rpms/selinux-policy/devel modules-minimum.conf, 1.29, 1.30 modules-targeted.conf, 1.138, 1.139 policy-F12.patch, 1.63, 1.64 selinux-policy.spec, 1.905, 1.906
Daniel J Walsh
dwalsh at fedoraproject.org
Wed Aug 26 20:19:02 UTC 2009
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv426
Modified Files:
modules-minimum.conf modules-targeted.conf policy-F12.patch
selinux-policy.spec
Log Message:
* Wed Aug 26 2009 Dan Walsh <dwalsh at redhat.com> 3.6.28-8
- Add back in unconfined.pp and unconfineduser.pp
- Add Sandbox unshare
Index: modules-minimum.conf
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/modules-minimum.conf,v
retrieving revision 1.29
retrieving revision 1.30
diff -u -p -r1.29 -r1.30
--- modules-minimum.conf 21 Aug 2009 22:58:28 -0000 1.29
+++ modules-minimum.conf 26 Aug 2009 20:19:01 -0000 1.30
@@ -1301,6 +1301,13 @@ selinuxutil = base
#
sendmail = base
+# Layer: apps
+# Module: seunshare
+#
+# seunshare executable
+#
+seunshare = module
+
# Layer: services
# Module: shorewall
#
Index: modules-targeted.conf
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/modules-targeted.conf,v
retrieving revision 1.138
retrieving revision 1.139
diff -u -p -r1.138 -r1.139
--- modules-targeted.conf 21 Aug 2009 22:58:28 -0000 1.138
+++ modules-targeted.conf 26 Aug 2009 20:19:01 -0000 1.139
@@ -1301,6 +1301,13 @@ selinuxutil = base
#
sendmail = base
+# Layer: apps
+# Module: seunshare
+#
+# seunshare executable
+#
+seunshare = module
+
# Layer: services
# Module: shorewall
#
policy-F12.patch:
Makefile | 22
Rules.modular | 8
config/appconfig-mcs/default_contexts | 19
config/appconfig-mcs/failsafe_context | 2
config/appconfig-mcs/root_default_contexts | 8
config/appconfig-mcs/securetty_types | 5
config/appconfig-mcs/seusers | 4
config/appconfig-mcs/staff_u_default_contexts | 4
config/appconfig-mcs/unconfined_u_default_contexts | 4
config/appconfig-mcs/user_u_default_contexts | 5
config/appconfig-mcs/userhelper_context | 2
config/appconfig-mcs/virtual_domain_context | 1
config/appconfig-mcs/virtual_image_context | 2
config/appconfig-mls/default_contexts | 19
config/appconfig-mls/root_default_contexts | 12
config/appconfig-mls/virtual_domain_context | 1
config/appconfig-mls/virtual_image_context | 2
config/appconfig-standard/securetty_types | 5
man/man8/rsync_selinux.8 | 18
man/man8/samba_selinux.8 | 4
policy/flask/access_vectors | 2
policy/global_tunables | 24
policy/mcs | 10
policy/modules/admin/anaconda.te | 3
policy/modules/admin/certwatch.te | 1
policy/modules/admin/dmesg.fc | 2
policy/modules/admin/dmesg.te | 7
policy/modules/admin/kismet.if | 1
policy/modules/admin/kismet.te | 17
policy/modules/admin/logrotate.te | 13
policy/modules/admin/logwatch.te | 1
policy/modules/admin/mrtg.te | 7
policy/modules/admin/portage.te | 2
policy/modules/admin/prelink.if | 19
policy/modules/admin/readahead.te | 3
policy/modules/admin/rpm.fc | 17
policy/modules/admin/rpm.if | 176 ++
policy/modules/admin/rpm.te | 65
policy/modules/admin/smoltclient.fc | 4
policy/modules/admin/smoltclient.if | 1
policy/modules/admin/smoltclient.te | 66 +
policy/modules/admin/sudo.if | 41
policy/modules/admin/tmpreaper.te | 4
policy/modules/admin/usermanage.if | 5
policy/modules/admin/usermanage.te | 30
policy/modules/admin/vbetool.te | 14
policy/modules/apps/awstats.te | 4
policy/modules/apps/calamaris.te | 4
policy/modules/apps/cdrecord.te | 4
policy/modules/apps/cpufreqselector.te | 4
policy/modules/apps/gitosis.fc | 4
policy/modules/apps/gitosis.if | 96 +
policy/modules/apps/gitosis.te | 36
policy/modules/apps/gnome.fc | 12
policy/modules/apps/gnome.if | 170 ++
policy/modules/apps/gnome.te | 92 +
policy/modules/apps/gpg.if | 2
policy/modules/apps/gpg.te | 16
policy/modules/apps/java.fc | 17
policy/modules/apps/java.if | 111 +
policy/modules/apps/java.te | 12
policy/modules/apps/kdumpgui.fc | 2
policy/modules/apps/kdumpgui.if | 2
policy/modules/apps/kdumpgui.te | 64
policy/modules/apps/livecd.fc | 2
policy/modules/apps/livecd.if | 50
policy/modules/apps/livecd.te | 26
policy/modules/apps/mono.if | 101 +
policy/modules/apps/mono.te | 9
policy/modules/apps/mozilla.fc | 1
policy/modules/apps/mozilla.if | 13
policy/modules/apps/mozilla.te | 21
policy/modules/apps/nsplugin.fc | 12
policy/modules/apps/nsplugin.if | 313 ++++
policy/modules/apps/nsplugin.te | 288 ++++
policy/modules/apps/openoffice.fc | 3
policy/modules/apps/openoffice.if | 93 +
policy/modules/apps/openoffice.te | 14
policy/modules/apps/ptchown.fc | 2
policy/modules/apps/ptchown.if | 22
policy/modules/apps/ptchown.te | 39
policy/modules/apps/pulseaudio.if | 1
policy/modules/apps/pulseaudio.te | 18
policy/modules/apps/qemu.fc | 4
policy/modules/apps/qemu.if | 270 ++--
policy/modules/apps/qemu.te | 82 +
policy/modules/apps/sambagui.fc | 1
policy/modules/apps/sambagui.if | 2
policy/modules/apps/sambagui.te | 55
policy/modules/apps/sandbox.fc | 1
policy/modules/apps/sandbox.if | 167 ++
policy/modules/apps/sandbox.te | 302 ++++
policy/modules/apps/screen.if | 24
policy/modules/apps/seunshare.fc | 2
policy/modules/apps/seunshare.if | 76 +
policy/modules/apps/seunshare.te | 37
policy/modules/apps/vmware.fc | 1
policy/modules/apps/vmware.te | 1
policy/modules/apps/webalizer.te | 1
policy/modules/apps/wine.fc | 23
policy/modules/apps/wine.if | 59
policy/modules/apps/wine.te | 23
policy/modules/kernel/corecommands.fc | 24
policy/modules/kernel/corecommands.if | 1
policy/modules/kernel/corenetwork.te.in | 29
policy/modules/kernel/devices.fc | 5
policy/modules/kernel/devices.if | 164 ++
policy/modules/kernel/devices.te | 19
policy/modules/kernel/domain.if | 132 +-
policy/modules/kernel/domain.te | 87 +
policy/modules/kernel/files.fc | 3
policy/modules/kernel/files.if | 298 ++++
policy/modules/kernel/files.te | 6
policy/modules/kernel/filesystem.fc | 2
policy/modules/kernel/filesystem.if | 173 ++
policy/modules/kernel/filesystem.te | 8
policy/modules/kernel/kernel.if | 39
policy/modules/kernel/kernel.te | 29
policy/modules/kernel/selinux.if | 25
policy/modules/kernel/storage.fc | 1
policy/modules/kernel/storage.if | 2
policy/modules/kernel/terminal.fc | 1
policy/modules/kernel/terminal.if | 40
policy/modules/kernel/terminal.te | 1
policy/modules/roles/guest.te | 8
policy/modules/roles/staff.te | 124 -
policy/modules/roles/sysadm.te | 124 -
policy/modules/roles/unconfineduser.fc | 36
policy/modules/roles/unconfineduser.if | 638 +++++++++
policy/modules/roles/unconfineduser.te | 392 +++++
policy/modules/roles/unprivuser.te | 131 --
policy/modules/roles/xguest.te | 18
policy/modules/services/abrt.fc | 13
policy/modules/services/abrt.if | 126 +
policy/modules/services/abrt.te | 124 +
policy/modules/services/afs.fc | 1
policy/modules/services/afs.te | 1
policy/modules/services/amavis.te | 2
policy/modules/services/apache.fc | 35
policy/modules/services/apache.if | 327 +++-
policy/modules/services/apache.te | 409 +++++-
policy/modules/services/apm.te | 2
policy/modules/services/automount.te | 1
policy/modules/services/bind.if | 40
policy/modules/services/bluetooth.te | 8
policy/modules/services/certmaster.te | 2
policy/modules/services/clamav.te | 12
policy/modules/services/consolekit.if | 39
policy/modules/services/consolekit.te | 18
policy/modules/services/courier.if | 18
policy/modules/services/courier.te | 1
policy/modules/services/cron.fc | 13
policy/modules/services/cron.if | 202 ++-
policy/modules/services/cron.te | 149 +-
policy/modules/services/cups.fc | 13
policy/modules/services/cups.te | 28
policy/modules/services/cvs.te | 1
policy/modules/services/dbus.fc | 5
policy/modules/services/dbus.if | 49
policy/modules/services/dbus.te | 25
policy/modules/services/dcc.te | 8
policy/modules/services/ddclient.if | 25
policy/modules/services/devicekit.fc | 2
policy/modules/services/devicekit.if | 22
policy/modules/services/devicekit.te | 50
policy/modules/services/dnsmasq.te | 8
policy/modules/services/dovecot.te | 7
policy/modules/services/exim.te | 4
policy/modules/services/fetchmail.te | 2
policy/modules/services/fprintd.te | 4
policy/modules/services/ftp.te | 58
policy/modules/services/gnomeclock.fc | 3
policy/modules/services/gnomeclock.if | 69 +
policy/modules/services/gnomeclock.te | 50
policy/modules/services/gpm.te | 3
policy/modules/services/gpsd.fc | 5
policy/modules/services/gpsd.if | 27
policy/modules/services/gpsd.te | 14
policy/modules/services/hal.fc | 1
policy/modules/services/hal.if | 18
policy/modules/services/hal.te | 46
policy/modules/services/hddtemp.fc | 4
policy/modules/services/hddtemp.if | 38
policy/modules/services/hddtemp.te | 40
policy/modules/services/kerberos.te | 13
policy/modules/services/kerneloops.te | 2
policy/modules/services/ktalk.te | 1
policy/modules/services/lircd.te | 11
policy/modules/services/mailman.te | 4
policy/modules/services/memcached.te | 2
policy/modules/services/modemmanager.fc | 2
policy/modules/services/modemmanager.if | 43
policy/modules/services/modemmanager.te | 46
policy/modules/services/mta.fc | 2
policy/modules/services/mta.if | 5
policy/modules/services/mta.te | 52
policy/modules/services/munin.fc | 3
policy/modules/services/munin.te | 3
policy/modules/services/mysql.te | 7
policy/modules/services/nagios.fc | 11
policy/modules/services/nagios.if | 70 -
policy/modules/services/nagios.te | 55
policy/modules/services/networkmanager.fc | 13
policy/modules/services/networkmanager.if | 45
policy/modules/services/networkmanager.te | 114 +
policy/modules/services/nis.fc | 5
policy/modules/services/nis.if | 87 +
policy/modules/services/nis.te | 13
policy/modules/services/nscd.if | 18
policy/modules/services/nscd.te | 11
policy/modules/services/nslcd.fc | 4
policy/modules/services/nslcd.if | 142 ++
policy/modules/services/nslcd.te | 48
policy/modules/services/ntp.if | 46
policy/modules/services/ntp.te | 7
policy/modules/services/nx.fc | 1
policy/modules/services/nx.if | 18
policy/modules/services/nx.te | 6
policy/modules/services/oddjob.if | 1
policy/modules/services/openvpn.te | 13
policy/modules/services/pcscd.te | 3
policy/modules/services/pegasus.te | 28
policy/modules/services/policykit.fc | 10
policy/modules/services/policykit.if | 49
policy/modules/services/policykit.te | 60
policy/modules/services/postfix.fc | 2
policy/modules/services/postfix.if | 150 ++
policy/modules/services/postfix.te | 136 +-
policy/modules/services/postgresql.fc | 1
policy/modules/services/postgresql.if | 43
policy/modules/services/postgresql.te | 9
policy/modules/services/ppp.if | 6
policy/modules/services/ppp.te | 12
policy/modules/services/privoxy.te | 3
policy/modules/services/procmail.te | 12
policy/modules/services/pyzor.fc | 4
policy/modules/services/pyzor.if | 47
policy/modules/services/pyzor.te | 37
policy/modules/services/razor.fc | 1
policy/modules/services/razor.if | 42
policy/modules/services/razor.te | 32
policy/modules/services/ricci.te | 5
policy/modules/services/rpc.if | 6
policy/modules/services/rpc.te | 10
policy/modules/services/rpcbind.if | 20
policy/modules/services/rsync.te | 23
policy/modules/services/rtkit_daemon.fc | 2
policy/modules/services/rtkit_daemon.if | 63
policy/modules/services/rtkit_daemon.te | 38
policy/modules/services/samba.fc | 4
policy/modules/services/samba.if | 104 +
policy/modules/services/samba.te | 83 +
policy/modules/services/sasl.te | 15
policy/modules/services/sendmail.if | 137 ++
policy/modules/services/sendmail.te | 87 +
policy/modules/services/setroubleshoot.fc | 2
policy/modules/services/setroubleshoot.if | 84 +
policy/modules/services/setroubleshoot.te | 60
policy/modules/services/shorewall.fc | 12
policy/modules/services/shorewall.if | 166 ++
policy/modules/services/shorewall.te | 95 +
policy/modules/services/smartmon.te | 12
policy/modules/services/spamassassin.fc | 14
policy/modules/services/spamassassin.if | 68 +
policy/modules/services/spamassassin.te | 129 +
policy/modules/services/squid.te | 9
policy/modules/services/ssh.fc | 2
policy/modules/services/ssh.if | 183 ++
policy/modules/services/ssh.te | 70 -
policy/modules/services/sssd.fc | 2
policy/modules/services/sssd.if | 43
policy/modules/services/sysstat.te | 2
policy/modules/services/uucp.te | 7
policy/modules/services/virt.fc | 11
policy/modules/services/virt.if | 131 +-
policy/modules/services/virt.te | 271 +++-
policy/modules/services/w3c.te | 7
policy/modules/services/xserver.fc | 29
policy/modules/services/xserver.if | 538 +++++++-
policy/modules/services/xserver.te | 306 +++-
policy/modules/system/application.if | 20
policy/modules/system/application.te | 11
policy/modules/system/authlogin.fc | 9
policy/modules/system/authlogin.if | 204 ++-
policy/modules/system/authlogin.te | 39
policy/modules/system/clock.te | 8
policy/modules/system/fstools.fc | 2
policy/modules/system/fstools.te | 67 -
policy/modules/system/getty.te | 16
policy/modules/system/hostname.te | 22
policy/modules/system/init.fc | 6
policy/modules/system/init.if | 156 ++
policy/modules/system/init.te | 268 +++-
policy/modules/system/ipsec.fc | 2
policy/modules/system/ipsec.if | 25
policy/modules/system/ipsec.te | 97 +
policy/modules/system/iptables.fc | 11
policy/modules/system/iptables.te | 5
policy/modules/system/iscsi.if | 40
policy/modules/system/iscsi.te | 6
policy/modules/system/kdump.fc | 8
policy/modules/system/kdump.if | 111 +
policy/modules/system/kdump.te | 38
policy/modules/system/libraries.fc | 153 +-
policy/modules/system/libraries.if | 4
policy/modules/system/libraries.te | 16
policy/modules/system/locallogin.te | 74 -
policy/modules/system/logging.fc | 11
policy/modules/system/logging.if | 4
policy/modules/system/logging.te | 34
policy/modules/system/lvm.te | 53
policy/modules/system/miscfiles.if | 19
policy/modules/system/modutils.te | 167 +-
policy/modules/system/mount.fc | 7
policy/modules/system/mount.te | 124 +
policy/modules/system/pcmcia.te | 19
policy/modules/system/raid.te | 27
policy/modules/system/selinuxutil.fc | 17
policy/modules/system/selinuxutil.if | 288 ++++
policy/modules/system/selinuxutil.te | 228 +--
policy/modules/system/setrans.if | 20
policy/modules/system/sysnetwork.fc | 9
policy/modules/system/sysnetwork.if | 117 +
policy/modules/system/sysnetwork.te | 107 +
policy/modules/system/udev.fc | 3
policy/modules/system/udev.if | 21
policy/modules/system/udev.te | 38
policy/modules/system/unconfined.fc | 15
policy/modules/system/unconfined.if | 446 ------
policy/modules/system/unconfined.te | 224 ---
policy/modules/system/userdomain.fc | 6
policy/modules/system/userdomain.if | 1374 ++++++++++++++++-----
policy/modules/system/userdomain.te | 50
policy/modules/system/xen.fc | 6
policy/modules/system/xen.if | 28
policy/modules/system/xen.te | 137 +-
policy/support/obj_perm_sets.spt | 14
policy/users | 13
support/Makefile.devel | 3
support/divert.m4 | 1
support/undivert.m4 | 1
341 files changed, 14748 insertions(+), 2987 deletions(-)
Index: policy-F12.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-F12.patch,v
retrieving revision 1.63
retrieving revision 1.64
diff -u -p -r1.63 -r1.64
--- policy-F12.patch 26 Aug 2009 14:02:26 -0000 1.63
+++ policy-F12.patch 26 Aug 2009 20:19:01 -0000 1.64
@@ -3604,8 +3604,8 @@ diff -b -B --ignore-all-space --exclude-
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te
--- nsaserefpolicy/policy/modules/apps/pulseaudio.te 2009-07-23 14:11:04.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te 2009-08-26 08:11:55.000000000 -0400
-@@ -22,7 +22,11 @@
++++ serefpolicy-3.6.28/policy/modules/apps/pulseaudio.te 2009-08-26 11:42:50.000000000 -0400
+@@ -22,7 +22,12 @@
allow pulseaudio_t self:unix_dgram_socket { sendto create_socket_perms };
allow pulseaudio_t self:tcp_socket create_stream_socket_perms;
allow pulseaudio_t self:udp_socket create_socket_perms;
@@ -3613,11 +3613,12 @@ diff -b -B --ignore-all-space --exclude-
+can_exec(pulseaudio_t, pulseaudio_exec_t)
+
++kernel_getattr_proc(pulseaudio_t)
+kernel_read_system_state(pulseaudio_t)
kernel_read_kernel_sysctls(pulseaudio_t)
corecmd_exec_bin(pulseaudio_t)
-@@ -47,6 +51,7 @@
+@@ -47,6 +52,7 @@
fs_rw_anon_inodefs_files(pulseaudio_t)
fs_getattr_tmpfs(pulseaudio_t)
@@ -3625,7 +3626,7 @@ diff -b -B --ignore-all-space --exclude-
term_use_all_user_ttys(pulseaudio_t)
term_use_all_user_ptys(pulseaudio_t)
-@@ -78,6 +83,15 @@
+@@ -78,6 +84,15 @@
policykit_domtrans_auth(pulseaudio_t)
policykit_read_lib(pulseaudio_t)
policykit_read_reload(pulseaudio_t)
@@ -3641,7 +3642,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -85,8 +99,7 @@
+@@ -85,8 +100,7 @@
')
optional_policy(`
@@ -4155,8 +4156,8 @@ diff -b -B --ignore-all-space --exclude-
+# No types are sandbox_exec_t
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.if serefpolicy-3.6.28/policy/modules/apps/sandbox.if
--- nsaserefpolicy/policy/modules/apps/sandbox.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.28/policy/modules/apps/sandbox.if 2009-08-21 18:56:07.000000000 -0400
-@@ -0,0 +1,143 @@
++++ serefpolicy-3.6.28/policy/modules/apps/sandbox.if 2009-08-26 15:34:36.000000000 -0400
+@@ -0,0 +1,167 @@
+
+## <summary>policy for sandbox</summary>
+
@@ -4180,12 +4181,27 @@ diff -b -B --ignore-all-space --exclude-
+ gen_require(`
+ type sandbox_xserver_t;
+ attribute sandbox_domain;
++ attribute sandbox_x_domain;
++ attribute sandbox_file_type;
+ ')
+
+ allow $1 sandbox_domain:process transition;
+ dontaudit $1 sandbox_domain:process { noatsecure siginh rlimitinh };
+ role $2 types sandbox_domain;
++ allow sandbox_domain $1:process sigchld;
++
++ allow $1 sandbox_x_domain:process transition;
++ dontaudit $1 sandbox_x_domain:process { noatsecure siginh rlimitinh };
++ role $2 types sandbox_x_domain;
+ role $2 types sandbox_xserver_t;
++ allow sandbox_x_domain $1:process sigchld;
++
++ manage_files_pattern($1, sandbox_file_type, sandbox_file_type);
++ manage_dirs_pattern($1, sandbox_file_type, sandbox_file_type);
++ manage_sock_files_pattern($1, sandbox_file_type, sandbox_file_type);
++ manage_fifo_files_pattern($1, sandbox_file_type, sandbox_file_type);
++ manage_lnk_files_pattern($1, sandbox_file_type, sandbox_file_type);
++ allow $1 sandbox_file_type:dir relabelto;
+')
+
+########################################
@@ -4203,12 +4219,13 @@ diff -b -B --ignore-all-space --exclude-
+
+ gen_require(`
+ attribute sandbox_domain;
++ attribute sandbox_file_type;
+ ')
+
+ type $1_t, sandbox_domain;
+ domain_type($1_t)
+
-+ type $1_file_t;
++ type $1_file_t, sandbox_file_type;
+ files_type($1_file_t)
+
+ can_exec($1_t, $1_file_t)
@@ -4237,16 +4254,24 @@ diff -b -B --ignore-all-space --exclude-
+ attribute sandbox_domain, sandbox_x_domain;
+ ')
+
-+ sandbox_domain_template($1)
++ type $1_t, sandbox_x_domain;
++ domain_type($1_t)
+
-+
-+ typeattribute $1_t sandbox_x_domain;
++ type $1_file_t, sandbox_file_type;
++ files_type($1_file_t)
++
++ can_exec($1_t, $1_file_t)
++ manage_dirs_pattern($1_t, $1_file_t, $1_file_t)
++ manage_files_pattern($1_t, $1_file_t, $1_file_t)
++ manage_lnk_files_pattern($1_t, $1_file_t, $1_file_t)
++ manage_fifo_files_pattern($1_t, $1_file_t, $1_file_t)
++ manage_sock_files_pattern($1_t, $1_file_t, $1_file_t)
+
+ # window manager
+ miscfiles_setattr_fonts($1_t)
+ allow $1_t self:capability setuid;
+
-+ type $1_client_t, sandbox_x_domain, sandbox_domain;
++ type $1_client_t, sandbox_x_domain;
+ domain_type($1_client_t)
+
+ type $1_client_tmpfs_t;
@@ -4302,12 +4327,13 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.te serefpolicy-3.6.28/policy/modules/apps/sandbox.te
--- nsaserefpolicy/policy/modules/apps/sandbox.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.28/policy/modules/apps/sandbox.te 2009-08-21 18:56:07.000000000 -0400
-@@ -0,0 +1,274 @@
++++ serefpolicy-3.6.28/policy/modules/apps/sandbox.te 2009-08-26 16:12:59.000000000 -0400
+@@ -0,0 +1,302 @@
+policy_module(sandbox,1.0.0)
+dbus_stub()
+attribute sandbox_domain;
+attribute sandbox_x_domain;
++attribute sandbox_file_type;
+
+########################################
+#
@@ -4337,7 +4363,7 @@ diff -b -B --ignore-all-space --exclude-
+#
+allow sandbox_xserver_t self:fifo_file manage_fifo_file_perms;
+allow sandbox_xserver_t self:shm create_shm_perms;
-+allow sandbox_xserver_t self:tcp_socket create_socket_perms;
++allow sandbox_xserver_t self:tcp_socket create_stream_socket_perms;
+
+manage_dirs_pattern(sandbox_xserver_t, sandbox_xserver_tmpfs_t, sandbox_xserver_tmpfs_t)
+manage_files_pattern(sandbox_xserver_t, sandbox_xserver_tmpfs_t, sandbox_xserver_tmpfs_t)
@@ -4392,10 +4418,15 @@ diff -b -B --ignore-all-space --exclude-
+#
+
+## internal communication is often done using fifo and unix sockets.
-+allow sandbox_domain self:fifo_file rw_file_perms;
++allow sandbox_domain self:fifo_file manage_file_perms;
+allow sandbox_domain self:unix_stream_socket create_stream_socket_perms;
+
-+files_rw_all_inherited_files(sandbox_domain)
++gen_require(`
++ type usr_t, lib_t, locale_t;
++ attribute exec_type;
++')
++
++files_rw_all_inherited_files(sandbox_domain, -exec_type -usr_t -lib_t -locale_t )
+files_entrypoint_all_files(sandbox_domain)
+
+miscfiles_read_localization(sandbox_domain)
@@ -4403,11 +4434,16 @@ diff -b -B --ignore-all-space --exclude-
+kernel_dontaudit_read_system_state(sandbox_domain)
+corecmd_exec_all_executables(sandbox_domain)
+
++userdom_dontaudit_use_user_terminals(sandbox_domain)
+
+########################################
+#
+# sandbox_x_domain local policy
+#
++## internal communication is often done using fifo and unix sockets.
++allow sandbox_x_domain self:fifo_file manage_file_perms;
++allow sandbox_x_domain self:unix_stream_socket create_stream_socket_perms;
++
+allow sandbox_x_domain self:process { signal_perms getsched setpgid };
+allow sandbox_x_domain self:shm create_shm_perms;
+allow sandbox_x_domain self:unix_stream_socket { connectto create_stream_socket_perms };
@@ -4415,20 +4451,32 @@ diff -b -B --ignore-all-space --exclude-
+allow sandbox_x_domain sandbox_xserver_t:unix_stream_socket connectto;
+dontaudit sandbox_x_domain self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
+
++files_search_home(sandbox_x_domain)
++
++kernel_read_system_state(sandbox_x_domain)
++
++corecmd_exec_all_executables(sandbox_x_domain)
++
++
+dev_read_urand(sandbox_x_domain)
+dev_dontaudit_read_rand(sandbox_x_domain)
+
++files_entrypoint_all_files(sandbox_x_domain)
+files_read_etc_files(sandbox_x_domain)
+files_read_usr_files(sandbox_x_domain)
+files_read_usr_symlinks(sandbox_x_domain)
+
+fs_getattr_tmpfs(sandbox_x_domain)
+fs_getattr_xattr_fs(sandbox_x_domain)
++fs_list_inotifyfs(sandbox_x_domain)
+
+auth_dontaudit_read_login_records(sandbox_x_domain)
++auth_use_nsswitch(sandbox_x_domain)
+
+init_read_utmp(sandbox_x_domain)
+
++miscfiles_read_localization(sandbox_x_domain)
++
+term_getattr_pty_fs(sandbox_x_domain)
+term_use_ptmx(sandbox_x_domain)
+
@@ -4445,6 +4493,11 @@ diff -b -B --ignore-all-space --exclude-
+ cups_read_rw_config(sandbox_x_domain)
+')
+
++#============= sandbox_x_t ==============
++allow sandbox_x_t home_root_t:dir search;
++allow sandbox_x_t user_devpts_t:chr_file { read write };
++
++
+########################################
+#
+# sandbox_x_client_t local policy
@@ -4623,6 +4676,133 @@ diff -b -B --ignore-all-space --exclude-
+ manage_lnk_files_pattern($1,screen_var_run_t,screen_var_run_t)
+ manage_fifo_files_pattern($1,screen_var_run_t,screen_var_run_t)
+')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshare.fc serefpolicy-3.6.28/policy/modules/apps/seunshare.fc
+--- nsaserefpolicy/policy/modules/apps/seunshare.fc 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.6.28/policy/modules/apps/seunshare.fc 2009-08-26 11:10:13.000000000 -0400
+@@ -0,0 +1,2 @@
++
++/usr/sbin/seunshare -- gen_context(system_u:object_r:seunshare_exec_t,s0)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshare.if serefpolicy-3.6.28/policy/modules/apps/seunshare.if
+--- nsaserefpolicy/policy/modules/apps/seunshare.if 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.6.28/policy/modules/apps/seunshare.if 2009-08-26 11:46:03.000000000 -0400
+@@ -0,0 +1,76 @@
++
++## <summary>policy for seunshare</summary>
++
++########################################
++## <summary>
++## Execute a domain transition to run seunshare.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`seunshare_domtrans',`
++ gen_require(`
++ type seunshare_t;
++ type seunshare_exec_t;
++ ')
++
++ domtrans_pattern($1,seunshare_exec_t,seunshare_t)
++')
++
++
++########################################
++## <summary>
++## Execute seunshare in the seunshare domain, and
++## allow the specified role the seunshare domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access
++## </summary>
++## </param>
++## <param name="role">
++## <summary>
++## The role to be allowed the seunshare domain.
++## </summary>
++## </param>
++#
++interface(`seunshare_run',`
++ gen_require(`
++ type seunshare_t;
++ ')
++
++ seunshare_domtrans($1)
++ sandbox_transition(seunshare_t, $2)
++ role $2 types seunshare_t;
++')
++
++########################################
++## <summary>
++## Role access for seunshare
++## </summary>
++## <param name="role">
++## <summary>
++## Role allowed access
++## </summary>
++## </param>
++## <param name="domain">
++## <summary>
++## User domain for the role
++## </summary>
++## </param>
++#
++interface(`seunshare_role',`
++ gen_require(`
++ type seunshare_t;
++ ')
++
++ role $2 types seunshare_t;
++
++ seunshare_domtrans($1)
++
++ ps_process_pattern($2, seunshare_t)
++ allow $2 seunshare_t:process signal;
++')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/seunshare.te serefpolicy-3.6.28/policy/modules/apps/seunshare.te
+--- nsaserefpolicy/policy/modules/apps/seunshare.te 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.6.28/policy/modules/apps/seunshare.te 2009-08-26 16:07:56.000000000 -0400
+@@ -0,0 +1,37 @@
++policy_module(seunshare,1.0.0)
++
++########################################
++#
++# Declarations
++#
++
++type seunshare_t;
++type seunshare_exec_t;
++application_domain(seunshare_t, seunshare_exec_t)
++role system_r types seunshare_t;
++
++permissive seunshare_t;
++
++########################################
++#
++# seunshare local policy
++#
++
++allow seunshare_t self:process { fork setexec signal };
++allow seunshare_t self:capability setpcap;
++allow seunshare_t self:process { getcap setcap };
++
++allow seunshare_t self:fifo_file rw_file_perms;
++allow seunshare_t self:unix_stream_socket create_stream_socket_perms;
++
++files_read_etc_files(seunshare_t)
++files_mounton_all_poly_members(seunshare_t)
++
++corecmd_exec_shell(seunshare_t)
++corecmd_exec_bin(seunshare_t)
++
++auth_use_nsswitch(seunshare_t)
++
++miscfiles_read_localization(seunshare_t)
++
++userdom_use_user_terminals(seunshare_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.6.28/policy/modules/apps/vmware.fc
--- nsaserefpolicy/policy/modules/apps/vmware.fc 2009-07-28 13:28:33.000000000 -0400
+++ serefpolicy-3.6.28/policy/modules/apps/vmware.fc 2009-08-21 18:56:07.000000000 -0400
@@ -4795,7 +4975,7 @@ diff -b -B --ignore-all-space --exclude-
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.6.28/policy/modules/kernel/corecommands.fc
--- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2009-07-30 13:09:10.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/kernel/corecommands.fc 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/corecommands.fc 2009-08-26 13:56:26.000000000 -0400
@@ -54,6 +54,7 @@
/etc/cron.weekly/.* -- gen_context(system_u:object_r:bin_t,s0)
/etc/cron.monthly/.* -- gen_context(system_u:object_r:bin_t,s0)
@@ -4822,7 +5002,15 @@ diff -b -B --ignore-all-space --exclude-
#
# /usr
#
-@@ -315,3 +320,21 @@
+@@ -221,6 +226,7 @@
+ /usr/share/PackageKit/pk-upgrade-distro\.sh -- gen_context(system_u:object_r:bin_t,s0)
+ /usr/share/PackageKit/helpers(/.*)? gen_context(system_u:object_r:bin_t,s0)
+ /usr/share/selinux/devel/policygentool -- gen_context(system_u:object_r:bin_t,s0)
++/usr/share/sandbox/sandboxX.sh -- gen_context(system_u:object_r:bin_t,s0)
+ /usr/share/shorewall/configpath -- gen_context(system_u:object_r:bin_t,s0)
+ /usr/share/shorewall-perl(/.*)? gen_context(system_u:object_r:bin_t,s0)
+ /usr/share/shorewall-shell(/.*)? gen_context(system_u:object_r:bin_t,s0)
+@@ -315,3 +321,21 @@
ifdef(`distro_suse',`
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
')
@@ -5582,7 +5770,7 @@ diff -b -B --ignore-all-space --exclude-
/var/lib/nfs/rpc_pipefs(/.*)? <<none>>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.6.28/policy/modules/kernel/files.if
--- nsaserefpolicy/policy/modules/kernel/files.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/kernel/files.if 2009-08-22 09:30:11.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/kernel/files.if 2009-08-26 15:56:29.000000000 -0400
@@ -110,6 +110,11 @@
## </param>
#
@@ -5957,11 +6145,11 @@ diff -b -B --ignore-all-space --exclude-
+ attribute file_type;
+ ')
+
-+ allow $1 file_type:dir search_dir_perms;
-+ allow $1 file_type:file { getattr read write append lock };
-+ allow $1 file_type:fifo_file { getattr read write append ioctl lock };
-+ allow $1 file_type:sock_file { getattr read write append ioctl lock };
-+ allow $1 file_type:chr_file { getattr read write append ioctl lock };
++ allow $1 { file_type $2 }:dir search_dir_perms;
++ allow $1 { file_type $2 }:file { getattr read write append lock };
++ allow $1 { file_type $2 }:fifo_file { getattr read write append ioctl lock };
++ allow $1 { file_type $2 }:sock_file { getattr read write append ioctl lock };
++ allow $1 { file_type $2 }:chr_file { getattr read write append ioctl lock };
+')
+
+########################################
@@ -15176,7 +15364,7 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.te serefpolicy-3.6.28/policy/modules/services/postgresql.te
--- nsaserefpolicy/policy/modules/services/postgresql.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/services/postgresql.te 2009-08-21 18:56:07.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/services/postgresql.te 2009-08-26 14:57:08.000000000 -0400
@@ -32,6 +32,9 @@
type postgresql_etc_t;
files_config_file(postgresql_etc_t)
@@ -15207,7 +15395,13 @@ diff -b -B --ignore-all-space --exclude-
corenet_sendrecv_postgresql_server_packets(postgresql_t)
corenet_sendrecv_auth_client_packets(postgresql_t)
-@@ -247,6 +253,7 @@
+@@ -242,11 +248,12 @@
+ files_read_etc_runtime_files(postgresql_t)
+ files_read_usr_files(postgresql_t)
+
+-auth_use_nsswitch(postgresql_t)
++auth_use_pam(postgresql_t)
+
init_read_utmp(postgresql_t)
logging_send_syslog_msg(postgresql_t)
@@ -26139,7 +26333,7 @@ diff -b -B --ignore-all-space --exclude-
+HOME_DIR/\.gvfs(/.*)? <<none>>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.28/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-07-28 13:28:33.000000000 -0400
-+++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-25 09:28:37.000000000 -0400
++++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-26 16:12:51.000000000 -0400
@@ -30,8 +30,9 @@
')
@@ -26584,7 +26778,7 @@ diff -b -B --ignore-all-space --exclude-
##############################
#
-@@ -511,182 +525,195 @@
+@@ -511,182 +525,203 @@
# evolution and gnome-session try to create a netlink socket
dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
@@ -26695,157 +26889,163 @@ diff -b -B --ignore-all-space --exclude-
tunable_policy(`user_direct_mouse',`
- dev_read_mouse($1_t)
-- ')
--
++ dev_read_mouse($1_usertype)
+ ')
+
- tunable_policy(`user_ttyfile_stat',`
- term_getattr_all_user_ttys($1_t)
-+ dev_read_mouse($1_usertype)
++ optional_policy(`
++ alsa_read_rw_config($1_usertype)
')
optional_policy(`
- alsa_read_rw_config($1_t)
-+ alsa_read_rw_config($1_usertype)
++ # Allow graphical boot to check battery lifespan
++ apm_stream_connect($1_usertype)
')
optional_policy(`
- # Allow graphical boot to check battery lifespan
+- # Allow graphical boot to check battery lifespan
- apm_stream_connect($1_t)
-+ apm_stream_connect($1_usertype)
++ canna_stream_connect($1_usertype)
++ ')
++
++ optional_policy(`
++ dbus_system_bus_client($1_usertype)
++
++ allow $1_usertype $1_usertype:dbus send_msg;
++
++ optional_policy(`
++ avahi_dbus_chat($1_usertype)
')
optional_policy(`
- canna_stream_connect($1_t)
-+ canna_stream_connect($1_usertype)
++ bluetooth_dbus_chat($1_usertype)
')
optional_policy(`
- dbus_system_bus_client($1_t)
-+ dbus_system_bus_client($1_usertype)
-+
-+ allow $1_usertype $1_usertype:dbus send_msg;
++ consolekit_dbus_chat($1_usertype)
++ consolekit_read_log($1_usertype)
++ ')
optional_policy(`
- bluetooth_dbus_chat($1_t)
-+ avahi_dbus_chat($1_usertype)
++ devicekit_dbus_chat($1_usertype)
++ devicekit_dbus_chat_disk($1_usertype)
++ devicekit_dbus_chat_power($1_usertype)
')
optional_policy(`
- evolution_dbus_chat($1_t)
- evolution_alarm_dbus_chat($1_t)
-+ bluetooth_dbus_chat($1_usertype)
++ evolution_dbus_chat($1_usertype)
++ evolution_alarm_dbus_chat($1_usertype)
')
optional_policy(`
- cups_dbus_chat_config($1_t)
-+ consolekit_dbus_chat($1_usertype)
-+ consolekit_read_log($1_usertype)
++ hal_dbus_chat($1_usertype)
')
optional_policy(`
- hal_dbus_chat($1_t)
-+ devicekit_dbus_chat($1_usertype)
-+ devicekit_dbus_chat_disk($1_usertype)
-+ devicekit_dbus_chat_power($1_usertype)
++ networkmanager_dbus_chat($1_usertype)
')
optional_policy(`
- networkmanager_dbus_chat($1_t)
-- ')
-+ evolution_dbus_chat($1_usertype)
-+ evolution_alarm_dbus_chat($1_usertype)
++ vpnc_dbus_chat($1_usertype)
+ ')
')
optional_policy(`
- inetd_use_fds($1_t)
- inetd_rw_tcp_sockets($1_t)
-+ hal_dbus_chat($1_usertype)
++ inetd_use_fds($1_usertype)
++ inetd_rw_tcp_sockets($1_usertype)
')
optional_policy(`
- inn_read_config($1_t)
- inn_read_news_lib($1_t)
- inn_read_news_spool($1_t)
-+ networkmanager_dbus_chat($1_usertype)
++ inn_read_config($1_usertype)
++ inn_read_news_lib($1_usertype)
++ inn_read_news_spool($1_usertype)
')
optional_policy(`
- locate_read_lib_files($1_t)
-+ vpnc_dbus_chat($1_usertype)
-+ ')
++ locate_read_lib_files($1_usertype)
')
-- # for running depmod as part of the kernel packaging process
+ # for running depmod as part of the kernel packaging process
optional_policy(`
- modutils_read_module_config($1_t)
-+ inetd_use_fds($1_usertype)
-+ inetd_rw_tcp_sockets($1_usertype)
++ modutils_read_module_config($1_usertype)
++ ')
++
++ optional_policy(`
++ mta_rw_spool($1_usertype)
++ mta_manage_queue($1_usertype)
')
optional_policy(`
- mta_rw_spool($1_t)
-+ inn_read_config($1_usertype)
-+ inn_read_news_lib($1_usertype)
-+ inn_read_news_spool($1_usertype)
++ nsplugin_role($1_r, $1_usertype)
')
optional_policy(`
- tunable_policy(`allow_user_mysql_connect',`
- mysql_stream_connect($1_t)
-+ locate_read_lib_files($1_usertype)
++ tunable_policy(`allow_user_postgresql_connect',`
++ postgresql_stream_connect($1_usertype)
')
-+
-+ # for running depmod as part of the kernel packaging process
-+ optional_policy(`
-+ modutils_read_module_config($1_usertype)
')
optional_policy(`
-- # to allow monitoring of pcmcia status
+ # to allow monitoring of pcmcia status
- pcmcia_read_pid($1_t)
-+ mta_rw_spool($1_usertype)
-+ mta_manage_queue($1_usertype)
++ pcmcia_read_pid($1_usertype)
')
optional_policy(`
- pcscd_read_pub_files($1_t)
- pcscd_stream_connect($1_t)
-+ nsplugin_role($1_r, $1_usertype)
++ pcscd_read_pub_files($1_usertype)
++ pcscd_stream_connect($1_usertype)
')
optional_policy(`
- tunable_policy(`allow_user_postgresql_connect',`
+- tunable_policy(`allow_user_postgresql_connect',`
- postgresql_stream_connect($1_t)
- postgresql_tcp_connect($1_t)
-+ postgresql_stream_connect($1_usertype)
-+ ')
- ')
-+
-+ optional_policy(`
-+ # to allow monitoring of pcmcia status
-+ pcmcia_read_pid($1_usertype)
+- ')
++ resmgr_stream_connect($1_usertype)
')
optional_policy(`
- resmgr_stream_connect($1_t)
-+ pcscd_read_pub_files($1_usertype)
-+ pcscd_stream_connect($1_usertype)
++ rpc_dontaudit_getattr_exports($1_usertype)
++ rpc_manage_nfs_rw_content($1_usertype)
')
optional_policy(`
- rpc_dontaudit_getattr_exports($1_t)
- rpc_manage_nfs_rw_content($1_t)
-+ resmgr_stream_connect($1_usertype)
++ samba_stream_connect_winbind($1_usertype)
')
optional_policy(`
- samba_stream_connect_winbind($1_t)
-+ rpc_dontaudit_getattr_exports($1_usertype)
-+ rpc_manage_nfs_rw_content($1_usertype)
++ sandbox_transition($1_t, $1_r)
')
optional_policy(`
- slrnpull_search_spool($1_t)
-+ samba_stream_connect_winbind($1_usertype)
++ seunshare_run($1_t, $1_r)
')
optional_policy(`
@@ -26856,23 +27056,21 @@ diff -b -B --ignore-all-space --exclude-
')
#######################################
-@@ -714,13 +741,26 @@
+@@ -714,13 +749,26 @@
userdom_base_user_template($1)
- userdom_manage_home_role($1_r, $1_t)
+ userdom_manage_home_role($1_r, $1_usertype)
-
-- userdom_manage_tmp_role($1_r, $1_t)
-- userdom_manage_tmpfs_role($1_r, $1_t)
++
+ userdom_manage_tmp_role($1_r, $1_usertype)
+ userdom_manage_tmpfs_role($1_r, $1_usertype)
-
-- userdom_exec_user_tmp_files($1_t)
-- userdom_exec_user_home_content_files($1_t)
++
+ ifelse(`$1',`unconfined',`',`
+ gen_tunable(allow_$1_exec_content, true)
-+
+
+- userdom_manage_tmp_role($1_r, $1_t)
+- userdom_manage_tmpfs_role($1_r, $1_t)
+ tunable_policy(`allow_$1_exec_content',`
+ userdom_exec_user_tmp_files($1_usertype)
+ userdom_exec_user_home_content_files($1_usertype)
@@ -26880,7 +27078,9 @@ diff -b -B --ignore-all-space --exclude-
+ tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
+ fs_exec_nfs_files($1_usertype)
+ ')
-+
+
+- userdom_exec_user_tmp_files($1_t)
+- userdom_exec_user_home_content_files($1_t)
+ tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
+ fs_exec_cifs_files($1_usertype)
+ ')
@@ -26888,7 +27088,7 @@ diff -b -B --ignore-all-space --exclude-
userdom_change_password_template($1)
-@@ -738,70 +778,71 @@
+@@ -738,70 +786,71 @@
allow $1_t self:context contains;
@@ -26993,7 +27193,7 @@ diff -b -B --ignore-all-space --exclude-
')
')
-@@ -838,6 +879,28 @@
+@@ -838,6 +887,28 @@
# Local policy
#
@@ -27022,7 +27222,7 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
loadkeys_run($1_t,$1_r)
')
-@@ -868,7 +931,10 @@
+@@ -868,7 +939,10 @@
userdom_restricted_user_template($1)
@@ -27034,7 +27234,7 @@ diff -b -B --ignore-all-space --exclude-
##############################
#
-@@ -876,14 +942,19 @@
+@@ -876,14 +950,19 @@
#
auth_role($1_r, $1_t)
@@ -27059,7 +27259,7 @@ diff -b -B --ignore-all-space --exclude-
logging_dontaudit_send_audit_msgs($1_t)
# Need to to this just so screensaver will work. Should be moved to screensaver domain
-@@ -891,28 +962,47 @@
+@@ -891,28 +970,47 @@
selinux_get_enforce_mode($1_t)
optional_policy(`
@@ -27075,15 +27275,15 @@ diff -b -B --ignore-all-space --exclude-
+ devicekit_dbus_chat($1_usertype)
+ devicekit_dbus_chat_disk($1_usertype)
+ devicekit_dbus_chat_power($1_usertype)
++ ')
++
++ optional_policy(`
++ fprintd_dbus_chat($1_t)
')
optional_policy(`
- dbus_role_template($1, $1_r, $1_t)
- dbus_system_bus_client($1_t)
-+ fprintd_dbus_chat($1_t)
-+ ')
-+
-+ optional_policy(`
+ gnomeclock_dbus_chat($1_t)
+ ')
@@ -27114,7 +27314,7 @@ diff -b -B --ignore-all-space --exclude-
')
')
-@@ -946,8 +1036,8 @@
+@@ -946,8 +1044,8 @@
# Declarations
#
@@ -27124,7 +27324,7 @@ diff -b -B --ignore-all-space --exclude-
userdom_common_user_template($1)
##############################
-@@ -956,11 +1046,12 @@
+@@ -956,11 +1054,12 @@
#
# port access is audited even if dac would not have allowed it, so dontaudit it here
@@ -27139,7 +27339,7 @@ diff -b -B --ignore-all-space --exclude-
# cjp: why?
files_read_kernel_symbol_table($1_t)
-@@ -978,36 +1069,53 @@
+@@ -978,36 +1077,53 @@
')
')
@@ -27207,7 +27407,7 @@ diff -b -B --ignore-all-space --exclude-
')
')
-@@ -1042,7 +1150,7 @@
+@@ -1042,7 +1158,7 @@
#
template(`userdom_admin_user_template',`
gen_require(`
@@ -27216,7 +27416,7 @@ diff -b -B --ignore-all-space --exclude-
')
##############################
-@@ -1051,8 +1159,7 @@
+@@ -1051,8 +1167,7 @@
#
# Inherit rules for ordinary users.
@@ -27226,7 +27426,7 @@ diff -b -B --ignore-all-space --exclude-
domain_obj_id_change_exemption($1_t)
role system_r types $1_t;
-@@ -1075,7 +1182,8 @@
+@@ -1075,7 +1190,8 @@
# Skip authentication when pam_rootok is specified.
allow $1_t self:passwd rootok;
@@ -27236,7 +27436,7 @@ diff -b -B --ignore-all-space --exclude-
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
-@@ -1091,6 +1199,7 @@
+@@ -1091,6 +1207,7 @@
kernel_sigstop_unlabeled($1_t)
kernel_signull_unlabeled($1_t)
kernel_sigchld_unlabeled($1_t)
@@ -27244,7 +27444,7 @@ diff -b -B --ignore-all-space --exclude-
corenet_tcp_bind_generic_port($1_t)
# allow setting up tunnels
-@@ -1098,8 +1207,6 @@
+@@ -1098,8 +1215,6 @@
dev_getattr_generic_blk_files($1_t)
dev_getattr_generic_chr_files($1_t)
@@ -27253,7 +27453,7 @@ diff -b -B --ignore-all-space --exclude-
# Allow MAKEDEV to work
dev_create_all_blk_files($1_t)
dev_create_all_chr_files($1_t)
-@@ -1126,6 +1233,7 @@
+@@ -1126,6 +1241,7 @@
files_exec_usr_src_files($1_t)
fs_getattr_all_fs($1_t)
@@ -27261,7 +27461,7 @@ diff -b -B --ignore-all-space --exclude-
fs_set_all_quotas($1_t)
fs_exec_noxattr($1_t)
-@@ -1154,20 +1262,6 @@
+@@ -1154,20 +1270,6 @@
# But presently necessary for installing the file_contexts file.
seutil_manage_bin_policy($1_t)
@@ -27282,7 +27482,7 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
postgresql_unconfined($1_t)
')
-@@ -1213,6 +1307,7 @@
+@@ -1213,6 +1315,7 @@
dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1)
@@ -27290,7 +27490,7 @@ diff -b -B --ignore-all-space --exclude-
# Necessary for managing /boot/efi
fs_manage_dos_files($1)
-@@ -1278,11 +1373,15 @@
+@@ -1278,11 +1381,15 @@
interface(`userdom_user_home_content',`
gen_require(`
type user_home_t;
@@ -27306,7 +27506,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -1374,12 +1473,13 @@
+@@ -1374,12 +1481,13 @@
')
allow $1 user_home_dir_t:dir search_dir_perms;
@@ -27321,7 +27521,7 @@ diff -b -B --ignore-all-space --exclude-
## </summary>
## <param name="domain">
## <summary>
-@@ -1412,6 +1512,14 @@
+@@ -1412,6 +1520,14 @@
allow $1 user_home_dir_t:dir list_dir_perms;
files_search_home($1)
@@ -27336,7 +27536,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -1427,9 +1535,11 @@
+@@ -1427,9 +1543,11 @@
interface(`userdom_dontaudit_list_user_home_dirs',`
gen_require(`
type user_home_dir_t;
@@ -27348,7 +27548,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -1486,6 +1596,25 @@
+@@ -1486,6 +1604,25 @@
allow $1 user_home_dir_t:dir relabelto;
')
@@ -27374,7 +27574,7 @@ diff -b -B --ignore-all-space --exclude-
########################################
## <summary>
## Create directories in the home dir root with
-@@ -1560,6 +1689,8 @@
+@@ -1560,6 +1697,8 @@
')
dontaudit $1 user_home_t:dir search_dir_perms;
@@ -27383,7 +27583,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -1653,6 +1784,7 @@
+@@ -1653,6 +1792,7 @@
type user_home_dir_t, user_home_t;
')
@@ -27391,7 +27591,7 @@ diff -b -B --ignore-all-space --exclude-
read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
files_search_home($1)
')
-@@ -1780,19 +1912,32 @@
+@@ -1780,19 +1920,32 @@
#
interface(`userdom_exec_user_home_content_files',`
gen_require(`
@@ -27431,7 +27631,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -1827,6 +1972,7 @@
+@@ -1827,6 +1980,7 @@
interface(`userdom_manage_user_home_content_files',`
gen_require(`
type user_home_dir_t, user_home_t;
@@ -27439,7 +27639,7 @@ diff -b -B --ignore-all-space --exclude-
')
manage_files_pattern($1, user_home_t, user_home_t)
-@@ -2374,7 +2520,7 @@
+@@ -2374,7 +2528,7 @@
########################################
## <summary>
@@ -27448,7 +27648,7 @@ diff -b -B --ignore-all-space --exclude-
## </summary>
## <param name="domain">
## <summary>
-@@ -2728,11 +2874,32 @@
+@@ -2728,11 +2882,32 @@
#
interface(`userdom_search_user_home_content',`
gen_require(`
@@ -27483,7 +27683,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -2860,7 +3027,25 @@
+@@ -2860,7 +3035,25 @@
type user_tmp_t;
')
@@ -27510,7 +27710,7 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
-@@ -2897,6 +3082,7 @@
+@@ -2897,6 +3090,7 @@
')
read_files_pattern($1, userdomain, userdomain)
@@ -27518,7 +27718,7 @@ diff -b -B --ignore-all-space --exclude-
kernel_search_proc($1)
')
-@@ -3027,3 +3213,559 @@
+@@ -3027,3 +3221,559 @@
allow $1 userdomain:dbus send_msg;
')
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.905
retrieving revision 1.906
diff -u -p -r1.905 -r1.906
--- selinux-policy.spec 26 Aug 2009 14:02:27 -0000 1.905
+++ selinux-policy.spec 26 Aug 2009 20:19:02 -0000 1.906
@@ -443,6 +443,7 @@ exit 0
%changelog
* Wed Aug 26 2009 Dan Walsh <dwalsh at redhat.com> 3.6.28-8
- Add back in unconfined.pp and unconfineduser.pp
+- Add Sandbox unshare
* Tue Aug 25 2009 Dan Walsh <dwalsh at redhat.com> 3.6.28-7
- Fixes for cdrecord, mdadm, and others
More information about the scm-commits
mailing list