rpms/selinux-policy/F-12 policy-20100106.patch, 1.40, 1.41 selinux-policy.spec, 1.1025, 1.1026
Miroslav Grepl
mgrepl at fedoraproject.org
Fri Feb 26 16:54:53 UTC 2010
- Previous message: rpms/kernel/devel patch-2.6.33-git2.bz2.sign, NONE, 1.1 .cvsignore, 1.1170, 1.1171 config-generic, 1.355, 1.356 kernel.spec, 1.1938, 1.1939 sources, 1.1129, 1.1130 upstream, 1.1042, 1.1043
- Next message: rpms/python-4Suite-XML/devel python-4Suite-XML-1.0.2-tests-as.patch, NONE, 1.1 python-4Suite-XML.spec, 1.15, 1.16
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: mgrepl
Update of /cvs/pkgs/rpms/selinux-policy/F-12
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv26830
Modified Files:
policy-20100106.patch selinux-policy.spec
Log Message:
- Add fixes from Dan Walsh
policy-20100106.patch:
modules/admin/consoletype.if | 4
modules/admin/dmesg.fc | 1
modules/admin/logrotate.te | 4
modules/admin/logwatch.te | 5
modules/admin/mcelog.fc | 2
modules/admin/mcelog.if | 20 +
modules/admin/mcelog.te | 31 ++
modules/admin/netutils.fc | 1
modules/admin/netutils.te | 2
modules/admin/prelink.te | 1
modules/admin/quota.te | 1
modules/admin/readahead.te | 2
modules/admin/rpm.if | 60 +++-
modules/admin/rpm.te | 2
modules/admin/smoltclient.te | 2
modules/admin/usermanage.te | 6
modules/admin/vbetool.te | 13 +
modules/apps/cdrecord.te | 2
modules/apps/chrome.te | 3
modules/apps/execmem.if | 5
modules/apps/firewallgui.te | 6
modules/apps/gnome.fc | 9
modules/apps/gnome.if | 81 +++++-
modules/apps/gnome.te | 8
modules/apps/gpg.fc | 2
modules/apps/gpg.te | 5
modules/apps/kdumpgui.te | 4
modules/apps/mozilla.fc | 1
modules/apps/nsplugin.fc | 1
modules/apps/nsplugin.if | 36 ++
modules/apps/podsleuth.te | 1
modules/apps/pulseaudio.fc | 2
modules/apps/pulseaudio.if | 6
modules/apps/pulseaudio.te | 14 +
modules/apps/qemu.te | 1
modules/apps/sambagui.te | 4
modules/apps/sandbox.if | 54 +++-
modules/apps/sandbox.te | 49 ++-
modules/apps/slocate.te | 1
modules/apps/vmware.if | 18 +
modules/apps/vmware.te | 9
modules/apps/wine.if | 4
modules/apps/wine.te | 14 +
modules/kernel/corecommands.fc | 4
modules/kernel/corenetwork.if.in | 18 +
modules/kernel/corenetwork.te.in | 5
modules/kernel/devices.fc | 6
modules/kernel/devices.if | 200 +++++++++++++++
modules/kernel/devices.te | 23 +
modules/kernel/domain.if | 22 +
modules/kernel/domain.te | 2
modules/kernel/files.fc | 2
modules/kernel/files.if | 334 ++++++++++++++++++++------
modules/kernel/files.te | 6
modules/kernel/filesystem.if | 156 +++++++++++-
modules/kernel/filesystem.te | 12
modules/kernel/kernel.if | 18 +
modules/kernel/terminal.if | 247 +++++++++++++++++++
modules/roles/auditadm.te | 2
modules/roles/secadm.te | 2
modules/roles/staff.te | 16 -
modules/roles/sysadm.te | 5
modules/roles/unconfineduser.fc | 5
modules/roles/unconfineduser.te | 4
modules/roles/xguest.te | 6
modules/services/abrt.if | 5
modules/services/abrt.te | 15 +
modules/services/afs.te | 6
modules/services/aisexec.fc | 2
modules/services/aisexec.te | 8
modules/services/amavis.te | 1
modules/services/apache.fc | 7
modules/services/apache.if | 27 ++
modules/services/apache.te | 25 +
modules/services/apcupsd.te | 2
modules/services/arpwatch.te | 2
modules/services/avahi.fc | 2
modules/services/ccs.te | 6
modules/services/chronyd.fc | 2
modules/services/chronyd.te | 15 -
modules/services/clogd.if | 24 -
modules/services/clogd.te | 7
modules/services/consolekit.te | 10
modules/services/corosync.fc | 2
modules/services/corosync.te | 9
modules/services/cron.te | 9
modules/services/cups.te | 7
modules/services/dbus.if | 2
modules/services/dcc.te | 2
modules/services/devicekit.fc | 4
modules/services/devicekit.te | 12
modules/services/djbdns.if | 38 +++
modules/services/djbdns.te | 8
modules/services/dnsmasq.fc | 2
modules/services/dnsmasq.te | 8
modules/services/dovecot.te | 6
modules/services/exim.if | 18 +
modules/services/fail2ban.if | 18 +
modules/services/ftp.fc | 2
modules/services/ftp.if | 37 ++
modules/services/ftp.te | 116 +++++++++
modules/services/git.fc | 17 -
modules/services/git.if | 466 ++++++++++++++++++++++++++++---------
modules/services/git.te | 145 ++++++-----
modules/services/gpm.fc | 2
modules/services/kerberos.if | 2
modules/services/ldap.fc | 3
modules/services/ldap.te | 7
modules/services/lircd.te | 7
modules/services/mailman.te | 1
modules/services/memcached.te | 14 -
modules/services/modemmanager.te | 2
modules/services/mta.if | 38 +++
modules/services/mta.te | 1
modules/services/munin.te | 1
modules/services/mysql.te | 5
modules/services/nagios.fc | 46 +++
modules/services/nagios.if | 4
modules/services/nagios.te | 85 ++++++
modules/services/networkmanager.fc | 1
modules/services/networkmanager.te | 1
modules/services/nis.fc | 5
modules/services/nis.te | 8
modules/services/nx.if | 18 +
modules/services/openvpn.te | 4
modules/services/plymouth.te | 33 +-
modules/services/policykit.te | 8
modules/services/postfix.if | 37 ++
modules/services/postfix.te | 5
modules/services/ppp.fc | 2
modules/services/ppp.te | 8
modules/services/prelude.te | 2
modules/services/qmail.if | 18 +
modules/services/rgmanager.if | 40 +++
modules/services/rgmanager.te | 57 +++-
modules/services/rhcs.fc | 9
modules/services/rhcs.if | 58 ++++
modules/services/rhcs.te | 276 ++++-----------------
modules/services/ricci.te | 6
modules/services/rpc.if | 1
modules/services/rpc.te | 8
modules/services/samba.te | 16 +
modules/services/sendmail.te | 4
modules/services/setroubleshoot.te | 4
modules/services/snmp.te | 4
modules/services/snort.te | 1
modules/services/spamassassin.if | 18 +
modules/services/spamassassin.te | 6
modules/services/ssh.if | 4
modules/services/ssh.te | 81 ------
modules/services/sssd.fc | 2
modules/services/sssd.if | 85 +++---
modules/services/sssd.te | 16 -
modules/services/tftp.te | 1
modules/services/tgtd.te | 1
modules/services/tuned.fc | 3
modules/services/tuned.te | 15 +
modules/services/ucspitcp.te | 5
modules/services/usbmuxd.fc | 6
modules/services/usbmuxd.if | 64 +++++
modules/services/usbmuxd.te | 48 +++
modules/services/virt.if | 7
modules/services/virt.te | 10
modules/services/xserver.fc | 7
modules/services/xserver.if | 2
modules/services/xserver.te | 25 +
modules/system/application.te | 12
modules/system/daemontools.if | 62 ++++
modules/system/daemontools.te | 26 +-
modules/system/fstools.fc | 2
modules/system/hostname.te | 3
modules/system/hotplug.te | 4
modules/system/init.if | 33 ++
modules/system/init.te | 27 ++
modules/system/ipsec.te | 11
modules/system/iptables.if | 10
modules/system/iptables.te | 6
modules/system/iscsi.fc | 3
modules/system/iscsi.te | 10
modules/system/libraries.fc | 18 +
modules/system/locallogin.te | 19 -
modules/system/logging.fc | 7
modules/system/logging.if | 18 +
modules/system/logging.te | 10
modules/system/lvm.fc | 1
modules/system/lvm.te | 3
modules/system/miscfiles.fc | 2
modules/system/miscfiles.if | 37 ++
modules/system/modutils.te | 1
modules/system/mount.if | 4
modules/system/mount.te | 16 +
modules/system/selinuxutil.te | 1
modules/system/sysnetwork.if | 4
modules/system/sysnetwork.te | 3
modules/system/udev.te | 5
modules/system/unconfined.if | 2
modules/system/userdomain.fc | 1
modules/system/userdomain.if | 36 ++
modules/system/xen.if | 2
modules/system/xen.te | 13 +
support/obj_perm_sets.spt | 8
users | 2
202 files changed, 3521 insertions(+), 845 deletions(-)
Index: policy-20100106.patch
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/F-12/policy-20100106.patch,v
retrieving revision 1.40
retrieving revision 1.41
diff -u -p -r1.40 -r1.41
--- policy-20100106.patch 26 Feb 2010 10:05:31 -0000 1.40
+++ policy-20100106.patch 26 Feb 2010 16:54:53 -0000 1.41
@@ -171,7 +171,7 @@ diff -b -B --ignore-all-space --exclude-
fs_dontaudit_search_ramfs(readahead_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.6.32/policy/modules/admin/rpm.if
--- nsaserefpolicy/policy/modules/admin/rpm.if 2010-01-18 18:24:22.567540216 +0100
-+++ serefpolicy-3.6.32/policy/modules/admin/rpm.if 2010-02-16 17:05:12.130597953 +0100
++++ serefpolicy-3.6.32/policy/modules/admin/rpm.if 2010-02-26 16:58:42.643856793 +0100
@@ -189,22 +189,23 @@
type rpm_tmpfs_t, rpm_script_tmp_t, rpm_var_lib_t;
')
@@ -206,6 +206,77 @@ diff -b -B --ignore-all-space --exclude-
')
########################################
+@@ -273,6 +274,26 @@
+ #####################################
+ ## <summary>
+ ## Allow the specified domain to append
++## to rpm tmp files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`rpm_append_tmp',`
++ gen_require(`
++ type rpm_tmp_t;
++ ')
++
++ files_search_tmp($1)
++ append_files_pattern($1, rpm_tmp_t, rpm_tmp_t)
++')
++
++#####################################
++## <summary>
++## Allow the specified domain to append
+ ## to rpm log files.
+ ## </summary>
+ ## <param name="domain">
+@@ -599,8 +620,10 @@
+ interface(`rpm_transition_script',`
+ gen_require(`
+ type rpm_script_t;
++ attribute rpm_transition_domain;
+ ')
+
++ typeattribute $1 rpm_transition_domain;
+ allow $1 rpm_script_t:process transition;
+
+ allow $1 rpm_script_t:fd use;
+@@ -627,3 +650,20 @@
+ allow $1 rpm_t:process signull;
+ ')
+
++########################################
++## <summary>
++## Send a null signal to rpm.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`rpm_inherited_fifo',`
++ gen_require(`
++ attribute rpm_transition_domain;
++ ')
++
++ allow $1 rpm_transition_domain:fifo_file rw_inherited_fifo_file_perms;
++')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.6.32/policy/modules/admin/rpm.te
+--- nsaserefpolicy/policy/modules/admin/rpm.te 2010-01-18 18:24:22.568530565 +0100
++++ serefpolicy-3.6.32/policy/modules/admin/rpm.te 2010-02-26 16:50:05.472606689 +0100
+@@ -1,6 +1,8 @@
+
+ policy_module(rpm, 1.10.0)
+
++attribute rpm_transition_domain;
++
+ ########################################
+ #
+ # Declarations
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/smoltclient.te serefpolicy-3.6.32/policy/modules/admin/smoltclient.te
--- nsaserefpolicy/policy/modules/admin/smoltclient.te 2010-01-18 18:24:22.573543214 +0100
+++ serefpolicy-3.6.32/policy/modules/admin/smoltclient.te 2010-01-25 11:03:49.548441857 +0100
@@ -713,6 +784,17 @@ diff -b -B --ignore-all-space --exclude-
xserver_common_app(pulseaudio_t)
+ xserver_user_x_domain_template(pulseaudio, pulseaudio_t, pulseaudio_tmpfs_t)
')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.te serefpolicy-3.6.32/policy/modules/apps/qemu.te
+--- nsaserefpolicy/policy/modules/apps/qemu.te 2010-01-18 18:24:22.644530315 +0100
++++ serefpolicy-3.6.32/policy/modules/apps/qemu.te 2010-02-26 17:10:10.725606301 +0100
+@@ -116,6 +116,7 @@
+ domain_type(qemu_unconfined_t)
+ unconfined_domain_noaudit(qemu_unconfined_t)
+ userdom_manage_tmpfs_role(unconfined_r, qemu_unconfined_t)
++ userdom_unpriv_usertype(unconfined,qemu_unconfined_t)
+
+ application_type(qemu_unconfined_t)
+ role unconfined_r types qemu_unconfined_t;
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.te serefpolicy-3.6.32/policy/modules/apps/sambagui.te
--- nsaserefpolicy/policy/modules/apps/sambagui.te 2010-01-18 18:24:22.646540277 +0100
+++ serefpolicy-3.6.32/policy/modules/apps/sambagui.te 2010-02-08 10:39:43.173336716 +0100
@@ -1616,6 +1698,20 @@ diff -b -B --ignore-all-space --exclude-
## Get the scheduler information of all domains.
## </summary>
## <param name="domain">
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.6.32/policy/modules/kernel/domain.te
+--- nsaserefpolicy/policy/modules/kernel/domain.te 2010-01-18 18:24:22.685530781 +0100
++++ serefpolicy-3.6.32/policy/modules/kernel/domain.te 2010-02-26 16:50:12.859856633 +0100
+@@ -216,8 +216,10 @@
+ optional_policy(`
+ rpm_use_fds(domain)
+ rpm_read_pipes(domain)
++ rpm_append_tmp(domain)
+ rpm_dontaudit_leaks(domain)
+ rpm_read_script_tmp_files(domain)
++ rpm_inherited_fifo(domain)
+ ')
+
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-3.6.32/policy/modules/kernel/files.fc
--- nsaserefpolicy/policy/modules/kernel/files.fc 2010-02-21 20:44:28.920309784 +0100
+++ serefpolicy-3.6.32/policy/modules/kernel/files.fc 2010-02-21 20:53:20.192309481 +0100
@@ -2875,6 +2971,30 @@ diff -b -B --ignore-all-space --exclude-
## Do not audit attempts to read or write
## any user ttys.
## </summary>
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/auditadm.te serefpolicy-3.6.32/policy/modules/roles/auditadm.te
+--- nsaserefpolicy/policy/modules/roles/auditadm.te 2009-09-16 16:01:19.000000000 +0200
++++ serefpolicy-3.6.32/policy/modules/roles/auditadm.te 2010-02-26 17:30:38.456615603 +0100
+@@ -33,6 +33,8 @@
+ seutil_run_runinit(auditadm_t, auditadm_r)
+ seutil_read_bin_policy(auditadm_t)
+
++userdom_dontaudit_search_admin_dir(auditadm_t)
++
+ optional_policy(`
+ consoletype_exec(auditadm_t)
+ ')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/secadm.te serefpolicy-3.6.32/policy/modules/roles/secadm.te
+--- nsaserefpolicy/policy/modules/roles/secadm.te 2009-09-16 16:01:19.000000000 +0200
++++ serefpolicy-3.6.32/policy/modules/roles/secadm.te 2010-02-26 17:31:00.881606103 +0100
+@@ -40,6 +40,8 @@
+ logging_read_generic_logs(secadm_t)
+ logging_read_audit_config(secadm_t)
+
++userdom_dontaudit_search_admin_dir(secadm_t)
++
+ optional_policy(`
+ aide_run(secadm_t, secadm_r)
+ ')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/staff.te serefpolicy-3.6.32/policy/modules/roles/staff.te
--- nsaserefpolicy/policy/modules/roles/staff.te 2010-01-18 18:24:22.718544267 +0100
+++ serefpolicy-3.6.32/policy/modules/roles/staff.te 2010-02-11 17:58:37.444708661 +0100
@@ -2909,8 +3029,16 @@ diff -b -B --ignore-all-space --exclude-
gnomeclock_dbus_chat(staff_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.te serefpolicy-3.6.32/policy/modules/roles/sysadm.te
--- nsaserefpolicy/policy/modules/roles/sysadm.te 2010-01-18 18:24:22.719529727 +0100
-+++ serefpolicy-3.6.32/policy/modules/roles/sysadm.te 2010-02-11 14:08:45.869618803 +0100
-@@ -129,6 +129,10 @@
++++ serefpolicy-3.6.32/policy/modules/roles/sysadm.te 2010-02-26 16:50:28.348855779 +0100
+@@ -29,6 +29,7 @@
+ corecmd_exec_shell(sysadm_t)
+
+ mls_process_read_up(sysadm_t)
++mls_file_read_to_clearance(sysadm_t)
+
+ ubac_process_exempt(sysadm_t)
+ ubac_file_exempt(sysadm_t)
+@@ -129,6 +130,10 @@
')
optional_policy(`
@@ -3674,7 +3802,7 @@ diff -b -B --ignore-all-space --exclude-
+/var/run/udisks(/.*)? gen_context(system_u:object_r:devicekit_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.6.32/policy/modules/services/devicekit.te
--- nsaserefpolicy/policy/modules/services/devicekit.te 2010-01-18 18:24:22.780530921 +0100
-+++ serefpolicy-3.6.32/policy/modules/services/devicekit.te 2010-02-26 09:34:07.924815056 +0100
++++ serefpolicy-3.6.32/policy/modules/services/devicekit.te 2010-02-26 16:50:32.750606240 +0100
@@ -62,8 +62,8 @@
# DeviceKit disk local policy
#
@@ -3709,7 +3837,17 @@ diff -b -B --ignore-all-space --exclude-
files_getattr_all_sockets(devicekit_disk_t)
files_getattr_all_mountpoints(devicekit_disk_t)
files_getattr_all_files(devicekit_disk_t)
-@@ -182,6 +185,7 @@
+@@ -122,6 +125,9 @@
+ storage_raw_read_removable_device(devicekit_disk_t)
+ storage_raw_write_removable_device(devicekit_disk_t)
+
++mls_file_read_all_levels(devicekit_disk_t)
++mls_file_write_to_clearance(devicekit_disk_t)
++
+ term_use_all_terms(devicekit_disk_t)
+
+ auth_use_nsswitch(devicekit_disk_t)
+@@ -182,6 +188,7 @@
#
allow devicekit_power_t self:capability { dac_override net_admin sys_admin sys_tty_config sys_nice sys_ptrace };
@@ -3717,7 +3855,7 @@ diff -b -B --ignore-all-space --exclude-
allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
allow devicekit_power_t self:netlink_kobject_uevent_socket create_socket_perms;
-@@ -205,6 +209,7 @@
+@@ -205,6 +212,7 @@
dev_read_input(devicekit_power_t)
dev_rw_generic_usb_dev(devicekit_power_t)
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/F-12/selinux-policy.spec,v
retrieving revision 1.1025
retrieving revision 1.1026
diff -u -p -r1.1025 -r1.1026
--- selinux-policy.spec 26 Feb 2010 10:05:31 -0000 1.1025
+++ selinux-policy.spec 26 Feb 2010 16:54:53 -0000 1.1026
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.6.32
-Release: 94%{?dist}
+Release: 95%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -469,6 +469,9 @@ exit 0
%endif
%changelog
+* Fri Feb 26 2010 Miroslav Grepl <mgrepl at redhat.com> 3.6.32-95
+- Add fixes from Dan Walsh
+
* Fri Feb 26 2010 Miroslav Grepl <mgrepl at redhat.com> 3.6.32-94
- Fixes for MLS booting from Dan Walsh
- Previous message: rpms/kernel/devel patch-2.6.33-git2.bz2.sign, NONE, 1.1 .cvsignore, 1.1170, 1.1171 config-generic, 1.355, 1.356 kernel.spec, 1.1938, 1.1939 sources, 1.1129, 1.1130 upstream, 1.1042, 1.1043
- Next message: rpms/python-4Suite-XML/devel python-4Suite-XML-1.0.2-tests-as.patch, NONE, 1.1 python-4Suite-XML.spec, 1.15, 1.16
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the scm-commits
mailing list