rpms/selinux-policy/F-11 policy-20090105.patch, 1.92, 1.93 selinux-policy.spec, 1.828, 1.829

[Daniel J Walsh]

Author: dwalsh

Update of /cvs/extras/rpms/selinux-policy/F-11
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv6115

Modified Files:
	policy-20090105.patch selinux-policy.spec 
Log Message:
* Sat Apr 18 2009 Dan Walsh <dwalsh at redhat.com> 3.6.12-8
- Fixes for podsleuth


policy-20090105.patch:

Index: policy-20090105.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-11/policy-20090105.patch,v
retrieving revision 1.92
retrieving revision 1.93
diff -u -r1.92 -r1.93
--- policy-20090105.patch	17 Apr 2009 15:33:53 -0000	1.92
+++ policy-20090105.patch	18 Apr 2009 10:33:57 -0000	1.93
@@ -3463,8 +3463,8 @@
 +
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/podsleuth.te serefpolicy-3.6.12/policy/modules/apps/podsleuth.te
 --- nsaserefpolicy/policy/modules/apps/podsleuth.te	2009-01-05 15:39:38.000000000 -0500
-+++ serefpolicy-3.6.12/policy/modules/apps/podsleuth.te	2009-04-07 16:01:44.000000000 -0400
-@@ -11,21 +11,68 @@
++++ serefpolicy-3.6.12/policy/modules/apps/podsleuth.te	2009-04-18 06:04:47.000000000 -0400
+@@ -11,25 +11,80 @@
  application_domain(podsleuth_t, podsleuth_exec_t)
  role system_r types podsleuth_t;
  
@@ -3484,7 +3484,7 @@
  #
 -
 -allow podsleuth_t self:process { signal getsched execheap execmem };
-+allow podsleuth_t self:capability { sys_admin sys_rawio };
++allow podsleuth_t self:capability { kill dac_override sys_admin sys_rawio };
 +allow podsleuth_t self:process { ptrace signal getsched execheap execmem execstack };
  allow podsleuth_t self:fifo_file rw_file_perms;
  allow podsleuth_t self:unix_stream_socket create_stream_socket_perms;
@@ -3534,7 +3534,21 @@
 +
  miscfiles_read_localization(podsleuth_t)
  
- dbus_system_bus_client(podsleuth_t)
+-dbus_system_bus_client(podsleuth_t)
++userdom_signal_all_users(podsleuth_t)
+ 
+-mono_exec(podsleuth_t)
++optional_policy(`
++	dbus_system_bus_client(podsleuth_t)
++')
+ 
++optional_policy(`
+ hal_dbus_chat(podsleuth_t)
++')
++
++optional_policy(`
++	mono_exec(podsleuth_t)
++')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.fc serefpolicy-3.6.12/policy/modules/apps/pulseaudio.fc
 --- nsaserefpolicy/policy/modules/apps/pulseaudio.fc	1969-12-31 19:00:00.000000000 -0500
 +++ serefpolicy-3.6.12/policy/modules/apps/pulseaudio.fc	2009-04-07 16:01:44.000000000 -0400
@@ -4924,7 +4938,7 @@
  type urandom_device_t;
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.6.12/policy/modules/kernel/domain.if
 --- nsaserefpolicy/policy/modules/kernel/domain.if	2009-01-05 15:39:38.000000000 -0500
-+++ serefpolicy-3.6.12/policy/modules/kernel/domain.if	2009-04-15 08:01:57.000000000 -0400
++++ serefpolicy-3.6.12/policy/modules/kernel/domain.if	2009-04-18 06:12:57.000000000 -0400
 @@ -525,7 +525,7 @@
  	')
  
@@ -6553,7 +6567,7 @@
 +
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.if serefpolicy-3.6.12/policy/modules/roles/unconfineduser.if
 --- nsaserefpolicy/policy/modules/roles/unconfineduser.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.12/policy/modules/roles/unconfineduser.if	2009-04-17 11:03:25.000000000 -0400
++++ serefpolicy-3.6.12/policy/modules/roles/unconfineduser.if	2009-04-18 06:06:56.000000000 -0400
 @@ -0,0 +1,638 @@
 +## <summary>Unconfiend user role</summary>
 +
@@ -25505,7 +25519,7 @@
 +')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.6.12/policy/modules/system/init.te
 --- nsaserefpolicy/policy/modules/system/init.te	2009-01-19 11:07:34.000000000 -0500
-+++ serefpolicy-3.6.12/policy/modules/system/init.te	2009-04-17 11:04:04.000000000 -0400
++++ serefpolicy-3.6.12/policy/modules/system/init.te	2009-04-17 11:41:15.000000000 -0400
 @@ -17,6 +17,20 @@
  ## </desc>
  gen_tunable(init_upstart,false)
@@ -29147,7 +29161,7 @@
 +/dev/shm/mono.*		gen_context(system_u:object_r:user_tmpfs_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.12/policy/modules/system/userdomain.if
 --- nsaserefpolicy/policy/modules/system/userdomain.if	2009-01-19 11:07:34.000000000 -0500
-+++ serefpolicy-3.6.12/policy/modules/system/userdomain.if	2009-04-17 11:03:40.000000000 -0400
++++ serefpolicy-3.6.12/policy/modules/system/userdomain.if	2009-04-18 06:14:35.000000000 -0400
 @@ -30,8 +30,9 @@
  	')
  
@@ -30554,7 +30568,7 @@
  	kernel_search_proc($1)
  ')
  
-@@ -2981,3 +3187,482 @@
+@@ -2981,3 +3187,481 @@
  
  	allow $1 userdomain:dbus send_msg;
  ')
@@ -31036,7 +31050,6 @@
 +
 +	dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
 +')
-+
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.6.12/policy/modules/system/userdomain.te
 --- nsaserefpolicy/policy/modules/system/userdomain.te	2009-01-19 11:07:34.000000000 -0500
 +++ serefpolicy-3.6.12/policy/modules/system/userdomain.te	2009-04-07 16:01:44.000000000 -0400


Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-11/selinux-policy.spec,v
retrieving revision 1.828
retrieving revision 1.829
diff -u -r1.828 -r1.829
--- selinux-policy.spec	17 Apr 2009 15:14:43 -0000	1.828
+++ selinux-policy.spec	18 Apr 2009 10:33:58 -0000	1.829
@@ -20,7 +20,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.6.12
-Release: 7%{?dist}
+Release: 8%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -446,6 +446,9 @@
 %endif
 
 %changelog
+* Sat Apr 18 2009 Dan Walsh <dwalsh at redhat.com> 3.6.12-8
+- Fixes for podsleuth
+
 * Fri Apr 17 2009 Dan Walsh <dwalsh at redhat.com> 3.6.12-7
 - Turn off nsplugin transition
 - Remove Konsole leaked file descriptors for release