rpms/selinux-policy/devel policy-20080710.patch, 1.56, 1.57 selinux-policy.spec, 1.719, 1.720

Daniel J Walsh dwalsh at fedoraproject.org
Mon Oct 6 19:10:49 UTC 2008 

Author: dwalsh

Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv10460

Modified Files:
	policy-20080710.patch selinux-policy.spec 
Log Message:
* Mon Oct 6 2008 Dan Walsh <dwalsh at redhat.com> 3.5.10-3
- Fixes for confined xwindows and xdm_t 


policy-20080710.patch:

Index: policy-20080710.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20080710.patch,v
retrieving revision 1.56
retrieving revision 1.57
diff -u -r1.56 -r1.57
--- policy-20080710.patch	3 Oct 2008 20:11:22 -0000	1.56
+++ policy-20080710.patch	6 Oct 2008 19:10:48 -0000	1.57
@@ -6707,7 +6707,7 @@
  
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.5.10/policy/modules/kernel/devices.if
 --- nsaserefpolicy/policy/modules/kernel/devices.if	2008-08-07 11:15:01.000000000 -0400
-+++ serefpolicy-3.5.10/policy/modules/kernel/devices.if	2008-10-03 11:36:44.000000000 -0400
++++ serefpolicy-3.5.10/policy/modules/kernel/devices.if	2008-10-06 13:16:47.000000000 -0400
 @@ -65,7 +65,7 @@
  
  	relabelfrom_dirs_pattern($1, device_t, device_node)
@@ -6717,7 +6717,32 @@
  	relabelfrom_fifo_files_pattern($1, device_t, device_node)
  	relabelfrom_sock_files_pattern($1, device_t, device_node)
  	relabel_blk_files_pattern($1,device_t,{ device_t device_node })
-@@ -167,6 +167,25 @@
+@@ -148,6 +148,24 @@
+ 
+ ########################################
+ ## <summary>
++##	Del entries to directories in /dev.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed to add entries.
++##	</summary>
++## </param>
++#
++interface(`dev_del_entry_generic_dirs',`
++	gen_require(`
++		type device_t;
++	')
++
++	allow $1 device_t:dir del_entry_dir_perms;
++')
++
++########################################
++## <summary>
+ ##	Create a directory in the device directory.
+ ## </summary>
+ ## <param name="domain">
+@@ -167,6 +185,25 @@
  
  ########################################
  ## <summary>
@@ -6743,7 +6768,7 @@
  ##	Delete a directory in the device directory.
  ## </summary>
  ## <param name="domain">
-@@ -667,6 +686,7 @@
+@@ -667,6 +704,7 @@
  	')
  
  	dontaudit $1 device_node:blk_file getattr;
@@ -6751,7 +6776,7 @@
  ')
  
  ########################################
-@@ -704,6 +724,7 @@
+@@ -704,6 +742,7 @@
  	')
  
  	dontaudit $1 device_node:chr_file getattr;
@@ -6759,7 +6784,7 @@
  ')
  
  ########################################
-@@ -1160,6 +1181,25 @@
+@@ -1160,6 +1199,25 @@
  
  ########################################
  ## <summary>
@@ -6785,7 +6810,7 @@
  ##	Read the CPU identity.
  ## </summary>
  ## <param name="domain">
-@@ -1958,6 +1998,42 @@
+@@ -1958,6 +2016,42 @@
  
  ########################################
  ## <summary>
@@ -6828,7 +6853,7 @@
  ##	Read and write to the null device (/dev/null).
  ## </summary>
  ## <param name="domain">
-@@ -2769,6 +2845,24 @@
+@@ -2769,6 +2863,24 @@
  
  ########################################
  ## <summary>
@@ -6853,7 +6878,7 @@
  ##	Read and write generic the USB devices.
  ## </summary>
  ## <param name="domain">
-@@ -2787,6 +2881,97 @@
+@@ -2787,6 +2899,97 @@
  
  ########################################
  ## <summary>
@@ -6951,7 +6976,7 @@
  ##	Mount a usbfs filesystem.
  ## </summary>
  ## <param name="domain">
-@@ -3322,3 +3507,223 @@
+@@ -3322,3 +3525,223 @@
  
  	typeattribute $1 devices_unconfined_type;
  ')
@@ -8201,7 +8226,7 @@
 +')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.5.10/policy/modules/kernel/filesystem.te
 --- nsaserefpolicy/policy/modules/kernel/filesystem.te	2008-08-14 13:08:27.000000000 -0400
-+++ serefpolicy-3.5.10/policy/modules/kernel/filesystem.te	2008-10-03 11:36:44.000000000 -0400
++++ serefpolicy-3.5.10/policy/modules/kernel/filesystem.te	2008-10-06 14:17:31.000000000 -0400
 @@ -21,7 +21,6 @@
  
  # Use xattrs for the following filesystem types.
@@ -8222,7 +8247,15 @@
  type eventpollfs_t;
  fs_type(eventpollfs_t)
  # change to task SID 20060628
-@@ -241,6 +245,7 @@
+@@ -141,6 +145,7 @@
+ fs_noxattr_type(vmblock_t)
+ files_mountpoint(vmblock_t)
+ genfscon vmblock / gen_context(system_u:object_r:vmblock_t,s0)
++genfscon vboxsf / gen_context(system_u:object_r:vmblock_t,s0)
+ 
+ type vxfs_t;
+ fs_noxattr_type(vxfs_t)
+@@ -241,6 +246,7 @@
  genfscon lustre / gen_context(system_u:object_r:nfs_t,s0)
  genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0)
  genfscon panfs / gen_context(system_u:object_r:nfs_t,s0)
@@ -8320,7 +8353,7 @@
  	files_read_default_files(kernel_t)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.5.10/policy/modules/kernel/selinux.if
 --- nsaserefpolicy/policy/modules/kernel/selinux.if	2008-08-07 11:15:01.000000000 -0400
-+++ serefpolicy-3.5.10/policy/modules/kernel/selinux.if	2008-10-03 11:36:44.000000000 -0400
++++ serefpolicy-3.5.10/policy/modules/kernel/selinux.if	2008-10-06 13:08:30.000000000 -0400
 @@ -164,6 +164,7 @@
  		type security_t;
  	')
@@ -8660,8 +8693,8 @@
 +')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/guest.te serefpolicy-3.5.10/policy/modules/roles/guest.te
 --- nsaserefpolicy/policy/modules/roles/guest.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.5.10/policy/modules/roles/guest.te	2008-10-03 11:36:44.000000000 -0400
-@@ -0,0 +1,34 @@
++++ serefpolicy-3.5.10/policy/modules/roles/guest.te	2008-10-06 12:29:55.000000000 -0400
+@@ -0,0 +1,35 @@
 +
 +policy_module(guest, 1.0.0)
 +
@@ -8687,6 +8720,7 @@
 +	mono_per_role_template(guest, guest_t, guest_r)
 +')
 +
++
 +optional_policy(`
 +	gen_require(`
 +		type xguest_t;
@@ -18892,7 +18926,7 @@
  ## <param name="domain">
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.5.10/policy/modules/services/networkmanager.te
 --- nsaserefpolicy/policy/modules/services/networkmanager.te	2008-09-24 09:07:28.000000000 -0400
-+++ serefpolicy-3.5.10/policy/modules/services/networkmanager.te	2008-10-03 11:37:02.000000000 -0400
++++ serefpolicy-3.5.10/policy/modules/services/networkmanager.te	2008-10-06 12:42:23.000000000 -0400
 @@ -33,9 +33,9 @@
  
  # networkmanager will ptrace itself if gdb is installed
@@ -19033,12 +19067,12 @@
  ')
  
  optional_policy(`
-@@ -174,9 +208,18 @@
+@@ -174,9 +208,19 @@
  ')
  
  optional_policy(`
--	ppp_domtrans(NetworkManager_t)
 +	ppp_initrc_domtrans(NetworkManager_t)
+ 	ppp_domtrans(NetworkManager_t)
  	ppp_read_pid_files(NetworkManager_t)
 +	ppp_sigkill(NetworkManager_t)
  	ppp_signal(NetworkManager_t)
@@ -19053,7 +19087,7 @@
  ')
  
  optional_policy(`
-@@ -221,3 +264,28 @@
+@@ -221,3 +265,28 @@
  miscfiles_read_localization(wpa_cli_t)
  
  term_dontaudit_use_console(wpa_cli_t)
@@ -22900,15 +22934,24 @@
  	unconfined_shell_domtrans(rshd_t)
 +	unconfined_signal(rshd_t)
  ')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.fc serefpolicy-3.5.10/policy/modules/services/rsync.fc
+--- nsaserefpolicy/policy/modules/services/rsync.fc	2008-08-07 11:15:11.000000000 -0400
++++ serefpolicy-3.5.10/policy/modules/services/rsync.fc	2008-10-06 08:55:56.000000000 -0400
+@@ -3,4 +3,4 @@
+ 
+ /var/log/rsync\.log      --	gen_context(system_u:object_r:rsync_log_t,s0)
+ 
+-/var/run/rsyncd\.lock      --	gen_context(system_u:object_r:rsync_log_t,s0)
++/var/run/rsyncd\.lock      --	gen_context(system_u:object_r:rsync_var_run_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.5.10/policy/modules/services/rsync.te
 --- nsaserefpolicy/policy/modules/services/rsync.te	2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.10/policy/modules/services/rsync.te	2008-10-03 11:36:44.000000000 -0400
++++ serefpolicy-3.5.10/policy/modules/services/rsync.te	2008-10-06 12:50:44.000000000 -0400
 @@ -45,7 +45,7 @@
  # Local policy
  #
  
 -allow rsync_t self:capability { dac_read_search dac_override setuid setgid sys_chroot };
-+allow rsync_t self:capability { chown dac_read_search dac_override setuid setgid sys_chroot };
++allow rsync_t self:capability { chown dac_read_search dac_override fowner fsetid setuid setgid sys_chroot };
  allow rsync_t self:process signal_perms;
  allow rsync_t self:fifo_file rw_fifo_file_perms;
  allow rsync_t self:tcp_socket create_stream_socket_perms;
@@ -24232,7 +24275,7 @@
  ')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.5.10/policy/modules/services/smartmon.te
 --- nsaserefpolicy/policy/modules/services/smartmon.te	2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.10/policy/modules/services/smartmon.te	2008-10-03 11:36:44.000000000 -0400
++++ serefpolicy-3.5.10/policy/modules/services/smartmon.te	2008-10-06 13:16:57.000000000 -0400
 @@ -10,6 +10,9 @@
  type fsdaemon_exec_t;
  init_daemon_domain(fsdaemon_t, fsdaemon_exec_t)
@@ -24243,7 +24286,13 @@
  type fsdaemon_var_run_t;
  files_pid_file(fsdaemon_var_run_t)
  
-@@ -28,6 +31,7 @@
+@@ -23,11 +26,12 @@
+ 
+ allow fsdaemon_t self:capability { setgid sys_rawio sys_admin };
+ dontaudit fsdaemon_t self:capability sys_tty_config;
+-allow fsdaemon_t self:process signal_perms;
++allow fsdaemon_t self:process { signal_perms setfscreate };
+ allow fsdaemon_t self:fifo_file rw_fifo_file_perms;
  allow fsdaemon_t self:unix_dgram_socket create_socket_perms;
  allow fsdaemon_t self:unix_stream_socket create_stream_socket_perms;
  allow fsdaemon_t self:udp_socket create_socket_perms;
@@ -24271,6 +24320,17 @@
  sysadm_dontaudit_search_home_dirs(fsdaemon_t)
  
  optional_policy(`
+@@ -95,3 +99,10 @@
+ optional_policy(`
+ 	udev_read_db(fsdaemon_t)
+ ')
++
++dev_del_entry_generic_dirs(fsdaemon_t)
++storage_dev_filetrans_fixed_disk(fsdaemon_t)
++storage_manage_fixed_disk(fsdaemon_t)
++seutil_read_file_contexts(fsdaemon_t)
++selinux_validate_context(fsdaemon_t)
++
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-3.5.10/policy/modules/services/snmp.fc
 --- nsaserefpolicy/policy/modules/services/snmp.fc	2008-08-07 11:15:11.000000000 -0400
 +++ serefpolicy-3.5.10/policy/modules/services/snmp.fc	2008-10-03 11:36:44.000000000 -0400
@@ -26535,7 +26595,7 @@
  /var/lib/pam_devperm/:0	--	gen_context(system_u:object_r:xdm_var_lib_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.5.10/policy/modules/services/xserver.if
 --- nsaserefpolicy/policy/modules/services/xserver.if	2008-09-24 09:07:28.000000000 -0400
-+++ serefpolicy-3.5.10/policy/modules/services/xserver.if	2008-10-03 16:06:18.000000000 -0400
++++ serefpolicy-3.5.10/policy/modules/services/xserver.if	2008-10-06 12:32:14.000000000 -0400
 @@ -16,6 +16,7 @@
  	gen_require(`
  		type xkb_var_lib_t, xserver_exec_t, xserver_log_t;
@@ -26665,14 +26725,14 @@
 -	#
 -	# $1_xserver_t Local policy
 -	#
--
--	domtrans_pattern($1_xserver_t, xauth_exec_t, $1_xauth_t)
 +	allow $1_xserver_t xauth_home_t:file { getattr read };
  
--	allow $1_xserver_t $1_xauth_home_t:file { getattr read };
+-	domtrans_pattern($1_xserver_t, xauth_exec_t, $1_xauth_t)
 +	domtrans_pattern($1_xserver_t, xauth_exec_t, xauth_t)
 +	role $3 types xauth_t;
  
+-	allow $1_xserver_t $1_xauth_home_t:file { getattr read };
+-
 -	domtrans_pattern($2, xserver_exec_t, $1_xserver_t)
  	allow $1_xserver_t $2:process signal;
  
@@ -26740,15 +26800,15 @@
 -
 -	allow $1_xauth_t $1_xauth_home_t:file manage_file_perms;
 -	userdom_user_home_dir_filetrans($1, $1_xauth_t, $1_xauth_home_t,file)
--
++	domtrans_pattern($2, xauth_exec_t, xauth_t)
++	allow $2 xauth_t:process signal;
+ 
 -	manage_dirs_pattern($1_xauth_t, $1_xauth_tmp_t, $1_xauth_tmp_t)
 -	manage_files_pattern($1_xauth_t, $1_xauth_tmp_t, $1_xauth_tmp_t)
 -	files_tmp_filetrans($1_xauth_t, $1_xauth_tmp_t, { file dir })
 -
 -	domtrans_pattern($2, xauth_exec_t, $1_xauth_t)
-+	domtrans_pattern($2, xauth_exec_t, xauth_t)
-+	allow $2 xauth_t:process signal;
- 
+-
 -	allow $2 $1_xauth_t:process signal;
 +    	allow $2 xauth_home_t:file manage_file_perms;
 +	allow $2 xauth_home_t:file { relabelfrom relabelto };
@@ -26772,13 +26832,13 @@
 -
 -	# cjp: why?
 -	term_use_ptmx($1_xauth_t)
-+	ps_process_pattern($2,xauth_t)
- 
+-
 -	auth_use_nsswitch($1_xauth_t)
 -
 -	libs_use_ld_so($1_xauth_t)
 -	libs_use_shared_libs($1_xauth_t)
--
++	ps_process_pattern($2,xauth_t)
+ 
 -	userdom_use_user_terminals($1, $1_xauth_t)
 -	userdom_read_user_tmp_files($1, $1_xauth_t)
 -
@@ -26818,7 +26878,7 @@
 +	allow $2 iceauth_home_t:file { relabelfrom relabelto };
  
 -	allow xdm_t $1_iceauth_home_t:file read_file_perms;
-+	allow xdm_t iceauth_home_t:file read_file_perms;
++	xserver_use_xdm($2)
  
  	fs_search_auto_mountpoints($1_iceauth_t)
  
@@ -26879,7 +26939,7 @@
  
  	# for when /tmp/.X11-unix is created by the system
  	allow $2 xdm_t:fd use;
-@@ -643,11 +572,109 @@
+@@ -643,13 +572,208 @@
  
  	xserver_read_xdm_tmp_files($2)
  
@@ -26921,8 +26981,8 @@
 +		attribute x_domain;
 +		type $1_xserver_t;
 +#		type $2_input_xevent_t;
-+	')
-+
+ ')
+ 
 +	allow $1_xserver_t self:netlink_selinux_socket create_socket_perms;
 +
 +#	typeattribute $2_input_xevent_t $1_input_xevent_type;
@@ -26990,13 +27050,20 @@
 +
 +	allow $1_xserver_t input_xevent_t:x_event send;
 +	allow $1_xserver_t $1_rootwindow_t:x_drawable send;
- ')
- 
- #######################################
-@@ -662,6 +689,103 @@
- ##	is the prefix for user_t).
- ##	</summary>
- ## </param>
++')
++
++#######################################
++## <summary>
++##	Interface to provide X object permissions on a given X server to
++##	an X client domain.  Provides the minimal set required by a basic
++##	X client application.
++## </summary>
++## <param name="user">
++##	<summary>
++##	The prefix of the X server domain (e.g., user
++##	is the prefix for user_t).
++##	</summary>
++## </param>
 +## <param name="domain">
 +##	<summary>
 +##	Client domain allowed access.
@@ -27082,21 +27149,9 @@
 +')
 +
 +
-+#######################################
-+## <summary>
-+##	Interface to provide X object permissions on a given X server to
-+##	an X client domain.  Provides the minimal set required by a basic
-+##	X client application.
-+## </summary>
-+## <param name="user">
-+##	<summary>
-+##	The prefix of the X server domain (e.g., user
-+##	is the prefix for user_t).
-+##	</summary>
-+## </param>
- ## <param name="prefix">
- ##	<summary>
- ##	The prefix of the X client domain (e.g., user
+ #######################################
+ ## <summary>
+ ##	Interface to provide X object permissions on a given X server to
 @@ -676,7 +800,7 @@
  #
  template(`xserver_common_x_domain_template',`
@@ -27237,13 +27292,13 @@
  
  	tunable_policy(`! xserver_object_manager',`
  		# should be xserver_unconfined($3),
-@@ -879,17 +1007,17 @@
+@@ -879,24 +1007,17 @@
  #
  template(`xserver_user_x_domain_template',`
  	gen_require(`
 -		type xdm_t, xdm_tmp_t;
 -		type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t;
-+		type xdm_t, xdm_tmp_t, xdm_xproperty_t;
++		type xdm_xproperty_t;
 +		type xauth_home_t, iceauth_home_t;
  	')
  
@@ -27257,12 +27312,24 @@
  	# Read .Xauthority file
 -	allow $3 $1_xauth_home_t:file { getattr read };
 -	allow $3 $1_iceauth_home_t:file { getattr read };
+-
+-	# for when /tmp/.X11-unix is created by the system
+-	allow $3 xdm_t:fd use;
+-	allow $3 xdm_t:fifo_file { getattr read write ioctl };
+-	allow $3 xdm_tmp_t:dir search;
+-	allow $3 xdm_tmp_t:sock_file { read write };
+-	dontaudit $3 xdm_t:tcp_socket { read write };
 +	allow $3 xauth_home_t:file { getattr read };
 +	allow $3 iceauth_home_t:file { getattr read };
  
- 	# for when /tmp/.X11-unix is created by the system
- 	allow $3 xdm_t:fd use;
-@@ -916,11 +1044,9 @@
+ 	# Allow connections to X server.
+ 	files_search_tmp($3)
+@@ -911,16 +1032,11 @@
+ 	xserver_rw_session_template($1, $3, $4)
+ 	xserver_use_user_fonts($1, $3)
+ 
+-	xserver_read_xdm_tmp_files($3)
+-
  	# X object manager
  	xserver_common_x_domain_template($1, $2, $3)
  
@@ -27271,13 +27338,12 @@
 -		allow $3 $1_xserver_t:shm rw_shm_perms;
 -		allow $3 $1_xserver_tmpfs_t:file rw_file_perms;
 -	')
-+	allow $3 xdm_t:x_client { getattr destroy };
-+	allow $3 xdm_t:x_drawable { receive get_property getattr send list_child };
 +	allow $3 xdm_xproperty_t:x_property { write read };
++	xserver_use_xdm($3)
  ')
  
  ########################################
-@@ -952,26 +1078,43 @@
+@@ -952,26 +1068,43 @@
  #
  template(`xserver_use_user_fonts',`
  	gen_require(`
@@ -27328,15 +27394,14 @@
  ##	Transition to a user Xauthority domain.
  ## </summary>
  ## <desc>
-@@ -997,10 +1140,77 @@
+@@ -997,10 +1130,77 @@
  #
  template(`xserver_domtrans_user_xauth',`
  	gen_require(`
 -		type $1_xauth_t, xauth_exec_t;
 +		type xauth_t, xauth_exec_t;
- 	')
- 
--	domtrans_pattern($2, xauth_exec_t, $1_xauth_t)
++	')
++
 +	domtrans_pattern($2, xauth_exec_t, xauth_t)
 +')
 +
@@ -27368,8 +27433,9 @@
 +template(`xserver_read_user_xauth',`
 +	gen_require(`
 +		type xauth_home_t;
-+	')
-+
+ 	')
+ 
+-	domtrans_pattern($2, xauth_exec_t, $1_xauth_t)
 +	allow $2 xauth_home_t:file { getattr read };
 +')
 +
@@ -27408,7 +27474,7 @@
  ')
  
  ########################################
-@@ -1030,10 +1240,10 @@
+@@ -1030,10 +1230,10 @@
  #
  template(`xserver_user_home_dir_filetrans_user_xauth',`
  	gen_require(`
@@ -27421,7 +27487,7 @@
  ')
  
  ########################################
-@@ -1219,6 +1429,25 @@
+@@ -1219,6 +1419,25 @@
  
  ########################################
  ## <summary>
@@ -27447,7 +27513,7 @@
  ##	Read xdm-writable configuration files.
  ## </summary>
  ## <param name="domain">
-@@ -1273,6 +1502,7 @@
+@@ -1273,6 +1492,7 @@
  	files_search_tmp($1)
  	allow $1 xdm_tmp_t:dir list_dir_perms;
  	create_sock_files_pattern($1, xdm_tmp_t, xdm_tmp_t)
@@ -27455,7 +27521,7 @@
  ')
  
  ########################################
-@@ -1291,7 +1521,7 @@
+@@ -1291,7 +1511,7 @@
  	')
  
  	files_search_pids($1)
@@ -27464,7 +27530,7 @@
  ')
  
  ########################################
-@@ -1314,6 +1544,24 @@
+@@ -1314,6 +1534,24 @@
  
  ########################################
  ## <summary>
@@ -27489,7 +27555,7 @@
  ##	Execute the X server in the XDM X server domain.
  ## </summary>
  ## <param name="domain">
-@@ -1324,15 +1572,47 @@
+@@ -1324,15 +1562,47 @@
  #
  interface(`xserver_domtrans_xdm_xserver',`
  	gen_require(`
@@ -27538,7 +27604,7 @@
  ##	Make an X session script an entrypoint for the specified domain.
  ## </summary>
  ## <param name="domain">
-@@ -1482,7 +1762,7 @@
+@@ -1482,7 +1752,7 @@
  		type xdm_xserver_tmp_t;
  	')
  
@@ -27547,7 +27613,7 @@
  ')
  
  ########################################
-@@ -1674,6 +1954,26 @@
+@@ -1674,6 +1944,26 @@
  
  ########################################
  ## <summary>
@@ -27574,7 +27640,7 @@
  ##	xdm xserver RW shared memory socket.
  ## </summary>
  ## <param name="domain">
-@@ -1692,6 +1992,24 @@
+@@ -1692,6 +1982,24 @@
  
  ########################################
  ## <summary>
@@ -27599,7 +27665,7 @@
  ##	Interface to provide X object permissions on a given X server to
  ##	an X client domain.  Gives the domain complete control over the
  ##	display.
-@@ -1704,8 +2022,127 @@
+@@ -1704,8 +2012,157 @@
  #
  interface(`xserver_unconfined',`
  	gen_require(`
@@ -27663,15 +27729,14 @@
 +	gen_require(`
 +		type fonts_home_t;
 +		type fonts_config_home_t;
- 	')
- 
--	typeattribute $1 xserver_unconfined_type;
++	')
++
 +	manage_dirs_pattern($1, fonts_home_t, fonts_home_t)
 +	manage_files_pattern($1, fonts_home_t, fonts_home_t)
 +	manage_lnk_files_pattern($1, fonts_home_t, fonts_home_t)
 +
 +	manage_files_pattern($1, fonts_config_home_t, fonts_config_home_t)
- ')
++')
 +
 +########################################
 +## <summary>
@@ -27729,9 +27794,40 @@
 +	dontaudit $1 xdm_home_t:file rw_file_perms;
 +')
 +
++#######################################
++## <summary>
++##	Interface to provide X object permissions on a given X server to
++##	an X client domain.  Provides the minimal set required by a basic
++##	X client application.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Client domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`xserver_use_xdm',`
++	gen_require(`
++		type xdm_t, xdm_tmp_t;
+ 	')
+ 
+-	typeattribute $1 xserver_unconfined_type;
++	allow $1 xdm_t:fd use;
++	allow $1 xdm_t:fifo_file { getattr read write ioctl };
++	dontaudit $1 xdm_t:tcp_socket { read write };
++
++	# Allow connections to X server.
++	xserver_stream_connect_xdm($1)
++	xserver_read_xdm_tmp_files($1)
++	xserver_xdm_stream_connect($1)
++
++	allow $1 xdm_t:x_client { getattr destroy };
++	allow $1 xdm_t:x_drawable { read receive get_property getattr send list_child };
++	allow $1 xdm_xproperty_t:x_property { write read };
+ ')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.5.10/policy/modules/services/xserver.te
 --- nsaserefpolicy/policy/modules/services/xserver.te	2008-09-24 09:07:28.000000000 -0400
-+++ serefpolicy-3.5.10/policy/modules/services/xserver.te	2008-10-03 16:06:35.000000000 -0400
++++ serefpolicy-3.5.10/policy/modules/services/xserver.te	2008-10-06 12:03:23.000000000 -0400
 @@ -8,6 +8,14 @@
  
  ## <desc>
@@ -28278,7 +28374,7 @@
 +	ssh_dontaudit_rw_tcp_sockets(xauth_t)
 +')
 +
-+
++allow xdm_t iceauth_home_t:file read_file_perms;
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zabbix.fc serefpolicy-3.5.10/policy/modules/services/zabbix.fc
 --- nsaserefpolicy/policy/modules/services/zabbix.fc	2008-08-07 11:15:11.000000000 -0400
 +++ serefpolicy-3.5.10/policy/modules/services/zabbix.fc	2008-10-03 11:36:44.000000000 -0400
@@ -29538,7 +29634,7 @@
  allow iscsid_t self:unix_stream_socket { create_stream_socket_perms connectto };
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.5.10/policy/modules/system/libraries.fc
 --- nsaserefpolicy/policy/modules/system/libraries.fc	2008-08-13 15:24:56.000000000 -0400
-+++ serefpolicy-3.5.10/policy/modules/system/libraries.fc	2008-10-03 11:36:44.000000000 -0400
++++ serefpolicy-3.5.10/policy/modules/system/libraries.fc	2008-10-06 12:36:31.000000000 -0400
 @@ -60,12 +60,15 @@
  #
  # /opt
@@ -29618,7 +29714,7 @@
  ') dnl end distro_redhat
  
  #
-@@ -310,3 +321,13 @@
+@@ -310,3 +321,15 @@
  /var/spool/postfix/lib(64)?(/.*)? 		gen_context(system_u:object_r:lib_t,s0)
  /var/spool/postfix/usr(/.*)?			gen_context(system_u:object_r:lib_t,s0)
  /var/spool/postfix/lib(64)?/ld.*\.so.*	--	gen_context(system_u:object_r:ld_so_t,s0)
@@ -29632,6 +29728,8 @@
 +/usr/lib/oracle/.*/lib/libnnz10\.so --	gen_context(system_u:object_r:textrel_shlib_t,s0)
 +
 +/opt/novell/groupwise/client/lib/libgwapijni\.so\.1	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
++
++/usr/lib(64)?/libmpeg2\.so.*		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.5.10/policy/modules/system/libraries.te
 --- nsaserefpolicy/policy/modules/system/libraries.te	2008-08-13 15:24:56.000000000 -0400
 +++ serefpolicy-3.5.10/policy/modules/system/libraries.te	2008-10-03 11:36:44.000000000 -0400


Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.719
retrieving revision 1.720
diff -u -r1.719 -r1.720
--- selinux-policy.spec	3 Oct 2008 20:11:22 -0000	1.719
+++ selinux-policy.spec	6 Oct 2008 19:10:48 -0000	1.720
@@ -17,7 +17,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.5.10
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -390,6 +390,9 @@
 %endif
 
 %changelog
+* Mon Oct 6 2008 Dan Walsh <dwalsh at redhat.com> 3.5.10-3
+- Fixes for confined xwindows and xdm_t 
+
 * Fri Oct 3 2008 Dan Walsh <dwalsh at redhat.com> 3.5.10-2
 - Allow confined users and xdm to exec wm
 - Allow nsplugin to talk to fifo files on nfs

More information about the scm-commits mailing list