[selinux-policy] - apcupsd needs to read /etc/passwd - Sanlock allso sends sigkill - Allow glance_registry to connect
Miroslav Grepl
mgrepl at fedoraproject.org
Tue Jun 19 11:41:15 UTC 2012
commit c74d194317e529f3952a891929125f27a30d92c4
Author: Miroslav Grepl <mgrepl at redhat.com>
Date: Tue Jun 19 13:40:53 2012 +0200
- apcupsd needs to read /etc/passwd
- Sanlock allso sends sigkill
- Allow glance_registry to connect to the mysqld port
- Dontaudit mozilla_plugin trying to getattr on /dev/gpmctl
- Allow firefox plugins/flash to connect to port 1234
- Allow mozilla plugins to delete user_tmp_t files
- Add transition name rule for printers.conf.O
- Allow virt_lxc_t to read urand
- Allow systemd_loigind to list gstreamer_home_dirs
- Fix labeling for /usr/bin
- Fixes for cloudform services
* support FIPS
- Allow polipo to work as web caching
- Allow chfn to execute tmux
policy-rawhide.patch | 30 ++++++------
policy_contrib-rawhide.patch | 108 ++++++++++++++++++++++++++---------------
selinux-policy.spec | 18 +++++++-
3 files changed, 100 insertions(+), 56 deletions(-)
---
diff --git a/policy-rawhide.patch b/policy-rawhide.patch
index 1bcf4e2..96b449d 100644
--- a/policy-rawhide.patch
+++ b/policy-rawhide.patch
@@ -58144,7 +58144,7 @@ index 3a45f23..f4754f0 100644
# fork
# setexec
diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors
-index f462e95..d29da40 100644
+index f462e95..e8f76cb 100644
--- a/policy/flask/access_vectors
+++ b/policy/flask/access_vectors
@@ -393,6 +393,10 @@ class system
@@ -58163,7 +58163,7 @@ index f462e95..d29da40 100644
mac_admin # unused by SELinux
syslog
+ wake_alarm
-+ epolwakeup
++ epollwakeup
}
#
@@ -60153,7 +60153,7 @@ index 7590165..59539e8 100644
+ fs_mounton_fusefs(seunshare_domain)
+')
diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
-index db981df..cdbf6c7 100644
+index db981df..b77f19f 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
@@ -1,9 +1,10 @@
@@ -60231,7 +60231,7 @@ index db981df..cdbf6c7 100644
/opt/gutenprint/cups/lib/filter(/.*)? gen_context(system_u:object_r:bin_t,s0)
-@@ -174,53 +183,77 @@ ifdef(`distro_gentoo',`
+@@ -174,53 +183,76 @@ ifdef(`distro_gentoo',`
/opt/vmware/workstation/lib/lib/wrapper-gtk24\.sh -- gen_context(system_u:object_r:bin_t,s0)
')
@@ -60244,7 +60244,6 @@ index db981df..cdbf6c7 100644
/usr/(.*/)?Bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/(.*/)?bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
-/usr/bin/git-shell -- gen_context(system_u:object_r:shell_exec_t,s0)
-+/usr/bin/.* gen_context(system_u:object_r:bin_t,s0)
+/usr/bin/d?ash -- gen_context(system_u:object_r:shell_exec_t,s0)
+/usr/bin/esh -- gen_context(system_u:object_r:shell_exec_t,s0)
+/usr/bin/bash -- gen_context(system_u:object_r:shell_exec_t,s0)
@@ -60326,7 +60325,7 @@ index db981df..cdbf6c7 100644
/usr/lib/xfce4/exo-1/exo-compose-mail-1 -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/xfce4/exo-1/exo-helper-1 -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/xfce4/panel/migrate -- gen_context(system_u:object_r:bin_t,s0)
-@@ -235,10 +268,15 @@ ifdef(`distro_gentoo',`
+@@ -235,10 +267,15 @@ ifdef(`distro_gentoo',`
/usr/lib/debug/sbin(/.*)? -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/debug/usr/bin(/.*)? -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/debug/usr/sbin(/.*)? -- gen_context(system_u:object_r:bin_t,s0)
@@ -60342,7 +60341,7 @@ index db981df..cdbf6c7 100644
/usr/lib/[^/]*/run-mozilla\.sh -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/[^/]*/mozilla-xremote-client -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/thunderbird.*/mozilla-xremote-client -- gen_context(system_u:object_r:bin_t,s0)
-@@ -251,11 +289,18 @@ ifdef(`distro_gentoo',`
+@@ -251,11 +288,18 @@ ifdef(`distro_gentoo',`
/usr/libexec/openssh/sftp-server -- gen_context(system_u:object_r:bin_t,s0)
@@ -60362,7 +60361,7 @@ index db981df..cdbf6c7 100644
/usr/sbin/scponlyc -- gen_context(system_u:object_r:shell_exec_t,s0)
/usr/sbin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0)
/usr/sbin/smrsh -- gen_context(system_u:object_r:shell_exec_t,s0)
-@@ -271,6 +316,10 @@ ifdef(`distro_gentoo',`
+@@ -271,6 +315,10 @@ ifdef(`distro_gentoo',`
/usr/share/cluster/.*\.sh gen_context(system_u:object_r:bin_t,s0)
/usr/share/cluster/ocf-shellfuncs -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/cluster/svclib_nfslock -- gen_context(system_u:object_r:bin_t,s0)
@@ -60373,7 +60372,7 @@ index db981df..cdbf6c7 100644
/usr/share/e16/misc(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/gedit-2/plugins/externaltools/tools(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/gitolite/hooks/common/update -- gen_context(system_u:object_r:bin_t,s0)
-@@ -290,15 +339,19 @@ ifdef(`distro_gentoo',`
+@@ -290,15 +338,19 @@ ifdef(`distro_gentoo',`
/usr/share/smolt/client(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall/compiler\.pl -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall/configpath -- gen_context(system_u:object_r:bin_t,s0)
@@ -60394,7 +60393,7 @@ index db981df..cdbf6c7 100644
ifdef(`distro_debian',`
/usr/lib/ConsoleKit/.* -- gen_context(system_u:object_r:bin_t,s0)
-@@ -314,8 +367,12 @@ ifdef(`distro_redhat', `
+@@ -314,8 +366,12 @@ ifdef(`distro_redhat', `
/etc/gdm/[^/]+ -d gen_context(system_u:object_r:bin_t,s0)
/etc/gdm/[^/]+/.* gen_context(system_u:object_r:bin_t,s0)
@@ -60407,7 +60406,7 @@ index db981df..cdbf6c7 100644
/usr/lib/vmware-tools/(s)?bin32(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib/vmware-tools/(s)?bin64(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/authconfig/authconfig-gtk\.py -- gen_context(system_u:object_r:bin_t,s0)
-@@ -325,9 +382,11 @@ ifdef(`distro_redhat', `
+@@ -325,9 +381,11 @@ ifdef(`distro_redhat', `
/usr/share/clamav/clamd-gen -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/clamav/freshclam-sleep -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/createrepo(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -60419,7 +60418,7 @@ index db981df..cdbf6c7 100644
/usr/share/pwlib/make/ptlib-config -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/pydict/pydict\.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/rhn/rhn_applet/applet\.py -- gen_context(system_u:object_r:bin_t,s0)
-@@ -376,11 +435,14 @@ ifdef(`distro_suse', `
+@@ -376,11 +434,14 @@ ifdef(`distro_suse', `
#
# /var
#
@@ -60435,7 +60434,7 @@ index db981df..cdbf6c7 100644
/usr/lib/yp/.+ -- gen_context(system_u:object_r:bin_t,s0)
/var/qmail/bin -d gen_context(system_u:object_r:bin_t,s0)
-@@ -390,3 +452,12 @@ ifdef(`distro_suse', `
+@@ -390,3 +451,12 @@ ifdef(`distro_suse', `
ifdef(`distro_suse',`
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
')
@@ -85742,10 +85741,10 @@ index 0000000..2497606
+
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644
-index 0000000..76b90b2
+index 0000000..a558441
--- /dev/null
+++ b/policy/modules/system/systemd.te
-@@ -0,0 +1,420 @@
+@@ -0,0 +1,421 @@
+policy_module(systemd, 1.0.0)
+
+#######################################
@@ -85906,6 +85905,7 @@ index 0000000..76b90b2
+ gnome_manage_home_config_dirs(systemd_logind_t)
+ gnome_manage_home_config(systemd_logind_t)
+ gnome_list_gkeyringd_tmp_dirs(systemd_logind_t)
++ gnome_manage_gstreamer_home_dirs(systemd_logind_t)
+')
+
+optional_policy(`
diff --git a/policy_contrib-rawhide.patch b/policy_contrib-rawhide.patch
index 8566bc4..2ee5085 100644
--- a/policy_contrib-rawhide.patch
+++ b/policy_contrib-rawhide.patch
@@ -3746,7 +3746,7 @@ index e342775..1fedbe5 100644
+ allow $1 apcupsd_unit_file_t:service all_service_perms;
')
diff --git a/apcupsd.te b/apcupsd.te
-index d052bf0..77e6e19 100644
+index d052bf0..6c7828b 100644
--- a/apcupsd.te
+++ b/apcupsd.te
@@ -24,6 +24,9 @@ files_tmp_file(apcupsd_tmp_t)
@@ -3759,7 +3759,7 @@ index d052bf0..77e6e19 100644
########################################
#
# apcupsd local policy
-@@ -76,6 +79,7 @@ files_etc_filetrans_etc_runtime(apcupsd_t, file)
+@@ -76,24 +79,31 @@ files_etc_filetrans_etc_runtime(apcupsd_t, file)
# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=240805
term_use_unallocated_ttys(apcupsd_t)
@@ -3767,7 +3767,13 @@ index d052bf0..77e6e19 100644
#apcupsd runs shutdown, probably need a shutdown domain
init_rw_utmp(apcupsd_t)
-@@ -87,13 +91,17 @@ miscfiles_read_localization(apcupsd_t)
+ init_telinit(apcupsd_t)
+
++auth_read_passwd(apcupsd_t)
++
+ logging_send_syslog_msg(apcupsd_t)
+
+ miscfiles_read_localization(apcupsd_t)
sysnet_dns_name_resolve(apcupsd_t)
@@ -8433,10 +8439,10 @@ index b40f3f7..3676ecc 100644
#
diff --git a/cloudform.fc b/cloudform.fc
new file mode 100644
-index 0000000..f2968f8
+index 0000000..3fe384f
--- /dev/null
+++ b/cloudform.fc
-@@ -0,0 +1,23 @@
+@@ -0,0 +1,22 @@
+/etc/rc\.d/init\.d/iwhd -- gen_context(system_u:object_r:iwhd_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/mongod -- gen_context(system_u:object_r:mongod_initrc_exec_t,s0)
+
@@ -8453,8 +8459,7 @@ index 0000000..f2968f8
+/var/log/deltacloud-core(/.*)? gen_context(system_u:object_r:deltacloudd_log_t,s0)
+/var/log/iwhd\.log -- gen_context(system_u:object_r:iwhd_log_t,s0)
+/var/log/mongodb(/.*)? gen_context(system_u:object_r:mongod_log_t,s0)
-+
-+
++/var/log/thin\.log -- gen_context(system_u:object_r:thin_log_t,s0)
+
+/var/run/mongodb(/.*)? gen_context(system_u:object_r:mongod_var_run_t,s0)
+/var/run/aeolus/dbomatic\.pid -- gen_context(system_u:object_r:mongod_var_run_t,s0)
@@ -8508,10 +8513,10 @@ index 0000000..7f55959
+')
diff --git a/cloudform.te b/cloudform.te
new file mode 100644
-index 0000000..2709243
+index 0000000..787b40a
--- /dev/null
+++ b/cloudform.te
-@@ -0,0 +1,224 @@
+@@ -0,0 +1,236 @@
+policy_module(cloudform, 1.0)
+########################################
+#
@@ -8525,6 +8530,9 @@ index 0000000..2709243
+cloudform_domain_template(mongod)
+cloudform_domain_template(thin)
+
++type thin_log_t;
++logging_log_file(thin_log_t)
++
+type deltacloudd_log_t;
+logging_log_file(deltacloudd_log_t)
+
@@ -8572,10 +8580,15 @@ index 0000000..2709243
+allow cloudform_domain self:fifo_file rw_fifo_file_perms;
+allow cloudform_domain self:tcp_socket create_stream_socket_perms;
+
++kernel_read_system_state(cloudform_domain)
++
++dev_read_rand(cloudform_domain)
+dev_read_urand(cloudform_domain)
+
+files_read_etc_files(cloudform_domain)
+
++auth_read_passwd(cloudform_domain)
++
+miscfiles_read_certs(cloudform_domain)
+miscfiles_read_localization(cloudform_domain)
+
@@ -8714,6 +8727,10 @@ index 0000000..2709243
+allow thin_t self:udp_socket create_socket_perms;
+allow thin_t self:unix_stream_socket create_stream_socket_perms;
+
++manage_files_pattern(thin_t, thin_log_t, thin_log_t)
++manage_dirs_pattern(thin_t, thin_log_t, thin_log_t)
++logging_log_filetrans(thin_t, thin_log_t, { file dir })
++
+manage_files_pattern(thin_t, thin_var_run_t, thin_var_run_t)
+files_pid_filetrans(thin_t, thin_var_run_t, { file })
+
@@ -12843,7 +12860,7 @@ index 848bb92..25c56f7 100644
+
+/usr/local/linuxprinter/ppd(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
diff --git a/cups.if b/cups.if
-index 305ddf4..3629b92 100644
+index 305ddf4..11d010a 100644
--- a/cups.if
+++ b/cups.if
@@ -9,6 +9,11 @@
@@ -12928,7 +12945,7 @@ index 305ddf4..3629b92 100644
init_labeled_script_domtrans($1, cupsd_initrc_exec_t)
domain_system_change_exemption($1)
role_transition $2 cupsd_initrc_exec_t system_r;
-@@ -350,9 +384,41 @@ interface(`cups_admin',`
+@@ -350,9 +384,42 @@ interface(`cups_admin',`
admin_pattern($1, cupsd_var_run_t)
files_list_pids($1)
@@ -12963,6 +12980,7 @@ index 305ddf4..3629b92 100644
+
+ filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "classes.conf")
+ filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "printers.conf")
++ filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "printers.conf.O")
+ filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "cupsd.conf")
+ filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "cupsd.conf.default")
+ filetrans_pattern($1, cups_etc_t, cups_rw_etc_t, file, "lpoptions")
@@ -20118,7 +20136,7 @@ index 7ff9d6d..6b0a7ff 100644
allow $1 glance_api_t:process signal_perms;
ps_process_pattern($1, glance_api_t)
diff --git a/glance.te b/glance.te
-index 4afb81f..842165a 100644
+index 4afb81f..40df3ea 100644
--- a/glance.te
+++ b/glance.te
@@ -57,12 +57,17 @@ manage_files_pattern(glance_domain, glance_var_run_t, glance_var_run_t)
@@ -20139,10 +20157,11 @@ index 4afb81f..842165a 100644
miscfiles_read_localization(glance_domain)
optional_policy(`
-@@ -80,6 +85,14 @@ files_tmp_filetrans(glance_registry_t, glance_registry_tmp_t, { file dir })
+@@ -80,6 +85,15 @@ files_tmp_filetrans(glance_registry_t, glance_registry_tmp_t, { file dir })
corenet_tcp_bind_generic_node(glance_registry_t)
corenet_tcp_bind_glance_registry_port(glance_registry_t)
++corenet_tcp_connect_mysqld_port(glance_registry_t)
+corenet_tcp_connect_all_ephemeral_ports(glance_registry_t)
+
+logging_send_syslog_msg(glance_registry_t)
@@ -20154,7 +20173,7 @@ index 4afb81f..842165a 100644
########################################
#
-@@ -94,11 +107,11 @@ can_exec(glance_api_t, glance_tmp_t)
+@@ -94,11 +108,11 @@ can_exec(glance_api_t, glance_tmp_t)
corecmd_exec_shell(glance_api_t)
corenet_tcp_bind_generic_node(glance_api_t)
@@ -30146,7 +30165,7 @@ index b397fde..30bfefb 100644
+')
+
diff --git a/mozilla.te b/mozilla.te
-index 0724816..c1fa8ea 100644
+index 0724816..0749777 100644
--- a/mozilla.te
+++ b/mozilla.te
@@ -12,14 +12,22 @@ policy_module(mozilla, 2.5.3)
@@ -30316,7 +30335,7 @@ index 0724816..c1fa8ea 100644
manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
manage_lnk_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
-@@ -323,31 +350,46 @@ manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plug
+@@ -323,31 +350,47 @@ manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plug
manage_sock_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
fs_tmpfs_filetrans(mozilla_plugin_t, mozilla_plugin_tmpfs_t, { file lnk_file sock_file fifo_file })
@@ -30358,6 +30377,7 @@ index 0724816..c1fa8ea 100644
+corenet_tcp_connect_soundd_port(mozilla_plugin_t)
+corenet_tcp_connect_vnc_port(mozilla_plugin_t)
+corenet_tcp_connect_couchdb_port(mozilla_plugin_t)
++corenet_tcp_connect_monopd_port(mozilla_plugin_t)
+corenet_tcp_connect_all_ephemeral_ports(mozilla_plugin_t)
+corenet_tcp_bind_generic_node(mozilla_plugin_t)
+corenet_udp_bind_generic_node(mozilla_plugin_t)
@@ -30369,7 +30389,7 @@ index 0724816..c1fa8ea 100644
dev_read_video_dev(mozilla_plugin_t)
dev_write_video_dev(mozilla_plugin_t)
dev_read_sysfs(mozilla_plugin_t)
-@@ -356,6 +398,7 @@ dev_write_sound(mozilla_plugin_t)
+@@ -356,6 +399,7 @@ dev_write_sound(mozilla_plugin_t)
# for nvidia driver
dev_rw_xserver_misc(mozilla_plugin_t)
dev_dontaudit_rw_dri(mozilla_plugin_t)
@@ -30377,7 +30397,7 @@ index 0724816..c1fa8ea 100644
domain_use_interactive_fds(mozilla_plugin_t)
domain_dontaudit_read_all_domains_state(mozilla_plugin_t)
-@@ -363,15 +406,22 @@ domain_dontaudit_read_all_domains_state(mozilla_plugin_t)
+@@ -363,15 +407,22 @@ domain_dontaudit_read_all_domains_state(mozilla_plugin_t)
files_read_config_files(mozilla_plugin_t)
files_read_usr_files(mozilla_plugin_t)
files_list_mnt(mozilla_plugin_t)
@@ -30400,7 +30420,7 @@ index 0724816..c1fa8ea 100644
logging_send_syslog_msg(mozilla_plugin_t)
miscfiles_read_localization(mozilla_plugin_t)
-@@ -384,35 +434,26 @@ sysnet_dns_name_resolve(mozilla_plugin_t)
+@@ -384,35 +435,27 @@ sysnet_dns_name_resolve(mozilla_plugin_t)
term_getattr_all_ttys(mozilla_plugin_t)
term_getattr_all_ptys(mozilla_plugin_t)
@@ -30413,6 +30433,7 @@ index 0724816..c1fa8ea 100644
userdom_manage_user_tmp_dirs(mozilla_plugin_t)
-userdom_read_user_tmp_files(mozilla_plugin_t)
+userdom_rw_inherited_user_tmp_files(mozilla_plugin_t)
++userdom_delete_user_tmp_files(mozilla_plugin_t)
+userdom_rw_inherited_user_home_sock_files(mozilla_plugin_t)
+userdom_manage_home_certs(mozilla_plugin_t)
userdom_read_user_tmp_symlinks(mozilla_plugin_t)
@@ -30447,7 +30468,7 @@ index 0724816..c1fa8ea 100644
optional_policy(`
alsa_read_rw_config(mozilla_plugin_t)
-@@ -422,35 +463,135 @@ optional_policy(`
+@@ -422,24 +465,36 @@ optional_policy(`
optional_policy(`
dbus_system_bus_client(mozilla_plugin_t)
dbus_session_bus_client(mozilla_plugin_t)
@@ -30467,7 +30488,14 @@ index 0724816..c1fa8ea 100644
')
optional_policy(`
- java_exec(mozilla_plugin_t)
+- java_exec(mozilla_plugin_t)
++ gpm_dontaudit_getattr_gpmctl(mozilla_plugin_t)
+ ')
+
+ optional_policy(`
+- mplayer_exec(mozilla_plugin_t)
+- mplayer_read_user_home_files(mozilla_plugin_t)
++ java_exec(mozilla_plugin_t)
')
+#optional_policy(`
@@ -30475,16 +30503,13 @@ index 0724816..c1fa8ea 100644
+#')
+
optional_policy(`
- mplayer_exec(mozilla_plugin_t)
- mplayer_read_user_home_files(mozilla_plugin_t)
+- pcscd_stream_connect(mozilla_plugin_t)
++ mplayer_exec(mozilla_plugin_t)
++ mplayer_read_user_home_files(mozilla_plugin_t)
')
optional_policy(`
-- pcscd_stream_connect(mozilla_plugin_t)
--')
--
--optional_policy(`
- pulseaudio_exec(mozilla_plugin_t)
+@@ -447,10 +502,102 @@ optional_policy(`
pulseaudio_stream_connect(mozilla_plugin_t)
pulseaudio_setattr_home_dir(mozilla_plugin_t)
pulseaudio_manage_home_files(mozilla_plugin_t)
@@ -30506,14 +30531,14 @@ index 0724816..c1fa8ea 100644
+optional_policy(`
+ xserver_xdm_tmp_filetrans(mozilla_plugin_t, mozilla_plugin_tmp_t, { dir file fifo_file sock_file })
+ xserver_dontaudit_read_xdm_tmp_files(mozilla_plugin_t)
-+ xserver_dontaudit_xdm_tmp_dirs(mozilla_plugin_t)
xserver_read_xdm_pid(mozilla_plugin_t)
xserver_stream_connect(mozilla_plugin_t)
xserver_use_user_fonts(mozilla_plugin_t)
+ xserver_read_user_iceauth(mozilla_plugin_t)
+ xserver_read_user_xauth(mozilla_plugin_t)
-+ xserver_append_xdm_home_files(mozilla_plugin_t);
-+')
++ xserver_append_xdm_home_files(mozilla_plugin_t)
++ xserver_dontaudit_xdm_tmp_dirs(mozilla_plugin_t)
+ ')
+
+########################################
+#
@@ -30572,7 +30597,7 @@ index 0724816..c1fa8ea 100644
+
+optional_policy(`
+ xserver_use_user_fonts(mozilla_plugin_config_t)
- ')
++')
+ifdef(`distro_redhat',`
+ typealias mozilla_plugin_t alias nsplugin_t;
+ typealias mozilla_plugin_exec_t alias nsplugin_exec_t;
@@ -39145,10 +39170,10 @@ index 0000000..d00f6ba
+')
diff --git a/polipo.te b/polipo.te
new file mode 100644
-index 0000000..c08cddc
+index 0000000..781625a
--- /dev/null
+++ b/polipo.te
-@@ -0,0 +1,171 @@
+@@ -0,0 +1,172 @@
+policy_module(polipo, 1.0.0)
+
+########################################
@@ -39254,6 +39279,7 @@ index 0000000..c08cddc
+corenet_tcp_sendrecv_http_cache_port(polipo_daemon)
+corenet_tcp_bind_http_cache_port(polipo_daemon)
+corenet_sendrecv_http_cache_server_packets(polipo_daemon)
++corenet_tcp_connect_http_port(polipo_daemon)
+
+files_read_usr_files(polipo_daemon)
+
@@ -50252,7 +50278,7 @@ index cfe3172..3eb745d 100644
+
')
diff --git a/sanlock.te b/sanlock.te
-index e02eb6c..f1314b0 100644
+index e02eb6c..c4130e0 100644
--- a/sanlock.te
+++ b/sanlock.te
@@ -1,4 +1,4 @@
@@ -50291,7 +50317,7 @@ index e02eb6c..f1314b0 100644
-allow sanlock_t self:capability { sys_nice ipc_lock };
-allow sanlock_t self:process { setsched signull };
+allow sanlock_t self:capability { chown setgid dac_override ipc_lock sys_nice };
-+allow sanlock_t self:process { setsched signull signal };
++allow sanlock_t self:process { setsched signull signal sigkill };
+
allow sanlock_t self:fifo_file rw_fifo_file_perms;
allow sanlock_t self:unix_stream_socket create_stream_socket_perms;
@@ -54745,10 +54771,10 @@ index 0000000..9127cec
+')
diff --git a/thumb.te b/thumb.te
new file mode 100644
-index 0000000..e379b1b
+index 0000000..89684c9
--- /dev/null
+++ b/thumb.te
-@@ -0,0 +1,109 @@
+@@ -0,0 +1,110 @@
+policy_module(thumb, 1.0.0)
+
+########################################
@@ -54819,6 +54845,7 @@ index 0000000..e379b1b
+files_read_usr_files(thumb_t)
+files_read_non_security_files(thumb_t)
+
++fs_getattr_all_fs(thumb_t)
+fs_read_dos_files(thumb_t)
+
+auth_use_nsswitch(thumb_t)
@@ -56983,7 +57010,7 @@ index 7c5d8d8..85b7d8b 100644
+ files_pid_filetrans($1, virt_lxc_var_run_t, dir, "libvirt-sandbox")
')
diff --git a/virt.te b/virt.te
-index ad3068a..55dd15c 100644
+index ad3068a..caef8cf 100644
--- a/virt.te
+++ b/virt.te
@@ -5,56 +5,87 @@ policy_module(virt, 1.4.2)
@@ -57587,7 +57614,7 @@ index ad3068a..55dd15c 100644
files_read_usr_files(virt_domain)
files_read_var_files(virt_domain)
files_search_all(virt_domain)
-@@ -449,25 +658,429 @@ files_search_all(virt_domain)
+@@ -449,25 +658,430 @@ files_search_all(virt_domain)
fs_getattr_tmpfs(virt_domain)
fs_rw_anon_inodefs_files(virt_domain)
fs_rw_tmpfs_files(virt_domain)
@@ -57787,6 +57814,7 @@ index ad3068a..55dd15c 100644
+dev_relabel_all_dev_nodes(virtd_lxc_t)
+dev_rw_sysfs(virtd_lxc_t)
+dev_read_sysfs(virtd_lxc_t)
++dev_read_urand(virtd_lxc_t)
+
+domain_use_interactive_fds(virtd_lxc_t)
+
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 5059ec6..bbb1316 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.11.0
-Release: 4%{?dist}
+Release: 5%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -491,6 +491,22 @@ SELinux Reference policy mls base module.
%endif
%changelog
+* Tue Jun 19 2012 Miroslav Grepl <mgrepl at redhat.com> 3.11.0-5
+- apcupsd needs to read /etc/passwd
+- Sanlock allso sends sigkill
+- Allow glance_registry to connect to the mysqld port
+- Dontaudit mozilla_plugin trying to getattr on /dev/gpmctl
+- Allow firefox plugins/flash to connect to port 1234
+- Allow mozilla plugins to delete user_tmp_t files
+- Add transition name rule for printers.conf.O
+- Allow virt_lxc_t to read urand
+- Allow systemd_loigind to list gstreamer_home_dirs
+- Fix labeling for /usr/bin
+- Fixes for cloudform services
+ * support FIPS
+- Allow polipo to work as web caching
+- Allow chfn to execute tmux
+
* Fri Jun 15 2012 Miroslav Grepl <mgrepl at redhat.com> 3.11.0-4
- Add support for ecryptfs
* ecryptfs does not support xattr
More information about the scm-commits
mailing list