rpms/selinux-policy/devel modules-minimum.conf, 1.49, 1.50 modules-mls.conf, 1.64, 1.65 modules-targeted.conf, 1.158, 1.159 policy-F13.patch, 1.45, 1.46 selinux-policy.spec, 1.964, 1.965
Daniel J Walsh
dwalsh at fedoraproject.org
Wed Feb 3 20:52:59 UTC 2010
- Previous message: rpms/audacious-plugins/F-12 audacious-plugins-2.2-streambrowser-race.patch, NONE, 1.1 audacious-plugins.spec, 1.85, 1.86
- Next message: rpms/texmaker/F-12 sources, 1.11, 1.12 texmaker-tools.patch, 1.12, 1.13 texmaker.spec, 1.24, 1.25
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: dwalsh
Update of /cvs/pkgs/rpms/selinux-policy/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv19155
Modified Files:
modules-minimum.conf modules-mls.conf modules-targeted.conf
policy-F13.patch selinux-policy.spec
Log Message:
* Wed Feb 3 2010 Dan Walsh <dwalsh at redhat.com> 3.7.8-7
- Add mcelog policy
Index: modules-minimum.conf
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/devel/modules-minimum.conf,v
retrieving revision 1.49
retrieving revision 1.50
diff -u -p -r1.49 -r1.50
--- modules-minimum.conf 2 Feb 2010 16:41:02 -0000 1.49
+++ modules-minimum.conf 3 Feb 2010 20:52:54 -0000 1.50
@@ -890,6 +890,13 @@ lircd = module
#
lvm = base
+# Layer: admin
+# Module: mcelog
+#
+# Policy for mcelog.
+#
+mcelog = base
+
# Layer: services
# Module: mailman
#
Index: modules-mls.conf
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/devel/modules-mls.conf,v
retrieving revision 1.64
retrieving revision 1.65
diff -u -p -r1.64 -r1.65
--- modules-mls.conf 22 Dec 2009 17:16:12 -0000 1.64
+++ modules-mls.conf 3 Feb 2010 20:52:54 -0000 1.65
@@ -792,6 +792,13 @@ lpd = module
#
lvm = base
+# Layer: admin
+# Module: mcelog
+#
+# Policy for mcelog.
+#
+mcelog = base
+
# Layer: services
# Module: mailman
#
Index: modules-targeted.conf
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/devel/modules-targeted.conf,v
retrieving revision 1.158
retrieving revision 1.159
diff -u -p -r1.158 -r1.159
--- modules-targeted.conf 2 Feb 2010 16:41:02 -0000 1.158
+++ modules-targeted.conf 3 Feb 2010 20:52:55 -0000 1.159
@@ -890,6 +890,13 @@ lircd = module
#
lvm = base
+# Layer: admin
+# Module: mcelog
+#
+# Policy for mcelog.
+#
+mcelog = base
+
# Layer: services
# Module: mailman
#
policy-F13.patch:
Makefile | 2
policy/global_tunables | 24
policy/modules/admin/alsa.te | 2
policy/modules/admin/anaconda.te | 3
policy/modules/admin/brctl.te | 2
policy/modules/admin/certwatch.te | 2
policy/modules/admin/consoletype.te | 2
policy/modules/admin/dmesg.te | 10
policy/modules/admin/firstboot.te | 6
policy/modules/admin/kismet.te | 5
policy/modules/admin/logrotate.te | 28
policy/modules/admin/logwatch.te | 8
policy/modules/admin/mcelog.fc | 2
policy/modules/admin/mcelog.if | 21
policy/modules/admin/mcelog.te | 31
policy/modules/admin/mrtg.te | 1
policy/modules/admin/netutils.te | 4
policy/modules/admin/portage.te | 2
policy/modules/admin/prelink.fc | 1
policy/modules/admin/prelink.if | 23
policy/modules/admin/prelink.te | 78 +
policy/modules/admin/readahead.te | 1
policy/modules/admin/rpm.fc | 21
policy/modules/admin/rpm.if | 344 ++++++
policy/modules/admin/rpm.te | 98 +
policy/modules/admin/shorewall.fc | 5
policy/modules/admin/shorewall.if | 40
policy/modules/admin/shorewall.te | 9
policy/modules/admin/smoltclient.fc | 4
policy/modules/admin/smoltclient.if | 1
policy/modules/admin/smoltclient.te | 66 +
policy/modules/admin/sudo.if | 13
policy/modules/admin/tmpreaper.te | 12
policy/modules/admin/usermanage.if | 11
policy/modules/admin/usermanage.te | 35
policy/modules/admin/vbetool.te | 14
policy/modules/admin/vpn.te | 4
policy/modules/apps/chrome.fc | 2
policy/modules/apps/chrome.if | 86 +
policy/modules/apps/chrome.te | 82 +
policy/modules/apps/cpufreqselector.te | 2
policy/modules/apps/execmem.fc | 43
policy/modules/apps/execmem.if | 103 +
policy/modules/apps/execmem.te | 11
policy/modules/apps/firewallgui.fc | 3
policy/modules/apps/firewallgui.if | 23
policy/modules/apps/firewallgui.te | 66 +
policy/modules/apps/gitosis.if | 44
policy/modules/apps/gnome.fc | 24
policy/modules/apps/gnome.if | 221 +++
policy/modules/apps/gnome.te | 116 +-
policy/modules/apps/gpg.fc | 1
policy/modules/apps/gpg.te | 8
policy/modules/apps/java.fc | 23
policy/modules/apps/java.if | 113 +
policy/modules/apps/java.te | 18
policy/modules/apps/kdumpgui.fc | 2
policy/modules/apps/kdumpgui.if | 2
policy/modules/apps/kdumpgui.te | 64 +
policy/modules/apps/livecd.fc | 2
policy/modules/apps/livecd.if | 52
policy/modules/apps/livecd.te | 27
policy/modules/apps/loadkeys.te | 6
policy/modules/apps/mono.fc | 2
policy/modules/apps/mono.if | 101 +
policy/modules/apps/mono.te | 9
policy/modules/apps/mozilla.fc | 2
policy/modules/apps/mozilla.if | 27
policy/modules/apps/mozilla.te | 22
policy/modules/apps/nsplugin.fc | 10
policy/modules/apps/nsplugin.if | 321 +++++
policy/modules/apps/nsplugin.te | 296 +++++
policy/modules/apps/openoffice.fc | 3
policy/modules/apps/openoffice.if | 92 +
policy/modules/apps/openoffice.te | 11
policy/modules/apps/podsleuth.te | 3
policy/modules/apps/ptchown.if | 24
policy/modules/apps/pulseaudio.fc | 6
policy/modules/apps/pulseaudio.if | 70 +
policy/modules/apps/pulseaudio.te | 27
policy/modules/apps/qemu.fc | 4
policy/modules/apps/qemu.if | 189 +++
policy/modules/apps/qemu.te | 83 +
policy/modules/apps/sambagui.fc | 1
policy/modules/apps/sambagui.if | 2
policy/modules/apps/sambagui.te | 61 +
policy/modules/apps/sandbox.fc | 1
policy/modules/apps/sandbox.if | 225 +++
policy/modules/apps/sandbox.te | 349 ++++++
policy/modules/apps/screen.if | 1
policy/modules/apps/sectoolm.fc | 6
policy/modules/apps/sectoolm.if | 3
policy/modules/apps/sectoolm.te | 118 ++
policy/modules/apps/seunshare.if | 2
policy/modules/apps/seunshare.te | 3
policy/modules/apps/slocate.te | 1
policy/modules/apps/vmware.if | 19
policy/modules/apps/vmware.te | 9
policy/modules/apps/wine.fc | 24
policy/modules/apps/wine.if | 118 ++
policy/modules/apps/wine.te | 50
policy/modules/kernel/corecommands.fc | 33
policy/modules/kernel/corecommands.if | 21
policy/modules/kernel/corenetwork.if.in | 18
policy/modules/kernel/corenetwork.te.in | 46
policy/modules/kernel/devices.fc | 8
policy/modules/kernel/devices.if | 90 +
policy/modules/kernel/devices.te | 12
policy/modules/kernel/domain.if | 174 ++-
policy/modules/kernel/domain.te | 103 +
policy/modules/kernel/files.fc | 9
policy/modules/kernel/files.if | 503 ++++++++
policy/modules/kernel/files.te | 12
policy/modules/kernel/filesystem.if | 251 ++++
policy/modules/kernel/filesystem.te | 8
policy/modules/kernel/kernel.if | 58 +
policy/modules/kernel/kernel.te | 27
policy/modules/kernel/selinux.if | 25
policy/modules/kernel/storage.fc | 1
policy/modules/kernel/storage.if | 1
policy/modules/kernel/terminal.if | 27
policy/modules/roles/guest.te | 8
policy/modules/roles/staff.te | 124 --
policy/modules/roles/sysadm.te | 125 --
policy/modules/roles/unconfineduser.fc | 10
policy/modules/roles/unconfineduser.if | 667 +++++++++++
policy/modules/roles/unconfineduser.te | 445 +++++++
policy/modules/roles/unprivuser.te | 127 --
policy/modules/roles/xguest.te | 72 +
policy/modules/services/abrt.fc | 8
policy/modules/services/abrt.if | 144 ++
policy/modules/services/abrt.te | 128 ++
policy/modules/services/afs.fc | 2
policy/modules/services/afs.te | 6
policy/modules/services/aiccu.fc | 5
policy/modules/services/aiccu.if | 119 ++
policy/modules/services/aiccu.te | 41
policy/modules/services/aisexec.fc | 12
policy/modules/services/aisexec.if | 106 +
policy/modules/services/aisexec.te | 112 +
policy/modules/services/amavis.te | 2
policy/modules/services/apache.fc | 61 +
policy/modules/services/apache.if | 512 ++++++---
policy/modules/services/apache.te | 477 +++++++-
policy/modules/services/apm.te | 4
policy/modules/services/arpwatch.te | 3
policy/modules/services/asterisk.if | 53
policy/modules/services/asterisk.te | 42
policy/modules/services/automount.te | 2
policy/modules/services/avahi.fc | 2
policy/modules/services/avahi.te | 13
policy/modules/services/bind.if | 61 +
policy/modules/services/bluetooth.te | 1
policy/modules/services/ccs.fc | 8
policy/modules/services/ccs.te | 33
policy/modules/services/certmaster.fc | 1
policy/modules/services/certmonger.fc | 6
policy/modules/services/certmonger.if | 217 +++
policy/modules/services/certmonger.te | 74 +
policy/modules/services/cgroup.fc | 7
policy/modules/services/cgroup.if | 35
policy/modules/services/cgroup.te | 87 +
policy/modules/services/chronyd.fc | 13
policy/modules/services/chronyd.if | 106 +
policy/modules/services/chronyd.te | 76 +
policy/modules/services/clamav.te | 5
policy/modules/services/clogd.fc | 4
policy/modules/services/clogd.if | 98 +
policy/modules/services/clogd.te | 62 +
policy/modules/services/cobbler.fc | 9
policy/modules/services/cobbler.if | 186 +++
policy/modules/services/cobbler.te | 127 ++
policy/modules/services/consolekit.fc | 3
policy/modules/services/consolekit.if | 39
policy/modules/services/consolekit.te | 23
policy/modules/services/corosync.fc | 13
policy/modules/services/corosync.if | 108 +
policy/modules/services/corosync.te | 108 +
policy/modules/services/cron.fc | 6
policy/modules/services/cron.if | 74 +
policy/modules/services/cron.te | 86 +
policy/modules/services/cups.fc | 14
policy/modules/services/cups.te | 62 -
policy/modules/services/cvs.te | 1
policy/modules/services/cyrus.te | 2
policy/modules/services/dbus.if | 53
policy/modules/services/dbus.te | 31
policy/modules/services/denyhosts.fc | 7
policy/modules/services/denyhosts.if | 90 +
policy/modules/services/denyhosts.te | 72 +
policy/modules/services/devicekit.fc | 3
policy/modules/services/devicekit.if | 20
policy/modules/services/devicekit.te | 83 +
policy/modules/services/dhcp.if | 19
policy/modules/services/dnsmasq.fc | 1
policy/modules/services/dnsmasq.if | 38
policy/modules/services/dnsmasq.te | 19
policy/modules/services/dovecot.fc | 1
policy/modules/services/dovecot.te | 33
policy/modules/services/exim.te | 4
policy/modules/services/fail2ban.if | 58 +
policy/modules/services/fetchmail.te | 1
policy/modules/services/fprintd.te | 2
policy/modules/services/ftp.if | 38
policy/modules/services/ftp.te | 176 ++-
policy/modules/services/git.fc | 19
policy/modules/services/git.if | 536 +++++++++
policy/modules/services/git.te | 179 +++
policy/modules/services/gpsd.te | 2
policy/modules/services/hal.fc | 1
policy/modules/services/hal.if | 18
policy/modules/services/hal.te | 53
policy/modules/services/howl.te | 2
policy/modules/services/kerberos.if | 6
policy/modules/services/kerberos.te | 3
policy/modules/services/ksmtuned.fc | 5
policy/modules/services/ksmtuned.if | 76 +
policy/modules/services/ksmtuned.te | 44
policy/modules/services/ktalk.te | 1
policy/modules/services/ldap.fc | 8
policy/modules/services/ldap.if | 38
policy/modules/services/ldap.te | 7
policy/modules/services/lircd.te | 21
policy/modules/services/mailman.fc | 10
policy/modules/services/memcached.te | 10
policy/modules/services/modemmanager.te | 5
policy/modules/services/mta.fc | 2
policy/modules/services/mta.if | 25
policy/modules/services/mta.te | 16
policy/modules/services/munin.fc | 3
policy/modules/services/munin.te | 6
policy/modules/services/mysql.if | 38
policy/modules/services/mysql.te | 22
policy/modules/services/nagios.fc | 79 +
policy/modules/services/nagios.if | 126 ++
policy/modules/services/nagios.te | 207 +++
policy/modules/services/networkmanager.fc | 16
policy/modules/services/networkmanager.if | 65 +
policy/modules/services/networkmanager.te | 121 +-
policy/modules/services/nis.fc | 10
policy/modules/services/nis.if | 87 +
policy/modules/services/nis.te | 19
policy/modules/services/nscd.if | 20
policy/modules/services/nscd.te | 23
policy/modules/services/ntop.fc | 1
policy/modules/services/ntop.te | 34
policy/modules/services/ntp.te | 2
policy/modules/services/nut.fc | 16
policy/modules/services/nut.if | 58 +
policy/modules/services/nut.te | 188 +++
policy/modules/services/nx.fc | 10
policy/modules/services/nx.if | 67 +
policy/modules/services/nx.te | 13
policy/modules/services/oddjob.if | 1
policy/modules/services/oddjob.te | 5
policy/modules/services/openvpn.te | 7
policy/modules/services/pcscd.if | 38
policy/modules/services/pegasus.te | 28
policy/modules/services/plymouth.fc | 5
policy/modules/services/plymouth.if | 322 +++++
policy/modules/services/plymouth.te | 102 +
policy/modules/services/policykit.fc | 5
policy/modules/services/policykit.if | 71 +
policy/modules/services/policykit.te | 73 +
policy/modules/services/portreserve.te | 3
policy/modules/services/postfix.fc | 2
policy/modules/services/postfix.if | 150 ++
policy/modules/services/postfix.te | 144 ++
policy/modules/services/postgresql.fc | 16
policy/modules/services/postgresql.if | 60 +
policy/modules/services/postgresql.te | 9
policy/modules/services/ppp.fc | 2
policy/modules/services/ppp.if | 4
policy/modules/services/ppp.te | 10
policy/modules/services/prelude.te | 3
policy/modules/services/procmail.te | 12
policy/modules/services/puppet.te | 2
policy/modules/services/pyzor.fc | 4
policy/modules/services/pyzor.if | 47
policy/modules/services/pyzor.te | 37
policy/modules/services/razor.fc | 1
policy/modules/services/razor.if | 42
policy/modules/services/razor.te | 32
policy/modules/services/rdisc.if | 19
policy/modules/services/rgmanager.fc | 8
policy/modules/services/rgmanager.if | 59 +
policy/modules/services/rgmanager.te | 186 +++
policy/modules/services/rhcs.fc | 24
policy/modules/services/rhcs.if | 367 ++++++
policy/modules/services/rhcs.te | 422 +++++++
policy/modules/services/ricci.te | 31
policy/modules/services/rpc.fc | 4
policy/modules/services/rpc.if | 45
policy/modules/services/rpc.te | 27
policy/modules/services/rsync.fc | 1
policy/modules/services/rsync.if | 38
policy/modules/services/rsync.te | 28
policy/modules/services/rtkit.if | 20
policy/modules/services/rtkit.te | 4
policy/modules/services/samba.fc | 4
policy/modules/services/samba.if | 138 ++
policy/modules/services/samba.te | 111 +
policy/modules/services/sasl.te | 15
policy/modules/services/sendmail.if | 19
policy/modules/services/sendmail.te | 17
policy/modules/services/setroubleshoot.fc | 2
policy/modules/services/setroubleshoot.if | 124 ++
policy/modules/services/setroubleshoot.te | 85 +
policy/modules/services/snmp.if | 18
policy/modules/services/snmp.te | 2
policy/modules/services/snort.te | 9
policy/modules/services/spamassassin.fc | 15
policy/modules/services/spamassassin.if | 107 +
policy/modules/services/spamassassin.te | 140 ++
policy/modules/services/squid.te | 9
policy/modules/services/ssh.fc | 2
policy/modules/services/ssh.if | 59 -
policy/modules/services/ssh.te | 59 -
policy/modules/services/sssd.fc | 2
policy/modules/services/sssd.if | 47
policy/modules/services/sssd.te | 15
policy/modules/services/sysstat.te | 5
policy/modules/services/telnet.te | 1
policy/modules/services/tftp.if | 38
policy/modules/services/tftp.te | 3
policy/modules/services/tgtd.if | 17
policy/modules/services/tgtd.te | 2
policy/modules/services/tor.te | 13
policy/modules/services/tuned.fc | 3
policy/modules/services/tuned.te | 10
policy/modules/services/usbmuxd.fc | 4
policy/modules/services/usbmuxd.if | 39
policy/modules/services/usbmuxd.te | 43
policy/modules/services/uucp.te | 5
policy/modules/services/vhostmd.fc | 6
policy/modules/services/vhostmd.if | 228 ++++
policy/modules/services/vhostmd.te | 84 +
policy/modules/services/virt.fc | 17
policy/modules/services/virt.if | 210 +++
policy/modules/services/virt.te | 297 ++++-
policy/modules/services/w3c.te | 7
policy/modules/services/xserver.fc | 54
policy/modules/services/xserver.if | 362 ++++++
policy/modules/services/xserver.te | 376 +++++-
policy/modules/services/zebra.if | 20
policy/modules/system/application.te | 11
policy/modules/system/authlogin.fc | 9
policy/modules/system/authlogin.if | 210 +++
policy/modules/system/authlogin.te | 11
policy/modules/system/fstools.fc | 3
policy/modules/system/fstools.te | 5
policy/modules/system/getty.te | 7
policy/modules/system/hostname.te | 3
policy/modules/system/hotplug.te | 4
policy/modules/system/init.fc | 7
policy/modules/system/init.if | 195 +++
policy/modules/system/init.te | 305 ++++-
policy/modules/system/ipsec.fc | 4
policy/modules/system/ipsec.if | 65 -
policy/modules/system/ipsec.te | 31
policy/modules/system/iptables.fc | 9
policy/modules/system/iptables.te | 17
policy/modules/system/iscsi.fc | 9
policy/modules/system/iscsi.te | 26
policy/modules/system/libraries.fc | 221 +++
policy/modules/system/libraries.if | 5
policy/modules/system/libraries.te | 18
policy/modules/system/locallogin.te | 35
policy/modules/system/logging.fc | 13
policy/modules/system/logging.if | 20
policy/modules/system/logging.te | 42
policy/modules/system/lvm.te | 10
policy/modules/system/miscfiles.fc | 3
policy/modules/system/miscfiles.if | 69 +
policy/modules/system/miscfiles.te | 3
policy/modules/system/modutils.te | 20
policy/modules/system/mount.fc | 7
policy/modules/system/mount.if | 59 +
policy/modules/system/mount.te | 100 +
policy/modules/system/raid.te | 2
policy/modules/system/selinuxutil.fc | 17
policy/modules/system/selinuxutil.if | 309 +++++
policy/modules/system/selinuxutil.te | 230 +---
policy/modules/system/sysnetwork.fc | 14
policy/modules/system/sysnetwork.if | 116 +-
policy/modules/system/sysnetwork.te | 80 +
policy/modules/system/udev.if | 1
policy/modules/system/udev.te | 16
policy/modules/system/unconfined.fc | 15
policy/modules/system/unconfined.if | 445 -------
policy/modules/system/unconfined.te | 224 ---
policy/modules/system/userdomain.fc | 9
policy/modules/system/userdomain.if | 1696 +++++++++++++++++++++++-------
policy/modules/system/userdomain.te | 51
policy/modules/system/xen.if | 19
policy/modules/system/xen.te | 20
policy/support/obj_perm_sets.spt | 25
policy/users | 17
398 files changed, 21512 insertions(+), 2768 deletions(-)
Index: policy-F13.patch
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/devel/policy-F13.patch,v
retrieving revision 1.45
retrieving revision 1.46
diff -u -p -r1.45 -r1.46
--- policy-F13.patch 2 Feb 2010 16:41:02 -0000 1.45
+++ policy-F13.patch 3 Feb 2010 20:52:56 -0000 1.46
@@ -123,14 +123,6 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.fc serefpolicy-3.7.8/policy/modules/admin/dmesg.fc
---- nsaserefpolicy/policy/modules/admin/dmesg.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/admin/dmesg.fc 2010-02-02 10:31:03.000000000 -0500
-@@ -1,2 +1,4 @@
-
- /bin/dmesg -- gen_context(system_u:object_r:dmesg_exec_t,s0)
-+
-+/usr/sbin/mcelog -- gen_context(system_u:object_r:dmesg_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmesg.te serefpolicy-3.7.8/policy/modules/admin/dmesg.te
--- nsaserefpolicy/policy/modules/admin/dmesg.te 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.7.8/policy/modules/admin/dmesg.te 2010-02-02 10:31:03.000000000 -0500
@@ -333,6 +325,72 @@ diff --exclude-from=exclude -N -u -r nsa
samba_read_log(logwatch_t)
+ samba_read_share_files(logwatch_t)
')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mcelog.fc serefpolicy-3.7.8/policy/modules/admin/mcelog.fc
+--- nsaserefpolicy/policy/modules/admin/mcelog.fc 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/admin/mcelog.fc 2010-02-03 08:26:08.000000000 -0500
+@@ -0,0 +1,2 @@
++
++/usr/sbin/mcelog -- gen_context(system_u:object_r:mcelog_exec_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mcelog.if serefpolicy-3.7.8/policy/modules/admin/mcelog.if
+--- nsaserefpolicy/policy/modules/admin/mcelog.if 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/admin/mcelog.if 2010-02-03 08:26:09.000000000 -0500
+@@ -0,0 +1,21 @@
++
++## <summary>policy for mcelog</summary>
++
++########################################
++## <summary>
++## Execute a domain transition to run mcelog.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`mcelog_domtrans',`
++ gen_require(`
++ type mcelog_t, mcelog_exec_t;
++ ')
++
++ domtrans_pattern($1, mcelog_exec_t, mcelog_t)
++')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mcelog.te serefpolicy-3.7.8/policy/modules/admin/mcelog.te
+--- nsaserefpolicy/policy/modules/admin/mcelog.te 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/admin/mcelog.te 2010-02-03 08:26:09.000000000 -0500
+@@ -0,0 +1,31 @@
++
++policy_module(mcelog,1.0.0)
++
++########################################
++#
++# Declarations
++#
++
++type mcelog_t;
++type mcelog_exec_t;
++application_domain(mcelog_t, mcelog_exec_t)
++cron_system_entry(mcelog_t, mcelog_exec_t)
++
++permissive mcelog_t;
++
++########################################
++#
++# mcelog local policy
++#
++
++
++kernel_read_system_state(mcelog_t)
++
++dev_read_raw_memory(mcelog_t)
++dev_read_kmsg(mcelog_t)
++
++files_read_etc_files(mcelog_t)
++
++miscfiles_read_localization(mcelog_t)
++
++logging_send_syslog_msg(mcelog_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mrtg.te serefpolicy-3.7.8/policy/modules/admin/mrtg.te
--- nsaserefpolicy/policy/modules/admin/mrtg.te 2009-11-17 10:54:26.000000000 -0500
+++ serefpolicy-3.7.8/policy/modules/admin/mrtg.te 2010-02-02 10:31:03.000000000 -0500
@@ -2316,8 +2374,8 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.7.8/policy/modules/apps/gnome.fc
--- nsaserefpolicy/policy/modules/apps/gnome.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/apps/gnome.fc 2010-02-02 10:31:03.000000000 -0500
-@@ -1,8 +1,25 @@
++++ serefpolicy-3.7.8/policy/modules/apps/gnome.fc 2010-02-02 16:41:41.000000000 -0500
+@@ -1,8 +1,28 @@
-HOME_DIR/\.config/gtk-.* gen_context(system_u:object_r:gnome_home_t,s0)
+HOME_DIR/\.cache(/.*)? gen_context(system_u:object_r:cache_home_t,s0)
+HOME_DIR/\.config(/.*)? gen_context(system_u:object_r:config_home_t,s0)
@@ -2326,12 +2384,15 @@ diff --exclude-from=exclude -N -u -r nsa
+HOME_DIR/\.gstreamer-.* gen_context(system_u:object_r:gstreamer_home_t,s0)
+HOME_DIR/\.local.* gen_context(system_u:object_r:gconf_home_t,s0)
+HOME_DIR/\.local/share(.*)? gen_context(system_u:object_r:data_home_t,s0)
++/HOME_DIR/\.Xdefaults gen_context(system_u:object_r:config_home_t,s0)
++
+/root/\.config(/.*)? gen_context(system_u:object_r:config_home_t,s0)
+/root/\.gconf(d)?(/.*)? gen_context(system_u:object_r:gconf_home_t,s0)
+/root/\.gnome2(/.*)? gen_context(system_u:object_r:gnome_home_t,s0)
+/root/\.gstreamer-.* gen_context(system_u:object_r:gstreamer_home_t,s0)
+/root/\.local.* gen_context(system_u:object_r:gconf_home_t,s0)
+/root/\.local/share(.*)? gen_context(system_u:object_r:data_home_t,s0)
++/root/\.Xdefaults gen_context(system_u:object_r:config_home_t,s0)
/etc/gconf(/.*)? gen_context(system_u:object_r:gconf_etc_t,s0)
@@ -6219,7 +6280,7 @@ diff --exclude-from=exclude -N -u -r nsa
#network_node(multicast, s0 - mls_systemhigh, ff00::, ff00::)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.7.8/policy/modules/kernel/devices.fc
--- nsaserefpolicy/policy/modules/kernel/devices.fc 2009-11-20 10:51:41.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/kernel/devices.fc 2010-02-02 10:31:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/kernel/devices.fc 2010-02-03 11:34:06.000000000 -0500
@@ -16,13 +16,16 @@
/dev/audio.* -c gen_context(system_u:object_r:sound_device_t,s0)
/dev/autofs.* -c gen_context(system_u:object_r:autofs_device_t,s0)
@@ -6253,7 +6314,15 @@ diff --exclude-from=exclude -N -u -r nsa
/dev/usblp.* -c gen_context(system_u:object_r:printer_device_t,s0)
ifdef(`distro_suse', `
/dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0)
-@@ -159,6 +164,8 @@
+@@ -142,6 +147,7 @@
+ /dev/input/mice -c gen_context(system_u:object_r:mouse_device_t,s0)
+ /dev/input/js.* -c gen_context(system_u:object_r:mouse_device_t,s0)
+ /dev/input/uinput -c gen_context(system_u:object_r:event_device_t,s0)
++/dev/uinput -c gen_context(system_u:object_r:event_device_t,s0)
+
+ /dev/mapper/control -c gen_context(system_u:object_r:lvm_control_t,s0)
+
+@@ -159,6 +165,8 @@
/dev/usb/mdc800.* -c gen_context(system_u:object_r:scanner_device_t,s0)
/dev/usb/scanner.* -c gen_context(system_u:object_r:scanner_device_t,s0)
@@ -11874,7 +11943,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.7.8/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/services/apache.te 2010-02-02 10:31:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/apache.te 2010-02-03 13:33:57.000000000 -0500
@@ -19,6 +19,8 @@
# Declarations
#
@@ -12091,15 +12160,20 @@ diff --exclude-from=exclude -N -u -r nsa
manage_dirs_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
manage_files_pattern(httpd_t, httpd_tmp_t, httpd_tmp_t)
-@@ -301,6 +370,7 @@
+@@ -301,9 +370,11 @@
manage_files_pattern(httpd_t, httpd_var_lib_t, httpd_var_lib_t)
files_var_lib_filetrans(httpd_t, httpd_var_lib_t, file)
+setattr_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
++manage_dirs_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
manage_files_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
manage_sock_files_pattern(httpd_t, httpd_var_run_t, httpd_var_run_t)
- files_pid_filetrans(httpd_t, httpd_var_run_t, { file sock_file })
-@@ -312,18 +382,21 @@
+-files_pid_filetrans(httpd_t, httpd_var_run_t, { file sock_file })
++files_pid_filetrans(httpd_t, httpd_var_run_t, { file sock_file dir })
+
+ manage_dirs_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
+ manage_files_pattern(httpd_t, squirrelmail_spool_t, squirrelmail_spool_t)
+@@ -312,18 +383,21 @@
kernel_read_kernel_sysctls(httpd_t)
# for modules that want to access /proc/meminfo
kernel_read_system_state(httpd_t)
@@ -12126,7 +12200,7 @@ diff --exclude-from=exclude -N -u -r nsa
corenet_sendrecv_http_server_packets(httpd_t)
# Signal self for shutdown
corenet_tcp_connect_http_port(httpd_t)
-@@ -335,15 +408,15 @@
+@@ -335,15 +409,15 @@
fs_getattr_all_fs(httpd_t)
fs_search_auto_mountpoints(httpd_t)
@@ -12145,7 +12219,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_read_usr_files(httpd_t)
files_list_mnt(httpd_t)
files_search_spool(httpd_t)
-@@ -358,6 +431,10 @@
+@@ -358,6 +432,10 @@
files_read_var_lib_symlinks(httpd_t)
fs_search_auto_mountpoints(httpd_sys_script_t)
@@ -12156,7 +12230,7 @@ diff --exclude-from=exclude -N -u -r nsa
libs_read_lib_files(httpd_t)
-@@ -372,18 +449,33 @@
+@@ -372,18 +450,33 @@
userdom_use_unpriv_users_fds(httpd_t)
@@ -12194,7 +12268,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
')
-@@ -391,32 +483,71 @@
+@@ -391,32 +484,71 @@
corenet_tcp_connect_all_ports(httpd_t)
')
@@ -12271,7 +12345,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -424,11 +555,23 @@
+@@ -424,11 +556,23 @@
fs_read_nfs_symlinks(httpd_t)
')
@@ -12295,7 +12369,7 @@ diff --exclude-from=exclude -N -u -r nsa
tunable_policy(`httpd_ssi_exec',`
corecmd_shell_domtrans(httpd_t, httpd_sys_script_t)
allow httpd_sys_script_t httpd_t:fd use;
-@@ -451,6 +594,21 @@
+@@ -451,6 +595,21 @@
')
optional_policy(`
@@ -12317,7 +12391,7 @@ diff --exclude-from=exclude -N -u -r nsa
cron_system_entry(httpd_t, httpd_exec_t)
')
-@@ -459,8 +617,18 @@
+@@ -459,8 +618,18 @@
')
optional_policy(`
@@ -12338,7 +12412,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -468,22 +636,19 @@
+@@ -468,22 +637,19 @@
mailman_domtrans_cgi(httpd_t)
# should have separate types for public and private archives
mailman_search_data(httpd_t)
@@ -12364,7 +12438,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -494,12 +659,23 @@
+@@ -494,12 +660,23 @@
')
optional_policy(`
@@ -12388,7 +12462,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
')
-@@ -508,6 +684,7 @@
+@@ -508,6 +685,7 @@
')
optional_policy(`
@@ -12396,7 +12470,7 @@ diff --exclude-from=exclude -N -u -r nsa
snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
')
-@@ -535,6 +712,23 @@
+@@ -535,6 +713,23 @@
userdom_use_user_terminals(httpd_helper_t)
@@ -12420,7 +12494,7 @@ diff --exclude-from=exclude -N -u -r nsa
########################################
#
# Apache PHP script local policy
-@@ -564,20 +758,25 @@
+@@ -564,20 +759,25 @@
fs_search_auto_mountpoints(httpd_php_t)
@@ -12452,7 +12526,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -595,23 +794,24 @@
+@@ -595,23 +795,24 @@
append_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
read_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
@@ -12481,7 +12555,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_read_etc_files(httpd_suexec_t)
files_read_usr_files(httpd_suexec_t)
-@@ -624,6 +824,7 @@
+@@ -624,6 +825,7 @@
logging_send_syslog_msg(httpd_suexec_t)
miscfiles_read_localization(httpd_suexec_t)
@@ -12489,7 +12563,7 @@ diff --exclude-from=exclude -N -u -r nsa
tunable_policy(`httpd_can_network_connect',`
allow httpd_suexec_t self:tcp_socket create_stream_socket_perms;
-@@ -631,22 +832,31 @@
+@@ -631,22 +833,31 @@
corenet_all_recvfrom_unlabeled(httpd_suexec_t)
corenet_all_recvfrom_netlabel(httpd_suexec_t)
@@ -12528,7 +12602,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -672,16 +882,16 @@
+@@ -672,16 +883,16 @@
dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
')
@@ -12549,7 +12623,7 @@ diff --exclude-from=exclude -N -u -r nsa
dontaudit httpd_sys_script_t httpd_config_t:dir search;
-@@ -699,12 +909,24 @@
+@@ -699,12 +910,24 @@
# Should we add a boolean?
apache_domtrans_rotatelogs(httpd_sys_script_t)
@@ -12576,7 +12650,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -712,6 +934,35 @@
+@@ -712,6 +935,35 @@
fs_read_nfs_symlinks(httpd_sys_script_t)
')
@@ -12612,7 +12686,7 @@ diff --exclude-from=exclude -N -u -r nsa
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_sys_script_t)
fs_read_cifs_symlinks(httpd_sys_script_t)
-@@ -724,6 +975,10 @@
+@@ -724,6 +976,10 @@
optional_policy(`
mysql_stream_connect(httpd_sys_script_t)
mysql_rw_db_sockets(httpd_sys_script_t)
@@ -12623,7 +12697,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -735,6 +990,8 @@
+@@ -735,6 +991,8 @@
# httpd_rotatelogs local policy
#
@@ -12632,7 +12706,7 @@ diff --exclude-from=exclude -N -u -r nsa
manage_files_pattern(httpd_rotatelogs_t, httpd_log_t, httpd_log_t)
kernel_read_kernel_sysctls(httpd_rotatelogs_t)
-@@ -754,11 +1011,88 @@
+@@ -754,11 +1012,88 @@
tunable_policy(`httpd_enable_cgi && httpd_unified',`
allow httpd_user_script_t httpdcontent:file entrypoint;
@@ -20510,7 +20584,7 @@ diff --exclude-from=exclude -N -u -r nsa
+/var/run/plymouth(/.*)? gen_context(system_u:object_r:plymouthd_var_run_t, s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plymouth.if serefpolicy-3.7.8/policy/modules/services/plymouth.if
--- nsaserefpolicy/policy/modules/services/plymouth.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/services/plymouth.if 2010-02-02 10:31:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/plymouth.if 2010-02-02 16:48:03.000000000 -0500
@@ -0,0 +1,322 @@
+## <summary>policy for plymouthd</summary>
+
@@ -20836,8 +20910,8 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plymouth.te serefpolicy-3.7.8/policy/modules/services/plymouth.te
--- nsaserefpolicy/policy/modules/services/plymouth.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/services/plymouth.te 2010-02-02 10:31:03.000000000 -0500
-@@ -0,0 +1,101 @@
++++ serefpolicy-3.7.8/policy/modules/services/plymouth.te 2010-02-03 15:28:58.000000000 -0500
+@@ -0,0 +1,102 @@
+policy_module(plymouthd, 1.0.0)
+
+########################################
@@ -20893,6 +20967,7 @@ diff --exclude-from=exclude -N -u -r nsa
+
+miscfiles_read_localization(plymouthd_t)
+miscfiles_read_fonts(plymouthd_t)
++miscfiles_manage_fonts_cache(plymouthd_t)
+
+manage_dirs_pattern(plymouthd_t, plymouthd_var_run_t, plymouthd_var_run_t)
+manage_files_pattern(plymouthd_t, plymouthd_var_run_t, plymouthd_var_run_t)
@@ -25278,7 +25353,7 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.7.8/policy/modules/services/spamassassin.te
--- nsaserefpolicy/policy/modules/services/spamassassin.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/services/spamassassin.te 2010-02-02 10:31:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/spamassassin.te 2010-02-03 08:51:00.000000000 -0500
@@ -20,6 +20,35 @@
## </desc>
gen_tunable(spamd_enable_home_dirs, true)
@@ -25345,16 +25420,17 @@ diff --exclude-from=exclude -N -u -r nsa
# this should probably be removed
corecmd_list_bin(spamassassin_t)
-@@ -150,6 +191,8 @@
+@@ -150,6 +191,9 @@
corenet_udp_sendrecv_all_ports(spamassassin_t)
corenet_tcp_connect_all_ports(spamassassin_t)
corenet_sendrecv_all_client_packets(spamassassin_t)
+ corenet_udp_bind_generic_node(spamassassin_t)
+ corenet_udp_bind_generic_port(spamassassin_t)
++ corenet_dontaudit_udp_bind_all_ports(spamassassin_t)
sysnet_read_config(spamassassin_t)
')
-@@ -186,6 +229,8 @@
+@@ -186,6 +230,8 @@
optional_policy(`
mta_read_config(spamassassin_t)
sendmail_stub(spamassassin_t)
@@ -25363,7 +25439,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -207,16 +252,33 @@
+@@ -207,16 +253,33 @@
allow spamc_t self:unix_stream_socket connectto;
allow spamc_t self:tcp_socket create_stream_socket_perms;
allow spamc_t self:udp_socket create_socket_perms;
@@ -25397,7 +25473,7 @@ diff --exclude-from=exclude -N -u -r nsa
corenet_all_recvfrom_unlabeled(spamc_t)
corenet_all_recvfrom_netlabel(spamc_t)
-@@ -246,9 +308,16 @@
+@@ -246,9 +309,16 @@
files_dontaudit_search_var(spamc_t)
# cjp: this may be removable:
files_list_home(spamc_t)
@@ -25414,7 +25490,7 @@ diff --exclude-from=exclude -N -u -r nsa
miscfiles_read_localization(spamc_t)
# cjp: this should probably be removed:
-@@ -256,27 +325,40 @@
+@@ -256,27 +326,40 @@
sysnet_read_config(spamc_t)
@@ -25461,7 +25537,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -288,7 +370,7 @@
+@@ -288,7 +371,7 @@
# setuids to the user running spamc. Comment this if you are not
# using this ability.
@@ -25470,7 +25546,7 @@ diff --exclude-from=exclude -N -u -r nsa
dontaudit spamd_t self:capability sys_tty_config;
allow spamd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow spamd_t self:fd use;
-@@ -304,10 +386,17 @@
+@@ -304,10 +387,17 @@
allow spamd_t self:unix_stream_socket connectto;
allow spamd_t self:tcp_socket create_stream_socket_perms;
allow spamd_t self:udp_socket create_socket_perms;
@@ -25489,7 +25565,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_spool_filetrans(spamd_t, spamd_spool_t, { file dir })
manage_dirs_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t)
-@@ -316,10 +405,12 @@
+@@ -316,10 +406,12 @@
# var/lib files for spamd
allow spamd_t spamd_var_lib_t:dir list_dir_perms;
@@ -25503,7 +25579,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_pid_filetrans(spamd_t, spamd_var_run_t, { dir file })
kernel_read_all_sysctls(spamd_t)
-@@ -369,22 +460,27 @@
+@@ -369,22 +461,27 @@
init_dontaudit_rw_utmp(spamd_t)
@@ -25535,7 +25611,7 @@ diff --exclude-from=exclude -N -u -r nsa
fs_manage_cifs_files(spamd_t)
')
-@@ -402,23 +498,16 @@
+@@ -402,23 +499,16 @@
optional_policy(`
dcc_domtrans_client(spamd_t)
@@ -25560,7 +25636,7 @@ diff --exclude-from=exclude -N -u -r nsa
postfix_read_config(spamd_t)
')
-@@ -433,6 +522,10 @@
+@@ -433,6 +523,10 @@
optional_policy(`
razor_domtrans(spamd_t)
@@ -25571,7 +25647,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -445,5 +538,9 @@
+@@ -445,5 +539,9 @@
')
optional_policy(`
@@ -26212,10 +26288,41 @@ diff --exclude-from=exclude -N -u -r nsa
+tunable_policy(`tor_bind_all_unreserved_ports', `
+ corenet_tcp_bind_all_unreserved_ports(tor_t)
+')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tuned.fc serefpolicy-3.7.8/policy/modules/services/tuned.fc
+--- nsaserefpolicy/policy/modules/services/tuned.fc 2009-11-12 12:51:51.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/tuned.fc 2010-02-03 13:29:02.000000000 -0500
+@@ -2,4 +2,7 @@
+
+ /usr/sbin/tuned -- gen_context(system_u:object_r:tuned_exec_t,s0)
+
++/var/log/tuned(/.*)? gen_context(system_u:object_r:tuned_log_t,s0)
++/var/log/tuned\.log -- gen_context(system_u:object_r:tuned_log_t,s0)
++
+ /var/run/tuned\.pid -- gen_context(system_u:object_r:tuned_var_run_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tuned.te serefpolicy-3.7.8/policy/modules/services/tuned.te
--- nsaserefpolicy/policy/modules/services/tuned.te 2009-12-18 11:38:25.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/services/tuned.te 2010-02-02 10:31:03.000000000 -0500
-@@ -27,6 +27,7 @@
++++ serefpolicy-3.7.8/policy/modules/services/tuned.te 2010-02-03 13:29:02.000000000 -0500
+@@ -13,6 +13,9 @@
+ type tuned_initrc_exec_t;
+ init_script_file(tuned_initrc_exec_t)
+
++type tuned_log_t;
++logging_log_file(tuned_log_t)
++
+ type tuned_var_run_t;
+ files_pid_file(tuned_var_run_t)
+
+@@ -22,15 +25,22 @@
+ #
+
+ dontaudit tuned_t self:capability { dac_override sys_tty_config };
++allow tuned_t self:process fork;
++
++manage_dirs_pattern(tuned_t, tuned_log_t, tuned_log_t)
++manage_files_pattern(tuned_t, tuned_log_t, tuned_log_t)
++logging_log_filetrans(tuned_t, tuned_log_t, file)
+
+ manage_files_pattern(tuned_t, tuned_var_run_t, tuned_var_run_t)
files_pid_filetrans(tuned_t, tuned_var_run_t, file)
corecmd_exec_shell(tuned_t)
@@ -26223,15 +26330,19 @@ diff --exclude-from=exclude -N -u -r nsa
kernel_read_system_state(tuned_t)
kernel_read_network_state(tuned_t)
+
++dev_read_urand(tuned_t)
+ dev_read_sysfs(tuned_t)
+ # to allow cpu tuning
+ dev_rw_netcontrol(tuned_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/usbmuxd.fc serefpolicy-3.7.8/policy/modules/services/usbmuxd.fc
--- nsaserefpolicy/policy/modules/services/usbmuxd.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/services/usbmuxd.fc 2010-02-02 10:31:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/usbmuxd.fc 2010-02-03 14:20:04.000000000 -0500
@@ -0,0 +1,4 @@
+
+/usr/sbin/usbmuxd -- gen_context(system_u:object_r:usbmuxd_exec_t,s0)
+
+/var/run/usbmuxd -s gen_context(system_u:object_r:usbmuxd_var_run_t,s0)
-\ No newline at end of file
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/usbmuxd.if serefpolicy-3.7.8/policy/modules/services/usbmuxd.if
--- nsaserefpolicy/policy/modules/services/usbmuxd.if 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.7.8/policy/modules/services/usbmuxd.if 2010-02-02 10:31:03.000000000 -0500
@@ -27414,7 +27525,7 @@ diff --exclude-from=exclude -N -u -r nsa
corenet_tcp_connect_http_port(httpd_w3c_validator_script_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.7.8/policy/modules/services/xserver.fc
--- nsaserefpolicy/policy/modules/services/xserver.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/services/xserver.fc 2010-02-02 10:31:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/xserver.fc 2010-02-03 08:06:18.000000000 -0500
@@ -3,12 +3,21 @@
#
HOME_DIR/\.fonts\.conf -- gen_context(system_u:object_r:user_fonts_config_t,s0)
@@ -27506,7 +27617,7 @@ diff --exclude-from=exclude -N -u -r nsa
+/var/run/lxdm\.pid -- gen_context(system_u:object_r:xdm_var_run_t,s0)
/var/run/xdmctl(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
+/var/run/xauth(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
-+/var/run/slim\.auth -- gen_context(system_u:object_r:xdm_var_run_t,s0)
++/var/run/slim.* -- gen_context(system_u:object_r:xdm_var_run_t,s0)
+/var/run/lxdm\.auth -- gen_context(system_u:object_r:xdm_var_run_t,s0)
+/var/run/lxdm(/*.)? gen_context(system_u:object_r:xdm_var_run_t,s0)
+
@@ -27988,7 +28099,7 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.7.8/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2009-12-04 09:43:33.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/services/xserver.te 2010-02-02 10:31:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/services/xserver.te 2010-02-02 16:08:33.000000000 -0500
@@ -36,6 +36,13 @@
## <desc>
@@ -28208,7 +28319,7 @@ diff --exclude-from=exclude -N -u -r nsa
fs_search_auto_mountpoints(xauth_t)
# cjp: why?
-@@ -283,6 +329,14 @@
+@@ -283,17 +329,35 @@
userdom_use_user_terminals(xauth_t)
userdom_read_user_tmp_files(xauth_t)
@@ -28223,7 +28334,12 @@ diff --exclude-from=exclude -N -u -r nsa
xserver_rw_xdm_tmp_files(xauth_t)
-@@ -294,6 +348,15 @@
+ tunable_policy(`use_nfs_home_dirs',`
+ fs_manage_nfs_files(xauth_t)
++ fs_read_nfs_symlinks(xauth_t)
+ ')
+
+ tunable_policy(`use_samba_home_dirs',`
fs_manage_cifs_files(xauth_t)
')
@@ -28239,7 +28355,7 @@ diff --exclude-from=exclude -N -u -r nsa
optional_policy(`
ssh_sigchld(xauth_t)
ssh_read_pipes(xauth_t)
-@@ -305,20 +368,31 @@
+@@ -305,20 +369,31 @@
# XDM Local policy
#
@@ -28274,7 +28390,7 @@ diff --exclude-from=exclude -N -u -r nsa
# Allow gdm to run gdm-binary
can_exec(xdm_t, xdm_exec_t)
-@@ -334,22 +408,40 @@
+@@ -334,22 +409,40 @@
manage_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
manage_sock_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)
files_tmp_filetrans(xdm_t, xdm_tmp_t, { file dir sock_file })
@@ -28318,7 +28434,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow xdm_t xserver_t:process signal;
allow xdm_t xserver_t:unix_stream_socket connectto;
-@@ -363,6 +455,7 @@
+@@ -363,6 +456,7 @@
allow xdm_t xserver_t:process { noatsecure siginh rlimitinh signal sigkill };
allow xdm_t xserver_t:shm rw_shm_perms;
@@ -28326,7 +28442,7 @@ diff --exclude-from=exclude -N -u -r nsa
# connect to xdm xserver over stream socket
stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t)
-@@ -371,10 +464,14 @@
+@@ -371,10 +465,14 @@
delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)
delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)
@@ -28342,7 +28458,7 @@ diff --exclude-from=exclude -N -u -r nsa
kernel_read_system_state(xdm_t)
kernel_read_kernel_sysctls(xdm_t)
-@@ -394,11 +491,13 @@
+@@ -394,11 +492,13 @@
corenet_udp_sendrecv_all_ports(xdm_t)
corenet_tcp_bind_generic_node(xdm_t)
corenet_udp_bind_generic_node(xdm_t)
@@ -28356,7 +28472,7 @@ diff --exclude-from=exclude -N -u -r nsa
dev_read_rand(xdm_t)
dev_read_sysfs(xdm_t)
dev_getattr_framebuffer_dev(xdm_t)
-@@ -406,6 +505,7 @@
+@@ -406,6 +506,7 @@
dev_getattr_mouse_dev(xdm_t)
dev_setattr_mouse_dev(xdm_t)
dev_rw_apm_bios(xdm_t)
@@ -28364,7 +28480,7 @@ diff --exclude-from=exclude -N -u -r nsa
dev_setattr_apm_bios_dev(xdm_t)
dev_rw_dri(xdm_t)
dev_rw_agp(xdm_t)
-@@ -414,18 +514,21 @@
+@@ -414,18 +515,21 @@
dev_getattr_misc_dev(xdm_t)
dev_setattr_misc_dev(xdm_t)
dev_dontaudit_rw_misc(xdm_t)
@@ -28389,7 +28505,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_read_etc_files(xdm_t)
files_read_var_files(xdm_t)
-@@ -436,9 +539,15 @@
+@@ -436,9 +540,15 @@
files_read_usr_files(xdm_t)
# Poweroff wants to create the /poweroff file when run from xdm
files_create_boot_flag(xdm_t)
@@ -28405,7 +28521,7 @@ diff --exclude-from=exclude -N -u -r nsa
storage_dontaudit_read_fixed_disk(xdm_t)
storage_dontaudit_write_fixed_disk(xdm_t)
-@@ -447,6 +556,7 @@
+@@ -447,6 +557,7 @@
storage_dontaudit_raw_write_removable_device(xdm_t)
storage_dontaudit_setattr_removable_dev(xdm_t)
storage_dontaudit_rw_scsi_generic(xdm_t)
@@ -28413,7 +28529,7 @@ diff --exclude-from=exclude -N -u -r nsa
term_setattr_console(xdm_t)
term_use_unallocated_ttys(xdm_t)
-@@ -455,6 +565,7 @@
+@@ -455,6 +566,7 @@
auth_domtrans_pam_console(xdm_t)
auth_manage_pam_pid(xdm_t)
auth_manage_pam_console_data(xdm_t)
@@ -28421,7 +28537,7 @@ diff --exclude-from=exclude -N -u -r nsa
auth_rw_faillog(xdm_t)
auth_write_login_records(xdm_t)
-@@ -465,10 +576,12 @@
+@@ -465,10 +577,12 @@
logging_read_generic_logs(xdm_t)
@@ -28436,7 +28552,7 @@ diff --exclude-from=exclude -N -u -r nsa
userdom_dontaudit_use_unpriv_user_fds(xdm_t)
userdom_create_all_users_keys(xdm_t)
-@@ -477,6 +590,11 @@
+@@ -477,6 +591,11 @@
# Search /proc for any user domain processes.
userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t)
@@ -28448,7 +28564,7 @@ diff --exclude-from=exclude -N -u -r nsa
xserver_rw_session(xdm_t, xdm_tmpfs_t)
xserver_unconfined(xdm_t)
-@@ -509,10 +627,12 @@
+@@ -509,10 +628,12 @@
optional_policy(`
alsa_domtrans(xdm_t)
@@ -28461,7 +28577,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -520,12 +640,49 @@
+@@ -520,12 +641,49 @@
')
optional_policy(`
@@ -28511,7 +28627,7 @@ diff --exclude-from=exclude -N -u -r nsa
hostname_exec(xdm_t)
')
-@@ -543,9 +700,43 @@
+@@ -543,9 +701,43 @@
')
optional_policy(`
@@ -28555,7 +28671,7 @@ diff --exclude-from=exclude -N -u -r nsa
optional_policy(`
seutil_sigchld_newrole(xdm_t)
')
-@@ -555,8 +746,9 @@
+@@ -555,8 +747,9 @@
')
optional_policy(`
@@ -28567,7 +28683,7 @@ diff --exclude-from=exclude -N -u -r nsa
ifndef(`distro_redhat',`
allow xdm_t self:process { execheap execmem };
-@@ -565,7 +757,6 @@
+@@ -565,7 +758,6 @@
ifdef(`distro_rhel4',`
allow xdm_t self:process { execheap execmem };
')
@@ -28575,7 +28691,7 @@ diff --exclude-from=exclude -N -u -r nsa
optional_policy(`
userhelper_dontaudit_search_config(xdm_t)
-@@ -576,6 +767,10 @@
+@@ -576,6 +768,10 @@
')
optional_policy(`
@@ -28586,7 +28702,7 @@ diff --exclude-from=exclude -N -u -r nsa
xfs_stream_connect(xdm_t)
')
-@@ -600,10 +795,9 @@
+@@ -600,10 +796,9 @@
# execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack
@@ -28598,7 +28714,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow xserver_t self:fd use;
allow xserver_t self:fifo_file rw_fifo_file_perms;
allow xserver_t self:sock_file read_sock_file_perms;
-@@ -615,6 +809,18 @@
+@@ -615,6 +810,18 @@
allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow xserver_t self:tcp_socket create_stream_socket_perms;
allow xserver_t self:udp_socket create_socket_perms;
@@ -28617,7 +28733,7 @@ diff --exclude-from=exclude -N -u -r nsa
manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
-@@ -634,12 +840,19 @@
+@@ -634,12 +841,19 @@
manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
files_search_var_lib(xserver_t)
@@ -28639,7 +28755,7 @@ diff --exclude-from=exclude -N -u -r nsa
kernel_read_system_state(xserver_t)
kernel_read_device_sysctls(xserver_t)
-@@ -673,7 +886,6 @@
+@@ -673,7 +887,6 @@
dev_rw_agp(xserver_t)
dev_rw_framebuffer(xserver_t)
dev_manage_dri_dev(xserver_t)
@@ -28647,7 +28763,7 @@ diff --exclude-from=exclude -N -u -r nsa
dev_create_generic_dirs(xserver_t)
dev_setattr_generic_dirs(xserver_t)
# raw memory access is needed if not using the frame buffer
-@@ -683,9 +895,12 @@
+@@ -683,9 +896,12 @@
dev_rw_xserver_misc(xserver_t)
# read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev(xserver_t)
@@ -28661,7 +28777,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_read_etc_files(xserver_t)
files_read_etc_runtime_files(xserver_t)
-@@ -700,8 +915,12 @@
+@@ -700,8 +916,12 @@
fs_search_nfs(xserver_t)
fs_search_auto_mountpoints(xserver_t)
fs_search_ramfs(xserver_t)
@@ -28674,7 +28790,7 @@ diff --exclude-from=exclude -N -u -r nsa
selinux_validate_context(xserver_t)
selinux_compute_access_vector(xserver_t)
-@@ -723,6 +942,7 @@
+@@ -723,6 +943,7 @@
miscfiles_read_localization(xserver_t)
miscfiles_read_fonts(xserver_t)
@@ -28682,7 +28798,7 @@ diff --exclude-from=exclude -N -u -r nsa
modutils_domtrans_insmod(xserver_t)
-@@ -779,12 +999,20 @@
+@@ -779,12 +1000,20 @@
')
optional_policy(`
@@ -28704,7 +28820,7 @@ diff --exclude-from=exclude -N -u -r nsa
unconfined_domtrans(xserver_t)
')
-@@ -811,7 +1039,7 @@
+@@ -811,7 +1040,7 @@
allow xserver_t xdm_var_lib_t:file { getattr read };
dontaudit xserver_t xdm_var_lib_t:dir search;
@@ -28713,7 +28829,7 @@ diff --exclude-from=exclude -N -u -r nsa
# Label pid and temporary files with derived types.
manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
-@@ -832,9 +1060,14 @@
+@@ -832,9 +1061,14 @@
# to read ROLE_home_t - examine this in more detail
# (xauth?)
userdom_read_user_home_content_files(xserver_t)
@@ -28728,7 +28844,7 @@ diff --exclude-from=exclude -N -u -r nsa
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(xserver_t)
fs_manage_nfs_files(xserver_t)
-@@ -849,11 +1082,14 @@
+@@ -849,11 +1083,14 @@
optional_policy(`
dbus_system_bus_client(xserver_t)
@@ -28745,7 +28861,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -1000,17 +1236,32 @@
+@@ -1000,17 +1237,32 @@
allow xserver_unconfined_type { x_domain xserver_t }:x_resource *;
allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *;
@@ -28822,8 +28938,8 @@ diff --exclude-from=exclude -N -u -r nsa
## </summary>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.7.8/policy/modules/system/application.te
--- nsaserefpolicy/policy/modules/system/application.te 2009-11-25 11:47:19.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/system/application.te 2010-02-02 10:31:03.000000000 -0500
-@@ -7,6 +7,13 @@
++++ serefpolicy-3.7.8/policy/modules/system/application.te 2010-02-03 09:21:48.000000000 -0500
+@@ -7,6 +7,17 @@
# Executables to be run by user
attribute application_exec_type;
@@ -28834,6 +28950,10 @@ diff --exclude-from=exclude -N -u -r nsa
+
+files_dontaudit_search_all_dirs(application_domain_type)
+
++optional_policy(`
++ afs_rw_udp_sockets(application_domain_type)
++')
++
optional_policy(`
ssh_sigchld(application_domain_type)
ssh_rw_stream_sockets(application_domain_type)
@@ -29340,20 +29460,24 @@ diff --exclude-from=exclude -N -u -r nsa
# /var
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.7.8/policy/modules/system/init.if
--- nsaserefpolicy/policy/modules/system/init.if 2009-11-12 12:51:51.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/system/init.if 2010-02-02 10:45:19.000000000 -0500
-@@ -162,6 +162,7 @@
++++ serefpolicy-3.7.8/policy/modules/system/init.if 2010-02-03 15:45:27.000000000 -0500
+@@ -162,8 +162,10 @@
gen_require(`
attribute direct_run_init, direct_init, direct_init_entry;
type initrc_t;
+ type init_t;
role system_r;
attribute daemon;
++ attribute initrc_transition_domain;
')
-@@ -174,6 +175,11 @@
+
+ typeattribute $1 daemon;
+@@ -174,6 +176,12 @@
role system_r types $1;
domtrans_pattern(initrc_t,$2,$1)
+ allow initrc_t $1:process siginh;
++ allow $1 initrc_transition_domain:fifo_file rw_inherited_fifo_file_perms;
+
+ # Handle upstart direct transition to a executable
+ domtrans_pattern(init_t,$2,$1)
@@ -29361,15 +29485,24 @@ diff --exclude-from=exclude -N -u -r nsa
# daemons started from init will
# inherit fds from init for the console
-@@ -272,6 +278,7 @@
+@@ -265,6 +273,7 @@
+ gen_require(`
+ type initrc_t;
+ role system_r;
++ attribute initrc_transition_domain;
+ ')
+
+ application_domain($1,$2)
+@@ -272,6 +281,8 @@
role system_r types $1;
domtrans_pattern(initrc_t,$2,$1)
+ allow initrc_t $1:process siginh;
++ allow $1 initrc_transition_domain:fifo_file rw_inherited_fifo_file_perms;
ifdef(`hide_broken_symptoms',`
# RHEL4 systems seem to have a stray
-@@ -280,6 +287,36 @@
+@@ -280,6 +291,36 @@
kernel_dontaudit_use_fds($1)
')
')
@@ -29406,7 +29539,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -546,7 +583,8 @@
+@@ -546,7 +587,8 @@
# upstart uses a datagram socket instead of initctl pipe
allow $1 self:unix_dgram_socket create_socket_perms;
@@ -29416,7 +29549,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
')
-@@ -619,18 +657,19 @@
+@@ -619,18 +661,19 @@
#
interface(`init_spec_domtrans_script',`
gen_require(`
@@ -29440,7 +29573,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
')
-@@ -646,23 +685,43 @@
+@@ -646,23 +689,43 @@
#
interface(`init_domtrans_script',`
gen_require(`
@@ -29488,7 +29621,18 @@ diff --exclude-from=exclude -N -u -r nsa
## Execute a init script in a specified domain.
## </summary>
## <desc>
-@@ -923,6 +982,24 @@
+@@ -714,8 +777,10 @@
+ interface(`init_labeled_script_domtrans',`
+ gen_require(`
+ type initrc_t;
++ attribute initrc_transition_domain;
+ ')
+
++ typeattribute $1 initrc_transition_domain;
+ domtrans_pattern($1, $2, initrc_t)
+ files_search_etc($1)
+ ')
+@@ -923,6 +988,24 @@
allow $1 init_script_file_type:file read_file_perms;
')
@@ -29513,7 +29657,7 @@ diff --exclude-from=exclude -N -u -r nsa
########################################
## <summary>
## Execute all init scripts in the caller domain.
-@@ -1142,7 +1219,7 @@
+@@ -1142,7 +1225,7 @@
type initrc_t;
')
@@ -29522,7 +29666,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -1310,6 +1387,25 @@
+@@ -1310,6 +1393,25 @@
########################################
## <summary>
@@ -29548,7 +29692,7 @@ diff --exclude-from=exclude -N -u -r nsa
## Create files in a init script
## temporary data directory.
## </summary>
-@@ -1540,3 +1636,75 @@
+@@ -1540,3 +1642,76 @@
')
corenet_udp_recvfrom_labeled($1, daemon)
')
@@ -29617,6 +29761,7 @@ diff --exclude-from=exclude -N -u -r nsa
+ ')
+
+ dontaudit $1 initrc_t:tcp_socket { read write };
++ dontaudit $1 initrc_t:udp_socket { read write };
+ dontaudit $1 initrc_t:unix_dgram_socket { read write };
+ dontaudit $1 initrc_t:unix_stream_socket { read write };
+ dontaudit $1 initrc_t:shm rw_shm_perms;
@@ -29626,7 +29771,7 @@ diff --exclude-from=exclude -N -u -r nsa
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.7.8/policy/modules/system/init.te
--- nsaserefpolicy/policy/modules/system/init.te 2009-11-12 12:51:51.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/system/init.te 2010-02-02 10:31:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/system/init.te 2010-02-03 15:43:32.000000000 -0500
@@ -17,6 +17,20 @@
## </desc>
gen_tunable(init_upstart, false)
@@ -29648,7 +29793,15 @@ diff --exclude-from=exclude -N -u -r nsa
# used for direct running of init scripts
# by admin domains
attribute direct_run_init;
-@@ -64,6 +78,7 @@
+@@ -26,6 +40,7 @@
+ attribute init_script_domain_type;
+ attribute init_script_file_type;
+ attribute init_run_all_scripts_domain;
++attribute initrc_transition_domain;
+
+ # Mark process types as daemons
+ attribute daemon;
+@@ -64,6 +79,7 @@
# of the below init_upstart tunable
# but this has a typeattribute in it
corecmd_shell_entry_type(initrc_t)
@@ -29656,7 +29809,7 @@ diff --exclude-from=exclude -N -u -r nsa
type initrc_devpts_t;
term_pty(initrc_devpts_t)
-@@ -88,7 +103,7 @@
+@@ -88,7 +104,7 @@
#
# Use capabilities. old rule:
@@ -29665,7 +29818,7 @@ diff --exclude-from=exclude -N -u -r nsa
# is ~sys_module really needed? observed:
# sys_boot
# sys_tty_config
-@@ -101,7 +116,8 @@
+@@ -101,7 +117,8 @@
# Re-exec itself
can_exec(init_t, init_exec_t)
@@ -29675,7 +29828,7 @@ diff --exclude-from=exclude -N -u -r nsa
# For /var/run/shutdown.pid.
allow init_t init_var_run_t:file manage_file_perms;
-@@ -140,6 +156,7 @@
+@@ -140,6 +157,7 @@
files_dontaudit_rw_root_files(init_t)
files_dontaudit_rw_root_chr_files(init_t)
@@ -29683,7 +29836,7 @@ diff --exclude-from=exclude -N -u -r nsa
# cjp: this may be related to /dev/log
fs_write_ramfs_sockets(init_t)
-@@ -167,6 +184,8 @@
+@@ -167,6 +185,8 @@
miscfiles_read_localization(init_t)
@@ -29692,7 +29845,7 @@ diff --exclude-from=exclude -N -u -r nsa
ifdef(`distro_gentoo',`
allow init_t self:process { getcap setcap };
')
-@@ -189,6 +208,22 @@
+@@ -189,6 +209,22 @@
')
optional_policy(`
@@ -29715,7 +29868,7 @@ diff --exclude-from=exclude -N -u -r nsa
nscd_socket_use(init_t)
')
-@@ -202,9 +237,10 @@
+@@ -202,9 +238,10 @@
#
allow initrc_t self:process { getpgid setsched setpgid setrlimit getsched };
@@ -29727,7 +29880,7 @@ diff --exclude-from=exclude -N -u -r nsa
# Allow IPC with self
allow initrc_t self:unix_dgram_socket create_socket_perms;
-@@ -217,7 +253,8 @@
+@@ -217,7 +254,8 @@
term_create_pty(initrc_t, initrc_devpts_t)
# Going to single user mode
@@ -29737,7 +29890,7 @@ diff --exclude-from=exclude -N -u -r nsa
can_exec(initrc_t, init_script_file_type)
-@@ -230,10 +267,16 @@
+@@ -230,10 +268,16 @@
allow initrc_t initrc_var_run_t:file manage_file_perms;
files_pid_filetrans(initrc_t, initrc_var_run_t, file)
@@ -29756,7 +29909,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_tmp_filetrans(initrc_t, initrc_tmp_t, { file dir })
init_write_initctl(initrc_t)
-@@ -246,13 +289,19 @@
+@@ -246,13 +290,19 @@
kernel_clear_ring_buffer(initrc_t)
kernel_get_sysvipc_info(initrc_t)
kernel_read_all_sysctls(initrc_t)
@@ -29778,7 +29931,7 @@ diff --exclude-from=exclude -N -u -r nsa
corenet_all_recvfrom_unlabeled(initrc_t)
corenet_all_recvfrom_netlabel(initrc_t)
-@@ -272,16 +321,66 @@
+@@ -272,16 +322,66 @@
dev_rw_sysfs(initrc_t)
dev_list_usbfs(initrc_t)
dev_read_framebuffer(initrc_t)
@@ -29846,7 +29999,7 @@ diff --exclude-from=exclude -N -u -r nsa
domain_kill_all_domains(initrc_t)
domain_signal_all_domains(initrc_t)
-@@ -291,7 +390,7 @@
+@@ -291,7 +391,7 @@
domain_sigchld_all_domains(initrc_t)
domain_read_all_domains_state(initrc_t)
domain_getattr_all_domains(initrc_t)
@@ -29855,7 +30008,7 @@ diff --exclude-from=exclude -N -u -r nsa
domain_getsession_all_domains(initrc_t)
domain_use_interactive_fds(initrc_t)
# for lsof which is used by alsa shutdown:
-@@ -306,14 +405,15 @@
+@@ -306,14 +406,15 @@
files_getattr_all_pipes(initrc_t)
files_getattr_all_sockets(initrc_t)
files_purge_tmp(initrc_t)
@@ -29873,7 +30026,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_exec_etc_files(initrc_t)
files_read_usr_files(initrc_t)
files_manage_urandom_seed(initrc_t)
-@@ -324,48 +424,16 @@
+@@ -324,48 +425,16 @@
files_mounton_isid_type_dirs(initrc_t)
files_list_default(initrc_t)
files_mounton_default(initrc_t)
@@ -29926,7 +30079,7 @@ diff --exclude-from=exclude -N -u -r nsa
logging_send_syslog_msg(initrc_t)
logging_manage_generic_logs(initrc_t)
logging_read_all_logs(initrc_t)
-@@ -374,19 +442,22 @@
+@@ -374,19 +443,22 @@
miscfiles_read_localization(initrc_t)
# slapd needs to read cert files from its initscript
@@ -29950,7 +30103,7 @@ diff --exclude-from=exclude -N -u -r nsa
ifdef(`distro_debian',`
dev_setattr_generic_dirs(initrc_t)
-@@ -422,16 +493,12 @@
+@@ -422,16 +494,12 @@
# init scripts touch this
clock_dontaudit_write_adjtime(initrc_t)
@@ -29968,7 +30121,7 @@ diff --exclude-from=exclude -N -u -r nsa
optional_policy(`
arpwatch_manage_data_files(initrc_t)
-@@ -450,11 +517,9 @@
+@@ -450,11 +518,9 @@
# Red Hat systems seem to have a stray
# fd open from the initrd
@@ -29981,7 +30134,7 @@ diff --exclude-from=exclude -N -u -r nsa
# These seem to be from the initrd
# during device initialization:
dev_create_generic_dirs(initrc_t)
-@@ -464,6 +529,7 @@
+@@ -464,6 +530,7 @@
storage_raw_read_fixed_disk(initrc_t)
storage_raw_write_fixed_disk(initrc_t)
@@ -29989,7 +30142,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_create_boot_flag(initrc_t)
files_rw_boot_symlinks(initrc_t)
# wants to read /.fonts directory
-@@ -492,15 +558,26 @@
+@@ -492,15 +559,26 @@
optional_policy(`
bind_manage_config_dirs(initrc_t)
bind_write_config(initrc_t)
@@ -30016,7 +30169,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -515,6 +592,33 @@
+@@ -515,6 +593,33 @@
')
')
@@ -30050,7 +30203,7 @@ diff --exclude-from=exclude -N -u -r nsa
optional_policy(`
amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t)
-@@ -567,10 +671,19 @@
+@@ -567,10 +672,19 @@
dbus_connect_system_bus(initrc_t)
dbus_system_bus_client(initrc_t)
dbus_read_config(initrc_t)
@@ -30070,7 +30223,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -590,6 +703,10 @@
+@@ -590,6 +704,10 @@
')
optional_policy(`
@@ -30081,7 +30234,7 @@ diff --exclude-from=exclude -N -u -r nsa
dev_read_usbfs(initrc_t)
# init scripts run /etc/hotplug/usb.rc
-@@ -646,20 +763,20 @@
+@@ -646,20 +764,20 @@
')
optional_policy(`
@@ -30108,7 +30261,7 @@ diff --exclude-from=exclude -N -u -r nsa
optional_policy(`
ifdef(`distro_redhat',`
-@@ -668,6 +785,7 @@
+@@ -668,6 +786,7 @@
mysql_stream_connect(initrc_t)
mysql_write_log(initrc_t)
@@ -30116,7 +30269,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -700,7 +818,6 @@
+@@ -700,7 +819,6 @@
')
optional_policy(`
@@ -30124,7 +30277,7 @@ diff --exclude-from=exclude -N -u -r nsa
fs_write_ramfs_sockets(initrc_t)
fs_search_ramfs(initrc_t)
-@@ -722,8 +839,6 @@
+@@ -722,8 +840,6 @@
# bash tries ioctl for some reason
files_dontaudit_ioctl_all_pids(initrc_t)
@@ -30133,7 +30286,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -736,13 +851,16 @@
+@@ -736,13 +852,16 @@
squid_manage_logs(initrc_t)
')
@@ -30150,7 +30303,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -751,6 +869,7 @@
+@@ -751,6 +870,7 @@
optional_policy(`
udev_rw_db(initrc_t)
@@ -30158,7 +30311,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -758,7 +877,17 @@
+@@ -758,7 +878,17 @@
')
optional_policy(`
@@ -30176,7 +30329,7 @@ diff --exclude-from=exclude -N -u -r nsa
ifdef(`distro_redhat',`
# system-config-services causes avc messages that should be dontaudited
-@@ -768,6 +897,21 @@
+@@ -768,6 +898,21 @@
optional_policy(`
mono_domtrans(initrc_t)
')
@@ -30198,7 +30351,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -793,3 +937,31 @@
+@@ -793,3 +938,31 @@
optional_policy(`
zebra_read_config(initrc_t)
')
@@ -30513,7 +30666,7 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.7.8/policy/modules/system/iptables.te
--- nsaserefpolicy/policy/modules/system/iptables.te 2009-12-04 09:43:33.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/system/iptables.te 2010-02-02 10:31:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/system/iptables.te 2010-02-03 08:15:29.000000000 -0500
@@ -14,9 +14,6 @@
type iptables_initrc_exec_t;
init_script_file(iptables_initrc_exec_t)
@@ -30555,7 +30708,15 @@ diff --exclude-from=exclude -N -u -r nsa
domain_use_interactive_fds(iptables_t)
-@@ -89,6 +89,7 @@
+@@ -76,6 +76,7 @@
+ # to allow rules to be saved on reboot:
+ init_rw_script_tmp_files(iptables_t)
+ init_rw_script_stream_sockets(iptables_t)
++init_dontaudit_script_leaks(iptables_t)
+
+ logging_send_syslog_msg(iptables_t)
+
+@@ -89,6 +90,7 @@
optional_policy(`
fail2ban_append_log(iptables_t)
@@ -30563,7 +30724,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -122,5 +123,10 @@
+@@ -122,5 +124,10 @@
')
optional_policy(`
@@ -30576,7 +30737,7 @@ diff --exclude-from=exclude -N -u -r nsa
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.fc serefpolicy-3.7.8/policy/modules/system/iscsi.fc
--- nsaserefpolicy/policy/modules/system/iscsi.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.7.8/policy/modules/system/iscsi.fc 2010-02-02 10:31:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/system/iscsi.fc 2010-02-03 10:42:23.000000000 -0500
@@ -1,5 +1,10 @@
-/sbin/iscsid -- gen_context(system_u:object_r:iscsid_exec_t,s0)
@@ -30584,7 +30745,7 @@ diff --exclude-from=exclude -N -u -r nsa
+/sbin/brcm_iscsiuio -- gen_context(system_u:object_r:iscsid_exec_t,s0)
+/sbin/iscsid -- gen_context(system_u:object_r:iscsid_exec_t,s0)
+
-+/var/log/brcm-iscsi\.log -- gen_context(system_u:object_r:iscsi_lock_t,s0)
++/var/log/brcm-iscsi\.log -- gen_context(system_u:object_r:iscsi_log_t,s0)
/var/lock/iscsi(/.*)? gen_context(system_u:object_r:iscsi_lock_t,s0)
+
+/var/lib/iscsi(/.*)? gen_context(system_u:object_r:iscsi_var_lib_t,s0)
@@ -30592,13 +30753,13 @@ diff --exclude-from=exclude -N -u -r nsa
/var/run/iscsid\.pid -- gen_context(system_u:object_r:iscsi_var_run_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.7.8/policy/modules/system/iscsi.te
--- nsaserefpolicy/policy/modules/system/iscsi.te 2009-11-25 11:47:19.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/system/iscsi.te 2010-02-02 10:31:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/system/iscsi.te 2010-02-03 14:44:32.000000000 -0500
@@ -14,6 +14,9 @@
type iscsi_lock_t;
files_lock_file(iscsi_lock_t)
-+type iscsid_log_t;
-+logging_log_file(iscsid_log_t)
++type iscsi_log_t;
++logging_log_file(iscsi_log_t)
+
type iscsi_tmp_t;
files_tmp_file(iscsi_tmp_t)
@@ -30621,8 +30782,8 @@ diff --exclude-from=exclude -N -u -r nsa
-allow iscsid_t iscsi_tmp_t:dir manage_dir_perms;
-allow iscsid_t iscsi_tmp_t:file manage_file_perms;
-fs_tmpfs_filetrans(iscsid_t, iscsi_tmp_t, file )
-+manage_files_pattern(iscsid_t, iscsid_log_t, iscsid_log_t)
-+logging_log_filetrans(iscsid_t, iscsid_log_t, file)
++manage_files_pattern(iscsid_t, iscsi_log_t, iscsi_log_t)
++logging_log_filetrans(iscsid_t, iscsi_log_t, file)
+
+manage_dirs_pattern(iscsid_t, iscsi_tmp_t, iscsi_tmp_t)
+manage_files_pattern(iscsid_t, iscsi_tmp_t, iscsi_tmp_t)
@@ -31463,7 +31624,7 @@ diff --exclude-from=exclude -N -u -r nsa
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.7.8/policy/modules/system/miscfiles.if
--- nsaserefpolicy/policy/modules/system/miscfiles.if 2009-11-25 11:47:19.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/system/miscfiles.if 2010-02-02 10:31:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/system/miscfiles.if 2010-02-03 15:28:51.000000000 -0500
@@ -73,7 +73,8 @@
#
interface(`miscfiles_read_fonts',`
@@ -31485,7 +31646,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -167,6 +172,70 @@
+@@ -167,6 +172,68 @@
manage_dirs_pattern($1, fonts_t, fonts_t)
manage_files_pattern($1, fonts_t, fonts_t)
manage_lnk_files_pattern($1, fonts_t, fonts_t)
@@ -31546,9 +31707,7 @@ diff --exclude-from=exclude -N -u -r nsa
+ type fonts_cache_t;
+ ')
+
-+ # cjp: fonts can be in either of these dirs
-+ files_search_usr($1)
-+ libs_search_lib($1)
++ files_search_var($1)
+
+ manage_dirs_pattern($1, fonts_cache_t, fonts_cache_t)
+ manage_files_pattern($1, fonts_cache_t, fonts_cache_t)
@@ -33260,7 +33419,7 @@ diff --exclude-from=exclude -N -u -r nsa
########################################
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.7.8/policy/modules/system/udev.te
--- nsaserefpolicy/policy/modules/system/udev.te 2009-11-25 11:47:19.000000000 -0500
-+++ serefpolicy-3.7.8/policy/modules/system/udev.te 2010-02-02 10:31:03.000000000 -0500
++++ serefpolicy-3.7.8/policy/modules/system/udev.te 2010-02-03 14:21:06.000000000 -0500
@@ -50,6 +50,7 @@
allow udev_t self:unix_stream_socket connectto;
allow udev_t self:netlink_kobject_uevent_socket create_socket_perms;
@@ -33297,10 +33456,14 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -271,6 +277,10 @@
+@@ -271,6 +277,14 @@
')
optional_policy(`
++ usbmuxd_domtrans(udev_t)
++')
++
++optional_policy(`
+ unconfined_signal(udev_t)
+')
+
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.964
retrieving revision 1.965
diff -u -p -r1.964 -r1.965
--- selinux-policy.spec 2 Feb 2010 16:41:03 -0000 1.964
+++ selinux-policy.spec 3 Feb 2010 20:52:58 -0000 1.965
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.7.8
-Release: 6%{?dist}
+Release: 7%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -457,6 +457,9 @@ exit 0
%endif
%changelog
+* Wed Feb 3 2010 Dan Walsh <dwalsh at redhat.com> 3.7.8-7
+- Add mcelog policy
+
* Mon Feb 1 2010 Dan Walsh <dwalsh at redhat.com> 3.7.8-6
- Lots of fixes found in F12
- Previous message: rpms/audacious-plugins/F-12 audacious-plugins-2.2-streambrowser-race.patch, NONE, 1.1 audacious-plugins.spec, 1.85, 1.86
- Next message: rpms/texmaker/F-12 sources, 1.11, 1.12 texmaker-tools.patch, 1.12, 1.13 texmaker.spec, 1.24, 1.25
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the scm-commits
mailing list