[selinux-policy/f14/master] - Turn off default transition to mozilla_plugin and telepathy domains from unconfined user - Turn of
Daniel J Walsh
dwalsh at fedoraproject.org
Fri Oct 1 16:06:07 UTC 2010
commit dee200ee9dd59b1c020dd23e65ff81d0bb410fb6
Author: Dan Walsh <dwalsh at redhat.com>
Date: Fri Oct 1 12:04:49 2010 -0400
- Turn off default transition to mozilla_plugin and telepathy domains from unconfined user
- Turn off iptables from unconfined user
- Allow sudo to send signals to any domains the user could have transitioned to.
- Passwd in single user mode needs to talk to console_device_t
- Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio
- locate tried to read a symbolic link, will dontaudit
- New labels for telepathy-sunshine content in homedir
- Google is storing other binaries under /opt/google/talkplugin
- bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug
- Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15
- modemmanger and bluetooth send dbus messages to devicekit_power
- Samba needs to getquota on filesystems labeld samba_share_t
policy-F14.patch | 402 +++++++++++++++++++++++++++++++++++++++------------
selinux-policy.spec | 16 ++-
2 files changed, 322 insertions(+), 96 deletions(-)
---
diff --git a/policy-F14.patch b/policy-F14.patch
index 89cff5d..456fd99 100644
--- a/policy-F14.patch
+++ b/policy-F14.patch
@@ -1467,7 +1467,7 @@ index 7bddc02..2b59ed0 100644
+
+/var/db/sudo(/.*)? gen_context(system_u:object_r:sudo_db_t,s0)
diff --git a/policy/modules/admin/sudo.if b/policy/modules/admin/sudo.if
-index 5f44f1b..2993130 100644
+index 5f44f1b..bb95e79 100644
--- a/policy/modules/admin/sudo.if
+++ b/policy/modules/admin/sudo.if
@@ -32,6 +32,7 @@ template(`sudo_role_template',`
@@ -1497,7 +1497,7 @@ index 5f44f1b..2993130 100644
allow $3 $1_sudo_t:fd use;
allow $3 $1_sudo_t:fifo_file rw_file_perms;
allow $3 $1_sudo_t:process signal_perms;
-@@ -111,6 +117,7 @@ template(`sudo_role_template',`
+@@ -111,12 +117,15 @@ template(`sudo_role_template',`
term_relabel_all_ttys($1_sudo_t)
term_relabel_all_ptys($1_sudo_t)
@@ -1505,7 +1505,15 @@ index 5f44f1b..2993130 100644
auth_run_chk_passwd($1_sudo_t, $2)
# sudo stores a token in the pam_pid directory
-@@ -133,13 +140,18 @@ template(`sudo_role_template',`
+ auth_manage_pam_pid($1_sudo_t)
+ auth_use_nsswitch($1_sudo_t)
+
++ application_signal($1_sudo_t)
++
+ init_rw_utmp($1_sudo_t)
+
+ logging_send_audit_msgs($1_sudo_t)
+@@ -133,13 +142,18 @@ template(`sudo_role_template',`
userdom_manage_user_tmp_files($1_sudo_t)
userdom_manage_user_tmp_symlinks($1_sudo_t)
userdom_use_user_terminals($1_sudo_t)
@@ -1606,7 +1614,7 @@ index aecbf1c..0b5e634 100644
optional_policy(`
diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te
-index c35d801..961424f 100644
+index c35d801..b1a841a 100644
--- a/policy/modules/admin/usermanage.te
+++ b/policy/modules/admin/usermanage.te
@@ -90,9 +90,7 @@ fs_search_auto_mountpoints(chfn_t)
@@ -1620,11 +1628,13 @@ index c35d801..961424f 100644
# allow checking if a shell is executable
corecmd_check_exec_shell(chfn_t)
-@@ -295,15 +293,18 @@ selinux_compute_user_contexts(passwd_t)
+@@ -293,17 +291,18 @@ selinux_compute_create_context(passwd_t)
+ selinux_compute_relabel_context(passwd_t)
+ selinux_compute_user_contexts(passwd_t)
- term_use_all_ttys(passwd_t)
- term_use_all_ptys(passwd_t)
-+term_use_generic_ptys(passwd_t)
+-term_use_all_ttys(passwd_t)
+-term_use_all_ptys(passwd_t)
++term_use_all_terms(passwd_t)
-auth_domtrans_chk_passwd(passwd_t)
auth_manage_shadow(passwd_t)
@@ -1641,7 +1651,7 @@ index c35d801..961424f 100644
domain_use_interactive_fds(passwd_t)
-@@ -334,6 +335,7 @@ userdom_read_user_tmp_files(passwd_t)
+@@ -334,6 +333,7 @@ userdom_read_user_tmp_files(passwd_t)
# user generally runs this from their home directory, so do not audit a search
# on user home dir
userdom_dontaudit_search_user_home_content(passwd_t)
@@ -1649,7 +1659,7 @@ index c35d801..961424f 100644
optional_policy(`
nscd_domtrans(passwd_t)
-@@ -428,7 +430,7 @@ optional_policy(`
+@@ -428,7 +428,7 @@ optional_policy(`
# Useradd local policy
#
@@ -1658,7 +1668,7 @@ index c35d801..961424f 100644
dontaudit useradd_t self:capability sys_tty_config;
allow useradd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow useradd_t self:process setfscreate;
-@@ -500,12 +502,8 @@ seutil_domtrans_setfiles(useradd_t)
+@@ -500,12 +500,8 @@ seutil_domtrans_setfiles(useradd_t)
userdom_use_unpriv_users_fds(useradd_t)
# Add/remove user home directories
@@ -3701,7 +3711,7 @@ index 9a6d67d..47aa143 100644
## mozilla over dbus.
## </summary>
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
-index cbf4bec..3ecd99b 100644
+index cbf4bec..70d899d 100644
--- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te
@@ -25,6 +25,7 @@ files_config_file(mozilla_conf_t)
@@ -3774,7 +3784,7 @@ index cbf4bec..3ecd99b 100644
pulseaudio_exec(mozilla_t)
pulseaudio_stream_connect(mozilla_t)
pulseaudio_manage_home_files(mozilla_t)
-@@ -266,3 +291,108 @@ optional_policy(`
+@@ -266,3 +291,121 @@ optional_policy(`
optional_policy(`
thunderbird_domtrans(mozilla_t)
')
@@ -3815,8 +3825,18 @@ index cbf4bec..3ecd99b 100644
+corecmd_exec_bin(mozilla_plugin_t)
+corecmd_exec_shell(mozilla_plugin_t)
+
++corenet_tcp_connect_flash_port(mozilla_plugin_t)
++corenet_tcp_connect_streaming_port(mozilla_plugin_t)
++corenet_tcp_connect_pulseaudio_port(mozilla_plugin_t)
++corenet_tcp_connect_http_port(mozilla_plugin_t)
++corenet_tcp_connect_http_cache_port(mozilla_plugin_t)
++corenet_tcp_connect_squid_port(mozilla_plugin_t)
++corenet_tcp_connect_ipp_port(mozilla_plugin_t)
++corenet_tcp_connect_speech_port(mozilla_plugin_t)
++
+dev_read_urand(mozilla_plugin_t)
+dev_read_video_dev(mozilla_plugin_t)
++dev_write_video_dev(mozilla_plugin_t)
+dev_read_sysfs(mozilla_plugin_t)
+dev_read_sound(mozilla_plugin_t)
+dev_write_sound(mozilla_plugin_t)
@@ -3852,6 +3872,7 @@ index cbf4bec..3ecd99b 100644
+
+optional_policy(`
+ alsa_read_rw_config(mozilla_plugin_t)
++ alsa_read_home_files(mozilla_plugin_t)
+')
+
+optional_policy(`
@@ -3874,8 +3895,10 @@ index cbf4bec..3ecd99b 100644
+')
+
+optional_policy(`
++ pulseaudio_exec(mozilla_plugin_t)
++ pulseaudio_stream_connect(mozilla_plugin_t)
+ pulseaudio_setattr_home_dir(mozilla_plugin_t)
-+ pulseaudio_rw_home_files(mozilla_plugin_t)
++ pulseaudio_manage_home_files(mozilla_plugin_t)
+')
+
+optional_policy(`
@@ -6088,15 +6111,28 @@ index 7590165..e5ef7b3 100644
')
')
+
+diff --git a/policy/modules/apps/slocate.te b/policy/modules/apps/slocate.te
+index e9134f0..3d2ef30 100644
+--- a/policy/modules/apps/slocate.te
++++ b/policy/modules/apps/slocate.te
+@@ -38,6 +38,7 @@ dev_getattr_all_blk_files(locate_t)
+ dev_getattr_all_chr_files(locate_t)
+
+ files_list_all(locate_t)
++files_dontaudit_read_all_symlinks(locate_t)
+ files_getattr_all_files(locate_t)
+ files_getattr_all_pipes(locate_t)
+ files_getattr_all_sockets(locate_t)
diff --git a/policy/modules/apps/telepathy.fc b/policy/modules/apps/telepathy.fc
new file mode 100644
-index 0000000..1e47b96
+index 0000000..809bb65
--- /dev/null
+++ b/policy/modules/apps/telepathy.fc
-@@ -0,0 +1,14 @@
+@@ -0,0 +1,15 @@
+HOME_DIR/\.mission-control(/.*)? gen_context(system_u:object_r:telepathy_mission_control_home_t, s0)
+HOME_DIR/\.cache/\.mc_connections -- gen_context(system_u:object_r:telepathy_mission_control_cache_home_t, s0)
-+HOME_DIR/\.cache/telepathy/gabble(/.*)? gen_context(system_u:object_r:telepathy_gabble_cache_home_t, s0)
++HOME_DIR/\.cache/telepathy/gabble(/.*)? gen_context(system_u:object_r:telepathy_gabble_cache_home_t, s0)
++HOME_DIR/.telepathy-sunshine(/.*)? gen_context(system_u:object_r:telepathy_sunshine_home_t, s0)
+
+/usr/libexec/mission-control-5 -- gen_context(system_u:object_r:telepathy_mission_control_exec_t, s0)
+
@@ -6304,10 +6340,10 @@ index 0000000..3d12484
+')
diff --git a/policy/modules/apps/telepathy.te b/policy/modules/apps/telepathy.te
new file mode 100644
-index 0000000..c4fe796
+index 0000000..34a2b48
--- /dev/null
+++ b/policy/modules/apps/telepathy.te
-@@ -0,0 +1,320 @@
+@@ -0,0 +1,327 @@
+
+policy_module(telepathy, 1.0.0)
+
@@ -6341,6 +6377,9 @@ index 0000000..c4fe796
+type telepathy_mission_control_cache_home_t;
+userdom_user_home_content(telepathy_mission_control_cache_home_t)
+
++type telepathy_sunshine_home_t;
++userdom_user_home_content(telepathy_sunshine_home_t)
++
+telepathy_domain_template(msn)
+telepathy_domain_template(salut)
+telepathy_domain_template(sofiasip)
@@ -6561,12 +6600,16 @@ index 0000000..c4fe796
+#
+# Telepathy Sunshine local policy.
+#
++manage_dirs_pattern(telepathy_sunshine_t, telepathy_sunshine_home_t, telepathy_sunshine_home_t)
++manage_files_pattern(telepathy_sunshine_t, telepathy_sunshine_home_t, telepathy_sunshine_home_t)
++userdom_user_home_dir_filetrans(telepathy_sunshine_t, telepathy_sunshine_home_t, { dir file })
++userdom_search_user_home_dirs(telepathy_sunshine_t)
+
+manage_files_pattern(telepathy_sunshine_t, telepathy_sunshine_tmp_t, telepathy_sunshine_tmp_t)
+exec_files_pattern(telepathy_sunshine_t, telepathy_sunshine_tmp_t, telepathy_sunshine_tmp_t)
+files_tmp_filetrans(telepathy_sunshine_t, telepathy_sunshine_tmp_t, file)
+
-+corecmd_list_bin(telepathy_sunshine_t)
++corecmd_exec_bin(telepathy_sunshine_t)
+
+dev_read_urand(telepathy_sunshine_t)
+
@@ -6984,7 +7027,7 @@ index 82842a0..369c3b5 100644
dbus_system_bus_client($1_wm_t)
dbus_session_bus_client($1_wm_t)
diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
-index 0eb1d97..38d675c 100644
+index 0eb1d97..46af2a4 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
@@ -9,8 +9,11 @@
@@ -7040,7 +7083,7 @@ index 0eb1d97..38d675c 100644
/opt/(.*/)?sbin(/.*)? gen_context(system_u:object_r:bin_t,s0)
-+/opt/google/talkplugin/cron(/.*)? gen_context(system_u:object_r:bin_t,s0)
++/opt/google/talkplugin(/.*)? gen_context(system_u:object_r:bin_t,s0)
+
+/opt/gutenprint/cups/lib/filter(/.*)? gen_context(system_u:object_r:bin_t,s0)
+
@@ -8061,7 +8104,7 @@ index 3517db2..bd4c23d 100644
+/nsr(/.*)? gen_context(system_u:object_r:var_t,s0)
+/nsr/logs(/.*)? gen_context(system_u:object_r:var_log_t,s0)
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
-index 5302dac..000c53a 100644
+index 5302dac..a738502 100644
--- a/policy/modules/kernel/files.if
+++ b/policy/modules/kernel/files.if
@@ -1053,10 +1053,8 @@ interface(`files_relabel_all_files',`
@@ -8506,7 +8549,7 @@ index 5302dac..000c53a 100644
')
########################################
-@@ -5826,3 +6137,229 @@ interface(`files_unconfined',`
+@@ -5826,3 +6137,247 @@ interface(`files_unconfined',`
typeattribute $1 files_unconfined_type;
')
@@ -8623,6 +8666,24 @@ index 5302dac..000c53a 100644
+
+########################################
+## <summary>
++## Allow read write all tmpfs files
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
++interface(`files_rw_tmpfs_files',`
++ gen_require(`
++ attribute tmpfsfile;
++ ')
++
++ allow $1 tmpfsfile:file { read write };
++')
++
++########################################
++## <summary>
+## Do not audit attempts to read security files
+## </summary>
+## <param name="domain">
@@ -9214,7 +9275,7 @@ index 0dff98e..a09ab47 100644
#
diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
-index ed7667a..46e9859 100644
+index ed7667a..10c14fe 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -698,6 +698,46 @@ interface(`kernel_read_debugfs',`
@@ -9273,7 +9334,32 @@ index ed7667a..46e9859 100644
')
########################################
-@@ -2845,6 +2885,24 @@ interface(`kernel_relabelfrom_unlabeled_database',`
+@@ -2380,6 +2420,24 @@ interface(`kernel_rw_unlabeled_blk_files',`
+
+ ########################################
+ ## <summary>
++## Read and write unlabeled sockets.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`kernel_rw_unlabeled_socket',`
++ gen_require(`
++ type unlabeled_t;
++ ')
++
++ allow $1 unlabeled_t:socket rw_socket_perms;
++')
++
++########################################
++## <summary>
+ ## Do not audit attempts by caller to get attributes for
+ ## unlabeled character devices.
+ ## </summary>
+@@ -2845,6 +2903,24 @@ interface(`kernel_relabelfrom_unlabeled_database',`
########################################
## <summary>
@@ -9298,7 +9384,7 @@ index ed7667a..46e9859 100644
## Unconfined access to kernel module resources.
## </summary>
## <param name="domain">
-@@ -2860,3 +2918,23 @@ interface(`kernel_unconfined',`
+@@ -2860,3 +2936,23 @@ interface(`kernel_unconfined',`
typeattribute $1 kern_unconfined;
')
@@ -10947,10 +11033,10 @@ index 0000000..8b2cdf3
+
diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
new file mode 100644
-index 0000000..a09ca52
+index 0000000..0e47a85
--- /dev/null
+++ b/policy/modules/roles/unconfineduser.te
-@@ -0,0 +1,478 @@
+@@ -0,0 +1,492 @@
+policy_module(unconfineduser, 1.0.0)
+
+########################################
@@ -10961,13 +11047,27 @@ index 0000000..a09ca52
+
+## <desc>
+## <p>
-+## Transition to confined nsplugin domains from unconfined user
++## Transition unconfined user to the nsplugin domains when running nspluginviewer
+## </p>
+## </desc>
+gen_tunable(allow_unconfined_nsplugin_transition, false)
+
+## <desc>
+## <p>
++## Transition unconfined user to the mozilla plugin domain when running xulrunner plugin-container.
++## </p>
++## </desc>
++gen_tunable(unconfined_mozilla_plugin_transition, false)
++
++## <desc>
++## <p>
++## Transition unconfined user to telepathy confined domains.
++## </p>
++## </desc>
++gen_tunable(unconfined_telepathy_transition, false)
++
++## <desc>
++## <p>
+## Allow vidio playing tools to tun unconfined
+## </p>
+## </desc>
@@ -11113,10 +11213,6 @@ index 0000000..a09ca52
+ ')
+
+ optional_policy(`
-+ iptables_run(unconfined_usertype, unconfined_r)
-+ ')
-+
-+ optional_policy(`
+ networkmanager_dbus_chat(unconfined_usertype)
+ ')
+
@@ -11282,8 +11378,11 @@ index 0000000..a09ca52
+ role system_r types unconfined_mono_t;
+')
+
++
+optional_policy(`
-+ mozilla_run_plugin(unconfined_usertype, unconfined_r)
++ tunable_policy(`unconfined_mozilla_plugin_transition', `
++ mozilla_run_plugin(unconfined_usertype, unconfined_r)
++ ')
+')
+
+optional_policy(`
@@ -11344,7 +11443,9 @@ index 0000000..a09ca52
+')
+
+optional_policy(`
-+ telepathy_dbus_session_role(unconfined_r, unconfined_t)
++ tunable_policy(`unconfined_telepathy_transition', `
++ telepathy_dbus_session_role(unconfined_r, unconfined_t)
++ ')
+')
+
+optional_policy(`
@@ -11428,7 +11529,6 @@ index 0000000..a09ca52
+#
+
+gen_user(unconfined_u, user, unconfined_r system_r, s0, s0 - mls_systemhigh, mcs_allcats)
-+
diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
index 9b55b00..2932c13 100644
--- a/policy/modules/roles/unprivuser.te
@@ -11917,7 +12017,7 @@ index 98646c4..5be7dc8 100644
+ allow abrt_t domain:process setrlimit;
')
diff --git a/policy/modules/services/accountsd.if b/policy/modules/services/accountsd.if
-index c0f858d..fe060aa 100644
+index c0f858d..d639ae0 100644
--- a/policy/modules/services/accountsd.if
+++ b/policy/modules/services/accountsd.if
@@ -5,9 +5,9 @@
@@ -11932,6 +12032,15 @@ index c0f858d..fe060aa 100644
## </param>
#
interface(`accountsd_domtrans',`
+@@ -25,7 +25,7 @@ interface(`accountsd_domtrans',`
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain allowed access.
++## Domain to not audit.
+ ## </summary>
+ ## </param>
+ #
@@ -138,7 +138,7 @@ interface(`accountsd_admin',`
type accountsd_t;
')
@@ -14463,7 +14572,7 @@ index 3e45431..fa57a6f 100644
admin_pattern($1, bluetooth_var_lib_t)
diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te
-index 215b86b..08afbb9 100644
+index 215b86b..67818fe 100644
--- a/policy/modules/services/bluetooth.te
+++ b/policy/modules/services/bluetooth.te
@@ -4,6 +4,7 @@ policy_module(bluetooth, 3.3.0)
@@ -14474,6 +14583,28 @@ index 215b86b..08afbb9 100644
type bluetooth_t;
type bluetooth_exec_t;
init_daemon_domain(bluetooth_t, bluetooth_exec_t)
+@@ -99,6 +100,10 @@ kernel_request_load_module(bluetooth_t)
+ #search debugfs - redhat bug 548206
+ kernel_search_debugfs(bluetooth_t)
+
++ifdef(`hide_broken_symptoms', `
++ kernel_rw_unlabeled_socket(bluetooth_t)
++')
++
+ corenet_all_recvfrom_unlabeled(bluetooth_t)
+ corenet_all_recvfrom_netlabel(bluetooth_t)
+ corenet_tcp_sendrecv_generic_if(bluetooth_t)
+@@ -147,6 +152,10 @@ userdom_dontaudit_use_user_terminals(bluetooth_t)
+ userdom_dontaudit_search_user_home_dirs(bluetooth_t)
+
+ optional_policy(`
++ devicekit_dbus_chat_power(bluetooth_t)
++')
++
++optional_policy(`
+ dbus_system_bus_client(bluetooth_t)
+ dbus_connect_system_bus(bluetooth_t)
+
diff --git a/policy/modules/services/boinc.fc b/policy/modules/services/boinc.fc
new file mode 100644
index 0000000..c095160
@@ -16429,7 +16560,7 @@ index 0258b48..c4d678b 100644
########################################
diff --git a/policy/modules/services/consolekit.if b/policy/modules/services/consolekit.if
-index 42c6bd7..53b10e3 100644
+index 42c6bd7..ac43a92 100644
--- a/policy/modules/services/consolekit.if
+++ b/policy/modules/services/consolekit.if
@@ -5,9 +5,9 @@
@@ -16444,7 +16575,32 @@ index 42c6bd7..53b10e3 100644
## </param>
#
interface(`consolekit_domtrans',`
-@@ -95,3 +95,22 @@ interface(`consolekit_read_pid_files',`
+@@ -41,6 +41,24 @@ interface(`consolekit_dbus_chat',`
+
+ ########################################
+ ## <summary>
++## Dontaudit attempts to read consolekit log files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
++interface(`consolekit_dontaudit_read_log',`
++ gen_require(`
++ type consolekit_log_t;
++ ')
++
++ dontaudit $1 consolekit_log_t:file read_file_perms;
++')
++
++########################################
++## <summary>
+ ## Read consolekit log files.
+ ## </summary>
+ ## <param name="domain">
+@@ -95,3 +113,22 @@ interface(`consolekit_read_pid_files',`
files_search_pids($1)
read_files_pattern($1, consolekit_var_run_t, consolekit_var_run_t)
')
@@ -18120,7 +18276,7 @@ index f706b99..ab2edfc 100644
+ files_list_pids($1)
')
diff --git a/policy/modules/services/devicekit.te b/policy/modules/services/devicekit.te
-index f231f17..58416a0 100644
+index f231f17..184b4b5 100644
--- a/policy/modules/services/devicekit.te
+++ b/policy/modules/services/devicekit.te
@@ -75,10 +75,12 @@ manage_dirs_pattern(devicekit_disk_t, devicekit_var_lib_t, devicekit_var_lib_t)
@@ -18215,7 +18371,18 @@ index f231f17..58416a0 100644
hal_domtrans_mac(devicekit_power_t)
hal_manage_log(devicekit_power_t)
hal_manage_pid_dirs(devicekit_power_t)
-@@ -280,5 +303,9 @@ optional_policy(`
+@@ -269,6 +292,10 @@ optional_policy(`
+ ')
+
+ optional_policy(`
++ networkmanager_domtrans(devicekit_power_t)
++')
++
++optional_policy(`
+ policykit_dbus_chat(devicekit_power_t)
+ policykit_domtrans_auth(devicekit_power_t)
+ policykit_read_lib(devicekit_power_t)
+@@ -280,5 +307,9 @@ optional_policy(`
')
optional_policy(`
@@ -22168,7 +22335,7 @@ index 3368699..7a7fc02 100644
#
interface(`modemmanager_domtrans',`
diff --git a/policy/modules/services/modemmanager.te b/policy/modules/services/modemmanager.te
-index b3ace16..3dd940c 100644
+index b3ace16..7f18c33 100644
--- a/policy/modules/services/modemmanager.te
+++ b/policy/modules/services/modemmanager.te
@@ -16,7 +16,8 @@ typealias modemmanager_exec_t alias ModemManager_exec_t;
@@ -22189,10 +22356,14 @@ index b3ace16..3dd940c 100644
term_use_unallocated_ttys(modemmanager_t)
miscfiles_read_localization(modemmanager_t)
-@@ -37,5 +39,9 @@ logging_send_syslog_msg(modemmanager_t)
+@@ -37,5 +39,13 @@ logging_send_syslog_msg(modemmanager_t)
networkmanager_dbus_chat(modemmanager_t)
optional_policy(`
++ devicekit_dbus_chat_power(modemmanager_t)
++')
++
++optional_policy(`
+ policykit_dbus_chat(modemmanager_t)
+')
+
@@ -30503,7 +30674,7 @@ index 82cb169..9e72970 100644
+ admin_pattern($1, samba_unconfined_script_exec_t)
')
diff --git a/policy/modules/services/samba.te b/policy/modules/services/samba.te
-index e30bb63..85203da 100644
+index e30bb63..e4334a6 100644
--- a/policy/modules/services/samba.te
+++ b/policy/modules/services/samba.te
@@ -152,9 +152,6 @@ domain_entry_file(winbind_helper_t, winbind_helper_exec_t)
@@ -30525,6 +30696,15 @@ index e30bb63..85203da 100644
dontaudit smbd_t self:capability sys_tty_config;
allow smbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow smbd_t self:process setrlimit;
+@@ -263,7 +260,7 @@ filetrans_pattern(smbd_t, samba_etc_t, samba_secrets_t, file)
+ manage_dirs_pattern(smbd_t, samba_share_t, samba_share_t)
+ manage_files_pattern(smbd_t, samba_share_t, samba_share_t)
+ manage_lnk_files_pattern(smbd_t, samba_share_t, samba_share_t)
+-allow smbd_t samba_share_t:filesystem getattr;
++allow smbd_t samba_share_t:filesystem { getattr quotaget };
+
+ manage_dirs_pattern(smbd_t, samba_var_t, samba_var_t)
+ manage_files_pattern(smbd_t, samba_var_t, samba_var_t)
@@ -279,7 +276,7 @@ files_tmp_filetrans(smbd_t, smbd_tmp_t, { file dir })
manage_dirs_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t)
manage_files_pattern(smbd_t, smbd_var_run_t, smbd_var_run_t)
@@ -35850,7 +36030,7 @@ index da2601a..f963642 100644
+ manage_files_pattern($1, user_fonts_config_t, user_fonts_config_t)
+')
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
-index e226da4..69093aa 100644
+index e226da4..f37e8ae 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -26,27 +26,43 @@ gen_require(`
@@ -36652,7 +36832,7 @@ index e226da4..69093aa 100644
dev_create_generic_dirs(xserver_t)
dev_setattr_generic_dirs(xserver_t)
# raw memory access is needed if not using the frame buffer
-@@ -678,8 +959,13 @@ dev_wx_raw_memory(xserver_t)
+@@ -678,11 +959,17 @@ dev_wx_raw_memory(xserver_t)
dev_rw_xserver_misc(xserver_t)
# read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev(xserver_t)
@@ -36666,7 +36846,11 @@ index e226da4..69093aa 100644
files_read_etc_files(xserver_t)
files_read_etc_runtime_files(xserver_t)
files_read_usr_files(xserver_t)
-@@ -693,8 +979,13 @@ fs_getattr_xattr_fs(xserver_t)
++files_rw_tmpfs_files(xserver_t)
+
+ # brought on by rhgb
+ files_search_mnt(xserver_t)
+@@ -693,8 +980,13 @@ fs_getattr_xattr_fs(xserver_t)
fs_search_nfs(xserver_t)
fs_search_auto_mountpoints(xserver_t)
fs_search_ramfs(xserver_t)
@@ -36680,7 +36864,7 @@ index e226da4..69093aa 100644
selinux_validate_context(xserver_t)
selinux_compute_access_vector(xserver_t)
-@@ -716,11 +1007,14 @@ logging_send_audit_msgs(xserver_t)
+@@ -716,11 +1008,14 @@ logging_send_audit_msgs(xserver_t)
miscfiles_read_localization(xserver_t)
miscfiles_read_fonts(xserver_t)
@@ -36695,7 +36879,7 @@ index e226da4..69093aa 100644
userdom_search_user_home_dirs(xserver_t)
userdom_use_user_ttys(xserver_t)
-@@ -773,12 +1067,28 @@ optional_policy(`
+@@ -773,12 +1068,28 @@ optional_policy(`
')
optional_policy(`
@@ -36725,7 +36909,7 @@ index e226da4..69093aa 100644
unconfined_domtrans(xserver_t)
')
-@@ -787,6 +1097,10 @@ optional_policy(`
+@@ -787,6 +1098,10 @@ optional_policy(`
')
optional_policy(`
@@ -36736,7 +36920,7 @@ index e226da4..69093aa 100644
xfs_stream_connect(xserver_t)
')
-@@ -802,10 +1116,10 @@ allow xserver_t xdm_t:shm rw_shm_perms;
+@@ -802,10 +1117,10 @@ allow xserver_t xdm_t:shm rw_shm_perms;
# NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open
# handle of a file inside the dir!!!
@@ -36750,7 +36934,7 @@ index e226da4..69093aa 100644
# Label pid and temporary files with derived types.
manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
-@@ -813,7 +1127,7 @@ manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
+@@ -813,7 +1128,7 @@ manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
manage_sock_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
# Run xkbcomp.
@@ -36759,7 +36943,7 @@ index e226da4..69093aa 100644
can_exec(xserver_t, xkb_var_lib_t)
# VNC v4 module in X server
-@@ -826,6 +1140,9 @@ init_use_fds(xserver_t)
+@@ -826,6 +1141,9 @@ init_use_fds(xserver_t)
# to read ROLE_home_t - examine this in more detail
# (xauth?)
userdom_read_user_home_content_files(xserver_t)
@@ -36769,7 +36953,7 @@ index e226da4..69093aa 100644
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(xserver_t)
-@@ -841,11 +1158,14 @@ tunable_policy(`use_samba_home_dirs',`
+@@ -841,11 +1159,14 @@ tunable_policy(`use_samba_home_dirs',`
optional_policy(`
dbus_system_bus_client(xserver_t)
@@ -36786,7 +36970,7 @@ index e226da4..69093aa 100644
')
optional_policy(`
-@@ -853,6 +1173,10 @@ optional_policy(`
+@@ -853,6 +1174,10 @@ optional_policy(`
rhgb_rw_tmpfs_files(xserver_t)
')
@@ -36797,7 +36981,7 @@ index e226da4..69093aa 100644
########################################
#
# Rules common to all X window domains
-@@ -896,7 +1220,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
+@@ -896,7 +1221,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show };
# operations allowed on my windows
allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
@@ -36806,7 +36990,7 @@ index e226da4..69093aa 100644
# operations allowed on all windows
allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child };
-@@ -950,11 +1274,31 @@ allow x_domain self:x_resource { read write };
+@@ -950,11 +1275,31 @@ allow x_domain self:x_resource { read write };
# can mess with the screensaver
allow x_domain xserver_t:x_screen { getattr saver_getattr };
@@ -36838,7 +37022,7 @@ index e226da4..69093aa 100644
tunable_policy(`! xserver_object_manager',`
# should be xserver_unconfined(x_domain),
# but typeattribute doesnt work in conditionals
-@@ -976,18 +1320,32 @@ tunable_policy(`! xserver_object_manager',`
+@@ -976,18 +1321,32 @@ tunable_policy(`! xserver_object_manager',`
allow x_domain xevent_type:{ x_event x_synthetic_event } *;
')
@@ -37374,7 +37558,7 @@ index 1c4b1e7..2997dd7 100644
/var/lib/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
-index bea0ade..c411b5e 100644
+index bea0ade..149e383 100644
--- a/policy/modules/system/authlogin.if
+++ b/policy/modules/system/authlogin.if
@@ -57,6 +57,8 @@ interface(`auth_use_pam',`
@@ -37566,7 +37750,33 @@ index bea0ade..c411b5e 100644
## Manage var auth files. Used by various other applications
## and pam applets etc.
## </summary>
-@@ -1500,6 +1586,8 @@ interface(`auth_manage_login_records',`
+@@ -1346,6 +1432,25 @@ interface(`auth_read_login_records',`
+
+ ########################################
+ ## <summary>
++## Read login records files (/var/log/wtmp).
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <rolecap/>
++#
++interface(`auth_dontaudit_read_login_records',`
++ gen_require(`
++ type wtmp_t;
++ ')
++
++ dontaudit $1 wtmp_t:file read_file_perms;
++')
++
++########################################
++## <summary>
+ ## Do not audit attempts to read login records
+ ## files (/var/log/wtmp).
+ ## </summary>
+@@ -1500,6 +1605,8 @@ interface(`auth_manage_login_records',`
#
interface(`auth_use_nsswitch',`
@@ -37575,7 +37785,7 @@ index bea0ade..c411b5e 100644
files_list_var_lib($1)
# read /etc/nsswitch.conf
-@@ -1531,7 +1619,15 @@ interface(`auth_use_nsswitch',`
+@@ -1531,7 +1638,15 @@ interface(`auth_use_nsswitch',`
')
optional_policy(`
@@ -43603,7 +43813,7 @@ index db75976..392d1ee 100644
+HOME_DIR/\.gvfs(/.*)? <<none>>
+HOME_DIR/\.debug(/.*)? <<none>>
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
-index 2aa8928..b4d758b 100644
+index 2aa8928..54365f8 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -30,8 +30,9 @@ template(`userdom_base_user_template',`
@@ -44509,12 +44719,13 @@ index 2aa8928..b4d758b 100644
##############################
#
# Local policy
-@@ -867,45 +1005,103 @@ template(`userdom_restricted_xwindows_user_template',`
+@@ -867,45 +1005,105 @@ template(`userdom_restricted_xwindows_user_template',`
#
auth_role($1_r, $1_t)
- auth_search_pam_console_data($1_t)
+ auth_search_pam_console_data($1_usertype)
++ auth_dontaudit_read_login_records($1_usertype)
- dev_read_sound($1_t)
- dev_write_sound($1_t)
@@ -44573,6 +44784,7 @@ index 2aa8928..b4d758b 100644
+ ')
+
+ optional_policy(`
++ consolekit_dontaudit_read_log($1_usertype)
+ consolekit_dbus_chat($1_usertype)
+ ')
+
@@ -44624,7 +44836,7 @@ index 2aa8928..b4d758b 100644
')
')
-@@ -940,7 +1136,7 @@ template(`userdom_unpriv_user_template', `
+@@ -940,7 +1138,7 @@ template(`userdom_unpriv_user_template', `
#
# Inherit rules for ordinary users.
@@ -44633,7 +44845,7 @@ index 2aa8928..b4d758b 100644
userdom_common_user_template($1)
##############################
-@@ -949,54 +1145,77 @@ template(`userdom_unpriv_user_template', `
+@@ -949,54 +1147,77 @@ template(`userdom_unpriv_user_template', `
#
# port access is audited even if dac would not have allowed it, so dontaudit it here
@@ -44741,7 +44953,7 @@ index 2aa8928..b4d758b 100644
')
')
-@@ -1032,7 +1251,7 @@ template(`userdom_unpriv_user_template', `
+@@ -1032,7 +1253,7 @@ template(`userdom_unpriv_user_template', `
template(`userdom_admin_user_template',`
gen_require(`
attribute admindomain;
@@ -44750,7 +44962,7 @@ index 2aa8928..b4d758b 100644
')
##############################
-@@ -1067,6 +1286,9 @@ template(`userdom_admin_user_template',`
+@@ -1067,6 +1288,9 @@ template(`userdom_admin_user_template',`
# Skip authentication when pam_rootok is specified.
allow $1_t self:passwd rootok;
@@ -44760,7 +44972,7 @@ index 2aa8928..b4d758b 100644
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
kernel_getattr_message_if($1_t)
-@@ -1081,6 +1303,7 @@ template(`userdom_admin_user_template',`
+@@ -1081,6 +1305,7 @@ template(`userdom_admin_user_template',`
kernel_sigstop_unlabeled($1_t)
kernel_signull_unlabeled($1_t)
kernel_sigchld_unlabeled($1_t)
@@ -44768,7 +44980,7 @@ index 2aa8928..b4d758b 100644
corenet_tcp_bind_generic_port($1_t)
# allow setting up tunnels
-@@ -1112,10 +1335,13 @@ template(`userdom_admin_user_template',`
+@@ -1112,10 +1337,13 @@ template(`userdom_admin_user_template',`
domain_sigchld_all_domains($1_t)
# for lsof
domain_getattr_all_sockets($1_t)
@@ -44782,7 +44994,7 @@ index 2aa8928..b4d758b 100644
fs_set_all_quotas($1_t)
fs_exec_noxattr($1_t)
-@@ -1135,6 +1361,7 @@ template(`userdom_admin_user_template',`
+@@ -1135,6 +1363,7 @@ template(`userdom_admin_user_template',`
logging_send_syslog_msg($1_t)
modutils_domtrans_insmod($1_t)
@@ -44790,7 +45002,7 @@ index 2aa8928..b4d758b 100644
# The following rule is temporary until such time that a complete
# policy management infrastructure is in place so that an administrator
-@@ -1203,6 +1430,8 @@ template(`userdom_security_admin_template',`
+@@ -1203,6 +1432,8 @@ template(`userdom_security_admin_template',`
dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1)
@@ -44799,7 +45011,7 @@ index 2aa8928..b4d758b 100644
# Necessary for managing /boot/efi
fs_manage_dos_files($1)
-@@ -1230,6 +1459,7 @@ template(`userdom_security_admin_template',`
+@@ -1230,6 +1461,7 @@ template(`userdom_security_admin_template',`
seutil_run_checkpolicy($1,$2)
seutil_run_loadpolicy($1,$2)
seutil_run_semanage($1,$2)
@@ -44807,7 +45019,7 @@ index 2aa8928..b4d758b 100644
seutil_run_setfiles($1, $2)
optional_policy(`
-@@ -1268,12 +1498,15 @@ template(`userdom_security_admin_template',`
+@@ -1268,12 +1500,15 @@ template(`userdom_security_admin_template',`
interface(`userdom_user_home_content',`
gen_require(`
type user_home_t;
@@ -44824,7 +45036,7 @@ index 2aa8928..b4d758b 100644
')
########################################
-@@ -1384,6 +1617,7 @@ interface(`userdom_search_user_home_dirs',`
+@@ -1384,6 +1619,7 @@ interface(`userdom_search_user_home_dirs',`
')
allow $1 user_home_dir_t:dir search_dir_perms;
@@ -44832,7 +45044,7 @@ index 2aa8928..b4d758b 100644
files_search_home($1)
')
-@@ -1430,6 +1664,14 @@ interface(`userdom_list_user_home_dirs',`
+@@ -1430,6 +1666,14 @@ interface(`userdom_list_user_home_dirs',`
allow $1 user_home_dir_t:dir list_dir_perms;
files_search_home($1)
@@ -44847,7 +45059,7 @@ index 2aa8928..b4d758b 100644
')
########################################
-@@ -1445,9 +1687,11 @@ interface(`userdom_list_user_home_dirs',`
+@@ -1445,9 +1689,11 @@ interface(`userdom_list_user_home_dirs',`
interface(`userdom_dontaudit_list_user_home_dirs',`
gen_require(`
type user_home_dir_t;
@@ -44859,7 +45071,7 @@ index 2aa8928..b4d758b 100644
')
########################################
-@@ -1504,6 +1748,42 @@ interface(`userdom_relabelto_user_home_dirs',`
+@@ -1504,6 +1750,42 @@ interface(`userdom_relabelto_user_home_dirs',`
allow $1 user_home_dir_t:dir relabelto;
')
@@ -44902,7 +45114,7 @@ index 2aa8928..b4d758b 100644
########################################
## <summary>
## Create directories in the home dir root with
-@@ -1578,6 +1858,8 @@ interface(`userdom_dontaudit_search_user_home_content',`
+@@ -1578,6 +1860,8 @@ interface(`userdom_dontaudit_search_user_home_content',`
')
dontaudit $1 user_home_t:dir search_dir_perms;
@@ -44911,7 +45123,7 @@ index 2aa8928..b4d758b 100644
')
########################################
-@@ -1592,10 +1874,12 @@ interface(`userdom_dontaudit_search_user_home_content',`
+@@ -1592,10 +1876,12 @@ interface(`userdom_dontaudit_search_user_home_content',`
#
interface(`userdom_list_user_home_content',`
gen_require(`
@@ -44926,7 +45138,7 @@ index 2aa8928..b4d758b 100644
')
########################################
-@@ -1638,34 +1922,53 @@ interface(`userdom_delete_user_home_content_dirs',`
+@@ -1638,34 +1924,53 @@ interface(`userdom_delete_user_home_content_dirs',`
########################################
## <summary>
@@ -44988,7 +45200,7 @@ index 2aa8928..b4d758b 100644
gen_require(`
type user_home_dir_t, user_home_t;
')
-@@ -1689,12 +1992,32 @@ interface(`userdom_read_user_home_content_files',`
+@@ -1689,12 +1994,32 @@ interface(`userdom_read_user_home_content_files',`
type user_home_dir_t, user_home_t;
')
@@ -45021,7 +45233,7 @@ index 2aa8928..b4d758b 100644
## Do not audit attempts to read user home files.
## </summary>
## <param name="domain">
-@@ -1705,11 +2028,14 @@ interface(`userdom_read_user_home_content_files',`
+@@ -1705,11 +2030,14 @@ interface(`userdom_read_user_home_content_files',`
#
interface(`userdom_dontaudit_read_user_home_content_files',`
gen_require(`
@@ -45039,7 +45251,7 @@ index 2aa8928..b4d758b 100644
')
########################################
-@@ -1799,8 +2125,7 @@ interface(`userdom_read_user_home_content_symlinks',`
+@@ -1799,8 +2127,7 @@ interface(`userdom_read_user_home_content_symlinks',`
type user_home_dir_t, user_home_t;
')
@@ -45049,7 +45261,7 @@ index 2aa8928..b4d758b 100644
')
########################################
-@@ -1816,20 +2141,14 @@ interface(`userdom_read_user_home_content_symlinks',`
+@@ -1816,20 +2143,14 @@ interface(`userdom_read_user_home_content_symlinks',`
#
interface(`userdom_exec_user_home_content_files',`
gen_require(`
@@ -45074,7 +45286,7 @@ index 2aa8928..b4d758b 100644
########################################
## <summary>
-@@ -2171,7 +2490,7 @@ interface(`userdom_dontaudit_read_user_tmp_files',`
+@@ -2171,7 +2492,7 @@ interface(`userdom_dontaudit_read_user_tmp_files',`
type user_tmp_t;
')
@@ -45083,7 +45295,7 @@ index 2aa8928..b4d758b 100644
')
########################################
-@@ -2424,13 +2743,14 @@ interface(`userdom_read_user_tmpfs_files',`
+@@ -2424,13 +2745,14 @@ interface(`userdom_read_user_tmpfs_files',`
')
read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
@@ -45099,7 +45311,7 @@ index 2aa8928..b4d758b 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2451,26 +2771,6 @@ interface(`userdom_rw_user_tmpfs_files',`
+@@ -2451,26 +2773,6 @@ interface(`userdom_rw_user_tmpfs_files',`
########################################
## <summary>
@@ -45126,7 +45338,7 @@ index 2aa8928..b4d758b 100644
## Get the attributes of a user domain tty.
## </summary>
## <param name="domain">
-@@ -2804,7 +3104,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
+@@ -2804,7 +3106,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
domain_entry_file_spec_domtrans($1, unpriv_userdomain)
allow unpriv_userdomain $1:fd use;
@@ -45135,7 +45347,7 @@ index 2aa8928..b4d758b 100644
allow unpriv_userdomain $1:process sigchld;
')
-@@ -2820,11 +3120,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
+@@ -2820,11 +3122,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
#
interface(`userdom_search_user_home_content',`
gen_require(`
@@ -45151,7 +45363,7 @@ index 2aa8928..b4d758b 100644
')
########################################
-@@ -2906,7 +3208,7 @@ interface(`userdom_dontaudit_use_user_ptys',`
+@@ -2906,7 +3210,7 @@ interface(`userdom_dontaudit_use_user_ptys',`
type user_devpts_t;
')
@@ -45160,7 +45372,7 @@ index 2aa8928..b4d758b 100644
')
########################################
-@@ -2961,7 +3263,45 @@ interface(`userdom_write_user_tmp_files',`
+@@ -2961,7 +3265,45 @@ interface(`userdom_write_user_tmp_files',`
type user_tmp_t;
')
@@ -45207,7 +45419,7 @@ index 2aa8928..b4d758b 100644
')
########################################
-@@ -2998,6 +3338,7 @@ interface(`userdom_read_all_users_state',`
+@@ -2998,6 +3340,7 @@ interface(`userdom_read_all_users_state',`
')
read_files_pattern($1, userdomain, userdomain)
@@ -45215,7 +45427,7 @@ index 2aa8928..b4d758b 100644
kernel_search_proc($1)
')
-@@ -3128,3 +3469,854 @@ interface(`userdom_dbus_send_all_users',`
+@@ -3128,3 +3471,854 @@ interface(`userdom_dbus_send_all_users',`
allow $1 userdomain:dbus send_msg;
')
diff --git a/selinux-policy.spec b/selinux-policy.spec
index c224b8f..c261d67 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -21,7 +21,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.9.5
-Release: 8%{?dist}
+Release: 9%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -470,6 +470,20 @@ exit 0
%endif
%changelog
+* Thu Sep 30 2010 Dan Walsh <dwalsh at redhat.com> 3.9.5-9
+- Turn off default transition to mozilla_plugin and telepathy domains from unconfined user
+- Turn off iptables from unconfined user
+- Allow sudo to send signals to any domains the user could have transitioned to.
+- Passwd in single user mode needs to talk to console_device_t
+- Mozilla_plugin_t needs to connect to web ports, needs to write to video device, and read alsa_home_t alsa setsup pulseaudio
+- locate tried to read a symbolic link, will dontaudit
+- New labels for telepathy-sunshine content in homedir
+- Google is storing other binaries under /opt/google/talkplugin
+- bluetooth/kernel is creating unlabeled_t socket that I will allow it to use until kernel fixes bug
+- Add boolean for unconfined_t transition to mozilla_plugin_t and telepathy domains, turned off in F14 on in F15
+- modemmanger and bluetooth send dbus messages to devicekit_power
+- Samba needs to getquota on filesystems labeld samba_share_t
+
* Wed Sep 29 2010 Dan Walsh <dwalsh at redhat.com> 3.9.5-8
- Dontaudit attempts by xdm_t to write to bin_t for kdm
- Allow initrc_t to manage system_conf_t
More information about the scm-commits
mailing list