rpms/selinux-policy/F-12 policy-20100106.patch, 1.38, 1.39 selinux-policy.spec, 1.1023, 1.1024
Miroslav Grepl
mgrepl at fedoraproject.org
Thu Feb 25 16:48:43 UTC 2010
- Previous message: rpms/proftpd/devel .cvsignore, 1.19, 1.20 proftpd.conf, 1.12, 1.13 proftpd.init, 1.7, 1.8 proftpd.spec, 1.63, 1.64 sources, 1.19, 1.20 proftpd-1.3.2-parallel-build.patch, 1.1, NONE proftpd-1.3.2a-mlsd.patch, 1.2, NONE
- Next message: [pkgdb] python-pycurl had acl change status
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: mgrepl
Update of /cvs/pkgs/rpms/selinux-policy/F-12
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv14583
Modified Files:
policy-20100106.patch selinux-policy.spec
Log Message:
- Fix wine dontaudit mmap_zero
- Add vbetool_mmap_zero_ignore boolean
- dontaudit acct using console
policy-20100106.patch:
modules/admin/consoletype.if | 4
modules/admin/dmesg.fc | 1
modules/admin/logrotate.te | 4
modules/admin/logwatch.te | 5
modules/admin/mcelog.fc | 2
modules/admin/mcelog.if | 20 +
modules/admin/mcelog.te | 31 ++
modules/admin/netutils.fc | 1
modules/admin/netutils.te | 2
modules/admin/prelink.te | 1
modules/admin/quota.te | 1
modules/admin/readahead.te | 2
modules/admin/rpm.if | 21 -
modules/admin/smoltclient.te | 2
modules/admin/usermanage.te | 6
modules/admin/vbetool.te | 13 +
modules/apps/cdrecord.te | 2
modules/apps/chrome.te | 3
modules/apps/execmem.if | 5
modules/apps/firewallgui.te | 6
modules/apps/gnome.fc | 9
modules/apps/gnome.if | 81 +++++-
modules/apps/gnome.te | 8
modules/apps/gpg.fc | 2
modules/apps/gpg.te | 5
modules/apps/kdumpgui.te | 4
modules/apps/mozilla.fc | 1
modules/apps/nsplugin.fc | 1
modules/apps/nsplugin.if | 36 ++
modules/apps/podsleuth.te | 1
modules/apps/pulseaudio.fc | 2
modules/apps/pulseaudio.if | 6
modules/apps/pulseaudio.te | 14 +
modules/apps/sambagui.te | 4
modules/apps/sandbox.if | 54 +++-
modules/apps/sandbox.te | 49 ++-
modules/apps/slocate.te | 1
modules/apps/vmware.if | 18 +
modules/apps/vmware.te | 9
modules/apps/wine.if | 4
modules/apps/wine.te | 14 +
modules/kernel/corecommands.fc | 4
modules/kernel/corenetwork.if.in | 18 +
modules/kernel/corenetwork.te.in | 5
modules/kernel/devices.fc | 5
modules/kernel/devices.if | 109 ++++++++
modules/kernel/devices.te | 18 +
modules/kernel/files.fc | 2
modules/kernel/files.if | 334 ++++++++++++++++++++------
modules/kernel/files.te | 6
modules/kernel/filesystem.if | 156 +++++++++++-
modules/kernel/filesystem.te | 12
modules/kernel/kernel.if | 18 +
modules/kernel/terminal.if | 25 +
modules/roles/staff.te | 16 -
modules/roles/sysadm.te | 4
modules/roles/unconfineduser.fc | 5
modules/roles/unconfineduser.te | 4
modules/roles/xguest.te | 6
modules/services/abrt.if | 5
modules/services/abrt.te | 15 +
modules/services/afs.te | 6
modules/services/aisexec.fc | 2
modules/services/aisexec.te | 8
modules/services/amavis.te | 1
modules/services/apache.fc | 7
modules/services/apache.if | 27 ++
modules/services/apache.te | 25 +
modules/services/apcupsd.te | 2
modules/services/arpwatch.te | 2
modules/services/avahi.fc | 2
modules/services/ccs.te | 6
modules/services/chronyd.fc | 2
modules/services/chronyd.te | 15 -
modules/services/clogd.if | 24 -
modules/services/clogd.te | 7
modules/services/consolekit.te | 10
modules/services/corosync.fc | 2
modules/services/corosync.te | 9
modules/services/cron.te | 9
modules/services/cups.te | 7
modules/services/dbus.if | 2
modules/services/dcc.te | 2
modules/services/djbdns.if | 38 +++
modules/services/djbdns.te | 8
modules/services/dnsmasq.fc | 2
modules/services/dnsmasq.te | 8
modules/services/dovecot.te | 6
modules/services/exim.if | 18 +
modules/services/fail2ban.if | 18 +
modules/services/ftp.fc | 2
modules/services/ftp.if | 37 ++
modules/services/ftp.te | 116 +++++++++
modules/services/git.fc | 17 -
modules/services/git.if | 466 ++++++++++++++++++++++++++++---------
modules/services/git.te | 145 ++++++-----
modules/services/gpm.fc | 2
modules/services/kerberos.if | 2
modules/services/ldap.fc | 3
modules/services/ldap.te | 7
modules/services/lircd.te | 7
modules/services/mailman.te | 1
modules/services/memcached.te | 14 -
modules/services/modemmanager.te | 2
modules/services/mta.if | 38 +++
modules/services/mta.te | 1
modules/services/munin.te | 1
modules/services/mysql.te | 5
modules/services/nagios.fc | 46 +++
modules/services/nagios.if | 4
modules/services/nagios.te | 85 ++++++
modules/services/networkmanager.fc | 1
modules/services/networkmanager.te | 1
modules/services/nis.fc | 5
modules/services/nis.te | 8
modules/services/nx.if | 18 +
modules/services/openvpn.te | 4
modules/services/plymouth.te | 33 +-
modules/services/policykit.te | 8
modules/services/postfix.if | 37 ++
modules/services/postfix.te | 5
modules/services/ppp.fc | 2
modules/services/ppp.te | 8
modules/services/prelude.te | 2
modules/services/qmail.if | 18 +
modules/services/rgmanager.if | 40 +++
modules/services/rgmanager.te | 57 +++-
modules/services/rhcs.fc | 9
modules/services/rhcs.if | 58 ++++
modules/services/rhcs.te | 276 ++++-----------------
modules/services/ricci.te | 6
modules/services/rpc.if | 1
modules/services/rpc.te | 8
modules/services/samba.te | 16 +
modules/services/sendmail.te | 4
modules/services/setroubleshoot.te | 4
modules/services/snmp.te | 4
modules/services/snort.te | 1
modules/services/spamassassin.if | 18 +
modules/services/spamassassin.te | 6
modules/services/ssh.if | 4
modules/services/ssh.te | 81 ------
modules/services/sssd.fc | 2
modules/services/sssd.if | 85 +++---
modules/services/sssd.te | 14 -
modules/services/tftp.te | 1
modules/services/tgtd.te | 1
modules/services/tuned.fc | 3
modules/services/tuned.te | 15 +
modules/services/ucspitcp.te | 5
modules/services/usbmuxd.fc | 6
modules/services/usbmuxd.if | 64 +++++
modules/services/usbmuxd.te | 48 +++
modules/services/virt.if | 7
modules/services/virt.te | 10
modules/services/xserver.fc | 7
modules/services/xserver.if | 2
modules/services/xserver.te | 25 +
modules/system/application.te | 12
modules/system/daemontools.if | 62 ++++
modules/system/daemontools.te | 26 +-
modules/system/fstools.fc | 2
modules/system/hostname.te | 3
modules/system/hotplug.te | 4
modules/system/init.if | 33 ++
modules/system/init.te | 26 +-
modules/system/ipsec.te | 11
modules/system/iptables.if | 10
modules/system/iptables.te | 6
modules/system/iscsi.fc | 3
modules/system/iscsi.te | 10
modules/system/libraries.fc | 18 +
modules/system/locallogin.te | 6
modules/system/logging.fc | 7
modules/system/logging.if | 18 +
modules/system/logging.te | 9
modules/system/lvm.te | 2
modules/system/miscfiles.fc | 2
modules/system/miscfiles.if | 37 ++
modules/system/modutils.te | 1
modules/system/mount.if | 4
modules/system/mount.te | 16 +
modules/system/selinuxutil.te | 1
modules/system/sysnetwork.if | 4
modules/system/sysnetwork.te | 3
modules/system/udev.te | 5
modules/system/unconfined.if | 2
modules/system/userdomain.fc | 1
modules/system/userdomain.if | 36 ++
modules/system/xen.if | 2
modules/system/xen.te | 13 +
support/obj_perm_sets.spt | 8
users | 2
193 files changed, 3127 insertions(+), 814 deletions(-)
Index: policy-20100106.patch
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/F-12/policy-20100106.patch,v
retrieving revision 1.38
retrieving revision 1.39
diff -u -p -r1.38 -r1.39
--- policy-20100106.patch 23 Feb 2010 18:27:15 -0000 1.38
+++ policy-20100106.patch 25 Feb 2010 16:48:42 -0000 1.39
@@ -241,6 +241,36 @@ diff -b -B --ignore-all-space --exclude-
allow passwd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow passwd_t self:process { setrlimit setfscreate };
allow passwd_t self:fd use;
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.6.32/policy/modules/admin/vbetool.te
+--- nsaserefpolicy/policy/modules/admin/vbetool.te 2010-01-18 18:24:22.585539991 +0100
++++ serefpolicy-3.6.32/policy/modules/admin/vbetool.te 2010-02-25 10:44:22.592616500 +0100
+@@ -6,6 +6,15 @@
+ # Declarations
+ #
+
++## <desc>
++## <p>
++## Ignore vbetool mmap_zero errors
++## </p>
++## </desc>
++#
++gen_tunable(vbetool_mmap_zero_ignore, false)
++
++
+ type vbetool_t;
+ type vbetool_exec_t;
+ init_system_domain(vbetool_t, vbetool_exec_t)
+@@ -34,6 +43,10 @@
+
+ miscfiles_read_localization(vbetool_t)
+
++tunable_policy(`vbetool_mmap_zero_ignore',`
++ dontaudit vbetool_t self:memprotect mmap_zero;
++')
++
+ optional_policy(`
+ hal_rw_pid_files(vbetool_t)
+ hal_write_log(vbetool_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/cdrecord.te serefpolicy-3.6.32/policy/modules/apps/cdrecord.te
--- nsaserefpolicy/policy/modules/apps/cdrecord.te 2009-09-16 16:01:19.000000000 +0200
+++ serefpolicy-3.6.32/policy/modules/apps/cdrecord.te 2010-02-09 09:59:13.342615577 +0100
@@ -1041,13 +1071,13 @@ diff -b -B --ignore-all-space --exclude-
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.6.32/policy/modules/apps/wine.if
--- nsaserefpolicy/policy/modules/apps/wine.if 2010-01-18 18:24:22.657540000 +0100
-+++ serefpolicy-3.6.32/policy/modules/apps/wine.if 2010-01-18 18:27:02.744541291 +0100
++++ serefpolicy-3.6.32/policy/modules/apps/wine.if 2010-02-25 10:41:42.983616503 +0100
@@ -143,6 +143,10 @@
userdom_unpriv_usertype($1, $1_wine_t)
userdom_manage_tmpfs_role($2, $1_wine_t)
+ tunable_policy(`wine_mmap_zero_ignore',`
-+ allow $1_wine_t self:memprotect mmap_zero;
++ dontaudit $1_wine_t self:memprotect mmap_zero;
+ ')
+
domain_mmap_low_type($1_wine_t)
@@ -1055,7 +1085,7 @@ diff -b -B --ignore-all-space --exclude-
domain_mmap_low($1_wine_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.6.32/policy/modules/apps/wine.te
--- nsaserefpolicy/policy/modules/apps/wine.te 2010-01-18 18:24:22.664530344 +0100
-+++ serefpolicy-3.6.32/policy/modules/apps/wine.te 2010-01-18 18:27:02.745530942 +0100
++++ serefpolicy-3.6.32/policy/modules/apps/wine.te 2010-02-25 10:41:30.613616914 +0100
@@ -6,6 +6,15 @@
# Declarations
#
@@ -1077,7 +1107,7 @@ diff -b -B --ignore-all-space --exclude-
files_tmp_filetrans(wine_t, wine_tmp_t,{ file dir })
+tunable_policy(`wine_mmap_zero_ignore',`
-+ allow wine_t self:memprotect mmap_zero;
++ dontaudit wine_t self:memprotect mmap_zero;
+')
+
+
@@ -2321,7 +2351,22 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.6.32/policy/modules/kernel/terminal.if
--- nsaserefpolicy/policy/modules/kernel/terminal.if 2010-01-18 18:24:22.716539752 +0100
-+++ serefpolicy-3.6.32/policy/modules/kernel/terminal.if 2010-02-23 18:59:49.535775282 +0100
++++ serefpolicy-3.6.32/policy/modules/kernel/terminal.if 2010-02-25 10:46:02.354878806 +0100
+@@ -273,11 +273,11 @@
+ interface(`term_dontaudit_use_console',`
+ gen_require(`
+ type console_device_t;
+- type tty_device_t;
+ ')
++ dontaudit $1 console_device_t:chr_file rw_inherited_chr_file_perms;
++ term_dontaudit_use_unallocated_ttys($1)
++ term_dontaudit_use_generic_ptys($1)
+
+- dontaudit $1 console_device_t:chr_file rw_chr_file_perms;
+- dontaudit $1 tty_device_t:chr_file rw_chr_file_perms;
+ ')
+
+ ########################################
@@ -1098,6 +1098,25 @@
allow $1 ttynode:chr_file getattr;
')
@@ -2470,7 +2515,7 @@ diff -b -B --ignore-all-space --exclude-
######################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.te serefpolicy-3.6.32/policy/modules/services/abrt.te
--- nsaserefpolicy/policy/modules/services/abrt.te 2010-01-18 18:24:22.727540243 +0100
-+++ serefpolicy-3.6.32/policy/modules/services/abrt.te 2010-02-04 16:36:56.307403800 +0100
++++ serefpolicy-3.6.32/policy/modules/services/abrt.te 2010-02-25 10:37:53.650616556 +0100
@@ -96,6 +96,7 @@
corenet_tcp_connect_ftp_port(abrt_t)
corenet_tcp_connect_all_ports(abrt_t)
@@ -2479,7 +2524,15 @@ diff -b -B --ignore-all-space --exclude-
dev_read_urand(abrt_t)
dev_rw_sysfs(abrt_t)
dev_dontaudit_read_memory_dev(abrt_t)
-@@ -176,6 +177,16 @@
+@@ -106,6 +107,7 @@
+ files_getattr_all_files(abrt_t)
+ files_read_etc_files(abrt_t)
+ files_read_var_lib_files(abrt_t)
++files_read_var_symlinks(abrt_t)
+ files_read_usr_files(abrt_t)
+ files_read_generic_tmp_files(abrt_t)
+ files_read_kernel_modules(abrt_t)
+@@ -176,6 +178,16 @@
sssd_stream_connect(abrt_t)
')
@@ -2496,7 +2549,7 @@ diff -b -B --ignore-all-space --exclude-
permissive abrt_t;
########################################
-@@ -200,10 +211,13 @@
+@@ -200,10 +212,13 @@
files_read_etc_files(abrt_helper_t)
files_dontaudit_all_non_security_leaks(abrt_helper_t)
@@ -2690,7 +2743,7 @@ diff -b -B --ignore-all-space --exclude-
## Do not audit attempts to read and write Apache
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.6.32/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2010-01-18 18:24:22.739530246 +0100
-+++ serefpolicy-3.6.32/policy/modules/services/apache.te 2010-02-19 15:04:33.153787458 +0100
++++ serefpolicy-3.6.32/policy/modules/services/apache.te 2010-02-23 19:15:56.528525860 +0100
@@ -309,7 +309,7 @@
manage_dirs_pattern(httpd_t, httpd_cache_t, httpd_cache_t)
manage_files_pattern(httpd_t, httpd_cache_t, httpd_cache_t)
@@ -2749,7 +2802,7 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
kerberos_keytab_template(httpd, httpd_t)
')
-@@ -895,12 +907,17 @@
+@@ -895,6 +907,9 @@
sysnet_read_config(httpd_sys_script_t)
@@ -2759,22 +2812,22 @@ diff -b -B --ignore-all-space --exclude-
ifdef(`distro_redhat',`
allow httpd_sys_script_t httpd_log_t:file append_file_perms;
')
-
- fs_read_iso9660_files(httpd_sys_script_t)
-
-+fs_nfs_entry_type(httpd_sys_script_t)
-+
- tunable_policy(`httpd_use_nfs',`
- fs_manage_nfs_dirs(httpd_sys_script_t)
+@@ -906,6 +921,7 @@
fs_manage_nfs_files(httpd_sys_script_t)
-@@ -950,6 +967,7 @@
- tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
- fs_read_cifs_files(httpd_sys_script_t)
- fs_read_cifs_symlinks(httpd_sys_script_t)
+ fs_manage_nfs_symlinks(httpd_sys_script_t)
+ fs_exec_nfs_files(httpd_sys_script_t)
++ fs_nfs_entry_type(httpd_sys_script_t)
+
+ fs_manage_nfs_dirs(httpd_suexec_t)
+ fs_manage_nfs_files(httpd_suexec_t)
+@@ -945,6 +960,7 @@
+ fs_manage_cifs_files(httpd_suexec_t)
+ fs_manage_cifs_symlinks(httpd_suexec_t)
+ fs_exec_cifs_files(httpd_suexec_t)
+ fs_cifs_entry_type(httpd_sys_script_t)
')
- optional_policy(`
+ tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.6.32/policy/modules/services/apcupsd.te
--- nsaserefpolicy/policy/modules/services/apcupsd.te 2009-09-16 16:01:19.000000000 +0200
+++ serefpolicy-3.6.32/policy/modules/services/apcupsd.te 2010-01-18 18:27:02.757542944 +0100
@@ -5299,7 +5352,7 @@ diff -b -B --ignore-all-space --exclude-
## Read qmail configuration files.
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rgmanager.if serefpolicy-3.6.32/policy/modules/services/rgmanager.if
--- nsaserefpolicy/policy/modules/services/rgmanager.if 2010-01-18 18:24:22.870539995 +0100
-+++ serefpolicy-3.6.32/policy/modules/services/rgmanager.if 2010-02-23 18:50:35.095776522 +0100
++++ serefpolicy-3.6.32/policy/modules/services/rgmanager.if 2010-02-23 19:35:04.211525807 +0100
@@ -16,7 +16,7 @@
')
@@ -5335,12 +5388,12 @@ diff -b -B --ignore-all-space --exclude-
+
+######################################
+## <summary>
-+## Manage rgmanager tmp files.
++## Allow manage rgmanager tmp files.
+## </summary>
+## <param name="domain">
-+## <summary>
-+## The type of the process performing this action.
-+## </summary>
++## <summary>
++## The type of the process performing this action.
++## </summary>
+## </param>
+#
+interface(`rgmanager_manage_tmp_files',`
@@ -6045,6 +6098,16 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.6.32/policy/modules/services/rpc.if
+--- nsaserefpolicy/policy/modules/services/rpc.if 2010-01-18 18:24:22.879530454 +0100
++++ serefpolicy-3.6.32/policy/modules/services/rpc.if 2010-02-23 19:16:59.984776521 +0100
+@@ -413,5 +413,6 @@
+ ')
+
+ files_search_var_lib($1)
++ allow $1 var_lib_nfs_t:file { relabelfrom relabelto };
+ manage_files_pattern($1, var_lib_nfs_t, var_lib_nfs_t)
+ ')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.6.32/policy/modules/services/rpc.te
--- nsaserefpolicy/policy/modules/services/rpc.te 2010-01-18 18:24:22.880531210 +0100
+++ serefpolicy-3.6.32/policy/modules/services/rpc.te 2010-02-23 18:51:13.680527323 +0100
@@ -7760,7 +7823,7 @@ diff -b -B --ignore-all-space --exclude-
domain_read_all_domains_state(iscsid_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.6.32/policy/modules/system/libraries.fc
--- nsaserefpolicy/policy/modules/system/libraries.fc 2010-01-18 18:24:22.945540594 +0100
-+++ serefpolicy-3.6.32/policy/modules/system/libraries.fc 2010-02-22 12:38:28.432618673 +0100
++++ serefpolicy-3.6.32/policy/modules/system/libraries.fc 2010-02-25 10:34:31.079617322 +0100
@@ -245,8 +245,12 @@
# Livna.org packages: xmms-mp3, ffmpeg, xvidcore, xine-lib, gsm, lame
/usr/lib(64)?.*/libmpg123\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -7785,7 +7848,7 @@ diff -b -B --ignore-all-space --exclude-
/usr/lib(64)?/libSDL-.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/xulrunner-[^/]*/libgtkembedmoz\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/lib(64)?/xulrunner-[^/]*/libxul\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -432,9 +434,20 @@
+@@ -432,9 +434,21 @@
/usr/lib(64)?/octagaplayer/libapplication\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -7794,6 +7857,7 @@ diff -b -B --ignore-all-space --exclude-
/opt/AutoScan/usr/lib/libvte\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/opt/lampp/lib/libsybdb\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/opt/Unify/SQLBase/libgptsblmsui11.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/opt/real/RealPlayer/codecs(/.*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/opt/real/RealPlayer/plugins/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
/usr/bin/bsnes -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -8291,7 +8355,7 @@ diff -b -B --ignore-all-space --exclude-
files_search_mnt(xend_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.6.32/policy/support/obj_perm_sets.spt
--- nsaserefpolicy/policy/support/obj_perm_sets.spt 2010-01-18 18:24:22.988541733 +0100
-+++ serefpolicy-3.6.32/policy/support/obj_perm_sets.spt 2010-02-09 10:00:01.300658461 +0100
++++ serefpolicy-3.6.32/policy/support/obj_perm_sets.spt 2010-02-25 12:03:02.296616618 +0100
@@ -28,8 +28,7 @@
#
# All socket classes.
@@ -8311,6 +8375,16 @@ diff -b -B --ignore-all-space --exclude-
define(`relabelfrom_lnk_file_perms',`{ getattr relabelfrom }')
define(`relabelto_lnk_file_perms',`{ getattr relabelto }')
define(`relabel_lnk_file_perms',`{ getattr relabelfrom relabelto }')
+@@ -291,7 +290,8 @@
+ define(`read_chr_file_perms',`{ getattr open read lock ioctl }')
+ define(`append_chr_file_perms',`{ getattr open append lock ioctl }')
+ define(`write_chr_file_perms',`{ getattr open write append lock ioctl }')
+-define(`rw_chr_file_perms',`{ getattr open read write append ioctl lock }')
++define(`rw_inherited_chr_file_perms',`{ getattr read write append ioctl lock }')
++define(`rw_chr_file_perms',`{ open rw_inherited_chr_file_perms }')
+ define(`create_chr_file_perms',`{ getattr create }')
+ define(`rename_chr_file_perms',`{ getattr rename }')
+ define(`delete_chr_file_perms',`{ getattr unlink }')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.6.32/policy/users
--- nsaserefpolicy/policy/users 2010-01-18 18:24:22.989541023 +0100
+++ serefpolicy-3.6.32/policy/users 2010-01-18 18:27:02.799531176 +0100
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/F-12/selinux-policy.spec,v
retrieving revision 1.1023
retrieving revision 1.1024
diff -u -p -r1.1023 -r1.1024
--- selinux-policy.spec 23 Feb 2010 18:27:16 -0000 1.1023
+++ selinux-policy.spec 25 Feb 2010 16:48:43 -0000 1.1024
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.6.32
-Release: 92%{?dist}
+Release: 93%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -469,6 +469,11 @@ exit 0
%endif
%changelog
+* Thu Feb 25 2010 Miroslav Grepl <mgrepl at redhat.com> 3.6.32-93
+- Fix wine dontaudit mmap_zero
+- Add vbetool_mmap_zero_ignore boolean
+- dontaudit acct using console
+
* Tue Feb 23 2010 Miroslav Grepl <mgrepl at redhat.com> 3.6.32-92
- Fixes for cluster policy
- Fixes for rgmanager
- Previous message: rpms/proftpd/devel .cvsignore, 1.19, 1.20 proftpd.conf, 1.12, 1.13 proftpd.init, 1.7, 1.8 proftpd.spec, 1.63, 1.64 sources, 1.19, 1.20 proftpd-1.3.2-parallel-build.patch, 1.1, NONE proftpd-1.3.2a-mlsd.patch, 1.2, NONE
- Next message: [pkgdb] python-pycurl had acl change status
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the scm-commits
mailing list