[selinux-policy: 2836/3172] Latest fixes
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 23:12:29 UTC 2010
commit 08e567dc5691717330404a7b564355f764653da4
Author: Dan Walsh <dwalsh at redhat.com>
Date: Thu Aug 26 20:30:04 2010 -0400
Latest fixes
policy/modules/admin/alsa.fc | 2 +-
policy/modules/admin/sectoolm.te | 1 -
policy/modules/kernel/filesystem.fc | 1 +
policy/modules/services/clamav.te | 2 +-
policy/modules/services/cobbler.if | 7 +++----
policy/modules/services/devicekit.te | 2 ++
policy/modules/services/dhcp.te | 3 +--
policy/modules/services/hddtemp.fc | 2 ++
policy/modules/services/kerberos.te | 2 ++
policy/modules/services/ldap.fc | 2 +-
policy/modules/services/virt.fc | 1 +
policy/modules/system/authlogin.fc | 1 +
policy/modules/system/init.te | 3 +++
13 files changed, 19 insertions(+), 10 deletions(-)
---
diff --git a/policy/modules/admin/alsa.fc b/policy/modules/admin/alsa.fc
index 1b43fbe..f5fc753 100644
--- a/policy/modules/admin/alsa.fc
+++ b/policy/modules/admin/alsa.fc
@@ -2,7 +2,7 @@ HOME_DIR/\.asoundrc -- gen_context(system_u:object_r:alsa_home_t,s0)
/bin/alsaunmute -- gen_context(system_u:object_r:alsa_exec_t,s0)
-/etc/alsa/asound\.state -- gen_context(system_u:object_r:alsa_etc_rw_t,s0)
+/etc/alsa/asound\.state -- gen_context(system_u:object_r:alsa_etc_rw_t,s0)
/etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0)
/etc/asound(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0)
/etc/asound\.state -- gen_context(system_u:object_r:alsa_etc_rw_t,s0)
diff --git a/policy/modules/admin/sectoolm.te b/policy/modules/admin/sectoolm.te
index d7083b8..c8ef84b 100644
--- a/policy/modules/admin/sectoolm.te
+++ b/policy/modules/admin/sectoolm.te
@@ -84,7 +84,6 @@ logging_send_syslog_msg(sectoolm_t)
sysnet_domtrans_ifconfig(sectoolm_t)
userdom_manage_user_tmp_sockets(sectoolm_t)
-userdom_write_user_tmp_sockets(sectoolm_t)
optional_policy(`
mount_exec(sectoolm_t)
diff --git a/policy/modules/kernel/filesystem.fc b/policy/modules/kernel/filesystem.fc
index 445d291..9a1e6a7 100644
--- a/policy/modules/kernel/filesystem.fc
+++ b/policy/modules/kernel/filesystem.fc
@@ -1,3 +1,4 @@
/dev/shm -d gen_context(system_u:object_r:tmpfs_t,s0)
/cgroup(/.*)? gen_context(system_u:object_r:cgroup_t,s0)
+/sys/fs/cgroup(/.*)? gen_context(system_u:object_r:cgroup_t,s0)
diff --git a/policy/modules/services/clamav.te b/policy/modules/services/clamav.te
index edee785..0a0f374 100644
--- a/policy/modules/services/clamav.te
+++ b/policy/modules/services/clamav.te
@@ -90,7 +90,7 @@ manage_files_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t)
logging_log_filetrans(clamd_t, clamd_var_log_t, { dir file })
# pid file
-manage_dirs_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t)
+manage_dirs_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t)
manage_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t)
manage_sock_files_pattern(clamd_t, clamd_var_run_t, clamd_var_run_t)
files_pid_filetrans(clamd_t, clamd_var_run_t, { sock_file file dir })
diff --git a/policy/modules/services/cobbler.if b/policy/modules/services/cobbler.if
index cde1fc2..a57fe37 100644
--- a/policy/modules/services/cobbler.if
+++ b/policy/modules/services/cobbler.if
@@ -148,7 +148,7 @@ interface(`cobbler_manage_lib_files',`
########################################
## <summary>
-## Read and write Cobbler log files.
+## dontaudit read and write Cobbler log files.
## </summary>
## <param name="domain">
## <summary>
@@ -156,13 +156,12 @@ interface(`cobbler_manage_lib_files',`
## </summary>
## </param>
#
-interface(`cobbler_rw_log',`
+interface(`cobbler_dontaudit_rw_log',`
gen_require(`
type cobbler_var_log_t;
')
- rw_files_pattern($1, cobbler_var_log_t, cobbler_var_log_t)
- logging_search_logs($1)
+ dontaudit $1 cobbler_var_log_t:file rw_inherited_files_perms;
')
########################################
diff --git a/policy/modules/services/devicekit.te b/policy/modules/services/devicekit.te
index f532a16..a7de603 100644
--- a/policy/modules/services/devicekit.te
+++ b/policy/modules/services/devicekit.te
@@ -241,6 +241,8 @@ auth_use_nsswitch(devicekit_power_t)
miscfiles_read_localization(devicekit_power_t)
+modutils_domtrans_insmod(devicekit_power_t)
+
sysnet_read_config(devicekit_power_t)
sysnet_domtrans_ifconfig(devicekit_power_t)
diff --git a/policy/modules/services/dhcp.te b/policy/modules/services/dhcp.te
index 506dbc6..a307b51 100644
--- a/policy/modules/services/dhcp.te
+++ b/policy/modules/services/dhcp.te
@@ -111,8 +111,7 @@ optional_policy(`
')
optional_policy(`
- # Should we dontaudit or not?
- cobbler_rw_log(dhcpd_t)
+ cobbler_dontaudit_rw_log(dhcpd_t)
')
optional_policy(`
diff --git a/policy/modules/services/hddtemp.fc b/policy/modules/services/hddtemp.fc
index 67ea7b6..1676612 100644
--- a/policy/modules/services/hddtemp.fc
+++ b/policy/modules/services/hddtemp.fc
@@ -1,3 +1,5 @@
/etc/rc\.d/init\.d/hddtemp -- gen_context(system_u:object_r:hddtemp_initrc_exec_t,s0)
+/etc/sysconfig/hddtemp -- gen_context(system_u:object_r:hddtemp_etc_t,s0)
+
/usr/sbin/hddtemp -- gen_context(system_u:object_r:hddtemp_exec_t,s0)
diff --git a/policy/modules/services/kerberos.te b/policy/modules/services/kerberos.te
index 8401e48..6deff48 100644
--- a/policy/modules/services/kerberos.te
+++ b/policy/modules/services/kerberos.te
@@ -152,6 +152,7 @@ selinux_validate_context(kadmind_t)
logging_send_syslog_msg(kadmind_t)
+miscfiles_read_certs(kadmind_t)
miscfiles_read_localization(kadmind_t)
seutil_read_file_contexts(kadmind_t)
@@ -251,6 +252,7 @@ selinux_validate_context(krb5kdc_t)
logging_send_syslog_msg(krb5kdc_t)
+miscfiles_read_certs(krb5kdc_t)
miscfiles_read_localization(krb5kdc_t)
seutil_read_file_contexts(krb5kdc_t)
diff --git a/policy/modules/services/ldap.fc b/policy/modules/services/ldap.fc
index a66e078..335fda1 100644
--- a/policy/modules/services/ldap.fc
+++ b/policy/modules/services/ldap.fc
@@ -17,4 +17,4 @@ ifdef(`distro_debian',`
/var/run/openldap(/.*)? gen_context(system_u:object_r:slapd_var_run_t,s0)
/var/run/slapd\.args -- gen_context(system_u:object_r:slapd_var_run_t,s0)
/var/run/slapd\.pid -- gen_context(system_u:object_r:slapd_var_run_t,s0)
-#/var/run/slapd.* -s gen_context(system_u:object_r:slapd_var_run_t,s0)
+/var/run/slapd.* -s gen_context(system_u:object_r:slapd_var_run_t,s0)
diff --git a/policy/modules/services/virt.fc b/policy/modules/services/virt.fc
index 03f2501..be4b00f 100644
--- a/policy/modules/services/virt.fc
+++ b/policy/modules/services/virt.fc
@@ -1,3 +1,4 @@
+HOME_DIR/.libvirt(/.*)? gen_context(system_u:object_r:virt_content_t,s0)
HOME_DIR/.virtinst(/.*)? gen_context(system_u:object_r:virt_content_t,s0)
HOME_DIR/VirtualMachines(/.*)? gen_context(system_u:object_r:virt_image_t,s0)
HOME_DIR/VirtualMachines/isos(/.*)? gen_context(system_u:object_r:virt_content_t,s0)
diff --git a/policy/modules/system/authlogin.fc b/policy/modules/system/authlogin.fc
index 9785c68..2997dd7 100644
--- a/policy/modules/system/authlogin.fc
+++ b/policy/modules/system/authlogin.fc
@@ -28,6 +28,7 @@ ifdef(`distro_gentoo', `
/var/db/shadow.* -- gen_context(system_u:object_r:shadow_t,s0)
+/var/run/user(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
/var/lib/abl(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
/var/lib/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0)
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 26a93da..cd266c0 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -220,6 +220,7 @@ storage_raw_rw_fixed_disk(init_t)
modutils_domtrans_insmod(init_t)
tunable_policy(`init_systemd',`
+ allow init_t self:unix_dgram_socket create_socket_perms;
allow init_t self:process { setsockcreate setfscreate };
allow init_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow init_t self:netlink_kobject_uevent_socket create_socket_perms;
@@ -256,6 +257,8 @@ tunable_policy(`init_systemd',`
init_read_script_state(init_t)
seutil_read_file_contexts(init_t)
+
+ storage_getattr_removable_dev(init_t)
')
optional_policy(`
More information about the scm-commits
mailing list