rpms/selinux-policy/F-11 policy-20090521.patch, 1.47, 1.48 selinux-policy.spec, 1.900, 1.901

Miroslav Grepl mgrepl at fedoraproject.org
Mon Aug 24 13:58:25 UTC 2009 

Author: mgrepl

Update of /cvs/extras/rpms/selinux-policy/F-11
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv659

Modified Files:
	policy-20090521.patch selinux-policy.spec 
Log Message:
- Allow pptp dac_override capability



policy-20090521.patch:
 man/man8/samba_selinux.8                  |    4 
 policy/mcs                                |   12 -
 policy/modules/admin/certwatch.te         |    4 
 policy/modules/admin/kismet.te            |   16 +
 policy/modules/admin/logrotate.te         |    6 
 policy/modules/admin/mrtg.te              |    8 
 policy/modules/admin/prelink.te           |    9 
 policy/modules/admin/readahead.te         |    2 
 policy/modules/admin/rpm.if               |   18 +
 policy/modules/admin/rpm.te               |    4 
 policy/modules/admin/shorewall.fc         |   12 +
 policy/modules/admin/shorewall.if         |  166 ++++++++++++++++++
 policy/modules/admin/shorewall.te         |  103 +++++++++++
 policy/modules/admin/sudo.if              |    4 
 policy/modules/admin/usermanage.te        |    1 
 policy/modules/apps/awstats.te            |    2 
 policy/modules/apps/calamaris.te          |    4 
 policy/modules/apps/gitosis.fc            |    4 
 policy/modules/apps/gitosis.if            |   96 ++++++++++
 policy/modules/apps/gitosis.te            |   43 ++++
 policy/modules/apps/gnome.te              |   15 +
 policy/modules/apps/gpg.if                |    2 
 policy/modules/apps/gpg.te                |    1 
 policy/modules/apps/mozilla.if            |   16 +
 policy/modules/apps/mozilla.te            |   14 -
 policy/modules/apps/nsplugin.if           |    2 
 policy/modules/apps/ptchown.fc            |    2 
 policy/modules/apps/ptchown.if            |   22 ++
 policy/modules/apps/ptchown.te            |   40 ++++
 policy/modules/apps/qemu.fc               |    1 
 policy/modules/apps/qemu.te               |    5 
 policy/modules/apps/sandbox.if            |  134 +++++++++++---
 policy/modules/apps/sandbox.te            |  274 +++++++++++++++++++++++++++---
 policy/modules/apps/screen.if             |    1 
 policy/modules/apps/vmware.fc             |    1 
 policy/modules/apps/vmware.te             |    6 
 policy/modules/kernel/corecommands.fc     |   10 -
 policy/modules/kernel/corenetwork.te.in   |    5 
 policy/modules/kernel/devices.fc          |    2 
 policy/modules/kernel/devices.if          |  145 +++++++++++++++
 policy/modules/kernel/devices.te          |   13 +
 policy/modules/kernel/domain.if           |   45 +---
 policy/modules/kernel/domain.te           |   30 +++
 policy/modules/kernel/files.if            |    3 
 policy/modules/kernel/kernel.if           |    2 
 policy/modules/kernel/terminal.if         |   19 ++
 policy/modules/roles/staff.te             |   12 +
 policy/modules/roles/sysadm.if            |   35 +++
 policy/modules/roles/sysadm.te            |    4 
 policy/modules/roles/unconfineduser.te    |    9 
 policy/modules/roles/unprivuser.te        |    4 
 policy/modules/roles/xguest.te            |    6 
 policy/modules/services/apache.fc         |    4 
 policy/modules/services/automount.if      |   18 +
 policy/modules/services/avahi.te          |    2 
 policy/modules/services/bluetooth.te      |    1 
 policy/modules/services/clamav.te         |    4 
 policy/modules/services/consolekit.te     |    3 
 policy/modules/services/cron.if           |   19 --
 policy/modules/services/cron.te           |    2 
 policy/modules/services/cups.fc           |    2 
 policy/modules/services/cups.te           |   28 ++-
 policy/modules/services/dbus.if           |    4 
 policy/modules/services/dcc.te            |    8 
 policy/modules/services/ddclient.if       |   25 ++
 policy/modules/services/devicekit.te      |    6 
 policy/modules/services/dnsmasq.te        |    4 
 policy/modules/services/dovecot.if        |   34 +--
 policy/modules/services/dovecot.te        |   20 +-
 policy/modules/services/exim.te           |    6 
 policy/modules/services/fetchmail.te      |    2 
 policy/modules/services/fprintd.te        |   10 -
 policy/modules/services/ftp.te            |   15 +
 policy/modules/services/gnomeclock.te     |    1 
 policy/modules/services/gpsd.fc           |    3 
 policy/modules/services/gpsd.te           |   19 +-
 policy/modules/services/hal.te            |   14 +
 policy/modules/services/hddtemp.fc        |    4 
 policy/modules/services/hddtemp.if        |   38 ++++
 policy/modules/services/hddtemp.te        |   40 ++++
 policy/modules/services/kerberos.if       |    2 
 policy/modules/services/kerberos.te       |   12 +
 policy/modules/services/lircd.te          |    4 
 policy/modules/services/mailman.if        |    1 
 policy/modules/services/mta.if            |    1 
 policy/modules/services/mysql.te          |    6 
 policy/modules/services/nis.te            |    3 
 policy/modules/services/nslcd.fc          |    4 
 policy/modules/services/nslcd.if          |  145 +++++++++++++++
 policy/modules/services/nslcd.te          |   50 +++++
 policy/modules/services/nx.fc             |    3 
 policy/modules/services/nx.if             |   19 ++
 policy/modules/services/openvpn.te        |   14 +
 policy/modules/services/pcscd.te          |    3 
 policy/modules/services/polkit.fc         |    2 
 policy/modules/services/polkit.if         |    2 
 policy/modules/services/polkit.te         |    3 
 policy/modules/services/postfix.if        |   26 ++
 policy/modules/services/postfix.te        |   26 --
 policy/modules/services/postgresql.te     |    2 
 policy/modules/services/ppp.if            |    6 
 policy/modules/services/ppp.te            |    2 
 policy/modules/services/privoxy.te        |    3 
 policy/modules/services/pyzor.fc          |    2 
 policy/modules/services/pyzor.te          |    2 
 policy/modules/services/rpc.te            |   12 +
 policy/modules/services/rsync.te          |    2 
 policy/modules/services/sasl.te           |    2 
 policy/modules/services/sendmail.if       |   39 ++++
 policy/modules/services/sendmail.te       |    7 
 policy/modules/services/setroubleshoot.te |    5 
 policy/modules/services/shorewall.fc      |   12 -
 policy/modules/services/shorewall.if      |  166 ------------------
 policy/modules/services/shorewall.te      |  102 -----------
 policy/modules/services/spamassassin.fc   |    8 
 policy/modules/services/spamassassin.te   |    1 
 policy/modules/services/squid.te          |    2 
 policy/modules/services/ssh.if            |   23 ++
 policy/modules/services/ssh.te            |    8 
 policy/modules/services/uucp.te           |    2 
 policy/modules/services/virt.te           |   27 ++
 policy/modules/services/xserver.fc        |    2 
 policy/modules/services/xserver.if        |   41 ++++
 policy/modules/services/xserver.te        |   11 -
 policy/modules/system/authlogin.fc        |    3 
 policy/modules/system/authlogin.if        |  270 ++++++++++++++++++-----------
 policy/modules/system/authlogin.te        |   27 +-
 policy/modules/system/init.fc             |    2 
 policy/modules/system/init.te             |    2 
 policy/modules/system/ipsec.te            |   61 +++++-
 policy/modules/system/iptables.te         |    4 
 policy/modules/system/iscsi.te            |    1 
 policy/modules/system/libraries.fc        |   11 +
 policy/modules/system/locallogin.te       |    6 
 policy/modules/system/miscfiles.fc        |    1 
 policy/modules/system/mount.te            |    1 
 policy/modules/system/sysnetwork.if       |    1 
 policy/modules/system/sysnetwork.te       |   17 +
 policy/modules/system/udev.fc             |    1 
 policy/modules/system/udev.te             |   10 +
 policy/modules/system/userdomain.if       |   33 ++-
 policy/modules/system/virtual.te          |    5 
 policy/modules/system/xen.te              |    1 
 143 files changed, 2360 insertions(+), 646 deletions(-)

Index: policy-20090521.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-11/policy-20090521.patch,v
retrieving revision 1.47
retrieving revision 1.48
diff -u -p -r1.47 -r1.48
--- policy-20090521.patch	20 Aug 2009 14:29:53 -0000	1.47
+++ policy-20090521.patch	24 Aug 2009 13:58:23 -0000	1.48
@@ -748,6 +748,31 @@ diff -b -B --ignore-all-space --exclude-
 +optional_policy(`
 +	ssh_rw_pipes(gitosis_t)
 +')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.6.12/policy/modules/apps/gnome.te
+--- nsaserefpolicy/policy/modules/apps/gnome.te	2009-06-25 10:19:43.000000000 +0200
++++ serefpolicy-3.6.12/policy/modules/apps/gnome.te	2009-08-24 09:15:41.000000000 +0200
+@@ -114,6 +114,21 @@
+ 
+ userdom_dontaudit_search_admin_dir(gconfdefaultsm_t)
+ 
++# if $HOME/.gconf is labeled as user_home_t
++userdom_user_home_dir_filetrans_pattern(gconfdefaultsm_t, { file })
++userdom_manage_user_home_content_dirs(gconfdefaultsm_t)
++userdom_manage_user_home_content_files(gconfdefaultsm_t)
++
++tunable_policy(`use_nfs_home_dirs',`
++        fs_manage_nfs_dirs(gconfdefaultsm_t)
++        fs_manage_nfs_files(gconfdefaultsm_t)
++')
++
++tunable_policy(`use_samba_home_dirs',`
++        fs_manage_cifs_dirs(gconfdefaultsm_t)
++        fs_manage_cifs_files(gconfdefaultsm_t)
++')
++
+ optional_policy(`
+         consolekit_dbus_chat(gconfdefaultsm_t)
+ ')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.if serefpolicy-3.6.12/policy/modules/apps/gpg.if
 --- nsaserefpolicy/policy/modules/apps/gpg.if	2009-06-25 10:19:43.000000000 +0200
 +++ serefpolicy-3.6.12/policy/modules/apps/gpg.if	2009-08-18 15:05:46.000000000 +0200
@@ -2766,8 +2791,22 @@ diff -b -B --ignore-all-space --exclude-
  permissive fprintd_t;
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.6.12/policy/modules/services/ftp.te
 --- nsaserefpolicy/policy/modules/services/ftp.te	2009-06-25 10:19:44.000000000 +0200
-+++ serefpolicy-3.6.12/policy/modules/services/ftp.te	2009-07-03 08:22:14.000000000 +0200
-@@ -91,6 +91,9 @@
++++ serefpolicy-3.6.12/policy/modules/services/ftp.te	2009-08-24 09:30:32.000000000 +0200
+@@ -85,12 +85,23 @@
+ type xferlog_t;
+ logging_log_file(xferlog_t)
+ 
++ifdef(`enable_mcs',`
++	init_ranged_daemon_domain(ftpd_t, ftpd_exec_t, s0 - mcs_systemhigh)
++')
++
++ifdef(`enable_mls',`
++	init_ranged_daemon_domain(ftpd_t, ftpd_exec_t, mls_systemhigh)
++')  
++
+ ########################################
+ #
+ # ftpd local policy
  #
  
  allow ftpd_t self:capability { chown fowner fsetid setgid setuid sys_chroot sys_nice sys_resource };
@@ -2777,7 +2816,7 @@ diff -b -B --ignore-all-space --exclude-
  dontaudit ftpd_t self:capability sys_tty_config;
  allow ftpd_t self:process signal_perms;
  allow ftpd_t self:process { getcap setcap setsched setrlimit };
-@@ -99,6 +102,7 @@
+@@ -99,6 +110,7 @@
  allow ftpd_t self:unix_stream_socket create_stream_socket_perms;
  allow ftpd_t self:tcp_socket create_stream_socket_perms;
  allow ftpd_t self:udp_socket create_socket_perms;
@@ -2785,7 +2824,7 @@ diff -b -B --ignore-all-space --exclude-
  allow ftpd_t self:key manage_key_perms;
  
  allow ftpd_t ftpd_etc_t:file read_file_perms;
-@@ -129,8 +133,7 @@
+@@ -129,8 +141,7 @@
  allow ftpd_t ftpdctl_tmp_t:sock_file { getattr unlink };
  
  # Create and modify /var/log/xferlog.
@@ -3675,6 +3714,18 @@ diff -b -B --ignore-all-space --exclude-
  ')
  
  ########################################
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.6.12/policy/modules/services/ppp.te
+--- nsaserefpolicy/policy/modules/services/ppp.te	2009-06-25 10:19:44.000000000 +0200
++++ serefpolicy-3.6.12/policy/modules/services/ppp.te	2009-08-24 15:30:24.000000000 +0200
+@@ -218,7 +218,7 @@
+ # PPTP Local policy
+ #
+ 
+-allow pptp_t self:capability { net_raw net_admin };
++allow pptp_t self:capability { dac_read_search dac_override net_raw net_admin };
+ dontaudit pptp_t self:capability sys_tty_config;
+ allow pptp_t self:process signal;
+ allow pptp_t self:fifo_file rw_fifo_file_perms;
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/privoxy.te serefpolicy-3.6.12/policy/modules/services/privoxy.te
 --- nsaserefpolicy/policy/modules/services/privoxy.te	2009-06-25 10:19:44.000000000 +0200
 +++ serefpolicy-3.6.12/policy/modules/services/privoxy.te	2009-06-25 10:21:01.000000000 +0200
@@ -4208,6 +4259,19 @@ diff -b -B --ignore-all-space --exclude-
  
  manage_dirs_pattern(spamc_t, spamc_tmp_t, spamc_tmp_t)
  manage_files_pattern(spamc_t, spamc_tmp_t, spamc_tmp_t)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.6.12/policy/modules/services/squid.te
+--- nsaserefpolicy/policy/modules/services/squid.te	2009-06-25 10:19:44.000000000 +0200
++++ serefpolicy-3.6.12/policy/modules/services/squid.te	2009-08-23 20:37:28.000000000 +0200
+@@ -67,7 +67,9 @@
+ 
+ can_exec(squid_t, squid_exec_t)
+ 
++manage_dirs_pattern(squid_t, squid_log_t, squid_log_t)
+ manage_files_pattern(squid_t, squid_log_t, squid_log_t)
++manage_lnk_files_pattern(squid_t, squid_log_t, squid_log_t)
+ logging_log_filetrans(squid_t, squid_log_t, { file dir })
+ 
+ manage_files_pattern(squid_t, squid_var_run_t, squid_var_run_t)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.6.12/policy/modules/services/ssh.if
 --- nsaserefpolicy/policy/modules/services/ssh.if	2009-06-25 10:19:44.000000000 +0200
 +++ serefpolicy-3.6.12/policy/modules/services/ssh.if	2009-07-20 14:31:17.000000000 +0200


Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-11/selinux-policy.spec,v
retrieving revision 1.900
retrieving revision 1.901
diff -u -p -r1.900 -r1.901
--- selinux-policy.spec	20 Aug 2009 11:27:42 -0000	1.900
+++ selinux-policy.spec	24 Aug 2009 13:58:24 -0000	1.901
@@ -20,7 +20,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.6.12
-Release: 79%{?dist}
+Release: 80%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -475,6 +475,9 @@ exit 0
 %endif
 
 %changelog
+* Mon Aug 24 2009 Miroslav Grepl <mgrepl at redhat.com> 3.6.12-80
+- Allow pptp dac_override capability
+
 * Thu Aug 20 2009 Miroslav Grepl <mgrepl at redhat.com> 3.6.12-79
 - Fixes for racoon 
 - Fixes for ptchown

More information about the scm-commits mailing list