rpms/selinux-policy/devel policy-20080710.patch, 1.71, 1.72 selinux-policy.spec, 1.730, 1.731
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 23 12:54:29 UTC 2008
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv5936
Modified Files:
policy-20080710.patch selinux-policy.spec
Log Message:
* Wed Oct 22 2008 Dan Walsh <dwalsh at redhat.com> 3.5.13-5
- Allow kerneloops to create tmp files
policy-20080710.patch:
Index: policy-20080710.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20080710.patch,v
retrieving revision 1.71
retrieving revision 1.72
diff -u -r1.71 -r1.72
--- policy-20080710.patch 22 Oct 2008 15:42:16 -0000 1.71
+++ policy-20080710.patch 23 Oct 2008 12:54:29 -0000 1.72
@@ -6168,8 +6168,16 @@
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.5.13/policy/modules/kernel/corenetwork.te.in
--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2008-10-14 11:58:07.000000000 -0400
-+++ serefpolicy-3.5.13/policy/modules/kernel/corenetwork.te.in 2008-10-17 10:31:26.000000000 -0400
-@@ -93,6 +93,7 @@
++++ serefpolicy-3.5.13/policy/modules/kernel/corenetwork.te.in 2008-10-23 08:53:02.000000000 -0400
+@@ -79,6 +79,7 @@
+ network_port(auth, tcp,113,s0)
+ network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0)
+ type biff_port_t, port_type, reserved_port_type; dnl network_port(biff) # no defined portcon in current strict
++network_port(certmaster, tcp,51235,s0)
+ network_port(clamd, tcp,3310,s0)
+ network_port(clockspeed, udp,4041,s0)
+ network_port(cluster, tcp,5149,s0, udp,5149,s0, tcp,40040,s0, tcp,50006,s0, udp,50006,s0, tcp,50007,s0, udp,50007,s0, tcp,50008,s0, udp,50008,s0)
+@@ -93,6 +94,7 @@
network_port(distccd, tcp,3632,s0)
network_port(dns, udp,53,s0, tcp,53,s0)
network_port(fingerd, tcp,79,s0)
@@ -6177,7 +6185,7 @@
network_port(ftp_data, tcp,20,s0)
network_port(ftp, tcp,21,s0)
network_port(gatekeeper, udp,1718,s0, udp,1719,s0, tcp,1721,s0, tcp,7000,s0)
-@@ -117,6 +118,8 @@
+@@ -117,6 +119,8 @@
network_port(kerberos_admin, tcp,464,s0, udp,464,s0, tcp,749,s0)
network_port(kerberos_master, tcp,4444,s0, udp,4444,s0)
network_port(kerberos, tcp,88,s0, udp,88,s0, tcp,750,s0, udp,750,s0)
@@ -6186,7 +6194,7 @@
network_port(ktalkd, udp,517,s0, udp,518,s0)
network_port(ldap, tcp,389,s0, udp,389,s0, tcp,636,s0, udp,636,s0, tcp,3268,s0)
type lrrd_port_t, port_type; dnl network_port(lrrd_port_t) # no defined portcon
-@@ -126,6 +129,7 @@
+@@ -126,6 +130,7 @@
network_port(mmcc, tcp,5050,s0, udp,5050,s0)
network_port(monopd, tcp,1234,s0)
network_port(msnp, tcp,1863,s0, udp,1863,s0)
@@ -6194,7 +6202,7 @@
network_port(mysqld, tcp,1186,s0, tcp,3306,s0)
portcon tcp 63132-63163 gen_context(system_u:object_r:mysqld_port_t, s0)
network_port(nessus, tcp,1241,s0)
-@@ -137,11 +141,13 @@
+@@ -137,11 +142,13 @@
network_port(pegasus_http, tcp,5988,s0)
network_port(pegasus_https, tcp,5989,s0)
network_port(postfix_policyd, tcp,10031,s0)
@@ -6208,7 +6216,7 @@
network_port(printer, tcp,515,s0)
network_port(ptal, tcp,5703,s0)
network_port(pxe, udp,4011,s0)
-@@ -159,9 +165,10 @@
+@@ -159,9 +166,10 @@
network_port(rwho, udp,513,s0)
network_port(smbd, tcp,137-139,s0, tcp,445,s0)
network_port(smtp, tcp,25,s0, tcp,465,s0, tcp,587,s0)
@@ -6220,7 +6228,7 @@
network_port(soundd, tcp,8000,s0, tcp,9433,s0, tcp, 16001, s0)
type socks_port_t, port_type; dnl network_port(socks) # no defined portcon
type stunnel_port_t, port_type; dnl network_port(stunnel) # no defined portcon in current strict
-@@ -170,13 +177,16 @@
+@@ -170,13 +178,16 @@
network_port(syslogd, udp,514,s0)
network_port(telnetd, tcp,23,s0)
network_port(tftp, udp,69,s0)
@@ -8480,8 +8488,8 @@
+logging_admin(logadm_t, logadm_r, { logadm_devpts_t logadm_tty_device_t })
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.te serefpolicy-3.5.13/policy/modules/roles/staff.te
--- nsaserefpolicy/policy/modules/roles/staff.te 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.13/policy/modules/roles/staff.te 2008-10-17 10:31:27.000000000 -0400
-@@ -8,23 +8,55 @@
++++ serefpolicy-3.5.13/policy/modules/roles/staff.te 2008-10-22 16:47:01.000000000 -0400
+@@ -8,23 +8,59 @@
role staff_r;
@@ -8507,6 +8515,10 @@
')
optional_policy(`
++ kerneloops_manage_tmp_files(staff_t)
++')
++
++optional_policy(`
+ logadm_role_change_template(staff)
+')
+
@@ -10545,7 +10557,7 @@
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.5.13/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2008-10-16 17:21:16.000000000 -0400
-+++ serefpolicy-3.5.13/policy/modules/services/apache.te 2008-10-22 09:53:30.000000000 -0400
++++ serefpolicy-3.5.13/policy/modules/services/apache.te 2008-10-22 14:38:49.000000000 -0400
@@ -20,6 +20,8 @@
# Declarations
#
@@ -10689,7 +10701,15 @@
manage_dirs_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
manage_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
-@@ -289,6 +338,7 @@
+@@ -278,6 +327,7 @@
+ manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t)
+ files_var_lib_filetrans(httpd_t, httpd_var_lib_t, file)
+
++setattr_dir_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
+ manage_files_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
+ manage_sock_files_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
+ files_pid_filetrans(httpd_t, httpd_var_run_t, { file sock_file })
+@@ -289,6 +339,7 @@
kernel_read_kernel_sysctls(httpd_t)
# for modules that want to access /proc/meminfo
kernel_read_system_state(httpd_t)
@@ -10697,7 +10717,7 @@
corenet_all_recvfrom_unlabeled(httpd_t)
corenet_all_recvfrom_netlabel(httpd_t)
-@@ -299,6 +349,7 @@
+@@ -299,6 +350,7 @@
corenet_tcp_sendrecv_all_ports(httpd_t)
corenet_udp_sendrecv_all_ports(httpd_t)
corenet_tcp_bind_all_nodes(httpd_t)
@@ -10705,7 +10725,7 @@
corenet_tcp_bind_http_port(httpd_t)
corenet_tcp_bind_http_cache_port(httpd_t)
corenet_sendrecv_http_server_packets(httpd_t)
-@@ -312,12 +363,11 @@
+@@ -312,12 +364,11 @@
fs_getattr_all_fs(httpd_t)
fs_search_auto_mountpoints(httpd_t)
@@ -10720,7 +10740,7 @@
domain_use_interactive_fds(httpd_t)
-@@ -335,6 +385,10 @@
+@@ -335,6 +386,10 @@
files_read_var_lib_symlinks(httpd_t)
fs_search_auto_mountpoints(httpd_sys_script_t)
@@ -10731,7 +10751,7 @@
libs_use_ld_so(httpd_t)
libs_use_shared_libs(httpd_t)
-@@ -351,18 +405,33 @@
+@@ -351,18 +406,33 @@
userdom_use_unpriv_users_fds(httpd_t)
@@ -10769,7 +10789,7 @@
')
')
-@@ -370,20 +439,45 @@
+@@ -370,20 +440,45 @@
corenet_tcp_connect_all_ports(httpd_t)
')
@@ -10816,7 +10836,7 @@
manage_dirs_pattern(httpd_t, httpdcontent, httpdcontent)
manage_files_pattern(httpd_t, httpdcontent, httpdcontent)
-@@ -394,11 +488,12 @@
+@@ -394,11 +489,12 @@
corenet_tcp_bind_ftp_port(httpd_t)
')
@@ -10832,7 +10852,7 @@
fs_read_nfs_files(httpd_t)
fs_read_nfs_symlinks(httpd_t)
')
-@@ -408,6 +503,11 @@
+@@ -408,6 +504,11 @@
fs_read_cifs_symlinks(httpd_t)
')
@@ -10844,7 +10864,7 @@
tunable_policy(`httpd_ssi_exec',`
corecmd_shell_domtrans(httpd_t,httpd_sys_script_t)
allow httpd_sys_script_t httpd_t:fd use;
-@@ -441,8 +541,13 @@
+@@ -441,8 +542,13 @@
')
optional_policy(`
@@ -10860,7 +10880,7 @@
')
optional_policy(`
-@@ -454,18 +559,13 @@
+@@ -454,18 +560,13 @@
')
optional_policy(`
@@ -10880,7 +10900,7 @@
')
optional_policy(`
-@@ -475,6 +575,12 @@
+@@ -475,6 +576,12 @@
openca_kill(httpd_t)
')
@@ -10893,7 +10913,7 @@
optional_policy(`
# Allow httpd to work with postgresql
postgresql_stream_connect(httpd_t)
-@@ -482,6 +588,7 @@
+@@ -482,6 +589,7 @@
tunable_policy(`httpd_can_network_connect_db',`
postgresql_tcp_connect(httpd_t)
@@ -10901,7 +10921,7 @@
')
')
-@@ -490,6 +597,7 @@
+@@ -490,6 +598,7 @@
')
optional_policy(`
@@ -10909,7 +10929,7 @@
snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
')
-@@ -519,9 +627,28 @@
+@@ -519,9 +628,28 @@
logging_send_syslog_msg(httpd_helper_t)
tunable_policy(`httpd_tty_comm',`
@@ -10938,7 +10958,7 @@
########################################
#
# Apache PHP script local policy
-@@ -551,22 +678,27 @@
+@@ -551,22 +679,27 @@
fs_search_auto_mountpoints(httpd_php_t)
@@ -10972,7 +10992,7 @@
')
########################################
-@@ -584,12 +716,14 @@
+@@ -584,12 +717,14 @@
append_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
read_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
@@ -10988,7 +11008,7 @@
kernel_read_kernel_sysctls(httpd_suexec_t)
kernel_list_proc(httpd_suexec_t)
kernel_read_proc_symlinks(httpd_suexec_t)
-@@ -598,9 +732,7 @@
+@@ -598,9 +733,7 @@
fs_search_auto_mountpoints(httpd_suexec_t)
@@ -10999,7 +11019,7 @@
files_read_etc_files(httpd_suexec_t)
files_read_usr_files(httpd_suexec_t)
-@@ -633,12 +765,25 @@
+@@ -633,12 +766,25 @@
corenet_sendrecv_all_client_packets(httpd_suexec_t)
')
@@ -11028,7 +11048,7 @@
')
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -647,6 +792,12 @@
+@@ -647,6 +793,12 @@
fs_exec_nfs_files(httpd_suexec_t)
')
@@ -11041,7 +11061,7 @@
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_suexec_t)
fs_read_cifs_symlinks(httpd_suexec_t)
-@@ -664,10 +815,6 @@
+@@ -664,20 +816,20 @@
dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
')
@@ -11052,7 +11072,12 @@
########################################
#
# Apache system script local policy
-@@ -677,7 +824,8 @@
+ #
+
++auth_use_nsswitch(httpd_sys_script_t)
++
++allow httpd_sys_script_t httpd_t:unix_stream_socket rw_stream_socket_perms;
+ allow httpd_sys_script_t httpd_t:tcp_socket { read write };
dontaudit httpd_sys_script_t httpd_config_t:dir search;
@@ -11062,7 +11087,7 @@
allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms;
read_files_pattern(httpd_sys_script_t, squirrelmail_spool_t, squirrelmail_spool_t)
-@@ -691,12 +839,15 @@
+@@ -691,12 +843,15 @@
# Should we add a boolean?
apache_domtrans_rotatelogs(httpd_sys_script_t)
@@ -11080,7 +11105,7 @@
')
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -704,6 +855,30 @@
+@@ -704,6 +859,30 @@
fs_read_nfs_symlinks(httpd_sys_script_t)
')
@@ -11111,7 +11136,7 @@
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_sys_script_t)
fs_read_cifs_symlinks(httpd_sys_script_t)
-@@ -716,10 +891,10 @@
+@@ -716,10 +895,10 @@
optional_policy(`
mysql_stream_connect(httpd_sys_script_t)
mysql_rw_db_sockets(httpd_sys_script_t)
@@ -11126,7 +11151,7 @@
')
########################################
-@@ -727,6 +902,8 @@
+@@ -727,6 +906,8 @@
# httpd_rotatelogs local policy
#
@@ -11135,7 +11160,7 @@
manage_files_pattern(httpd_rotatelogs_t, httpd_log_t, httpd_log_t)
kernel_read_kernel_sysctls(httpd_rotatelogs_t)
-@@ -741,3 +918,66 @@
+@@ -741,3 +922,66 @@
logging_search_logs(httpd_rotatelogs_t)
miscfiles_read_localization(httpd_rotatelogs_t)
@@ -14928,7 +14953,7 @@
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.if serefpolicy-3.5.13/policy/modules/services/exim.if
--- nsaserefpolicy/policy/modules/services/exim.if 2008-08-07 11:15:11.000000000 -0400
-+++ serefpolicy-3.5.13/policy/modules/services/exim.if 2008-10-17 10:31:27.000000000 -0400
++++ serefpolicy-3.5.13/policy/modules/services/exim.if 2008-10-22 16:44:31.000000000 -0400
@@ -97,6 +97,26 @@
########################################
@@ -15695,6 +15720,74 @@
dev_read_urand(kpropd_t)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.if serefpolicy-3.5.13/policy/modules/services/kerneloops.if
+--- nsaserefpolicy/policy/modules/services/kerneloops.if 2008-10-14 11:58:09.000000000 -0400
++++ serefpolicy-3.5.13/policy/modules/services/kerneloops.if 2008-10-22 16:51:11.000000000 -0400
+@@ -63,6 +63,25 @@
+
+ ########################################
+ ## <summary>
++## Allow domain to manage kerneloops tmp files
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
++interface(`kerneloops_manage_tmp_files',`
++ gen_require(`
++ type kerneloops_tmp_t;
++ ')
++
++ manage_files_pattern($1, kerneloops_tmp_t, kerneloops_tmp_t)
++ files_search_tmp($1)
++')
++
++########################################
++## <summary>
+ ## All of the rules required to administrate
+ ## an kerneloops environment
+ ## </summary>
+@@ -81,6 +100,7 @@
+ interface(`kerneloops_admin',`
+ gen_require(`
+ type kerneloops_t, kerneloops_initrc_exec_t;
++ type kerneloops_tmp_t;
+ ')
+
+ allow $1 kerneloops_t:process { ptrace signal_perms };
+@@ -90,4 +110,7 @@
+ domain_system_change_exemption($1)
+ role_transition $2 kerneloops_initrc_exec_t system_r;
+ allow $2 system_r;
++
++ admin_pattern($1, kerneloops_tmp_t)
+ ')
++
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerneloops.te serefpolicy-3.5.13/policy/modules/services/kerneloops.te
+--- nsaserefpolicy/policy/modules/services/kerneloops.te 2008-10-14 11:58:09.000000000 -0400
++++ serefpolicy-3.5.13/policy/modules/services/kerneloops.te 2008-10-22 16:49:44.000000000 -0400
+@@ -13,6 +13,9 @@
+ type kerneloops_initrc_exec_t;
+ init_script_file(kerneloops_initrc_exec_t)
+
++type kerneloops_tmp_t;
++files_tmp_file(kerneloops_tmp_t)
++
+ ########################################
+ #
+ # kerneloops local policy
+@@ -23,6 +26,9 @@
+ allow kerneloops_t self:fifo_file rw_file_perms;
+ allow kerneloops_t self:netlink_route_socket r_netlink_socket_perms;
+
++manage_files_pattern(kerneloops_t, kerneloops_tmp_t, kerneloops_tmp_t)
++files_tmp_filetrans(kerneloops_t,kerneloops_tmp_t,file)
++
+ kernel_read_ring_buffer(kerneloops_t)
+
+ # Init script handling
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.te serefpolicy-3.5.13/policy/modules/services/ldap.te
--- nsaserefpolicy/policy/modules/services/ldap.te 2008-10-16 17:21:16.000000000 -0400
+++ serefpolicy-3.5.13/policy/modules/services/ldap.te 2008-10-17 10:31:27.000000000 -0400
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.730
retrieving revision 1.731
diff -u -r1.730 -r1.731
--- selinux-policy.spec 22 Oct 2008 13:34:13 -0000 1.730
+++ selinux-policy.spec 23 Oct 2008 12:54:29 -0000 1.731
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.5.13
-Release: 4%{?dist}
+Release: 5%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -462,6 +462,9 @@
%endif
%changelog
+* Wed Oct 22 2008 Dan Walsh <dwalsh at redhat.com> 3.5.13-5
+- Allow kerneloops to create tmp files
+
* Wed Oct 22 2008 Dan Walsh <dwalsh at redhat.com> 3.5.13-4
- More alias for fastcgi
More information about the scm-commits
mailing list