rpms/selinux-policy/F-13 policy-F13.patch, 1.102, 1.103 selinux-policy.spec, 1.1006, 1.1007
Daniel J Walsh
dwalsh at fedoraproject.org
Wed Apr 28 21:49:30 UTC 2010
- Previous message: rpms/dogtag-pki-console-ui/EL-5 .cvsignore, 1.3, 1.4 dogtag-pki-console-ui.spec, 1.3, 1.4 import.log, 1.3, 1.4 sources, 1.3, 1.4
- Next message: rpms/pki-ca/EL-5 .cvsignore, 1.4, 1.5 import.log, 1.6, 1.7 pki-ca.spec, 1.6, 1.7 sources, 1.4, 1.5
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/F-13
In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv13748
Modified Files:
policy-F13.patch selinux-policy.spec
Log Message:
* Wed Apr 28 2010 Dan Walsh <dwalsh at redhat.com> 3.7.19-8
- Allow ksmtuned to use terminals
Resolves: #586663
- Allow lircd to write to generic usb devices
policy-F13.patch:
Makefile | 2
policy/global_tunables | 24
policy/mls | 1
policy/modules/admin/accountsd.fc | 4
policy/modules/admin/accountsd.if | 164 +++
policy/modules/admin/accountsd.te | 55 +
policy/modules/admin/acct.te | 1
policy/modules/admin/alsa.te | 2
policy/modules/admin/anaconda.te | 4
policy/modules/admin/certwatch.te | 2
policy/modules/admin/consoletype.if | 3
policy/modules/admin/consoletype.te | 1
policy/modules/admin/firstboot.te | 7
policy/modules/admin/kismet.te | 1
policy/modules/admin/logrotate.te | 42
policy/modules/admin/mcelog.te | 2
policy/modules/admin/mrtg.te | 1
policy/modules/admin/netutils.fc | 1
policy/modules/admin/netutils.te | 20
policy/modules/admin/prelink.fc | 4
policy/modules/admin/prelink.if | 28
policy/modules/admin/prelink.te | 78 +
policy/modules/admin/quota.te | 1
policy/modules/admin/readahead.te | 4
policy/modules/admin/rpm.fc | 21
policy/modules/admin/rpm.if | 387 +++++++
policy/modules/admin/rpm.te | 106 +-
policy/modules/admin/shorewall.te | 6
policy/modules/admin/shutdown.fc | 5
policy/modules/admin/shutdown.if | 118 ++
policy/modules/admin/shutdown.te | 57 +
policy/modules/admin/su.if | 11
policy/modules/admin/sudo.if | 9
policy/modules/admin/tmpreaper.te | 24
policy/modules/admin/usermanage.if | 20
policy/modules/admin/usermanage.te | 21
policy/modules/admin/vbetool.te | 6
policy/modules/admin/vpn.te | 8
policy/modules/apps/chrome.fc | 3
policy/modules/apps/chrome.if | 90 +
policy/modules/apps/chrome.te | 86 +
policy/modules/apps/cpufreqselector.te | 2
policy/modules/apps/execmem.fc | 47
policy/modules/apps/execmem.if | 110 ++
policy/modules/apps/execmem.te | 11
policy/modules/apps/firewallgui.fc | 3
policy/modules/apps/firewallgui.if | 23
policy/modules/apps/firewallgui.te | 66 +
policy/modules/apps/gitosis.if | 2
policy/modules/apps/gnome.fc | 24
policy/modules/apps/gnome.if | 438 ++++++++
policy/modules/apps/gnome.te | 116 ++
policy/modules/apps/gpg.fc | 1
policy/modules/apps/gpg.if | 77 +
policy/modules/apps/gpg.te | 114 ++
policy/modules/apps/irc.fc | 7
policy/modules/apps/irc.if | 37
policy/modules/apps/irc.te | 104 ++
policy/modules/apps/java.fc | 7
policy/modules/apps/java.if | 4
policy/modules/apps/java.te | 9
policy/modules/apps/kdumpgui.fc | 2
policy/modules/apps/kdumpgui.if | 2
policy/modules/apps/kdumpgui.te | 68 +
policy/modules/apps/livecd.fc | 2
policy/modules/apps/livecd.if | 108 ++
policy/modules/apps/livecd.te | 34
policy/modules/apps/loadkeys.if | 3
policy/modules/apps/loadkeys.te | 6
policy/modules/apps/mono.if | 5
policy/modules/apps/mozilla.fc | 2
policy/modules/apps/mozilla.if | 62 +
policy/modules/apps/mozilla.te | 22
policy/modules/apps/mplayer.if | 36
policy/modules/apps/mplayer.te | 29
policy/modules/apps/nsplugin.fc | 10
policy/modules/apps/nsplugin.if | 391 +++++++
policy/modules/apps/nsplugin.te | 297 +++++
policy/modules/apps/openoffice.fc | 3
policy/modules/apps/openoffice.if | 129 ++
policy/modules/apps/openoffice.te | 17
policy/modules/apps/podsleuth.te | 3
policy/modules/apps/pulseaudio.fc | 1
policy/modules/apps/pulseaudio.if | 39
policy/modules/apps/pulseaudio.te | 2
policy/modules/apps/qemu.if | 84 +
policy/modules/apps/qemu.te | 11
policy/modules/apps/sambagui.fc | 1
policy/modules/apps/sambagui.if | 2
policy/modules/apps/sambagui.te | 66 +
policy/modules/apps/sandbox.fc | 1
policy/modules/apps/sandbox.if | 287 +++++
policy/modules/apps/sandbox.te | 368 +++++++
policy/modules/apps/seunshare.if | 78 -
policy/modules/apps/seunshare.te | 35
policy/modules/apps/slocate.te | 4
policy/modules/apps/telepathysofiasip.fc | 2
policy/modules/apps/telepathysofiasip.if | 69 +
policy/modules/apps/telepathysofiasip.te | 45
policy/modules/apps/userhelper.fc | 1
policy/modules/apps/userhelper.if | 56 +
policy/modules/apps/userhelper.te | 42
policy/modules/apps/vmware.if | 19
policy/modules/apps/vmware.te | 13
policy/modules/apps/wine.fc | 1
policy/modules/apps/wine.if | 11
policy/modules/apps/wine.te | 22
policy/modules/apps/wm.if | 16
policy/modules/kernel/corecommands.fc | 31
policy/modules/kernel/corecommands.if | 2
policy/modules/kernel/corenetwork.te.in | 27
policy/modules/kernel/devices.fc | 1
policy/modules/kernel/devices.if | 91 +
policy/modules/kernel/devices.te | 12
policy/modules/kernel/domain.if | 63 +
policy/modules/kernel/domain.te | 109 ++
policy/modules/kernel/files.fc | 20
policy/modules/kernel/files.if | 653 ++++++++++++
policy/modules/kernel/files.te | 13
policy/modules/kernel/filesystem.if | 176 +++
policy/modules/kernel/filesystem.te | 11
policy/modules/kernel/kernel.if | 76 +
policy/modules/kernel/kernel.te | 34
policy/modules/kernel/selinux.if | 25
policy/modules/kernel/storage.if | 22
policy/modules/kernel/terminal.if | 29
policy/modules/roles/auditadm.te | 3
policy/modules/roles/guest.te | 6
policy/modules/roles/staff.te | 117 ++
policy/modules/roles/sysadm.te | 98 +
policy/modules/roles/unconfineduser.fc | 10
policy/modules/roles/unconfineduser.if | 667 ++++++++++++
policy/modules/roles/unconfineduser.te | 433 ++++++++
policy/modules/roles/unprivuser.te | 23
policy/modules/roles/xguest.te | 72 +
policy/modules/services/abrt.fc | 8
policy/modules/services/abrt.if | 143 ++
policy/modules/services/abrt.te | 157 ++-
policy/modules/services/afs.te | 5
policy/modules/services/aiccu.fc | 5
policy/modules/services/aiccu.if | 119 ++
policy/modules/services/aiccu.te | 41
policy/modules/services/aisexec.fc | 10
policy/modules/services/aisexec.if | 106 ++
policy/modules/services/aisexec.te | 115 ++
policy/modules/services/apache.fc | 16
policy/modules/services/apache.if | 142 ++
policy/modules/services/apache.te | 230 ++++
policy/modules/services/apcupsd.te | 4
policy/modules/services/arpwatch.te | 4
policy/modules/services/asterisk.if | 19
policy/modules/services/asterisk.te | 45
policy/modules/services/automount.te | 1
policy/modules/services/avahi.if | 1
policy/modules/services/boinc.fc | 6
policy/modules/services/boinc.if | 151 ++
policy/modules/services/boinc.te | 92 +
policy/modules/services/bugzilla.fc | 4
policy/modules/services/bugzilla.if | 39
policy/modules/services/bugzilla.te | 57 +
policy/modules/services/cachefilesd.fc | 29
policy/modules/services/cachefilesd.if | 41
policy/modules/services/cachefilesd.te | 147 ++
policy/modules/services/ccs.te | 10
policy/modules/services/certmonger.fc | 6
policy/modules/services/certmonger.if | 217 ++++
policy/modules/services/certmonger.te | 74 +
policy/modules/services/cgroup.fc | 9
policy/modules/services/cgroup.if | 35
policy/modules/services/cgroup.te | 87 +
policy/modules/services/clamav.te | 19
policy/modules/services/clogd.fc | 4
policy/modules/services/clogd.if | 82 +
policy/modules/services/clogd.te | 65 +
policy/modules/services/cobbler.if | 4
policy/modules/services/cobbler.te | 12
policy/modules/services/consolekit.fc | 4
policy/modules/services/consolekit.if | 39
policy/modules/services/consolekit.te | 34
policy/modules/services/corosync.fc | 15
policy/modules/services/corosync.if | 108 ++
policy/modules/services/corosync.te | 122 ++
policy/modules/services/cron.fc | 6
policy/modules/services/cron.if | 99 +
policy/modules/services/cron.te | 94 +
policy/modules/services/cups.fc | 14
policy/modules/services/cups.te | 65 +
policy/modules/services/cvs.te | 2
policy/modules/services/cyrus.te | 2
policy/modules/services/dbus.if | 107 +-
policy/modules/services/dbus.te | 21
policy/modules/services/denyhosts.fc | 7
policy/modules/services/denyhosts.if | 87 +
policy/modules/services/denyhosts.te | 73 +
policy/modules/services/devicekit.fc | 8
policy/modules/services/devicekit.if | 22
policy/modules/services/devicekit.te | 101 +
policy/modules/services/dhcp.te | 4
policy/modules/services/djbdns.if | 38
policy/modules/services/djbdns.te | 8
policy/modules/services/dnsmasq.fc | 2
policy/modules/services/dnsmasq.if | 4
policy/modules/services/dnsmasq.te | 22
policy/modules/services/dovecot.fc | 6
policy/modules/services/dovecot.te | 46
policy/modules/services/fail2ban.if | 20
policy/modules/services/fprintd.te | 2
policy/modules/services/ftp.fc | 2
policy/modules/services/ftp.if | 38
policy/modules/services/ftp.te | 179 +++
policy/modules/services/git.fc | 9
policy/modules/services/git.if | 533 ++++++++++
policy/modules/services/git.te | 190 +++
policy/modules/services/hal.if | 22
policy/modules/services/hal.te | 33
policy/modules/services/inn.te | 1
policy/modules/services/kerberos.if | 6
policy/modules/services/kerberos.te | 3
policy/modules/services/ksmtuned.te | 3
policy/modules/services/ldap.fc | 3
policy/modules/services/ldap.if | 81 +
policy/modules/services/ldap.te | 13
policy/modules/services/lircd.te | 23
policy/modules/services/milter.if | 20
policy/modules/services/milter.te | 8
policy/modules/services/modemmanager.te | 9
policy/modules/services/mta.fc | 2
policy/modules/services/mta.if | 68 +
policy/modules/services/mta.te | 24
policy/modules/services/munin.fc | 58 +
policy/modules/services/munin.if | 66 +
policy/modules/services/munin.te | 169 +++
policy/modules/services/mysql.te | 3
policy/modules/services/nagios.fc | 83 +
policy/modules/services/nagios.if | 142 ++
policy/modules/services/nagios.te | 283 ++++-
policy/modules/services/networkmanager.fc | 20
policy/modules/services/networkmanager.if | 86 +
policy/modules/services/networkmanager.te | 125 ++
policy/modules/services/nis.fc | 10
policy/modules/services/nis.if | 78 +
policy/modules/services/nis.te | 21
policy/modules/services/nscd.if | 20
policy/modules/services/nscd.te | 27
policy/modules/services/nslcd.te | 2
policy/modules/services/ntop.te | 32
policy/modules/services/ntp.te | 2
policy/modules/services/nut.te | 4
policy/modules/services/nx.fc | 12
policy/modules/services/nx.if | 67 +
policy/modules/services/nx.te | 13
policy/modules/services/oddjob.if | 1
policy/modules/services/oddjob.te | 5
policy/modules/services/oident.te | 1
policy/modules/services/openvpn.te | 7
policy/modules/services/pegasus.te | 28
policy/modules/services/plymouthd.fc | 9
policy/modules/services/plymouthd.if | 322 ++++++
policy/modules/services/plymouthd.te | 107 ++
policy/modules/services/policykit.fc | 5
policy/modules/services/policykit.if | 71 +
policy/modules/services/policykit.te | 84 +
policy/modules/services/postfix.fc | 2
policy/modules/services/postfix.if | 187 +++
policy/modules/services/postfix.te | 149 ++
policy/modules/services/ppp.te | 4
policy/modules/services/procmail.fc | 2
policy/modules/services/procmail.te | 26
policy/modules/services/pyzor.fc | 4
policy/modules/services/pyzor.if | 47
policy/modules/services/pyzor.te | 37
policy/modules/services/qpidd.fc | 9
policy/modules/services/qpidd.if | 236 ++++
policy/modules/services/qpidd.te | 61 +
policy/modules/services/razor.fc | 1
policy/modules/services/razor.if | 42
policy/modules/services/razor.te | 32
policy/modules/services/rgmanager.fc | 8
policy/modules/services/rgmanager.if | 98 +
policy/modules/services/rgmanager.te | 226 ++++
policy/modules/services/rhcs.fc | 23
policy/modules/services/rhcs.if | 424 ++++++++
policy/modules/services/rhcs.te | 239 ++++
policy/modules/services/ricci.te | 39
policy/modules/services/rlogin.fc | 3
policy/modules/services/rlogin.te | 1
policy/modules/services/rpc.if | 1
policy/modules/services/rpc.te | 15
policy/modules/services/rsync.if | 4
policy/modules/services/rsync.te | 26
policy/modules/services/samba.fc | 4
policy/modules/services/samba.if | 138 ++
policy/modules/services/samba.te | 123 +-
policy/modules/services/sasl.te | 3
policy/modules/services/sendmail.if | 19
policy/modules/services/sendmail.te | 15
policy/modules/services/setroubleshoot.fc | 2
policy/modules/services/setroubleshoot.if | 124 ++
policy/modules/services/setroubleshoot.te | 91 +
policy/modules/services/smartmon.te | 2
policy/modules/services/snmp.te | 3
policy/modules/services/snort.te | 4
policy/modules/services/spamassassin.fc | 15
policy/modules/services/spamassassin.if | 107 ++
policy/modules/services/spamassassin.te | 141 ++
policy/modules/services/squid.te | 21
policy/modules/services/ssh.fc | 2
policy/modules/services/ssh.if | 88 +
policy/modules/services/ssh.te | 53 -
policy/modules/services/sssd.te | 2
policy/modules/services/tgtd.te | 4
policy/modules/services/tuned.te | 5
policy/modules/services/ucspitcp.te | 5
policy/modules/services/varnishd.if | 19
policy/modules/services/vhostmd.te | 2
policy/modules/services/virt.fc | 6
policy/modules/services/virt.if | 58 -
policy/modules/services/virt.te | 81 +
policy/modules/services/w3c.te | 7
policy/modules/services/xserver.fc | 58 -
policy/modules/services/xserver.if | 393 +++++++
policy/modules/services/xserver.te | 398 ++++++-
policy/modules/system/application.te | 15
policy/modules/system/authlogin.fc | 1
policy/modules/system/authlogin.if | 52 -
policy/modules/system/daemontools.if | 62 +
policy/modules/system/daemontools.te | 26
policy/modules/system/fstools.fc | 2
policy/modules/system/fstools.te | 8
policy/modules/system/getty.te | 2
policy/modules/system/hostname.te | 3
policy/modules/system/init.fc | 3
policy/modules/system/init.if | 146 ++
policy/modules/system/init.te | 205 +++
policy/modules/system/ipsec.te | 16
policy/modules/system/iptables.fc | 4
policy/modules/system/iptables.if | 4
policy/modules/system/iptables.te | 15
policy/modules/system/libraries.fc | 148 ++
policy/modules/system/libraries.te | 8
policy/modules/system/locallogin.te | 40
policy/modules/system/logging.fc | 16
policy/modules/system/logging.if | 43
policy/modules/system/logging.te | 23
policy/modules/system/lvm.fc | 1
policy/modules/system/lvm.if | 2
policy/modules/system/lvm.te | 21
policy/modules/system/modutils.te | 14
policy/modules/system/mount.fc | 8
policy/modules/system/mount.if | 138 ++
policy/modules/system/mount.te | 148 ++
policy/modules/system/raid.te | 1
policy/modules/system/selinuxutil.fc | 17
policy/modules/system/selinuxutil.if | 330 ++++++
policy/modules/system/selinuxutil.te | 242 +---
policy/modules/system/sosreport.fc | 2
policy/modules/system/sosreport.if | 113 ++
policy/modules/system/sosreport.te | 128 ++
policy/modules/system/sysnetwork.fc | 2
policy/modules/system/sysnetwork.if | 96 +
policy/modules/system/sysnetwork.te | 19
policy/modules/system/udev.fc | 1
policy/modules/system/udev.if | 19
policy/modules/system/udev.te | 13
policy/modules/system/unconfined.fc | 14
policy/modules/system/unconfined.if | 440 --------
policy/modules/system/unconfined.te | 224 ----
policy/modules/system/userdomain.fc | 9
policy/modules/system/userdomain.if | 1550 ++++++++++++++++++++++++------
policy/modules/system/userdomain.te | 50
policy/modules/system/xen.if | 3
policy/modules/system/xen.te | 11
policy/support/misc_patterns.spt | 8
policy/support/obj_perm_sets.spt | 35
policy/users | 17
375 files changed, 21120 insertions(+), 2076 deletions(-)
Index: policy-F13.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-13/policy-F13.patch,v
retrieving revision 1.102
retrieving revision 1.103
diff -u -p -r1.102 -r1.103
--- policy-F13.patch 27 Apr 2010 15:49:50 -0000 1.102
+++ policy-F13.patch 28 Apr 2010 21:49:28 -0000 1.103
@@ -1344,7 +1344,7 @@ diff --exclude-from=exclude -N -u -r nsa
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.7.19/policy/modules/admin/rpm.te
--- nsaserefpolicy/policy/modules/admin/rpm.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.19/policy/modules/admin/rpm.te 2010-04-14 10:48:18.000000000 -0400
++++ serefpolicy-3.7.19/policy/modules/admin/rpm.te 2010-04-28 13:10:58.000000000 -0400
@@ -1,6 +1,8 @@
policy_module(rpm, 1.10.0)
@@ -1404,14 +1404,24 @@ diff --exclude-from=exclude -N -u -r nsa
allow rpm_t rpm_log_t:file manage_file_perms;
logging_log_filetrans(rpm_t, rpm_log_t, file)
-@@ -83,12 +98,21 @@
+@@ -75,6 +90,7 @@
+ manage_dirs_pattern(rpm_t, rpm_tmp_t, rpm_tmp_t)
+ manage_files_pattern(rpm_t, rpm_tmp_t, rpm_tmp_t)
+ files_tmp_filetrans(rpm_t, rpm_tmp_t, { file dir })
++can_exec(rpm_t, rpm_tmp_t)
+
+ manage_dirs_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t)
+ manage_files_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t)
+@@ -82,13 +98,23 @@
+ manage_fifo_files_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t)
manage_sock_files_pattern(rpm_t, rpm_tmpfs_t, rpm_tmpfs_t)
fs_tmpfs_filetrans(rpm_t, rpm_tmpfs_t, { dir file lnk_file sock_file fifo_file })
-
++can_exec(rpm_t, rpm_tmpfs_t)
++
+manage_dirs_pattern(rpm_t, rpm_var_cache_t, rpm_var_cache_t)
+manage_files_pattern(rpm_t, rpm_var_cache_t, rpm_var_cache_t)
+files_var_filetrans(rpm_t, rpm_var_cache_t, dir)
-+
+
# Access /var/lib/rpm files
manage_files_pattern(rpm_t, rpm_var_lib_t, rpm_var_lib_t)
files_var_lib_filetrans(rpm_t, rpm_var_lib_t, dir)
@@ -1426,7 +1436,7 @@ diff --exclude-from=exclude -N -u -r nsa
corecmd_exec_all_executables(rpm_t)
-@@ -108,12 +132,15 @@
+@@ -108,12 +134,15 @@
dev_list_sysfs(rpm_t)
dev_list_usbfs(rpm_t)
dev_read_urand(rpm_t)
@@ -1443,7 +1453,7 @@ diff --exclude-from=exclude -N -u -r nsa
fs_search_auto_mountpoints(rpm_t)
mls_file_read_all_levels(rpm_t)
-@@ -132,6 +159,8 @@
+@@ -132,6 +161,8 @@
# for installing kernel packages
storage_raw_read_fixed_disk(rpm_t)
@@ -1452,7 +1462,7 @@ diff --exclude-from=exclude -N -u -r nsa
auth_relabel_all_files_except_shadow(rpm_t)
auth_manage_all_files_except_shadow(rpm_t)
auth_dontaudit_read_shadow(rpm_t)
-@@ -155,6 +184,7 @@
+@@ -155,6 +186,7 @@
files_exec_etc_files(rpm_t)
init_domtrans_script(rpm_t)
@@ -1460,7 +1470,7 @@ diff --exclude-from=exclude -N -u -r nsa
libs_exec_ld_so(rpm_t)
libs_exec_lib_files(rpm_t)
-@@ -174,7 +204,19 @@
+@@ -174,7 +206,19 @@
')
optional_policy(`
@@ -1481,7 +1491,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -182,36 +224,19 @@
+@@ -182,36 +226,19 @@
')
optional_policy(`
@@ -1522,7 +1532,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow rpm_script_t self:fd use;
allow rpm_script_t self:fifo_file rw_fifo_file_perms;
allow rpm_script_t self:unix_dgram_socket create_socket_perms;
-@@ -222,12 +247,15 @@
+@@ -222,12 +249,15 @@
allow rpm_script_t self:sem create_sem_perms;
allow rpm_script_t self:msgq create_msgq_perms;
allow rpm_script_t self:msg { send receive };
@@ -1538,7 +1548,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_tmp_filetrans(rpm_script_t, rpm_script_tmp_t, { file dir })
manage_dirs_pattern(rpm_script_t, rpm_script_tmpfs_t, rpm_script_tmpfs_t)
-@@ -239,6 +267,9 @@
+@@ -239,6 +269,9 @@
kernel_read_kernel_sysctls(rpm_script_t)
kernel_read_system_state(rpm_script_t)
@@ -1548,7 +1558,7 @@ diff --exclude-from=exclude -N -u -r nsa
dev_list_sysfs(rpm_script_t)
-@@ -254,7 +285,9 @@
+@@ -254,7 +287,9 @@
fs_getattr_xattr_fs(rpm_script_t)
fs_mount_xattr_fs(rpm_script_t)
fs_unmount_xattr_fs(rpm_script_t)
@@ -1558,7 +1568,7 @@ diff --exclude-from=exclude -N -u -r nsa
mcs_killall(rpm_script_t)
mcs_ptrace_all(rpm_script_t)
-@@ -272,14 +305,19 @@
+@@ -272,14 +307,19 @@
storage_raw_read_fixed_disk(rpm_script_t)
storage_raw_write_fixed_disk(rpm_script_t)
@@ -1578,7 +1588,7 @@ diff --exclude-from=exclude -N -u -r nsa
domain_read_all_domains_state(rpm_script_t)
domain_getattr_all_domains(rpm_script_t)
-@@ -291,8 +329,10 @@
+@@ -291,8 +331,10 @@
files_exec_etc_files(rpm_script_t)
files_read_etc_runtime_files(rpm_script_t)
files_exec_usr_files(rpm_script_t)
@@ -1589,7 +1599,7 @@ diff --exclude-from=exclude -N -u -r nsa
libs_exec_ld_so(rpm_script_t)
libs_exec_lib_files(rpm_script_t)
-@@ -308,12 +348,15 @@
+@@ -308,12 +350,15 @@
seutil_domtrans_loadpolicy(rpm_script_t)
seutil_domtrans_setfiles(rpm_script_t)
seutil_domtrans_semanage(rpm_script_t)
@@ -1605,7 +1615,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
')
-@@ -326,13 +369,22 @@
+@@ -326,13 +371,22 @@
')
optional_policy(`
@@ -1870,7 +1880,7 @@ diff --exclude-from=exclude -N -u -r nsa
fs_manage_nfs_files($1_sudo_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.7.19/policy/modules/admin/su.if
--- nsaserefpolicy/policy/modules/admin/su.if 2010-02-12 10:33:09.000000000 -0500
-+++ serefpolicy-3.7.19/policy/modules/admin/su.if 2010-04-14 10:48:18.000000000 -0400
++++ serefpolicy-3.7.19/policy/modules/admin/su.if 2010-04-27 14:37:28.000000000 -0400
@@ -58,6 +58,10 @@
allow $2 $1_su_t:fifo_file rw_file_perms;
allow $2 $1_su_t:process sigchld;
@@ -1893,6 +1903,23 @@ diff --exclude-from=exclude -N -u -r nsa
ps_process_pattern($3, $1_su_t)
+@@ -207,7 +215,7 @@
+
+ auth_domtrans_chk_passwd($1_su_t)
+ auth_dontaudit_read_shadow($1_su_t)
+- auth_use_nsswitch($1_su_t)
++ auth_use_pam($1_su_t)
+ auth_rw_faillog($1_su_t)
+
+ corecmd_search_bin($1_su_t)
+@@ -231,6 +239,7 @@
+
+ userdom_use_user_terminals($1_su_t)
+ userdom_search_user_home_dirs($1_su_t)
++ userdom_search_admin_dir($1_su_t)
+
+ ifdef(`distro_redhat',`
+ # RHEL5 and possibly newer releases incl. Fedora
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.te serefpolicy-3.7.19/policy/modules/admin/tmpreaper.te
--- nsaserefpolicy/policy/modules/admin/tmpreaper.te 2009-08-14 16:14:31.000000000 -0400
+++ serefpolicy-3.7.19/policy/modules/admin/tmpreaper.te 2010-04-14 10:48:18.000000000 -0400
@@ -2353,8 +2380,8 @@ diff --exclude-from=exclude -N -u -r nsa
dbus_system_domain(cpufreqselector_t, cpufreqselector_exec_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.fc serefpolicy-3.7.19/policy/modules/apps/execmem.fc
--- nsaserefpolicy/policy/modules/apps/execmem.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.7.19/policy/modules/apps/execmem.fc 2010-04-14 10:48:18.000000000 -0400
-@@ -0,0 +1,46 @@
++++ serefpolicy-3.7.19/policy/modules/apps/execmem.fc 2010-04-27 13:16:02.000000000 -0400
+@@ -0,0 +1,47 @@
+
+/usr/bin/aticonfig -- gen_context(system_u:object_r:execmem_exec_t,s0)
+/usr/bin/compiz -- gen_context(system_u:object_r:execmem_exec_t,s0)
@@ -2400,6 +2427,7 @@ diff --exclude-from=exclude -N -u -r nsa
+/opt/likewise/bin/domainjoin-cli -- gen_context(system_u:object_r:execmem_exec_t,s0)
+
+/opt/google/chrome/chrome -- gen_context(system_u:object_r:execmem_exec_t,s0)
++/opt/google/chrome/google-chrome -- gen_context(system_u:object_r:execmem_exec_t,s0)
+/opt/Komodo-Edit-5/lib/mozilla/komodo-bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/execmem.if serefpolicy-3.7.19/policy/modules/apps/execmem.if
--- nsaserefpolicy/policy/modules/apps/execmem.if 1969-12-31 19:00:00.000000000 -0500
@@ -3299,7 +3327,7 @@ diff --exclude-from=exclude -N -u -r nsa
/usr/bin/gpg-agent -- gen_context(system_u:object_r:gpg_agent_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.if serefpolicy-3.7.19/policy/modules/apps/gpg.if
--- nsaserefpolicy/policy/modules/apps/gpg.if 2009-09-09 09:23:16.000000000 -0400
-+++ serefpolicy-3.7.19/policy/modules/apps/gpg.if 2010-04-14 10:48:18.000000000 -0400
++++ serefpolicy-3.7.19/policy/modules/apps/gpg.if 2010-04-28 12:18:06.000000000 -0400
@@ -21,6 +21,7 @@
type gpg_agent_t, gpg_agent_exec_t;
type gpg_agent_tmp_t;
@@ -3400,7 +3428,7 @@ diff --exclude-from=exclude -N -u -r nsa
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.7.19/policy/modules/apps/gpg.te
--- nsaserefpolicy/policy/modules/apps/gpg.te 2009-12-04 09:43:33.000000000 -0500
-+++ serefpolicy-3.7.19/policy/modules/apps/gpg.te 2010-04-14 10:48:18.000000000 -0400
++++ serefpolicy-3.7.19/policy/modules/apps/gpg.te 2010-04-28 12:00:49.000000000 -0400
@@ -20,6 +20,7 @@
typealias gpg_t alias { auditadm_gpg_t secadm_gpg_t };
application_domain(gpg_t, gpg_exec_t)
@@ -3529,7 +3557,18 @@ diff --exclude-from=exclude -N -u -r nsa
domain_use_interactive_fds(gpg_agent_t)
-@@ -237,31 +268,74 @@
+@@ -215,6 +246,10 @@
+ userdom_use_user_terminals(gpg_agent_t)
+ # read and write ~/.gnupg (gpg-agent stores secret keys in ~/.gnupg/private-keys-v1.d )
+ userdom_search_user_home_dirs(gpg_agent_t)
++ifdef(`hide_broken_symptoms',`
++ userdom_dontaudit_read_user_tmp_files(gpg_agent_t)
++ userdom_dontaudit_write_user_tmp_files(gpg_agent_t)
++')
+
+ tunable_policy(`gpg_agent_env_file',`
+ # write ~/.gpg-agent-info or a similar to the users home dir
+@@ -237,31 +272,74 @@
fs_manage_cifs_symlinks(gpg_agent_t)
')
@@ -3605,7 +3644,7 @@ diff --exclude-from=exclude -N -u -r nsa
tunable_policy(`use_nfs_home_dirs',`
fs_read_nfs_files(gpg_pinentry_t)
')
-@@ -271,5 +345,25 @@
+@@ -271,5 +349,25 @@
')
optional_policy(`
@@ -18200,6 +18239,17 @@ diff --exclude-from=exclude -N -u -r nsa
allow kpropd_t krb5_keytab_t:file read_file_perms;
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmtuned.te serefpolicy-3.7.19/policy/modules/services/ksmtuned.te
+--- nsaserefpolicy/policy/modules/services/ksmtuned.te 2010-03-29 15:04:22.000000000 -0400
++++ serefpolicy-3.7.19/policy/modules/services/ksmtuned.te 2010-04-28 09:53:51.000000000 -0400
+@@ -37,4 +37,7 @@
+
+ files_read_etc_files(ksmtuned_t)
+
++term_use_all_terms(ksmtuned_t)
++
+ miscfiles_read_localization(ksmtuned_t)
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.fc serefpolicy-3.7.19/policy/modules/services/ldap.fc
--- nsaserefpolicy/policy/modules/services/ldap.fc 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.7.19/policy/modules/services/ldap.fc 2010-04-14 10:48:18.000000000 -0400
@@ -18359,7 +18409,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_pid_filetrans(slapd_t, slapd_var_run_t, { file sock_file })
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lircd.te serefpolicy-3.7.19/policy/modules/services/lircd.te
--- nsaserefpolicy/policy/modules/services/lircd.te 2010-01-11 09:40:36.000000000 -0500
-+++ serefpolicy-3.7.19/policy/modules/services/lircd.te 2010-04-14 10:48:18.000000000 -0400
++++ serefpolicy-3.7.19/policy/modules/services/lircd.te 2010-04-28 13:20:28.000000000 -0400
@@ -24,8 +24,11 @@
# lircd local policy
#
@@ -18380,6 +18430,7 @@ diff --exclude-from=exclude -N -u -r nsa
-# /dev/lircd socket
-dev_filetrans(lircd_t, lircd_var_run_t, sock_file)
+-dev_read_generic_usb_dev(lircd_t)
+corenet_tcp_bind_generic_node(lircd_t)
+corenet_tcp_bind_lirc_port(lircd_t)
+corenet_tcp_connect_lirc_port(lircd_t)
@@ -18388,7 +18439,7 @@ diff --exclude-from=exclude -N -u -r nsa
+
+# /dev/lircd socket
+dev_filetrans(lircd_t, lircd_var_run_t, sock_file )
- dev_read_generic_usb_dev(lircd_t)
++dev_rw_generic_usb_dev(lircd_t)
+dev_read_mouse(lircd_t)
dev_filetrans_lirc(lircd_t)
dev_rw_lirc(lircd_t)
@@ -27339,7 +27390,7 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.7.19/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2010-02-12 10:33:09.000000000 -0500
-+++ serefpolicy-3.7.19/policy/modules/services/xserver.te 2010-04-23 09:42:21.000000000 -0400
++++ serefpolicy-3.7.19/policy/modules/services/xserver.te 2010-04-28 13:07:41.000000000 -0400
@@ -36,6 +36,13 @@
## <desc>
@@ -27732,10 +27783,11 @@ diff --exclude-from=exclude -N -u -r nsa
corecmd_exec_shell(xdm_t)
corecmd_exec_bin(xdm_t)
-@@ -394,11 +520,13 @@
+@@ -394,11 +520,14 @@
corenet_udp_sendrecv_all_ports(xdm_t)
corenet_tcp_bind_generic_node(xdm_t)
corenet_udp_bind_generic_node(xdm_t)
++corenet_udp_bind_ipp_port(xdm_t)
+corenet_udp_bind_xdmcp_port(xdm_t)
corenet_tcp_connect_all_ports(xdm_t)
corenet_sendrecv_all_client_packets(xdm_t)
@@ -27746,7 +27798,7 @@ diff --exclude-from=exclude -N -u -r nsa
dev_read_rand(xdm_t)
dev_read_sysfs(xdm_t)
dev_getattr_framebuffer_dev(xdm_t)
-@@ -406,6 +534,7 @@
+@@ -406,6 +535,7 @@
dev_getattr_mouse_dev(xdm_t)
dev_setattr_mouse_dev(xdm_t)
dev_rw_apm_bios(xdm_t)
@@ -27754,7 +27806,7 @@ diff --exclude-from=exclude -N -u -r nsa
dev_setattr_apm_bios_dev(xdm_t)
dev_rw_dri(xdm_t)
dev_rw_agp(xdm_t)
-@@ -414,18 +543,22 @@
+@@ -414,18 +544,22 @@
dev_getattr_misc_dev(xdm_t)
dev_setattr_misc_dev(xdm_t)
dev_dontaudit_rw_misc(xdm_t)
@@ -27780,7 +27832,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_read_etc_files(xdm_t)
files_read_var_files(xdm_t)
-@@ -436,9 +569,17 @@
+@@ -436,9 +570,17 @@
files_read_usr_files(xdm_t)
# Poweroff wants to create the /poweroff file when run from xdm
files_create_boot_flag(xdm_t)
@@ -27794,11 +27846,11 @@ diff --exclude-from=exclude -N -u -r nsa
+fs_rw_anon_inodefs_files(xdm_t)
+fs_mount_tmpfs(xdm_t)
+
-+mls_net_write_within_range(xdm_t)
++mls_socket_write_to_clearance(xdm_t)
storage_dontaudit_read_fixed_disk(xdm_t)
storage_dontaudit_write_fixed_disk(xdm_t)
-@@ -447,14 +588,19 @@
+@@ -447,14 +589,19 @@
storage_dontaudit_raw_write_removable_device(xdm_t)
storage_dontaudit_setattr_removable_dev(xdm_t)
storage_dontaudit_rw_scsi_generic(xdm_t)
@@ -27818,7 +27870,7 @@ diff --exclude-from=exclude -N -u -r nsa
auth_rw_faillog(xdm_t)
auth_write_login_records(xdm_t)
-@@ -465,10 +611,12 @@
+@@ -465,10 +612,12 @@
logging_read_generic_logs(xdm_t)
@@ -27833,7 +27885,7 @@ diff --exclude-from=exclude -N -u -r nsa
userdom_dontaudit_use_unpriv_user_fds(xdm_t)
userdom_create_all_users_keys(xdm_t)
-@@ -477,6 +625,11 @@
+@@ -477,6 +626,11 @@
# Search /proc for any user domain processes.
userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t)
@@ -27845,7 +27897,7 @@ diff --exclude-from=exclude -N -u -r nsa
xserver_rw_session(xdm_t, xdm_tmpfs_t)
xserver_unconfined(xdm_t)
-@@ -509,10 +662,12 @@
+@@ -509,10 +663,12 @@
optional_policy(`
alsa_domtrans(xdm_t)
@@ -27858,7 +27910,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -520,12 +675,50 @@
+@@ -520,12 +676,50 @@
')
optional_policy(`
@@ -27909,7 +27961,7 @@ diff --exclude-from=exclude -N -u -r nsa
hostname_exec(xdm_t)
')
-@@ -543,20 +736,59 @@
+@@ -543,20 +737,59 @@
')
optional_policy(`
@@ -27971,7 +28023,7 @@ diff --exclude-from=exclude -N -u -r nsa
ifndef(`distro_redhat',`
allow xdm_t self:process { execheap execmem };
-@@ -565,7 +797,6 @@
+@@ -565,7 +798,6 @@
ifdef(`distro_rhel4',`
allow xdm_t self:process { execheap execmem };
')
@@ -27979,7 +28031,7 @@ diff --exclude-from=exclude -N -u -r nsa
optional_policy(`
userhelper_dontaudit_search_config(xdm_t)
-@@ -576,6 +807,10 @@
+@@ -576,6 +808,10 @@
')
optional_policy(`
@@ -27990,7 +28042,7 @@ diff --exclude-from=exclude -N -u -r nsa
xfs_stream_connect(xdm_t)
')
-@@ -600,10 +835,9 @@
+@@ -600,10 +836,9 @@
# execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack
@@ -28002,7 +28054,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow xserver_t self:fd use;
allow xserver_t self:fifo_file rw_fifo_file_perms;
allow xserver_t self:sock_file read_sock_file_perms;
-@@ -615,6 +849,18 @@
+@@ -615,6 +850,18 @@
allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow xserver_t self:tcp_socket create_stream_socket_perms;
allow xserver_t self:udp_socket create_socket_perms;
@@ -28021,7 +28073,7 @@ diff --exclude-from=exclude -N -u -r nsa
manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
-@@ -634,12 +880,19 @@
+@@ -634,12 +881,19 @@
manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
files_search_var_lib(xserver_t)
@@ -28043,7 +28095,7 @@ diff --exclude-from=exclude -N -u -r nsa
kernel_read_system_state(xserver_t)
kernel_read_device_sysctls(xserver_t)
-@@ -673,7 +926,6 @@
+@@ -673,7 +927,6 @@
dev_rw_agp(xserver_t)
dev_rw_framebuffer(xserver_t)
dev_manage_dri_dev(xserver_t)
@@ -28051,7 +28103,7 @@ diff --exclude-from=exclude -N -u -r nsa
dev_create_generic_dirs(xserver_t)
dev_setattr_generic_dirs(xserver_t)
# raw memory access is needed if not using the frame buffer
-@@ -683,9 +935,12 @@
+@@ -683,9 +936,12 @@
dev_rw_xserver_misc(xserver_t)
# read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev(xserver_t)
@@ -28065,7 +28117,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_read_etc_files(xserver_t)
files_read_etc_runtime_files(xserver_t)
-@@ -700,8 +955,13 @@
+@@ -700,8 +956,13 @@
fs_search_nfs(xserver_t)
fs_search_auto_mountpoints(xserver_t)
fs_search_ramfs(xserver_t)
@@ -28079,7 +28131,7 @@ diff --exclude-from=exclude -N -u -r nsa
selinux_validate_context(xserver_t)
selinux_compute_access_vector(xserver_t)
-@@ -723,11 +983,14 @@
+@@ -723,11 +984,14 @@
miscfiles_read_localization(xserver_t)
miscfiles_read_fonts(xserver_t)
@@ -28094,7 +28146,7 @@ diff --exclude-from=exclude -N -u -r nsa
userdom_search_user_home_dirs(xserver_t)
userdom_use_user_ttys(xserver_t)
-@@ -779,12 +1042,24 @@
+@@ -779,12 +1043,24 @@
')
optional_policy(`
@@ -28120,7 +28172,7 @@ diff --exclude-from=exclude -N -u -r nsa
unconfined_domtrans(xserver_t)
')
-@@ -811,7 +1086,7 @@
+@@ -811,7 +1087,7 @@
allow xserver_t xdm_var_lib_t:file { getattr read };
dontaudit xserver_t xdm_var_lib_t:dir search;
@@ -28129,7 +28181,7 @@ diff --exclude-from=exclude -N -u -r nsa
# Label pid and temporary files with derived types.
manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
-@@ -832,9 +1107,14 @@
+@@ -832,9 +1108,14 @@
# to read ROLE_home_t - examine this in more detail
# (xauth?)
userdom_read_user_home_content_files(xserver_t)
@@ -28144,7 +28196,7 @@ diff --exclude-from=exclude -N -u -r nsa
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(xserver_t)
fs_manage_nfs_files(xserver_t)
-@@ -849,11 +1129,14 @@
+@@ -849,11 +1130,14 @@
optional_policy(`
dbus_system_bus_client(xserver_t)
@@ -28161,7 +28213,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -999,3 +1282,33 @@
+@@ -999,3 +1283,33 @@
allow xserver_unconfined_type xextension_type:x_extension *;
allow xserver_unconfined_type { x_domain xserver_t }:x_resource *;
allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *;
@@ -28861,7 +28913,7 @@ diff --exclude-from=exclude -N -u -r nsa
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.7.19/policy/modules/system/init.te
--- nsaserefpolicy/policy/modules/system/init.te 2010-03-18 10:35:11.000000000 -0400
-+++ serefpolicy-3.7.19/policy/modules/system/init.te 2010-04-27 10:22:42.000000000 -0400
++++ serefpolicy-3.7.19/policy/modules/system/init.te 2010-04-28 13:08:01.000000000 -0400
@@ -17,6 +17,20 @@
## </desc>
gen_tunable(init_upstart, false)
@@ -28978,7 +29030,7 @@ diff --exclude-from=exclude -N -u -r nsa
can_exec(initrc_t, initrc_tmp_t)
manage_files_pattern(initrc_t, initrc_tmp_t, initrc_tmp_t)
-@@ -259,13 +293,21 @@
+@@ -259,13 +293,22 @@
kernel_clear_ring_buffer(initrc_t)
kernel_get_sysvipc_info(initrc_t)
kernel_read_all_sysctls(initrc_t)
@@ -28998,10 +29050,11 @@ diff --exclude-from=exclude -N -u -r nsa
-corecmd_exec_all_executables(initrc_t)
+fs_manage_tmpfs_dirs(initrc_t)
++fs_tmpfs_filetrans(initrc_t, initrc_state_t, file)
corenet_all_recvfrom_unlabeled(initrc_t)
corenet_all_recvfrom_netlabel(initrc_t)
-@@ -299,6 +341,7 @@
+@@ -299,6 +342,7 @@
dev_delete_generic_symlinks(initrc_t)
dev_getattr_all_blk_files(initrc_t)
dev_getattr_all_chr_files(initrc_t)
@@ -29009,7 +29062,7 @@ diff --exclude-from=exclude -N -u -r nsa
corecmd_exec_all_executables(initrc_t)
-@@ -325,8 +368,10 @@
+@@ -325,8 +369,10 @@
files_getattr_all_pipes(initrc_t)
files_getattr_all_sockets(initrc_t)
files_purge_tmp(initrc_t)
@@ -29021,7 +29074,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_delete_all_pids(initrc_t)
files_delete_all_pid_dirs(initrc_t)
files_read_etc_files(initrc_t)
-@@ -342,6 +387,8 @@
+@@ -342,6 +388,8 @@
files_mounton_isid_type_dirs(initrc_t)
files_list_default(initrc_t)
files_mounton_default(initrc_t)
@@ -29030,7 +29083,7 @@ diff --exclude-from=exclude -N -u -r nsa
fs_list_inotifyfs(initrc_t)
fs_register_binary_executable_type(initrc_t)
-@@ -352,6 +399,11 @@
+@@ -352,6 +400,11 @@
fs_unmount_all_fs(initrc_t)
fs_remount_all_fs(initrc_t)
fs_getattr_all_fs(initrc_t)
@@ -29042,15 +29095,15 @@ diff --exclude-from=exclude -N -u -r nsa
# initrc_t needs to do a pidof which requires ptrace
mcs_ptrace_all(initrc_t)
-@@ -364,6 +416,7 @@
+@@ -364,6 +417,7 @@
mls_process_write_down(initrc_t)
mls_rangetrans_source(initrc_t)
mls_fd_share_all_levels(initrc_t)
-+mls_net_write_within_range(initrc_t)
++mls_socket_write_to_clearance(initrc_t)
selinux_get_enforce_mode(initrc_t)
-@@ -395,15 +448,16 @@
+@@ -395,15 +449,16 @@
miscfiles_read_localization(initrc_t)
# slapd needs to read cert files from its initscript
@@ -29069,7 +29122,7 @@ diff --exclude-from=exclude -N -u -r nsa
# TTYs to any process in the initrc_t domain. Therefore, daemons and such
# started from init should be placed in their own domain.
userdom_use_user_terminals(initrc_t)
-@@ -471,7 +525,7 @@
+@@ -471,7 +526,7 @@
# Red Hat systems seem to have a stray
# fd open from the initrd
@@ -29078,7 +29131,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_dontaudit_read_root_files(initrc_t)
# These seem to be from the initrd
-@@ -517,6 +571,23 @@
+@@ -517,6 +572,23 @@
optional_policy(`
bind_manage_config_dirs(initrc_t)
bind_write_config(initrc_t)
@@ -29102,7 +29155,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -542,6 +613,35 @@
+@@ -542,6 +614,35 @@
')
')
@@ -29138,7 +29191,7 @@ diff --exclude-from=exclude -N -u -r nsa
optional_policy(`
amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t)
-@@ -554,6 +654,8 @@
+@@ -554,6 +655,8 @@
optional_policy(`
apache_read_config(initrc_t)
apache_list_modules(initrc_t)
@@ -29147,7 +29200,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -594,6 +696,7 @@
+@@ -594,6 +697,7 @@
dbus_connect_system_bus(initrc_t)
dbus_system_bus_client(initrc_t)
dbus_read_config(initrc_t)
@@ -29155,7 +29208,7 @@ diff --exclude-from=exclude -N -u -r nsa
optional_policy(`
consolekit_dbus_chat(initrc_t)
-@@ -647,11 +750,6 @@
+@@ -647,11 +751,6 @@
')
optional_policy(`
@@ -29167,7 +29220,7 @@ diff --exclude-from=exclude -N -u -r nsa
kerberos_use(initrc_t)
')
-@@ -690,12 +788,22 @@
+@@ -690,12 +789,22 @@
')
optional_policy(`
@@ -29190,7 +29243,7 @@ diff --exclude-from=exclude -N -u -r nsa
mta_dontaudit_read_spool_symlinks(initrc_t)
')
-@@ -718,6 +826,10 @@
+@@ -718,6 +827,10 @@
')
optional_policy(`
@@ -29201,7 +29254,7 @@ diff --exclude-from=exclude -N -u -r nsa
postgresql_manage_db(initrc_t)
postgresql_read_config(initrc_t)
')
-@@ -760,8 +872,6 @@
+@@ -760,8 +873,6 @@
# bash tries ioctl for some reason
files_dontaudit_ioctl_all_pids(initrc_t)
@@ -29210,7 +29263,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -774,10 +884,12 @@
+@@ -774,10 +885,12 @@
squid_manage_logs(initrc_t)
')
@@ -29223,7 +29276,7 @@ diff --exclude-from=exclude -N -u -r nsa
optional_policy(`
ssh_dontaudit_read_server_keys(initrc_t)
-@@ -790,6 +902,7 @@
+@@ -790,6 +903,7 @@
optional_policy(`
udev_rw_db(initrc_t)
@@ -29231,7 +29284,7 @@ diff --exclude-from=exclude -N -u -r nsa
udev_manage_pid_files(initrc_t)
')
-@@ -798,11 +911,18 @@
+@@ -798,11 +912,18 @@
')
optional_policy(`
@@ -29251,7 +29304,7 @@ diff --exclude-from=exclude -N -u -r nsa
ifdef(`distro_redhat',`
# system-config-services causes avc messages that should be dontaudited
-@@ -812,6 +932,25 @@
+@@ -812,6 +933,25 @@
optional_policy(`
mono_domtrans(initrc_t)
')
@@ -29277,7 +29330,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -837,3 +976,34 @@
+@@ -837,3 +977,34 @@
optional_policy(`
zebra_read_config(initrc_t)
')
@@ -32825,7 +32878,7 @@ diff --exclude-from=exclude -N -u -r nsa
+HOME_DIR/\.gvfs(/.*)? <<none>>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.7.19/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2010-03-03 23:26:37.000000000 -0500
-+++ serefpolicy-3.7.19/policy/modules/system/userdomain.if 2010-04-27 08:35:15.000000000 -0400
++++ serefpolicy-3.7.19/policy/modules/system/userdomain.if 2010-04-28 11:59:42.000000000 -0400
@@ -30,8 +30,9 @@
')
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-13/selinux-policy.spec,v
retrieving revision 1.1006
retrieving revision 1.1007
diff -u -p -r1.1006 -r1.1007
--- selinux-policy.spec 27 Apr 2010 15:49:51 -0000 1.1006
+++ selinux-policy.spec 28 Apr 2010 21:49:29 -0000 1.1007
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.7.19
-Release: 7%{?dist}
+Release: 8%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -96,7 +96,9 @@ SELinux policy documentation package
%attr(755,root,root) %{_usr}/share/selinux/devel/policyhelp
%check
-/usr/bin/sepolgen-ifgen -i %{buildroot}%{_usr}/share/selinux/devel/include -o /dev/null
+if /usr/sbin/selinuxenabled; then
+/usr/bin/sepolgen-ifgen -i %{buildroot}%{_usr}/share/selinux/devel/include -o /dev/null
+fi
%define makeCmds() \
make UNK_PERMS=%5 NAME=%1 TYPE=%2 DISTRO=%{distro} UBAC=n DIRECT_INITRC=%3 MONOLITHIC=%{monolithic} POLY=%4 MLS_CATS=1024 MCS_CATS=1024 bare \
@@ -466,6 +468,11 @@ exit 0
%endif
%changelog
+* Wed Apr 28 2010 Dan Walsh <dwalsh at redhat.com> 3.7.19-8
+- Allow ksmtuned to use terminals
+Resolves: #586663
+- Allow lircd to write to generic usb devices
+
* Tue Apr 27 2010 Dan Walsh <dwalsh at redhat.com> 3.7.19-7
- Allow sandbox_xserver to connectto unconfined stream
Resolves: #585171
- Previous message: rpms/dogtag-pki-console-ui/EL-5 .cvsignore, 1.3, 1.4 dogtag-pki-console-ui.spec, 1.3, 1.4 import.log, 1.3, 1.4 sources, 1.3, 1.4
- Next message: rpms/pki-ca/EL-5 .cvsignore, 1.4, 1.5 import.log, 1.6, 1.7 pki-ca.spec, 1.6, 1.7 sources, 1.4, 1.5
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the scm-commits
mailing list