rpms/selinux-policy/devel modules-minimum.conf, 1.57, 1.58 modules-targeted.conf, 1.166, 1.167 policy-F14.patch, 1.11, 1.12 selinux-policy.spec, 1.979, 1.980
Daniel J Walsh
dwalsh at fedoraproject.org
Wed Jun 16 20:17:51 UTC 2010
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv12817
Modified Files:
modules-minimum.conf modules-targeted.conf policy-F14.patch
selinux-policy.spec
Log Message:
* Wed Jun 9 2010 Dan Walsh <dwalsh at redhat.com> 3.8.3-4
- Add Zarafa policy
Index: modules-minimum.conf
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/modules-minimum.conf,v
retrieving revision 1.57
retrieving revision 1.58
diff -u -p -r1.57 -r1.58
--- modules-minimum.conf 16 Jun 2010 18:25:47 -0000 1.57
+++ modules-minimum.conf 16 Jun 2010 20:17:50 -0000 1.58
@@ -1897,6 +1897,13 @@ xfs = module
xserver = base
# Layer: services
+# Module: zarafa
+#
+# Zarafa Collaboration Platform
+#
+zarafa = module
+
+# Layer: services
# Module: zebra
#
# Zebra border gateway protocol network routing service
Index: modules-targeted.conf
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/modules-targeted.conf,v
retrieving revision 1.166
retrieving revision 1.167
diff -u -p -r1.166 -r1.167
--- modules-targeted.conf 16 Jun 2010 18:25:47 -0000 1.166
+++ modules-targeted.conf 16 Jun 2010 20:17:50 -0000 1.167
@@ -1897,6 +1897,13 @@ xfs = module
xserver = base
# Layer: services
+# Module: zarafa
+#
+# Zarafa Collaboration Platform
+#
+zarafa = module
+
+# Layer: services
# Module: zebra
#
# Zebra border gateway protocol network routing service
policy-F14.patch:
Changelog | 3
Makefile | 2
man/man8/git_selinux.8 | 109 +
policy/global_tunables | 24
policy/modules/admin/accountsd.fc | 4
policy/modules/admin/accountsd.if | 164 ++
policy/modules/admin/accountsd.te | 62 +
policy/modules/admin/acct.te | 1
policy/modules/admin/alsa.te | 2
policy/modules/admin/anaconda.te | 4
policy/modules/admin/certwatch.te | 2
policy/modules/admin/consoletype.if | 3
policy/modules/admin/consoletype.te | 2
policy/modules/admin/dmesg.te | 5
policy/modules/admin/firstboot.te | 7
policy/modules/admin/kismet.te | 1
policy/modules/admin/logrotate.te | 1
policy/modules/admin/logwatch.fc | 2
policy/modules/admin/mcelog.te | 2
policy/modules/admin/mrtg.te | 1
policy/modules/admin/ncftool.fc | 2
policy/modules/admin/ncftool.if | 74 +
policy/modules/admin/ncftool.te | 79 +
policy/modules/admin/netutils.fc | 1
policy/modules/admin/netutils.te | 22
policy/modules/admin/prelink.fc | 1
policy/modules/admin/prelink.if | 5
policy/modules/admin/prelink.te | 8
policy/modules/admin/quota.te | 1
policy/modules/admin/readahead.te | 2
policy/modules/admin/rpm.fc | 4
policy/modules/admin/rpm.if | 133 ++
policy/modules/admin/rpm.te | 41
policy/modules/admin/shorewall.te | 7
policy/modules/admin/shutdown.fc | 5
policy/modules/admin/shutdown.if | 136 ++
policy/modules/admin/shutdown.te | 61 +
policy/modules/admin/su.if | 11
policy/modules/admin/sudo.if | 12
policy/modules/admin/tmpreaper.te | 13
policy/modules/admin/usermanage.if | 20
policy/modules/admin/usermanage.te | 24
policy/modules/admin/vbetool.te | 6
policy/modules/admin/vpn.if | 20
policy/modules/admin/vpn.te | 3
policy/modules/apps/chrome.fc | 3
policy/modules/apps/chrome.if | 90 +
policy/modules/apps/chrome.te | 86 +
policy/modules/apps/cpufreqselector.te | 4
policy/modules/apps/execmem.fc | 47
policy/modules/apps/execmem.if | 110 +
policy/modules/apps/execmem.te | 11
policy/modules/apps/firewallgui.fc | 3
policy/modules/apps/firewallgui.if | 23
policy/modules/apps/firewallgui.te | 66 +
policy/modules/apps/gitosis.fc | 2
policy/modules/apps/gitosis.if | 2
policy/modules/apps/gitosis.te | 7
policy/modules/apps/gnome.fc | 24
policy/modules/apps/gnome.if | 438 +++++++
policy/modules/apps/gnome.te | 118 ++
policy/modules/apps/gpg.fc | 1
policy/modules/apps/gpg.if | 41
policy/modules/apps/gpg.te | 91 +
policy/modules/apps/irc.fc | 4
policy/modules/apps/irc.if | 15
policy/modules/apps/irc.te | 104 +
policy/modules/apps/java.fc | 3
policy/modules/apps/java.if | 4
policy/modules/apps/java.te | 1
policy/modules/apps/kdumpgui.fc | 2
policy/modules/apps/kdumpgui.if | 2
policy/modules/apps/kdumpgui.te | 68 +
policy/modules/apps/livecd.fc | 2
policy/modules/apps/livecd.if | 127 ++
policy/modules/apps/livecd.te | 34
policy/modules/apps/loadkeys.if | 3
policy/modules/apps/mono.if | 5
policy/modules/apps/mozilla.fc | 2
policy/modules/apps/mozilla.if | 62 +
policy/modules/apps/mozilla.te | 22
policy/modules/apps/mplayer.if | 36
policy/modules/apps/mplayer.te | 29
policy/modules/apps/nsplugin.fc | 10
policy/modules/apps/nsplugin.if | 391 ++++++
policy/modules/apps/nsplugin.te | 300 +++++
policy/modules/apps/openoffice.fc | 4
policy/modules/apps/openoffice.if | 129 ++
policy/modules/apps/openoffice.te | 17
policy/modules/apps/podsleuth.te | 3
policy/modules/apps/pulseaudio.if | 57 +
policy/modules/apps/pulseaudio.te | 13
policy/modules/apps/qemu.fc | 4
policy/modules/apps/qemu.if | 84 +
policy/modules/apps/qemu.te | 11
policy/modules/apps/sambagui.fc | 1
policy/modules/apps/sambagui.if | 2
policy/modules/apps/sambagui.te | 66 +
policy/modules/apps/sandbox.fc | 1
policy/modules/apps/sandbox.if | 314 +++++
policy/modules/apps/sandbox.te | 386 ++++++
policy/modules/apps/seunshare.if | 78 -
policy/modules/apps/seunshare.te | 35
policy/modules/apps/slocate.te | 4
policy/modules/apps/telepathysofiasip.fc | 2
policy/modules/apps/telepathysofiasip.if | 69 +
policy/modules/apps/telepathysofiasip.te | 43
policy/modules/apps/userhelper.fc | 1
policy/modules/apps/userhelper.if | 56
policy/modules/apps/userhelper.te | 42
policy/modules/apps/vmware.fc | 4
policy/modules/apps/vmware.if | 19
policy/modules/apps/vmware.te | 14
policy/modules/apps/wine.fc | 1
policy/modules/apps/wine.if | 11
policy/modules/apps/wine.te | 22
policy/modules/apps/wm.if | 15
policy/modules/kernel/corecommands.fc | 28
policy/modules/kernel/corecommands.if | 2
policy/modules/kernel/corecommands.te | 2
policy/modules/kernel/corenetwork.te.in | 32
policy/modules/kernel/devices.fc | 5
policy/modules/kernel/devices.if | 77 +
policy/modules/kernel/devices.te | 4
policy/modules/kernel/domain.if | 45
policy/modules/kernel/domain.te | 109 +
policy/modules/kernel/files.fc | 31
policy/modules/kernel/files.if | 653 +++++++++++
policy/modules/kernel/files.te | 13
policy/modules/kernel/filesystem.if | 159 ++
policy/modules/kernel/filesystem.te | 13
policy/modules/kernel/kernel.if | 40
policy/modules/kernel/kernel.te | 18
policy/modules/kernel/selinux.if | 25
policy/modules/kernel/storage.if | 2
policy/modules/kernel/terminal.if | 29
policy/modules/roles/auditadm.te | 3
policy/modules/roles/guest.te | 8
policy/modules/roles/secadm.te | 2
policy/modules/roles/staff.te | 118 ++
policy/modules/roles/sysadm.te | 102 +
policy/modules/roles/unconfineduser.fc | 8
policy/modules/roles/unconfineduser.if | 667 +++++++++++
policy/modules/roles/unconfineduser.te | 443 +++++++
policy/modules/roles/unprivuser.te | 23
policy/modules/roles/xguest.te | 79 +
policy/modules/services/abrt.fc | 4
policy/modules/services/abrt.if | 61 +
policy/modules/services/abrt.te | 47
policy/modules/services/afs.te | 5
policy/modules/services/aiccu.fc | 6
policy/modules/services/aiccu.if | 118 ++
policy/modules/services/aiccu.te | 71 +
policy/modules/services/aisexec.te | 3
policy/modules/services/apache.fc | 18
policy/modules/services/apache.if | 203 +++
policy/modules/services/apache.te | 237 +++-
policy/modules/services/apcupsd.te | 4
policy/modules/services/arpwatch.te | 1
policy/modules/services/asterisk.te | 6
policy/modules/services/automount.te | 1
policy/modules/services/avahi.if | 1
policy/modules/services/bitlbee.te | 5
policy/modules/services/bluetooth.if | 21
policy/modules/services/boinc.fc | 6
policy/modules/services/boinc.if | 151 ++
policy/modules/services/boinc.te | 94 +
policy/modules/services/bugzilla.fc | 4
policy/modules/services/bugzilla.if | 39
policy/modules/services/bugzilla.te | 57 +
policy/modules/services/cachefilesd.fc | 29
policy/modules/services/cachefilesd.if | 41
policy/modules/services/cachefilesd.te | 147 ++
policy/modules/services/ccs.te | 5
policy/modules/services/certmonger.te | 2
policy/modules/services/cgroup.te | 4
policy/modules/services/chronyd.if | 76 +
policy/modules/services/chronyd.te | 8
policy/modules/services/clamav.te | 7
policy/modules/services/cmirrord.fc | 6
policy/modules/services/cmirrord.if | 118 ++
policy/modules/services/cmirrord.te | 57 +
policy/modules/services/cobbler.fc | 2
policy/modules/services/cobbler.te | 16
policy/modules/services/consolekit.te | 22
policy/modules/services/corosync.fc | 1
policy/modules/services/corosync.te | 21
policy/modules/services/cron.fc | 6
policy/modules/services/cron.if | 98 +
policy/modules/services/cron.te | 98 +
policy/modules/services/cups.fc | 6
policy/modules/services/cups.te | 15
policy/modules/services/cvs.te | 1
policy/modules/services/cyrus.te | 1
policy/modules/services/dbus.if | 26
policy/modules/services/dbus.te | 20
policy/modules/services/denyhosts.te | 5
policy/modules/services/devicekit.te | 14
policy/modules/services/dhcp.te | 4
policy/modules/services/dnsmasq.te | 4
policy/modules/services/dovecot.te | 5
policy/modules/services/exim.fc | 3
policy/modules/services/exim.if | 61 +
policy/modules/services/exim.te | 7
policy/modules/services/fail2ban.if | 20
policy/modules/services/fprintd.te | 1
policy/modules/services/ftp.te | 67 +
policy/modules/services/git.fc | 9
policy/modules/services/git.if | 526 +++++++++
policy/modules/services/git.te | 190 +++
policy/modules/services/gnomeclock.if | 21
policy/modules/services/gpsd.te | 4
policy/modules/services/hal.if | 20
policy/modules/services/hal.te | 28
policy/modules/services/hddtemp.te | 1
policy/modules/services/icecast.te | 6
policy/modules/services/inn.te | 1
policy/modules/services/kerberos.if | 8
policy/modules/services/kerberos.te | 6
policy/modules/services/ksmtuned.fc | 2
policy/modules/services/ksmtuned.te | 11
policy/modules/services/ldap.fc | 5
policy/modules/services/ldap.if | 81 +
policy/modules/services/ldap.te | 13
policy/modules/services/lircd.te | 3
policy/modules/services/milter.if | 20
policy/modules/services/mock.fc | 6
policy/modules/services/mock.if | 183 +++
policy/modules/services/mock.te | 93 +
policy/modules/services/modemmanager.te | 8
policy/modules/services/mpd.fc | 8
policy/modules/services/mpd.if | 270 ++++
policy/modules/services/mpd.te | 106 +
policy/modules/services/mta.fc | 2
policy/modules/services/mta.if | 34
policy/modules/services/mta.te | 28
policy/modules/services/munin.if | 18
policy/modules/services/munin.te | 17
policy/modules/services/mysql.te | 3
policy/modules/services/nagios.if | 38
policy/modules/services/nagios.te | 8
policy/modules/services/networkmanager.fc | 4
policy/modules/services/networkmanager.if | 68 +
policy/modules/services/networkmanager.te | 22
policy/modules/services/nscd.if | 20
policy/modules/services/nscd.te | 27
policy/modules/services/nslcd.te | 2
policy/modules/services/ntp.te | 3
policy/modules/services/nut.te | 4
policy/modules/services/nx.if | 1
policy/modules/services/nx.te | 6
policy/modules/services/oddjob.fc | 1
policy/modules/services/oddjob.if | 1
policy/modules/services/oddjob.te | 5
policy/modules/services/oident.te | 1
policy/modules/services/openvpn.te | 7
policy/modules/services/pegasus.te | 28
policy/modules/services/piranha.fc | 21
policy/modules/services/piranha.if | 175 +++
policy/modules/services/piranha.te | 182 +++
policy/modules/services/plymouthd.te | 5
policy/modules/services/policykit.fc | 5
policy/modules/services/policykit.if | 71 +
policy/modules/services/policykit.te | 86 +
policy/modules/services/portreserve.fc | 3
policy/modules/services/portreserve.if | 55
policy/modules/services/portreserve.te | 3
policy/modules/services/postfix.fc | 3
policy/modules/services/postfix.if | 152 ++
policy/modules/services/postfix.te | 54
policy/modules/services/ppp.te | 4
policy/modules/services/procmail.fc | 2
policy/modules/services/procmail.te | 17
policy/modules/services/psad.if | 20
policy/modules/services/psad.te | 1
policy/modules/services/puppet.te | 2
policy/modules/services/pyzor.fc | 4
policy/modules/services/pyzor.if | 47
policy/modules/services/pyzor.te | 37
policy/modules/services/qpidd.fc | 9
policy/modules/services/qpidd.if | 236 ++++
policy/modules/services/qpidd.te | 59 +
policy/modules/services/radius.te | 2
policy/modules/services/razor.fc | 1
policy/modules/services/razor.if | 42
policy/modules/services/razor.te | 32
policy/modules/services/rgmanager.fc | 2
policy/modules/services/rgmanager.if | 61 +
policy/modules/services/rgmanager.te | 17
policy/modules/services/rhcs.if | 61 +
policy/modules/services/rhcs.te | 25
policy/modules/services/ricci.fc | 3
policy/modules/services/ricci.if | 62 +
policy/modules/services/ricci.te | 9
policy/modules/services/rlogin.fc | 3
policy/modules/services/rlogin.te | 1
policy/modules/services/rpc.if | 21
policy/modules/services/rpc.te | 14
policy/modules/services/rpcbind.te | 4
policy/modules/services/rsync.if | 28
policy/modules/services/rsync.te | 26
policy/modules/services/rtkit.if | 21
policy/modules/services/samba.fc | 4
policy/modules/services/samba.if | 102 +
policy/modules/services/samba.te | 44
policy/modules/services/sasl.te | 3
policy/modules/services/sendmail.fc | 2
policy/modules/services/sendmail.if | 65 +
policy/modules/services/sendmail.te | 15
policy/modules/services/setroubleshoot.if | 19
policy/modules/services/setroubleshoot.te | 16
policy/modules/services/smartmon.te | 2
policy/modules/services/smokeping.te | 2
policy/modules/services/snmp.te | 3
policy/modules/services/snort.te | 2
policy/modules/services/spamassassin.fc | 15
policy/modules/services/spamassassin.if | 107 +
policy/modules/services/spamassassin.te | 147 ++
policy/modules/services/ssh.fc | 8
policy/modules/services/ssh.if | 64 -
policy/modules/services/ssh.te | 64 -
policy/modules/services/sssd.te | 3
policy/modules/services/sysstat.te | 5
policy/modules/services/tgtd.te | 4
policy/modules/services/tor.te | 2
policy/modules/services/tuned.te | 5
policy/modules/services/ucspitcp.te | 5
policy/modules/services/usbmuxd.fc | 2
policy/modules/services/varnishd.if | 19
policy/modules/services/vhostmd.if | 2
policy/modules/services/vhostmd.te | 2
policy/modules/services/virt.fc | 6
policy/modules/services/virt.if | 59 -
policy/modules/services/virt.te | 89 +
policy/modules/services/w3c.te | 9
policy/modules/services/xserver.fc | 61 -
policy/modules/services/xserver.if | 451 +++++++-
policy/modules/services/xserver.te | 423 ++++++-
policy/modules/services/zabbix.te | 2
policy/modules/services/zarafa.fc | 27
policy/modules/services/zarafa.if | 105 +
policy/modules/services/zarafa.te | 134 ++
policy/modules/system/application.te | 16
policy/modules/system/authlogin.fc | 1
policy/modules/system/authlogin.if | 56
policy/modules/system/authlogin.te | 9
policy/modules/system/daemontools.if | 62 +
policy/modules/system/daemontools.te | 26
policy/modules/system/fstools.fc | 2
policy/modules/system/fstools.te | 12
policy/modules/system/getty.te | 2
policy/modules/system/hostname.te | 7
policy/modules/system/hotplug.te | 3
policy/modules/system/init.fc | 3
policy/modules/system/init.if | 148 ++
policy/modules/system/init.te | 195 +++
policy/modules/system/ipsec.fc | 1
policy/modules/system/ipsec.if | 18
policy/modules/system/ipsec.te | 17
policy/modules/system/iptables.fc | 6
policy/modules/system/iptables.if | 4
policy/modules/system/iptables.te | 22
policy/modules/system/iscsi.if | 18
policy/modules/system/iscsi.te | 2
policy/modules/system/libraries.fc | 154 ++
policy/modules/system/libraries.te | 8
policy/modules/system/locallogin.te | 40
policy/modules/system/logging.fc | 16
policy/modules/system/logging.if | 43
policy/modules/system/logging.te | 34
policy/modules/system/lvm.fc | 2
policy/modules/system/lvm.te | 21
policy/modules/system/miscfiles.fc | 2
policy/modules/system/miscfiles.if | 3
policy/modules/system/modutils.if | 20
policy/modules/system/modutils.te | 14
policy/modules/system/mount.fc | 8
policy/modules/system/mount.if | 163 ++
policy/modules/system/mount.te | 151 ++
policy/modules/system/raid.te | 1
policy/modules/system/selinuxutil.fc | 17
policy/modules/system/selinuxutil.if | 330 +++++
policy/modules/system/selinuxutil.te | 236 +---
policy/modules/system/setrans.te | 1
policy/modules/system/sosreport.fc | 2
policy/modules/system/sosreport.if | 131 ++
policy/modules/system/sosreport.te | 155 ++
policy/modules/system/sysnetwork.fc | 2
policy/modules/system/sysnetwork.if | 190 ++-
policy/modules/system/sysnetwork.te | 27
policy/modules/system/udev.fc | 1
policy/modules/system/udev.te | 13
policy/modules/system/unconfined.fc | 14
policy/modules/system/unconfined.if | 440 -------
policy/modules/system/unconfined.te | 224 ---
policy/modules/system/userdomain.fc | 11
policy/modules/system/userdomain.if | 1684 ++++++++++++++++++++++++------
policy/modules/system/userdomain.te | 29
policy/modules/system/xen.if | 3
policy/modules/system/xen.te | 14
policy/support/misc_patterns.spt | 8
policy/support/obj_perm_sets.spt | 38
policy/users | 15
403 files changed, 18714 insertions(+), 1865 deletions(-)
Index: policy-F14.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-F14.patch,v
retrieving revision 1.11
retrieving revision 1.12
diff -u -p -r1.11 -r1.12
--- policy-F14.patch 16 Jun 2010 18:25:47 -0000 1.11
+++ policy-F14.patch 16 Jun 2010 20:17:50 -0000 1.12
@@ -6893,7 +6893,7 @@ diff --exclude-from=exclude -N -u -r nsa
#
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.8.3/policy/modules/kernel/corenetwork.te.in
--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.3/policy/modules/kernel/corenetwork.te.in 2010-06-11 11:15:13.000000000 -0400
++++ serefpolicy-3.8.3/policy/modules/kernel/corenetwork.te.in 2010-06-16 15:29:05.000000000 -0400
@@ -25,6 +25,7 @@
#
type tun_tap_device_t;
@@ -7011,7 +7011,7 @@ diff --exclude-from=exclude -N -u -r nsa
network_port(syslogd, udp,514,s0)
network_port(telnetd, tcp,23,s0)
network_port(tftp, udp,69,s0)
-@@ -205,13 +226,13 @@
+@@ -205,13 +226,14 @@
network_port(varnishd, tcp,6081,s0, tcp,6082,s0)
network_port(virt, tcp,16509,s0, udp,16509,s0, tcp,16514,s0, udp,16514,s0)
network_port(virt_migration, tcp,49152-49216,s0)
@@ -7024,6 +7024,7 @@ diff --exclude-from=exclude -N -u -r nsa
network_port(xfs, tcp,7100,s0)
-network_port(xserver, tcp,6000-6020,s0)
+network_port(xserver, tcp,6000-6150,s0)
++network_port(zarafa, tcp,236,s0)
network_port(zebra, tcp,2600-2604,s0, tcp,2606,s0, udp,2600-2604,s0, udp,2606,s0)
network_port(zope, tcp,8021,s0)
@@ -10900,7 +10901,7 @@ diff --exclude-from=exclude -N -u -r nsa
+/var/spool/abrt(/.*)? gen_context(system_u:object_r:abrt_var_cache_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.if serefpolicy-3.8.3/policy/modules/services/abrt.if
--- nsaserefpolicy/policy/modules/services/abrt.if 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.3/policy/modules/services/abrt.if 2010-06-08 11:32:10.000000000 -0400
++++ serefpolicy-3.8.3/policy/modules/services/abrt.if 2010-06-16 15:22:44.000000000 -0400
@@ -111,6 +111,10 @@
')
@@ -11340,7 +11341,7 @@ diff --exclude-from=exclude -N -u -r nsa
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aisexec.te serefpolicy-3.8.3/policy/modules/services/aisexec.te
--- nsaserefpolicy/policy/modules/services/aisexec.te 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.3/policy/modules/services/aisexec.te 2010-06-08 11:32:10.000000000 -0400
++++ serefpolicy-3.8.3/policy/modules/services/aisexec.te 2010-06-16 15:40:47.000000000 -0400
@@ -98,3 +98,6 @@
rhcs_rw_groupd_semaphores(aisexec_t)
rhcs_rw_groupd_shm(aisexec_t)
@@ -11796,7 +11797,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.8.3/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.3/policy/modules/services/apache.te 2010-06-08 11:32:10.000000000 -0400
++++ serefpolicy-3.8.3/policy/modules/services/apache.te 2010-06-16 16:04:24.000000000 -0400
@@ -19,6 +19,8 @@
# Declarations
#
@@ -12152,7 +12153,18 @@ diff --exclude-from=exclude -N -u -r nsa
snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
')
-@@ -619,6 +745,10 @@
+@@ -604,6 +730,10 @@
+ yam_read_content(httpd_t)
+ ')
+
++optional_policy(`
++ zarafa_stream_connect_server(httpd_t)
++')
++
+ ########################################
+ #
+ # Apache helper local policy
+@@ -619,6 +749,10 @@
userdom_use_user_terminals(httpd_helper_t)
@@ -12163,7 +12175,7 @@ diff --exclude-from=exclude -N -u -r nsa
########################################
#
# Apache PHP script local policy
-@@ -700,17 +830,18 @@
+@@ -700,17 +834,18 @@
manage_files_pattern(httpd_suexec_t, httpd_suexec_tmp_t, httpd_suexec_tmp_t)
files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir })
@@ -12185,7 +12197,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_read_etc_files(httpd_suexec_t)
files_read_usr_files(httpd_suexec_t)
-@@ -741,10 +872,21 @@
+@@ -741,10 +876,21 @@
corenet_sendrecv_all_client_packets(httpd_suexec_t)
')
@@ -12208,7 +12220,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -770,6 +912,12 @@
+@@ -770,6 +916,12 @@
dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
')
@@ -12221,7 +12233,7 @@ diff --exclude-from=exclude -N -u -r nsa
########################################
#
# Apache system script local policy
-@@ -793,9 +941,13 @@
+@@ -793,9 +945,13 @@
files_search_var_lib(httpd_sys_script_t)
files_search_spool(httpd_sys_script_t)
@@ -12235,7 +12247,7 @@ diff --exclude-from=exclude -N -u -r nsa
ifdef(`distro_redhat',`
allow httpd_sys_script_t httpd_log_t:file append_file_perms;
')
-@@ -804,6 +956,22 @@
+@@ -804,6 +960,22 @@
mta_send_mail(httpd_sys_script_t)
')
@@ -12258,7 +12270,7 @@ diff --exclude-from=exclude -N -u -r nsa
tunable_policy(`httpd_enable_cgi && httpd_can_network_connect',`
allow httpd_sys_script_t self:tcp_socket create_stream_socket_perms;
allow httpd_sys_script_t self:udp_socket create_socket_perms;
-@@ -831,6 +999,16 @@
+@@ -831,6 +1003,16 @@
fs_read_nfs_symlinks(httpd_sys_script_t)
')
@@ -12275,7 +12287,7 @@ diff --exclude-from=exclude -N -u -r nsa
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_sys_script_t)
fs_read_cifs_symlinks(httpd_sys_script_t)
-@@ -843,6 +1021,7 @@
+@@ -843,6 +1025,7 @@
optional_policy(`
mysql_stream_connect(httpd_sys_script_t)
mysql_rw_db_sockets(httpd_sys_script_t)
@@ -12283,7 +12295,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -892,11 +1071,33 @@
+@@ -892,11 +1075,33 @@
tunable_policy(`httpd_enable_cgi && httpd_unified',`
allow httpd_user_script_t httpdcontent:file entrypoint;
@@ -18758,7 +18770,7 @@ diff --exclude-from=exclude -N -u -r nsa
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.8.3/policy/modules/services/postfix.te
--- nsaserefpolicy/policy/modules/services/postfix.te 2010-05-25 16:28:22.000000000 -0400
-+++ serefpolicy-3.8.3/policy/modules/services/postfix.te 2010-06-14 19:02:47.000000000 -0400
++++ serefpolicy-3.8.3/policy/modules/services/postfix.te 2010-06-16 16:05:01.000000000 -0400
@@ -6,6 +6,15 @@
# Declarations
#
@@ -18854,7 +18866,7 @@ diff --exclude-from=exclude -N -u -r nsa
term_dontaudit_search_ptys(postfix_master_t)
-@@ -305,6 +332,10 @@
+@@ -305,9 +332,17 @@
')
optional_policy(`
@@ -18865,7 +18877,14 @@ diff --exclude-from=exclude -N -u -r nsa
procmail_domtrans(postfix_local_t)
')
-@@ -421,6 +452,7 @@
++optional_policy(`
++ zarafa_deliver_domtrans(postfix_local_t)
++')
++
+ ########################################
+ #
+ # Postfix map local policy
+@@ -421,6 +456,7 @@
optional_policy(`
spamassassin_domtrans_client(postfix_pipe_t)
@@ -18873,7 +18892,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -589,6 +621,11 @@
+@@ -589,6 +625,11 @@
# for OpenSSL certificates
files_read_usr_files(postfix_smtpd_t)
@@ -18885,7 +18904,7 @@ diff --exclude-from=exclude -N -u -r nsa
mta_read_aliases(postfix_smtpd_t)
optional_policy(`
-@@ -631,3 +668,8 @@
+@@ -631,3 +672,8 @@
# For reading spamassasin
mta_read_config(postfix_virtual_t)
mta_manage_spool(postfix_virtual_t)
@@ -23914,6 +23933,299 @@ diff --exclude-from=exclude -N -u -r nsa
+tunable_policy(`use_samba_home_dirs',`
+ fs_append_cifs_files(xdmhomewriter)
+')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zabbix.te serefpolicy-3.8.3/policy/modules/services/zabbix.te
+--- nsaserefpolicy/policy/modules/services/zabbix.te 2009-07-14 14:19:57.000000000 -0400
++++ serefpolicy-3.8.3/policy/modules/services/zabbix.te 2010-06-16 15:16:12.000000000 -0400
+@@ -13,11 +13,9 @@
+ type zabbix_initrc_exec_t;
+ init_script_file(zabbix_initrc_exec_t)
+
+-# log files
+ type zabbix_log_t;
+ logging_log_file(zabbix_log_t)
+
+-# pid files
+ type zabbix_var_run_t;
+ files_pid_file(zabbix_var_run_t)
+
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.fc serefpolicy-3.8.3/policy/modules/services/zarafa.fc
+--- nsaserefpolicy/policy/modules/services/zarafa.fc 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.8.3/policy/modules/services/zarafa.fc 2010-06-16 16:03:02.000000000 -0400
+@@ -0,0 +1,27 @@
++
++/etc/zarafa(/.*)? gen_context(system_u:object_r:zarafa_etc_t,s0)
++
++/usr/bin/zarafa-dagent -- gen_context(system_u:object_r:zarafa_deliver_exec_t,s0)
++
++/usr/bin/zarafa-server -- gen_context(system_u:object_r:zarafa_server_exec_t,s0)
++
++/usr/bin/zarafa-gateway -- gen_context(system_u:object_r:zarafa_gateway_exec_t,s0)
++
++/usr/bin/zarafa-spooler -- gen_context(system_u:object_r:zarafa_spooler_exec_t,s0)
++
++/usr/bin/zarafa-ical -- gen_context(system_u:object_r:zarafa_ical_exec_t,s0)
++
++/usr/bin/zarafa-monitor -- gen_context(system_u:object_r:zarafa_monitor_exec_t,s0)
++
++/var/log/zarafa/server\.log -- gen_context(system_u:object_r:zarafa_server_log_t,s0)
++/var/log/zarafa/spooler\.log -- gen_context(system_u:object_r:zarafa_spooler_log_t,s0)
++/var/log/zarafa/gateway\.log -- gen_context(system_u:object_r:zarafa_gateway_log_t,s0)
++/var/log/zarafa/ical\.log -- gen_context(system_u:object_r:zarafa_ical_log_t,s0)
++/var/log/zarafa/monitor\.log -- gen_context(system_u:object_r:zarafa_monitor_log_t,s0)
++
++/var/run/zarafa -s gen_context(system_u:object_r:zarafa_server_var_run_t,s0)
++/var/run/zarafa-gateway\.pid -- gen_context(system_u:object_r:zarafa_gateway_var_run_t,s0)
++/var/run/zarafa-server\.pid -- gen_context(system_u:object_r:zarafa_server_var_run_t,s0)
++/var/run/zarafa-spooler\.pid -- gen_context(system_u:object_r:zarafa_spooler_var_run_t,s0)
++/var/run/zarafa-ical\.pid -- gen_context(system_u:object_r:zarafa_ical_var_run_t,s0)
++/var/run/zarafa-monitor\.pid -- gen_context(system_u:object_r:zarafa_monitor_var_run_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.if serefpolicy-3.8.3/policy/modules/services/zarafa.if
+--- nsaserefpolicy/policy/modules/services/zarafa.if 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.8.3/policy/modules/services/zarafa.if 2010-06-16 16:09:56.000000000 -0400
+@@ -0,0 +1,105 @@
++
++## <summary>policy for zarafa services</summary>
++
++######################################
++## <summary>
++## Creates types and rules for a basic
++## zararfa init daemon domain.
++## </summary>
++## <param name="prefix">
++## <summary>
++## Prefix for the domain.
++## </summary>
++## </param>
++#
++template(`zarafa_domain_template',`
++
++ gen_require(`
++ attribute zarafa_domain;
++ ')
++
++ ##############################
++ #
++ # $1_t declarations
++ #
++
++ type zarafa_$1_t, zarafa_domain;
++ type zarafa_$1_exec_t;
++ init_daemon_domain(zarafa_$1_t, zarafa_$1_exec_t)
++
++ type zarafa_$1_log_t;
++ logging_log_file(zarafa_$1_log_t)
++
++ type zarafa_$1_var_run_t;
++ files_pid_file(zarafa_$1_var_run_t)
++
++ ##############################
++ #
++ # $1_t local policy
++ #
++
++ manage_files_pattern(zarafa_$1_t, zarafa_$1_var_run_t, zarafa_$1_var_run_t)
++ manage_sock_files_pattern(zarafa_$1_t, zarafa_$1_var_run_t, zarafa_$1_var_run_t)
++ files_pid_filetrans(zarafa_$1_t, zarafa_$1_var_run_t, { file sock_file })
++ #stream_connect_pattern(zarafa_$1_t, $1_var_run_t, $1_var_run_t, virtd_t)
++
++ manage_files_pattern(zarafa_$1_t, zarafa_$1_log_t,zarafa_$1_log_t)
++ #manage_sock_files_pattern(zarafa_$1_t, zarafa_$1_log_t,zarafa_$1_log_t)
++ logging_log_filetrans(zarafa_$1_t,zarafa_$1_log_t,{ file })
++')
++
++########################################
++## <summary>
++## Execute a domain transition to run zarafa_server.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`zarafa_server_domtrans',`
++ gen_require(`
++ type zarafa_server_t, zarafa_server_exec_t;
++ ')
++
++ domtrans_pattern($1, zarafa_server_exec_t, zarafa_server_t)
++')
++
++
++########################################
++## <summary>
++## Execute a domain transition to run zarafa_deliver.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`zarafa_deliver_domtrans',`
++ gen_require(`
++ type zarafa_deliver_t, zarafa_deliver_exec_t;
++ ')
++
++ domtrans_pattern($1, zarafa_deliver_exec_t, zarafa_deliver_t)
++')
++
++#######################################
++## <summary>
++## Connect to zarafa-server unix domain stream socket.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <rolecap/>
++#
++interface(`zarafa_stream_connect_server',`
++ gen_require(`
++ type zarafa_server_t, zarafa_server_var_run_t;
++ ')
++
++ stream_connect_pattern($1, zarafa_server_t, zarafa_server_var_run_t, zarafa_server_t)
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zarafa.te serefpolicy-3.8.3/policy/modules/services/zarafa.te
+--- nsaserefpolicy/policy/modules/services/zarafa.te 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.8.3/policy/modules/services/zarafa.te 2010-06-16 16:08:32.000000000 -0400
+@@ -0,0 +1,134 @@
++
++policy_module(zarafa, 1.0.0)
++
++########################################
++#
++# Declarations
++#
++
++attribute zarafa_domain;
++
++zarafa_domain_template(monitor)
++zarafa_domain_template(ical)
++zarafa_domain_template(server)
++zarafa_domain_template(spooler)
++zarafa_domain_template(gateway)
++zarafa_domain_template(deliver)
++
++type zarafa_deliver_tmp_t;
++files_tmp_file(zarafa_deliver_tmp_t)
++
++type zarafa_etc_t;
++files_config_file(zarafa_etc_t)
++
++type zarafa_share_t;
++files_type(zarafa_share_t)
++
++permissive zarafa_server_t;
++permissive zarafa_spooler_t;
++permissive zarafa_gateway_t;
++permissive zarafa_deliver_t;
++permissive zarafa_ical_t;
++permissive zarafa_monitor_t;
++
++########################################
++#
++# zarafa-deliver local policy
++#
++
++manage_dirs_pattern(zarafa_deliver_t, zarafa_deliver_tmp_t, zarafa_deliver_tmp_t)
++manage_files_pattern(zarafa_deliver_t, zarafa_deliver_tmp_t, zarafa_deliver_tmp_t)
++files_tmp_filetrans(zarafa_deliver_t, zarafa_deliver_tmp_t, { file dir })
++
++#temporary
++#allow zarafa_deliver_t port_t:tcp_socket name_bind;
++
++########################################
++#
++# zarafa_server local policy
++#
++
++allow zarafa_server_t self:capability { chown kill net_bind_service};
++allow zarafa_server_t self:process { setrlimit signal };
++
++corenet_tcp_bind_zarafa_port(zarafa_ical_t)
++
++files_read_usr_files(zarafa_server_t)
++
++logging_send_syslog_msg(zarafa_server_t)
++logging_send_audit_msgs(zarafa_server_t)
++
++sysnet_dns_name_resolve(zarafa_server_t)
++
++optional_policy(`
++ mysql_stream_connect(zarafa_server_t)
++')
++
++optional_policy(`
++ kerberos_use(zarafa_server_t)
++')
++
++########################################
++#
++# zarafa_spooler local policy
++#
++
++allow zarafa_spooler_t self:capability { chown kill };
++allow zarafa_spooler_t self:process { signal };
++
++corenet_tcp_connect_smtp_port(zarafa_spooler_t)
++
++########################################
++#
++# zarafa_gateway local policy
++#
++
++allow zarafa_gateway_t self:capability { chown kill };
++allow zarafa_gateway_t self:process { setrlimit signal };
++
++corenet_tcp_bind_pop_port(zarafa_gateway_t)
++
++#######################################
++#
++# zarafa-ical local policy
++#
++
++allow zarafa_ical_t self:capability chown;
++
++corenet_tcp_bind_http_cache_port(zarafa_ical_t)
++
++######################################
++#
++# zarafa-monitor local policy
++#
++
++allow zarafa_monitor_t self:capability chown;
++
++########################################
++#
++# zarafa domains local policy
++#
++
++# bad permission on /etc/zarafa
++allow zarafa_domain self:capability { dac_override setgid setuid };
++
++allow zarafa_domain self:fifo_file rw_fifo_file_perms;
++allow zarafa_domain self:tcp_socket create_stream_socket_perms;
++allow zarafa_domain self:unix_stream_socket create_stream_socket_perms;
++
++stream_connect_pattern(zarafa_domain, zarafa_server_var_run_t, zarafa_server_var_run_t, zarafa_server_t)
++
++read_files_pattern(zarafa_domain, zarafa_etc_t, zarafa_etc_t)
++
++kernel_read_system_state(zarafa_domain)
++
++files_read_etc_files(zarafa_domain)
++
++auth_use_nsswitch(zarafa_domain)
++
++miscfiles_read_localization(zarafa_domain)
++
++# temporary rules
++optional_policy(`
++ apache_content_template(zarafa)
++')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.8.3/policy/modules/system/application.te
--- nsaserefpolicy/policy/modules/system/application.te 2010-05-25 16:28:22.000000000 -0400
+++ serefpolicy-3.8.3/policy/modules/system/application.te 2010-06-08 11:32:10.000000000 -0400
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.979
retrieving revision 1.980
diff -u -p -r1.979 -r1.980
--- selinux-policy.spec 11 Jun 2010 15:39:46 -0000 1.979
+++ selinux-policy.spec 16 Jun 2010 20:17:50 -0000 1.980
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.8.3
-Release: 3%{?dist}
+Release: 4%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -469,6 +469,9 @@ exit 0
%endif
%changelog
+* Wed Jun 9 2010 Dan Walsh <dwalsh at redhat.com> 3.8.3-4
+- Add Zarafa policy
+
* Wed Jun 9 2010 Dan Walsh <dwalsh at redhat.com> 3.8.3-3
- Cleanup of aiccu policy
- initial mock policy
More information about the scm-commits
mailing list