)
@@ -23002,7 +23077,7 @@
dev_setattr_apm_bios_dev(xdm_t)
dev_rw_dri(xdm_t)
dev_rw_agp(xdm_t)
-@@ -413,14 +469,17 @@
+@@ -413,14 +468,17 @@
dev_setattr_video_dev(xdm_t)
dev_getattr_scanner_dev(xdm_t)
dev_setattr_scanner_dev(xdm_t)
@@ -23022,7 +23097,7 @@
files_read_etc_files(xdm_t)
files_read_var_files(xdm_t)
-@@ -431,9 +490,13 @@
+@@ -431,9 +489,13 @@
files_read_usr_files(xdm_t)
# Poweroff wants to create the /poweroff file when run from xdm
files_create_boot_flag(xdm_t)
@@ -23036,7 +23111,7 @@
storage_dontaudit_read_fixed_disk(xdm_t)
storage_dontaudit_write_fixed_disk(xdm_t)
-@@ -442,6 +505,7 @@
+@@ -442,6 +504,7 @@
storage_dontaudit_raw_write_removable_device(xdm_t)
storage_dontaudit_setattr_removable_dev(xdm_t)
storage_dontaudit_rw_scsi_generic(xdm_t)
@@ -23044,7 +23119,7 @@
term_setattr_console(xdm_t)
term_use_unallocated_ttys(xdm_t)
-@@ -450,6 +514,7 @@
+@@ -450,6 +513,7 @@
auth_domtrans_pam_console(xdm_t)
auth_manage_pam_pid(xdm_t)
auth_manage_pam_console_data(xdm_t)
@@ -23052,7 +23127,7 @@
auth_rw_faillog(xdm_t)
auth_write_login_records(xdm_t)
-@@ -460,10 +525,10 @@
+@@ -460,10 +524,10 @@
logging_read_generic_logs(xdm_t)
@@ -23065,11 +23140,12 @@
userdom_dontaudit_use_unpriv_user_fds(xdm_t)
userdom_create_all_users_keys(xdm_t)
-@@ -472,6 +537,7 @@
+@@ -472,6 +536,8 @@
# Search /proc for any user domain processes.
userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t)
+userdom_manage_user_tmp_sockets(xdm_t)
++userdom_manage_tmpfs_role(system_r, xdm_t)
xserver_rw_session(xdm_t,xdm_tmpfs_t)
xserver_unconfined(xdm_t)
@@ -23138,7 +23214,7 @@
+')
+
+optional_policy(`
-+ pulseaudio_role(system_r, xdm_t)
++ pulseaudio_exec(xdm_t)
+')
+
+# On crash gdm execs gdb to dump stack
@@ -28022,7 +28098,7 @@
+/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.9/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-01-19 11:07:34.000000000 -0500
-+++ serefpolicy-3.6.9/policy/modules/system/userdomain.if 2009-03-12 13:35:00.000000000 -0400
++++ serefpolicy-3.6.9/policy/modules/system/userdomain.if 2009-03-17 14:38:03.000000000 -0400
@@ -30,8 +30,9 @@
')
@@ -29962,8 +30038,8 @@
+# No application file contexts.
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virtual.if serefpolicy-3.6.9/policy/modules/system/virtual.if
--- nsaserefpolicy/policy/modules/system/virtual.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.9/policy/modules/system/virtual.if 2009-03-12 13:35:00.000000000 -0400
-@@ -0,0 +1,99 @@
++++ serefpolicy-3.6.9/policy/modules/system/virtual.if 2009-03-17 15:49:05.000000000 -0400
+@@ -0,0 +1,118 @@
+## <summary>Virtual machine emulator and virtualizer</summary>
+
+########################################
@@ -30055,7 +30131,7 @@
+#
+interface(`virtual_manage_image',`
+ gen_require(`
-+ type virtual_image_type;
++ attribute virtual_image_type;
+ ')
+
+ manage_dirs_pattern($1, virtual_image_type, virtual_image_type)
@@ -30063,6 +30139,25 @@
+ manage_lnk_files_pattern($1, virtual_image_type, virtual_image_type)
+ rw_blk_files_pattern($1, virtual_image_type, virtual_image_type)
+')
++
++########################################
++## <summary>
++## Allow domain to relabel virt image files
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
++interface(`virtual_manage_relabel',`
++ gen_require(`
++ attribute virtual_image_type;
++ ')
++
++ allow $1 virtual_image_type:file { relabelfrom relabelto };
++')
++
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virtual.te serefpolicy-3.6.9/policy/modules/system/virtual.te
--- nsaserefpolicy/policy/modules/system/virtual.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.9/policy/modules/system/virtual.te 2009-03-12 13:35:00.000000000 -0400
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.806
retrieving revision 1.807
diff -u -r1.806 -r1.807
--- selinux-policy.spec 16 Mar 2009 16:02:20 -0000 1.806
+++ selinux-policy.spec 17 Mar 2009 19:52:35 -0000 1.807
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.6.9
-Release: 2%{?dist}
+Release: 3%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -444,6 +444,9 @@
%endif
%changelog
+* Tue Mar 17 2009 Dan Walsh <dwalsh at redhat.com> 3.6.9-3
+- Change to svirt to only access svirt_image_t
+
* Thu Mar 12 2009 Dan Walsh <dwalsh at redhat.com> 3.6.9-2
- Fix libvirt policy
More information about the fedora-extras-commits
mailing list