rpms/selinux-policy/devel policy-F12.patch,1.59,1.60
Daniel J Walsh
dwalsh at fedoraproject.org
Sun Aug 23 17:39:52 UTC 2009
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv28917
Modified Files:
policy-F12.patch
Log Message:
* Sat Aug 22 2009 Dan Walsh <dwalsh at redhat.com> 3.6.28-6
- Add capability setting to dhcpc and gpm
policy-F12.patch:
Makefile | 22
Rules.modular | 8
config/appconfig-mcs/default_contexts | 19
config/appconfig-mcs/failsafe_context | 2
config/appconfig-mcs/root_default_contexts | 8
config/appconfig-mcs/securetty_types | 5
config/appconfig-mcs/seusers | 4
config/appconfig-mcs/staff_u_default_contexts | 4
config/appconfig-mcs/unconfined_u_default_contexts | 4
config/appconfig-mcs/user_u_default_contexts | 5
config/appconfig-mcs/userhelper_context | 2
config/appconfig-mcs/virtual_domain_context | 1
config/appconfig-mcs/virtual_image_context | 2
config/appconfig-mls/default_contexts | 19
config/appconfig-mls/root_default_contexts | 12
config/appconfig-mls/virtual_domain_context | 1
config/appconfig-mls/virtual_image_context | 2
config/appconfig-standard/securetty_types | 5
man/man8/rsync_selinux.8 | 18
man/man8/samba_selinux.8 | 4
policy/flask/access_vectors | 2
policy/global_tunables | 24
policy/mcs | 10
policy/modules/admin/anaconda.te | 3
policy/modules/admin/certwatch.te | 1
policy/modules/admin/dmesg.fc | 2
policy/modules/admin/dmesg.te | 7
policy/modules/admin/kismet.if | 1
policy/modules/admin/kismet.te | 17
policy/modules/admin/logrotate.te | 13
policy/modules/admin/logwatch.te | 1
policy/modules/admin/mrtg.te | 7
policy/modules/admin/portage.te | 2
policy/modules/admin/prelink.if | 19
policy/modules/admin/readahead.te | 3
policy/modules/admin/rpm.fc | 16
policy/modules/admin/rpm.if | 176 ++
policy/modules/admin/rpm.te | 65 -
policy/modules/admin/smoltclient.fc | 4
policy/modules/admin/smoltclient.if | 1
policy/modules/admin/smoltclient.te | 66 +
policy/modules/admin/sudo.if | 41
policy/modules/admin/tmpreaper.te | 4
policy/modules/admin/usermanage.te | 25
policy/modules/admin/vbetool.te | 14
policy/modules/apps/awstats.te | 4
policy/modules/apps/calamaris.te | 4
policy/modules/apps/cpufreqselector.te | 4
policy/modules/apps/gitosis.fc | 4
policy/modules/apps/gitosis.if | 96 +
policy/modules/apps/gitosis.te | 36
policy/modules/apps/gnome.fc | 12
policy/modules/apps/gnome.if | 170 ++
policy/modules/apps/gnome.te | 92 +
policy/modules/apps/gpg.if | 2
policy/modules/apps/gpg.te | 16
policy/modules/apps/java.fc | 17
policy/modules/apps/java.if | 111 +
policy/modules/apps/java.te | 12
policy/modules/apps/kdumpgui.fc | 2
policy/modules/apps/kdumpgui.if | 2
policy/modules/apps/kdumpgui.te | 64
policy/modules/apps/livecd.fc | 2
policy/modules/apps/livecd.if | 50
policy/modules/apps/livecd.te | 26
policy/modules/apps/mono.if | 101 +
policy/modules/apps/mono.te | 9
policy/modules/apps/mozilla.fc | 1
policy/modules/apps/mozilla.if | 13
policy/modules/apps/mozilla.te | 21
policy/modules/apps/nsplugin.fc | 12
policy/modules/apps/nsplugin.if | 313 ++++
policy/modules/apps/nsplugin.te | 288 ++++
policy/modules/apps/openoffice.fc | 3
policy/modules/apps/openoffice.if | 93 +
policy/modules/apps/openoffice.te | 14
policy/modules/apps/ptchown.fc | 2
policy/modules/apps/ptchown.if | 22
policy/modules/apps/ptchown.te | 39
policy/modules/apps/pulseaudio.te | 16
policy/modules/apps/qemu.fc | 4
policy/modules/apps/qemu.if | 270 ++--
policy/modules/apps/qemu.te | 82 +
policy/modules/apps/sambagui.fc | 1
policy/modules/apps/sambagui.if | 2
policy/modules/apps/sambagui.te | 55
policy/modules/apps/sandbox.fc | 1
policy/modules/apps/sandbox.if | 143 ++
policy/modules/apps/sandbox.te | 274 ++++
policy/modules/apps/screen.if | 24
policy/modules/apps/vmware.fc | 1
policy/modules/apps/vmware.te | 1
policy/modules/apps/webalizer.te | 1
policy/modules/apps/wine.fc | 23
policy/modules/apps/wine.if | 60
policy/modules/apps/wine.te | 23
policy/modules/kernel/corecommands.fc | 23
policy/modules/kernel/corecommands.if | 1
policy/modules/kernel/corenetwork.te.in | 29
policy/modules/kernel/devices.fc | 5
policy/modules/kernel/devices.if | 164 ++
policy/modules/kernel/devices.te | 19
policy/modules/kernel/domain.if | 132 +-
policy/modules/kernel/domain.te | 87 +
policy/modules/kernel/files.fc | 3
policy/modules/kernel/files.if | 298 ++++
policy/modules/kernel/files.te | 6
policy/modules/kernel/filesystem.fc | 2
policy/modules/kernel/filesystem.if | 155 ++
policy/modules/kernel/filesystem.te | 8
policy/modules/kernel/kernel.if | 39
policy/modules/kernel/kernel.te | 29
policy/modules/kernel/selinux.if | 25
policy/modules/kernel/terminal.fc | 1
policy/modules/kernel/terminal.if | 40
policy/modules/kernel/terminal.te | 1
policy/modules/roles/guest.te | 8
policy/modules/roles/staff.te | 124 -
policy/modules/roles/sysadm.te | 124 -
policy/modules/roles/unconfineduser.fc | 37
policy/modules/roles/unconfineduser.if | 638 +++++++++
policy/modules/roles/unconfineduser.te | 391 ++++++
policy/modules/roles/unprivuser.te | 131 --
policy/modules/roles/xguest.te | 18
policy/modules/services/abrt.fc | 13
policy/modules/services/abrt.if | 126 +
policy/modules/services/abrt.te | 124 +
policy/modules/services/amavis.te | 2
policy/modules/services/apache.fc | 35
policy/modules/services/apache.if | 327 +++--
policy/modules/services/apache.te | 409 +++++-
policy/modules/services/apm.te | 2
policy/modules/services/automount.te | 1
policy/modules/services/bind.if | 40
policy/modules/services/bluetooth.te | 8
policy/modules/services/certmaster.te | 2
policy/modules/services/clamav.te | 12
policy/modules/services/consolekit.if | 39
policy/modules/services/consolekit.te | 18
policy/modules/services/courier.if | 18
policy/modules/services/courier.te | 1
policy/modules/services/cron.fc | 13
policy/modules/services/cron.if | 202 ++-
policy/modules/services/cron.te | 149 +-
policy/modules/services/cups.fc | 13
policy/modules/services/cups.te | 28
policy/modules/services/cvs.te | 1
policy/modules/services/dbus.fc | 5
policy/modules/services/dbus.if | 49
policy/modules/services/dbus.te | 25
policy/modules/services/dcc.te | 8
policy/modules/services/ddclient.if | 25
policy/modules/services/devicekit.fc | 2
policy/modules/services/devicekit.if | 22
policy/modules/services/devicekit.te | 50
policy/modules/services/dnsmasq.te | 8
policy/modules/services/dovecot.te | 7
policy/modules/services/exim.te | 4
policy/modules/services/fetchmail.te | 2
policy/modules/services/fprintd.te | 4
policy/modules/services/ftp.te | 58
policy/modules/services/gnomeclock.fc | 3
policy/modules/services/gnomeclock.if | 69 +
policy/modules/services/gnomeclock.te | 50
policy/modules/services/gpm.te | 1
policy/modules/services/gpsd.fc | 5
policy/modules/services/gpsd.if | 27
policy/modules/services/gpsd.te | 14
policy/modules/services/hal.fc | 1
policy/modules/services/hal.if | 18
policy/modules/services/hal.te | 46
policy/modules/services/hddtemp.fc | 4
policy/modules/services/hddtemp.if | 38
policy/modules/services/hddtemp.te | 40
policy/modules/services/kerberos.te | 13
policy/modules/services/kerneloops.te | 2
policy/modules/services/ktalk.te | 1
policy/modules/services/lircd.te | 11
policy/modules/services/mailman.te | 4
policy/modules/services/memcached.te | 2
policy/modules/services/modemmanager.fc | 2
policy/modules/services/modemmanager.if | 43
policy/modules/services/modemmanager.te | 46
policy/modules/services/mta.fc | 2
policy/modules/services/mta.if | 5
policy/modules/services/mta.te | 52
policy/modules/services/munin.fc | 3
policy/modules/services/munin.te | 3
policy/modules/services/mysql.te | 7
policy/modules/services/nagios.fc | 11
policy/modules/services/nagios.if | 70 -
policy/modules/services/nagios.te | 55
policy/modules/services/networkmanager.fc | 13
policy/modules/services/networkmanager.if | 45
policy/modules/services/networkmanager.te | 114 +
policy/modules/services/nis.fc | 5
policy/modules/services/nis.if | 87 +
policy/modules/services/nis.te | 13
policy/modules/services/nscd.if | 18
policy/modules/services/nscd.te | 11
policy/modules/services/nslcd.fc | 4
policy/modules/services/nslcd.if | 142 ++
policy/modules/services/nslcd.te | 48
policy/modules/services/ntp.if | 46
policy/modules/services/ntp.te | 7
policy/modules/services/nx.fc | 1
policy/modules/services/nx.if | 18
policy/modules/services/nx.te | 6
policy/modules/services/oddjob.if | 1
policy/modules/services/openvpn.te | 13
policy/modules/services/pcscd.te | 3
policy/modules/services/pegasus.te | 28
policy/modules/services/policykit.fc | 10
policy/modules/services/policykit.if | 46
policy/modules/services/policykit.te | 54
policy/modules/services/postfix.fc | 2
policy/modules/services/postfix.if | 150 ++
policy/modules/services/postfix.te | 136 +-
policy/modules/services/postgresql.fc | 1
policy/modules/services/postgresql.if | 43
policy/modules/services/postgresql.te | 7
policy/modules/services/ppp.if | 6
policy/modules/services/ppp.te | 10
policy/modules/services/privoxy.te | 3
policy/modules/services/procmail.te | 12
policy/modules/services/pyzor.fc | 4
policy/modules/services/pyzor.if | 47
policy/modules/services/pyzor.te | 37
policy/modules/services/razor.fc | 1
policy/modules/services/razor.if | 42
policy/modules/services/razor.te | 32
policy/modules/services/ricci.te | 5
policy/modules/services/rpc.if | 6
policy/modules/services/rpc.te | 10
policy/modules/services/rpcbind.if | 20
policy/modules/services/rsync.te | 23
policy/modules/services/rtkit_daemon.fc | 2
policy/modules/services/rtkit_daemon.if | 63
policy/modules/services/rtkit_daemon.te | 38
policy/modules/services/samba.fc | 4
policy/modules/services/samba.if | 104 +
policy/modules/services/samba.te | 82 +
policy/modules/services/sasl.te | 15
policy/modules/services/sendmail.if | 137 ++
policy/modules/services/sendmail.te | 87 +
policy/modules/services/setroubleshoot.fc | 2
policy/modules/services/setroubleshoot.if | 84 +
policy/modules/services/setroubleshoot.te | 60
policy/modules/services/shorewall.fc | 12
policy/modules/services/shorewall.if | 166 ++
policy/modules/services/shorewall.te | 95 +
policy/modules/services/smartmon.te | 12
policy/modules/services/spamassassin.fc | 14
policy/modules/services/spamassassin.if | 68 +
policy/modules/services/spamassassin.te | 129 +
policy/modules/services/squid.te | 9
policy/modules/services/ssh.fc | 2
policy/modules/services/ssh.if | 183 ++
policy/modules/services/ssh.te | 70 -
policy/modules/services/sssd.fc | 2
policy/modules/services/sssd.if | 43
policy/modules/services/sysstat.te | 2
policy/modules/services/uucp.te | 7
policy/modules/services/virt.fc | 11
policy/modules/services/virt.if | 131 +-
policy/modules/services/virt.te | 271 ++++
policy/modules/services/w3c.te | 7
policy/modules/services/xserver.fc | 29
policy/modules/services/xserver.if | 538 +++++++-
policy/modules/services/xserver.te | 306 +++-
policy/modules/system/application.if | 20
policy/modules/system/application.te | 11
policy/modules/system/authlogin.fc | 9
policy/modules/system/authlogin.if | 204 ++-
policy/modules/system/authlogin.te | 39
policy/modules/system/clock.te | 8
policy/modules/system/fstools.fc | 2
policy/modules/system/fstools.te | 67 -
policy/modules/system/getty.te | 16
policy/modules/system/hostname.te | 22
policy/modules/system/init.fc | 6
policy/modules/system/init.if | 156 ++
policy/modules/system/init.te | 268 +++-
policy/modules/system/ipsec.fc | 2
policy/modules/system/ipsec.if | 25
policy/modules/system/ipsec.te | 97 +
policy/modules/system/iptables.fc | 11
policy/modules/system/iptables.te | 5
policy/modules/system/iscsi.if | 40
policy/modules/system/iscsi.te | 6
policy/modules/system/kdump.fc | 8
policy/modules/system/kdump.if | 111 +
policy/modules/system/kdump.te | 38
policy/modules/system/libraries.fc | 153 +-
policy/modules/system/libraries.if | 4
policy/modules/system/libraries.te | 16
policy/modules/system/locallogin.te | 74 -
policy/modules/system/logging.fc | 11
policy/modules/system/logging.if | 4
policy/modules/system/logging.te | 34
policy/modules/system/lvm.te | 53
policy/modules/system/miscfiles.if | 19
policy/modules/system/modutils.te | 167 +-
policy/modules/system/mount.fc | 7
policy/modules/system/mount.te | 124 +
policy/modules/system/pcmcia.te | 19
policy/modules/system/raid.te | 24
policy/modules/system/selinuxutil.fc | 17
policy/modules/system/selinuxutil.if | 288 ++++
policy/modules/system/selinuxutil.te | 228 +--
policy/modules/system/setrans.if | 20
policy/modules/system/sysnetwork.fc | 9
policy/modules/system/sysnetwork.if | 117 +
policy/modules/system/sysnetwork.te | 107 +
policy/modules/system/udev.fc | 3
policy/modules/system/udev.if | 21
policy/modules/system/udev.te | 38
policy/modules/system/unconfined.fc | 15
policy/modules/system/unconfined.if | 446 ------
policy/modules/system/unconfined.te | 224 ---
policy/modules/system/userdomain.fc | 6
policy/modules/system/userdomain.if | 1364 ++++++++++++++++-----
policy/modules/system/userdomain.te | 50
policy/modules/system/xen.fc | 6
policy/modules/system/xen.if | 28
policy/modules/system/xen.te | 137 +-
policy/support/obj_perm_sets.spt | 14
policy/users | 13
support/Makefile.devel | 3
support/divert.m4 | 1
support/undivert.m4 | 1
331 files changed, 14520 insertions(+), 2978 deletions(-)
Index: policy-F12.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-F12.patch,v
retrieving revision 1.59
retrieving revision 1.60
diff -u -p -r1.59 -r1.60
--- policy-F12.patch 23 Aug 2009 13:55:48 -0000 1.59
+++ policy-F12.patch 23 Aug 2009 17:39:51 -0000 1.60
@@ -11114,7 +11114,7 @@ diff -b -B --ignore-all-space --exclude-
/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.6.28/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/dbus.if 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/dbus.if 2009-08-23 12:50:58.000000000 -0400
@@ -42,8 +42,10 @@
gen_require(`
class dbus { send_msg acquire_svc };
@@ -11215,6 +11215,31 @@ diff -b -B --ignore-all-space --exclude-
ifdef(`hide_broken_symptoms', `
dontaudit $1 system_dbusd_t:netlink_selinux_socket { read write };
')
+@@ -405,3 +421,24 @@
+
+ typeattribute $1 dbusd_unconfined;
+ ')
++
++########################################
++## <summary>
++## Create, read, write, and delete
++## system dbus lib files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dbus_manage_lib_files',`
++ gen_require(`
++ type system_dbus_var_lib_t;
++ ')
++
++ files_search_var_lib($1)
++ manage_files_pattern($1, system_dbus_var_lib_t, system_dbus_var_lib_t)
++')
++
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.6.28/policy/modules/services/dbus.te
--- nsaserefpolicy/policy/modules/services/dbus.te 2009-08-18 18:39:50.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/dbus.te 2009-08-21 18:56:07.000000000 -0400
@@ -17533,7 +17558,7 @@ diff -b -B --ignore-all-space --exclude-
+/root/\.ssh(/.*)? gen_context(system_u:object_r:home_ssh_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.6.28/policy/modules/services/ssh.if
--- nsaserefpolicy/policy/modules/services/ssh.if 2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/ssh.if 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/ssh.if 2009-08-23 12:58:23.000000000 -0400
@@ -36,6 +36,7 @@
gen_require(`
attribute ssh_server;
@@ -17770,7 +17795,7 @@ diff -b -B --ignore-all-space --exclude-
########################################
## <summary>
-@@ -603,3 +638,63 @@
+@@ -603,3 +638,83 @@
dontaudit $1 sshd_key_t:file { getattr read };
')
@@ -17834,6 +17859,26 @@ diff -b -B --ignore-all-space --exclude-
+ read_lnk_files_pattern($1, home_ssh_t, home_ssh_t)
+ userdom_search_user_home_dirs($1)
+')
++
++########################################
++## <summary>
++## Set the attributes of sshd key files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`ssh_setattr_key_files',`
++ gen_require(`
++ type sshd_key_t;
++ ')
++
++ allow $1 sshd_key_t:file setattr;
++ files_search_pids($1)
++')
++
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.6.28/policy/modules/services/ssh.te
--- nsaserefpolicy/policy/modules/services/ssh.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/services/ssh.te 2009-08-21 18:56:07.000000000 -0400
@@ -18030,7 +18075,7 @@ diff -b -B --ignore-all-space --exclude-
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.if serefpolicy-3.6.28/policy/modules/services/sssd.if
--- nsaserefpolicy/policy/modules/services/sssd.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/sssd.if 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/sssd.if 2009-08-23 12:49:30.000000000 -0400
@@ -12,12 +12,32 @@
#
interface(`sssd_domtrans',`
@@ -21231,7 +21276,7 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.6.28/policy/modules/system/init.te
--- nsaserefpolicy/policy/modules/system/init.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/init.te 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/init.te 2009-08-23 13:00:32.000000000 -0400
@@ -17,6 +17,20 @@
## </desc>
gen_tunable(init_upstart, false)
@@ -21515,7 +21560,23 @@ diff -b -B --ignore-all-space --exclude-
logging_send_syslog_msg(initrc_t)
logging_manage_generic_logs(initrc_t)
logging_read_all_logs(initrc_t)
-@@ -422,8 +478,6 @@
+@@ -374,13 +430,14 @@
+
+ miscfiles_read_localization(initrc_t)
+ # slapd needs to read cert files from its initscript
+-miscfiles_read_certs(initrc_t)
++miscfiles_manage_cert_files(initrc_t)
+
+ modutils_read_module_config(initrc_t)
+ modutils_domtrans_insmod(initrc_t)
+
+ seutil_read_config(initrc_t)
+
++userdom_read_admin_home_files(initrc_t)
+ userdom_read_user_home_content_files(initrc_t)
+ # Allow access to the sysadm TTYs. Note that this will give access to the
+ # TTYs to any process in the initrc_t domain. Therefore, daemons and such
+@@ -422,8 +479,6 @@
# init scripts touch this
clock_dontaudit_write_adjtime(initrc_t)
@@ -21524,7 +21585,7 @@ diff -b -B --ignore-all-space --exclude-
# for integrated run_init to read run_init_type.
# happens during boot (/sbin/rc execs init scripts)
seutil_read_default_contexts(initrc_t)
-@@ -450,11 +504,9 @@
+@@ -450,11 +505,9 @@
# Red Hat systems seem to have a stray
# fd open from the initrd
@@ -21537,7 +21598,7 @@ diff -b -B --ignore-all-space --exclude-
# These seem to be from the initrd
# during device initialization:
dev_create_generic_dirs(initrc_t)
-@@ -464,6 +516,7 @@
+@@ -464,6 +517,7 @@
storage_raw_read_fixed_disk(initrc_t)
storage_raw_write_fixed_disk(initrc_t)
@@ -21545,7 +21606,7 @@ diff -b -B --ignore-all-space --exclude-
files_create_boot_flag(initrc_t)
files_rw_boot_symlinks(initrc_t)
# wants to read /.fonts directory
-@@ -492,11 +545,13 @@
+@@ -492,11 +546,13 @@
optional_policy(`
bind_manage_config_dirs(initrc_t)
bind_write_config(initrc_t)
@@ -21559,7 +21620,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -515,6 +570,33 @@
+@@ -515,6 +571,33 @@
')
')
@@ -21593,14 +21654,17 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t)
-@@ -569,8 +651,16 @@
+@@ -567,10 +650,19 @@
+ dbus_connect_system_bus(initrc_t)
+ dbus_system_bus_client(initrc_t)
dbus_read_config(initrc_t)
-
- optional_policy(`
-+ consolekit_dbus_chat(initrc_t)
-+ ')
++ dbus_manage_lib_files(initrc_t)
+
+ optional_policy(`
++ consolekit_dbus_chat(initrc_t)
++ ')
+
+ optional_policy(`
networkmanager_dbus_chat(initrc_t)
')
+
@@ -21610,7 +21674,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -590,6 +680,10 @@
+@@ -590,6 +682,10 @@
')
optional_policy(`
@@ -21621,7 +21685,7 @@ diff -b -B --ignore-all-space --exclude-
dev_read_usbfs(initrc_t)
# init scripts run /etc/hotplug/usb.rc
-@@ -646,20 +740,20 @@
+@@ -646,20 +742,20 @@
')
optional_policy(`
@@ -21648,7 +21712,7 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
ifdef(`distro_redhat',`
-@@ -668,6 +762,7 @@
+@@ -668,6 +764,7 @@
mysql_stream_connect(initrc_t)
mysql_write_log(initrc_t)
@@ -21656,7 +21720,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -696,7 +791,6 @@
+@@ -696,7 +793,6 @@
')
optional_policy(`
@@ -21664,7 +21728,7 @@ diff -b -B --ignore-all-space --exclude-
fs_write_ramfs_sockets(initrc_t)
fs_search_ramfs(initrc_t)
-@@ -718,8 +812,6 @@
+@@ -718,8 +814,6 @@
# bash tries ioctl for some reason
files_dontaudit_ioctl_all_pids(initrc_t)
@@ -21673,7 +21737,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -732,10 +824,12 @@
+@@ -732,13 +826,16 @@
squid_manage_logs(initrc_t)
')
@@ -21686,7 +21750,19 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
ssh_dontaudit_read_server_keys(initrc_t)
-@@ -754,6 +848,15 @@
++ ssh_setattr_key_files(initrc_t)
+ ')
+
+ optional_policy(`
+@@ -747,6 +844,7 @@
+
+ optional_policy(`
+ udev_rw_db(initrc_t)
++ udev_manage_pid_files(initrc_t)
+ ')
+
+ optional_policy(`
+@@ -754,6 +852,15 @@
')
optional_policy(`
@@ -21702,7 +21778,7 @@ diff -b -B --ignore-all-space --exclude-
unconfined_domain(initrc_t)
ifdef(`distro_redhat',`
-@@ -764,6 +867,13 @@
+@@ -764,6 +871,13 @@
optional_policy(`
mono_domtrans(initrc_t)
')
@@ -21716,7 +21792,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -789,3 +899,31 @@
+@@ -789,3 +903,31 @@
optional_policy(`
zebra_read_config(initrc_t)
')
@@ -24985,6 +25061,35 @@ diff -b -B --ignore-all-space --exclude-
/sbin/start_udev -- gen_context(system_u:object_r:udev_exec_t,s0)
/sbin/udev -- gen_context(system_u:object_r:udev_exec_t,s0)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.if serefpolicy-3.6.28/policy/modules/system/udev.if
+--- nsaserefpolicy/policy/modules/system/udev.if 2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/udev.if 2009-08-23 12:54:42.000000000 -0400
+@@ -168,4 +168,25 @@
+
+ dev_list_all_dev_nodes($1)
+ allow $1 udev_tbl_t:file rw_file_perms;
++ allow $1 udev_tbl_t:file unlink;
++')
++
++########################################
++## <summary>
++## Create, read, write, and delete
++## udev pid files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`udev_manage_pid_files',`
++ gen_require(`
++ type udev_var_run_t;
++ ')
++
++ files_search_var_lib($1)
++ manage_files_pattern($1, udev_var_run_t, udev_var_run_t)
+ ')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.6.28/policy/modules/system/udev.te
--- nsaserefpolicy/policy/modules/system/udev.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/system/udev.te 2009-08-21 18:56:07.000000000 -0400
@@ -25872,7 +25977,7 @@ diff -b -B --ignore-all-space --exclude-
+HOME_DIR/\.gvfs(/.*)? <<none>>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.28/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-23 13:00:14.000000000 -0400
@@ -30,8 +30,9 @@
')
@@ -27238,7 +27343,7 @@ diff -b -B --ignore-all-space --exclude-
kernel_search_proc($1)
')
-@@ -3027,3 +3207,540 @@
+@@ -3027,3 +3207,559 @@
allow $1 userdomain:dbus send_msg;
')
@@ -27525,7 +27630,26 @@ diff -b -B --ignore-all-space --exclude-
+
+########################################
+## <summary>
-+## Execute user home files.
++## Read admin home files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <rolecap/>
++#
++interface(`userdom_read_admin_home_files',`
++ gen_require(`
++ type admin_home_t;
++ ')
++
++ read_files_pattern($1, admin_home_t, admin_home_t)
++')
++
++########################################
++## <summary>
++## Execute admin home files.
+## </summary>
+## <param name="domain">
+## <summary>
More information about the scm-commits
mailing list