scm-commits March 2011

scm-commits@lists.fedoraproject.org

379 participants
14469 discussions

[usermode/f15/master] (2 commits) ...Add UGROUPS=wheel to config-util
by Miloslav Trmac 31 Mar '11

31 Mar '11

Summary of changes: 2d24fa9... Update to usermode-1.107 (*) 459a768... Add UGROUPS=wheel to config-util (*) (*) This commit already existed in another branch; no separate mail sent

1 0

[perl-Perl-Critic] Created tag perl-Perl-Critic-1.114-1.fc16
by Paul Howarth 31 Mar '11

31 Mar '11

The lightweight tag 'perl-Perl-Critic-1.114-1.fc16' was created pointing to: 2868c63... Tidy dependencies and add --with authortests build option

1 0

[perl-Perl-Critic] Created tag perl-Perl-Critic-1.114-1.fc15
by Paul Howarth 31 Mar '11

31 Mar '11

The lightweight tag 'perl-Perl-Critic-1.114-1.fc15' was created pointing to: 2868c63... Tidy dependencies and add --with authortests build option

1 0

[selinux-policy/f15/master] - A lot of fixes making /run change working - Add subs file to equate /var/run with /run and /var/lo
by Miroslav Grepl 31 Mar '11

31 Mar '11

commit 143c3c644e7f8dfdcfed561317a679ddec857dd6 Author: Miroslav Grepl <mgrepl(a)redhat.com> Date: Thu Mar 31 23:08:45 2011 +0000 - A lot of fixes making /run change working - Add subs file to equate /var/run with /run and /var/lock with /run/lock - Allow rgmanager to send the kill signal to all users - Allow ssh_t to search /root/.ssh and create it if it does not exist - dontaudit read of user_tmp_t from load_policy - Allow abrt fowner capability - Allow audit daemons to change the run level in MLS environments - Since /var/lock is moving to /run/lock. We need to allow all interfaces for lock files to search var_run_t - Add file labelfor MathKernel - Add label for /dev/dlm* - Allow systemd_tmpfiles_t to manage sandbox data - More /run directories labels - rlogind sends kill signal to chkpwd_t - systemd is now mounting on /var/lock policy-F15.patch | 762 +++++++++++++++++++++++++++++++++++++-------------- selinux-policy.spec | 15 +- 2 files changed, 571 insertions(+), 206 deletions(-) --- diff --git a/policy-F15.patch b/policy-F15.patch index 873d343..716da52 100644 --- a/policy-F15.patch +++ b/policy-F15.patch @@ -1,12 +1,12 @@ diff --git a/Makefile b/Makefile -index b8486a0..72a53cc 100644 +index b8486a0..6153c8b 100644 --- a/Makefile +++ b/Makefile @@ -61,6 +61,7 @@ SEMODULE ?= $(tc_usrsbindir)/semodule SEMOD_PKG ?= $(tc_usrbindir)/semodule_package SEMOD_LNK ?= $(tc_usrbindir)/semodule_link SEMOD_EXP ?= $(tc_usrbindir)/semodule_expand -+SEPOLGEN ?= $(tc_usrbindir)/sepolgen-ifgen ++#SEPOLGEN ?= $(tc_usrbindir)/sepolgen-ifgen LOADPOLICY ?= $(tc_usrsbindir)/load_policy SETFILES ?= $(tc_sbindir)/setfiles XMLLINT ?= $(BINDIR)/xmllint @@ -20,14 +20,14 @@ index b8486a0..72a53cc 100644 all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d) diff --git a/Rules.modular b/Rules.modular -index 168a14f..c2bf491 100644 +index 168a14f..cc1f793 100644 --- a/Rules.modular +++ b/Rules.modular @@ -207,6 +207,7 @@ validate: $(base_pkg) $(mod_pkgs) @echo "Validating policy linking." $(verbose) $(SEMOD_LNK) -o $(tmpdir)/test.lnk $^ $(verbose) $(SEMOD_EXP) $(tmpdir)/test.lnk $(tmpdir)/policy.bin -+ $(verbose) $(SEPOLGEN) -p $(tmpdir)/policy.bin -i $(poldir) -o $(tmpdir)/output ++# $(verbose) $(SEPOLGEN) -p $(tmpdir)/policy.bin -i $(poldir) -o $(tmpdir)/output @echo "Success." ######################################## @@ -1426,10 +1426,10 @@ index 7077413..56d1ecb 100644 + +/dev/\.systemd/readahead(/.*)? gen_context(system_u:object_r:readahead_var_run_t,s0) diff --git a/policy/modules/admin/readahead.if b/policy/modules/admin/readahead.if -index 47c4723..c1bed2b 100644 +index 47c4723..1f57c34 100644 --- a/policy/modules/admin/readahead.if +++ b/policy/modules/admin/readahead.if -@@ -1 +1,42 @@ +@@ -1 +1,43 @@ ## <summary>Readahead, read files into page cache for improved performance</summary> + +######################################## @@ -1470,10 +1470,11 @@ index 47c4723..c1bed2b 100644 + manage_files_pattern($1, readahead_var_run_t, readahead_var_run_t) + dev_filetrans($1, readahead_var_run_t, { dir file }) + files_search_pids($1) ++ init_search_pid_dirs($1) +') + diff --git a/policy/modules/admin/readahead.te b/policy/modules/admin/readahead.te -index b4ac57e..9702e8c 100644 +index b4ac57e..275323b 100644 --- a/policy/modules/admin/readahead.te +++ b/policy/modules/admin/readahead.te @@ -16,13 +16,14 @@ typealias readahead_var_lib_t alias readahead_etc_rw_t; @@ -1492,7 +1493,7 @@ index b4ac57e..9702e8c 100644 dontaudit readahead_t self:capability { net_admin sys_tty_config }; allow readahead_t self:process { setsched signal_perms }; -@@ -31,7 +32,9 @@ manage_files_pattern(readahead_t, readahead_var_lib_t, readahead_var_lib_t) +@@ -31,7 +32,10 @@ manage_files_pattern(readahead_t, readahead_var_lib_t, readahead_var_lib_t) files_search_var_lib(readahead_t) manage_files_pattern(readahead_t, readahead_var_run_t, readahead_var_run_t) @@ -1500,10 +1501,11 @@ index b4ac57e..9702e8c 100644 +manage_dirs_pattern(readahead_t, readahead_var_run_t, readahead_var_run_t) +files_pid_filetrans(readahead_t, readahead_var_run_t, { dir file }) +dev_filetrans(readahead_t, readahead_var_run_t, { dir file }) ++init_pid_filetrans(readahead_t, readahead_var_run_t, { dir file }) kernel_read_all_sysctls(readahead_t) kernel_read_system_state(readahead_t) -@@ -53,10 +56,18 @@ domain_read_all_domains_state(readahead_t) +@@ -53,10 +57,18 @@ domain_read_all_domains_state(readahead_t) files_list_non_security(readahead_t) files_read_non_security_files(readahead_t) @@ -1522,7 +1524,7 @@ index b4ac57e..9702e8c 100644 fs_getattr_all_fs(readahead_t) fs_search_auto_mountpoints(readahead_t) -@@ -66,12 +77,14 @@ fs_read_cgroup_files(readahead_t) +@@ -66,12 +78,14 @@ fs_read_cgroup_files(readahead_t) fs_read_tmpfs_files(readahead_t) fs_read_tmpfs_symlinks(readahead_t) fs_list_inotifyfs(readahead_t) @@ -2987,10 +2989,10 @@ index e51e7f5..8e0405f 100644 +') diff --git a/policy/modules/apps/execmem.fc b/policy/modules/apps/execmem.fc new file mode 100644 -index 0000000..09f0673 +index 0000000..4540090 --- /dev/null +++ b/policy/modules/apps/execmem.fc -@@ -0,0 +1,49 @@ +@@ -0,0 +1,50 @@ + +/usr/bin/aticonfig -- gen_context(system_u:object_r:execmem_exec_t,s0) +/usr/bin/darcs -- gen_context(system_u:object_r:execmem_exec_t,s0) @@ -3040,6 +3042,7 @@ index 0000000..09f0673 +/opt/google/chrome/google-chrome -- gen_context(system_u:object_r:execmem_exec_t,s0) +/opt/Komodo-Edit-5/lib/mozilla/komodo-bin -- gen_context(system_u:object_r:execmem_exec_t,s0) +/opt/Adobe/Reader9/Reader/intellinux/bin/acroread -- gen_context(system_u:object_r:execmem_exec_t,s0) ++/usr/local/Wolfram/Mathematica(/.*)?MathKernel -- gen_context(system_u:object_r:execmem_exec_t,s0) diff --git a/policy/modules/apps/execmem.if b/policy/modules/apps/execmem.if new file mode 100644 index 0000000..1bc60f7 @@ -3358,10 +3361,10 @@ index 00a19e3..55075f9 100644 +/usr/libexec/gnome-system-monitor-mechanism -- gen_context(system_u:object_r:gnomesystemmm_exec_t,s0) +/usr/libexec/kde(3|4)/ksysguardprocesslist_helper -- gen_context(system_u:object_r:gnomesystemmm_exec_t,s0) diff --git a/policy/modules/apps/gnome.if b/policy/modules/apps/gnome.if -index f5afe78..8df829d 100644 +index f5afe78..b1b6bf6 100644 --- a/policy/modules/apps/gnome.if +++ b/policy/modules/apps/gnome.if -@@ -1,43 +1,524 @@ +@@ -1,43 +1,523 @@ ## <summary>GNU network object model environment (GNOME)</summary> -############################################################ @@ -3431,11 +3434,10 @@ index f5afe78..8df829d 100644 + ') + + type $1_gkeyringd_t, gnome_domain, gkeyringd_domain; -+ typealias $1_gkeyringd_t alias gkeyrind_$1_t; ++ typealias $1_gkeyringd_t alias gkeyringd_$1_t; + application_domain($1_gkeyringd_t, gkeyringd_exec_t) + ubac_constrained($1_gkeyringd_t) + domain_user_exemption_target($1_gkeyringd_t) -+ permissive $1_gkeyringd_t; + + role $2 types $1_gkeyringd_t; + @@ -3904,7 +3906,7 @@ index f5afe78..8df829d 100644 ## in the caller domain. ## </summary> ## <param name="domain"> -@@ -56,27 +537,26 @@ interface(`gnome_exec_gconf',` +@@ -56,27 +536,26 @@ interface(`gnome_exec_gconf',` ######################################## ## <summary> @@ -3940,7 +3942,7 @@ index f5afe78..8df829d 100644 ## </summary> ## <param name="domain"> ## <summary> -@@ -84,37 +564,43 @@ template(`gnome_read_gconf_config',` +@@ -84,37 +563,43 @@ template(`gnome_read_gconf_config',` ## </summary> ## </param> # @@ -3995,7 +3997,7 @@ index f5afe78..8df829d 100644 ## </summary> ## <param name="domain"> ## <summary> -@@ -122,12 +608,13 @@ interface(`gnome_stream_connect_gconf',` +@@ -122,12 +607,13 @@ interface(`gnome_stream_connect_gconf',` ## </summary> ## </param> # @@ -4012,7 +4014,7 @@ index f5afe78..8df829d 100644 ') ######################################## -@@ -151,40 +638,328 @@ interface(`gnome_setattr_config_dirs',` +@@ -151,40 +637,328 @@ interface(`gnome_setattr_config_dirs',` ######################################## ## <summary> @@ -7980,10 +7982,10 @@ index 0000000..0fedd57 +') diff --git a/policy/modules/apps/sandbox.te b/policy/modules/apps/sandbox.te new file mode 100644 -index 0000000..26d0f56 +index 0000000..4f96196 --- /dev/null +++ b/policy/modules/apps/sandbox.te -@@ -0,0 +1,476 @@ +@@ -0,0 +1,475 @@ +policy_module(sandbox,1.0.0) +dbus_stub() +attribute sandbox_domain; @@ -8182,7 +8184,7 @@ index 0000000..26d0f56 +domain_dontaudit_read_all_domains_state(sandbox_x_domain) + +files_search_home(sandbox_x_domain) -+files_dontaudit_list_tmp(sandbox_x_domain) ++files_dontaudit_list_all_mountpoints(sandbox_x_domain) + +kernel_getattr_proc(sandbox_x_domain) +kernel_read_network_state(sandbox_x_domain) @@ -8381,7 +8383,6 @@ index 0000000..26d0f56 +corenet_dontaudit_tcp_bind_generic_port(sandbox_web_type) + +files_dontaudit_getattr_all_dirs(sandbox_web_type) -+files_dontaudit_list_mnt(sandbox_web_type) + +fs_dontaudit_rw_anon_inodefs_files(sandbox_web_type) +fs_dontaudit_getattr_all_fs(sandbox_web_type) @@ -9853,7 +9854,7 @@ index 5a07a43..99c7564 100644 ## </summary> ## <param name="domain"> diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in -index 0757523..6346e86 100644 +index 0757523..47f11a4 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -16,6 +16,7 @@ attribute rpc_port_type; @@ -9952,7 +9953,7 @@ index 0757523..6346e86 100644 network_port(i18n_input, tcp,9010,s0) network_port(imaze, tcp,5323,s0, udp,5323,s0) network_port(inetd_child, tcp,1,s0, udp,1,s0, tcp,7,s0, udp,7,s0, tcp,9,s0, udp,9,s0, tcp,13,s0, udp,13,s0, tcp,19,s0, udp,19,s0, tcp,37,s0, udp,37,s0, tcp,512,s0, tcp,543,s0, tcp,544,s0, tcp,891,s0, udp,891,s0, tcp,892,s0, udp,892,s0, tcp,2105,s0, tcp,5666,s0) -@@ -126,43 +150,57 @@ network_port(iscsi, tcp,3260,s0) +@@ -126,43 +150,58 @@ network_port(iscsi, tcp,3260,s0) network_port(isns, tcp,3205,s0, udp,3205,s0) network_port(jabber_client, tcp,5222,s0, tcp,5223,s0) network_port(jabber_interserver, tcp,5269,s0) @@ -9995,6 +9996,7 @@ index 0757523..6346e86 100644 +network_port(oracledb, tcp, 1521,s0,udp, 1521,s0, tcp,2483,s0,udp,2483,s0, tcp,2484,s0, udp,2484,s0) network_port(ocsp, tcp,9080,s0) network_port(openvpn, tcp,1194,s0, udp,1194,s0) ++network_port(pktcable, tcp,2126,s0, udp,2126,s0, tcp,3198,s0, udp,3198,s0) network_port(pegasus_http, tcp,5988,s0) network_port(pegasus_https, tcp,5989,s0) network_port(pgpkeyserver, udp, 11371,s0, tcp,11371,s0) @@ -10016,7 +10018,7 @@ index 0757523..6346e86 100644 network_port(printer, tcp,515,s0) network_port(ptal, tcp,5703,s0) network_port(pulseaudio, tcp,4713,s0) -@@ -177,24 +215,29 @@ network_port(ricci, tcp,11111,s0, udp,11111,s0) +@@ -177,24 +216,29 @@ network_port(ricci, tcp,11111,s0, udp,11111,s0) network_port(ricci_modcluster, tcp,16851,s0, udp,16851,s0) network_port(rlogind, tcp,513,s0) network_port(rndc, tcp,953,s0) @@ -10050,7 +10052,7 @@ index 0757523..6346e86 100644 network_port(syslogd, udp,514,s0) network_port(tcs, tcp, 30003, s0) network_port(telnetd, tcp,23,s0) -@@ -205,16 +248,17 @@ network_port(transproxy, tcp,8081,s0) +@@ -205,16 +249,17 @@ network_port(transproxy, tcp,8081,s0) network_port(ups, tcp,3493,s0) type utcpserver_port_t, port_type; dnl network_port(utcpserver) # no defined portcon network_port(uucpd, tcp,540,s0) @@ -10071,7 +10073,7 @@ index 0757523..6346e86 100644 network_port(zookeeper_client, tcp,2181,s0) network_port(zookeeper_election, tcp,3888,s0) network_port(zookeeper_leader, tcp,2888,s0) -@@ -276,5 +320,5 @@ allow corenet_unconfined_type port_type:tcp_socket { send_msg recv_msg name_conn +@@ -276,5 +321,5 @@ allow corenet_unconfined_type port_type:tcp_socket { send_msg recv_msg name_conn allow corenet_unconfined_type port_type:udp_socket { send_msg recv_msg }; # Bind to any network address. @@ -10079,10 +10081,18 @@ index 0757523..6346e86 100644 +allow corenet_unconfined_type port_type:{ tcp_socket udp_socket rawip_socket } name_bind; allow corenet_unconfined_type node_type:{ tcp_socket udp_socket rawip_socket } node_bind; diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc -index 6cf8784..286aec1 100644 +index 6cf8784..5b25039 100644 --- a/policy/modules/kernel/devices.fc +++ b/policy/modules/kernel/devices.fc -@@ -187,8 +187,6 @@ ifdef(`distro_suse', ` +@@ -20,6 +20,7 @@ + /dev/controlD64 -c gen_context(system_u:object_r:xserver_misc_device_t,s0) + /dev/crash -c gen_context(system_u:object_r:crash_device_t,mls_systemhigh) + /dev/dahdi/.* -c gen_context(system_u:object_r:sound_device_t,s0) ++/dev/dlm.* -c gen_context(system_u:object_r:dlm_control_device_t,s0) + /dev/dmfm -c gen_context(system_u:object_r:sound_device_t,s0) + /dev/dmmidi.* -c gen_context(system_u:object_r:sound_device_t,s0) + /dev/dsp.* -c gen_context(system_u:object_r:sound_device_t,s0) +@@ -187,8 +188,6 @@ ifdef(`distro_suse', ` /lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0) /lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0) @@ -10091,7 +10101,7 @@ index 6cf8784..286aec1 100644 ifdef(`distro_redhat',` # originally from named.fc /var/named/chroot/dev -d gen_context(system_u:object_r:device_t,s0) -@@ -196,3 +194,8 @@ ifdef(`distro_redhat',` +@@ -196,3 +195,8 @@ ifdef(`distro_redhat',` /var/named/chroot/dev/random -c gen_context(system_u:object_r:random_device_t,s0) /var/named/chroot/dev/zero -c gen_context(system_u:object_r:zero_device_t,s0) ') @@ -10861,7 +10871,7 @@ index 16108f6..0f1470f 100644 + +/usr/lib/debug(/.*)? <<none>> diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if -index 958ca84..32a3f1d 100644 +index 958ca84..a595aa7 100644 --- a/policy/modules/kernel/files.if +++ b/policy/modules/kernel/files.if @@ -1053,10 +1053,8 @@ interface(`files_relabel_all_files',` @@ -11546,7 +11556,7 @@ index 958ca84..32a3f1d 100644 ## Read and write files in the /var directory. ## </summary> ## <param name="domain"> -@@ -5071,6 +5538,24 @@ interface(`files_manage_mounttab',` +@@ -5071,6 +5538,25 @@ interface(`files_manage_mounttab',` ######################################## ## <summary> @@ -11563,6 +11573,7 @@ index 958ca84..32a3f1d 100644 + type var_t, var_lock_t; + ') + ++ files_search_pids($1) + list_dirs_pattern($1, var_t, var_lock_t) +') + @@ -11571,7 +11582,58 @@ index 958ca84..32a3f1d 100644 ## Search the locks directory (/var/lock). ## </summary> ## <param name="domain"> -@@ -5156,12 +5641,12 @@ interface(`files_getattr_generic_locks',` +@@ -5084,6 +5570,7 @@ interface(`files_search_locks',` + type var_t, var_lock_t; + ') + ++ files_search_pids($1) + search_dirs_pattern($1, var_t, var_lock_t) + ') + +@@ -5108,6 +5595,26 @@ interface(`files_dontaudit_search_locks',` + + ######################################## + ## <summary> ++## create a directory in the /var/lock ++## directories. ++## </summary> ++## <param name="domain"> ++## <summary> ++## Domain allowed access. ++## </summary> ++## </param> ++# ++interface(`files_create_lock_dirs',` ++ gen_require(` ++ type var_t, var_lock_t; ++ ') ++ ++ allow $1 var_t:dir search_dir_perms; ++ allow $1 var_lock_t:dir create_dir_perms; ++') ++ ++######################################## ++## <summary> + ## Add and remove entries in the /var/lock + ## directories. + ## </summary> +@@ -5122,6 +5629,7 @@ interface(`files_rw_lock_dirs',` + type var_t, var_lock_t; + ') + ++ files_search_pids($1) + rw_dirs_pattern($1, var_t, var_lock_t) + ') + +@@ -5142,6 +5650,7 @@ interface(`files_getattr_generic_locks',` + + allow $1 var_t:dir search_dir_perms; + allow $1 var_lock_t:dir list_dir_perms; ++ files_search_pids($1) + getattr_files_pattern($1, var_lock_t, var_lock_t) + ') + +@@ -5156,12 +5665,13 @@ interface(`files_getattr_generic_locks',` ## </param> # interface(`files_delete_generic_locks',` @@ -11584,11 +11646,20 @@ index 958ca84..32a3f1d 100644 - allow $1 var_t:dir search_dir_perms; - delete_files_pattern($1, var_lock_t, var_lock_t) + allow $1 var_t:dir search_dir_perms; ++ files_search_pids($1) + delete_files_pattern($1, var_lock_t, var_lock_t) ') ######################################## -@@ -5207,6 +5692,27 @@ interface(`files_delete_all_locks',` +@@ -5181,6 +5691,7 @@ interface(`files_manage_generic_locks',` + ') + + allow $1 var_t:dir search_dir_perms; ++ files_search_pids($1) + manage_files_pattern($1, var_lock_t, var_lock_t) + ') + +@@ -5207,6 +5718,27 @@ interface(`files_delete_all_locks',` ######################################## ## <summary> @@ -11616,7 +11687,31 @@ index 958ca84..32a3f1d 100644 ## Read all lock files. ## </summary> ## <param name="domain"> -@@ -5335,6 +5841,43 @@ interface(`files_search_pids',` +@@ -5224,6 +5756,7 @@ interface(`files_read_all_locks',` + allow $1 { var_t var_lock_t }:dir search_dir_perms; + allow $1 lockfile:dir list_dir_perms; + read_files_pattern($1, lockfile, lockfile) ++ files_search_pids($1) + read_lnk_files_pattern($1, lockfile, lockfile) + ') + +@@ -5244,6 +5777,7 @@ interface(`files_manage_all_locks',` + ') + + allow $1 { var_t var_lock_t }:dir search_dir_perms; ++ files_search_pids($1) + manage_dirs_pattern($1, lockfile, lockfile) + manage_files_pattern($1, lockfile, lockfile) + manage_lnk_files_pattern($1, lockfile, lockfile) +@@ -5276,6 +5810,7 @@ interface(`files_lock_filetrans',` + ') + + allow $1 var_t:dir search_dir_perms; ++ files_search_pids($1) + filetrans_pattern($1, var_lock_t, $2, $3) + ') + +@@ -5335,6 +5870,43 @@ interface(`files_search_pids',` search_dirs_pattern($1, var_t, var_run_t) ') @@ -11660,7 +11755,7 @@ index 958ca84..32a3f1d 100644 ######################################## ## <summary> ## Do not audit attempts to search -@@ -5542,6 +6085,62 @@ interface(`files_dontaudit_ioctl_all_pids',` +@@ -5542,6 +6114,62 @@ interface(`files_dontaudit_ioctl_all_pids',` ######################################## ## <summary> @@ -11723,7 +11818,7 @@ index 958ca84..32a3f1d 100644 ## Read all process ID files. ## </summary> ## <param name="domain"> -@@ -5559,6 +6158,44 @@ interface(`files_read_all_pids',` +@@ -5559,6 +6187,44 @@ interface(`files_read_all_pids',` list_dirs_pattern($1, var_t, pidfile) read_files_pattern($1, pidfile, pidfile) @@ -11768,7 +11863,7 @@ index 958ca84..32a3f1d 100644 ') ######################################## -@@ -5844,3 +6481,284 @@ interface(`files_unconfined',` +@@ -5844,3 +6510,284 @@ interface(`files_unconfined',` typeattribute $1 files_unconfined_type; ') @@ -12054,7 +12149,7 @@ index 958ca84..32a3f1d 100644 + dontaudit $1 file_type:dir_file_class_set write; +') diff --git a/policy/modules/kernel/files.te b/policy/modules/kernel/files.te -index 6e01635..212a736 100644 +index 6e01635..207d34a 100644 --- a/policy/modules/kernel/files.te +++ b/policy/modules/kernel/files.te @@ -11,6 +11,7 @@ attribute lockfile; @@ -12088,6 +12183,14 @@ index 6e01635..212a736 100644 files_type(etc_runtime_t) #Temporarily in policy until FC5 dissappears typealias etc_runtime_t alias firstboot_rw_t; +@@ -167,6 +177,7 @@ files_mountpoint(var_lib_t) + # + type var_lock_t; + files_lock_file(var_lock_t) ++files_mountpoint(var_lock_t) + + # + # var_run_t is the type of /var/run, usually diff --git a/policy/modules/kernel/filesystem.fc b/policy/modules/kernel/filesystem.fc index 59bae6a..2e55e71 100644 --- a/policy/modules/kernel/filesystem.fc @@ -13613,7 +13716,7 @@ index be4de58..cce681a 100644 ######################################## # diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te -index 2be17d2..093b48d 100644 +index 2be17d2..9440b5f 100644 --- a/policy/modules/roles/staff.te +++ b/policy/modules/roles/staff.te @@ -8,12 +8,48 @@ policy_module(staff, 2.2.0) @@ -13665,7 +13768,7 @@ index 2be17d2..093b48d 100644 optional_policy(` apache_role(staff_r, staff_t) ') -@@ -27,25 +63,137 @@ optional_policy(` +@@ -27,25 +63,138 @@ optional_policy(` ') optional_policy(` @@ -13688,6 +13791,7 @@ index 2be17d2..093b48d 100644 +optional_policy(` + gnome_role(staff_r, staff_t) + gnome_role_gkeyringd(staff, staff_r, staff_t) ++ permissive staff_gkeyringd_t; +') + +optional_policy(` @@ -13805,7 +13909,7 @@ index 2be17d2..093b48d 100644 optional_policy(` vlock_run(staff_t, staff_r) -@@ -89,10 +237,6 @@ ifndef(`distro_redhat',` +@@ -89,10 +238,6 @@ ifndef(`distro_redhat',` ') optional_policy(` @@ -13816,7 +13920,7 @@ index 2be17d2..093b48d 100644 gpg_role(staff_r, staff_t) ') -@@ -137,10 +281,6 @@ ifndef(`distro_redhat',` +@@ -137,10 +282,6 @@ ifndef(`distro_redhat',` ') optional_policy(` @@ -13827,7 +13931,7 @@ index 2be17d2..093b48d 100644 spamassassin_role(staff_r, staff_t) ') -@@ -172,3 +312,7 @@ ifndef(`distro_redhat',` +@@ -172,3 +313,7 @@ ifndef(`distro_redhat',` wireshark_role(staff_r, staff_t) ') ') @@ -15801,7 +15905,7 @@ index 0b827c5..9a82e8d 100644 admin_pattern($1, abrt_tmp_t) ') diff --git a/policy/modules/services/abrt.te b/policy/modules/services/abrt.te -index 30861ec..d3996c8 100644 +index 30861ec..de61315 100644 --- a/policy/modules/services/abrt.te +++ b/policy/modules/services/abrt.te @@ -5,6 +5,14 @@ policy_module(abrt, 1.2.0) @@ -15819,9 +15923,12 @@ index 30861ec..d3996c8 100644 type abrt_t; type abrt_exec_t; init_daemon_domain(abrt_t, abrt_exec_t) -@@ -50,7 +58,7 @@ ifdef(`enable_mcs',` +@@ -48,9 +56,9 @@ ifdef(`enable_mcs',` + # abrt local policy + # - allow abrt_t self:capability { chown kill setuid setgid sys_nice dac_override }; +-allow abrt_t self:capability { chown kill setuid setgid sys_nice dac_override }; ++allow abrt_t self:capability { fowner chown kill setuid setgid sys_nice dac_override }; dontaudit abrt_t self:capability sys_rawio; -allow abrt_t self:process { signal signull setsched getsched }; +allow abrt_t self:process { sigkill signal signull setsched getsched }; @@ -18350,7 +18457,7 @@ index 8b8143e..c1a2b96 100644 init_labeled_script_domtrans($1, asterisk_initrc_exec_t) diff --git a/policy/modules/services/asterisk.te b/policy/modules/services/asterisk.te -index b3b0176..99f98ff 100644 +index b3b0176..51cb893 100644 --- a/policy/modules/services/asterisk.te +++ b/policy/modules/services/asterisk.te @@ -76,10 +76,11 @@ fs_tmpfs_filetrans(asterisk_t, asterisk_tmpfs_t, { dir file lnk_file sock_file f @@ -18366,11 +18473,12 @@ index b3b0176..99f98ff 100644 kernel_read_system_state(asterisk_t) kernel_read_kernel_sysctls(asterisk_t) -@@ -108,6 +109,7 @@ corenet_tcp_bind_generic_port(asterisk_t) +@@ -108,6 +109,8 @@ corenet_tcp_bind_generic_port(asterisk_t) corenet_udp_bind_generic_port(asterisk_t) corenet_dontaudit_udp_bind_all_ports(asterisk_t) corenet_sendrecv_generic_server_packets(asterisk_t) +corenet_tcp_connect_festival_port(asterisk_t) ++corenet_tcp_connect_pktcable_port(asterisk_t) corenet_tcp_connect_postgresql_port(asterisk_t) corenet_tcp_connect_snmp_port(asterisk_t) corenet_tcp_connect_sip_port(asterisk_t) @@ -18569,10 +18677,10 @@ index 44a1e3d..7e9d2fb 100644 files_list_pids($1) admin_pattern($1, named_var_run_t) diff --git a/policy/modules/services/bind.te b/policy/modules/services/bind.te -index 4deca04..42aa033 100644 +index 4deca04..a2bf2dc 100644 --- a/policy/modules/services/bind.te +++ b/policy/modules/services/bind.te -@@ -6,10 +6,10 @@ policy_module(bind, 1.11.0) +@@ -6,10 +6,17 @@ policy_module(bind, 1.11.0) # ## <desc> @@ -18580,6 +18688,13 @@ index 4deca04..42aa033 100644 -## Allow BIND to write the master zone files. -## Generally this is used for dynamic DNS or zone transfers. -## </p> ++## <p> ++## Allow BIND to bind apache port. ++## </p> ++## </desc> ++gen_tunable(named_bind_http_port, false) ++ ++## <desc> +## <p> +## Allow BIND to write the master zone files. +## Generally this is used for dynamic DNS or zone transfers. @@ -18587,7 +18702,7 @@ index 4deca04..42aa033 100644 ## </desc> gen_tunable(named_write_master_zones, false) -@@ -27,7 +27,7 @@ init_system_domain(named_t, named_checkconf_exec_t) +@@ -27,7 +34,7 @@ init_system_domain(named_t, named_checkconf_exec_t) # A type for configuration files of named. type named_conf_t; @@ -18596,7 +18711,7 @@ index 4deca04..42aa033 100644 files_mountpoint(named_conf_t) # for secondary zone files -@@ -89,9 +89,10 @@ manage_dirs_pattern(named_t, named_tmp_t, named_tmp_t) +@@ -89,9 +96,10 @@ manage_dirs_pattern(named_t, named_tmp_t, named_tmp_t) manage_files_pattern(named_t, named_tmp_t, named_tmp_t) files_tmp_filetrans(named_t, named_tmp_t, { file dir }) @@ -18608,7 +18723,18 @@ index 4deca04..42aa033 100644 # read zone files allow named_t named_zone_t:dir list_dir_perms; -@@ -201,12 +202,12 @@ allow ndc_t self:tcp_socket create_socket_perms; +@@ -147,6 +155,10 @@ miscfiles_read_generic_certs(named_t) + userdom_dontaudit_use_unpriv_user_fds(named_t) + userdom_dontaudit_search_user_home_dirs(named_t) + ++tunable_policy(`named_bind_http_port',` ++ corenet_tcp_bind_http_port(named_t) ++') ++ + tunable_policy(`named_write_master_zones',` + manage_dirs_pattern(named_t, named_zone_t, named_zone_t) + manage_files_pattern(named_t, named_zone_t, named_zone_t) +@@ -201,12 +213,12 @@ allow ndc_t self:tcp_socket create_socket_perms; allow ndc_t self:netlink_route_socket r_netlink_socket_perms; allow ndc_t dnssec_t:file read_file_perms; @@ -18623,7 +18749,7 @@ index 4deca04..42aa033 100644 allow ndc_t named_zone_t:dir search_dir_perms; -@@ -244,7 +245,7 @@ term_dontaudit_use_console(ndc_t) +@@ -244,7 +256,7 @@ term_dontaudit_use_console(ndc_t) # for /etc/rndc.key ifdef(`distro_redhat',` @@ -37051,7 +37177,7 @@ index 7dc38d1..9c2c963 100644 + admin_pattern($1, rgmanager_var_run_t) +') diff --git a/policy/modules/services/rgmanager.te b/policy/modules/services/rgmanager.te -index 00fa514..1ef4cc6 100644 +index 00fa514..56ecadc 100644 --- a/policy/modules/services/rgmanager.te +++ b/policy/modules/services/rgmanager.te @@ -6,17 +6,19 @@ policy_module(rgmanager, 1.0.0) @@ -37136,16 +37262,16 @@ index 00fa514..1ef4cc6 100644 # needed by resources scripts auth_read_all_files_except_shadow(rgmanager_t) -@@ -100,8 +108,6 @@ logging_send_syslog_msg(rgmanager_t) +@@ -100,7 +108,7 @@ logging_send_syslog_msg(rgmanager_t) miscfiles_read_localization(rgmanager_t) -mount_domtrans(rgmanager_t) -- ++userdom_kill_all_users(rgmanager_t) + tunable_policy(`rgmanager_can_network_connect',` corenet_tcp_connect_all_ports(rgmanager_t) - ') -@@ -118,6 +124,14 @@ optional_policy(` +@@ -118,6 +126,14 @@ optional_policy(` ') optional_policy(` @@ -37160,7 +37286,7 @@ index 00fa514..1ef4cc6 100644 fstools_domtrans(rgmanager_t) ') -@@ -140,6 +154,15 @@ optional_policy(` +@@ -140,6 +156,15 @@ optional_policy(` ') optional_policy(` @@ -38062,7 +38188,7 @@ index 63e78c6..ffa4f37 100644 ## </param> # diff --git a/policy/modules/services/rlogin.te b/policy/modules/services/rlogin.te -index 779fa44..cdfebe3 100644 +index 779fa44..13556c1 100644 --- a/policy/modules/services/rlogin.te +++ b/policy/modules/services/rlogin.te @@ -27,15 +27,14 @@ files_pid_file(rlogind_var_run_t) @@ -38091,15 +38217,18 @@ index 779fa44..cdfebe3 100644 manage_files_pattern(rlogind_t, rlogind_var_run_t, rlogind_var_run_t) files_pid_filetrans(rlogind_t, rlogind_var_run_t, file) -@@ -71,6 +69,7 @@ fs_search_auto_mountpoints(rlogind_t) +@@ -69,8 +67,10 @@ fs_getattr_xattr_fs(rlogind_t) + fs_search_auto_mountpoints(rlogind_t) + auth_domtrans_chk_passwd(rlogind_t) ++auth_signal_chk_passwd(rlogind_t) auth_rw_login_records(rlogind_t) auth_use_nsswitch(rlogind_t) +auth_login_pgm_domain(rlogind_t) files_read_etc_files(rlogind_t) files_read_etc_runtime_files(rlogind_t) -@@ -88,9 +87,9 @@ seutil_read_config(rlogind_t) +@@ -88,9 +88,9 @@ seutil_read_config(rlogind_t) userdom_setattr_user_ptys(rlogind_t) # cjp: this is egregious userdom_read_user_home_content_files(rlogind_t) @@ -38112,7 +38241,7 @@ index 779fa44..cdfebe3 100644 rlogin_read_home_content(rlogind_t) -@@ -112,5 +111,10 @@ optional_policy(` +@@ -112,5 +112,10 @@ optional_policy(` ') optional_policy(` @@ -38624,7 +38753,7 @@ index 39015ae..5e7b7cf 100644 + auth_can_read_shadow_passwords(rsync_t) diff --git a/policy/modules/services/rtkit.if b/policy/modules/services/rtkit.if -index 46dad1f..d632bc0 100644 +index 46dad1f..6586da0 100644 --- a/policy/modules/services/rtkit.if +++ b/policy/modules/services/rtkit.if @@ -5,9 +5,9 @@ @@ -38639,7 +38768,7 @@ index 46dad1f..d632bc0 100644 ## </param> # interface(`rtkit_daemon_domtrans',` -@@ -41,6 +41,27 @@ interface(`rtkit_daemon_dbus_chat',` +@@ -41,6 +41,28 @@ interface(`rtkit_daemon_dbus_chat',` ######################################## ## <summary> @@ -38660,6 +38789,7 @@ index 46dad1f..d632bc0 100644 + + dontaudit $1 rtkit_daemon_t:dbus send_msg; + dontaudit rtkit_daemon_t $1:dbus send_msg; ++ dontaudit rtkit_daemon_t $1:process { getsched setsched }; +') + +######################################## @@ -38667,7 +38797,7 @@ index 46dad1f..d632bc0 100644 ## Allow rtkit to control scheduling for your process ## </summary> ## <param name="domain"> -@@ -54,6 +75,7 @@ interface(`rtkit_scheduled',` +@@ -54,6 +76,7 @@ interface(`rtkit_scheduled',` type rtkit_daemon_t; ') @@ -40960,7 +41090,7 @@ index 22adaca..d9913e0 100644 + allow $1 sshd_t:process signull; +') diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te -index 2dad3c8..92e24a9 100644 +index 2dad3c8..503a845 100644 --- a/policy/modules/services/ssh.te +++ b/policy/modules/services/ssh.te @@ -6,26 +6,32 @@ policy_module(ssh, 2.2.0) @@ -41055,11 +41185,13 @@ index 2dad3c8..92e24a9 100644 manage_files_pattern(ssh_t, ssh_tmpfs_t, ssh_tmpfs_t) manage_lnk_files_pattern(ssh_t, ssh_tmpfs_t, ssh_tmpfs_t) manage_fifo_files_pattern(ssh_t, ssh_tmpfs_t, ssh_tmpfs_t) -@@ -113,20 +114,23 @@ fs_tmpfs_filetrans(ssh_t, ssh_tmpfs_t, { dir file lnk_file sock_file fifo_file } +@@ -113,20 +114,25 @@ fs_tmpfs_filetrans(ssh_t, ssh_tmpfs_t, { dir file lnk_file sock_file fifo_file } manage_dirs_pattern(ssh_t, ssh_home_t, ssh_home_t) manage_sock_files_pattern(ssh_t, ssh_home_t, ssh_home_t) userdom_user_home_dir_filetrans(ssh_t, ssh_home_t, { dir sock_file }) +userdom_stream_connect(ssh_t) ++userdom_search_admin_dir(sshd_t) ++userdom_admin_home_dir_filetrans(ssh_t, ssh_home_t, { dir sock_file }) # Allow the ssh program to communicate with ssh-agent. stream_connect_pattern(ssh_t, ssh_agent_tmp_t, ssh_agent_tmp_t, ssh_agent_type) @@ -41082,7 +41214,7 @@ index 2dad3c8..92e24a9 100644 kernel_read_kernel_sysctls(ssh_t) kernel_read_system_state(ssh_t) -@@ -138,6 +142,8 @@ corenet_tcp_sendrecv_generic_node(ssh_t) +@@ -138,6 +144,8 @@ corenet_tcp_sendrecv_generic_node(ssh_t) corenet_tcp_sendrecv_all_ports(ssh_t) corenet_tcp_connect_ssh_port(ssh_t) corenet_sendrecv_ssh_client_packets(ssh_t) @@ -41091,7 +41223,7 @@ index 2dad3c8..92e24a9 100644 dev_read_urand(ssh_t) -@@ -162,6 +168,7 @@ logging_read_generic_logs(ssh_t) +@@ -162,21 +170,28 @@ logging_read_generic_logs(ssh_t) auth_use_nsswitch(ssh_t) miscfiles_read_localization(ssh_t) @@ -41099,8 +41231,9 @@ index 2dad3c8..92e24a9 100644 seutil_read_config(ssh_t) -@@ -169,14 +176,19 @@ userdom_dontaudit_list_user_home_dirs(ssh_t) + userdom_dontaudit_list_user_home_dirs(ssh_t) userdom_search_user_home_dirs(ssh_t) ++userdom_search_admin_dir(ssh_t) # Write to the user domain tty. userdom_use_user_terminals(ssh_t) -# needs to read krb tgt @@ -41124,7 +41257,7 @@ index 2dad3c8..92e24a9 100644 ') tunable_policy(`use_nfs_home_dirs',` -@@ -196,10 +208,15 @@ tunable_policy(`user_tcp_server',` +@@ -196,10 +211,15 @@ tunable_policy(`user_tcp_server',` ') optional_policy(` @@ -41140,7 +41273,7 @@ index 2dad3c8..92e24a9 100644 ############################## # # ssh_keysign_t local policy -@@ -209,7 +226,7 @@ tunable_policy(`allow_ssh_keysign',` +@@ -209,7 +229,7 @@ tunable_policy(`allow_ssh_keysign',` allow ssh_keysign_t self:capability { setgid setuid }; allow ssh_keysign_t self:unix_stream_socket create_socket_perms; @@ -41149,7 +41282,7 @@ index 2dad3c8..92e24a9 100644 dev_read_urand(ssh_keysign_t) -@@ -232,33 +249,43 @@ optional_policy(` +@@ -232,33 +252,42 @@ optional_policy(` # so a tunnel can point to another ssh tunnel allow sshd_t self:netlink_route_socket r_netlink_socket_perms; allow sshd_t self:key { search link write }; @@ -41175,7 +41308,6 @@ index 2dad3c8..92e24a9 100644 +userdom_read_user_home_content_files(sshd_t) +userdom_read_user_home_content_symlinks(sshd_t) -+userdom_search_admin_dir(sshd_t) +userdom_manage_tmp_role(system_r, sshd_t) +userdom_spec_domtrans_unpriv_users(sshd_t) +userdom_signal_unpriv_users(sshd_t) @@ -41202,7 +41334,7 @@ index 2dad3c8..92e24a9 100644 ') optional_policy(` -@@ -266,11 +293,24 @@ optional_policy(` +@@ -266,11 +295,24 @@ optional_policy(` ') optional_policy(` @@ -41228,7 +41360,7 @@ index 2dad3c8..92e24a9 100644 ') optional_policy(` -@@ -284,6 +324,11 @@ optional_policy(` +@@ -284,6 +326,11 @@ optional_policy(` ') optional_policy(` @@ -41240,7 +41372,7 @@ index 2dad3c8..92e24a9 100644 unconfined_shell_domtrans(sshd_t) ') -@@ -292,26 +337,26 @@ optional_policy(` +@@ -292,26 +339,26 @@ optional_policy(` ') ifdef(`TODO',` @@ -41286,7 +41418,7 @@ index 2dad3c8..92e24a9 100644 ') dnl endif TODO ######################################## -@@ -322,14 +367,18 @@ tunable_policy(`ssh_sysadm_login',` +@@ -322,14 +369,18 @@ tunable_policy(`ssh_sysadm_login',` # ssh_keygen_t is the type of the ssh-keygen program when run at install time # and by sysadm_t @@ -41306,7 +41438,7 @@ index 2dad3c8..92e24a9 100644 kernel_read_kernel_sysctls(ssh_keygen_t) fs_search_auto_mountpoints(ssh_keygen_t) -@@ -353,7 +402,7 @@ logging_send_syslog_msg(ssh_keygen_t) +@@ -353,7 +404,7 @@ logging_send_syslog_msg(ssh_keygen_t) userdom_dontaudit_use_unpriv_user_fds(ssh_keygen_t) optional_policy(` @@ -46533,7 +46665,7 @@ index 2952cef..d845132 100644 /var/run/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0) /var/run/sepermit(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0) diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if -index 42b4f0f..bd258e2 100644 +index 42b4f0f..3c1892d 100644 --- a/policy/modules/system/authlogin.if +++ b/policy/modules/system/authlogin.if @@ -57,6 +57,8 @@ interface(`auth_use_pam',` @@ -46679,15 +46811,33 @@ index 42b4f0f..bd258e2 100644 ') ######################################## -@@ -418,6 +475,7 @@ interface(`auth_run_chk_passwd',` +@@ -418,6 +475,25 @@ interface(`auth_run_chk_passwd',` auth_domtrans_chk_passwd($1) role $2 types chkpwd_t; + auth_run_upd_passwd($1, $2) ++') ++ ++######################################## ++## <summary> ++## Send generic signals to chkpwd processes. ++## </summary> ++## <param name="domain"> ++## <summary> ++## Domain allowed access. ++## </summary> ++## </param> ++# ++interface(`auth_signal_chk_passwd',` ++ gen_require(` ++ type chkpwd_t; ++ ') ++ ++ allow $1 chkpwd_t:process signal; ') ######################################## -@@ -694,7 +752,7 @@ interface(`auth_relabel_shadow',` +@@ -694,7 +770,7 @@ interface(`auth_relabel_shadow',` ') files_search_etc($1) @@ -46696,7 +46846,7 @@ index 42b4f0f..bd258e2 100644 typeattribute $1 can_relabelto_shadow_passwords; ') -@@ -736,6 +794,46 @@ interface(`auth_rw_faillog',` +@@ -736,6 +812,46 @@ interface(`auth_rw_faillog',` allow $1 faillog_t:file rw_file_perms; ') @@ -46743,7 +46893,7 @@ index 42b4f0f..bd258e2 100644 ####################################### ## <summary> ## Read the last logins log. -@@ -874,6 +972,46 @@ interface(`auth_exec_pam',` +@@ -874,6 +990,46 @@ interface(`auth_exec_pam',` ######################################## ## <summary> @@ -46790,7 +46940,7 @@ index 42b4f0f..bd258e2 100644 ## Manage var auth files. Used by various other applications ## and pam applets etc. ## </summary> -@@ -896,6 +1034,26 @@ interface(`auth_manage_var_auth',` +@@ -896,6 +1052,26 @@ interface(`auth_manage_var_auth',` ######################################## ## <summary> @@ -46817,7 +46967,7 @@ index 42b4f0f..bd258e2 100644 ## Read PAM PID files. ## </summary> ## <param name="domain"> -@@ -1093,6 +1251,24 @@ interface(`auth_delete_pam_console_data',` +@@ -1093,6 +1269,24 @@ interface(`auth_delete_pam_console_data',` ######################################## ## <summary> @@ -46842,7 +46992,7 @@ index 42b4f0f..bd258e2 100644 ## Read all directories on the filesystem, except ## the shadow passwords and listed exceptions. ## </summary> -@@ -1326,6 +1502,25 @@ interface(`auth_setattr_login_records',` +@@ -1326,6 +1520,25 @@ interface(`auth_setattr_login_records',` ######################################## ## <summary> @@ -46868,7 +47018,7 @@ index 42b4f0f..bd258e2 100644 ## Read login records files (/var/log/wtmp). ## </summary> ## <param name="domain"> -@@ -1500,28 +1695,36 @@ interface(`auth_manage_login_records',` +@@ -1500,28 +1713,36 @@ interface(`auth_manage_login_records',` # interface(`auth_use_nsswitch',` @@ -46912,7 +47062,7 @@ index 42b4f0f..bd258e2 100644 optional_policy(` kerberos_use($1) ') -@@ -1531,7 +1734,15 @@ interface(`auth_use_nsswitch',` +@@ -1531,7 +1752,15 @@ interface(`auth_use_nsswitch',` ') optional_policy(` @@ -47186,7 +47336,7 @@ index a97a096..ab1e16a 100644 /usr/bin/raw -- gen_context(system_u:object_r:fsadm_exec_t,s0) /usr/bin/scsi_unique_id -- gen_context(system_u:object_r:fsadm_exec_t,s0) diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te -index a442acc..8cc63f7 100644 +index a442acc..f7dcebe 100644 --- a/policy/modules/system/fstools.te +++ b/policy/modules/system/fstools.te @@ -55,6 +55,7 @@ allow fsadm_t swapfile_t:file { rw_file_perms swapon }; @@ -47237,7 +47387,7 @@ index a442acc..8cc63f7 100644 # Recreate /mnt/cdrom. files_manage_mnt_dirs(fsadm_t) # for tune2fs -@@ -130,6 +138,7 @@ storage_raw_write_fixed_disk(fsadm_t) +@@ -130,10 +138,12 @@ storage_raw_write_fixed_disk(fsadm_t) storage_raw_read_removable_device(fsadm_t) storage_raw_write_removable_device(fsadm_t) storage_read_scsi_generic(fsadm_t) @@ -47245,7 +47395,12 @@ index a442acc..8cc63f7 100644 storage_swapon_fixed_disk(fsadm_t) term_use_console(fsadm_t) -@@ -142,12 +151,9 @@ logging_send_syslog_msg(fsadm_t) + ++init_read_state(fsadm_t) + init_use_fds(fsadm_t) + init_use_script_ptys(fsadm_t) + init_dontaudit_getattr_initctl(fsadm_t) +@@ -142,12 +152,9 @@ logging_send_syslog_msg(fsadm_t) miscfiles_read_localization(fsadm_t) @@ -47259,7 +47414,7 @@ index a442acc..8cc63f7 100644 ifdef(`distro_redhat',` optional_policy(` -@@ -166,6 +172,24 @@ optional_policy(` +@@ -166,6 +173,24 @@ optional_policy(` ') optional_policy(` @@ -47284,7 +47439,7 @@ index a442acc..8cc63f7 100644 nis_use_ypbind(fsadm_t) ') -@@ -175,6 +199,14 @@ optional_policy(` +@@ -175,6 +200,14 @@ optional_policy(` ') optional_policy(` @@ -47369,7 +47524,7 @@ index 882c6a2..d0ff4ec 100644 ') diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc -index 354ce93..f7cda1c 100644 +index 354ce93..f97fbb7 100644 --- a/policy/modules/system/init.fc +++ b/policy/modules/system/init.fc @@ -33,6 +33,19 @@ ifdef(`distro_gentoo', ` @@ -47402,8 +47557,13 @@ index 354ce93..f7cda1c 100644 # # /var +@@ -76,3 +92,4 @@ ifdef(`distro_suse', ` + /var/run/setleds-on -- gen_context(system_u:object_r:initrc_var_run_t,s0) + /var/run/sysconfig(/.*)? gen_context(system_u:object_r:initrc_var_run_t,s0) + ') ++/var/run/systemd(/.*)? gen_context(system_u:object_r:init_var_run_t,s0) diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if -index cc83689..84c0fb7 100644 +index cc83689..05b4982 100644 --- a/policy/modules/system/init.if +++ b/policy/modules/system/init.if @@ -79,6 +79,41 @@ interface(`init_script_domain',` @@ -47611,10 +47771,20 @@ index cc83689..84c0fb7 100644 mls_rangetrans_target($1) ') ') -@@ -525,6 +636,24 @@ interface(`init_stream_connect',` - allow $1 init_t:unix_stream_socket connectto; - ') +@@ -519,10 +630,30 @@ interface(`init_sigchld',` + # + interface(`init_stream_connect',` + gen_require(` +- type init_t; ++ type init_t, init_var_run_t; + ') +- allow $1 init_t:unix_stream_socket connectto; ++ files_search_pids($1) ++ stream_connect_pattern($1, init_var_run_t, init_var_run_t, init_t) ++ ++') ++ +####################################### +## <summary> +## Dontaudit Connect to init with a unix socket. @@ -47631,12 +47801,10 @@ index cc83689..84c0fb7 100644 + ') + + dontaudit $1 init_t:unix_stream_socket connectto; -+') -+ + ') + ######################################## - ## <summary> - ## Inherit and use file descriptors from init. -@@ -688,19 +817,24 @@ interface(`init_telinit',` +@@ -688,19 +819,24 @@ interface(`init_telinit',` type initctl_t; ') @@ -47662,7 +47830,7 @@ index cc83689..84c0fb7 100644 ') ') -@@ -773,18 +907,19 @@ interface(`init_script_file_entry_type',` +@@ -773,18 +909,19 @@ interface(`init_script_file_entry_type',` # interface(`init_spec_domtrans_script',` gen_require(` @@ -47686,7 +47854,7 @@ index cc83689..84c0fb7 100644 ') ') -@@ -800,19 +935,41 @@ interface(`init_spec_domtrans_script',` +@@ -800,23 +937,45 @@ interface(`init_spec_domtrans_script',` # interface(`init_domtrans_script',` gen_require(` @@ -47709,11 +47877,11 @@ index cc83689..84c0fb7 100644 ifdef(`enable_mls',` - range_transition $1 initrc_exec_t:process s0 - mls_systemhigh; + range_transition $1 init_script_file_type:process s0 - mls_systemhigh; -+ ') -+') -+ -+######################################## -+## <summary> + ') + ') + + ######################################## + ## <summary> +## Execute a file in a bin directory +## in the initrc_t domain +## </summary> @@ -47726,13 +47894,17 @@ index cc83689..84c0fb7 100644 +interface(`init_bin_domtrans_spec',` + gen_require(` + type initrc_t; - ') ++ ') + + corecmd_bin_domtrans($1, initrc_t) - ') - - ######################################## -@@ -868,9 +1025,14 @@ interface(`init_script_file_domtrans',` ++') ++ ++######################################## ++## <summary> + ## Execute a init script in a specified domain. + ## </summary> + ## <desc> +@@ -868,9 +1027,14 @@ interface(`init_script_file_domtrans',` interface(`init_labeled_script_domtrans',` gen_require(` type initrc_t; @@ -47747,7 +47919,7 @@ index cc83689..84c0fb7 100644 files_search_etc($1) ') -@@ -1079,6 +1241,24 @@ interface(`init_read_all_script_files',` +@@ -1079,6 +1243,24 @@ interface(`init_read_all_script_files',` ####################################### ## <summary> @@ -47772,7 +47944,7 @@ index cc83689..84c0fb7 100644 ## Dontaudit read all init script files. ## </summary> ## <param name="domain"> -@@ -1130,12 +1310,7 @@ interface(`init_read_script_state',` +@@ -1130,12 +1312,7 @@ interface(`init_read_script_state',` ') kernel_search_proc($1) @@ -47786,7 +47958,7 @@ index cc83689..84c0fb7 100644 ') ######################################## -@@ -1375,6 +1550,27 @@ interface(`init_dbus_send_script',` +@@ -1375,6 +1552,27 @@ interface(`init_dbus_send_script',` ######################################## ## <summary> ## Send and receive messages from @@ -47814,7 +47986,7 @@ index cc83689..84c0fb7 100644 ## init scripts over dbus. ## </summary> ## <param name="domain"> -@@ -1461,6 +1657,25 @@ interface(`init_getattr_script_status_files',` +@@ -1461,6 +1659,25 @@ interface(`init_getattr_script_status_files',` ######################################## ## <summary> @@ -47840,7 +48012,7 @@ index cc83689..84c0fb7 100644 ## Do not audit attempts to read init script ## status files. ## </summary> -@@ -1519,6 +1734,24 @@ interface(`init_rw_script_tmp_files',` +@@ -1519,6 +1736,24 @@ interface(`init_rw_script_tmp_files',` ######################################## ## <summary> @@ -47865,7 +48037,7 @@ index cc83689..84c0fb7 100644 ## Create files in a init script ## temporary data directory. ## </summary> -@@ -1674,7 +1907,7 @@ interface(`init_dontaudit_rw_utmp',` +@@ -1674,7 +1909,7 @@ interface(`init_dontaudit_rw_utmp',` type initrc_var_run_t; ') @@ -47874,7 +48046,82 @@ index cc83689..84c0fb7 100644 ') ######################################## -@@ -1749,3 +1982,120 @@ interface(`init_udp_recvfrom_all_daemons',` +@@ -1715,6 +1950,74 @@ interface(`init_pid_filetrans_utmp',` + files_pid_filetrans($1, initrc_var_run_t, file) + ') + ++###################################### ++## <summary> ++## Allow search directory in the /run/systemd directory. ++## </summary> ++## <param name="domain"> ++## <summary> ++## Domain allowed access. ++## </summary> ++## </param> ++# ++interface(`init_search_pid_dirs',` ++ gen_require(` ++ type init_var_run_t; ++ ') ++ ++ allow $1 init_var_run_t:dir list_dir_perms; ++') ++ ++####################################### ++## <summary> ++## Create a directory in the /run/systemd directory. ++## </summary> ++## <param name="domain"> ++## <summary> ++## Domain allowed access. ++## </summary> ++## </param> ++# ++interface(`init_create_pid_dirs',` ++ gen_require(` ++ type init_var_run_t; ++ ') ++ ++ allow $1 init_var_run_t:dir list_dir_perms; ++ create_dirs_pattern($1, init_var_run_t, init_var_run_t) ++') ++ ++####################################### ++## <summary> ++## Create objects in /run/systemd directory ++## with an automatic type transition to ++## a specified private type. ++## </summary> ++## <param name="domain"> ++## <summary> ++## Domain allowed access. ++## </summary> ++## </param> ++## <param name="private_type"> ++## <summary> ++## The type of the object to create. ++## </summary> ++## </param> ++## <param name="object_class"> ++## <summary> ++## The class of the object to be created. ++## </summary> ++## </param> ++# ++interface(`init_pid_filetrans',` ++ gen_require(` ++ type init_var_run_t; ++ ') ++ ++ filetrans_pattern($1, init_var_run_t, $2, $3) ++ allow $1 init_var_run_t:dir search_dir_perms; ++') ++ + ######################################## + ## <summary> + ## Allow the specified domain to connect to daemon with a tcp socket +@@ -1749,3 +2052,120 @@ interface(`init_udp_recvfrom_all_daemons',` ') corenet_udp_recvfrom_labeled($1, daemon) ') @@ -47996,7 +48243,7 @@ index cc83689..84c0fb7 100644 +') + diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te -index ea29513..4283571 100644 +index ea29513..de61fb9 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -16,6 +16,34 @@ gen_require(` @@ -48071,7 +48318,7 @@ index ea29513..4283571 100644 # is ~sys_module really needed? observed: # sys_boot # sys_tty_config -@@ -100,7 +133,9 @@ allow init_t self:fifo_file rw_fifo_file_perms; +@@ -100,11 +133,15 @@ allow init_t self:fifo_file rw_fifo_file_perms; # Re-exec itself can_exec(init_t, init_exec_t) @@ -48080,9 +48327,18 @@ index ea29513..4283571 100644 +allow initrc_t init_t:unix_stream_socket { connectto rw_stream_socket_perms }; +allow initrc_t init_t:fifo_file rw_fifo_file_perms; - # For /var/run/shutdown.pid. - allow init_t init_var_run_t:file manage_file_perms; -@@ -114,11 +149,13 @@ allow init_t initrc_var_run_t:file { rw_file_perms setattr }; +-# For /var/run/shutdown.pid. +-allow init_t init_var_run_t:file manage_file_perms; +-files_pid_filetrans(init_t, init_var_run_t, file) ++manage_dirs_pattern(init_t, init_var_run_t, init_var_run_t) ++manage_files_pattern(init_t, init_var_run_t, init_var_run_t) ++manage_lnk_files_pattern(init_t, init_var_run_t, init_var_run_t) ++manage_sock_files_pattern(init_t, init_var_run_t, init_var_run_t) ++files_pid_filetrans(init_t, init_var_run_t, { dir file }) + + allow init_t initctl_t:fifo_file manage_fifo_file_perms; + dev_filetrans(init_t, initctl_t, fifo_file) +@@ -114,11 +151,13 @@ allow init_t initrc_var_run_t:file { rw_file_perms setattr }; kernel_read_system_state(init_t) kernel_share_state(init_t) @@ -48096,7 +48352,7 @@ index ea29513..4283571 100644 # Early devtmpfs dev_rw_generic_chr_files(init_t) -@@ -127,11 +164,16 @@ domain_kill_all_domains(init_t) +@@ -127,11 +166,16 @@ domain_kill_all_domains(init_t) domain_signal_all_domains(init_t) domain_signull_all_domains(init_t) domain_sigstop_all_domains(init_t) @@ -48113,7 +48369,7 @@ index ea29513..4283571 100644 files_manage_etc_runtime_files(init_t) files_etc_filetrans_etc_runtime(init_t, file) # Run /etc/X11/prefdm: -@@ -151,6 +193,7 @@ mls_file_read_all_levels(init_t) +@@ -151,6 +195,7 @@ mls_file_read_all_levels(init_t) mls_file_write_all_levels(init_t) mls_process_write_down(init_t) mls_fd_use_all_levels(init_t) @@ -48121,7 +48377,7 @@ index ea29513..4283571 100644 selinux_set_all_booleans(init_t) -@@ -162,12 +205,15 @@ init_domtrans_script(init_t) +@@ -162,12 +207,15 @@ init_domtrans_script(init_t) libs_rw_ld_so_cache(init_t) logging_send_syslog_msg(init_t) @@ -48137,7 +48393,7 @@ index ea29513..4283571 100644 ifdef(`distro_gentoo',` allow init_t self:process { getcap setcap }; ') -@@ -178,7 +224,7 @@ ifdef(`distro_redhat',` +@@ -178,7 +226,7 @@ ifdef(`distro_redhat',` fs_tmpfs_filetrans(init_t, initctl_t, fifo_file) ') @@ -48146,7 +48402,7 @@ index ea29513..4283571 100644 corecmd_shell_domtrans(init_t, initrc_t) ',` # Run the shell in the sysadm role for single-user mode. -@@ -186,12 +232,106 @@ tunable_policy(`init_upstart',` +@@ -186,12 +234,109 @@ tunable_policy(`init_upstart',` sysadm_shell_domtrans(init_t) ') @@ -48192,8 +48448,11 @@ index ea29513..4283571 100644 + files_mounton_all_mountpoints(init_t) + files_unmount_all_file_type_fs(init_t) + files_manage_all_pid_dirs(init_t) ++ files_relabel_all_pid_dirs(init_t) ++ files_relabel_all_pid_files(init_t) + files_unlink_all_pid_sockets(init_t) + files_manage_urandom_seed(init_t) ++ files_create_lock_dirs(init_t) + + fs_manage_cgroup_dirs(init_t) + fs_manage_hugetlbfs_dirs(init_t) @@ -48253,7 +48512,7 @@ index ea29513..4283571 100644 ') optional_policy(` -@@ -199,10 +339,25 @@ optional_policy(` +@@ -199,10 +344,25 @@ optional_policy(` ') optional_policy(` @@ -48279,7 +48538,7 @@ index ea29513..4283571 100644 unconfined_domain(init_t) ') -@@ -212,7 +367,7 @@ optional_policy(` +@@ -212,7 +372,7 @@ optional_policy(` # allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched }; @@ -48288,11 +48547,12 @@ index ea29513..4283571 100644 dontaudit initrc_t self:capability sys_module; # sysctl is triggering this allow initrc_t self:passwd rootok; allow initrc_t self:key manage_key_perms; -@@ -241,12 +396,14 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t) +@@ -241,12 +401,15 @@ manage_fifo_files_pattern(initrc_t, initrc_state_t, initrc_state_t) allow initrc_t initrc_var_run_t:file manage_file_perms; files_pid_filetrans(initrc_t, initrc_var_run_t, file) +files_manage_generic_pids_symlinks(initrc_t) ++files_create_var_run_dirs(initrc_t) can_exec(initrc_t, initrc_tmp_t) manage_files_pattern(initrc_t, initrc_tmp_t, initrc_tmp_t) @@ -48303,7 +48563,7 @@ index ea29513..4283571 100644 init_write_initctl(initrc_t) -@@ -258,20 +415,32 @@ kernel_change_ring_buffer_level(initrc_t) +@@ -258,20 +421,32 @@ kernel_change_ring_buffer_level(initrc_t) kernel_clear_ring_buffer(initrc_t) kernel_get_sysvipc_info(initrc_t) kernel_read_all_sysctls(initrc_t) @@ -48340,7 +48600,7 @@ index ea29513..4283571 100644 corenet_tcp_sendrecv_all_ports(initrc_t) corenet_udp_sendrecv_all_ports(initrc_t) corenet_tcp_connect_all_ports(initrc_t) -@@ -279,6 +448,7 @@ corenet_sendrecv_all_client_packets(initrc_t) +@@ -279,6 +454,7 @@ corenet_sendrecv_all_client_packets(initrc_t) dev_read_rand(initrc_t) dev_read_urand(initrc_t) @@ -48348,7 +48608,7 @@ index ea29513..4283571 100644 dev_write_kmsg(initrc_t) dev_write_rand(initrc_t) dev_write_urand(initrc_t) -@@ -291,6 +461,7 @@ dev_read_sound_mixer(initrc_t) +@@ -291,6 +467,7 @@ dev_read_sound_mixer(initrc_t) dev_write_sound_mixer(initrc_t) dev_setattr_all_chr_files(initrc_t) dev_rw_lvm_control(initrc_t) @@ -48356,7 +48616,7 @@ index ea29513..4283571 100644 dev_delete_lvm_control_dev(initrc_t) dev_manage_generic_symlinks(initrc_t) dev_manage_generic_files(initrc_t) -@@ -298,13 +469,13 @@ dev_manage_generic_files(initrc_t) +@@ -298,13 +475,13 @@ dev_manage_generic_files(initrc_t) dev_delete_generic_symlinks(initrc_t) dev_getattr_all_blk_files(initrc_t) dev_getattr_all_chr_files(initrc_t) @@ -48372,7 +48632,7 @@ index ea29513..4283571 100644 domain_sigchld_all_domains(initrc_t) domain_read_all_domains_state(initrc_t) domain_getattr_all_domains(initrc_t) -@@ -316,6 +487,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t) +@@ -316,6 +493,7 @@ domain_dontaudit_getattr_all_udp_sockets(initrc_t) domain_dontaudit_getattr_all_tcp_sockets(initrc_t) domain_dontaudit_getattr_all_dgram_sockets(initrc_t) domain_dontaudit_getattr_all_pipes(initrc_t) @@ -48380,7 +48640,7 @@ index ea29513..4283571 100644 files_getattr_all_dirs(initrc_t) files_getattr_all_files(initrc_t) -@@ -323,8 +495,10 @@ files_getattr_all_symlinks(initrc_t) +@@ -323,8 +501,10 @@ files_getattr_all_symlinks(initrc_t) files_getattr_all_pipes(initrc_t) files_getattr_all_sockets(initrc_t) files_purge_tmp(initrc_t) @@ -48392,7 +48652,7 @@ index ea29513..4283571 100644 files_delete_all_pids(initrc_t) files_delete_all_pid_dirs(initrc_t) files_read_etc_files(initrc_t) -@@ -340,8 +514,12 @@ files_list_isid_type_dirs(initrc_t) +@@ -340,8 +520,12 @@ files_list_isid_type_dirs(initrc_t) files_mounton_isid_type_dirs(initrc_t) files_list_default(initrc_t) files_mounton_default(initrc_t) @@ -48406,7 +48666,7 @@ index ea29513..4283571 100644 fs_list_inotifyfs(initrc_t) fs_register_binary_executable_type(initrc_t) # rhgb-console writes to ramfs -@@ -351,6 +529,8 @@ fs_mount_all_fs(initrc_t) +@@ -351,6 +535,8 @@ fs_mount_all_fs(initrc_t) fs_unmount_all_fs(initrc_t) fs_remount_all_fs(initrc_t) fs_getattr_all_fs(initrc_t) @@ -48415,7 +48675,7 @@ index ea29513..4283571 100644 # initrc_t needs to do a pidof which requires ptrace mcs_ptrace_all(initrc_t) -@@ -363,6 +543,7 @@ mls_process_read_up(initrc_t) +@@ -363,6 +549,7 @@ mls_process_read_up(initrc_t) mls_process_write_down(initrc_t) mls_rangetrans_source(initrc_t) mls_fd_share_all_levels(initrc_t) @@ -48423,7 +48683,7 @@ index ea29513..4283571 100644 selinux_get_enforce_mode(initrc_t) -@@ -374,6 +555,7 @@ term_use_all_terms(initrc_t) +@@ -374,6 +561,7 @@ term_use_all_terms(initrc_t) term_reset_tty_labels(initrc_t) auth_rw_login_records(initrc_t) @@ -48431,7 +48691,7 @@ index ea29513..4283571 100644 auth_setattr_login_records(initrc_t) auth_rw_lastlog(initrc_t) auth_read_pam_pid(initrc_t) -@@ -394,13 +576,12 @@ logging_read_audit_config(initrc_t) +@@ -394,13 +582,12 @@ logging_read_audit_config(initrc_t) miscfiles_read_localization(initrc_t) # slapd needs to read cert files from its initscript @@ -48447,7 +48707,7 @@ index ea29513..4283571 100644 userdom_read_user_home_content_files(initrc_t) # Allow access to the sysadm TTYs. Note that this will give access to the # TTYs to any process in the initrc_t domain. Therefore, daemons and such -@@ -478,7 +659,7 @@ ifdef(`distro_redhat',` +@@ -478,7 +665,7 @@ ifdef(`distro_redhat',` # Red Hat systems seem to have a stray # fd open from the initrd @@ -48456,7 +48716,15 @@ index ea29513..4283571 100644 files_dontaudit_read_root_files(initrc_t) # These seem to be from the initrd -@@ -524,6 +705,23 @@ ifdef(`distro_redhat',` +@@ -493,6 +680,7 @@ ifdef(`distro_redhat',` + files_create_boot_dirs(initrc_t) + files_create_boot_flag(initrc_t) + files_rw_boot_symlinks(initrc_t) ++ + # wants to read /.fonts directory + files_read_default_files(initrc_t) + files_mountpoint(initrc_tmp_t) +@@ -524,6 +712,23 @@ ifdef(`distro_redhat',` optional_policy(` bind_manage_config_dirs(initrc_t) bind_write_config(initrc_t) @@ -48480,7 +48748,7 @@ index ea29513..4283571 100644 ') optional_policy(` -@@ -531,10 +729,17 @@ ifdef(`distro_redhat',` +@@ -531,10 +736,17 @@ ifdef(`distro_redhat',` rpc_write_exports(initrc_t) rpc_manage_nfs_state_data(initrc_t) ') @@ -48498,7 +48766,7 @@ index ea29513..4283571 100644 ') optional_policy(` -@@ -549,6 +754,39 @@ ifdef(`distro_suse',` +@@ -549,6 +761,39 @@ ifdef(`distro_suse',` ') ') @@ -48538,7 +48806,7 @@ index ea29513..4283571 100644 optional_policy(` amavis_search_lib(initrc_t) amavis_setattr_pid_files(initrc_t) -@@ -561,6 +799,8 @@ optional_policy(` +@@ -561,6 +806,8 @@ optional_policy(` optional_policy(` apache_read_config(initrc_t) apache_list_modules(initrc_t) @@ -48547,7 +48815,7 @@ index ea29513..4283571 100644 ') optional_policy(` -@@ -577,6 +817,7 @@ optional_policy(` +@@ -577,6 +824,7 @@ optional_policy(` optional_policy(` cgroup_stream_connect_cgred(initrc_t) @@ -48555,7 +48823,7 @@ index ea29513..4283571 100644 ') optional_policy(` -@@ -589,6 +830,11 @@ optional_policy(` +@@ -589,6 +837,11 @@ optional_policy(` ') optional_policy(` @@ -48567,7 +48835,7 @@ index ea29513..4283571 100644 dev_getattr_printer_dev(initrc_t) cups_read_log(initrc_t) -@@ -605,9 +851,13 @@ optional_policy(` +@@ -605,9 +858,13 @@ optional_policy(` dbus_connect_system_bus(initrc_t) dbus_system_bus_client(initrc_t) dbus_read_config(initrc_t) @@ -48581,7 +48849,7 @@ index ea29513..4283571 100644 ') optional_policy(` -@@ -649,6 +899,11 @@ optional_policy(` +@@ -649,6 +906,11 @@ optional_policy(` ') optional_policy(` @@ -48593,7 +48861,7 @@ index ea29513..4283571 100644 inn_exec_config(initrc_t) ') -@@ -706,7 +961,13 @@ optional_policy(` +@@ -706,7 +968,13 @@ optional_policy(` ') optional_policy(` @@ -48607,7 +48875,7 @@ index ea29513..4283571 100644 mta_dontaudit_read_spool_symlinks(initrc_t) ') -@@ -729,6 +990,10 @@ optional_policy(` +@@ -729,6 +997,10 @@ optional_policy(` ') optional_policy(` @@ -48618,7 +48886,7 @@ index ea29513..4283571 100644 postgresql_manage_db(initrc_t) postgresql_read_config(initrc_t) ') -@@ -738,10 +1003,20 @@ optional_policy(` +@@ -738,10 +1010,20 @@ optional_policy(` ') optional_policy(` @@ -48639,7 +48907,7 @@ index ea29513..4283571 100644 quota_manage_flags(initrc_t) ') -@@ -750,6 +1025,10 @@ optional_policy(` +@@ -750,6 +1032,10 @@ optional_policy(` ') optional_policy(` @@ -48650,7 +48918,7 @@ index ea29513..4283571 100644 fs_write_ramfs_sockets(initrc_t) fs_search_ramfs(initrc_t) -@@ -771,8 +1050,6 @@ optional_policy(` +@@ -771,8 +1057,6 @@ optional_policy(` # bash tries ioctl for some reason files_dontaudit_ioctl_all_pids(initrc_t) @@ -48659,7 +48927,7 @@ index ea29513..4283571 100644 ') optional_policy(` -@@ -781,14 +1058,21 @@ optional_policy(` +@@ -781,14 +1065,21 @@ optional_policy(` ') optional_policy(` @@ -48681,7 +48949,7 @@ index ea29513..4283571 100644 optional_policy(` ssh_dontaudit_read_server_keys(initrc_t) -@@ -810,11 +1094,24 @@ optional_policy(` +@@ -810,11 +1101,24 @@ optional_policy(` ') optional_policy(` @@ -48707,7 +48975,7 @@ index ea29513..4283571 100644 ifdef(`distro_redhat',` # system-config-services causes avc messages that should be dontaudited -@@ -824,6 +1121,25 @@ optional_policy(` +@@ -824,6 +1128,25 @@ optional_policy(` optional_policy(` mono_domtrans(initrc_t) ') @@ -48733,7 +49001,7 @@ index ea29513..4283571 100644 ') optional_policy(` -@@ -849,3 +1165,37 @@ optional_policy(` +@@ -849,3 +1172,42 @@ optional_policy(` optional_policy(` zebra_read_config(initrc_t) ') @@ -48771,6 +49039,11 @@ index ea29513..4283571 100644 +') + +init_rw_stream_sockets(daemon) ++ ++allow init_t var_run_t:dir relabelto; ++ ++init_stream_connect(initrc_t) ++ diff --git a/policy/modules/system/ipsec.fc b/policy/modules/system/ipsec.fc index 07eba2b..942bea1 100644 --- a/policy/modules/system/ipsec.fc @@ -50055,7 +50328,7 @@ index c7cfb62..6160239 100644 init_labeled_script_domtrans($1, syslogd_initrc_exec_t) domain_system_change_exemption($1) diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te -index 9b5a9ed..4c9a5eb 100644 +index 9b5a9ed..d3522be 100644 --- a/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te @@ -19,6 +19,11 @@ type auditd_log_t; @@ -50084,7 +50357,7 @@ index 9b5a9ed..4c9a5eb 100644 type syslogd_initrc_exec_t; init_script_file(syslogd_initrc_exec_t) -@@ -179,6 +185,8 @@ logging_send_syslog_msg(auditd_t) +@@ -179,10 +185,13 @@ logging_send_syslog_msg(auditd_t) logging_domtrans_dispatcher(auditd_t) logging_signal_dispatcher(auditd_t) @@ -50093,7 +50366,12 @@ index 9b5a9ed..4c9a5eb 100644 miscfiles_read_localization(auditd_t) mls_file_read_all_levels(auditd_t) -@@ -234,7 +242,12 @@ domain_use_interactive_fds(audisp_t) + mls_file_write_all_levels(auditd_t) # Need to be able to write to /var/run/ directory ++mls_socket_write_all_levels(auditd_t) + + seutil_dontaudit_read_config(auditd_t) + +@@ -234,7 +243,12 @@ domain_use_interactive_fds(audisp_t) files_read_etc_files(audisp_t) files_read_etc_runtime_files(audisp_t) @@ -50106,7 +50384,7 @@ index 9b5a9ed..4c9a5eb 100644 logging_send_syslog_msg(audisp_t) -@@ -244,14 +257,26 @@ sysnet_dns_name_resolve(audisp_t) +@@ -244,14 +258,26 @@ sysnet_dns_name_resolve(audisp_t) optional_policy(` dbus_system_bus_client(audisp_t) @@ -50134,9 +50412,12 @@ index 9b5a9ed..4c9a5eb 100644 corenet_all_recvfrom_unlabeled(audisp_remote_t) corenet_all_recvfrom_netlabel(audisp_remote_t) -@@ -266,9 +291,16 @@ corenet_sendrecv_audit_client_packets(audisp_remote_t) +@@ -265,10 +291,19 @@ corenet_sendrecv_audit_client_packets(audisp_remote_t) + files_read_etc_files(audisp_remote_t) ++mls_socket_write_all_levels(audisp_remote_t) ++ logging_send_syslog_msg(audisp_remote_t) +logging_send_audit_msgs(audisp_remote_t) + @@ -50151,7 +50432,7 @@ index 9b5a9ed..4c9a5eb 100644 sysnet_dns_name_resolve(audisp_remote_t) ######################################## -@@ -338,11 +370,12 @@ optional_policy(` +@@ -338,11 +373,12 @@ optional_policy(` # chown fsetid for syslog-ng # sys_admin for the integrated klog of syslog-ng and metalog # cjp: why net_admin! @@ -50166,7 +50447,7 @@ index 9b5a9ed..4c9a5eb 100644 # receive messages to be logged allow syslogd_t self:unix_dgram_socket create_socket_perms; allow syslogd_t self:unix_stream_socket create_stream_socket_perms; -@@ -360,6 +393,7 @@ files_pid_filetrans(syslogd_t, devlog_t, sock_file) +@@ -360,6 +396,7 @@ files_pid_filetrans(syslogd_t, devlog_t, sock_file) # create/append log files. manage_files_pattern(syslogd_t, var_log_t, var_log_t) rw_fifo_files_pattern(syslogd_t, var_log_t, var_log_t) @@ -50174,7 +50455,7 @@ index 9b5a9ed..4c9a5eb 100644 # Allow access for syslog-ng allow syslogd_t var_log_t:dir { create setattr }; -@@ -369,9 +403,15 @@ manage_dirs_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t) +@@ -369,9 +406,15 @@ manage_dirs_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t) manage_files_pattern(syslogd_t, syslogd_tmp_t, syslogd_tmp_t) files_tmp_filetrans(syslogd_t, syslogd_tmp_t, { dir file }) @@ -50190,7 +50471,7 @@ index 9b5a9ed..4c9a5eb 100644 # manage pid file manage_files_pattern(syslogd_t, syslogd_var_run_t, syslogd_var_run_t) files_pid_filetrans(syslogd_t, syslogd_var_run_t, file) -@@ -412,6 +452,9 @@ corenet_sendrecv_mysqld_client_packets(syslogd_t) +@@ -412,6 +455,9 @@ corenet_sendrecv_mysqld_client_packets(syslogd_t) dev_filetrans(syslogd_t, devlog_t, sock_file) dev_read_sysfs(syslogd_t) @@ -50200,7 +50481,15 @@ index 9b5a9ed..4c9a5eb 100644 domain_use_interactive_fds(syslogd_t) -@@ -480,6 +523,10 @@ optional_policy(` +@@ -432,6 +478,7 @@ term_write_console(syslogd_t) + # Allow syslog to a terminal + term_write_unallocated_ttys(syslogd_t) + ++init_stream_connect(syslogd_t) + # for sending messages to logged in users + init_read_utmp(syslogd_t) + init_dontaudit_write_utmp(syslogd_t) +@@ -480,6 +527,10 @@ optional_policy(` ') optional_policy(` @@ -50211,7 +50500,7 @@ index 9b5a9ed..4c9a5eb 100644 postgresql_stream_connect(syslogd_t) ') -@@ -488,6 +535,10 @@ optional_policy(` +@@ -488,6 +539,10 @@ optional_policy(` ') optional_policy(` @@ -50700,16 +50989,17 @@ index a0eef20..75e256f 100644 dev_rw_xserver_misc(insmod_t) diff --git a/policy/modules/system/mount.fc b/policy/modules/system/mount.fc -index 72c746e..3d0bc28 100644 +index 72c746e..9f9124f 100644 --- a/policy/modules/system/mount.fc +++ b/policy/modules/system/mount.fc -@@ -1,4 +1,14 @@ +@@ -1,4 +1,15 @@ +/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0) /bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) -/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) +/dev/\.mount(/.*)? gen_context(system_u:object_r:mount_var_run_t,s0) ++/run/mount(/.*)? gen_context(system_u:object_r:mount_var_run_t,s0) + +/sbin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) +/sbin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) @@ -51896,7 +52186,7 @@ index 170e2c7..540a936 100644 +') +') diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te -index 7ed9819..293555e 100644 +index 7ed9819..1dc6876 100644 --- a/policy/modules/system/selinuxutil.te +++ b/policy/modules/system/selinuxutil.te @@ -22,6 +22,9 @@ attribute can_relabelto_binary_policy; @@ -51980,7 +52270,15 @@ index 7ed9819..293555e 100644 miscfiles_read_localization(load_policy_t) -@@ -204,7 +222,7 @@ ifdef(`hide_broken_symptoms',` +@@ -183,6 +201,7 @@ seutil_libselinux_linked(load_policy_t) + + userdom_use_user_terminals(load_policy_t) + userdom_use_all_users_fds(load_policy_t) ++userdom_dontaudit_read_user_tmp_files(load_policy_t) + + ifdef(`distro_ubuntu',` + optional_policy(` +@@ -204,7 +223,7 @@ ifdef(`hide_broken_symptoms',` # Newrole local policy # @@ -51989,7 +52287,7 @@ index 7ed9819..293555e 100644 allow newrole_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execheap execstack }; allow newrole_t self:process setexec; allow newrole_t self:fd use; -@@ -216,7 +234,7 @@ allow newrole_t self:msgq create_msgq_perms; +@@ -216,7 +235,7 @@ allow newrole_t self:msgq create_msgq_perms; allow newrole_t self:msg { send receive }; allow newrole_t self:unix_dgram_socket sendto; allow newrole_t self:unix_stream_socket { create_stream_socket_perms connectto }; @@ -51998,7 +52296,7 @@ index 7ed9819..293555e 100644 read_files_pattern(newrole_t, default_context_t, default_context_t) read_lnk_files_pattern(newrole_t, default_context_t, default_context_t) -@@ -233,6 +251,7 @@ domain_use_interactive_fds(newrole_t) +@@ -233,6 +252,7 @@ domain_use_interactive_fds(newrole_t) # for when the user types "exec newrole" at the command line: domain_sigchld_interactive_fds(newrole_t) @@ -52006,7 +52304,7 @@ index 7ed9819..293555e 100644 files_read_etc_files(newrole_t) files_read_var_files(newrole_t) files_read_var_symlinks(newrole_t) -@@ -260,25 +279,30 @@ term_relabel_all_ptys(newrole_t) +@@ -260,25 +280,30 @@ term_relabel_all_ptys(newrole_t) term_getattr_unallocated_ttys(newrole_t) term_dontaudit_use_unallocated_ttys(newrole_t) @@ -52043,7 +52341,7 @@ index 7ed9819..293555e 100644 ifdef(`distro_ubuntu',` optional_policy(` unconfined_domain(newrole_t) -@@ -312,6 +336,8 @@ kernel_use_fds(restorecond_t) +@@ -312,6 +337,8 @@ kernel_use_fds(restorecond_t) kernel_rw_pipes(restorecond_t) kernel_read_system_state(restorecond_t) @@ -52052,7 +52350,7 @@ index 7ed9819..293555e 100644 fs_relabelfrom_noxattr_fs(restorecond_t) fs_dontaudit_list_nfs(restorecond_t) fs_getattr_xattr_fs(restorecond_t) -@@ -335,6 +361,8 @@ miscfiles_read_localization(restorecond_t) +@@ -335,6 +362,8 @@ miscfiles_read_localization(restorecond_t) seutil_libselinux_linked(restorecond_t) @@ -52061,7 +52359,7 @@ index 7ed9819..293555e 100644 ifdef(`distro_ubuntu',` optional_policy(` unconfined_domain(restorecond_t) -@@ -353,7 +381,7 @@ optional_policy(` +@@ -353,7 +382,7 @@ optional_policy(` allow run_init_t self:process setexec; allow run_init_t self:capability setuid; allow run_init_t self:fifo_file rw_file_perms; @@ -52070,7 +52368,15 @@ index 7ed9819..293555e 100644 # often the administrator runs such programs from a directory that is owned # by a different user or has restrictive SE permissions, do not want to audit -@@ -380,6 +408,8 @@ selinux_compute_create_context(run_init_t) +@@ -363,6 +392,7 @@ dontaudit run_init_t self:capability { dac_override dac_read_search }; + corecmd_exec_bin(run_init_t) + corecmd_exec_shell(run_init_t) + ++dev_dontaudit_getattr_all(run_init_t) + dev_dontaudit_list_all_dev_nodes(run_init_t) + + domain_use_interactive_fds(run_init_t) +@@ -380,6 +410,8 @@ selinux_compute_create_context(run_init_t) selinux_compute_relabel_context(run_init_t) selinux_compute_user_contexts(run_init_t) @@ -52079,7 +52385,7 @@ index 7ed9819..293555e 100644 auth_use_nsswitch(run_init_t) auth_domtrans_chk_passwd(run_init_t) auth_domtrans_upd_passwd(run_init_t) -@@ -405,6 +435,15 @@ ifndef(`direct_sysadm_daemon',` +@@ -405,6 +437,15 @@ ifndef(`direct_sysadm_daemon',` ') ') @@ -52095,7 +52401,7 @@ index 7ed9819..293555e 100644 ifdef(`distro_ubuntu',` optional_policy(` unconfined_domain(run_init_t) -@@ -420,61 +459,22 @@ optional_policy(` +@@ -420,61 +461,22 @@ optional_policy(` # semodule local policy # @@ -52165,7 +52471,7 @@ index 7ed9819..293555e 100644 # netfilter_contexts: seutil_manage_default_contexts(semanage_t) -@@ -487,118 +487,69 @@ ifdef(`distro_debian',` +@@ -487,118 +489,69 @@ ifdef(`distro_debian',` files_read_var_lib_symlinks(semanage_t) ') @@ -52842,10 +53148,10 @@ index df32316..e8d03fb 100644 +') diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc new file mode 100644 -index 0000000..50aed3b +index 0000000..266e9b0 --- /dev/null +++ b/policy/modules/system/systemd.fc -@@ -0,0 +1,11 @@ +@@ -0,0 +1,12 @@ +/bin/systemd-notify -- gen_context(system_u:object_r:systemd_notify_exec_t,s0) + +/bin/systemd-tty-ask-password-agent -- gen_context(system_u:object_r:systemd_passwd_agent_exec_t,s0) @@ -52855,14 +53161,15 @@ index 0000000..50aed3b + +/lib/systemd/systemd-tmpfiles -- gen_context(system_u:object_r:systemd_tmpfiles_exec_t,s0) + ++/var/run/systemd/ask-password-block/[^/]* -p gen_context(system_u:object_r:systemd_device_t,s0) +/dev/\.systemd/ask-password-block/[^/]* -p gen_context(system_u:object_r:systemd_device_t,s0) + diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if new file mode 100644 -index 0000000..1d17a7b +index 0000000..aabfb0d --- /dev/null +++ b/policy/modules/system/systemd.if -@@ -0,0 +1,139 @@ +@@ -0,0 +1,140 @@ +## <summary>SELinux policy for systemd components</summary> + +####################################### @@ -52995,6 +53302,7 @@ index 0000000..1d17a7b + dev_associate(systemd_$1_device_t) + + dev_filetrans($1_t, systemd_$1_device_t, { file sock_file }) ++ init_pid_filetrans($1_t, systemd_$1_device_t, { file sock_file }) + allow $1_t systemd_$1_device_t:file manage_file_perms; + allow $1_t systemd_$1_device_t:sock_file manage_sock_file_perms; + @@ -53004,10 +53312,10 @@ index 0000000..1d17a7b +') diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te new file mode 100644 -index 0000000..6c68924 +index 0000000..a0f5414 --- /dev/null +++ b/policy/modules/system/systemd.te -@@ -0,0 +1,153 @@ +@@ -0,0 +1,163 @@ + +policy_module(systemd, 1.0.0) + @@ -53054,6 +53362,7 @@ index 0000000..6c68924 + +allow systemd_passwd_agent_t systemd_device_t:fifo_file manage_fifo_file_perms; +dev_filetrans(systemd_passwd_agent_t, systemd_device_t, fifo_file) ++init_pid_filetrans(systemd_passwd_agent_t, systemd_device_t, fifo_file) + +kernel_stream_connect(systemd_passwd_agent_t) + @@ -53066,6 +53375,7 @@ index 0000000..6c68924 +auth_use_nsswitch(systemd_passwd_agent_t) + +init_read_utmp(systemd_passwd_agent_t) ++init_create_pid_dirs(systemd_passwd_agent_t) + +miscfiles_read_localization(systemd_passwd_agent_t) + @@ -53140,6 +53450,14 @@ index 0000000..6c68924 + rpm_delete_db(systemd_tmpfiles_t) +') + ++optional_policy(` ++ sandbox_list(systemd_tmpfiles_t) ++ sandbox_delete_dirs(systemd_tmpfiles_t) ++ sandbox_delete_files(systemd_tmpfiles_t) ++ sandbox_delete_sock_files(systemd_tmpfiles_t) ++ sandbox_setattr_dirs(systemd_tmpfiles_t) ++') ++ +######################################## +# +# systemd_notify local policy @@ -53162,10 +53480,19 @@ index 0000000..6c68924 + readahead_manage_pid_files(systemd_notify_t) +') diff --git a/policy/modules/system/udev.fc b/policy/modules/system/udev.fc -index 0291685..44fe366 100644 +index 0291685..9dcdfe7 100644 --- a/policy/modules/system/udev.fc +++ b/policy/modules/system/udev.fc -@@ -22,3 +22,4 @@ +@@ -11,6 +11,8 @@ + + /lib/udev/udev-acl -- gen_context(system_u:object_r:udev_exec_t,s0) + ++/run/\.udev(/.*)? -- gen_context(system_u:object_r:udev_tbl_t,s0) ++ + /sbin/start_udev -- gen_context(system_u:object_r:udev_exec_t,s0) + /sbin/udev -- gen_context(system_u:object_r:udev_exec_t,s0) + /sbin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0) +@@ -22,3 +24,4 @@ /usr/bin/udevinfo -- gen_context(system_u:object_r:udev_exec_t,s0) /var/run/PackageKit/udev(/.*)? gen_context(system_u:object_r:udev_var_run_t,s0) @@ -54196,7 +54523,7 @@ index db75976..392d1ee 100644 +HOME_DIR/\.gvfs(/.*)? <<none>> +HOME_DIR/\.debug(/.*)? <<none>> diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if -index 28b88de..012c198 100644 +index 28b88de..8e51296 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -30,8 +30,9 @@ template(`userdom_base_user_template',` @@ -55905,7 +56232,32 @@ index 28b88de..012c198 100644 kernel_search_proc($1) ') -@@ -3139,3 +3543,1058 @@ interface(`userdom_dbus_send_all_users',` +@@ -3087,6 +3491,24 @@ interface(`userdom_signal_all_users',` + + ######################################## + ## <summary> ++## Send kill signals to all user domains. ++## </summary> ++## <param name="domain"> ++## <summary> ++## Domain allowed access. ++## </summary> ++## </param> ++# ++interface(`userdom_kill_all_users',` ++ gen_require(` ++ attribute userdomain; ++ ') ++ ++ allow $1 userdomain:process sigkill; ++') ++ ++######################################## ++## <summary> + ## Send a SIGCHLD signal to all user domains. + ## </summary> + ## <param name="domain"> +@@ -3139,3 +3561,1058 @@ interface(`userdom_dbus_send_all_users',` allow $1 userdomain:dbus send_msg; ') diff --git a/selinux-policy.spec b/selinux-policy.spec index 6075a5c..c971b22 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -471,8 +471,21 @@ exit 0 %endif %changelog -* Wed Mar 30 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.9.16-8 +* Thu Mar 31 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.9.16-8 +- A lot of fixes making /run change working - Add subs file to equate /var/run with /run and /var/lock with /run/lock +- Allow rgmanager to send the kill signal to all users +- Allow ssh_t to search /root/.ssh and create it if it does not exist +- dontaudit read of user_tmp_t from load_policy +- Allow abrt fowner capability +- Allow audit daemons to change the run level in MLS environments +- Since /var/lock is moving to /run/lock. We need to allow all interfaces for lock files to search var_run_t +- Add file labelfor MathKernel +- Add label for /dev/dlm* +- Allow systemd_tmpfiles_t to manage sandbox data +- More /run directories labels +- rlogind sends kill signal to chkpwd_t +- systemd is now mounting on /var/lock * Fri Mar 25 2011 Miroslav Grepl <mgrepl(a)redhat.com> 3.9.16-7 - Make Makefile/Rules.modular run sepolgen-ifgen during build to check if files for bugs

1 0

[kernel] update to snapshot 2.6.39-rc1-git1
by Kyle McMartin 31 Mar '11

31 Mar '11

commit ae1de152a447f25a063869715b81875d11e24103 Author: Kyle McMartin <kyle(a)redhat.com> Date: Thu Mar 31 15:59:16 2011 -0400 update to snapshot 2.6.39-rc1-git1 .gitignore | 1 + kernel.spec | 5 ++++- sources | 1 + 3 files changed, 6 insertions(+), 1 deletions(-) --- diff --git a/.gitignore b/.gitignore index c2fd413..61249dd 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ patch-*.bz2 clog *.rpm kernel-2.6.*/ +patch-2.6.39-rc1-git1.bz2 diff --git a/kernel.spec b/kernel.spec index 8e82f91..0d64f0f 100644 --- a/kernel.spec +++ b/kernel.spec @@ -84,7 +84,7 @@ Summary: The Linux kernel # The rc snapshot level %define rcrev 1 # The git snapshot level -%define gitrev 0 +%define gitrev 1 # Set rpm version accordingly %define rpmversion 2.6.%{upstream_sublevel} %endif @@ -1941,6 +1941,9 @@ fi # and build. %changelog +* Thu Mar 31 2011 Kyle McMartin <kmcmartin(a)redhat.com> 2.6.39-0.rc1.git1.0 +- Update to snapshot 2.6.39-rc1-git1 + * Tue Mar 29 2011 Kyle McMartin <kmcmartin(a)redhat.com> - Disable CONFIG_IMA, CONFIG_TCG_TPM on powerpc (#689468) diff --git a/sources b/sources index 73a552c..f7373f9 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ 7d471477bfa67546f902da62227fa976 linux-2.6.38.tar.bz2 1ddd2ac391e294ac05e9d83b8ade6279 patch-2.6.39-rc1.bz2 +8a44f599c7b872b7cb9ced894711d071 patch-2.6.39-rc1-git1.bz2

1 0

[kernel/f14/master] update to 2.6.35.12
by Kyle McMartin 31 Mar '11

31 Mar '11

commit 3472dfdd752e2e37edd2b2dc477fe946922b5c7c Author: Kyle McMartin <kyle(a)redhat.com> Date: Thu Mar 31 17:04:46 2011 -0400 update to 2.6.35.12 add-macbookair3-ids.patch | 263 -------------------- ...211-fix-can_beacon_sec_chan-reenable-ht40.patch | 46 ---- config-x86-generic | 2 + config-x86_64-generic | 2 + ...-security_d_instantiate-in-d_obtain_alias.patch | 65 ----- ...ping-function-called-from-invalid-context.patch | 76 ------ iwl3945-remove-plcp-check.patch | 36 --- kernel.spec | 46 +--- kvm-fix-fs-gs-reload-oops-with-invalid-ldt.patch | 161 ------------ linux-2.6-upstream-reverts.patch | 193 ++++++++++++++ ...lock-synchronization-when-migrating-tasks.patch | 8 +- ...-move-sched_avg_update-to-update_cpu_load.patch | 58 ----- ...ment-cache_nice_tries-only-on-periodic-lb.patch | 93 ------- sources | 2 +- tpm-fix-stall-on-boot.patch | 24 -- 15 files changed, 207 insertions(+), 868 deletions(-) --- diff --git a/config-x86-generic b/config-x86-generic index f1686da..65e788a 100644 --- a/config-x86-generic +++ b/config-x86-generic @@ -492,3 +492,5 @@ CONFIG_LPC_SCH=m CONFIG_INTEL_IDLE=y CONFIG_PCI_CNB20LE_QUIRK=y + +CONFIG_IRQ_TIME_ACCOUNTING=y diff --git a/config-x86_64-generic b/config-x86_64-generic index 79b74c2..4c4924c 100644 --- a/config-x86_64-generic +++ b/config-x86_64-generic @@ -409,3 +409,5 @@ CONFIG_I7300_IDLE=m CONFIG_PCI_CNB20LE_QUIRK=y CONFIG_HP_ILO=m + +CONFIG_IRQ_TIME_ACCOUNTING=y diff --git a/kernel.spec b/kernel.spec index 06c837f..0951de2 100644 --- a/kernel.spec +++ b/kernel.spec @@ -48,7 +48,7 @@ Summary: The Linux kernel # reset this by hand to 1 (or to 0 and then use rpmdev-bumpspec). # scripts/rebase.sh should be made to do that for you, actually. # -%global baserelease 87 +%global baserelease 88 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -60,7 +60,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 11 +%define stable_update 12 # Is it a -stable RC? %define stable_rc 0 # Set rpm version accordingly @@ -763,13 +763,10 @@ Patch12565: sched-05-avoid-side-effect-of-tickless-idle-on-update_cpu_load.patch Patch12570: sched-10-change-nohz-idle-load-balancing-logic-to-push-model.patch Patch12575: sched-15-update-rq-clock-for-nohz-balanced-cpus.patch Patch12580: sched-20-fix-rq-clock-synchronization-when-migrating-tasks.patch -Patch12585: sched-25-move-sched_avg_update-to-update_cpu_load.patch Patch12590: sched-30-sched-fix-nohz-balance-kick.patch -Patch12595: sched-35-increment-cache_nice_tries-only-on-periodic-lb.patch Patch13600: btusb-macbookpro-6-2.patch Patch13601: btusb-macbookpro-7-1.patch -Patch13602: add-macbookair3-ids.patch Patch13610: libata-it821x-dump-stack-on-cache-flush.patch @@ -784,9 +781,6 @@ Patch13641: mmc-make-sdhci-work-with-ricoh-mmc-controller.patch Patch13642: mmc-add-ricoh-e822-pci-id.patch Patch13645: tpm-autodetect-itpm-devices.patch -Patch13646: tpm-fix-stall-on-boot.patch - -Patch13651: kvm-fix-fs-gs-reload-oops-with-invalid-ldt.patch Patch13652: fix-i8k-inline-asm.patch @@ -810,8 +804,6 @@ Patch13694: btrfs-fix-error-handling-in-btrfs_get_sub.patch Patch13695: btrfs-setup-blank-root-and-fs_info-for-mount-time.patch Patch13696: btrfs-fix-race-between-btrfs_get_sb-and-unmount.patch -Patch13697: fs-call-security_d_instantiate-in-d_obtain_alias.patch - Patch13698: net-AF_PACKET-vmalloc.patch # rhbz#652744 @@ -824,9 +816,6 @@ Patch13702: block-check-for-proper-length-of-iov-entries-earlier-in-blk_rq_map_u # RHBZ #669511 Patch13703: btrfs-fix-typo-in-fallocate-to-make-it-honor-actual-size.patch -# rhbz#643758 -Patch13704: hostap_cs-fix-sleeping-function-called-from-invalid-context.patch - # rhbz #673207 Patch13705: sunrpc-kernel-panic-when-mount-nfsv4.patch @@ -839,18 +828,12 @@ Patch13707: kvm-mmu-fix-32-bit-legacy-paging-with-npt.patch # rhbz#676860 Patch13708: hid-force-feedback-support-for-logitech-rumblepad-gamepad.patch -# rhbz#654599 -Patch13709: iwl3945-remove-plcp-check.patch - # rhbz#604630 Patch13710: linux-2.6-bonding-sysfs-warning.patch # rhbz#680791 Patch13711: md-fix-regression-resulting-in-delays-in-clearing-bits-in-a-bitmap.patch -# rhbz#671514 -Patch13712: cfg80211-fix-can_beacon_sec_chan-reenable-ht40.patch - Patch13713: virtio_net-add-schedule-check-to-napi_enable-call.patch %endif @@ -1314,9 +1297,6 @@ ApplyPatch linux-2.6-32bit-mmap-exec-randomization.patch # bugfixes to drivers and filesystems # -# rhbz#662344,600690 -ApplyPatch fs-call-security_d_instantiate-in-d_obtain_alias.patch - # ext4 # rhbz#578674 @@ -1519,16 +1499,11 @@ ApplyPatch sched-05-avoid-side-effect-of-tickless-idle-on-update_cpu_load.patch ApplyPatch sched-10-change-nohz-idle-load-balancing-logic-to-push-model.patch ApplyPatch sched-15-update-rq-clock-for-nohz-balanced-cpus.patch ApplyPatch sched-20-fix-rq-clock-synchronization-when-migrating-tasks.patch -ApplyPatch sched-25-move-sched_avg_update-to-update_cpu_load.patch ApplyPatch sched-30-sched-fix-nohz-balance-kick.patch -ApplyPatch sched-35-increment-cache_nice_tries-only-on-periodic-lb.patch ApplyPatch btusb-macbookpro-7-1.patch ApplyPatch btusb-macbookpro-6-2.patch -# rhbz#651019 -ApplyPatch add-macbookair3-ids.patch - # temporary patch, dump stack on failed it821x commands ApplyPatch libata-it821x-dump-stack-on-cache-flush.patch @@ -1546,11 +1521,6 @@ ApplyPatch mmc-make-sdhci-work-with-ricoh-mmc-controller.patch ApplyPatch mmc-add-ricoh-e822-pci-id.patch ApplyPatch tpm-autodetect-itpm-devices.patch -# rhbz#530393 -ApplyPatch tpm-fix-stall-on-boot.patch - -# CVE-2010-3698 -ApplyPatch kvm-fix-fs-gs-reload-oops-with-invalid-ldt.patch ApplyPatch fix-i8k-inline-asm.patch @@ -1582,9 +1552,6 @@ ApplyPatch e1000e-82566DC-fails-to-get-link.patch # CVE-2010-4668 ApplyPatch block-check-for-proper-length-of-iov-entries-earlier-in-blk_rq_map_user_iov.patch -# rhbz#643758 -ApplyPatch hostap_cs-fix-sleeping-function-called-from-invalid-context.patch - # rhbz #673207 ApplyPatch sunrpc-kernel-panic-when-mount-nfsv4.patch @@ -1597,18 +1564,12 @@ ApplyPatch kvm-mmu-fix-32-bit-legacy-paging-with-npt.patch # rhbz#676860 ApplyPatch hid-force-feedback-support-for-logitech-rumblepad-gamepad.patch -# rhbz#654599 -ApplyPatch iwl3945-remove-plcp-check.patch - # rhbz#604630 ApplyPatch linux-2.6-bonding-sysfs-warning.patch # rhbz#680791 ApplyPatch md-fix-regression-resulting-in-delays-in-clearing-bits-in-a-bitmap.patch -# rhbz#671514 -ApplyPatch cfg80211-fix-can_beacon_sec_chan-reenable-ht40.patch - ApplyPatch virtio_net-add-schedule-check-to-napi_enable-call.patch # END OF PATCH APPLICATIONS @@ -2197,6 +2158,9 @@ fi # and build. %changelog +* Thu Mar 31 2011 Kyle McMartin <kmcmartin(a)redhat.com> 2.6.35.12-88 +- Update to longterm 2.6.35.12, drop upstream patches. + * Wed Mar 23 2011 Kyle McMartin <kmcmartin(a)redhat.com> - Backport 3e9d08e: "virtio_net: Add schedule check to napi_enable call" diff --git a/linux-2.6-upstream-reverts.patch b/linux-2.6-upstream-reverts.patch index 9eb4848..50f70fd 100644 --- a/linux-2.6-upstream-reverts.patch +++ b/linux-2.6-upstream-reverts.patch @@ -137,3 +137,196 @@ Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de> /* Channel's PRAMIN object + heap */ ret = nouveau_gpuobj_new_fake(dev, 0, c_offset, c_size, 0, NULL, &chan->ramin); + +commit 6f1b1e1384b23cfab30c2bc02a8f94927274c10d +Author: Geert Uytterhoeven <geert(a)linux-m68k.org> +Date: Sun Jan 16 10:09:13 2011 -0300 + + radio-aimslab.c needs #include <linux/delay.h> + + commit 2400982a2e8a8e4e95f0a0e1517bbe63cc88038f upstream. + + Commit e3c92215198cb6aa00ad38db2780faa6b72e0a3f ("[media] radio-aimslab.c: Fix + gcc 4.5+ bug") removed the include, but introduced new callers of msleep(): + + | drivers/media/radio/radio-aimslab.c: In function ‘rt_decvol’: + | drivers/media/radio/radio-aimslab.c:76: error: implicit declaration of function ‘msleep’ + + Signed-off-by: Geert Uytterhoeven <geert(a)linux-m68k.org> + Signed-off-by: Mauro Carvalho Chehab <mchehab(a)redhat.com> + Signed-off-by: Andi Kleen <ak(a)linux.intel.com> + Cc: dann frazier <dannf(a)debian.org> + Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de> + +diff --git a/drivers/media/radio/radio-aimslab.c b/drivers/media/radio/radio-aimslab.c +index 1944814..a91642c 100644 +--- a/drivers/media/radio/radio-aimslab.c ++++ b/drivers/media/radio/radio-aimslab.c +@@ -31,6 +31,7 @@ + #include <linux/module.h> /* Modules */ + #include <linux/init.h> /* Initdata */ + #include <linux/ioport.h> /* request_region */ ++#include <linux/delay.h> /* msleep */ + #include <linux/videodev2.h> /* kernel radio structs */ + #include <linux/version.h> /* for KERNEL_VERSION MACRO */ + #include <linux/io.h> /* outb, outb_p */ + +commit 9c198dad83c19a05a11b5a195242f3e8dcbe55f4 +Author: Mauro Carvalho Chehab <mchehab(a)redhat.com> +Date: Thu Jan 6 08:16:04 2011 -0200 + + radio-aimslab.c: Fix gcc 4.5+ bug + + commit e3c92215198cb6aa00ad38db2780faa6b72e0a3f upstream. + + gcc 4.5+ doesn't properly evaluate some inlined expressions. + A previous patch were proposed by Andrew Morton using noinline. + However, the entire inlined function is bogus, so let's just + remove it and be happy. + + Reported-by: Andrew Morton <akpm(a)linux-foundation.org> + Signed-off-by: Mauro Carvalho Chehab <mchehab(a)redhat.com> + Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de> + Signed-off-by: Andi Kleen <ak(a)linux.intel.com> + +diff --git a/drivers/media/radio/radio-aimslab.c b/drivers/media/radio/radio-aimslab.c +index 5bf4985..1944814 100644 +--- a/drivers/media/radio/radio-aimslab.c ++++ b/drivers/media/radio/radio-aimslab.c +@@ -31,7 +31,6 @@ + #include <linux/module.h> /* Modules */ + #include <linux/init.h> /* Initdata */ + #include <linux/ioport.h> /* request_region */ +-#include <linux/delay.h> /* udelay */ + #include <linux/videodev2.h> /* kernel radio structs */ + #include <linux/version.h> /* for KERNEL_VERSION MACRO */ + #include <linux/io.h> /* outb, outb_p */ +@@ -71,27 +70,17 @@ static struct rtrack rtrack_card; + + /* local things */ + +-static void sleep_delay(long n) +-{ +- /* Sleep nicely for 'n' uS */ +- int d = n / msecs_to_jiffies(1000); +- if (!d) +- udelay(n); +- else +- msleep(jiffies_to_msecs(d)); +-} +- + static void rt_decvol(struct rtrack *rt) + { + outb(0x58, rt->io); /* volume down + sigstr + on */ +- sleep_delay(100000); ++ msleep(100); + outb(0xd8, rt->io); /* volume steady + sigstr + on */ + } + + static void rt_incvol(struct rtrack *rt) + { + outb(0x98, rt->io); /* volume up + sigstr + on */ +- sleep_delay(100000); ++ msleep(100); + outb(0xd8, rt->io); /* volume steady + sigstr + on */ + } + +@@ -120,7 +109,7 @@ static int rt_setvol(struct rtrack *rt, int vol) + + if (vol == 0) { /* volume = 0 means mute the card */ + outb(0x48, rt->io); /* volume down but still "on" */ +- sleep_delay(2000000); /* make sure it's totally down */ ++ msleep(2000); /* make sure it's totally down */ + outb(0xd0, rt->io); /* volume steady, off */ + rt->curvol = 0; /* track the volume state! */ + mutex_unlock(&rt->lock); +@@ -155,7 +144,7 @@ static void send_0_byte(struct rtrack *rt) + outb_p(128+64+16+8+ 1, rt->io); /* on + wr-enable + data low */ + outb_p(128+64+16+8+2+1, rt->io); /* clock */ + } +- sleep_delay(1000); ++ msleep(1); + } + + static void send_1_byte(struct rtrack *rt) +@@ -169,7 +158,7 @@ static void send_1_byte(struct rtrack *rt) + outb_p(128+64+16+8+4+2+1, rt->io); /* clock */ + } + +- sleep_delay(1000); ++ msleep(1); + } + + static int rt_setfreq(struct rtrack *rt, unsigned long freq) +@@ -427,7 +416,7 @@ static int __init rtrack_init(void) + + /* this ensures that the volume is all the way down */ + outb(0x48, rt->io); /* volume down but still "on" */ +- sleep_delay(2000000); /* make sure it's totally down */ ++ msleep(2000); /* make sure it's totally down */ + outb(0xc0, rt->io); /* steady volume, mute card */ + + return 0; + +commit 515884e98dc4f1c99387000d420394c3bc47c0d7 +Author: Dan Carpenter <error27(a)gmail.com> +Date: Fri Jan 7 16:41:54 2011 -0300 + + av7110: check for negative array offset + + commit cb26a24ee9706473f31d34cc259f4dcf45cd0644 upstream. + + info->num comes from the user. It's type int. If the user passes + in a negative value that would cause memory corruption. + + Signed-off-by: Dan Carpenter <error27(a)gmail.com> + Signed-off-by: Mauro Carvalho Chehab <mchehab(a)redhat.com> + Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de> + Signed-off-by: Andi Kleen <ak(a)linux.intel.com> + +diff --git a/drivers/media/dvb/ttpci/av7110_ca.c b/drivers/media/dvb/ttpci/av7110_ca.c +index 4eba35a..c38dd67 100644 +--- a/drivers/media/dvb/ttpci/av7110_ca.c ++++ b/drivers/media/dvb/ttpci/av7110_ca.c +@@ -277,7 +277,7 @@ static int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg) + { + ca_slot_info_t *info=(ca_slot_info_t *)parg; + +- if (info->num > 1) ++ if (info->num < 0 || info->num > 1) + return -EINVAL; + av7110->ci_slot[info->num].num = info->num; + av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ? + +commit 9e5ad61f8d81da0b58535ac2cf60d36e26ca567a +Author: Mauro Carvalho Chehab <mchehab(a)redhat.com> +Date: Mon Oct 25 17:51:15 2010 -0300 + + em28xx: Fix audio input for Terratec Grabby + + commit a3fa904ec79b94f0db7faed010ff94d42f7d1d47 upstream. + + The audio input line was wrong. Fix it. + + Signed-off-by: Mauro Carvalho Chehab <mchehab(a)redhat.com> + Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de> + Signed-off-by: Andi Kleen <ak(a)linux.intel.com> + +diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c +index 3a4fd85..2fa5bb4 100644 +--- a/drivers/media/video/em28xx/em28xx-cards.c ++++ b/drivers/media/video/em28xx/em28xx-cards.c +@@ -1605,11 +1605,11 @@ struct em28xx_board em28xx_boards[] = { + .input = { { + .type = EM28XX_VMUX_COMPOSITE1, + .vmux = SAA7115_COMPOSITE0, +- .amux = EM28XX_AMUX_VIDEO2, ++ .amux = EM28XX_AMUX_LINE_IN, + }, { + .type = EM28XX_VMUX_SVIDEO, + .vmux = SAA7115_SVIDEO3, +- .amux = EM28XX_AMUX_VIDEO2, ++ .amux = EM28XX_AMUX_LINE_IN, + } }, + }, + [EM2860_BOARD_TERRATEC_AV350] = { diff --git a/sched-20-fix-rq-clock-synchronization-when-migrating-tasks.patch b/sched-20-fix-rq-clock-synchronization-when-migrating-tasks.patch index 466dd2d..bcdaac9 100644 --- a/sched-20-fix-rq-clock-synchronization-when-migrating-tasks.patch +++ b/sched-20-fix-rq-clock-synchronization-when-migrating-tasks.patch @@ -24,15 +24,15 @@ Signed-off-by: Ingo Molnar <mingo(a)elte.hu> --- diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c -index 806d1b2..ab661eb 100644 +index 09a9811..6cebdf8 100644 --- a/kernel/sched_fair.c +++ b/kernel/sched_fair.c -@@ -3752,6 +3752,8 @@ static void task_fork_fair(struct task_struct *p) +@@ -3609,6 +3609,8 @@ static void task_fork_fair(struct task_struct *p) raw_spin_lock_irqsave(&rq->lock, flags); + update_rq_clock(rq); + - if (unlikely(task_cpu(p) != this_cpu)) + if (unlikely(task_cpu(p) != this_cpu)) { + rcu_read_lock(); __set_task_cpu(p, this_cpu); - diff --git a/sources b/sources index 5f39778..3cdf638 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ 091abeb4684ce03d1d936851618687b6 linux-2.6.35.tar.bz2 -573170b7d56d30d06d26b705d4794615 patch-2.6.35.11.bz2 +c835a799c89c296b332077a5390fcc68 patch-2.6.35.12.bz2

1 0

[usermode] Add UGROUPS=wheel to config-util
by Miloslav Trmac 31 Mar '11

31 Mar '11

commit 459a7682f7fae71eaf54c867c142cf0a150e107a Author: Miloslav Trmač <mitr(a)redhat.com> Date: Thu Mar 31 22:57:53 2011 +0200 Add UGROUPS=wheel to config-util - Add UGROUPS=wheel to config-util Resolves: #688690 config-util | 2 ++ usermode.spec | 6 +++++- 2 files changed, 7 insertions(+), 1 deletions(-) --- diff --git a/config-util b/config-util new file mode 100644 index 0000000..a6b9096 --- /dev/null +++ b/config-util @@ -0,0 +1,2 @@ +USER=root +UGROUPS=wheel diff --git a/usermode.spec b/usermode.spec index db4daae..415ae3b 100644 --- a/usermode.spec +++ b/usermode.spec @@ -6,6 +6,7 @@ License: GPLv2+ Group: Applications/System URL: https://fedorahosted.org/usermode/ Source: https://fedorahosted.org/releases/u/s/usermode/usermode-%{version}.tar.xz +Source1: config-util Requires: pam, passwd, util-linux BuildRequires: desktop-file-utils, gettext, glib2-devel, gtk2-devel, intltool BuildRequires: libblkid-devel, libSM-devel, libselinux-devel, libuser-devel @@ -56,7 +57,8 @@ for wrappedapp in halt reboot poweroff ; do $RPM_BUILD_ROOT/etc/security/console.apps/${wrappedapp} install -p -m644 shutdown.pamd $RPM_BUILD_ROOT/etc/pam.d/${wrappedapp} done -echo 'USER=root' > $RPM_BUILD_ROOT/etc/security/console.apps/config-util +install -p -m 644 %{SOURCE1} \ + $RPM_BUILD_ROOT/etc/security/console.apps/config-util for i in redhat-userinfo.desktop redhat-userpasswd.desktop \ redhat-usermount.desktop; do @@ -113,6 +115,8 @@ rm -rf $RPM_BUILD_ROOT * Thu Mar 31 2011 Miloslav Trmač <mitr(a)redhat.com> - 1.107-1 - Update to usermode-1.107 Resolves: #668731 +- Add UGROUPS=wheel to config-util + Resolves: #688690 * Mon Feb 07 2011 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 1.106.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild

1 0

[usermode] Update to usermode-1.107
by Miloslav Trmac 31 Mar '11

31 Mar '11

commit 2d24fa9874c2d387b780e268643aca98adf8de1a Author: Miloslav Trmač <mitr(a)redhat.com> Date: Thu Mar 31 22:36:45 2011 +0200 Update to usermode-1.107 * Thu Mar 31 2011 Miloslav Trmač <mitr(a)redhat.com> - 1.107-1 - Update to usermode-1.107 Resolves: #668731 .gitignore | 1 + sources | 2 +- usermode.spec | 8 ++++++-- 3 files changed, 8 insertions(+), 3 deletions(-) --- diff --git a/.gitignore b/.gitignore index 707474a..cf05f91 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ usermode-1.105.tar.xz /usermode-1.106.tar.xz /usermode-1.106.1.tar.xz +/usermode-1.107.tar.xz diff --git a/sources b/sources index df9d075..6ef84ec 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -e687f847bc050b669c9dc76915349853 usermode-1.106.1.tar.xz +00a53086a5716106585fe0234f1030d3 usermode-1.107.tar.xz diff --git a/usermode.spec b/usermode.spec index 5d957a4..db4daae 100644 --- a/usermode.spec +++ b/usermode.spec @@ -1,7 +1,7 @@ Summary: Tools for certain user account management tasks Name: usermode -Version: 1.106.1 -Release: 3%{?dist} +Version: 1.107 +Release: 1%{?dist} License: GPLv2+ Group: Applications/System URL: https://fedorahosted.org/usermode/ @@ -110,6 +110,10 @@ rm -rf $RPM_BUILD_ROOT %{_datadir}/applications/* %changelog +* Thu Mar 31 2011 Miloslav Trmač <mitr(a)redhat.com> - 1.107-1 +- Update to usermode-1.107 + Resolves: #668731 + * Mon Feb 07 2011 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 1.106.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild

1 0

[bwbar/el6/master: 2/2] Merge branch 'master' into el6
by Adrian Reber 31 Mar '11

31 Mar '11

commit f76f34af4739116335448f215e4870c185b2a18f Merge: 84a247c 4498ed0 Author: Adrian Reber <adrian(a)lisas.de> Date: Thu Mar 31 22:57:24 2011 +0200 Merge branch 'master' into el6 bwbar.debian-020_proc_net_2.6.x_fix.patch | 4 ++-- bwbar.spec | 5 ++++- 2 files changed, 6 insertions(+), 3 deletions(-) ---

1 0

[bwbar/el6/master] (2 commits) ...Merge branch 'master' into el6
by Adrian Reber 31 Mar '11

31 Mar '11

Summary of changes: 4498ed0... fix patch (**** rejecting target file name with ".." compon (*) f76f34a... Merge branch 'master' into el6 (*) This commit already existed in another branch; no separate mail sent

1 0

← Newer
1
2
3
4
5
6
7
8
...
1447
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

scm-commits March 2011