rpms/selinux-policy/devel policy-F13.patch, 1.39, 1.40 selinux-policy.spec, 1.960, 1.961
Daniel J Walsh
dwalsh at fedoraproject.org
Wed Jan 27 17:08:59 UTC 2010
Author: dwalsh
Update of /cvs/pkgs/rpms/selinux-policy/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv32142
Modified Files:
policy-F13.patch selinux-policy.spec
Log Message:
* Mon Jan 25 2010 Dan Walsh <dwalsh at redhat.com> 3.7.8-3
- Allow abrt_helper to getattr on all filesystems
- Add label for /opt/real/RealPlayer/plugins/oggfformat\.so
policy-F13.patch:
Makefile | 2
policy/global_tunables | 24
policy/modules/admin/alsa.te | 2
policy/modules/admin/anaconda.te | 3
policy/modules/admin/brctl.te | 2
policy/modules/admin/certwatch.te | 2
policy/modules/admin/consoletype.te | 2
policy/modules/admin/dmesg.fc | 2
policy/modules/admin/dmesg.te | 10
policy/modules/admin/firstboot.te | 6
policy/modules/admin/kismet.te | 5
policy/modules/admin/logrotate.te | 28
policy/modules/admin/logwatch.te | 8
policy/modules/admin/mrtg.te | 1
policy/modules/admin/netutils.te | 4
policy/modules/admin/portage.te | 2
policy/modules/admin/prelink.fc | 1
policy/modules/admin/prelink.if | 23
policy/modules/admin/prelink.te | 77 +
policy/modules/admin/readahead.te | 1
policy/modules/admin/rpm.fc | 21
policy/modules/admin/rpm.if | 344 ++++++
policy/modules/admin/rpm.te | 98 +
policy/modules/admin/shorewall.fc | 5
policy/modules/admin/shorewall.if | 40
policy/modules/admin/shorewall.te | 9
policy/modules/admin/smoltclient.fc | 4
policy/modules/admin/smoltclient.if | 1
policy/modules/admin/smoltclient.te | 66 +
policy/modules/admin/sudo.if | 13
policy/modules/admin/tmpreaper.te | 12
policy/modules/admin/usermanage.if | 11
policy/modules/admin/usermanage.te | 35
policy/modules/admin/vbetool.te | 14
policy/modules/admin/vpn.te | 4
policy/modules/apps/chrome.fc | 2
policy/modules/apps/chrome.if | 86 +
policy/modules/apps/chrome.te | 82 +
policy/modules/apps/cpufreqselector.te | 2
policy/modules/apps/execmem.fc | 42
policy/modules/apps/execmem.if | 103 +
policy/modules/apps/execmem.te | 11
policy/modules/apps/firewallgui.fc | 3
policy/modules/apps/firewallgui.if | 23
policy/modules/apps/firewallgui.te | 62 +
policy/modules/apps/gitosis.if | 44
policy/modules/apps/gnome.fc | 21
policy/modules/apps/gnome.if | 221 +++
policy/modules/apps/gnome.te | 116 +-
policy/modules/apps/gpg.fc | 1
policy/modules/apps/gpg.te | 8
policy/modules/apps/java.fc | 23
policy/modules/apps/java.if | 113 +
policy/modules/apps/java.te | 18
policy/modules/apps/kdumpgui.fc | 2
policy/modules/apps/kdumpgui.if | 2
policy/modules/apps/kdumpgui.te | 64 +
policy/modules/apps/livecd.fc | 2
policy/modules/apps/livecd.if | 52
policy/modules/apps/livecd.te | 27
policy/modules/apps/loadkeys.te | 6
policy/modules/apps/mono.fc | 2
policy/modules/apps/mono.if | 101 +
policy/modules/apps/mono.te | 9
policy/modules/apps/mozilla.fc | 2
policy/modules/apps/mozilla.if | 27
policy/modules/apps/mozilla.te | 22
policy/modules/apps/nsplugin.fc | 10
policy/modules/apps/nsplugin.if | 321 +++++
policy/modules/apps/nsplugin.te | 296 +++++
policy/modules/apps/openoffice.fc | 3
policy/modules/apps/openoffice.if | 92 +
policy/modules/apps/openoffice.te | 11
policy/modules/apps/podsleuth.te | 3
policy/modules/apps/ptchown.if | 24
policy/modules/apps/pulseaudio.fc | 3
policy/modules/apps/pulseaudio.if | 60 +
policy/modules/apps/pulseaudio.te | 19
policy/modules/apps/qemu.fc | 4
policy/modules/apps/qemu.if | 189 +++
policy/modules/apps/qemu.te | 83 +
policy/modules/apps/sambagui.fc | 1
policy/modules/apps/sambagui.if | 2
policy/modules/apps/sambagui.te | 61 +
policy/modules/apps/sandbox.fc | 1
policy/modules/apps/sandbox.if | 225 +++
policy/modules/apps/sandbox.te | 345 ++++++
policy/modules/apps/screen.if | 1
policy/modules/apps/sectoolm.fc | 6
policy/modules/apps/sectoolm.if | 3
policy/modules/apps/sectoolm.te | 118 ++
policy/modules/apps/seunshare.if | 2
policy/modules/apps/seunshare.te | 3
policy/modules/apps/slocate.te | 1
policy/modules/apps/vmware.if | 19
policy/modules/apps/wine.fc | 24
policy/modules/apps/wine.if | 118 ++
policy/modules/apps/wine.te | 50
policy/modules/kernel/corecommands.fc | 33
policy/modules/kernel/corecommands.if | 21
policy/modules/kernel/corenetwork.te.in | 46
policy/modules/kernel/devices.fc | 6
policy/modules/kernel/devices.if | 90 +
policy/modules/kernel/devices.te | 12
policy/modules/kernel/domain.if | 174 ++-
policy/modules/kernel/domain.te | 103 +
policy/modules/kernel/files.fc | 9
policy/modules/kernel/files.if | 483 ++++++++
policy/modules/kernel/files.te | 12
policy/modules/kernel/filesystem.if | 232 ++++
policy/modules/kernel/filesystem.te | 8
policy/modules/kernel/kernel.if | 58 +
policy/modules/kernel/kernel.te | 27
policy/modules/kernel/selinux.if | 25
policy/modules/kernel/storage.fc | 1
policy/modules/kernel/storage.if | 1
policy/modules/kernel/terminal.if | 27
policy/modules/roles/guest.te | 8
policy/modules/roles/staff.te | 124 --
policy/modules/roles/sysadm.te | 125 --
policy/modules/roles/unconfineduser.fc | 8
policy/modules/roles/unconfineduser.if | 667 +++++++++++
policy/modules/roles/unconfineduser.te | 445 +++++++
policy/modules/roles/unprivuser.te | 127 --
policy/modules/roles/xguest.te | 72 +
policy/modules/services/abrt.fc | 8
policy/modules/services/abrt.if | 139 ++
policy/modules/services/abrt.te | 128 ++
policy/modules/services/afs.fc | 2
policy/modules/services/afs.te | 6
policy/modules/services/aiccu.fc | 5
policy/modules/services/aiccu.if | 119 ++
policy/modules/services/aiccu.te | 41
policy/modules/services/aisexec.fc | 12
policy/modules/services/aisexec.if | 106 +
policy/modules/services/aisexec.te | 112 +
policy/modules/services/amavis.te | 1
policy/modules/services/apache.fc | 55
policy/modules/services/apache.if | 511 ++++++---
policy/modules/services/apache.te | 474 +++++++-
policy/modules/services/apm.te | 4
policy/modules/services/arpwatch.te | 3
policy/modules/services/asterisk.if | 53
policy/modules/services/asterisk.te | 42
policy/modules/services/automount.te | 2
policy/modules/services/avahi.fc | 2
policy/modules/services/avahi.te | 13
policy/modules/services/bind.if | 61 +
policy/modules/services/bluetooth.te | 1
policy/modules/services/ccs.fc | 8
policy/modules/services/ccs.te | 33
policy/modules/services/certmaster.fc | 1
policy/modules/services/certmonger.fc | 6
policy/modules/services/certmonger.if | 217 +++
policy/modules/services/certmonger.te | 74 +
policy/modules/services/cgroup.fc | 7
policy/modules/services/cgroup.if | 35
policy/modules/services/cgroup.te | 87 +
policy/modules/services/chronyd.fc | 11
policy/modules/services/chronyd.if | 105 +
policy/modules/services/chronyd.te | 67 +
policy/modules/services/clamav.te | 5
policy/modules/services/clogd.fc | 4
policy/modules/services/clogd.if | 98 +
policy/modules/services/clogd.te | 62 +
policy/modules/services/cobbler.fc | 9
policy/modules/services/cobbler.if | 186 +++
policy/modules/services/cobbler.te | 127 ++
policy/modules/services/consolekit.fc | 3
policy/modules/services/consolekit.if | 39
policy/modules/services/consolekit.te | 23
policy/modules/services/corosync.fc | 13
policy/modules/services/corosync.if | 108 +
policy/modules/services/corosync.te | 108 +
policy/modules/services/cron.fc | 6
policy/modules/services/cron.if | 74 +
policy/modules/services/cron.te | 84 +
policy/modules/services/cups.fc | 14
policy/modules/services/cups.te | 57 -
policy/modules/services/cvs.te | 1
policy/modules/services/cyrus.te | 2
policy/modules/services/dbus.if | 53
policy/modules/services/dbus.te | 31
policy/modules/services/denyhosts.fc | 7
policy/modules/services/denyhosts.if | 90 +
policy/modules/services/denyhosts.te | 72 +
policy/modules/services/devicekit.fc | 3
policy/modules/services/devicekit.if | 20
policy/modules/services/devicekit.te | 78 +
policy/modules/services/dhcp.if | 19
policy/modules/services/dnsmasq.fc | 1
policy/modules/services/dnsmasq.if | 38
policy/modules/services/dnsmasq.te | 19
policy/modules/services/dovecot.fc | 1
policy/modules/services/dovecot.te | 33
policy/modules/services/exim.te | 4
policy/modules/services/fail2ban.if | 58 +
policy/modules/services/fetchmail.te | 1
policy/modules/services/fprintd.te | 2
policy/modules/services/ftp.if | 38
policy/modules/services/ftp.te | 176 ++-
policy/modules/services/git.fc | 19
policy/modules/services/git.if | 536 +++++++++
policy/modules/services/git.te | 179 +++
policy/modules/services/gpsd.te | 2
policy/modules/services/hal.fc | 1
policy/modules/services/hal.if | 18
policy/modules/services/hal.te | 51
policy/modules/services/howl.te | 2
policy/modules/services/kerberos.if | 6
policy/modules/services/kerberos.te | 3
policy/modules/services/ksmtuned.fc | 5
policy/modules/services/ksmtuned.if | 76 +
policy/modules/services/ksmtuned.te | 44
policy/modules/services/ktalk.te | 1
policy/modules/services/ldap.fc | 2
policy/modules/services/ldap.if | 38
policy/modules/services/lircd.te | 18
policy/modules/services/mailman.fc | 8
policy/modules/services/memcached.te | 10
policy/modules/services/modemmanager.te | 5
policy/modules/services/mta.fc | 2
policy/modules/services/mta.if | 25
policy/modules/services/mta.te | 15
policy/modules/services/munin.fc | 3
policy/modules/services/munin.te | 6
policy/modules/services/mysql.if | 38
policy/modules/services/mysql.te | 22
policy/modules/services/nagios.fc | 79 +
policy/modules/services/nagios.if | 126 ++
policy/modules/services/nagios.te | 207 +++
policy/modules/services/networkmanager.fc | 16
policy/modules/services/networkmanager.if | 65 +
policy/modules/services/networkmanager.te | 120 +-
policy/modules/services/nis.fc | 5
policy/modules/services/nis.if | 87 +
policy/modules/services/nis.te | 13
policy/modules/services/nscd.if | 20
policy/modules/services/nscd.te | 23
policy/modules/services/ntop.fc | 1
policy/modules/services/ntop.te | 34
policy/modules/services/ntp.te | 2
policy/modules/services/nut.fc | 16
policy/modules/services/nut.if | 58 +
policy/modules/services/nut.te | 188 +++
policy/modules/services/nx.fc | 10
policy/modules/services/nx.if | 67 +
policy/modules/services/nx.te | 13
policy/modules/services/oddjob.if | 1
policy/modules/services/oddjob.te | 5
policy/modules/services/openvpn.te | 7
policy/modules/services/pcscd.if | 38
policy/modules/services/pegasus.te | 28
policy/modules/services/plymouth.fc | 5
policy/modules/services/plymouth.if | 322 +++++
policy/modules/services/plymouth.te | 101 +
policy/modules/services/policykit.fc | 5
policy/modules/services/policykit.if | 71 +
policy/modules/services/policykit.te | 71 +
policy/modules/services/portreserve.te | 3
policy/modules/services/postfix.fc | 2
policy/modules/services/postfix.if | 150 ++
policy/modules/services/postfix.te | 144 ++
policy/modules/services/postgresql.fc | 16
policy/modules/services/postgresql.if | 60 +
policy/modules/services/postgresql.te | 9
policy/modules/services/ppp.if | 4
policy/modules/services/ppp.te | 3
policy/modules/services/prelude.te | 3
policy/modules/services/procmail.te | 12
policy/modules/services/puppet.te | 2
policy/modules/services/pyzor.fc | 4
policy/modules/services/pyzor.if | 47
policy/modules/services/pyzor.te | 37
policy/modules/services/razor.fc | 1
policy/modules/services/razor.if | 42
policy/modules/services/razor.te | 32
policy/modules/services/rdisc.if | 19
policy/modules/services/rgmanager.fc | 8
policy/modules/services/rgmanager.if | 59 +
policy/modules/services/rgmanager.te | 186 +++
policy/modules/services/rhcs.fc | 22
policy/modules/services/rhcs.if | 367 ++++++
policy/modules/services/rhcs.te | 410 +++++++
policy/modules/services/ricci.te | 31
policy/modules/services/rpc.fc | 4
policy/modules/services/rpc.if | 45
policy/modules/services/rpc.te | 27
policy/modules/services/rsync.fc | 1
policy/modules/services/rsync.if | 38
policy/modules/services/rsync.te | 28
policy/modules/services/rtkit.if | 20
policy/modules/services/rtkit.te | 4
policy/modules/services/samba.fc | 4
policy/modules/services/samba.if | 138 ++
policy/modules/services/samba.te | 109 +
policy/modules/services/sasl.te | 15
policy/modules/services/sendmail.if | 19
policy/modules/services/sendmail.te | 17
policy/modules/services/setroubleshoot.fc | 2
policy/modules/services/setroubleshoot.if | 124 ++
policy/modules/services/setroubleshoot.te | 83 +
policy/modules/services/snmp.if | 18
policy/modules/services/snmp.te | 2
policy/modules/services/snort.te | 9
policy/modules/services/spamassassin.fc | 15
policy/modules/services/spamassassin.if | 107 +
policy/modules/services/spamassassin.te | 139 ++
policy/modules/services/squid.te | 9
policy/modules/services/ssh.fc | 2
policy/modules/services/ssh.if | 59 -
policy/modules/services/ssh.te | 59 -
policy/modules/services/sssd.fc | 2
policy/modules/services/sssd.if | 47
policy/modules/services/sssd.te | 15
policy/modules/services/sysstat.te | 5
policy/modules/services/telnet.te | 1
policy/modules/services/tftp.if | 38
policy/modules/services/tftp.te | 3
policy/modules/services/tgtd.if | 17
policy/modules/services/tgtd.te | 2
policy/modules/services/tor.te | 13
policy/modules/services/tuned.te | 1
policy/modules/services/uucp.te | 5
policy/modules/services/vhostmd.fc | 6
policy/modules/services/vhostmd.if | 228 ++++
policy/modules/services/vhostmd.te | 84 +
policy/modules/services/virt.fc | 17
policy/modules/services/virt.if | 210 +++
policy/modules/services/virt.te | 297 ++++-
policy/modules/services/w3c.te | 7
policy/modules/services/xserver.fc | 49
policy/modules/services/xserver.if | 362 ++++++
policy/modules/services/xserver.te | 370 +++++-
policy/modules/services/zebra.if | 20
policy/modules/system/application.te | 7
policy/modules/system/authlogin.fc | 9
policy/modules/system/authlogin.if | 210 +++
policy/modules/system/authlogin.te | 11
policy/modules/system/fstools.fc | 3
policy/modules/system/fstools.te | 5
policy/modules/system/getty.te | 7
policy/modules/system/hotplug.te | 4
policy/modules/system/init.fc | 7
policy/modules/system/init.if | 164 ++
policy/modules/system/init.te | 304 ++++-
policy/modules/system/ipsec.fc | 4
policy/modules/system/ipsec.if | 65 -
policy/modules/system/ipsec.te | 31
policy/modules/system/iptables.fc | 9
policy/modules/system/iptables.te | 15
policy/modules/system/iscsi.fc | 4
policy/modules/system/iscsi.te | 14
policy/modules/system/libraries.fc | 221 +++
policy/modules/system/libraries.if | 5
policy/modules/system/libraries.te | 18
policy/modules/system/locallogin.te | 35
policy/modules/system/logging.fc | 12
policy/modules/system/logging.if | 20
policy/modules/system/logging.te | 38
policy/modules/system/lvm.te | 10
policy/modules/system/miscfiles.fc | 3
policy/modules/system/miscfiles.if | 71 +
policy/modules/system/miscfiles.te | 3
policy/modules/system/modutils.te | 20
policy/modules/system/mount.fc | 7
policy/modules/system/mount.if | 59 +
policy/modules/system/mount.te | 95 +
policy/modules/system/raid.te | 2
policy/modules/system/selinuxutil.fc | 17
policy/modules/system/selinuxutil.if | 309 +++++
policy/modules/system/selinuxutil.te | 230 +---
policy/modules/system/sysnetwork.fc | 14
policy/modules/system/sysnetwork.if | 116 +-
policy/modules/system/sysnetwork.te | 80 +
policy/modules/system/udev.if | 1
policy/modules/system/udev.te | 12
policy/modules/system/unconfined.fc | 15
policy/modules/system/unconfined.if | 445 -------
policy/modules/system/unconfined.te | 224 ---
policy/modules/system/userdomain.fc | 9
policy/modules/system/userdomain.if | 1696 +++++++++++++++++++++++-------
policy/modules/system/userdomain.te | 51
policy/modules/system/xen.if | 19
policy/modules/system/xen.te | 20
policy/support/obj_perm_sets.spt | 25
policy/users | 17
387 files changed, 21090 insertions(+), 2751 deletions(-)
Index: policy-F13.patch
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/devel/policy-F13.patch,v
retrieving revision 1.39
retrieving revision 1.40
diff -u -p -r1.39 -r1.40
--- policy-F13.patch 22 Jan 2010 15:26:38 -0000 1.39
+++ policy-F13.patch 27 Jan 2010 17:08:59 -0000 1.40
@@ -1428,8 +1428,8 @@ diff --exclude-from=exclude -N -u -r nsa
+## <summary>The Fedora hardware profiler client</summary>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/smoltclient.te serefpolicy-3.7.8/policy/modules/admin/smoltclient.te
--- nsaserefpolicy/policy/modules/admin/smoltclient.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/admin/smoltclient.te 2010-01-18 15:18:03.000000000 -0500
-@@ -0,0 +1,64 @@
++++ serefpolicy-3.7.8/policy/modules/admin/smoltclient.te 2010-01-27 09:39:20.000000000 -0500
+@@ -0,0 +1,66 @@
+policy_module(smoltclient,1.0.0)
+
+########################################
@@ -1469,8 +1469,6 @@ diff --exclude-from=exclude -N -u -r nsa
+
+corenet_tcp_connect_http_port(smoltclient_t)
+
-+auth_use_nsswitch(smoltclient_t)
-+
+dev_read_sysfs(smoltclient_t)
+
+fs_getattr_all_fs(smoltclient_t)
@@ -1480,6 +1478,10 @@ diff --exclude-from=exclude -N -u -r nsa
+files_read_etc_files(smoltclient_t)
+files_read_usr_files(smoltclient_t)
+
++auth_use_nsswitch(smoltclient_t)
++
++logging_send_syslog_msg(smoltclient_t)
++
+miscfiles_read_localization(smoltclient_t)
+
+optional_policy(`
@@ -2257,8 +2259,8 @@ diff --exclude-from=exclude -N -u -r nsa
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gitosis.if serefpolicy-3.7.8/policy/modules/apps/gitosis.if
--- nsaserefpolicy/policy/modules/apps/gitosis.if 2009-09-09 09:23:16.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/apps/gitosis.if 2010-01-18 15:18:03.000000000 -0500
-@@ -43,3 +43,48 @@
++++ serefpolicy-3.7.8/policy/modules/apps/gitosis.if 2010-01-26 09:29:35.000000000 -0500
+@@ -43,3 +43,47 @@
role $2 types gitosis_t;
')
@@ -2276,8 +2278,7 @@ diff --exclude-from=exclude -N -u -r nsa
+interface(`gitosis_read_var_lib',`
+ gen_require(`
+ type gitosis_var_lib_t;
-+
-+')
++ ')
+
+ files_search_var_lib($1)
+ read_files_pattern($1, gitosis_var_lib_t, gitosis_var_lib_t)
@@ -2340,8 +2341,33 @@ diff --exclude-from=exclude -N -u -r nsa
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.7.8/policy/modules/apps/gnome.if
--- nsaserefpolicy/policy/modules/apps/gnome.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/apps/gnome.if 2010-01-21 11:05:31.000000000 -0500
-@@ -84,10 +84,207 @@
++++ serefpolicy-3.7.8/policy/modules/apps/gnome.if 2010-01-25 12:24:02.000000000 -0500
+@@ -74,6 +74,24 @@
+
+ ########################################
+ ## <summary>
++## Dontaudit search gnome homedir content (.config)
++## </summary>
++## <param name="user_domain">
++## <summary>
++## The type of the user domain.
++## </summary>
++## </param>
++#
++interface(`gnome_dontaudit_search_config',`
++ gen_require(`
++ attribute gnome_home_type;
++ ')
++
++ dontaudit $1 gnome_home_type:dir search_dir_perms;
++')
++
++########################################
++## <summary>
+ ## manage gnome homedir content (.config)
+ ## </summary>
+ ## <param name="user_domain">
+@@ -84,10 +102,207 @@
#
interface(`gnome_manage_config',`
gen_require(`
@@ -5567,6 +5593,32 @@ diff --exclude-from=exclude -N -u -r nsa
# getpwnam
auth_use_nsswitch(locate_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.if serefpolicy-3.7.8/policy/modules/apps/vmware.if
+--- nsaserefpolicy/policy/modules/apps/vmware.if 2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.7.8/policy/modules/apps/vmware.if 2010-01-25 10:36:28.000000000 -0500
+@@ -84,3 +84,22 @@
+ logging_search_logs($1)
+ append_files_pattern($1, vmware_log_t, vmware_log_t)
+ ')
++
++########################################
++## <summary>
++## Execute vmware host executables
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`vmware_exec_host',`
++ gen_require(`
++ type vmware_host_exec_t;
++ ')
++
++ can_exec($1, vmware_host_exec_t)
++')
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.fc serefpolicy-3.7.8/policy/modules/apps/wine.fc
--- nsaserefpolicy/policy/modules/apps/wine.fc 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.7.8/policy/modules/apps/wine.fc 2010-01-18 15:18:03.000000000 -0500
@@ -6069,7 +6121,7 @@ diff --exclude-from=exclude -N -u -r nsa
#network_node(multicast, s0 - mls_systemhigh, ff00::, ff00::)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.7.8/policy/modules/kernel/devices.fc
--- nsaserefpolicy/policy/modules/kernel/devices.fc 2009-11-20 10:51:41.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/kernel/devices.fc 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/kernel/devices.fc 2010-01-27 11:30:22.000000000 -0500
@@ -16,13 +16,16 @@
/dev/audio.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/autofs.* -c gen_context(system_u:object_r:autofs_device_t,s0)
@@ -6087,14 +6139,14 @@ diff --exclude-from=exclude -N -u -r nsa
/dev/event.* -c gen_context(system_u:object_r:event_device_t,s0)
/dev/evtchn -c gen_context(system_u:object_r:xen_device_t,s0)
/dev/fb[0-9]* -c gen_context(system_u:object_r:framebuf_device_t,s0)
-@@ -100,6 +103,7 @@
- /dev/tpm[0-9]* -c gen_context(system_u:object_r:tpm_device_t,s0)
+@@ -101,6 +104,7 @@
/dev/urandom -c gen_context(system_u:object_r:urandom_device_t,s0)
/dev/ub[a-c] -c gen_context(system_u:object_r:usb_device_t,s0)
-+/dev/usbmon.+ -c gen_context(system_u:object_r:usbmon_device_t,s0)
/dev/usb.+ -c gen_context(system_u:object_r:usb_device_t,s0)
++/dev/usbmon.+ -c gen_context(system_u:object_r:usbmon_device_t,s0)
/dev/usblp.* -c gen_context(system_u:object_r:printer_device_t,s0)
ifdef(`distro_suse', `
+ /dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0)
@@ -159,6 +163,8 @@
/dev/usb/mdc800.* -c gen_context(system_u:object_r:scanner_device_t,s0)
/dev/usb/scanner.* -c gen_context(system_u:object_r:scanner_device_t,s0)
@@ -6106,7 +6158,7 @@ diff --exclude-from=exclude -N -u -r nsa
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.7.8/policy/modules/kernel/devices.if
--- nsaserefpolicy/policy/modules/kernel/devices.if 2009-12-18 11:38:25.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/kernel/devices.if 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/kernel/devices.if 2010-01-27 11:29:35.000000000 -0500
@@ -801,6 +801,24 @@
########################################
@@ -6234,23 +6286,18 @@ diff --exclude-from=exclude -N -u -r nsa
## Do not audit attempts to get the attributes
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-3.7.8/policy/modules/kernel/devices.te
--- nsaserefpolicy/policy/modules/kernel/devices.te 2009-12-18 11:38:25.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/kernel/devices.te 2010-01-18 15:18:03.000000000 -0500
-@@ -227,11 +227,23 @@
- genfscon usbdevfs / gen_context(system_u:object_r:usbfs_t,s0)
++++ serefpolicy-3.7.8/policy/modules/kernel/devices.te 2010-01-27 11:29:16.000000000 -0500
+@@ -232,6 +232,18 @@
+ type usb_device_t;
+ dev_node(usb_device_t)
- #
++#
+# usb_device_t is the type for /dev/usbmon
+#
+type usbmon_device_t;
+dev_node(usbmon_device_t)
+
+#
- # usb_device_t is the type for /dev/bus/usb/[0-9]+/[0-9]+
- #
- type usb_device_t;
- dev_node(usb_device_t)
-
-+#
+# userio_device_t is the type for /dev/uio[0-9]+
+#
+type userio_device_t;
@@ -7709,7 +7756,7 @@ diff --exclude-from=exclude -N -u -r nsa
# nfs_t is the default type for NFS file systems
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.7.8/policy/modules/kernel/kernel.if
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2009-11-25 11:47:19.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/kernel/kernel.if 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/kernel/kernel.if 2010-01-27 11:28:51.000000000 -0500
@@ -1849,7 +1849,7 @@
')
@@ -10149,7 +10196,7 @@ diff --exclude-from=exclude -N -u -r nsa
## All of the rules required to administrate
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.te serefpolicy-3.7.8/policy/modules/services/abrt.te
--- nsaserefpolicy/policy/modules/services/abrt.te 2009-09-16 09:09:20.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/services/abrt.te 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/abrt.te 2010-01-26 14:15:44.000000000 -0500
@@ -33,12 +33,24 @@
type abrt_var_run_t;
files_pid_file(abrt_var_run_t)
@@ -10235,7 +10282,7 @@ diff --exclude-from=exclude -N -u -r nsa
sysnet_read_config(abrt_t)
-@@ -96,22 +130,93 @@
+@@ -96,22 +130,96 @@
miscfiles_read_certs(abrt_t)
miscfiles_read_localization(abrt_t)
@@ -10317,9 +10364,12 @@ diff --exclude-from=exclude -N -u -r nsa
+files_dontaudit_all_non_security_leaks(abrt_helper_t)
+
+fs_list_inotifyfs(abrt_helper_t)
++fs_getattr_all_fs(abrt_helper_t)
+
+auth_use_nsswitch(abrt_helper_t)
+
++logging_send_syslog_msg(abrt_helper_t)
++
+miscfiles_read_localization(abrt_helper_t)
+
+userdom_dontaudit_use_user_terminals(abrt_helper_t)
@@ -10806,8 +10856,8 @@ diff --exclude-from=exclude -N -u -r nsa
sysnet_use_ldap(amavis_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.7.8/policy/modules/services/apache.fc
--- nsaserefpolicy/policy/modules/services/apache.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/services/apache.fc 2010-01-18 15:18:03.000000000 -0500
-@@ -2,11 +2,15 @@
++++ serefpolicy-3.7.8/policy/modules/services/apache.fc 2010-01-27 11:16:47.000000000 -0500
+@@ -2,12 +2,17 @@
/etc/apache(2)?(/.*)? gen_context(system_u:object_r:httpd_config_t,s0)
/etc/apache-ssl(2)?(/.*)? gen_context(system_u:object_r:httpd_config_t,s0)
@@ -10823,9 +10873,11 @@ diff --exclude-from=exclude -N -u -r nsa
+/etc/rc\.d/init\.d/httpd -- gen_context(system_u:object_r:httpd_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/lighttpd -- gen_context(system_u:object_r:httpd_initrc_exec_t,s0)
/etc/vhosts -- gen_context(system_u:object_r:httpd_config_t,s0)
++/etc/zabbix/web(/.*)? gen_context(system_u:object_r:httpd_sys_content_rw_t,s0)
/srv/([^/]*/)?www(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
-@@ -21,10 +25,13 @@
+ /srv/gallery2(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
+@@ -21,10 +26,13 @@
/usr/lib(64)?/apache(2)?/suexec(2)? -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0)
/usr/lib(64)?/cgi-bin/(nph-)?cgiwrap(d)? -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0)
/usr/lib(64)?/httpd(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0)
@@ -10839,7 +10891,7 @@ diff --exclude-from=exclude -N -u -r nsa
/usr/sbin/rotatelogs -- gen_context(system_u:object_r:httpd_rotatelogs_exec_t,s0)
/usr/sbin/suexec -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0)
-@@ -32,14 +39,28 @@
+@@ -32,14 +40,28 @@
/usr/sbin/httpd2-.* -- gen_context(system_u:object_r:httpd_exec_t,s0)
')
@@ -10868,7 +10920,7 @@ diff --exclude-from=exclude -N -u -r nsa
/var/cache/php-eaccelerator(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0)
/var/cache/php-mmcache(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0)
/var/cache/rt3(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0)
-@@ -47,16 +68,21 @@
+@@ -47,16 +69,21 @@
/var/lib/cacti/rra(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
/var/lib/dav(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0)
@@ -10890,7 +10942,7 @@ diff --exclude-from=exclude -N -u -r nsa
ifdef(`distro_debian', `
/var/log/horde2(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
')
-@@ -64,11 +90,33 @@
+@@ -64,11 +91,33 @@
/var/run/apache.* gen_context(system_u:object_r:httpd_var_run_t,s0)
/var/run/gcache_port -s gen_context(system_u:object_r:httpd_var_run_t,s0)
/var/run/httpd.* gen_context(system_u:object_r:httpd_var_run_t,s0)
@@ -11652,7 +11704,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.7.8/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/services/apache.te 2010-01-21 15:05:52.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/apache.te 2010-01-27 08:23:39.000000000 -0500
@@ -19,6 +19,8 @@
# Declarations
#
@@ -11955,7 +12007,8 @@ diff --exclude-from=exclude -N -u -r nsa
+## </desc>
+gen_tunable(allow_httpd_mod_auth_pam, false)
+
-+tunable_policy(`allow_httpd_mod_auth_pam',`
+ tunable_policy(`allow_httpd_mod_auth_pam',`
+- auth_domtrans_chk_passwd(httpd_t)
+ auth_domtrans_chkpwd(httpd_t)
+')
+
@@ -11966,8 +12019,7 @@ diff --exclude-from=exclude -N -u -r nsa
+## </desc>
+gen_tunable(allow_httpd_mod_auth_ntlm_winbind, false)
+optional_policy(`
- tunable_policy(`allow_httpd_mod_auth_pam',`
-- auth_domtrans_chk_passwd(httpd_t)
++tunable_policy(`allow_httpd_mod_auth_pam',`
+ samba_domtrans_winbind_helper(httpd_t)
')
')
@@ -12095,7 +12147,7 @@ diff --exclude-from=exclude -N -u -r nsa
cron_system_entry(httpd_t, httpd_exec_t)
')
-@@ -459,8 +617,13 @@
+@@ -459,8 +617,18 @@
')
optional_policy(`
@@ -12106,12 +12158,17 @@ diff --exclude-from=exclude -N -u -r nsa
+ avahi_dbus_chat(httpd_t)
+ ')
+')
++
++optional_policy(`
++ gitosis_read_var_lib(httpd_t)
++')
++
+optional_policy(`
+ kerberos_keytab_template(httpd, httpd_t)
')
optional_policy(`
-@@ -468,22 +631,19 @@
+@@ -468,22 +636,19 @@
mailman_domtrans_cgi(httpd_t)
# should have separate types for public and private archives
mailman_search_data(httpd_t)
@@ -12137,7 +12194,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -494,12 +654,23 @@
+@@ -494,12 +659,23 @@
')
optional_policy(`
@@ -12161,7 +12218,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
')
-@@ -508,6 +679,7 @@
+@@ -508,6 +684,7 @@
')
optional_policy(`
@@ -12169,7 +12226,7 @@ diff --exclude-from=exclude -N -u -r nsa
snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
')
-@@ -535,6 +707,23 @@
+@@ -535,6 +712,23 @@
userdom_use_user_terminals(httpd_helper_t)
@@ -12193,7 +12250,7 @@ diff --exclude-from=exclude -N -u -r nsa
########################################
#
# Apache PHP script local policy
-@@ -564,20 +753,25 @@
+@@ -564,20 +758,25 @@
fs_search_auto_mountpoints(httpd_php_t)
@@ -12225,7 +12282,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -595,23 +789,24 @@
+@@ -595,23 +794,24 @@
append_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
read_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
@@ -12254,7 +12311,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_read_etc_files(httpd_suexec_t)
files_read_usr_files(httpd_suexec_t)
-@@ -624,6 +819,7 @@
+@@ -624,6 +824,7 @@
logging_send_syslog_msg(httpd_suexec_t)
miscfiles_read_localization(httpd_suexec_t)
@@ -12262,7 +12319,7 @@ diff --exclude-from=exclude -N -u -r nsa
tunable_policy(`httpd_can_network_connect',`
allow httpd_suexec_t self:tcp_socket create_stream_socket_perms;
-@@ -631,22 +827,31 @@
+@@ -631,22 +832,31 @@
corenet_all_recvfrom_unlabeled(httpd_suexec_t)
corenet_all_recvfrom_netlabel(httpd_suexec_t)
@@ -12301,7 +12358,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -672,16 +877,16 @@
+@@ -672,16 +882,16 @@
dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
')
@@ -12322,7 +12379,7 @@ diff --exclude-from=exclude -N -u -r nsa
dontaudit httpd_sys_script_t httpd_config_t:dir search;
-@@ -699,12 +904,24 @@
+@@ -699,12 +909,24 @@
# Should we add a boolean?
apache_domtrans_rotatelogs(httpd_sys_script_t)
@@ -12349,7 +12406,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -712,6 +929,35 @@
+@@ -712,6 +934,35 @@
fs_read_nfs_symlinks(httpd_sys_script_t)
')
@@ -12385,7 +12442,7 @@ diff --exclude-from=exclude -N -u -r nsa
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_sys_script_t)
fs_read_cifs_symlinks(httpd_sys_script_t)
-@@ -724,6 +970,10 @@
+@@ -724,6 +975,10 @@
optional_policy(`
mysql_stream_connect(httpd_sys_script_t)
mysql_rw_db_sockets(httpd_sys_script_t)
@@ -12396,7 +12453,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -735,6 +985,8 @@
+@@ -735,6 +990,8 @@
# httpd_rotatelogs local policy
#
@@ -12405,7 +12462,7 @@ diff --exclude-from=exclude -N -u -r nsa
manage_files_pattern(httpd_rotatelogs_t, httpd_log_t, httpd_log_t)
kernel_read_kernel_sysctls(httpd_rotatelogs_t)
-@@ -754,11 +1006,88 @@
+@@ -754,11 +1011,88 @@
tunable_policy(`httpd_enable_cgi && httpd_unified',`
allow httpd_user_script_t httpdcontent:file entrypoint;
@@ -12425,12 +12482,12 @@ diff --exclude-from=exclude -N -u -r nsa
+ userdom_search_user_home_content(httpd_t)
+ userdom_search_user_home_content(httpd_suexec_t)
+ userdom_search_user_home_content(httpd_user_script_t)
- ')
++')
+
+tunable_policy(`httpd_read_user_content',`
+ userdom_read_user_home_content_files(httpd_user_script_t)
+ userdom_read_user_home_content_files(httpd_suexec_t)
-+')
+ ')
+
+tunable_policy(`httpd_read_user_content && httpd_builtin_scripting',`
+ userdom_read_user_home_content_files(httpd_t)
@@ -12513,7 +12570,7 @@ diff --exclude-from=exclude -N -u -r nsa
xserver_domtrans(apmd_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/arpwatch.te serefpolicy-3.7.8/policy/modules/services/arpwatch.te
--- nsaserefpolicy/policy/modules/services/arpwatch.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/services/arpwatch.te 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/arpwatch.te 2010-01-27 11:31:50.000000000 -0500
@@ -34,6 +34,7 @@
allow arpwatch_t self:tcp_socket { connect create_stream_socket_perms };
allow arpwatch_t self:udp_socket create_socket_perms;
@@ -12530,6 +12587,14 @@ diff --exclude-from=exclude -N -u -r nsa
kernel_read_kernel_sysctls(arpwatch_t)
kernel_list_proc(arpwatch_t)
kernel_read_proc_symlinks(arpwatch_t)
+@@ -62,6 +64,7 @@
+ corenet_udp_sendrecv_all_ports(arpwatch_t)
+
+ dev_read_sysfs(arpwatch_t)
++dev_read_usbmon_dev(arpwatch_t)
+
+ fs_getattr_all_fs(arpwatch_t)
+ fs_search_auto_mountpoints(arpwatch_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.if serefpolicy-3.7.8/policy/modules/services/asterisk.if
--- nsaserefpolicy/policy/modules/services/asterisk.if 2009-12-18 11:38:25.000000000 -0500
+++ serefpolicy-3.7.8/policy/modules/services/asterisk.if 2010-01-21 14:59:59.000000000 -0500
@@ -15723,7 +15788,7 @@ diff --exclude-from=exclude -N -u -r nsa
## </summary>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.7.8/policy/modules/services/devicekit.te
--- nsaserefpolicy/policy/modules/services/devicekit.te 2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/services/devicekit.te 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/devicekit.te 2010-01-27 08:37:23.000000000 -0500
@@ -42,6 +42,8 @@
files_read_etc_files(devicekit_t)
@@ -15739,7 +15804,7 @@ diff --exclude-from=exclude -N -u -r nsa
-allow devicekit_disk_t self:capability { chown dac_override fowner fsetid sys_nice sys_ptrace sys_rawio };
+allow devicekit_disk_t self:capability { chown setuid setgid dac_override fowner fsetid net_admin sys_admin sys_nice sys_ptrace sys_rawio };
-+allow devicekit_disk_t self:process signal_perms;
++allow devicekit_disk_t self:process { getsched signal_perms };
allow devicekit_disk_t self:fifo_file rw_fifo_file_perms;
+allow devicekit_disk_t self:netlink_kobject_uevent_socket create_socket_perms;
@@ -15849,19 +15914,20 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -139,9 +174,10 @@
+@@ -139,9 +174,11 @@
# DeviceKit-Power local policy
#
-allow devicekit_power_t self:capability { dac_override sys_tty_config sys_nice sys_ptrace };
+allow devicekit_power_t self:capability { dac_override net_admin sys_admin sys_tty_config sys_nice sys_ptrace };
++allow devicekit_power_t self:process getsched;
allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
+allow devicekit_power_t self:netlink_kobject_uevent_socket create_socket_perms;
manage_dirs_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t)
manage_files_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t)
-@@ -151,6 +187,7 @@
+@@ -151,6 +188,7 @@
kernel_read_system_state(devicekit_power_t)
kernel_rw_hotplug_sysctls(devicekit_power_t)
kernel_rw_kernel_sysctl(devicekit_power_t)
@@ -15869,7 +15935,7 @@ diff --exclude-from=exclude -N -u -r nsa
corecmd_exec_bin(devicekit_power_t)
corecmd_exec_shell(devicekit_power_t)
-@@ -159,6 +196,7 @@
+@@ -159,6 +197,7 @@
domain_read_all_domains_state(devicekit_power_t)
@@ -15877,7 +15943,7 @@ diff --exclude-from=exclude -N -u -r nsa
dev_rw_generic_usb_dev(devicekit_power_t)
dev_rw_netcontrol(devicekit_power_t)
dev_rw_sysfs(devicekit_power_t)
-@@ -167,12 +205,17 @@
+@@ -167,12 +206,17 @@
files_read_etc_files(devicekit_power_t)
files_read_usr_files(devicekit_power_t)
@@ -15895,7 +15961,7 @@ diff --exclude-from=exclude -N -u -r nsa
userdom_read_all_users_state(devicekit_power_t)
optional_policy(`
-@@ -180,6 +223,10 @@
+@@ -180,6 +224,10 @@
')
optional_policy(`
@@ -15906,7 +15972,7 @@ diff --exclude-from=exclude -N -u -r nsa
dbus_system_bus_client(devicekit_power_t)
allow devicekit_power_t devicekit_t:dbus send_msg;
-@@ -203,17 +250,23 @@
+@@ -203,17 +251,23 @@
optional_policy(`
hal_domtrans_mac(devicekit_power_t)
@@ -16078,8 +16144,8 @@ diff --exclude-from=exclude -N -u -r nsa
/var/spool/dovecot(/.*)? gen_context(system_u:object_r:dovecot_spool_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.7.8/policy/modules/services/dovecot.te
--- nsaserefpolicy/policy/modules/services/dovecot.te 2010-01-07 14:53:53.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/services/dovecot.te 2010-01-18 15:18:03.000000000 -0500
-@@ -73,8 +73,14 @@
++++ serefpolicy-3.7.8/policy/modules/services/dovecot.te 2010-01-27 10:51:08.000000000 -0500
+@@ -73,14 +73,21 @@
can_exec(dovecot_t, dovecot_exec_t)
@@ -16095,7 +16161,14 @@ diff --exclude-from=exclude -N -u -r nsa
manage_dirs_pattern(dovecot_t, dovecot_spool_t, dovecot_spool_t)
manage_files_pattern(dovecot_t, dovecot_spool_t, dovecot_spool_t)
-@@ -103,6 +109,7 @@
+ manage_lnk_files_pattern(dovecot_t, dovecot_spool_t, dovecot_spool_t)
+
+ manage_files_pattern(dovecot_t, dovecot_var_run_t, dovecot_var_run_t)
++manage_lnk_files_pattern(dovecot_t, dovecot_var_run_t, dovecot_var_run_t)
+ manage_sock_files_pattern(dovecot_t, dovecot_var_run_t, dovecot_var_run_t)
+ files_pid_filetrans(dovecot_t, dovecot_var_run_t, file)
+
+@@ -103,6 +110,7 @@
dev_read_urand(dovecot_t)
fs_getattr_all_fs(dovecot_t)
@@ -16103,7 +16176,7 @@ diff --exclude-from=exclude -N -u -r nsa
fs_search_auto_mountpoints(dovecot_t)
fs_list_inotifyfs(dovecot_t)
-@@ -142,6 +149,10 @@
+@@ -142,6 +150,10 @@
')
optional_policy(`
@@ -16114,7 +16187,7 @@ diff --exclude-from=exclude -N -u -r nsa
seutil_sigchld_newrole(dovecot_t)
')
-@@ -172,11 +183,6 @@
+@@ -172,11 +184,6 @@
manage_files_pattern(dovecot_auth_t, dovecot_auth_tmp_t, dovecot_auth_tmp_t)
files_tmp_filetrans(dovecot_auth_t, dovecot_auth_tmp_t, { file dir })
@@ -16126,7 +16199,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow dovecot_auth_t dovecot_var_run_t:dir list_dir_perms;
manage_sock_files_pattern(dovecot_auth_t, dovecot_var_run_t, dovecot_var_run_t)
dovecot_stream_connect_auth(dovecot_auth_t)
-@@ -197,8 +203,9 @@
+@@ -197,8 +204,9 @@
files_search_pids(dovecot_auth_t)
files_read_usr_files(dovecot_auth_t)
files_read_usr_symlinks(dovecot_auth_t)
@@ -16137,7 +16210,7 @@ diff --exclude-from=exclude -N -u -r nsa
init_rw_utmp(dovecot_auth_t)
-@@ -225,6 +232,7 @@
+@@ -225,6 +233,7 @@
')
optional_policy(`
@@ -16145,7 +16218,7 @@ diff --exclude-from=exclude -N -u -r nsa
postfix_search_spool(dovecot_auth_t)
')
-@@ -234,6 +242,8 @@
+@@ -234,6 +243,8 @@
#
allow dovecot_deliver_t self:unix_dgram_socket create_socket_perms;
@@ -16154,7 +16227,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow dovecot_deliver_t dovecot_etc_t:file read_file_perms;
allow dovecot_deliver_t dovecot_var_run_t:dir list_dir_perms;
-@@ -263,11 +273,19 @@
+@@ -263,11 +274,19 @@
userdom_user_home_dir_filetrans_user_home_content(dovecot_deliver_t, { dir file lnk_file fifo_file sock_file })
tunable_policy(`use_nfs_home_dirs',`
@@ -17900,7 +17973,7 @@ diff --exclude-from=exclude -N -u -r nsa
+term_dontaudit_use_console(memcached_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/modemmanager.te serefpolicy-3.7.8/policy/modules/services/modemmanager.te
--- nsaserefpolicy/policy/modules/services/modemmanager.te 2009-12-18 11:38:25.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/services/modemmanager.te 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/modemmanager.te 2010-01-27 08:38:46.000000000 -0500
@@ -16,8 +16,8 @@
#
# ModemManager local policy
@@ -17908,7 +17981,7 @@ diff --exclude-from=exclude -N -u -r nsa
-
-allow modemmanager_t self:process signal;
+allow modemmanager_t self:capability { sys_admin sys_tty_config };
-+allow modemmanager_t self:process signal;
++allow modemmanager_t self:process { getsched signal };
allow modemmanager_t self:fifo_file rw_file_perms;
allow modemmanager_t self:unix_stream_socket create_stream_socket_perms;
allow modemmanager_t self:netlink_kobject_uevent_socket create_socket_perms;
@@ -18209,7 +18282,7 @@ diff --exclude-from=exclude -N -u -r nsa
mysql_write_log(mysqld_safe_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.fc serefpolicy-3.7.8/policy/modules/services/nagios.fc
--- nsaserefpolicy/policy/modules/services/nagios.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/services/nagios.fc 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/nagios.fc 2010-01-27 08:48:15.000000000 -0500
@@ -1,16 +1,85 @@
/etc/nagios(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0)
/etc/nagios/nrpe\.cfg -- gen_context(system_u:object_r:nrpe_etc_t,s0)
@@ -18244,8 +18317,8 @@ diff --exclude-from=exclude -N -u -r nsa
+# check disk plugins
+/usr/lib(64)?/nagios/plugins/check_disk -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0)
+/usr/lib(64)?/nagios/plugins/check_disk_smb -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0)
-+/usr/lib(64)?/nagios/plugins/check_ide_smart -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0)
-+/usr/lib(64)?/nagios/plugins/check_linux_raid -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0)
++/usr/lib(64)?/nagios/plugins/check_ide_smart -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0)
++/usr/lib(64)?/nagios/plugins/check_linux_raid -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0)
+
+# system plugins
+/usr/lib(64)?/nagios/plugins/check_breeze -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
@@ -18461,7 +18534,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.7.8/policy/modules/services/nagios.te
--- nsaserefpolicy/policy/modules/services/nagios.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/services/nagios.te 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/nagios.te 2010-01-27 08:54:01.000000000 -0500
@@ -6,17 +6,23 @@
# Declarations
#
@@ -18571,7 +18644,16 @@ diff --exclude-from=exclude -N -u -r nsa
fs_getattr_all_fs(nagios_t)
fs_search_auto_mountpoints(nagios_t)
-@@ -127,52 +172,59 @@
+@@ -118,61 +163,63 @@
+ udev_read_db(nagios_t)
+ ')
+
+-# cjp: leaked file descriptors:
+-# for open file handles
+-#dontaudit system_mail_t nagios_etc_t:file read;
+-#dontaudit system_mail_t nagios_log_t:fifo_file read;
+-
+ ########################################
#
# Nagios CGI local policy
#
@@ -18581,46 +18663,46 @@ diff --exclude-from=exclude -N -u -r nsa
-allow nagios_cgi_t self:process signal_perms;
-allow nagios_cgi_t self:fifo_file rw_fifo_file_perms;
-+allow httpd_nagios_script_t self:process signal_perms;
-
+-
-read_files_pattern(nagios_cgi_t, nagios_t, nagios_t)
-read_lnk_files_pattern(nagios_cgi_t, nagios_t, nagios_t)
-+read_files_pattern(httpd_nagios_script_t, nagios_t, nagios_t)
-+read_lnk_files_pattern(httpd_nagios_script_t, nagios_t, nagios_t)
++allow httpd_nagios_script_t self:process signal_perms;
-allow nagios_cgi_t nagios_etc_t:dir list_dir_perms;
-read_files_pattern(nagios_cgi_t, nagios_etc_t, nagios_etc_t)
-read_lnk_files_pattern(nagios_cgi_t, nagios_etc_t, nagios_etc_t)
-+files_search_spool(httpd_nagios_script_t)
-+rw_fifo_files_pattern(httpd_nagios_script_t, nagios_spool_t, nagios_spool_t)
++read_files_pattern(httpd_nagios_script_t, nagios_t, nagios_t)
++read_lnk_files_pattern(httpd_nagios_script_t, nagios_t, nagios_t)
-allow nagios_cgi_t nagios_log_t:dir list_dir_perms;
-read_files_pattern(nagios_cgi_t, nagios_etc_t, nagios_log_t)
-read_lnk_files_pattern(nagios_cgi_t, nagios_etc_t, nagios_log_t)
++files_search_spool(httpd_nagios_script_t)
++rw_fifo_files_pattern(httpd_nagios_script_t, nagios_spool_t, nagios_spool_t)
+
+-kernel_read_system_state(nagios_cgi_t)
+allow httpd_nagios_script_t nagios_etc_t:dir list_dir_perms;
+read_files_pattern(httpd_nagios_script_t, nagios_etc_t, nagios_etc_t)
+read_lnk_files_pattern(httpd_nagios_script_t, nagios_etc_t, nagios_etc_t)
--kernel_read_system_state(nagios_cgi_t)
+-corecmd_exec_bin(nagios_cgi_t)
+allow httpd_nagios_script_t nagios_log_t:dir list_dir_perms;
+read_files_pattern(httpd_nagios_script_t, nagios_etc_t, nagios_log_t)
+read_lnk_files_pattern(httpd_nagios_script_t, nagios_etc_t, nagios_log_t)
--corecmd_exec_bin(nagios_cgi_t)
-+kernel_read_system_state(httpd_nagios_script_t)
-
-domain_dontaudit_read_all_domains_state(nagios_cgi_t)
-+domain_dontaudit_read_all_domains_state(httpd_nagios_script_t)
++kernel_read_system_state(httpd_nagios_script_t)
-files_read_etc_files(nagios_cgi_t)
-files_read_etc_runtime_files(nagios_cgi_t)
-files_read_kernel_symbol_table(nagios_cgi_t)
-+files_read_etc_runtime_files(httpd_nagios_script_t)
-+files_read_kernel_symbol_table(httpd_nagios_script_t)
++domain_dontaudit_read_all_domains_state(httpd_nagios_script_t)
-logging_send_syslog_msg(nagios_cgi_t)
-logging_search_logs(nagios_cgi_t)
--
++files_read_etc_runtime_files(httpd_nagios_script_t)
++files_read_kernel_symbol_table(httpd_nagios_script_t)
+
-miscfiles_read_localization(nagios_cgi_t)
-
-optional_policy(`
@@ -18633,15 +18715,17 @@ diff --exclude-from=exclude -N -u -r nsa
# Nagios remote plugin executor local policy
#
-+allow nrpe_t self:capability {setuid setgid};
- dontaudit nrpe_t self:capability sys_tty_config;
- allow nrpe_t self:process { setpgid signal_perms };
+-dontaudit nrpe_t self:capability sys_tty_config;
+-allow nrpe_t self:process { setpgid signal_perms };
++allow nrpe_t self:capability { setuid setgid };
++dontaudit nrpe_t self:capability {sys_tty_config sys_resource};
++allow nrpe_t self:process { setpgid signal_perms setsched setrlimit };
allow nrpe_t self:fifo_file rw_fifo_file_perms;
+allow nrpe_t self:tcp_socket create_stream_socket_perms;
++
++domtrans_pattern(nrpe_t, nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t)
-allow nrpe_t nrpe_etc_t:file read_file_perms;
-+domtrans_pattern(nrpe_t, nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t)
-+
+read_files_pattern(nrpe_t, nagios_etc_t, nagios_etc_t)
files_search_etc(nrpe_t)
@@ -18656,7 +18740,7 @@ diff --exclude-from=exclude -N -u -r nsa
kernel_read_system_state(nrpe_t)
kernel_read_kernel_sysctls(nrpe_t)
-@@ -183,11 +235,15 @@
+@@ -183,15 +230,21 @@
dev_read_urand(nrpe_t)
domain_use_interactive_fds(nrpe_t)
@@ -18672,7 +18756,13 @@ diff --exclude-from=exclude -N -u -r nsa
logging_send_syslog_msg(nrpe_t)
miscfiles_read_localization(nrpe_t)
-@@ -209,3 +265,84 @@
+
++mta_send_mail(nrpe_t)
++
+ userdom_dontaudit_use_unpriv_user_fds(nrpe_t)
+
+ optional_policy(`
+@@ -209,3 +262,85 @@
optional_policy(`
udev_read_db(nrpe_t)
')
@@ -18734,6 +18824,7 @@ diff --exclude-from=exclude -N -u -r nsa
+#
+
+allow nagios_system_plugin_t self:capability dac_override;
++dontaudit nagios_system_plugin_t self:capability { setuid setgid };
+
+# check_log
+manage_files_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_system_plugin_tmp_t)
@@ -20448,8 +20539,8 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plymouth.te serefpolicy-3.7.8/policy/modules/services/plymouth.te
--- nsaserefpolicy/policy/modules/services/plymouth.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/services/plymouth.te 2010-01-18 15:18:03.000000000 -0500
-@@ -0,0 +1,98 @@
++++ serefpolicy-3.7.8/policy/modules/services/plymouth.te 2010-01-27 10:37:10.000000000 -0500
+@@ -0,0 +1,101 @@
+policy_module(plymouthd, 1.0.0)
+
+########################################
@@ -20528,6 +20619,7 @@ diff --exclude-from=exclude -N -u -r nsa
+allow plymouth_t self:fifo_file rw_file_perms;
+allow plymouth_t self:unix_stream_socket create_stream_socket_perms;
+
++kernel_read_system_state(plymouth_t)
+kernel_stream_connect(plymouth_t)
+
+domain_use_interactive_fds(plymouth_t)
@@ -20536,6 +20628,8 @@ diff --exclude-from=exclude -N -u -r nsa
+
+miscfiles_read_localization(plymouth_t)
+
++term_use_ptmx(plymouth_t)
++
+plymouth_stream_connect(plymouth_t)
+
+optional_policy(`
@@ -20667,7 +20761,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.7.8/policy/modules/services/policykit.te
--- nsaserefpolicy/policy/modules/services/policykit.te 2009-11-17 10:54:26.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/services/policykit.te 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/policykit.te 2010-01-25 12:24:39.000000000 -0500
@@ -36,11 +36,12 @@
# policykit local policy
#
@@ -20700,7 +20794,7 @@ diff --exclude-from=exclude -N -u -r nsa
auth_use_nsswitch(policykit_t)
-@@ -68,21 +73,38 @@
+@@ -68,21 +73,42 @@
miscfiles_read_localization(policykit_t)
@@ -20719,6 +20813,10 @@ diff --exclude-from=exclude -N -u -r nsa
+ rpm_dbus_chat(policykit_t)
+ ')
+')
++
++optional_policy(`
++ gnome_dontaudit_search_config(policykit_t)
++')
########################################
#
@@ -20743,7 +20841,7 @@ diff --exclude-from=exclude -N -u -r nsa
rw_files_pattern(policykit_auth_t, policykit_reload_t, policykit_reload_t)
-@@ -92,21 +114,25 @@
+@@ -92,21 +118,25 @@
manage_files_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t)
files_pid_filetrans(policykit_auth_t, policykit_var_run_t, { file dir })
@@ -20772,7 +20870,7 @@ diff --exclude-from=exclude -N -u -r nsa
dbus_session_bus_client(policykit_auth_t)
optional_policy(`
-@@ -119,6 +145,14 @@
+@@ -119,6 +149,14 @@
hal_read_state(policykit_auth_t)
')
@@ -20787,7 +20885,7 @@ diff --exclude-from=exclude -N -u -r nsa
########################################
#
# polkit_grant local policy
-@@ -126,7 +160,8 @@
+@@ -126,7 +164,8 @@
allow policykit_grant_t self:capability setuid;
allow policykit_grant_t self:process getattr;
@@ -20797,7 +20895,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow policykit_grant_t self:unix_dgram_socket create_socket_perms;
allow policykit_grant_t self:unix_stream_socket create_stream_socket_perms;
-@@ -156,9 +191,12 @@
+@@ -156,9 +195,12 @@
userdom_read_all_users_state(policykit_grant_t)
optional_policy(`
@@ -20811,7 +20909,7 @@ diff --exclude-from=exclude -N -u -r nsa
consolekit_dbus_chat(policykit_grant_t)
')
')
-@@ -170,7 +208,8 @@
+@@ -170,7 +212,8 @@
allow policykit_resolve_t self:capability { setuid sys_nice sys_ptrace };
allow policykit_resolve_t self:process getattr;
@@ -21706,7 +21804,7 @@ diff --exclude-from=exclude -N -u -r nsa
consoletype_exec(pppd_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.te serefpolicy-3.7.8/policy/modules/services/prelude.te
--- nsaserefpolicy/policy/modules/services/prelude.te 2009-12-18 11:38:25.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/services/prelude.te 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/prelude.te 2010-01-26 09:32:03.000000000 -0500
@@ -90,6 +90,7 @@
corenet_tcp_bind_prelude_port(prelude_t)
corenet_tcp_connect_prelude_port(prelude_t)
@@ -21715,6 +21813,15 @@ diff --exclude-from=exclude -N -u -r nsa
dev_read_rand(prelude_t)
dev_read_urand(prelude_t)
+@@ -250,6 +251,8 @@
+ files_read_etc_files(prelude_lml_t)
+ files_read_etc_runtime_files(prelude_lml_t)
+
++fs_getattr_all_fs(prelude_lml_t)
++fs_list_inotifyfs(prelude_lml_t)
+ fs_rw_anon_inodefs_files(prelude_lml_t)
+
+ auth_use_nsswitch(prelude_lml_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.7.8/policy/modules/services/procmail.te
--- nsaserefpolicy/policy/modules/services/procmail.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.7.8/policy/modules/services/procmail.te 2010-01-18 15:18:03.000000000 -0500
@@ -24623,7 +24730,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow snmpd_t self:fifo_file rw_fifo_file_perms;
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snort.te serefpolicy-3.7.8/policy/modules/services/snort.te
--- nsaserefpolicy/policy/modules/services/snort.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/services/snort.te 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/snort.te 2010-01-27 11:31:24.000000000 -0500
@@ -37,6 +37,7 @@
allow snort_t self:tcp_socket create_stream_socket_perms;
allow snort_t self:udp_socket create_socket_perms;
@@ -25707,6 +25814,18 @@ diff --exclude-from=exclude -N -u -r nsa
+
+ allow $1 tgtd_t:sem { rw_sem_perms };
+')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tgtd.te serefpolicy-3.7.8/policy/modules/services/tgtd.te
+--- nsaserefpolicy/policy/modules/services/tgtd.te 2009-11-12 12:51:51.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/tgtd.te 2010-01-26 08:47:40.000000000 -0500
+@@ -60,7 +60,7 @@
+
+ files_read_etc_files(tgtd_t)
+
+-storage_getattr_fixed_disk_dev(tgtd_t)
++storage_manage_fixed_disk(tgtd_t)
+
+ logging_send_syslog_msg(tgtd_t)
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tor.te serefpolicy-3.7.8/policy/modules/services/tor.te
--- nsaserefpolicy/policy/modules/services/tor.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.7.8/policy/modules/services/tor.te 2010-01-18 15:18:03.000000000 -0500
@@ -27413,7 +27532,7 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.7.8/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2009-12-04 09:43:33.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/services/xserver.te 2010-01-21 11:13:43.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/xserver.te 2010-01-25 12:06:19.000000000 -0500
@@ -36,6 +36,13 @@
## <desc>
@@ -27785,7 +27904,12 @@ diff --exclude-from=exclude -N -u -r nsa
dev_setattr_apm_bios_dev(xdm_t)
dev_rw_dri(xdm_t)
dev_rw_agp(xdm_t)
-@@ -418,14 +514,17 @@
+@@ -414,18 +510,21 @@
+ dev_getattr_misc_dev(xdm_t)
+ dev_setattr_misc_dev(xdm_t)
+ dev_dontaudit_rw_misc(xdm_t)
+-dev_getattr_video_dev(xdm_t)
++dev_read_video_dev(xdm_t)
dev_setattr_video_dev(xdm_t)
dev_getattr_scanner_dev(xdm_t)
dev_setattr_scanner_dev(xdm_t)
@@ -28633,13 +28757,17 @@ diff --exclude-from=exclude -N -u -r nsa
# PAM local policy
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.7.8/policy/modules/system/fstools.fc
--- nsaserefpolicy/policy/modules/system/fstools.fc 2009-11-25 11:47:19.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/system/fstools.fc 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/system/fstools.fc 2010-01-27 09:25:00.000000000 -0500
@@ -1,4 +1,3 @@
-/sbin/badblocks -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/blkid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/blockdev -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/cfdisk -- gen_context(system_u:object_r:fsadm_exec_t,s0)
-@@ -22,7 +21,6 @@
+@@ -19,10 +18,10 @@
+ /sbin/make_reiser4 -- gen_context(system_u:object_r:fsadm_exec_t,s0)
+ /sbin/mkdosfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
+ /sbin/mke2fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
++/sbin/mke4fs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)
/sbin/mkreiserfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
@@ -29726,7 +29854,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.7.8/policy/modules/system/ipsec.te
--- nsaserefpolicy/policy/modules/system/ipsec.te 2009-11-25 11:47:19.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/system/ipsec.te 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/system/ipsec.te 2010-01-27 11:40:13.000000000 -0500
@@ -29,9 +29,15 @@
type ipsec_key_file_t;
files_type(ipsec_key_file_t)
@@ -29763,15 +29891,17 @@ diff --exclude-from=exclude -N -u -r nsa
manage_files_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t)
manage_sock_files_pattern(ipsec_t, ipsec_var_run_t, ipsec_var_run_t)
files_pid_filetrans(ipsec_t, ipsec_var_run_t, { file sock_file })
-@@ -99,6 +109,7 @@
+@@ -98,7 +108,9 @@
+ corecmd_shell_domtrans(ipsec_t, ipsec_mgmt_t)
allow ipsec_mgmt_t ipsec_t:fd use;
allow ipsec_mgmt_t ipsec_t:fifo_file rw_fifo_file_perms;
++dontaudit ipsec_mgmt_t ipsec_t:unix_stream_socket { read write };
allow ipsec_mgmt_t ipsec_t:process sigchld;
+sysnet_domtrans_ifconfig(ipsec_t)
kernel_read_kernel_sysctls(ipsec_t)
kernel_list_proc(ipsec_t)
-@@ -171,8 +182,9 @@
+@@ -171,8 +183,9 @@
# ipsec_mgmt Local policy
#
@@ -29783,7 +29913,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow ipsec_mgmt_t self:unix_stream_socket create_stream_socket_perms;
allow ipsec_mgmt_t self:tcp_socket create_stream_socket_perms;
allow ipsec_mgmt_t self:udp_socket create_socket_perms;
-@@ -182,6 +194,9 @@
+@@ -182,6 +195,9 @@
allow ipsec_mgmt_t ipsec_mgmt_lock_t:file manage_file_perms;
files_lock_filetrans(ipsec_mgmt_t, ipsec_mgmt_lock_t, file)
@@ -29793,6 +29923,14 @@ diff --exclude-from=exclude -N -u -r nsa
allow ipsec_mgmt_t ipsec_mgmt_var_run_t:file manage_file_perms;
files_pid_filetrans(ipsec_mgmt_t, ipsec_mgmt_var_run_t, file)
+@@ -209,7 +225,6 @@
+ # whack needs to connect to pluto
+ stream_connect_pattern(ipsec_mgmt_t, ipsec_var_run_t, ipsec_var_run_t, ipsec_t)
+
+-can_exec(ipsec_mgmt_t, ipsec_exec_t)
+ can_exec(ipsec_mgmt_t, ipsec_mgmt_exec_t)
+ allow ipsec_mgmt_t ipsec_mgmt_exec_t:lnk_file read;
+
@@ -259,6 +274,7 @@
init_use_script_ptys(ipsec_mgmt_t)
init_exec_script_files(ipsec_mgmt_t)
@@ -29978,7 +30116,7 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.7.8/policy/modules/system/libraries.fc
--- nsaserefpolicy/policy/modules/system/libraries.fc 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/system/libraries.fc 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/system/libraries.fc 2010-01-26 15:36:44.000000000 -0500
@@ -60,12 +60,15 @@
#
# /opt
@@ -30195,7 +30333,7 @@ diff --exclude-from=exclude -N -u -r nsa
') dnl end distro_redhat
#
-@@ -307,10 +317,134 @@
+@@ -307,10 +317,137 @@
/var/mailman/pythonlib(/.*)?/.+\.so(\..*)? -- gen_context(system_u:object_r:lib_t,s0)
@@ -30275,6 +30413,9 @@ diff --exclude-from=exclude -N -u -r nsa
+
+/usr/lib(64)?/libx264\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+
++/usr/lib(64)?/libmp3lame\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/libmpeg2\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++
+ifdef(`fixed',`
+/usr/lib(64)?/libavfilter\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?/libavdevice\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -30286,10 +30427,8 @@ diff --exclude-from=exclude -N -u -r nsa
+/usr/lib(64)?/libgsm\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?/libImlib2\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?/libjackserver\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-+/usr/lib(64)?/libmp3lame\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/X11R6/lib/libOSMesa.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?/libOSMesa.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-+/usr/lib(64)?/libmpeg2\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?/libSDL-.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?/xulrunner-[^/]*/libgtkembedmoz\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/usr/lib(64)?/xulrunner-[^/]*/libxul\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -30330,6 +30469,8 @@ diff --exclude-from=exclude -N -u -r nsa
+/usr/lib(64)?/libkmplayercommon\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+
+/opt/Unify/SQLBase/libgptsblmsui11\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++
++/opt/real/RealPlayer/plugins/oggfformat\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.if serefpolicy-3.7.8/policy/modules/system/libraries.if
--- nsaserefpolicy/policy/modules/system/libraries.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.7.8/policy/modules/system/libraries.if 2010-01-18 15:18:03.000000000 -0500
@@ -31071,7 +31212,7 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.7.8/policy/modules/system/mount.te
--- nsaserefpolicy/policy/modules/system/mount.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/system/mount.te 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/system/mount.te 2010-01-25 10:51:48.000000000 -0500
@@ -18,8 +18,15 @@
init_system_domain(mount_t, mount_exec_t)
role system_r types mount_t;
@@ -31273,15 +31414,19 @@ diff --exclude-from=exclude -N -u -r nsa
# for kernel package installation
optional_policy(`
rpm_rw_pipes(mount_t)
-@@ -186,6 +258,7 @@
+@@ -186,6 +258,11 @@
optional_policy(`
samba_domtrans_smbmount(mount_t)
+ samba_read_config(mount_t)
++')
++
++optional_policy(`
++ vmware_exec_host(mount_t)
')
########################################
-@@ -195,5 +268,9 @@
+@@ -195,5 +272,9 @@
optional_policy(`
files_etc_filetrans_etc_runtime(unconfined_mount_t, file)
@@ -32318,7 +32463,7 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.7.8/policy/modules/system/sysnetwork.te
--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/system/sysnetwork.te 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/system/sysnetwork.te 2010-01-27 11:22:49.000000000 -0500
@@ -20,6 +20,9 @@
init_daemon_domain(dhcpc_t, dhcpc_exec_t)
role system_r types dhcpc_t;
@@ -32341,7 +32486,7 @@ diff --exclude-from=exclude -N -u -r nsa
dontaudit dhcpc_t self:capability { dac_read_search sys_module };
-allow dhcpc_t self:process signal_perms;
-allow dhcpc_t self:fifo_file rw_file_perms;
-+allow dhcpc_t self:process { getcap setcap setfscreate ptrace signal_perms };
++allow dhcpc_t self:process { getsched getcap setcap setfscreate ptrace signal_perms };
+
+allow dhcpc_t self:fifo_file rw_fifo_file_perms;
allow dhcpc_t self:tcp_socket create_stream_socket_perms;
@@ -32367,15 +32512,17 @@ diff --exclude-from=exclude -N -u -r nsa
files_etc_filetrans(dhcpc_t, net_conf_t, file)
# create temp files
-@@ -81,6 +88,7 @@
+@@ -80,7 +87,9 @@
+
kernel_read_system_state(dhcpc_t)
kernel_read_network_state(dhcpc_t)
++kernel_search_network_sysctl(dhcpc_t)
kernel_read_kernel_sysctls(dhcpc_t)
+kernel_request_load_module(dhcpc_t)
kernel_use_fds(dhcpc_t)
corecmd_exec_bin(dhcpc_t)
-@@ -107,14 +115,17 @@
+@@ -107,14 +116,17 @@
# for SSP:
dev_read_urand(dhcpc_t)
@@ -32394,7 +32541,7 @@ diff --exclude-from=exclude -N -u -r nsa
fs_getattr_all_fs(dhcpc_t)
fs_search_auto_mountpoints(dhcpc_t)
-@@ -146,7 +157,7 @@
+@@ -146,7 +158,7 @@
')
optional_policy(`
@@ -32403,7 +32550,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -183,25 +194,23 @@
+@@ -183,25 +195,23 @@
')
optional_policy(`
@@ -32437,7 +32584,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -212,6 +221,7 @@
+@@ -212,6 +222,7 @@
optional_policy(`
seutil_sigchld_newrole(dhcpc_t)
seutil_dontaudit_search_config(dhcpc_t)
@@ -32445,7 +32592,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -223,6 +233,10 @@
+@@ -223,6 +234,10 @@
')
optional_policy(`
@@ -32456,7 +32603,7 @@ diff --exclude-from=exclude -N -u -r nsa
kernel_read_xen_state(dhcpc_t)
kernel_write_xen_state(dhcpc_t)
xen_append_log(dhcpc_t)
-@@ -235,7 +249,6 @@
+@@ -235,7 +250,6 @@
#
allow ifconfig_t self:capability { net_raw net_admin sys_tty_config };
@@ -32464,7 +32611,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow ifconfig_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack };
allow ifconfig_t self:fd use;
allow ifconfig_t self:fifo_file rw_fifo_file_perms;
-@@ -249,6 +262,8 @@
+@@ -249,6 +263,8 @@
allow ifconfig_t self:sem create_sem_perms;
allow ifconfig_t self:msgq create_msgq_perms;
allow ifconfig_t self:msg { send receive };
@@ -32473,7 +32620,7 @@ diff --exclude-from=exclude -N -u -r nsa
# Create UDP sockets, necessary when called from dhcpc
allow ifconfig_t self:udp_socket create_socket_perms;
# for /sbin/ip
-@@ -260,7 +275,9 @@
+@@ -260,7 +276,9 @@
kernel_use_fds(ifconfig_t)
kernel_read_system_state(ifconfig_t)
kernel_read_network_state(ifconfig_t)
@@ -32483,7 +32630,7 @@ diff --exclude-from=exclude -N -u -r nsa
kernel_rw_net_sysctls(ifconfig_t)
corenet_rw_tun_tap_dev(ifconfig_t)
-@@ -269,15 +286,23 @@
+@@ -269,15 +287,23 @@
# for IPSEC setup:
dev_read_urand(ifconfig_t)
@@ -32508,7 +32655,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_dontaudit_read_root_files(ifconfig_t)
-@@ -294,6 +319,8 @@
+@@ -294,6 +320,8 @@
seutil_use_runinit_fds(ifconfig_t)
@@ -32517,7 +32664,7 @@ diff --exclude-from=exclude -N -u -r nsa
userdom_use_user_terminals(ifconfig_t)
userdom_use_all_users_fds(ifconfig_t)
-@@ -330,8 +357,22 @@
+@@ -330,8 +358,22 @@
')
optional_policy(`
@@ -33378,7 +33525,7 @@ diff --exclude-from=exclude -N -u -r nsa
+HOME_DIR/\.gvfs(/.*)? <<none>>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.7.8/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-08-31 13:30:04.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/system/userdomain.if 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/system/userdomain.if 2010-01-27 11:14:58.000000000 -0500
@@ -30,8 +30,9 @@
')
@@ -34735,23 +34882,25 @@ diff --exclude-from=exclude -N -u -r nsa
read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
files_search_home($1)
')
-@@ -1686,11 +1875,12 @@
+@@ -1686,11 +1875,14 @@
#
interface(`userdom_dontaudit_read_user_home_content_files',`
gen_require(`
- type user_home_t;
+ attribute user_home_type;
++ type user_home_dir_t;
')
- dontaudit $1 user_home_t:dir list_dir_perms;
- dontaudit $1 user_home_t:file read_file_perms;
++ dontaudit $1 user_home_dir_t:dir list_dir_perms;
+ dontaudit $1 user_home_type:dir list_dir_perms;
+ dontaudit $1 user_home_type:file read_file_perms;
+ dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
')
########################################
-@@ -1797,19 +1987,32 @@
+@@ -1797,19 +1989,32 @@
#
interface(`userdom_exec_user_home_content_files',`
gen_require(`
@@ -34791,7 +34940,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -1844,6 +2047,7 @@
+@@ -1844,6 +2049,7 @@
interface(`userdom_manage_user_home_content_files',`
gen_require(`
type user_home_dir_t, user_home_t;
@@ -34799,7 +34948,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
manage_files_pattern($1, user_home_t, user_home_t)
-@@ -2196,6 +2400,25 @@
+@@ -2196,6 +2402,25 @@
########################################
## <summary>
@@ -34825,7 +34974,7 @@ diff --exclude-from=exclude -N -u -r nsa
## Do not audit attempts to manage users
## temporary files.
## </summary>
-@@ -2276,7 +2499,7 @@
+@@ -2276,7 +2501,7 @@
########################################
## <summary>
## Create, read, write, and delete user
@@ -34834,7 +34983,7 @@ diff --exclude-from=exclude -N -u -r nsa
## </summary>
## <param name="domain">
## <summary>
-@@ -2284,19 +2507,19 @@
+@@ -2284,19 +2509,19 @@
## </summary>
## </param>
#
@@ -34857,7 +35006,7 @@ diff --exclude-from=exclude -N -u -r nsa
## </summary>
## <param name="domain">
## <summary>
-@@ -2304,19 +2527,19 @@
+@@ -2304,19 +2529,19 @@
## </summary>
## </param>
#
@@ -34880,17 +35029,16 @@ diff --exclude-from=exclude -N -u -r nsa
## </summary>
## <param name="domain">
## <summary>
-@@ -2324,12 +2547,52 @@
+@@ -2324,7 +2549,47 @@
## </summary>
## </param>
#
-interface(`userdom_manage_user_tmp_sockets',`
+interface(`userdom_manage_user_tmp_symlinks',`
- gen_require(`
- type user_tmp_t;
- ')
-
-- manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
++ gen_require(`
++ type user_tmp_t;
++ ')
++
+ manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
+ files_search_tmp($1)
+')
@@ -34927,15 +35075,10 @@ diff --exclude-from=exclude -N -u -r nsa
+## </param>
+#
+interface(`userdom_manage_user_tmp_sockets',`
-+ gen_require(`
-+ type user_tmp_t;
-+ ')
-+
-+ manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
- files_search_tmp($1)
- ')
-
-@@ -2391,7 +2654,7 @@
+ gen_require(`
+ type user_tmp_t;
+ ')
+@@ -2391,7 +2656,7 @@
########################################
## <summary>
@@ -34944,7 +35087,7 @@ diff --exclude-from=exclude -N -u -r nsa
## </summary>
## <param name="domain">
## <summary>
-@@ -2399,19 +2662,21 @@
+@@ -2399,19 +2664,21 @@
## </summary>
## </param>
#
@@ -34970,7 +35113,7 @@ diff --exclude-from=exclude -N -u -r nsa
## </summary>
## <param name="domain">
## <summary>
-@@ -2419,15 +2684,14 @@
+@@ -2419,15 +2686,14 @@
## </summary>
## </param>
#
@@ -34990,7 +35133,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -2749,7 +3013,7 @@
+@@ -2749,7 +3015,7 @@
domain_entry_file_spec_domtrans($1, unpriv_userdomain)
allow unpriv_userdomain $1:fd use;
@@ -34999,7 +35142,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow unpriv_userdomain $1:process sigchld;
')
-@@ -2765,11 +3029,33 @@
+@@ -2765,11 +3031,33 @@
#
interface(`userdom_search_user_home_content',`
gen_require(`
@@ -35035,7 +35178,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -2897,7 +3183,43 @@
+@@ -2897,7 +3185,43 @@
type user_tmp_t;
')
@@ -35080,7 +35223,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -2934,6 +3256,7 @@
+@@ -2934,6 +3258,7 @@
')
read_files_pattern($1, userdomain, userdomain)
@@ -35088,7 +35231,7 @@ diff --exclude-from=exclude -N -u -r nsa
kernel_search_proc($1)
')
-@@ -3064,3 +3387,674 @@
+@@ -3064,3 +3389,674 @@
allow $1 userdomain:dbus send_msg;
')
@@ -35885,7 +36028,7 @@ diff --exclude-from=exclude -N -u -r nsa
## <param name="domain">
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.7.8/policy/modules/system/xen.te
--- nsaserefpolicy/policy/modules/system/xen.te 2009-11-25 11:47:19.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/system/xen.te 2010-01-18 15:18:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/system/xen.te 2010-01-25 11:49:09.000000000 -0500
@@ -85,6 +85,7 @@
type xenconsoled_t;
type xenconsoled_exec_t;
@@ -35929,16 +36072,17 @@ diff --exclude-from=exclude -N -u -r nsa
########################################
#
# Xen store local policy
-@@ -340,6 +348,8 @@
+@@ -340,6 +348,9 @@
files_read_usr_files(xenstored_t)
+fs_search_xenfs(xenstored_t)
++fs_manage_xenfs_files(xenstored_t)
+
storage_raw_read_fixed_disk(xenstored_t)
storage_raw_write_fixed_disk(xenstored_t)
storage_raw_read_removable_device(xenstored_t)
-@@ -421,7 +431,14 @@
+@@ -421,7 +432,14 @@
xen_stream_connect_xenstore(xm_t)
optional_policy(`
@@ -35953,7 +36097,7 @@ diff --exclude-from=exclude -N -u -r nsa
virt_stream_connect(xm_t)
')
-@@ -438,6 +455,8 @@
+@@ -438,6 +456,8 @@
fs_manage_xenfs_dirs(xm_ssh_t)
fs_manage_xenfs_files(xm_ssh_t)
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.960
retrieving revision 1.961
diff -u -p -r1.960 -r1.961
--- selinux-policy.spec 22 Jan 2010 15:26:39 -0000 1.960
+++ selinux-policy.spec 27 Jan 2010 17:08:59 -0000 1.961
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.7.8
-Release: 2%{?dist}
+Release: 3%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -459,6 +459,10 @@ exit 0
%endif
%changelog
+* Mon Jan 25 2010 Dan Walsh <dwalsh at redhat.com> 3.7.8-3
+- Allow abrt_helper to getattr on all filesystems
+- Add label for /opt/real/RealPlayer/plugins/oggfformat\.so
+
* Thu Jan 21 2010 Dan Walsh <dwalsh at redhat.com> 3.7.8-2
- Add gstreamer_home_t for ~/.gstreamer
More information about the scm-commits
mailing list