rpms/selinux-policy/devel policy-20070703.patch, 1.23, 1.24 selinux-policy.spec, 1.485, 1.486
Daniel J Walsh (dwalsh)
fedora-extras-commits at redhat.com
Tue Jul 31 20:52:15 UTC 2007
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv16974
Modified Files:
policy-20070703.patch selinux-policy.spec
Log Message:
* Mon Jul 30 2007 Dan Walsh <dwalsh at redhat.com> 3.0.4-4
- Eliminate mount_ntfs_t policy, merge into mount_t
policy-20070703.patch:
Index: policy-20070703.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20070703.patch,v
retrieving revision 1.23
retrieving revision 1.24
diff -u -r1.23 -r1.24
--- policy-20070703.patch 31 Jul 2007 17:53:29 -0000 1.23
+++ policy-20070703.patch 31 Jul 2007 20:51:42 -0000 1.24
@@ -710,7 +710,7 @@
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.0.4/policy/modules/admin/rpm.if
--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-30 11:47:29.000000000 -0400
-+++ serefpolicy-3.0.4/policy/modules/admin/rpm.if 2007-07-25 13:27:51.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/admin/rpm.if 2007-07-31 14:04:42.000000000 -0400
@@ -210,6 +210,24 @@
########################################
@@ -767,7 +767,7 @@
')
########################################
-@@ -289,3 +328,65 @@
+@@ -289,3 +328,84 @@
dontaudit $1 rpm_var_lib_t:file manage_file_perms;
dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms;
')
@@ -833,6 +833,25 @@
+
+ dontaudit $1 rpm_tmp_t:file rw_file_perms;
+')
++
++########################################
++## <summary>
++## Do not audit attempts to read,
++## write RPM shm
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
++interface(`rpm_dontaudit_rw_shm',`
++ gen_require(`
++ type rpm_t;
++ ')
++
++ dontaudit $1 rpm_t:shm rw_shm_perms;
++')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.0.4/policy/modules/admin/rpm.te
--- nsaserefpolicy/policy/modules/admin/rpm.te 2007-07-25 10:37:43.000000000 -0400
+++ serefpolicy-3.0.4/policy/modules/admin/rpm.te 2007-07-25 13:27:51.000000000 -0400
@@ -2697,7 +2716,7 @@
# etc_runtime_t is the type of various
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.0.4/policy/modules/kernel/filesystem.if
--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-07-03 07:05:38.000000000 -0400
-+++ serefpolicy-3.0.4/policy/modules/kernel/filesystem.if 2007-07-30 10:20:15.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/filesystem.if 2007-07-31 16:40:44.000000000 -0400
@@ -1192,6 +1192,24 @@
########################################
@@ -2723,9 +2742,61 @@
## Search inotifyfs filesystem.
## </summary>
## <param name="domain">
+@@ -2219,7 +2237,7 @@
+ ## Domain allowed access.
+ ## </summary>
+ ## </param>
+-#
++
+ interface(`fs_dontaudit_read_ramfs_files',`
+ gen_require(`
+ type ramfs_t;
+@@ -3476,3 +3494,42 @@
+ relabelfrom_blk_files_pattern($1,noxattrfs,noxattrfs)
+ relabelfrom_chr_files_pattern($1,noxattrfs,noxattrfs)
+ ')
++
++########################################
++## <summary>
++## Read files of anon_inodefs file system files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`fs_read_anon_inodefs_files',`
++ gen_require(`
++ type anon_inodefs_t;
++
++ ')
++
++ read_files_pattern($1,anon_inodefs_t,anon_inodefs_t)
++')
++
++########################################
++## <summary>
++## Read/wrie files of anon_inodefs file system files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`fs_rw_anon_inodefs_files',`
++ gen_require(`
++ type anon_inodefs_t;
++
++ ')
++
++ rw_files_pattern($1,anon_inodefs_t,anon_inodefs_t)
++')
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.0.4/policy/modules/kernel/filesystem.te
--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-07-25 10:37:36.000000000 -0400
-+++ serefpolicy-3.0.4/policy/modules/kernel/filesystem.te 2007-07-25 13:27:51.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/filesystem.te 2007-07-31 16:40:53.000000000 -0400
@@ -43,6 +43,12 @@
#
# Non-persistent/pseudo filesystems
@@ -2749,7 +2820,7 @@
# filesystem SID to label inodes in the following filesystem types,
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.4/policy/modules/kernel/kernel.if
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-07-03 07:05:38.000000000 -0400
-+++ serefpolicy-3.0.4/policy/modules/kernel/kernel.if 2007-07-25 14:26:57.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/kernel/kernel.if 2007-07-31 16:22:36.000000000 -0400
@@ -108,6 +108,24 @@
########################################
@@ -3354,7 +3425,7 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.0.4/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.4/policy/modules/services/apache.te 2007-07-26 13:46:18.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/apache.te 2007-07-31 16:48:18.000000000 -0400
@@ -30,6 +30,13 @@
## <desc>
@@ -3470,22 +3541,18 @@
libs_use_ld_so(httpd_t)
libs_use_shared_libs(httpd_t)
-@@ -348,7 +396,13 @@
+@@ -348,7 +396,9 @@
userdom_use_unpriv_users_fds(httpd_t)
-mta_send_mail(httpd_t)
-+optional_policy(`
-+ nscd_socket_use(httpd_t)
-+')
-+
+tunable_policy(`httpd_enable_homedirs',`
+ userdom_search_generic_user_home_dirs(httpd_t)
+')
tunable_policy(`allow_httpd_anon_write',`
miscfiles_manage_public_files(httpd_t)
-@@ -360,6 +414,7 @@
+@@ -360,6 +410,7 @@
#
tunable_policy(`allow_httpd_mod_auth_pam',`
auth_domtrans_chk_passwd(httpd_t)
@@ -3493,7 +3560,7 @@
')
')
-@@ -367,6 +422,16 @@
+@@ -367,6 +418,16 @@
corenet_tcp_connect_all_ports(httpd_t)
')
@@ -3510,7 +3577,7 @@
tunable_policy(`httpd_can_network_connect_db',`
# allow httpd to connect to mysql/posgresql
corenet_tcp_connect_postgresql_port(httpd_t)
-@@ -387,6 +452,17 @@
+@@ -387,6 +448,17 @@
corenet_sendrecv_http_cache_client_packets(httpd_t)
')
@@ -3528,7 +3595,7 @@
tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',`
domtrans_pattern(httpd_t, httpdcontent, httpd_sys_script_t)
-@@ -404,11 +480,21 @@
+@@ -404,11 +476,21 @@
fs_read_nfs_symlinks(httpd_t)
')
@@ -3550,7 +3617,7 @@
tunable_policy(`httpd_ssi_exec',`
corecmd_shell_domtrans(httpd_t,httpd_sys_script_t)
allow httpd_sys_script_t httpd_t:fd use;
-@@ -430,6 +516,12 @@
+@@ -430,6 +512,12 @@
')
optional_policy(`
@@ -3563,7 +3630,7 @@
calamaris_read_www_files(httpd_t)
')
-@@ -512,10 +604,16 @@
+@@ -512,10 +600,16 @@
tunable_policy(`httpd_tty_comm',`
# cjp: this is redundant:
term_use_controlling_term(httpd_helper_t)
@@ -3581,7 +3648,24 @@
########################################
#
# Apache PHP script local policy
-@@ -606,6 +704,10 @@
+@@ -567,7 +661,6 @@
+ allow httpd_suexec_t self:capability { setuid setgid };
+ allow httpd_suexec_t self:process signal_perms;
+ allow httpd_suexec_t self:unix_stream_socket create_stream_socket_perms;
+-allow httpd_suexec_t self:netlink_route_socket r_netlink_socket_perms;
+
+ domtrans_pattern(httpd_t, httpd_suexec_exec_t, httpd_suexec_t)
+
+@@ -581,6 +674,8 @@
+ manage_files_pattern(httpd_suexec_t,httpd_suexec_tmp_t,httpd_suexec_tmp_t)
+ files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir })
+
++auth_use_nsswitch(httpd_suexec_t)
++
+ kernel_read_kernel_sysctls(httpd_suexec_t)
+ kernel_list_proc(httpd_suexec_t)
+ kernel_read_proc_symlinks(httpd_suexec_t)
+@@ -606,6 +701,10 @@
miscfiles_read_localization(httpd_suexec_t)
@@ -3592,7 +3676,7 @@
tunable_policy(`httpd_can_network_connect',`
allow httpd_suexec_t self:tcp_socket create_stream_socket_perms;
allow httpd_suexec_t self:udp_socket create_socket_perms;
-@@ -620,10 +722,13 @@
+@@ -620,10 +719,13 @@
corenet_udp_sendrecv_all_ports(httpd_suexec_t)
corenet_tcp_connect_all_ports(httpd_suexec_t)
corenet_sendrecv_all_client_packets(httpd_suexec_t)
@@ -3607,7 +3691,7 @@
tunable_policy(`httpd_enable_cgi && httpd_unified',`
domtrans_pattern(httpd_suexec_t, httpdcontent, httpd_sys_script_t)
')
-@@ -634,6 +739,12 @@
+@@ -634,6 +736,12 @@
fs_exec_nfs_files(httpd_suexec_t)
')
@@ -3620,7 +3704,22 @@
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_suexec_t)
fs_read_cifs_symlinks(httpd_suexec_t)
-@@ -672,7 +783,8 @@
+@@ -655,14 +763,6 @@
+ nagios_domtrans_cgi(httpd_suexec_t)
+ ')
+
+-optional_policy(`
+- nis_use_ypbind(httpd_suexec_t)
+-')
+-
+-optional_policy(`
+- nscd_socket_use(httpd_suexec_t)
+-')
+-
+ ########################################
+ #
+ # Apache system script local policy
+@@ -672,7 +772,8 @@
dontaudit httpd_sys_script_t httpd_config_t:dir search;
@@ -3630,7 +3729,7 @@
allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms;
read_files_pattern(httpd_sys_script_t,squirrelmail_spool_t,squirrelmail_spool_t)
-@@ -686,15 +798,66 @@
+@@ -686,15 +787,66 @@
# Should we add a boolean?
apache_domtrans_rotatelogs(httpd_sys_script_t)
@@ -3646,15 +3745,15 @@
+')
+
+tunable_policy(`httpd_use_nfs', `
-+ fs_read_nfs_files(httpd_sys_script_t)
-+ fs_read_nfs_symlinks(httpd_sys_script_t)
-+')
-+
-+tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs', `
fs_read_nfs_files(httpd_sys_script_t)
fs_read_nfs_symlinks(httpd_sys_script_t)
')
++tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs', `
++ fs_read_nfs_files(httpd_sys_script_t)
++ fs_read_nfs_symlinks(httpd_sys_script_t)
++')
++
+tunable_policy(`httpd_enable_cgi && httpd_can_network_connect_db',`
+ allow httpd_sys_script_t self:tcp_socket create_stream_socket_perms;
+ allow httpd_sys_script_t self:udp_socket create_socket_perms;
@@ -3698,7 +3797,7 @@
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_sys_script_t)
fs_read_cifs_symlinks(httpd_sys_script_t)
-@@ -711,6 +874,19 @@
+@@ -711,6 +863,19 @@
########################################
#
@@ -3718,7 +3817,7 @@
# httpd_rotatelogs local policy
#
-@@ -728,3 +904,26 @@
+@@ -728,3 +893,26 @@
logging_search_logs(httpd_rotatelogs_t)
miscfiles_read_localization(httpd_rotatelogs_t)
@@ -3795,7 +3894,7 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.0.4/policy/modules/services/apcupsd.te
--- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.4/policy/modules/services/apcupsd.te 2007-07-30 11:42:36.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/apcupsd.te 2007-07-31 14:08:18.000000000 -0400
@@ -16,6 +16,9 @@
type apcupsd_log_t;
logging_log_file(apcupsd_log_t)
@@ -3844,7 +3943,7 @@
files_search_locks(apcupsd_t)
+# Creates /etc/nologin
+files_manage_etc_runtime_files(apcupsd_t)
-+files_etc_filetrans_etc_runtime(apcuspd_t,file)
++files_etc_filetrans_etc_runtime(apcupsd_t,file)
+
+#apcupsd runs shutdown, probably need a shutdown domain
+init_rw_utmp(apcupsd_t)
@@ -4572,7 +4671,7 @@
+/usr/local/Brother/inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.4/policy/modules/services/cups.te
--- nsaserefpolicy/policy/modules/services/cups.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.4/policy/modules/services/cups.te 2007-07-31 12:58:26.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/cups.te 2007-07-31 16:41:22.000000000 -0400
@@ -81,12 +81,11 @@
# /usr/lib/cups/backend/serial needs sys_admin(?!)
allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_resource sys_tty_config };
@@ -4596,7 +4695,7 @@
allow cupsd_t cupsd_exec_t:lnk_file read;
manage_files_pattern(cupsd_t,cupsd_log_t,cupsd_log_t)
-@@ -150,14 +149,17 @@
+@@ -150,20 +149,24 @@
corenet_tcp_bind_reserved_port(cupsd_t)
corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t)
corenet_tcp_connect_all_ports(cupsd_t)
@@ -4615,7 +4714,14 @@
dev_getattr_printer_dev(cupsd_t)
domain_read_all_domains_state(cupsd_t)
-@@ -176,6 +178,7 @@
+
+ fs_getattr_all_fs(cupsd_t)
+ fs_search_auto_mountpoints(cupsd_t)
++fs_read_anon_inodefs_files(cupsd_t)
+
+ mls_fd_use_all_levels(cupsd_t)
+ mls_file_downgrade(cupsd_t)
+@@ -176,6 +179,7 @@
term_search_ptys(cupsd_t)
auth_domtrans_chk_passwd(cupsd_t)
@@ -4623,7 +4729,7 @@
auth_dontaudit_read_pam_pid(cupsd_t)
# Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp
-@@ -189,7 +192,7 @@
+@@ -189,7 +193,7 @@
# read python modules
files_read_usr_files(cupsd_t)
# for /var/lib/defoma
@@ -4632,7 +4738,7 @@
files_list_world_readable(cupsd_t)
files_read_world_readable_files(cupsd_t)
files_read_world_readable_symlinks(cupsd_t)
-@@ -223,21 +226,45 @@
+@@ -223,21 +227,45 @@
sysnet_read_config(cupsd_t)
@@ -4678,7 +4784,7 @@
cron_system_entry(cupsd_t, cupsd_exec_t)
')
-@@ -250,6 +277,10 @@
+@@ -250,6 +278,10 @@
optional_policy(`
hal_dbus_chat(cupsd_t)
')
@@ -4689,7 +4795,7 @@
')
optional_policy(`
-@@ -265,16 +296,16 @@
+@@ -265,16 +297,16 @@
')
optional_policy(`
@@ -4710,7 +4816,7 @@
seutil_sigchld_newrole(cupsd_t)
')
-@@ -379,6 +410,14 @@
+@@ -379,6 +411,14 @@
')
optional_policy(`
@@ -4725,7 +4831,7 @@
cron_system_entry(cupsd_config_t, cupsd_config_exec_t)
')
-@@ -562,7 +601,7 @@
+@@ -562,7 +602,7 @@
dev_read_urand(hplip_t)
dev_read_rand(hplip_t)
dev_rw_generic_usb_dev(hplip_t)
@@ -4734,7 +4840,7 @@
fs_getattr_all_fs(hplip_t)
fs_search_auto_mountpoints(hplip_t)
-@@ -589,8 +628,6 @@
+@@ -589,8 +629,6 @@
userdom_dontaudit_search_sysadm_home_dirs(hplip_t)
userdom_dontaudit_search_all_users_home_content(hplip_t)
@@ -6225,7 +6331,7 @@
/usr/lib/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.0.4/policy/modules/services/postfix.if
--- nsaserefpolicy/policy/modules/services/postfix.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.4/policy/modules/services/postfix.if 2007-07-25 13:27:51.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/postfix.if 2007-07-31 15:40:47.000000000 -0400
@@ -41,6 +41,8 @@
allow postfix_$1_t self:unix_stream_socket connectto;
@@ -6235,7 +6341,15 @@
allow postfix_$1_t postfix_etc_t:dir list_dir_perms;
read_files_pattern(postfix_$1_t,postfix_etc_t,postfix_etc_t)
-@@ -132,10 +134,8 @@
+@@ -66,6 +68,7 @@
+
+ fs_search_auto_mountpoints(postfix_$1_t)
+ fs_getattr_xattr_fs(postfix_$1_t)
++ fs_rw_anon_inodefs_files(postfix_$1_t)
+
+ term_dontaudit_use_console(postfix_$1_t)
+
+@@ -132,10 +135,8 @@
corenet_tcp_connect_all_ports(postfix_$1_t)
corenet_sendrecv_all_client_packets(postfix_$1_t)
@@ -6247,7 +6361,7 @@
')
')
-@@ -269,6 +269,42 @@
+@@ -269,6 +270,42 @@
########################################
## <summary>
@@ -6290,7 +6404,7 @@
## Do not audit attempts to use
## postfix master process file
## file descriptors.
-@@ -434,6 +470,25 @@
+@@ -434,6 +471,25 @@
########################################
## <summary>
@@ -6316,7 +6430,7 @@
## Execute postfix user mail programs
## in their respective domains.
## </summary>
-@@ -450,3 +505,22 @@
+@@ -450,3 +506,22 @@
typeattribute $1 postfix_user_domtrans;
')
@@ -6677,7 +6791,7 @@
fs_search_auto_mountpoints($1_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.4/policy/modules/services/rpc.te
--- nsaserefpolicy/policy/modules/services/rpc.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.4/policy/modules/services/rpc.te 2007-07-30 09:46:58.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/services/rpc.te 2007-07-31 14:16:40.000000000 -0400
@@ -59,10 +59,13 @@
manage_files_pattern(rpcd_t,rpcd_var_run_t,rpcd_var_run_t)
files_pid_filetrans(rpcd_t,rpcd_var_run_t,file)
@@ -7135,8 +7249,25 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.4/policy/modules/services/setroubleshoot.te
--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.4/policy/modules/services/setroubleshoot.te 2007-07-25 13:27:51.000000000 -0400
-@@ -76,6 +76,9 @@
++++ serefpolicy-3.0.4/policy/modules/services/setroubleshoot.te 2007-07-31 16:16:14.000000000 -0400
+@@ -33,7 +33,6 @@
+ allow setroubleshootd_t self:tcp_socket create_stream_socket_perms;
+ allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto };
+ allow setroubleshootd_t self:unix_dgram_socket create_socket_perms;
+-allow setroubleshootd_t self:netlink_route_socket r_netlink_socket_perms;
+
+ # database files
+ allow setroubleshootd_t setroubleshoot_var_lib_t:dir setattr;
+@@ -51,6 +50,8 @@
+ manage_sock_files_pattern(setroubleshootd_t,setroubleshoot_var_run_t,setroubleshoot_var_run_t)
+ files_pid_filetrans(setroubleshootd_t,setroubleshoot_var_run_t, { file sock_file })
+
++auth_use_nsswitch(setroubleshootd_t)
++
+ kernel_read_kernel_sysctls(setroubleshootd_t)
+ kernel_read_system_state(setroubleshootd_t)
+ kernel_read_network_state(setroubleshootd_t)
+@@ -76,6 +77,9 @@
files_getattr_all_dirs(setroubleshootd_t)
files_getattr_all_files(setroubleshootd_t)
@@ -7146,6 +7277,13 @@
selinux_get_enforce_mode(setroubleshootd_t)
selinux_validate_context(setroubleshootd_t)
+@@ -108,6 +112,3 @@
+ rpm_use_script_fds(setroubleshootd_t)
+ ')
+
+-optional_policy(`
+- nis_use_ypbind(setroubleshootd_t)
+-')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.0.4/policy/modules/services/smartmon.te
--- nsaserefpolicy/policy/modules/services/smartmon.te 2007-07-25 10:37:42.000000000 -0400
+++ serefpolicy-3.0.4/policy/modules/services/smartmon.te 2007-07-25 13:27:51.000000000 -0400
@@ -10115,7 +10253,16 @@
########################################
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.4/policy/modules/system/sysnetwork.te
--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.4/policy/modules/system/sysnetwork.te 2007-07-25 13:27:51.000000000 -0400
++++ serefpolicy-3.0.4/policy/modules/system/sysnetwork.te 2007-07-31 16:04:09.000000000 -0400
+@@ -45,7 +45,7 @@
+ dontaudit dhcpc_t self:capability sys_tty_config;
+ # for access("/etc/bashrc", X_OK) on Red Hat
+ dontaudit dhcpc_t self:capability { dac_read_search sys_module };
+-allow dhcpc_t self:process signal_perms;
++allow dhcpc_t self:process { ptrace signal_perms };
+ allow dhcpc_t self:fifo_file rw_file_perms;
+ allow dhcpc_t self:tcp_socket create_stream_socket_perms;
+ allow dhcpc_t self:udp_socket create_socket_perms;
@@ -159,6 +159,10 @@
dbus_connect_system_bus(dhcpc_t)
dbus_send_system_bus(dhcpc_t)
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.485
retrieving revision 1.486
diff -u -r1.485 -r1.486
--- selinux-policy.spec 31 Jul 2007 17:53:29 -0000 1.485
+++ selinux-policy.spec 31 Jul 2007 20:51:43 -0000 1.486
@@ -12,7 +12,7 @@
%endif
%define POLICYVER 21
%define libsepolver 2.0.3-2
-%define POLICYCOREUTILSVER 2.0.21-1
+%define POLICYCOREUTILSVER 2.0.22-11
%define CHECKPOLICYVER 2.0.3-1
Summary: SELinux policy configuration
Name: selinux-policy
More information about the scm-commits
mailing list