rpms/selinux-policy/F-13 modules-minimum.conf, 1.66, 1.67 modules-targeted.conf, 1.175, 1.176 policy-F13.patch, 1.126, 1.127 selinux-policy.spec, 1.1028, 1.1029
Miroslav Grepl
mgrepl at fedoraproject.org
Mon Jun 14 18:34:42 UTC 2010
Author: mgrepl
Update of /cvs/pkgs/rpms/selinux-policy/F-13
In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv14640
Modified Files:
modules-minimum.conf modules-targeted.conf policy-F13.patch
selinux-policy.spec
Log Message:
- Fixes for netutils
- Cleanup of aiccu policy
- Add mpd policy
Index: modules-minimum.conf
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/F-13/modules-minimum.conf,v
retrieving revision 1.66
retrieving revision 1.67
diff -u -p -r1.66 -r1.67
--- modules-minimum.conf 1 Jun 2010 15:56:38 -0000 1.66
+++ modules-minimum.conf 14 Jun 2010 18:34:41 -0000 1.67
@@ -1024,6 +1024,13 @@ nsplugin = module
#
modemmanager = module
+# Layer: services
+# Module: mpd
+#
+# mpd - daemon for playing music
+#
+mpd = module
+
# Layer: apps
# Module: mplayer
#
Index: modules-targeted.conf
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/F-13/modules-targeted.conf,v
retrieving revision 1.175
retrieving revision 1.176
diff -u -p -r1.175 -r1.176
--- modules-targeted.conf 1 Jun 2010 15:56:40 -0000 1.175
+++ modules-targeted.conf 14 Jun 2010 18:34:41 -0000 1.176
@@ -1024,6 +1024,13 @@ nsplugin = module
#
modemmanager = module
+# Layer: services
+# Module: mpd
+#
+# mpd - daemon for playing music
+#
+mpd = module
+
# Layer: apps
# Module: mplayer
#
policy-F13.patch:
Makefile | 2
policy/global_tunables | 24
policy/mls | 2
policy/modules/admin/accountsd.fc | 4
policy/modules/admin/accountsd.if | 164 ++
policy/modules/admin/accountsd.te | 64 +
policy/modules/admin/acct.te | 1
policy/modules/admin/alsa.te | 2
policy/modules/admin/anaconda.te | 4
policy/modules/admin/certwatch.te | 2
policy/modules/admin/consoletype.if | 3
policy/modules/admin/consoletype.te | 2
policy/modules/admin/dmesg.te | 5
policy/modules/admin/firstboot.te | 7
policy/modules/admin/kismet.te | 1
policy/modules/admin/logrotate.te | 42
policy/modules/admin/logwatch.fc | 6
policy/modules/admin/mcelog.te | 2
policy/modules/admin/mrtg.te | 1
policy/modules/admin/netutils.fc | 2
policy/modules/admin/netutils.te | 24
policy/modules/admin/prelink.fc | 4
policy/modules/admin/prelink.if | 28
policy/modules/admin/prelink.te | 79 +
policy/modules/admin/quota.te | 1
policy/modules/admin/readahead.te | 4
policy/modules/admin/rpm.fc | 21
policy/modules/admin/rpm.if | 387 +++++++
policy/modules/admin/rpm.te | 110 +-
policy/modules/admin/shorewall.te | 6
policy/modules/admin/shutdown.fc | 5
policy/modules/admin/shutdown.if | 136 ++
policy/modules/admin/shutdown.te | 63 +
policy/modules/admin/su.if | 11
policy/modules/admin/sudo.if | 12
policy/modules/admin/tmpreaper.te | 24
policy/modules/admin/usermanage.if | 20
policy/modules/admin/usermanage.te | 24
policy/modules/admin/vbetool.te | 6
policy/modules/admin/vpn.if | 20
policy/modules/admin/vpn.te | 8
policy/modules/apps/chrome.fc | 3
policy/modules/apps/chrome.if | 90 +
policy/modules/apps/chrome.te | 86 +
policy/modules/apps/cpufreqselector.te | 4
policy/modules/apps/execmem.fc | 47
policy/modules/apps/execmem.if | 110 ++
policy/modules/apps/execmem.te | 11
policy/modules/apps/firewallgui.fc | 3
policy/modules/apps/firewallgui.if | 23
policy/modules/apps/firewallgui.te | 66 +
policy/modules/apps/gitosis.fc | 2
policy/modules/apps/gitosis.if | 2
policy/modules/apps/gitosis.te | 7
policy/modules/apps/gnome.fc | 24
policy/modules/apps/gnome.if | 438 +++++++-
policy/modules/apps/gnome.te | 118 ++
policy/modules/apps/gpg.fc | 1
policy/modules/apps/gpg.if | 114 ++
policy/modules/apps/gpg.te | 157 ++
policy/modules/apps/irc.fc | 7
policy/modules/apps/irc.if | 37
policy/modules/apps/irc.te | 104 +
policy/modules/apps/java.fc | 7
policy/modules/apps/java.if | 4
policy/modules/apps/java.te | 9
policy/modules/apps/kdumpgui.fc | 2
policy/modules/apps/kdumpgui.if | 2
policy/modules/apps/kdumpgui.te | 68 +
policy/modules/apps/livecd.fc | 2
policy/modules/apps/livecd.if | 127 ++
policy/modules/apps/livecd.te | 34
policy/modules/apps/loadkeys.if | 3
policy/modules/apps/loadkeys.te | 6
policy/modules/apps/mono.if | 5
policy/modules/apps/mozilla.fc | 2
policy/modules/apps/mozilla.if | 62 +
policy/modules/apps/mozilla.te | 22
policy/modules/apps/mplayer.if | 36
policy/modules/apps/mplayer.te | 29
policy/modules/apps/nsplugin.fc | 10
policy/modules/apps/nsplugin.if | 391 +++++++
policy/modules/apps/nsplugin.te | 297 +++++
policy/modules/apps/openoffice.fc | 4
policy/modules/apps/openoffice.if | 129 ++
policy/modules/apps/openoffice.te | 17
policy/modules/apps/podsleuth.te | 3
policy/modules/apps/pulseaudio.if | 57 +
policy/modules/apps/pulseaudio.te | 11
policy/modules/apps/qemu.fc | 4
policy/modules/apps/qemu.if | 84 +
policy/modules/apps/qemu.te | 11
policy/modules/apps/sambagui.fc | 1
policy/modules/apps/sambagui.if | 2
policy/modules/apps/sambagui.te | 66 +
policy/modules/apps/sandbox.fc | 1
policy/modules/apps/sandbox.if | 314 +++++
policy/modules/apps/sandbox.te | 386 +++++++
policy/modules/apps/seunshare.if | 78 -
policy/modules/apps/seunshare.te | 35
policy/modules/apps/slocate.te | 4
policy/modules/apps/telepathysofiasip.fc | 2
policy/modules/apps/telepathysofiasip.if | 69 +
policy/modules/apps/telepathysofiasip.te | 45
policy/modules/apps/userhelper.fc | 1
policy/modules/apps/userhelper.if | 56 +
policy/modules/apps/userhelper.te | 42
policy/modules/apps/vmware.if | 19
policy/modules/apps/vmware.te | 14
policy/modules/apps/wine.fc | 1
policy/modules/apps/wine.if | 11
policy/modules/apps/wine.te | 22
policy/modules/apps/wm.if | 16
policy/modules/kernel/corecommands.fc | 34
policy/modules/kernel/corecommands.if | 2
policy/modules/kernel/corenetwork.te.in | 37
policy/modules/kernel/devices.fc | 9
policy/modules/kernel/devices.if | 214 +++
policy/modules/kernel/devices.te | 18
policy/modules/kernel/domain.if | 63 +
policy/modules/kernel/domain.te | 112 ++
policy/modules/kernel/files.fc | 27
policy/modules/kernel/files.if | 653 +++++++++++
policy/modules/kernel/files.te | 15
policy/modules/kernel/filesystem.if | 296 ++++-
policy/modules/kernel/filesystem.te | 11
policy/modules/kernel/kernel.if | 107 +
policy/modules/kernel/kernel.te | 36
policy/modules/kernel/selinux.if | 25
policy/modules/kernel/storage.fc | 1
policy/modules/kernel/storage.if | 22
policy/modules/kernel/terminal.if | 29
policy/modules/roles/auditadm.te | 3
policy/modules/roles/guest.te | 8
policy/modules/roles/secadm.te | 2
policy/modules/roles/staff.te | 118 ++
policy/modules/roles/sysadm.te | 98 +
policy/modules/roles/unconfineduser.fc | 10
policy/modules/roles/unconfineduser.if | 667 ++++++++++++
policy/modules/roles/unconfineduser.te | 439 ++++++++
policy/modules/roles/unprivuser.te | 23
policy/modules/roles/xguest.te | 79 +
policy/modules/services/abrt.fc | 18
policy/modules/services/abrt.if | 208 +++
policy/modules/services/abrt.te | 165 ++-
policy/modules/services/afs.te | 5
policy/modules/services/aiccu.fc | 6
policy/modules/services/aiccu.if | 118 ++
policy/modules/services/aiccu.te | 71 +
policy/modules/services/aisexec.fc | 10
policy/modules/services/aisexec.if | 106 +
policy/modules/services/aisexec.te | 118 ++
policy/modules/services/apache.fc | 18
policy/modules/services/apache.if | 221 +++-
policy/modules/services/apache.te | 234 +++-
policy/modules/services/apcupsd.te | 4
policy/modules/services/arpwatch.te | 4
policy/modules/services/asterisk.if | 19
policy/modules/services/asterisk.te | 45
policy/modules/services/automount.te | 1
policy/modules/services/avahi.if | 1
policy/modules/services/bitlbee.te | 7
policy/modules/services/bluetooth.if | 21
policy/modules/services/boinc.fc | 6
policy/modules/services/boinc.if | 151 ++
policy/modules/services/boinc.te | 97 +
policy/modules/services/bugzilla.fc | 4
policy/modules/services/bugzilla.if | 39
policy/modules/services/bugzilla.te | 57 +
policy/modules/services/cachefilesd.fc | 29
policy/modules/services/cachefilesd.if | 41
policy/modules/services/cachefilesd.te | 147 ++
policy/modules/services/ccs.te | 10
policy/modules/services/certmonger.fc | 6
policy/modules/services/certmonger.if | 217 +++
policy/modules/services/certmonger.te | 75 +
policy/modules/services/cgroup.fc | 12
policy/modules/services/cgroup.if | 243 ++++
policy/modules/services/cgroup.te | 102 +
policy/modules/services/chronyd.if | 77 +
policy/modules/services/chronyd.te | 10
policy/modules/services/clamav.te | 21
policy/modules/services/clogd.fc | 4
policy/modules/services/clogd.if | 82 +
policy/modules/services/clogd.te | 65 +
policy/modules/services/cmirrord.fc | 6
policy/modules/services/cmirrord.if | 118 ++
policy/modules/services/cmirrord.te | 63 +
policy/modules/services/cobbler.if | 4
policy/modules/services/cobbler.te | 14
policy/modules/services/consolekit.fc | 4
policy/modules/services/consolekit.if | 39
policy/modules/services/consolekit.te | 38
policy/modules/services/corosync.fc | 15
policy/modules/services/corosync.if | 108 +
policy/modules/services/corosync.te | 126 ++
policy/modules/services/cron.fc | 6
policy/modules/services/cron.if | 101 +
policy/modules/services/cron.te | 100 +
policy/modules/services/cups.fc | 15
policy/modules/services/cups.te | 68 +
policy/modules/services/cvs.te | 2
policy/modules/services/cyrus.te | 2
policy/modules/services/dbus.if | 107 +
policy/modules/services/dbus.te | 21
policy/modules/services/denyhosts.fc | 7
policy/modules/services/denyhosts.if | 87 +
policy/modules/services/denyhosts.te | 76 +
policy/modules/services/devicekit.fc | 8
policy/modules/services/devicekit.if | 22
policy/modules/services/devicekit.te | 101 +
policy/modules/services/dhcp.te | 4
policy/modules/services/djbdns.if | 38
policy/modules/services/djbdns.te | 8
policy/modules/services/dnsmasq.fc | 2
policy/modules/services/dnsmasq.if | 4
policy/modules/services/dnsmasq.te | 22
policy/modules/services/dovecot.fc | 6
policy/modules/services/dovecot.te | 48
policy/modules/services/exim.fc | 3
policy/modules/services/exim.if | 61 +
policy/modules/services/exim.te | 3
policy/modules/services/fail2ban.if | 20
policy/modules/services/fprintd.te | 2
policy/modules/services/ftp.fc | 2
policy/modules/services/ftp.if | 38
policy/modules/services/ftp.te | 179 +++
policy/modules/services/git.fc | 9
policy/modules/services/git.if | 526 +++++++++
policy/modules/services/git.te | 190 +++
policy/modules/services/gnomeclock.if | 21
policy/modules/services/gpsd.te | 5
policy/modules/services/hal.if | 22
policy/modules/services/hal.te | 38
policy/modules/services/icecast.te | 6
policy/modules/services/inn.te | 1
policy/modules/services/kerberos.if | 6
policy/modules/services/kerberos.te | 8
policy/modules/services/ksmtuned.fc | 2
policy/modules/services/ksmtuned.te | 11
policy/modules/services/ldap.fc | 5
policy/modules/services/ldap.if | 81 +
policy/modules/services/ldap.te | 13
policy/modules/services/lircd.te | 23
policy/modules/services/milter.if | 20
policy/modules/services/milter.te | 8
policy/modules/services/modemmanager.te | 9
policy/modules/services/mpd.fc | 10
policy/modules/services/mpd.if | 274 +++++
policy/modules/services/mpd.te | 111 ++
policy/modules/services/mta.fc | 2
policy/modules/services/mta.if | 68 +
policy/modules/services/mta.te | 25
policy/modules/services/munin.fc | 58 +
policy/modules/services/munin.if | 66 +
policy/modules/services/munin.te | 175 +++
policy/modules/services/mysql.te | 3
policy/modules/services/nagios.fc | 83 +
policy/modules/services/nagios.if | 160 ++
policy/modules/services/nagios.te | 294 ++++-
policy/modules/services/networkmanager.fc | 20
policy/modules/services/networkmanager.if | 126 ++
policy/modules/services/networkmanager.te | 127 +-
policy/modules/services/nis.fc | 10
policy/modules/services/nis.if | 81 +
policy/modules/services/nis.te | 23
policy/modules/services/nscd.if | 20
policy/modules/services/nscd.te | 29
policy/modules/services/nslcd.te | 2
policy/modules/services/ntop.te | 32
policy/modules/services/ntp.te | 3
policy/modules/services/nut.te | 4
policy/modules/services/nx.fc | 12
policy/modules/services/nx.if | 67 +
policy/modules/services/nx.te | 13
policy/modules/services/oddjob.fc | 1
policy/modules/services/oddjob.if | 1
policy/modules/services/oddjob.te | 5
policy/modules/services/oident.te | 1
policy/modules/services/openvpn.te | 7
policy/modules/services/pegasus.te | 28
policy/modules/services/piranha.fc | 21
policy/modules/services/piranha.if | 175 +++
policy/modules/services/piranha.te | 187 +++
policy/modules/services/plymouthd.fc | 9
policy/modules/services/plymouthd.if | 322 +++++
policy/modules/services/plymouthd.te | 109 +
policy/modules/services/policykit.fc | 5
policy/modules/services/policykit.if | 71 +
policy/modules/services/policykit.te | 86 +
policy/modules/services/portreserve.fc | 3
policy/modules/services/portreserve.if | 55 +
policy/modules/services/portreserve.te | 3
policy/modules/services/postfix.fc | 3
policy/modules/services/postfix.if | 282 ++++-
policy/modules/services/postfix.te | 152 ++
policy/modules/services/ppp.te | 4
policy/modules/services/procmail.fc | 2
policy/modules/services/procmail.te | 26
policy/modules/services/psad.te | 1
policy/modules/services/puppet.te | 2
policy/modules/services/pyzor.fc | 4
policy/modules/services/pyzor.if | 47
policy/modules/services/pyzor.te | 37
policy/modules/services/qpidd.fc | 9
policy/modules/services/qpidd.if | 236 ++++
policy/modules/services/qpidd.te | 61 +
policy/modules/services/radius.te | 2
policy/modules/services/razor.fc | 1
policy/modules/services/razor.if | 42
policy/modules/services/razor.te | 32
policy/modules/services/rgmanager.fc | 10
policy/modules/services/rgmanager.if | 141 ++
policy/modules/services/rgmanager.te | 223 ++++
policy/modules/services/rhcs.fc | 23
policy/modules/services/rhcs.if | 424 +++++++
policy/modules/services/rhcs.te | 242 ++++
policy/modules/services/ricci.fc | 3
policy/modules/services/ricci.if | 62 +
policy/modules/services/ricci.te | 42
policy/modules/services/rlogin.fc | 3
policy/modules/services/rlogin.te | 1
policy/modules/services/rpc.if | 21
policy/modules/services/rpc.te | 15
policy/modules/services/rpcbind.te | 4
policy/modules/services/rsync.if | 4
policy/modules/services/rsync.te | 26
policy/modules/services/rtkit.if | 21
policy/modules/services/samba.fc | 4
policy/modules/services/samba.if | 138 ++
policy/modules/services/samba.te | 123 +-
policy/modules/services/sasl.te | 3
policy/modules/services/sendmail.fc | 2
policy/modules/services/sendmail.if | 84 +
policy/modules/services/sendmail.te | 20
policy/modules/services/setroubleshoot.fc | 2
policy/modules/services/setroubleshoot.if | 124 ++
policy/modules/services/setroubleshoot.te | 91 +
policy/modules/services/smartmon.te | 2
policy/modules/services/smokeping.te | 2
policy/modules/services/snmp.te | 3
policy/modules/services/snort.te | 4
policy/modules/services/spamassassin.fc | 15
policy/modules/services/spamassassin.if | 107 +
policy/modules/services/spamassassin.te | 141 ++
policy/modules/services/squid.te | 21
policy/modules/services/ssh.fc | 6
policy/modules/services/ssh.if | 158 ++
policy/modules/services/ssh.te | 56 -
policy/modules/services/sssd.te | 3
policy/modules/services/sysstat.te | 4
policy/modules/services/tgtd.te | 6
policy/modules/services/tor.te | 3
policy/modules/services/tuned.te | 5
policy/modules/services/ucspitcp.te | 5
policy/modules/services/usbmuxd.fc | 2
policy/modules/services/varnishd.if | 19
policy/modules/services/vhostmd.te | 2
policy/modules/services/virt.fc | 6
policy/modules/services/virt.if | 59 -
policy/modules/services/virt.te | 95 +
policy/modules/services/w3c.te | 7
policy/modules/services/xserver.fc | 61 -
policy/modules/services/xserver.if | 456 ++++++++
policy/modules/services/xserver.te | 425 ++++++-
policy/modules/system/application.te | 16
policy/modules/system/authlogin.fc | 1
policy/modules/system/authlogin.if | 56 -
policy/modules/system/daemontools.if | 62 +
policy/modules/system/daemontools.te | 26
policy/modules/system/fstools.fc | 2
policy/modules/system/fstools.te | 12
policy/modules/system/getty.te | 2
policy/modules/system/hostname.te | 7
policy/modules/system/init.fc | 3
policy/modules/system/init.if | 146 ++
policy/modules/system/init.te | 213 +++
policy/modules/system/ipsec.te | 17
policy/modules/system/iptables.fc | 9
policy/modules/system/iptables.if | 4
policy/modules/system/iptables.te | 21
policy/modules/system/iscsi.if | 18
policy/modules/system/iscsi.te | 2
policy/modules/system/libraries.fc | 152 ++
policy/modules/system/libraries.te | 8
policy/modules/system/locallogin.te | 40
policy/modules/system/logging.fc | 16
policy/modules/system/logging.if | 43
policy/modules/system/logging.te | 27
policy/modules/system/lvm.fc | 2
policy/modules/system/lvm.if | 2
policy/modules/system/lvm.te | 21
policy/modules/system/miscfiles.fc | 2
policy/modules/system/miscfiles.if | 3
policy/modules/system/modutils.te | 14
policy/modules/system/mount.fc | 8
policy/modules/system/mount.if | 163 ++
policy/modules/system/mount.te | 153 ++
policy/modules/system/raid.te | 1
policy/modules/system/selinuxutil.fc | 17
policy/modules/system/selinuxutil.if | 330 ++++++
policy/modules/system/selinuxutil.te | 246 +---
policy/modules/system/setrans.te | 1
policy/modules/system/sosreport.fc | 2
policy/modules/system/sosreport.if | 131 ++
policy/modules/system/sosreport.te | 155 ++
policy/modules/system/sysnetwork.fc | 2
policy/modules/system/sysnetwork.if | 133 ++
policy/modules/system/sysnetwork.te | 29
policy/modules/system/udev.fc | 1
policy/modules/system/udev.if | 19
policy/modules/system/udev.te | 13
policy/modules/system/unconfined.fc | 14
policy/modules/system/unconfined.if | 440 --------
policy/modules/system/unconfined.te | 224 ----
policy/modules/system/userdomain.fc | 11
policy/modules/system/userdomain.if | 1641 ++++++++++++++++++++++++------
policy/modules/system/userdomain.te | 54
policy/modules/system/xen.if | 3
policy/modules/system/xen.te | 14
policy/support/misc_patterns.spt | 8
policy/support/obj_perm_sets.spt | 38
policy/users | 17
423 files changed, 24279 insertions(+), 2160 deletions(-)
Index: policy-F13.patch
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/F-13/policy-F13.patch,v
retrieving revision 1.126
retrieving revision 1.127
diff -u -p -r1.126 -r1.127
--- policy-F13.patch 9 Jun 2010 21:48:14 -0000 1.126
+++ policy-F13.patch 14 Jun 2010 18:34:41 -0000 1.127
@@ -616,7 +616,7 @@ diff --exclude-from=exclude -N -u -r nsa
+/usr/sbin/send_arp -- gen_context(system_u:object_r:ping_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.7.19/policy/modules/admin/netutils.te
--- nsaserefpolicy/policy/modules/admin/netutils.te 2010-04-13 20:44:37.000000000 +0200
-+++ serefpolicy-3.7.19/policy/modules/admin/netutils.te 2010-05-28 09:41:59.954610969 +0200
++++ serefpolicy-3.7.19/policy/modules/admin/netutils.te 2010-06-14 11:19:18.240056520 +0200
@@ -44,6 +44,7 @@
allow netutils_t self:packet_socket create_socket_perms;
allow netutils_t self:udp_socket create_socket_perms;
@@ -625,7 +625,24 @@ diff --exclude-from=exclude -N -u -r nsa
manage_dirs_pattern(netutils_t, netutils_tmp_t, netutils_tmp_t)
manage_files_pattern(netutils_t, netutils_tmp_t, netutils_tmp_t)
-@@ -85,6 +86,7 @@
+@@ -51,6 +52,8 @@
+
+ kernel_search_proc(netutils_t)
+ kernel_read_all_sysctls(netutils_t)
++kernel_read_network_state(netutils_t)
++kernel_request_load_module(netutils_t)
+
+ corenet_all_recvfrom_unlabeled(netutils_t)
+ corenet_all_recvfrom_netlabel(netutils_t)
+@@ -66,6 +69,7 @@
+ corenet_sendrecv_all_client_packets(netutils_t)
+ corenet_udp_bind_generic_node(netutils_t)
+
++dev_read_usbmon_dev(netutils_t)
+ dev_read_sysfs(netutils_t)
+
+ fs_getattr_xattr_fs(netutils_t)
+@@ -85,6 +89,7 @@
miscfiles_read_localization(netutils_t)
@@ -633,7 +650,7 @@ diff --exclude-from=exclude -N -u -r nsa
userdom_use_user_terminals(netutils_t)
userdom_use_all_users_fds(netutils_t)
-@@ -142,15 +144,27 @@
+@@ -142,15 +147,27 @@
init_dontaudit_use_fds(ping_t)
optional_policy(`
@@ -661,7 +678,7 @@ diff --exclude-from=exclude -N -u -r nsa
pcmcia_use_cardmgr_fds(ping_t)
')
-@@ -211,3 +225,10 @@
+@@ -211,3 +228,10 @@
dev_read_rand(traceroute_t)
dev_read_urand(traceroute_t)
files_read_usr_files(traceroute_t)
@@ -5693,16 +5710,6 @@ diff --exclude-from=exclude -N -u -r nsa
optional_policy(`
dbus_system_bus_client(podsleuth_t)
-diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.fc serefpolicy-3.7.19/policy/modules/apps/pulseaudio.fc
---- nsaserefpolicy/policy/modules/apps/pulseaudio.fc 2010-04-13 20:44:37.000000000 +0200
-+++ serefpolicy-3.7.19/policy/modules/apps/pulseaudio.fc 2010-05-28 09:41:59.997610803 +0200
-@@ -3,5 +3,6 @@
-
- /usr/bin/pulseaudio -- gen_context(system_u:object_r:pulseaudio_exec_t,s0)
-
-+/var/lib/mpd(/.*)? gen_context(system_u:object_r:pulseaudio_var_lib_t,s0)
- /var/lib/pulse(/.*)? gen_context(system_u:object_r:pulseaudio_var_lib_t,s0)
- /var/run/pulse(/.*)? gen_context(system_u:object_r:pulseaudio_var_run_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.if serefpolicy-3.7.19/policy/modules/apps/pulseaudio.if
--- nsaserefpolicy/policy/modules/apps/pulseaudio.if 2010-04-13 20:44:37.000000000 +0200
+++ serefpolicy-3.7.19/policy/modules/apps/pulseaudio.if 2010-05-28 09:41:59.998610877 +0200
@@ -5784,7 +5791,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.7.19/policy/modules/apps/pulseaudio.te
--- nsaserefpolicy/policy/modules/apps/pulseaudio.te 2010-04-13 20:44:37.000000000 +0200
-+++ serefpolicy-3.7.19/policy/modules/apps/pulseaudio.te 2010-06-08 14:18:19.967627028 +0200
++++ serefpolicy-3.7.19/policy/modules/apps/pulseaudio.te 2010-06-14 18:32:15.573218388 +0200
@@ -41,9 +41,11 @@
manage_dirs_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t)
manage_files_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t)
@@ -5797,7 +5804,18 @@ diff --exclude-from=exclude -N -u -r nsa
files_var_lib_filetrans(pulseaudio_t, pulseaudio_var_lib_t, { dir file })
manage_dirs_pattern(pulseaudio_t, pulseaudio_var_run_t, pulseaudio_var_run_t)
-@@ -128,6 +130,7 @@
+@@ -118,6 +120,10 @@
+ ')
+
+ optional_policy(`
++ mpd_read_tmpfs_files(pulseaudio_t)
++')
++
++optional_policy(`
+ rtkit_scheduled(pulseaudio_t)
+ ')
+
+@@ -128,6 +134,7 @@
')
optional_policy(`
@@ -5805,7 +5823,7 @@ diff --exclude-from=exclude -N -u -r nsa
udev_read_db(pulseaudio_t)
')
-@@ -138,3 +141,7 @@
+@@ -138,3 +145,7 @@
xserver_read_xdm_pid(pulseaudio_t)
xserver_user_x_domain_template(pulseaudio, pulseaudio_t, pulseaudio_tmpfs_t)
')
@@ -7530,7 +7548,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.7.19/policy/modules/kernel/corenetwork.te.in
--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2010-04-13 20:44:37.000000000 +0200
-+++ serefpolicy-3.7.19/policy/modules/kernel/corenetwork.te.in 2010-05-28 09:42:00.019610687 +0200
++++ serefpolicy-3.7.19/policy/modules/kernel/corenetwork.te.in 2010-06-14 18:31:28.287218510 +0200
@@ -25,6 +25,7 @@
#
type tun_tap_device_t;
@@ -7590,7 +7608,7 @@ diff --exclude-from=exclude -N -u -r nsa
network_port(http_cache, tcp,3128,s0, udp,3130,s0, tcp,8080,s0, tcp,8118,s0, tcp,10001-10010,s0) # 8118 is for privoxy
network_port(i18n_input, tcp,9010,s0)
network_port(imaze, tcp,5323,s0, udp,5323,s0)
-@@ -125,13 +133,15 @@
+@@ -125,39 +133,52 @@
network_port(jabber_client, tcp,5222,s0, tcp,5223,s0)
network_port(jabber_interserver, tcp,5269,s0)
network_port(kerberos, tcp,88,s0, udp,88,s0, tcp,750,s0, udp,750,s0)
@@ -7607,7 +7625,9 @@ diff --exclude-from=exclude -N -u -r nsa
type lrrd_port_t, port_type; dnl network_port(lrrd_port_t) # no defined portcon
network_port(mail, tcp,2000,s0, tcp,3905,s0)
network_port(memcache, tcp,11211,s0, udp,11211,s0)
-@@ -140,24 +150,34 @@
+ network_port(mmcc, tcp,5050,s0, udp,5050,s0)
+ network_port(monopd, tcp,1234,s0)
++network_port(mpd, tcp,6600,s0)
network_port(msnp, tcp,1863,s0, udp,1863,s0)
network_port(mssql, tcp,1433,s0, tcp,1434,s0, udp,1433,s0, udp,1434,s0)
network_port(munin, tcp,4949,s0, udp,4949,s0)
@@ -7643,12 +7663,13 @@ diff --exclude-from=exclude -N -u -r nsa
network_port(printer, tcp,515,s0)
network_port(ptal, tcp,5703,s0)
network_port(pulseaudio, tcp,4713,s0)
-@@ -177,18 +197,21 @@
+@@ -177,18 +198,22 @@
network_port(rsync, tcp,873,s0, udp,873,s0)
network_port(rwho, udp,513,s0)
network_port(sap, tcp,9875,s0, udp,9875,s0)
+network_port(sieve, tcp,4190,s0)
network_port(sip, tcp,5060,s0, udp,5060,s0, tcp,5061,s0, udp,5061,s0)
++network_port(sixxsconfig, tcp,3874,s0, udp,3874,s0)
network_port(smbd, tcp,137-139,s0, tcp,445,s0)
network_port(smtp, tcp,25,s0, tcp,465,s0, tcp,587,s0)
-network_port(snmp, udp,161,s0, udp,162,s0, tcp,199,s0, tcp, 1161, s0)
@@ -7666,7 +7687,7 @@ diff --exclude-from=exclude -N -u -r nsa
network_port(syslogd, udp,514,s0)
network_port(telnetd, tcp,23,s0)
network_port(tftp, udp,69,s0)
-@@ -201,13 +224,13 @@
+@@ -201,13 +226,13 @@
network_port(varnishd, tcp,6081,s0, tcp,6082,s0)
network_port(virt, tcp,16509,s0, udp,16509,s0, tcp,16514,s0, udp,16514,s0)
network_port(virt_migration, tcp,49152-49216,s0)
@@ -12762,19 +12783,19 @@ diff --exclude-from=exclude -N -u -r nsa
corenet_tcp_sendrecv_generic_if(afs_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aiccu.fc serefpolicy-3.7.19/policy/modules/services/aiccu.fc
--- nsaserefpolicy/policy/modules/services/aiccu.fc 1970-01-01 01:00:00.000000000 +0100
-+++ serefpolicy-3.7.19/policy/modules/services/aiccu.fc 2010-05-28 09:42:00.054610627 +0200
-@@ -0,0 +1,5 @@
++++ serefpolicy-3.7.19/policy/modules/services/aiccu.fc 2010-06-14 11:26:52.511056371 +0200
+@@ -0,0 +1,6 @@
++/etc/aiccu\.conf -- gen_context(system_u:object_r:aiccu_etc_t,s0)
++/etc/rc\.d/init\.d/aiccu -- gen_context(system_u:object_r:aiccu_initrc_exec_t,s0)
+
-+/usr/sbin/aiccu -- gen_context(system_u:object_r:aiccu_exec_t,s0)
++/usr/sbin/aiccu -- gen_context(system_u:object_r:aiccu_exec_t,s0)
+
-+/etc/rc\.d/init\.d/aiccu -- gen_context(system_u:object_r:aiccu_initrc_exec_t,s0)
-+/var/run/aiccu.pid -- gen_context(system_u:object_r:aiccu_var_run_t,s0)
++/var/run/aiccu\.pid -- gen_context(system_u:object_r:aiccu_var_run_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aiccu.if serefpolicy-3.7.19/policy/modules/services/aiccu.if
--- nsaserefpolicy/policy/modules/services/aiccu.if 1970-01-01 01:00:00.000000000 +0100
-+++ serefpolicy-3.7.19/policy/modules/services/aiccu.if 2010-05-28 09:42:00.054610627 +0200
-@@ -0,0 +1,119 @@
-+
-+## <summary>policy for aiccu</summary>
++++ serefpolicy-3.7.19/policy/modules/services/aiccu.if 2010-06-14 11:26:09.814056575 +0200
+@@ -0,0 +1,118 @@
++## <summary>Automatic IPv6 Connectivity Client Utility.</summary>
+
+########################################
+## <summary>
@@ -12792,6 +12813,7 @@ diff --exclude-from=exclude -N -u -r nsa
+ ')
+
+ domtrans_pattern($1, aiccu_exec_t, aiccu_t)
++ corecmd_search_bin($1)
+')
+
+
@@ -12801,7 +12823,7 @@ diff --exclude-from=exclude -N -u -r nsa
+## </summary>
+## <param name="domain">
+## <summary>
-+## The type of the process performing this action.
++## Domain allowed to transition.
+## </summary>
+## </param>
+#
@@ -12828,13 +12850,13 @@ diff --exclude-from=exclude -N -u -r nsa
+ type aiccu_var_run_t;
+ ')
+
-+ files_search_pids($1)
+ allow $1 aiccu_var_run_t:file read_file_perms;
++ files_search_pids($1)
+')
+
+########################################
+## <summary>
-+## Manage aiccu var_run files.
++## Manage aiccu PID files.
+## </summary>
+## <param name="domain">
+## <summary>
@@ -12847,9 +12869,10 @@ diff --exclude-from=exclude -N -u -r nsa
+ type aiccu_var_run_t;
+ ')
+
-+ manage_dirs_pattern($1, aiccu_var_run_t, aiccu_var_run_t)
-+ manage_files_pattern($1, aiccu_var_run_t, aiccu_var_run_t)
-+ manage_lnk_files_pattern($1, aiccu_var_run_t, aiccu_var_run_t)
++ manage_dirs_pattern($1, aiccu_var_run_t, aiccu_var_run_t)
++ manage_files_pattern($1, aiccu_var_run_t, aiccu_var_run_t)
++ manage_lnk_files_pattern($1, aiccu_var_run_t, aiccu_var_run_t)
++ files_search_pids($1)
+')
+
+
@@ -12872,31 +12895,30 @@ diff --exclude-from=exclude -N -u -r nsa
+#
+interface(`aiccu_admin',`
+ gen_require(`
-+ type aiccu_t;
++ type aiccu_t, aiccu_initrc_exec_t, aiccu_etc_t;
++ type aiccu_var_run_t;
+ ')
+
-+ allow $1 aiccu_t:process { ptrace signal_perms getattr };
-+ read_files_pattern($1, aiccu_t, aiccu_t)
-+
-+
-+ gen_require(`
-+ type aiccu_initrc_exec_t;
-+ ')
++ allow $1 aiccu_t:process { ptrace signal_perms };
++ ps_process_pattern($1, aiccu_t)
+
-+ # Allow aiccu_t to restart the apache service
+ aiccu_initrc_domtrans($1)
+ domain_system_change_exemption($1)
+ role_transition $2 aiccu_initrc_exec_t system_r;
+ allow $2 system_r;
+
-+ aiccu_manage_var_run($1)
++ admin_pattern($1, aiccu_etc_t)
++ files_search_etc($1)
+
++ admin_pattern($1, aiccu_var_run_t)
++ files_search_pids($1)
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aiccu.te serefpolicy-3.7.19/policy/modules/services/aiccu.te
--- nsaserefpolicy/policy/modules/services/aiccu.te 1970-01-01 01:00:00.000000000 +0100
-+++ serefpolicy-3.7.19/policy/modules/services/aiccu.te 2010-05-28 09:42:00.055610771 +0200
-@@ -0,0 +1,44 @@
-+policy_module(aiccu,1.0.0)
++++ serefpolicy-3.7.19/policy/modules/services/aiccu.te 2010-06-14 11:26:09.815056510 +0200
+@@ -0,0 +1,71 @@
++
++policy_module(aiccu, 1.0.0)
+
+########################################
+#
@@ -12907,11 +12929,12 @@ diff --exclude-from=exclude -N -u -r nsa
+type aiccu_exec_t;
+init_daemon_domain(aiccu_t, aiccu_exec_t)
+
-+permissive aiccu_t;
-+
+type aiccu_initrc_exec_t;
+init_script_file(aiccu_initrc_exec_t)
+
++type aiccu_etc_t;
++files_config_file(aiccu_etc_t)
++
+type aiccu_var_run_t;
+files_pid_file(aiccu_var_run_t)
+
@@ -12920,25 +12943,50 @@ diff --exclude-from=exclude -N -u -r nsa
+# aiccu local policy
+#
+
-+allow aiccu_t self:capability { kill };
-+allow aiccu_t self:process { fork signal };
++allow aiccu_t self:capability { kill net_admin };
++allow aiccu_t self:process signal;
++allow aiccu_t self:fifo_file rw_file_perms;
++allow aiccu_t self:netlink_route_socket create_netlink_socket_perms;
++allow aiccu_t self:tcp_socket create_stream_socket_perms;
++allow aiccu_t self:tun_socket create_socket_perms;
++allow aiccu_t self:udp_socket create_stream_socket_perms;
++allow aiccu_t self:unix_stream_socket create_stream_socket_perms;
++
++allow aiccu_t aiccu_etc_t:file read_file_perms;
++
++manage_dirs_pattern(aiccu_t, aiccu_var_run_t, aiccu_var_run_t)
++manage_files_pattern(aiccu_t, aiccu_var_run_t, aiccu_var_run_t)
++files_pid_filetrans(aiccu_t, aiccu_var_run_t, { file dir })
++
++kernel_read_system_state(aiccu_t)
++
++corecmd_exec_shell(aiccu_t)
++
++corenet_all_recvfrom_netlabel(aiccu_t)
++corenet_all_recvfrom_unlabeled(aiccu_t)
++corenet_tcp_bind_generic_node(aiccu_t)
++corenet_tcp_sendrecv_generic_if(aiccu_t)
++corenet_tcp_sendrecv_generic_node(aiccu_t)
++corenet_tcp_sendrecv_generic_port(aiccu_t)
++corenet_sendrecv_sixxsconfig_client_packets(aiccu_t)
++corenet_tcp_sendrecv_sixxsconfig_port(aiccu_t)
++corenet_tcp_connect_sixxsconfig_port(aiccu_t)
++corenet_rw_tun_tap_dev(aiccu_t)
+
-+# Init script handling
+domain_use_interactive_fds(aiccu_t)
+
-+# internal communication is often done using fifo and unix sockets.
-+allow aiccu_t self:fifo_file rw_file_perms;
-+allow aiccu_t self:unix_stream_socket create_stream_socket_perms;
++dev_read_rand(aiccu_t)
++dev_read_urand(aiccu_t)
+
+files_read_etc_files(aiccu_t)
+
-+corenet_rw_tun_tap_dev(aiccu_t)
++logging_send_syslog_msg(aiccu_t)
+
+miscfiles_read_localization(aiccu_t)
+
-+manage_dirs_pattern(aiccu_t, aiccu_var_run_t, aiccu_var_run_t)
-+manage_files_pattern(aiccu_t, aiccu_var_run_t, aiccu_var_run_t)
-+files_pid_filetrans(aiccu_t, aiccu_var_run_t, { file dir })
++modutils_domtrans_insmod(aiccu_t)
++
++sysnet_domtrans_ifconfig(aiccu_t)
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aisexec.fc serefpolicy-3.7.19/policy/modules/services/aisexec.fc
--- nsaserefpolicy/policy/modules/services/aisexec.fc 1970-01-01 01:00:00.000000000 +0100
@@ -20606,6 +20654,413 @@ diff --exclude-from=exclude -N -u -r nsa
+optional_policy(`
udev_read_db(modemmanager_t)
')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.fc serefpolicy-3.7.19/policy/modules/services/mpd.fc
+--- nsaserefpolicy/policy/modules/services/mpd.fc 1970-01-01 01:00:00.000000000 +0100
++++ serefpolicy-3.7.19/policy/modules/services/mpd.fc 2010-06-14 18:34:39.866517713 +0200
+@@ -0,0 +1,10 @@
++
++
++/etc/mpd\.conf -- gen_context(system_u:object_r:mpd_etc_t,s0)
++/etc/rc\.d/init\.d/mpd -- gen_context(system_u:object_r:mpd_initrc_exec_t,s0)
++
++/usr/bin/mpd -- gen_context(system_u:object_r:mpd_exec_t,s0)
++
++/var/lib/mpd(/.*)? gen_context(system_u:object_r:mpd_var_lib_t,s0)
++/var/lib/mpd/music(/.*)? gen_context(system_u:object_r:mpd_data_t,s0)
++/var/lib/mpd/playlists(/.*)? gen_context(system_u:object_r:mpd_data_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.if serefpolicy-3.7.19/policy/modules/services/mpd.if
+--- nsaserefpolicy/policy/modules/services/mpd.if 1970-01-01 01:00:00.000000000 +0100
++++ serefpolicy-3.7.19/policy/modules/services/mpd.if 2010-06-14 18:37:18.471468823 +0200
+@@ -0,0 +1,274 @@
++
++## <summary>policy for daemon for playing music</summary>
++
++########################################
++## <summary>
++## Execute a domain transition to run mpd.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`mpd_domtrans',`
++ gen_require(`
++ type mpd_t, mpd_exec_t;
++ ')
++
++ domtrans_pattern($1, mpd_exec_t, mpd_t)
++')
++
++
++########################################
++## <summary>
++## Execute mpd server in the mpd domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`mpd_initrc_domtrans',`
++ gen_require(`
++ type mpd_initrc_exec_t;
++ ')
++
++ init_labeled_script_domtrans($1, mpd_initrc_exec_t)
++')
++
++#######################################
++## <summary>
++## Read mpd data files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`mpd_read_data_files',`
++ gen_require(`
++ type mpd_data_t;
++ ')
++
++ files_search_var_lib($1)
++ mpd_search_lib($1)
++ read_files_pattern($1, mpd_data_t, mpd_data_t)
++')
++
++#######################################
++## <summary>
++## Read mpd tmpfs files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`mpd_read_tmpfs_files',`
++ gen_require(`
++ type mpd_tmpfs_t;
++ ')
++
++ files_search_var_lib($1)
++ mpd_search_lib($1)
++ read_files_pattern($1, mpd_tmpfs_t, mpd_tmpfs_t)
++')
++
++###################################
++## <summary>
++## Manage mpd tmpfs files.
++## </summary>
++## <param name="domain">
++## <summary>
++## The type of the process performing this action.
++## </summary>
++## </param>
++#
++interface(`mpd_manage_tmpfs_files',`
++ gen_require(`
++ type mpd_tmpfs_t;
++ ')
++
++ files_search_var_lib($1)
++ mpd_search_lib($1)
++ manage_files_pattern($1, mpd_tmpfs_t, mpd_tmpfs_t)
++ manage_lnk_files_pattern($1, mpd_tmpfs_t, mpd_tmpfs_t)
++')
++
++######################################
++## <summary>
++## Manage mpd data files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`mpd_manage_data_files',`
++ gen_require(`
++ type mpd_data_t;
++ ')
++
++ files_search_var_lib($1)
++ mpd_search_lib($1)
++ manage_files_pattern($1, mpd_data_t, mpd_data_t)
++')
++
++########################################
++## <summary>
++## Search mpd lib directories.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`mpd_search_lib',`
++ gen_require(`
++ type mpd_var_lib_t;
++ ')
++
++ allow $1 mpd_var_lib_t:dir search_dir_perms;
++ files_search_var_lib($1)
++')
++
++########################################
++## <summary>
++## Read mpd lib files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`mpd_read_lib_files',`
++ gen_require(`
++ type mpd_var_lib_t;
++ ')
++
++ files_search_var_lib($1)
++ read_files_pattern($1, mpd_var_lib_t, mpd_var_lib_t)
++')
++
++########################################
++## <summary>
++## Create, read, write, and delete
++## mpd lib files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`mpd_manage_lib_files',`
++ gen_require(`
++ type mpd_var_lib_t;
++ ')
++
++ files_search_var_lib($1)
++ manage_files_pattern($1, mpd_var_lib_t, mpd_var_lib_t)
++')
++
++#######################################
++## <summary>
++## Create an object in the root directory, with a private
++## type using a type transition.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <param name="private type">
++## <summary>
++## The type of the object to be created.
++## </summary>
++## </param>
++## <param name="object">
++## <summary>
++## The object class of the object being created.
++## </summary>
++## </param>
++#
++interface(`mpd_var_lib_filetrans',`
++ gen_require(`
++ type mpd_var_lib_t;
++ ')
++
++ filetrans_pattern($1, mpd_var_lib_t, $2, $3)
++')
++
++########################################
++## <summary>
++## Manage mpd lib dirs files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`mpd_manage_lib_dirs',`
++ gen_require(`
++ type mpd_var_lib_t;
++ ')
++
++ files_search_var_lib($1)
++ manage_dirs_pattern($1, mpd_var_lib_t, mpd_var_lib_t)
++')
++
++########################################
++## <summary>
++## All of the rules required to administrate
++## an mpd environment
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <param name="role">
++## <summary>
++## Role allowed access.
++## </summary>
++## </param>
++## <rolecap/>
++#
++interface(`mpd_admin',`
++ gen_require(`
++ type mpd_t;
++ type mpd_initrc_exec_t;
++ type mpd_data_t;
++ type mpd_etc_t;
++ type mpd_log_t;
++ type mpd_var_lib_t;
++ ')
++
++ allow $1 mpd_t:process { ptrace signal_perms };
++ ps_process_pattern($1, mpd_t)
++
++ mpd_initrc_domtrans($1)
++ domain_system_change_exemption($1)
++ role_transition $2 mpd_initrc_exec_t system_r;
++ allow $2 system_r;
++
++ admin_pattern($1, mpd_etc_t)
++ files_search_etc($1)
++
++ files_search_var_lib($1)
++ admin_pattern($1, mpd_var_lib_t)
++
++ mpd_search_lib($1)
++ admin_pattern($1, mpd_data_t)
++
++ admin_pattern($1, mpd_log_t)
++
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mpd.te serefpolicy-3.7.19/policy/modules/services/mpd.te
+--- nsaserefpolicy/policy/modules/services/mpd.te 1970-01-01 01:00:00.000000000 +0100
++++ serefpolicy-3.7.19/policy/modules/services/mpd.te 2010-06-14 18:36:19.117468437 +0200
+@@ -0,0 +1,111 @@
++
++policy_module(mpd,1.0.0)
++
++########################################
++#
++# Declarations
++#
++
++type mpd_t;
++type mpd_exec_t;
++init_daemon_domain(mpd_t, mpd_exec_t)
++
++permissive mpd_t;
++
++type mpd_initrc_exec_t;
++init_script_file(mpd_initrc_exec_t)
++
++type mpd_etc_t;
++files_config_file(mpd_etc_t)
++
++# type for music content
++type mpd_data_t;
++files_type(mpd_data_t)
++
++type mpd_log_t;
++logging_log_file(mpd_log_t)
++
++type mpd_tmp_t;
++files_tmp_file(mpd_tmp_t)
++
++type mpd_tmpfs_t;
++files_tmpfs_file(mpd_tmpfs_t)
++
++type mpd_var_lib_t;
++files_type(mpd_var_lib_t)
++
++########################################
++#
++# mpd local policy
++#
++
++#cjp: dac_override bug in mpd relating to mpd.log file
++allow mpd_t self:capability { dac_override kill setgid setuid };
++allow mpd_t self:process { getsched setsched setrlimit signal signull };
++
++allow mpd_t self:fifo_file rw_fifo_file_perms;
++allow mpd_t self:unix_stream_socket { connectto create_stream_socket_perms };
++allow mpd_t self:tcp_socket create_stream_socket_perms;
++allow mpd_t self:netlink_kobject_uevent_socket create_socket_perms;
++allow mpd_t self:unix_dgram_socket { create_socket_perms sendto };
++
++read_files_pattern(mpd_t, mpd_etc_t, mpd_etc_t)
++
++manage_dirs_pattern(mpd_t, mpd_data_t, mpd_data_t)
++manage_files_pattern(mpd_t, mpd_data_t, mpd_data_t)
++
++manage_dirs_pattern(mpd_t, mpd_tmp_t, mpd_tmp_t)
++manage_files_pattern(mpd_t, mpd_tmp_t, mpd_tmp_t)
++manage_sock_files_pattern(mpd_t, mpd_tmp_t, mpd_tmp_t)
++files_tmp_filetrans(mpd_t, mpd_tmp_t, { dir file sock_file })
++
++manage_files_pattern(mpd_t, mpd_tmpfs_t, mpd_tmpfs_t)
++manage_dirs_pattern(mpd_t, mpd_tmpfs_t, mpd_tmpfs_t)
++fs_tmpfs_filetrans(mpd_t, mpd_tmpfs_t, file )
++
++manage_dirs_pattern(mpd_t, mpd_var_lib_t, mpd_var_lib_t)
++manage_files_pattern(mpd_t, mpd_var_lib_t, mpd_var_lib_t)
++manage_lnk_files_pattern(mpd_t, mpd_var_lib_t, mpd_var_lib_t)
++files_var_lib_filetrans(mpd_t, mpd_var_lib_t, { dir file lnk_file })
++
++kernel_read_system_state(mpd_t)
++kernel_read_kernel_sysctls(mpd_t)
++
++corecmd_exec_bin(mpd_t)
++
++corenet_sendrecv_pulseaudio_client_packets(mpd_t)
++corenet_tcp_connect_http_port(mpd_t)
++corenet_tcp_connect_pulseaudio_port(mpd_t)
++corenet_tcp_bind_mpd_port(mpd_t)
++corenet_tcp_bind_soundd_port(mpd_t)
++
++dev_read_sysfs(mpd_t)
++
++files_read_etc_files(mpd_t)
++files_read_usr_files(mpd_t)
++
++fs_getattr_tmpfs(mpd_t)
++fs_list_inotifyfs(mpd_t)
++fs_rw_anon_inodefs_files(mpd_t)
++
++auth_use_nsswitch(mpd_t)
++
++logging_send_syslog_msg(mpd_t)
++
++miscfiles_read_localization(mpd_t)
++
++userdom_read_user_tmpfs_files(mpd_t)
++
++optional_policy(`
++ dbus_system_bus_client(mpd_t)
++')
++
++optional_policy(`
++ pulseaudio_exec(mpd_t)
++ pulseaudio_stream_connect(mpd_t)
++ pulseaudio_signull(mpd_t)
++')
++
++optional_policy(`
++ udev_read_db(mpd_t)
++')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.7.19/policy/modules/services/mta.fc
--- nsaserefpolicy/policy/modules/services/mta.fc 2010-04-13 20:44:37.000000000 +0200
+++ serefpolicy-3.7.19/policy/modules/services/mta.fc 2010-05-28 09:42:00.125610532 +0200
@@ -30869,7 +31324,7 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.7.19/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2010-04-13 20:44:37.000000000 +0200
-+++ serefpolicy-3.7.19/policy/modules/services/xserver.te 2010-06-08 14:36:03.433610464 +0200
++++ serefpolicy-3.7.19/policy/modules/services/xserver.te 2010-06-14 11:32:09.363806498 +0200
@@ -1,5 +1,5 @@
-policy_module(xserver, 3.3.2)
@@ -31392,7 +31847,7 @@ diff --exclude-from=exclude -N -u -r nsa
userdom_dontaudit_use_unpriv_user_fds(xdm_t)
userdom_create_all_users_keys(xdm_t)
-@@ -477,6 +640,11 @@
+@@ -477,6 +640,12 @@
# Search /proc for any user domain processes.
userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t)
@@ -31401,10 +31856,11 @@ diff --exclude-from=exclude -N -u -r nsa
+userdom_manage_user_tmp_files(xdm_t)
+userdom_manage_user_tmp_sockets(xdm_t)
+userdom_manage_tmpfs_role(system_r, xdm_t)
++userdom_dontaudit_getattr_user_home_content(xdm_t)
xserver_rw_session(xdm_t, xdm_tmpfs_t)
xserver_unconfined(xdm_t)
-@@ -508,11 +676,17 @@
+@@ -508,11 +677,17 @@
')
optional_policy(`
@@ -31422,7 +31878,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -520,12 +694,50 @@
+@@ -520,12 +695,50 @@
')
optional_policy(`
@@ -31473,7 +31929,7 @@ diff --exclude-from=exclude -N -u -r nsa
hostname_exec(xdm_t)
')
-@@ -543,20 +755,59 @@
+@@ -543,20 +756,59 @@
')
optional_policy(`
@@ -31535,7 +31991,7 @@ diff --exclude-from=exclude -N -u -r nsa
ifndef(`distro_redhat',`
allow xdm_t self:process { execheap execmem };
-@@ -565,7 +816,6 @@
+@@ -565,7 +817,6 @@
ifdef(`distro_rhel4',`
allow xdm_t self:process { execheap execmem };
')
@@ -31543,7 +31999,7 @@ diff --exclude-from=exclude -N -u -r nsa
optional_policy(`
userhelper_dontaudit_search_config(xdm_t)
-@@ -576,6 +826,10 @@
+@@ -576,6 +827,10 @@
')
optional_policy(`
@@ -31554,7 +32010,7 @@ diff --exclude-from=exclude -N -u -r nsa
xfs_stream_connect(xdm_t)
')
-@@ -600,10 +854,9 @@
+@@ -600,10 +855,9 @@
# execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack
@@ -31566,7 +32022,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow xserver_t self:fd use;
allow xserver_t self:fifo_file rw_fifo_file_perms;
allow xserver_t self:sock_file read_sock_file_perms;
-@@ -615,6 +868,18 @@
+@@ -615,6 +869,18 @@
allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow xserver_t self:tcp_socket create_stream_socket_perms;
allow xserver_t self:udp_socket create_socket_perms;
@@ -31585,7 +32041,7 @@ diff --exclude-from=exclude -N -u -r nsa
manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
-@@ -634,12 +899,19 @@
+@@ -634,12 +900,19 @@
manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
files_search_var_lib(xserver_t)
@@ -31607,7 +32063,7 @@ diff --exclude-from=exclude -N -u -r nsa
kernel_read_system_state(xserver_t)
kernel_read_device_sysctls(xserver_t)
-@@ -673,7 +945,6 @@
+@@ -673,7 +946,6 @@
dev_rw_agp(xserver_t)
dev_rw_framebuffer(xserver_t)
dev_manage_dri_dev(xserver_t)
@@ -31615,7 +32071,7 @@ diff --exclude-from=exclude -N -u -r nsa
dev_create_generic_dirs(xserver_t)
dev_setattr_generic_dirs(xserver_t)
# raw memory access is needed if not using the frame buffer
-@@ -683,9 +954,12 @@
+@@ -683,9 +955,12 @@
dev_rw_xserver_misc(xserver_t)
# read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev(xserver_t)
@@ -31629,7 +32085,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_read_etc_files(xserver_t)
files_read_etc_runtime_files(xserver_t)
-@@ -700,8 +974,13 @@
+@@ -700,8 +975,13 @@
fs_search_nfs(xserver_t)
fs_search_auto_mountpoints(xserver_t)
fs_search_ramfs(xserver_t)
@@ -31643,7 +32099,7 @@ diff --exclude-from=exclude -N -u -r nsa
selinux_validate_context(xserver_t)
selinux_compute_access_vector(xserver_t)
-@@ -723,11 +1002,14 @@
+@@ -723,11 +1003,14 @@
miscfiles_read_localization(xserver_t)
miscfiles_read_fonts(xserver_t)
@@ -31658,7 +32114,7 @@ diff --exclude-from=exclude -N -u -r nsa
userdom_search_user_home_dirs(xserver_t)
userdom_use_user_ttys(xserver_t)
-@@ -779,12 +1061,28 @@
+@@ -779,12 +1062,28 @@
')
optional_policy(`
@@ -31688,7 +32144,7 @@ diff --exclude-from=exclude -N -u -r nsa
unconfined_domtrans(xserver_t)
')
-@@ -811,7 +1109,7 @@
+@@ -811,7 +1110,7 @@
allow xserver_t xdm_var_lib_t:file { getattr read };
dontaudit xserver_t xdm_var_lib_t:dir search;
@@ -31697,7 +32153,7 @@ diff --exclude-from=exclude -N -u -r nsa
# Label pid and temporary files with derived types.
manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
-@@ -832,9 +1130,14 @@
+@@ -832,9 +1131,14 @@
# to read ROLE_home_t - examine this in more detail
# (xauth?)
userdom_read_user_home_content_files(xserver_t)
@@ -31712,7 +32168,7 @@ diff --exclude-from=exclude -N -u -r nsa
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(xserver_t)
fs_manage_nfs_files(xserver_t)
-@@ -849,11 +1152,14 @@
+@@ -849,11 +1153,14 @@
optional_policy(`
dbus_system_bus_client(xserver_t)
@@ -31729,7 +32185,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -999,3 +1305,33 @@
+@@ -999,3 +1306,33 @@
allow xserver_unconfined_type xextension_type:x_extension *;
allow xserver_unconfined_type { x_domain xserver_t }:x_resource *;
allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *;
@@ -36743,7 +37199,7 @@ diff --exclude-from=exclude -N -u -r nsa
+HOME_DIR/\.gvfs(/.*)? <<none>>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.7.19/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2010-04-13 20:44:37.000000000 +0200
-+++ serefpolicy-3.7.19/policy/modules/system/userdomain.if 2010-06-01 17:31:14.105409578 +0200
++++ serefpolicy-3.7.19/policy/modules/system/userdomain.if 2010-06-14 18:44:14.626468321 +0200
@@ -30,8 +30,9 @@
')
@@ -38050,7 +38506,7 @@ diff --exclude-from=exclude -N -u -r nsa
## Do not audit attempts to set the
## attributes of user home files.
## </summary>
-@@ -1692,6 +1965,7 @@
+@@ -1692,10 +1965,30 @@
type user_home_dir_t, user_home_t;
')
@@ -38058,7 +38514,30 @@ diff --exclude-from=exclude -N -u -r nsa
read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
files_search_home($1)
')
-@@ -1708,11 +1982,14 @@
+
++#######################################
++## <summary>
++## Do not audit attempts to getattr user home files.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
++interface(`userdom_dontaudit_getattr_user_home_content',`
++ gen_require(`
++ attribute user_home_type;
++ ')
++
++ dontaudit $1 user_home_type:dir getattr;
++ dontaudit $1 user_home_type:file getattr;
++')
++
+ ########################################
+ ## <summary>
+ ## Do not audit attempts to read user home files.
+@@ -1708,11 +2001,14 @@
#
interface(`userdom_dontaudit_read_user_home_content_files',`
gen_require(`
@@ -38076,7 +38555,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -1802,8 +2079,7 @@
+@@ -1802,8 +2098,7 @@
type user_home_dir_t, user_home_t;
')
@@ -38086,7 +38565,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -1815,25 +2091,18 @@
+@@ -1815,25 +2110,18 @@
## Domain allowed access.
## </summary>
## </param>
@@ -38116,7 +38595,7 @@ diff --exclude-from=exclude -N -u -r nsa
########################################
## <summary>
## Do not audit attempts to execute user home files.
-@@ -1866,6 +2135,7 @@
+@@ -1866,6 +2154,7 @@
interface(`userdom_manage_user_home_content_files',`
gen_require(`
type user_home_dir_t, user_home_t;
@@ -38124,53 +38603,11 @@ diff --exclude-from=exclude -N -u -r nsa
')
manage_files_pattern($1, user_home_t, user_home_t)
-@@ -2102,7 +2372,7 @@
+@@ -2102,6 +2391,25 @@
########################################
## <summary>
--## Do not audit attempts to list user
+## Do not audit attempts to search user
- ## temporary directories.
- ## </summary>
- ## <param name="domain">
-@@ -2111,17 +2381,17 @@
- ## </summary>
- ## </param>
- #
--interface(`userdom_dontaudit_list_user_tmp',`
-+interface(`userdom_dontaudit_search_user_tmp',`
- gen_require(`
- type user_tmp_t;
- ')
-
-- dontaudit $1 user_tmp_t:dir list_dir_perms;
-+ dontaudit $1 user_tmp_t:dir search_dir_perms;
- ')
-
- ########################################
- ## <summary>
--## Do not audit attempts to manage users
-+## Do not audit attempts to list user
- ## temporary directories.
- ## </summary>
- ## <param name="domain">
-@@ -2130,12 +2400,31 @@
- ## </summary>
- ## </param>
- #
--interface(`userdom_dontaudit_manage_user_tmp_dirs',`
-+interface(`userdom_dontaudit_list_user_tmp',`
- gen_require(`
- type user_tmp_t;
- ')
-
-- dontaudit $1 user_tmp_t:dir manage_dir_perms;
-+ dontaudit $1 user_tmp_t:dir list_dir_perms;
-+')
-+
-+########################################
-+## <summary>
-+## Do not audit attempts to manage users
+## temporary directories.
+## </summary>
+## <param name="domain">
@@ -38179,16 +38616,20 @@ diff --exclude-from=exclude -N -u -r nsa
+## </summary>
+## </param>
+#
-+interface(`userdom_dontaudit_manage_user_tmp_dirs',`
++interface(`userdom_dontaudit_search_user_tmp',`
+ gen_require(`
+ type user_tmp_t;
+ ')
+
-+ dontaudit $1 user_tmp_t:dir manage_dir_perms;
- ')
-
- ########################################
-@@ -2218,6 +2507,25 @@
++ dontaudit $1 user_tmp_t:dir search_dir_perms;
++')
++
++########################################
++## <summary>
+ ## Do not audit attempts to list user
+ ## temporary directories.
+ ## </summary>
+@@ -2218,6 +2526,25 @@
########################################
## <summary>
@@ -38214,7 +38655,7 @@ diff --exclude-from=exclude -N -u -r nsa
## Do not audit attempts to manage users
## temporary files.
## </summary>
-@@ -2427,13 +2735,14 @@
+@@ -2427,13 +2754,14 @@
')
read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
@@ -38230,7 +38671,7 @@ diff --exclude-from=exclude -N -u -r nsa
## </summary>
## <param name="domain">
## <summary>
-@@ -2454,6 +2763,24 @@
+@@ -2454,6 +2782,24 @@
########################################
## <summary>
@@ -38255,7 +38696,7 @@ diff --exclude-from=exclude -N -u -r nsa
## Get the attributes of a user domain tty.
## </summary>
## <param name="domain">
-@@ -2747,6 +3074,25 @@
+@@ -2747,6 +3093,25 @@
########################################
## <summary>
@@ -38281,7 +38722,7 @@ diff --exclude-from=exclude -N -u -r nsa
## Execute bin_t in the unprivileged user domains. This
## is an explicit transition, requiring the
## caller to use setexeccon().
-@@ -2787,7 +3133,7 @@
+@@ -2787,7 +3152,7 @@
domain_entry_file_spec_domtrans($1, unpriv_userdomain)
allow unpriv_userdomain $1:fd use;
@@ -38290,7 +38731,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow unpriv_userdomain $1:process sigchld;
')
-@@ -2803,11 +3149,13 @@
+@@ -2803,11 +3168,13 @@
#
interface(`userdom_search_user_home_content',`
gen_require(`
@@ -38306,7 +38747,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -2944,7 +3292,7 @@
+@@ -2944,7 +3311,7 @@
type user_tmp_t;
')
@@ -38315,7 +38756,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -2981,6 +3329,7 @@
+@@ -2981,6 +3348,7 @@
')
read_files_pattern($1, userdomain, userdomain)
@@ -38323,7 +38764,7 @@ diff --exclude-from=exclude -N -u -r nsa
kernel_search_proc($1)
')
-@@ -3111,3 +3460,702 @@
+@@ -3111,3 +3479,702 @@
allow $1 userdomain:dbus send_msg;
')
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/F-13/selinux-policy.spec,v
retrieving revision 1.1028
retrieving revision 1.1029
diff -u -p -r1.1028 -r1.1029
--- selinux-policy.spec 9 Jun 2010 21:48:14 -0000 1.1028
+++ selinux-policy.spec 14 Jun 2010 18:34:42 -0000 1.1029
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.7.19
-Release: 27%{?dist}
+Release: 28%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -469,6 +469,11 @@ exit 0
%endif
%changelog
+* Mon Jun 14 2010 Miroslav Grepl <mgrepl at redhat.com> 3.7.19-28
+- Fixes for netutils
+- Cleanup of aiccu policy
+- Add mpd policy
+
* Wed Jun 9 2010 Miroslav Grepl <mgrepl at redhat.com> 3.7.19-27
- Allow ftpd ipc_lock capability
- Allow audisp-remote to getcap and setcap
More information about the scm-commits
mailing list