rpms/selinux-policy/F-12 policy-20100106.patch, 1.34, 1.35 selinux-policy.spec, 1.1019, 1.1020
Miroslav Grepl
mgrepl at fedoraproject.org
Thu Feb 11 20:51:38 UTC 2010
Author: mgrepl
Update of /cvs/pkgs/rpms/selinux-policy/F-12
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv14504
Modified Files:
policy-20100106.patch selinux-policy.spec
Log Message:
- Allow rpcd to read files with default file type
policy-20100106.patch:
modules/admin/dmesg.fc | 1
modules/admin/mcelog.fc | 2
modules/admin/mcelog.if | 20 +
modules/admin/mcelog.te | 31 ++
modules/admin/prelink.te | 1
modules/admin/quota.te | 1
modules/admin/readahead.te | 2
modules/admin/rpm.if | 20 -
modules/admin/smoltclient.te | 2
modules/admin/usermanage.te | 6
modules/apps/cdrecord.te | 2
modules/apps/chrome.te | 3
modules/apps/execmem.if | 5
modules/apps/firewallgui.te | 4
modules/apps/gnome.fc | 9
modules/apps/gnome.if | 81 +++++-
modules/apps/gnome.te | 8
modules/apps/gpg.fc | 2
modules/apps/gpg.te | 5
modules/apps/kdumpgui.te | 4
modules/apps/mozilla.fc | 1
modules/apps/nsplugin.fc | 1
modules/apps/nsplugin.if | 36 ++
modules/apps/podsleuth.te | 1
modules/apps/pulseaudio.fc | 2
modules/apps/pulseaudio.if | 6
modules/apps/pulseaudio.te | 8
modules/apps/sambagui.te | 4
modules/apps/sandbox.if | 54 +++-
modules/apps/sandbox.te | 49 ++-
modules/apps/vmware.if | 18 +
modules/apps/vmware.te | 9
modules/apps/wine.if | 4
modules/apps/wine.te | 14 +
modules/kernel/corecommands.fc | 4
modules/kernel/corenetwork.if.in | 18 +
modules/kernel/corenetwork.te.in | 4
modules/kernel/devices.fc | 5
modules/kernel/devices.if | 109 ++++++++
modules/kernel/devices.te | 18 +
modules/kernel/files.if | 20 +
modules/kernel/filesystem.if | 118 ++++++++-
modules/kernel/filesystem.te | 12
modules/roles/staff.te | 16 -
modules/roles/sysadm.te | 4
modules/roles/unconfineduser.fc | 5
modules/roles/unconfineduser.te | 2
modules/roles/xguest.te | 2
modules/services/abrt.if | 5
modules/services/abrt.te | 14 +
modules/services/afs.te | 6
modules/services/aisexec.te | 8
modules/services/amavis.te | 1
modules/services/apache.fc | 5
modules/services/apache.if | 27 ++
modules/services/apache.te | 12
modules/services/apcupsd.te | 2
modules/services/arpwatch.te | 2
modules/services/avahi.fc | 2
modules/services/chronyd.fc | 2
modules/services/chronyd.te | 15 -
modules/services/corosync.te | 6
modules/services/cron.te | 9
modules/services/cups.te | 6
modules/services/dbus.if | 2
modules/services/djbdns.if | 38 +++
modules/services/djbdns.te | 8
modules/services/dovecot.te | 6
modules/services/fail2ban.if | 18 +
modules/services/ftp.if | 37 ++
modules/services/ftp.te | 114 +++++++++
modules/services/git.fc | 17 -
modules/services/git.if | 466 ++++++++++++++++++++++++++++---------
modules/services/git.te | 145 ++++++-----
modules/services/kerberos.if | 2
modules/services/ldap.fc | 8
modules/services/ldap.te | 7
modules/services/lircd.te | 7
modules/services/mailman.te | 1
modules/services/memcached.te | 14 -
modules/services/mta.if | 19 +
modules/services/mta.te | 1
modules/services/munin.te | 1
modules/services/mysql.te | 4
modules/services/nagios.fc | 42 +++
modules/services/nagios.if | 2
modules/services/nagios.te | 47 +++
modules/services/networkmanager.fc | 1
modules/services/networkmanager.te | 1
modules/services/nis.fc | 5
modules/services/nis.te | 6
modules/services/nx.if | 18 +
modules/services/openvpn.te | 4
modules/services/plymouth.te | 32 +-
modules/services/policykit.te | 8
modules/services/postfix.te | 5
modules/services/ppp.fc | 2
modules/services/ppp.te | 7
modules/services/prelude.te | 2
modules/services/rgmanager.if | 2
modules/services/rgmanager.te | 18 +
modules/services/rhcs.fc | 8
modules/services/rhcs.te | 47 ++-
modules/services/rpc.te | 2
modules/services/samba.te | 13 -
modules/services/sendmail.te | 4
modules/services/setroubleshoot.te | 4
modules/services/snmp.te | 4
modules/services/snort.te | 1
modules/services/spamassassin.if | 18 +
modules/services/spamassassin.te | 6
modules/services/ssh.if | 2
modules/services/ssh.te | 81 ------
modules/services/sssd.fc | 2
modules/services/sssd.if | 85 +++---
modules/services/sssd.te | 14 -
modules/services/tftp.te | 1
modules/services/tgtd.te | 1
modules/services/tuned.fc | 3
modules/services/tuned.te | 9
modules/services/ucspitcp.te | 5
modules/services/usbmuxd.fc | 6
modules/services/usbmuxd.if | 64 +++++
modules/services/usbmuxd.te | 48 +++
modules/services/virt.if | 1
modules/services/virt.te | 10
modules/services/xserver.fc | 7
modules/services/xserver.if | 2
modules/services/xserver.te | 19 +
modules/system/application.te | 12
modules/system/daemontools.if | 62 ++++
modules/system/daemontools.te | 26 +-
modules/system/fstools.fc | 1
modules/system/hostname.te | 3
modules/system/hotplug.te | 4
modules/system/init.if | 33 ++
modules/system/init.te | 25 +
modules/system/ipsec.te | 11
modules/system/iptables.if | 7
modules/system/iptables.te | 6
modules/system/iscsi.fc | 3
modules/system/iscsi.te | 10
modules/system/libraries.fc | 16 +
modules/system/locallogin.te | 6
modules/system/logging.fc | 2
modules/system/logging.if | 18 +
modules/system/logging.te | 9
modules/system/miscfiles.if | 37 ++
modules/system/modutils.te | 1
modules/system/mount.te | 16 +
modules/system/selinuxutil.te | 1
modules/system/sysnetwork.te | 1
modules/system/udev.te | 5
modules/system/unconfined.if | 2
modules/system/userdomain.fc | 1
modules/system/userdomain.if | 18 +
modules/system/xen.te | 7
support/obj_perm_sets.spt | 5
users | 2
159 files changed, 2330 insertions(+), 479 deletions(-)
Index: policy-20100106.patch
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/F-12/policy-20100106.patch,v
retrieving revision 1.34
retrieving revision 1.35
diff -u -p -r1.34 -r1.35
--- policy-20100106.patch 11 Feb 2010 19:42:32 -0000 1.34
+++ policy-20100106.patch 11 Feb 2010 20:51:36 -0000 1.35
@@ -1271,7 +1271,7 @@ diff -b -B --ignore-all-space --exclude-
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.6.32/policy/modules/kernel/files.if
--- nsaserefpolicy/policy/modules/kernel/files.if 2010-01-18 18:24:22.691530426 +0100
-+++ serefpolicy-3.6.32/policy/modules/kernel/files.if 2010-01-29 10:02:38.893864113 +0100
++++ serefpolicy-3.6.32/policy/modules/kernel/files.if 2010-02-11 21:31:15.568440872 +0100
@@ -5537,3 +5537,23 @@
dontaudit $1 non_security_file_type:file_class_set rw_inherited_file_perms;
@@ -4143,6 +4143,18 @@ diff -b -B --ignore-all-space --exclude-
netutils_domtrans_ping(qdiskd_t)
')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.6.32/policy/modules/services/rpc.te
+--- nsaserefpolicy/policy/modules/services/rpc.te 2010-01-18 18:24:22.880531210 +0100
++++ serefpolicy-3.6.32/policy/modules/services/rpc.te 2010-02-11 21:29:42.257440026 +0100
+@@ -82,6 +82,8 @@
+
+ files_manage_mounttab(rpcd_t)
+ files_getattr_all_dirs(rpcd_t)
++files_read_isid_type_files(rpcd_t)
++files_read_default_files(rpcd_t)
+
+ fs_list_rpc(rpcd_t)
+ fs_read_rpc_files(rpcd_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.6.32/policy/modules/services/samba.te
--- nsaserefpolicy/policy/modules/services/samba.te 2010-01-18 18:24:22.886540773 +0100
+++ serefpolicy-3.6.32/policy/modules/services/samba.te 2010-02-09 10:52:45.543866160 +0100
@@ -5926,7 +5938,7 @@ diff -b -B --ignore-all-space --exclude-
kernel_setsched(insmod_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.6.32/policy/modules/system/mount.te
--- nsaserefpolicy/policy/modules/system/mount.te 2010-01-18 18:24:22.961540534 +0100
-+++ serefpolicy-3.6.32/policy/modules/system/mount.te 2010-02-08 11:03:56.385336831 +0100
++++ serefpolicy-3.6.32/policy/modules/system/mount.te 2010-02-11 21:24:42.750703041 +0100
@@ -155,6 +155,8 @@
seutil_read_config(mount_t)
@@ -5963,6 +5975,14 @@ diff -b -B --ignore-all-space --exclude-
########################################
#
# Unconfined mount local policy
+@@ -268,6 +283,7 @@
+ optional_policy(`
+ files_etc_filetrans_etc_runtime(unconfined_mount_t, file)
+ unconfined_domain_noaudit(unconfined_mount_t)
++ userdom_unpriv_usertype(unconfined, unconfined_mount_t)
+
+ rpc_domtrans_rpcd(unconfined_mount_t)
+ devicekit_dbus_chat_disk(unconfined_mount_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.6.32/policy/modules/system/selinuxutil.te
--- nsaserefpolicy/policy/modules/system/selinuxutil.te 2010-01-18 18:24:22.967540599 +0100
+++ serefpolicy-3.6.32/policy/modules/system/selinuxutil.te 2010-01-18 18:27:02.789530951 +0100
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/F-12/selinux-policy.spec,v
retrieving revision 1.1019
retrieving revision 1.1020
diff -u -p -r1.1019 -r1.1020
--- selinux-policy.spec 11 Feb 2010 19:42:32 -0000 1.1019
+++ selinux-policy.spec 11 Feb 2010 20:51:36 -0000 1.1020
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.6.32
-Release: 88%{?dist}
+Release: 89%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -469,6 +469,9 @@ exit 0
%endif
%changelog
+* Thu Feb 11 2010 Miroslav Grepl <mgrepl at redhat.com> 3.6.32-89
+- Allow rpcd to read files with default file type
+
* Thu Feb 11 2010 Miroslav Grepl <mgrepl at redhat.com> 3.6.32-88
- Fixes for sandbox
- Allow quota to set priority of kernel threads
More information about the scm-commits
mailing list