rpms/selinux-policy/F-13 policy-F13.patch, 1.80, 1.81 selinux-policy.spec, 1.987, 1.988
Daniel J Walsh
dwalsh at fedoraproject.org
Wed Mar 17 14:08:34 UTC 2010
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/F-13
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv16354
Modified Files:
policy-F13.patch selinux-policy.spec
Log Message:
* Tue Mar 16 2010 Dan Walsh <dwalsh at redhat.com> 3.7.14-5
- Allow boinc to read kernel sysctl
- Fix snmp port definitions
- Allow apache to read anon_inodefs
policy-F13.patch:
Makefile | 2
policy/global_tunables | 24
policy/modules/admin/acct.te | 1
policy/modules/admin/alsa.te | 2
policy/modules/admin/anaconda.te | 3
policy/modules/admin/brctl.te | 2
policy/modules/admin/certwatch.te | 2
policy/modules/admin/consoletype.if | 3
policy/modules/admin/consoletype.te | 1
policy/modules/admin/firstboot.te | 6
policy/modules/admin/kismet.te | 1
policy/modules/admin/logrotate.te | 38
policy/modules/admin/mcelog.fc | 2
policy/modules/admin/mcelog.if | 21
policy/modules/admin/mcelog.te | 32
policy/modules/admin/mrtg.te | 1
policy/modules/admin/netutils.fc | 1
policy/modules/admin/netutils.te | 20
policy/modules/admin/prelink.fc | 1
policy/modules/admin/prelink.if | 23
policy/modules/admin/prelink.te | 79 +
policy/modules/admin/quota.te | 1
policy/modules/admin/readahead.te | 3
policy/modules/admin/rpm.fc | 21
policy/modules/admin/rpm.if | 387 +++++++
policy/modules/admin/rpm.te | 104 +
policy/modules/admin/shorewall.te | 2
policy/modules/admin/shutdown.fc | 5
policy/modules/admin/shutdown.if | 118 ++
policy/modules/admin/shutdown.te | 57 +
policy/modules/admin/smoltclient.fc | 4
policy/modules/admin/smoltclient.if | 1
policy/modules/admin/smoltclient.te | 66 +
policy/modules/admin/su.if | 8
policy/modules/admin/sudo.if | 9
policy/modules/admin/tmpreaper.te | 18
policy/modules/admin/usermanage.if | 20
policy/modules/admin/usermanage.te | 18
policy/modules/admin/vbetool.te | 6
policy/modules/admin/vpn.te | 8
policy/modules/apps/chrome.fc | 2
policy/modules/apps/chrome.if | 90 +
policy/modules/apps/chrome.te | 81 +
policy/modules/apps/cpufreqselector.te | 2
policy/modules/apps/execmem.fc | 45
policy/modules/apps/execmem.if | 118 ++
policy/modules/apps/execmem.te | 11
policy/modules/apps/firewallgui.fc | 3
policy/modules/apps/firewallgui.if | 23
policy/modules/apps/firewallgui.te | 66 +
policy/modules/apps/gitosis.if | 44
policy/modules/apps/gnome.fc | 24
policy/modules/apps/gnome.if | 260 ++++
policy/modules/apps/gnome.te | 116 ++
policy/modules/apps/gpg.fc | 1
policy/modules/apps/gpg.if | 5
policy/modules/apps/gpg.te | 14
policy/modules/apps/java.fc | 7
policy/modules/apps/java.if | 4
policy/modules/apps/java.te | 8
policy/modules/apps/kdumpgui.fc | 2
policy/modules/apps/kdumpgui.if | 2
policy/modules/apps/kdumpgui.te | 68 +
policy/modules/apps/livecd.fc | 2
policy/modules/apps/livecd.if | 52
policy/modules/apps/livecd.te | 27
policy/modules/apps/loadkeys.if | 3
policy/modules/apps/loadkeys.te | 6
policy/modules/apps/mono.if | 2
policy/modules/apps/mozilla.fc | 2
policy/modules/apps/mozilla.if | 62 +
policy/modules/apps/mozilla.te | 22
policy/modules/apps/mplayer.if | 36
policy/modules/apps/nsplugin.fc | 10
policy/modules/apps/nsplugin.if | 390 +++++++
policy/modules/apps/nsplugin.te | 295 +++++
policy/modules/apps/openoffice.fc | 3
policy/modules/apps/openoffice.if | 129 ++
policy/modules/apps/openoffice.te | 17
policy/modules/apps/podsleuth.te | 3
policy/modules/apps/ptchown.if | 24
policy/modules/apps/ptchown.te | 1
policy/modules/apps/pulseaudio.fc | 8
policy/modules/apps/pulseaudio.if | 74 +
policy/modules/apps/pulseaudio.te | 44
policy/modules/apps/qemu.if | 64 +
policy/modules/apps/qemu.te | 9
policy/modules/apps/sambagui.fc | 1
policy/modules/apps/sambagui.if | 2
policy/modules/apps/sambagui.te | 66 +
policy/modules/apps/sandbox.fc | 1
policy/modules/apps/sandbox.if | 250 ++++
policy/modules/apps/sandbox.te | 365 ++++++
policy/modules/apps/screen.if | 1
policy/modules/apps/seunshare.if | 78 -
policy/modules/apps/seunshare.te | 35
policy/modules/apps/slocate.te | 2
policy/modules/apps/userhelper.fc | 1
policy/modules/apps/userhelper.if | 48
policy/modules/apps/userhelper.te | 42
policy/modules/apps/vmware.if | 19
policy/modules/apps/vmware.te | 10
policy/modules/apps/wine.if | 11
policy/modules/apps/wine.te | 20
policy/modules/apps/wm.if | 16
policy/modules/kernel/corecommands.fc | 21
policy/modules/kernel/corecommands.if | 2
policy/modules/kernel/corenetwork.te.in | 22
policy/modules/kernel/devices.fc | 1
policy/modules/kernel/devices.if | 73 +
policy/modules/kernel/devices.te | 11
policy/modules/kernel/domain.if | 164 +++
policy/modules/kernel/domain.te | 108 ++
policy/modules/kernel/files.fc | 15
policy/modules/kernel/files.if | 617 +++++++++++
policy/modules/kernel/files.te | 11
policy/modules/kernel/filesystem.if | 26
policy/modules/kernel/filesystem.te | 2
policy/modules/kernel/kernel.if | 94 +
policy/modules/kernel/kernel.te | 26
policy/modules/kernel/selinux.if | 25
policy/modules/kernel/terminal.if | 29
policy/modules/roles/auditadm.te | 2
policy/modules/roles/guest.te | 6
policy/modules/roles/staff.te | 103 +
policy/modules/roles/sysadm.te | 96 +
policy/modules/roles/unconfineduser.fc | 10
policy/modules/roles/unconfineduser.if | 667 ++++++++++++
policy/modules/roles/unconfineduser.te | 417 +++++++
policy/modules/roles/unprivuser.te | 21
policy/modules/roles/xguest.te | 72 +
policy/modules/services/abrt.fc | 8
policy/modules/services/abrt.if | 143 ++
policy/modules/services/abrt.te | 144 ++
policy/modules/services/afs.if | 2
policy/modules/services/afs.te | 6
policy/modules/services/aiccu.fc | 5
policy/modules/services/aiccu.if | 119 ++
policy/modules/services/aiccu.te | 41
policy/modules/services/aisexec.fc | 10
policy/modules/services/aisexec.if | 106 ++
policy/modules/services/aisexec.te | 115 ++
policy/modules/services/amavis.if | 23
policy/modules/services/amavis.te | 4
policy/modules/services/apache.fc | 62 +
policy/modules/services/apache.if | 492 ++++++---
policy/modules/services/apache.te | 501 ++++++++-
policy/modules/services/apcupsd.te | 4
policy/modules/services/arpwatch.te | 4
policy/modules/services/asterisk.if | 19
policy/modules/services/asterisk.te | 43
policy/modules/services/avahi.fc | 2
policy/modules/services/avahi.if | 1
policy/modules/services/avahi.te | 13
policy/modules/services/bind.if | 23
policy/modules/services/bind.te | 4
policy/modules/services/bluetooth.te | 3
policy/modules/services/boinc.fc | 6
policy/modules/services/boinc.if | 151 ++
policy/modules/services/boinc.te | 80 +
policy/modules/services/cachefilesd.fc | 28
policy/modules/services/cachefilesd.if | 41
policy/modules/services/cachefilesd.te | 146 ++
policy/modules/services/ccs.te | 5
policy/modules/services/certmaster.fc | 1
policy/modules/services/certmonger.fc | 6
policy/modules/services/certmonger.if | 217 ++++
policy/modules/services/certmonger.te | 74 +
policy/modules/services/cgroup.fc | 7
policy/modules/services/cgroup.if | 35
policy/modules/services/cgroup.te | 87 +
policy/modules/services/chronyd.fc | 2
policy/modules/services/chronyd.if | 4
policy/modules/services/chronyd.te | 19
policy/modules/services/clamav.te | 5
policy/modules/services/clogd.fc | 4
policy/modules/services/clogd.if | 82 +
policy/modules/services/clogd.te | 65 +
policy/modules/services/cobbler.if | 4
policy/modules/services/cobbler.te | 12
policy/modules/services/consolekit.fc | 3
policy/modules/services/consolekit.if | 39
policy/modules/services/consolekit.te | 35
policy/modules/services/corosync.fc | 14
policy/modules/services/corosync.if | 108 ++
policy/modules/services/corosync.te | 115 ++
policy/modules/services/cron.fc | 6
policy/modules/services/cron.if | 76 +
policy/modules/services/cron.te | 92 +
policy/modules/services/cups.fc | 14
policy/modules/services/cups.te | 65 +
policy/modules/services/cvs.te | 2
policy/modules/services/cyrus.te | 2
policy/modules/services/dbus.if | 56 -
policy/modules/services/dbus.te | 31
policy/modules/services/dcc.te | 2
policy/modules/services/denyhosts.fc | 7
policy/modules/services/denyhosts.if | 90 +
policy/modules/services/denyhosts.te | 72 +
policy/modules/services/devicekit.fc | 6
policy/modules/services/devicekit.if | 22
policy/modules/services/devicekit.te | 95 +
policy/modules/services/dhcp.te | 4
policy/modules/services/djbdns.if | 38
policy/modules/services/djbdns.te | 8
policy/modules/services/dnsmasq.fc | 2
policy/modules/services/dnsmasq.if | 4
policy/modules/services/dnsmasq.te | 22
policy/modules/services/dovecot.fc | 1
policy/modules/services/dovecot.te | 34
policy/modules/services/fail2ban.if | 58 +
policy/modules/services/fetchmail.te | 1
policy/modules/services/fprintd.te | 2
policy/modules/services/ftp.fc | 2
policy/modules/services/ftp.if | 38
policy/modules/services/ftp.te | 179 +++
policy/modules/services/git.fc | 19
policy/modules/services/git.if | 536 ++++++++++
policy/modules/services/git.te | 179 +++
policy/modules/services/gpsd.te | 2
policy/modules/services/hal.te | 33
policy/modules/services/howl.te | 2
policy/modules/services/icecast.fc | 7
policy/modules/services/icecast.if | 199 +++
policy/modules/services/icecast.te | 59 +
policy/modules/services/inn.te | 1
policy/modules/services/kerberos.if | 6
policy/modules/services/kerberos.te | 3
policy/modules/services/ksmtuned.fc | 5
policy/modules/services/ksmtuned.if | 76 +
policy/modules/services/ksmtuned.te | 44
policy/modules/services/ldap.fc | 3
policy/modules/services/ldap.if | 38
policy/modules/services/ldap.te | 13
policy/modules/services/lircd.te | 21
policy/modules/services/mailman.fc | 10
policy/modules/services/memcached.te | 10
policy/modules/services/modemmanager.te | 5
policy/modules/services/mta.fc | 2
policy/modules/services/mta.if | 68 +
policy/modules/services/mta.te | 17
policy/modules/services/munin.fc | 3
policy/modules/services/munin.te | 13
policy/modules/services/mysql.te | 2
policy/modules/services/nagios.fc | 83 +
policy/modules/services/nagios.if | 142 ++
policy/modules/services/nagios.te | 282 ++++-
policy/modules/services/networkmanager.fc | 20
policy/modules/services/networkmanager.if | 86 +
policy/modules/services/networkmanager.te | 121 +-
policy/modules/services/nis.fc | 10
policy/modules/services/nis.if | 78 +
policy/modules/services/nis.te | 21
policy/modules/services/nscd.if | 20
policy/modules/services/nscd.te | 23
policy/modules/services/ntop.fc | 1
policy/modules/services/ntop.te | 34
policy/modules/services/ntp.te | 2
policy/modules/services/nut.te | 21
policy/modules/services/nx.fc | 12
policy/modules/services/nx.if | 67 +
policy/modules/services/nx.te | 13
policy/modules/services/oddjob.if | 1
policy/modules/services/oddjob.te | 5
policy/modules/services/openvpn.te | 7
policy/modules/services/pcscd.if | 38
policy/modules/services/pegasus.te | 28
policy/modules/services/plymouthd.fc | 9
policy/modules/services/plymouthd.if | 322 ++++++
policy/modules/services/plymouthd.te | 105 +
policy/modules/services/policykit.fc | 5
policy/modules/services/policykit.if | 71 +
policy/modules/services/policykit.te | 74 +
policy/modules/services/portreserve.te | 3
policy/modules/services/postfix.fc | 2
policy/modules/services/postfix.if | 187 +++
policy/modules/services/postfix.te | 149 ++
policy/modules/services/postgresql.fc | 8
policy/modules/services/postgresql.if | 17
policy/modules/services/postgresql.te | 6
policy/modules/services/ppp.fc | 1
policy/modules/services/ppp.if | 4
policy/modules/services/ppp.te | 8
policy/modules/services/prelude.te | 3
policy/modules/services/procmail.te | 12
policy/modules/services/pyzor.fc | 4
policy/modules/services/pyzor.if | 47
policy/modules/services/pyzor.te | 37
policy/modules/services/radvd.te | 12
policy/modules/services/razor.fc | 1
policy/modules/services/razor.if | 42
policy/modules/services/razor.te | 32
policy/modules/services/rdisc.if | 19
policy/modules/services/rgmanager.fc | 8
policy/modules/services/rgmanager.if | 98 +
policy/modules/services/rgmanager.te | 223 ++++
policy/modules/services/rhcs.fc | 23
policy/modules/services/rhcs.if | 424 ++++++++
policy/modules/services/rhcs.te | 248 ++++
policy/modules/services/ricci.te | 39
policy/modules/services/rpc.fc | 4
policy/modules/services/rpc.if | 46
policy/modules/services/rpc.te | 35
policy/modules/services/rsync.if | 4
policy/modules/services/rsync.te | 25
policy/modules/services/rtkit.if | 20
policy/modules/services/rtkit.te | 4
policy/modules/services/samba.fc | 4
policy/modules/services/samba.if | 138 ++
policy/modules/services/samba.te | 120 +-
policy/modules/services/sasl.te | 15
policy/modules/services/sendmail.if | 19
policy/modules/services/sendmail.te | 17
policy/modules/services/setroubleshoot.fc | 2
policy/modules/services/setroubleshoot.if | 124 ++
policy/modules/services/setroubleshoot.te | 91 +
policy/modules/services/smokeping.fc | 12
policy/modules/services/smokeping.if | 193 +++
policy/modules/services/smokeping.te | 81 +
policy/modules/services/snmp.te | 2
policy/modules/services/snort.te | 10
policy/modules/services/spamassassin.fc | 15
policy/modules/services/spamassassin.if | 107 ++
policy/modules/services/spamassassin.te | 141 ++
policy/modules/services/squid.te | 9
policy/modules/services/ssh.fc | 2
policy/modules/services/ssh.if | 65 -
policy/modules/services/ssh.te | 53 -
policy/modules/services/sssd.fc | 4
policy/modules/services/sssd.if | 47
policy/modules/services/sssd.te | 17
policy/modules/services/sysstat.te | 5
policy/modules/services/telnet.te | 1
policy/modules/services/tftp.te | 3
policy/modules/services/tor.fc | 3
policy/modules/services/tor.te | 13
policy/modules/services/tuned.fc | 3
policy/modules/services/tuned.te | 16
policy/modules/services/ucspitcp.te | 5
policy/modules/services/usbmuxd.fc | 4
policy/modules/services/usbmuxd.if | 39
policy/modules/services/usbmuxd.te | 50
policy/modules/services/uucp.te | 3
policy/modules/services/vhostmd.fc | 6
policy/modules/services/vhostmd.if | 228 ++++
policy/modules/services/vhostmd.te | 84 +
policy/modules/services/virt.fc | 4
policy/modules/services/virt.if | 42
policy/modules/services/virt.te | 55 -
policy/modules/services/w3c.te | 7
policy/modules/services/xserver.fc | 55 -
policy/modules/services/xserver.if | 383 +++++++
policy/modules/services/xserver.te | 385 ++++++-
policy/modules/services/zebra.if | 20
policy/modules/system/application.te | 11
policy/modules/system/authlogin.fc | 8
policy/modules/system/authlogin.if | 212 +++-
policy/modules/system/authlogin.te | 11
policy/modules/system/daemontools.if | 62 +
policy/modules/system/daemontools.te | 26
policy/modules/system/fstools.fc | 2
policy/modules/system/fstools.te | 4
policy/modules/system/getty.te | 7
policy/modules/system/hostname.te | 3
policy/modules/system/init.fc | 7
policy/modules/system/init.if | 203 +++
policy/modules/system/init.te | 250 ++++
policy/modules/system/ipsec.fc | 4
policy/modules/system/ipsec.if | 19
policy/modules/system/ipsec.te | 41
policy/modules/system/iptables.fc | 2
policy/modules/system/iptables.if | 4
policy/modules/system/iptables.te | 20
policy/modules/system/libraries.fc | 227 +++-
policy/modules/system/libraries.if | 5
policy/modules/system/libraries.te | 28
policy/modules/system/locallogin.te | 39
policy/modules/system/logging.fc | 18
policy/modules/system/logging.if | 38
policy/modules/system/logging.te | 51
policy/modules/system/lvm.fc | 1
policy/modules/system/lvm.if | 2
policy/modules/system/lvm.te | 16
policy/modules/system/modutils.te | 22
policy/modules/system/mount.fc | 8
policy/modules/system/mount.if | 138 ++
policy/modules/system/mount.te | 147 ++
policy/modules/system/raid.te | 1
policy/modules/system/selinuxutil.fc | 17
policy/modules/system/selinuxutil.if | 330 ++++++
policy/modules/system/selinuxutil.te | 231 +---
policy/modules/system/sosreport.fc | 2
policy/modules/system/sosreport.if | 74 +
policy/modules/system/sosreport.te | 129 ++
policy/modules/system/sysnetwork.fc | 9
policy/modules/system/sysnetwork.if | 133 ++
policy/modules/system/sysnetwork.te | 77 +
policy/modules/system/udev.fc | 1
policy/modules/system/udev.if | 19
policy/modules/system/udev.te | 17
policy/modules/system/unconfined.fc | 14
policy/modules/system/unconfined.if | 440 --------
policy/modules/system/unconfined.te | 224 ----
policy/modules/system/userdomain.fc | 8
policy/modules/system/userdomain.if | 1585 ++++++++++++++++++++++++------
policy/modules/system/userdomain.te | 44
policy/modules/system/xen.if | 22
policy/modules/system/xen.te | 32
policy/support/misc_patterns.spt | 4
policy/support/obj_perm_sets.spt | 33
policy/users | 17
411 files changed, 21661 insertions(+), 2346 deletions(-)
Index: policy-F13.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-13/policy-F13.patch,v
retrieving revision 1.80
retrieving revision 1.81
diff -u -p -r1.80 -r1.81
--- policy-F13.patch 15 Mar 2010 21:18:24 -0000 1.80
+++ policy-F13.patch 17 Mar 2010 14:08:32 -0000 1.81
@@ -2568,7 +2568,7 @@ diff --exclude-from=exclude -N -u -r nsa
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.7.14/policy/modules/apps/gnome.if
--- nsaserefpolicy/policy/modules/apps/gnome.if 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.7.14/policy/modules/apps/gnome.if 2010-03-12 09:30:00.000000000 -0500
++++ serefpolicy-3.7.14/policy/modules/apps/gnome.if 2010-03-17 08:37:44.000000000 -0400
@@ -74,6 +74,24 @@
########################################
@@ -2594,7 +2594,7 @@ diff --exclude-from=exclude -N -u -r nsa
## manage gnome homedir content (.config)
## </summary>
## <param name="user_domain">
-@@ -84,10 +102,228 @@
+@@ -84,10 +102,246 @@
#
interface(`gnome_manage_config',`
gen_require(`
@@ -2729,6 +2729,24 @@ diff --exclude-from=exclude -N -u -r nsa
+
+########################################
+## <summary>
++## Append gconf home files
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`gnome_append_gconf_home_files',`
++ gen_require(`
++ type gconf_home_t;
++ ')
++
++ append_files_pattern($1, gconf_home_t, gconf_home_t)
++')
++
++########################################
++## <summary>
+## manage gconf home files
+## </summary>
+## <param name="domain">
@@ -6093,7 +6111,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.7.14/policy/modules/kernel/corenetwork.te.in
--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2010-03-08 14:49:44.000000000 -0500
-+++ serefpolicy-3.7.14/policy/modules/kernel/corenetwork.te.in 2010-03-12 09:30:00.000000000 -0500
++++ serefpolicy-3.7.14/policy/modules/kernel/corenetwork.te.in 2010-03-16 10:29:41.000000000 -0400
@@ -65,6 +65,7 @@
type server_packet_t, packet_type, server_packet_type;
@@ -6171,7 +6189,7 @@ diff --exclude-from=exclude -N -u -r nsa
network_port(printer, tcp,515,s0)
network_port(ptal, tcp,5703,s0)
network_port(pulseaudio, tcp,4713,s0)
-@@ -176,6 +192,7 @@
+@@ -176,16 +192,18 @@
network_port(rsync, tcp,873,s0, udp,873,s0)
network_port(rwho, udp,513,s0)
network_port(sap, tcp,9875,s0, udp,9875,s0)
@@ -6179,7 +6197,11 @@ diff --exclude-from=exclude -N -u -r nsa
network_port(sip, tcp,5060,s0, udp,5060,s0, tcp,5061,s0, udp,5061,s0)
network_port(smbd, tcp,137-139,s0, tcp,445,s0)
network_port(smtp, tcp,25,s0, tcp,465,s0, tcp,587,s0)
-@@ -186,6 +203,7 @@
+-network_port(snmp, udp,161,s0, udp,162,s0, tcp,199,s0, tcp, 1161, s0)
++network_port(snmp, tcp,161,s0, udp,161,s0, tcp,162,s0, udp,162,s0, tcp,199,s0, tcp, 1161, s0)
+ type socks_port_t, port_type; dnl network_port(socks) # no defined portcon
+ network_port(soundd, tcp,8000,s0, tcp,9433,s0, tcp, 16001, s0)
+ network_port(spamd, tcp,783,s0)
network_port(speech, tcp,8036,s0)
network_port(squid, udp,3401,s0, tcp,3401,s0, udp,4827,s0, tcp,4827,s0) # snmp and htcp
network_port(ssh, tcp,22,s0)
@@ -6813,7 +6835,7 @@ diff --exclude-from=exclude -N -u -r nsa
/var/lib/nfs/rpc_pipefs(/.*)? <<none>>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.7.14/policy/modules/kernel/files.if
--- nsaserefpolicy/policy/modules/kernel/files.if 2010-03-03 23:26:37.000000000 -0500
-+++ serefpolicy-3.7.14/policy/modules/kernel/files.if 2010-03-12 09:30:00.000000000 -0500
++++ serefpolicy-3.7.14/policy/modules/kernel/files.if 2010-03-17 08:58:55.000000000 -0400
@@ -1053,10 +1053,8 @@
relabel_lnk_files_pattern($1, { file_type $2 }, { file_type $2 })
relabel_fifo_files_pattern($1, { file_type $2 }, { file_type $2 })
@@ -6827,7 +6849,7 @@ diff --exclude-from=exclude -N -u -r nsa
# satisfy the assertions:
seutil_relabelto_bin_policy($1)
-@@ -1428,6 +1426,24 @@
+@@ -1428,6 +1426,42 @@
########################################
## <summary>
@@ -6849,10 +6871,28 @@ diff --exclude-from=exclude -N -u -r nsa
+
+########################################
+## <summary>
++## Write all mount points.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`files_write_all_mountpoints',`
++ gen_require(`
++ attribute mountpoint;
++ ')
++
++ allow $1 mountpoint:dir write;
++')
++
++########################################
++## <summary>
## List the contents of the root directory.
## </summary>
## <param name="domain">
-@@ -1552,6 +1568,24 @@
+@@ -1552,6 +1586,24 @@
########################################
## <summary>
@@ -6877,7 +6917,41 @@ diff --exclude-from=exclude -N -u -r nsa
## Remove entries from the root directory.
## </summary>
## <param name="domain">
-@@ -2209,6 +2243,24 @@
+@@ -1697,6 +1749,24 @@
+
+ ########################################
+ ## <summary>
++## manage directories in /boot
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`files_manage_boot_dirs',`
++ gen_require(`
++ type boot_t;
++ ')
++
++ allow $1 boot_t:dir manage_dir_perms;
++')
++
++########################################
++## <summary>
+ ## Create a private type object in boot
+ ## with an automatic type transition
+ ## </summary>
+@@ -1740,7 +1810,7 @@
+ type boot_t;
+ ')
+
+- manage_files_pattern($1, boot_t, boot_t)
++ read_files_pattern($1, boot_t, boot_t)
+ ')
+
+ ########################################
+@@ -2209,6 +2279,24 @@
allow $1 etc_t:dir rw_dir_perms;
')
@@ -6902,7 +6976,7 @@ diff --exclude-from=exclude -N -u -r nsa
##########################################
## <summary>
## Manage generic directories in /etc
-@@ -2280,6 +2332,8 @@
+@@ -2280,6 +2368,8 @@
allow $1 etc_t:dir list_dir_perms;
read_files_pattern($1, etc_t, etc_t)
read_lnk_files_pattern($1, etc_t, etc_t)
@@ -6911,7 +6985,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -2362,6 +2416,24 @@
+@@ -2362,6 +2452,24 @@
########################################
## <summary>
@@ -6936,7 +7010,7 @@ diff --exclude-from=exclude -N -u -r nsa
## Execute generic files in /etc.
## </summary>
## <param name="domain">
-@@ -2789,6 +2861,101 @@
+@@ -2789,6 +2897,101 @@
########################################
## <summary>
@@ -7038,7 +7112,7 @@ diff --exclude-from=exclude -N -u -r nsa
## Create, read, write, and delete files
## on new filesystems that have not yet been labeled.
## </summary>
-@@ -2899,6 +3066,7 @@
+@@ -2899,6 +3102,7 @@
')
allow $1 home_root_t:dir getattr;
@@ -7046,7 +7120,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -2919,6 +3087,7 @@
+@@ -2919,6 +3123,7 @@
')
dontaudit $1 home_root_t:dir getattr;
@@ -7054,7 +7128,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -2937,6 +3106,7 @@
+@@ -2937,6 +3142,7 @@
')
allow $1 home_root_t:dir search_dir_perms;
@@ -7062,7 +7136,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -2956,6 +3126,7 @@
+@@ -2956,6 +3162,7 @@
')
dontaudit $1 home_root_t:dir search_dir_perms;
@@ -7070,7 +7144,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -2975,6 +3146,7 @@
+@@ -2975,6 +3182,7 @@
')
dontaudit $1 home_root_t:dir list_dir_perms;
@@ -7078,7 +7152,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -2993,6 +3165,7 @@
+@@ -2993,6 +3201,7 @@
')
allow $1 home_root_t:dir list_dir_perms;
@@ -7086,7 +7160,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -3502,6 +3675,64 @@
+@@ -3502,6 +3711,64 @@
allow $1 readable_t:sock_file read_sock_file_perms;
')
@@ -7151,7 +7225,7 @@ diff --exclude-from=exclude -N -u -r nsa
########################################
## <summary>
## Allow the specified type to associate
-@@ -3687,6 +3918,32 @@
+@@ -3687,6 +3954,32 @@
########################################
## <summary>
@@ -7184,7 +7258,7 @@ diff --exclude-from=exclude -N -u -r nsa
## Manage temporary files and directories in /tmp.
## </summary>
## <param name="domain">
-@@ -3900,6 +4157,13 @@
+@@ -3900,6 +4193,13 @@
delete_lnk_files_pattern($1, tmpfile, tmpfile)
delete_fifo_files_pattern($1, tmpfile, tmpfile)
delete_sock_files_pattern($1, tmpfile, tmpfile)
@@ -7198,7 +7272,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -4008,7 +4272,7 @@
+@@ -4008,7 +4308,7 @@
type usr_t;
')
@@ -7207,7 +7281,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -4089,6 +4353,24 @@
+@@ -4089,6 +4389,24 @@
########################################
## <summary>
@@ -7232,7 +7306,7 @@ diff --exclude-from=exclude -N -u -r nsa
## dontaudit write of /usr files
## </summary>
## <param name="domain">
-@@ -5014,6 +5296,25 @@
+@@ -5014,6 +5332,25 @@
search_dirs_pattern($1, var_t, var_run_t)
')
@@ -7258,7 +7332,7 @@ diff --exclude-from=exclude -N -u -r nsa
########################################
## <summary>
## Do not audit attempts to search
-@@ -5073,6 +5374,24 @@
+@@ -5073,6 +5410,24 @@
########################################
## <summary>
@@ -7283,7 +7357,7 @@ diff --exclude-from=exclude -N -u -r nsa
## Create an object in the process ID directory, with a private type.
## </summary>
## <desc>
-@@ -5148,6 +5467,24 @@
+@@ -5148,6 +5503,24 @@
########################################
## <summary>
@@ -7308,7 +7382,7 @@ diff --exclude-from=exclude -N -u -r nsa
## Do not audit attempts to write to daemon runtime data files.
## </summary>
## <param name="domain">
-@@ -5201,6 +5538,7 @@
+@@ -5201,6 +5574,7 @@
list_dirs_pattern($1, var_t, pidfile)
read_files_pattern($1, pidfile, pidfile)
@@ -7316,7 +7390,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -5269,6 +5607,24 @@
+@@ -5269,6 +5643,24 @@
########################################
## <summary>
@@ -7341,7 +7415,7 @@ diff --exclude-from=exclude -N -u -r nsa
## Search the contents of generic spool
## directories (/var/spool).
## </summary>
-@@ -5457,12 +5813,15 @@
+@@ -5457,12 +5849,15 @@
allow $1 poly_t:dir { create mounton };
fs_unmount_xattr_fs($1)
@@ -7358,7 +7432,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
')
-@@ -5483,3 +5842,211 @@
+@@ -5483,3 +5878,211 @@
typeattribute $1 files_unconfined_type;
')
@@ -7953,7 +8027,7 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.7.14/policy/modules/kernel/terminal.if
--- nsaserefpolicy/policy/modules/kernel/terminal.if 2010-02-18 14:06:31.000000000 -0500
-+++ serefpolicy-3.7.14/policy/modules/kernel/terminal.if 2010-03-12 09:30:00.000000000 -0500
++++ serefpolicy-3.7.14/policy/modules/kernel/terminal.if 2010-03-16 14:27:31.000000000 -0400
@@ -292,9 +292,11 @@
interface(`term_dontaudit_use_console',`
gen_require(`
@@ -7967,7 +8041,33 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -829,7 +831,7 @@
+@@ -672,6 +674,25 @@
+
+ ########################################
+ ## <summary>
++## Do not audit attempts to get attributes
++## on the pty multiplexor (/dev/ptmx).
++## </summary>
++## <param name="domain">
++## <summary>
++## The type of the process to not audit.
++## </summary>
++## </param>
++#
++interface(`term_dontaudit_getattr_ptmx',`
++ gen_require(`
++ type ptmx_t;
++ ')
++
++ dontaudit $1 ptmx_t:chr_file getattr;
++')
++
++########################################
++## <summary>
+ ## Do not audit attempts to read and
+ ## write the pty multiplexor (/dev/ptmx).
+ ## </summary>
+@@ -829,7 +850,7 @@
attribute ptynode;
')
@@ -7976,7 +8076,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -1196,7 +1198,7 @@
+@@ -1196,7 +1217,7 @@
type tty_device_t;
')
@@ -7985,7 +8085,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -1333,7 +1335,7 @@
+@@ -1333,7 +1354,7 @@
attribute ttynode;
')
@@ -11614,7 +11714,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.7.14/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2010-03-09 19:04:58.000000000 -0500
-+++ serefpolicy-3.7.14/policy/modules/services/apache.te 2010-03-12 09:30:00.000000000 -0500
++++ serefpolicy-3.7.14/policy/modules/services/apache.te 2010-03-17 09:55:47.000000000 -0400
@@ -19,6 +19,8 @@
# Declarations
#
@@ -11883,11 +11983,12 @@ diff --exclude-from=exclude -N -u -r nsa
corenet_sendrecv_http_server_packets(httpd_t)
# Signal self for shutdown
corenet_tcp_connect_http_port(httpd_t)
-@@ -342,15 +417,15 @@
+@@ -342,15 +417,16 @@
fs_getattr_all_fs(httpd_t)
fs_search_auto_mountpoints(httpd_t)
+fs_read_iso9660_files(httpd_t)
++fs_read_anon_inodefs_files(httpd_t)
auth_use_nsswitch(httpd_t)
@@ -11902,7 +12003,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_read_usr_files(httpd_t)
files_list_mnt(httpd_t)
files_search_spool(httpd_t)
-@@ -365,6 +440,10 @@
+@@ -365,6 +441,10 @@
files_read_var_lib_symlinks(httpd_t)
fs_search_auto_mountpoints(httpd_sys_script_t)
@@ -11913,7 +12014,7 @@ diff --exclude-from=exclude -N -u -r nsa
libs_read_lib_files(httpd_t)
-@@ -379,18 +458,33 @@
+@@ -379,18 +459,33 @@
userdom_use_unpriv_users_fds(httpd_t)
@@ -11951,7 +12052,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
')
-@@ -398,32 +492,71 @@
+@@ -398,32 +493,71 @@
corenet_tcp_connect_all_ports(httpd_t)
')
@@ -12028,7 +12129,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -431,14 +564,21 @@
+@@ -431,14 +565,21 @@
fs_read_nfs_symlinks(httpd_t)
')
@@ -12053,7 +12154,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
tunable_policy(`httpd_ssi_exec',`
-@@ -463,7 +603,18 @@
+@@ -463,7 +604,18 @@
')
optional_policy(`
@@ -12072,7 +12173,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -475,8 +626,24 @@
+@@ -475,8 +627,24 @@
')
optional_policy(`
@@ -12099,7 +12200,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -484,22 +651,19 @@
+@@ -484,22 +652,19 @@
mailman_domtrans_cgi(httpd_t)
# should have separate types for public and private archives
mailman_search_data(httpd_t)
@@ -12125,7 +12226,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -510,12 +674,23 @@
+@@ -510,12 +675,23 @@
')
optional_policy(`
@@ -12149,7 +12250,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
')
-@@ -524,6 +699,11 @@
+@@ -524,6 +700,11 @@
')
optional_policy(`
@@ -12161,7 +12262,7 @@ diff --exclude-from=exclude -N -u -r nsa
snmp_dontaudit_read_snmp_var_lib_files(httpd_t)
snmp_dontaudit_write_snmp_var_lib_files(httpd_t)
')
-@@ -551,6 +731,23 @@
+@@ -551,6 +732,23 @@
userdom_use_user_terminals(httpd_helper_t)
@@ -12185,7 +12286,7 @@ diff --exclude-from=exclude -N -u -r nsa
########################################
#
# Apache PHP script local policy
-@@ -580,20 +777,32 @@
+@@ -580,20 +778,32 @@
fs_search_auto_mountpoints(httpd_php_t)
@@ -12224,7 +12325,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -611,23 +820,24 @@
+@@ -611,23 +821,24 @@
append_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
read_files_pattern(httpd_suexec_t, httpd_log_t, httpd_log_t)
@@ -12253,7 +12354,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_read_etc_files(httpd_suexec_t)
files_read_usr_files(httpd_suexec_t)
-@@ -640,6 +850,7 @@
+@@ -640,6 +851,7 @@
logging_send_syslog_msg(httpd_suexec_t)
miscfiles_read_localization(httpd_suexec_t)
@@ -12261,7 +12362,7 @@ diff --exclude-from=exclude -N -u -r nsa
tunable_policy(`httpd_can_network_connect',`
allow httpd_suexec_t self:tcp_socket create_stream_socket_perms;
-@@ -647,22 +858,31 @@
+@@ -647,22 +859,31 @@
corenet_all_recvfrom_unlabeled(httpd_suexec_t)
corenet_all_recvfrom_netlabel(httpd_suexec_t)
@@ -12300,7 +12401,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -688,16 +908,16 @@
+@@ -688,16 +909,16 @@
dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
')
@@ -12321,7 +12422,7 @@ diff --exclude-from=exclude -N -u -r nsa
dontaudit httpd_sys_script_t httpd_config_t:dir search;
-@@ -712,15 +932,29 @@
+@@ -712,15 +933,29 @@
files_search_var_lib(httpd_sys_script_t)
files_search_spool(httpd_sys_script_t)
@@ -12353,7 +12454,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
tunable_policy(`httpd_enable_homedirs && use_nfs_home_dirs',`
-@@ -728,6 +962,35 @@
+@@ -728,6 +963,35 @@
fs_read_nfs_symlinks(httpd_sys_script_t)
')
@@ -12389,7 +12490,7 @@ diff --exclude-from=exclude -N -u -r nsa
tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',`
fs_read_cifs_files(httpd_sys_script_t)
fs_read_cifs_symlinks(httpd_sys_script_t)
-@@ -740,6 +1003,10 @@
+@@ -740,6 +1004,10 @@
optional_policy(`
mysql_stream_connect(httpd_sys_script_t)
mysql_rw_db_sockets(httpd_sys_script_t)
@@ -12400,7 +12501,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -751,6 +1018,8 @@
+@@ -751,6 +1019,8 @@
# httpd_rotatelogs local policy
#
@@ -12409,7 +12510,7 @@ diff --exclude-from=exclude -N -u -r nsa
manage_files_pattern(httpd_rotatelogs_t, httpd_log_t, httpd_log_t)
kernel_read_kernel_sysctls(httpd_rotatelogs_t)
-@@ -770,11 +1039,88 @@
+@@ -770,11 +1040,88 @@
tunable_policy(`httpd_enable_cgi && httpd_unified',`
allow httpd_user_script_t httpdcontent:file entrypoint;
@@ -12992,8 +13093,8 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.te serefpolicy-3.7.14/policy/modules/services/boinc.te
--- nsaserefpolicy/policy/modules/services/boinc.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.7.14/policy/modules/services/boinc.te 2010-03-15 14:49:29.000000000 -0400
-@@ -0,0 +1,76 @@
++++ serefpolicy-3.7.14/policy/modules/services/boinc.te 2010-03-16 14:27:36.000000000 -0400
+@@ -0,0 +1,80 @@
+
+policy_module(boinc,1.0.0)
+
@@ -13039,6 +13140,7 @@ diff --exclude-from=exclude -N -u -r nsa
+files_var_lib_filetrans(boinc_t, boinc_var_lib_t, { file dir } )
+
+kernel_read_system_state(boinc_t)
++kernel_read_kernel_sysctls(boinc_t)
+
+corecmd_exec_bin(boinc_t)
+corecmd_exec_shell(boinc_t)
@@ -13065,11 +13167,14 @@ diff --exclude-from=exclude -N -u -r nsa
+
+fs_getattr_all_fs(boinc_t)
+
++term_dontaudit_getattr_ptmx(boinc_t)
++
+miscfiles_read_localization(boinc_t)
+
+logging_send_syslog_msg(boinc_t)
+
+sysnet_dns_name_resolve(boinc_t)
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cachefilesd.fc serefpolicy-3.7.14/policy/modules/services/cachefilesd.fc
--- nsaserefpolicy/policy/modules/services/cachefilesd.fc 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.7.14/policy/modules/services/cachefilesd.fc 2010-03-12 09:30:00.000000000 -0500
@@ -15731,7 +15836,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow $1 devicekit_t:process { ptrace signal_perms getattr };
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.7.14/policy/modules/services/devicekit.te
--- nsaserefpolicy/policy/modules/services/devicekit.te 2009-07-29 15:15:33.000000000 -0400
-+++ serefpolicy-3.7.14/policy/modules/services/devicekit.te 2010-03-15 17:07:58.000000000 -0400
++++ serefpolicy-3.7.14/policy/modules/services/devicekit.te 2010-03-17 08:59:10.000000000 -0400
@@ -42,6 +42,8 @@
files_read_etc_files(devicekit_t)
@@ -15753,7 +15858,7 @@ diff --exclude-from=exclude -N -u -r nsa
manage_dirs_pattern(devicekit_disk_t, devicekit_tmp_t, devicekit_tmp_t)
manage_files_pattern(devicekit_disk_t, devicekit_tmp_t, devicekit_tmp_t)
-@@ -71,29 +75,61 @@
+@@ -71,29 +75,62 @@
manage_files_pattern(devicekit_disk_t, devicekit_var_lib_t, devicekit_var_lib_t)
files_var_lib_filetrans(devicekit_disk_t, devicekit_var_lib_t, dir)
@@ -15791,6 +15896,7 @@ diff --exclude-from=exclude -N -u -r nsa
+files_getattr_all_sockets(devicekit_disk_t)
+files_getattr_all_mountpoints(devicekit_disk_t)
+files_getattr_all_files(devicekit_disk_t)
++files_manage_boot_dirs(devicekit_disk_t)
+files_manage_isid_type_dirs(devicekit_disk_t)
files_manage_mnt_dirs(devicekit_disk_t)
files_read_etc_files(devicekit_disk_t)
@@ -15817,7 +15923,7 @@ diff --exclude-from=exclude -N -u -r nsa
auth_use_nsswitch(devicekit_disk_t)
miscfiles_read_localization(devicekit_disk_t)
-@@ -102,6 +138,16 @@
+@@ -102,6 +139,16 @@
userdom_search_user_home_dirs(devicekit_disk_t)
optional_policy(`
@@ -15834,7 +15940,7 @@ diff --exclude-from=exclude -N -u -r nsa
fstools_domtrans(devicekit_disk_t)
')
-@@ -110,28 +156,27 @@
+@@ -110,28 +157,27 @@
')
optional_policy(`
@@ -15872,7 +15978,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -139,9 +184,11 @@
+@@ -139,9 +185,11 @@
# DeviceKit-Power local policy
#
@@ -15885,7 +15991,7 @@ diff --exclude-from=exclude -N -u -r nsa
manage_dirs_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t)
manage_files_pattern(devicekit_power_t, devicekit_var_lib_t, devicekit_var_lib_t)
-@@ -151,6 +198,8 @@
+@@ -151,6 +199,8 @@
kernel_read_system_state(devicekit_power_t)
kernel_rw_hotplug_sysctls(devicekit_power_t)
kernel_rw_kernel_sysctl(devicekit_power_t)
@@ -15894,7 +16000,7 @@ diff --exclude-from=exclude -N -u -r nsa
corecmd_exec_bin(devicekit_power_t)
corecmd_exec_shell(devicekit_power_t)
-@@ -159,7 +208,9 @@
+@@ -159,7 +209,9 @@
domain_read_all_domains_state(devicekit_power_t)
@@ -15904,7 +16010,7 @@ diff --exclude-from=exclude -N -u -r nsa
dev_rw_netcontrol(devicekit_power_t)
dev_rw_sysfs(devicekit_power_t)
-@@ -167,12 +218,17 @@
+@@ -167,12 +219,17 @@
files_read_etc_files(devicekit_power_t)
files_read_usr_files(devicekit_power_t)
@@ -15922,7 +16028,7 @@ diff --exclude-from=exclude -N -u -r nsa
userdom_read_all_users_state(devicekit_power_t)
optional_policy(`
-@@ -180,6 +236,10 @@
+@@ -180,6 +237,10 @@
')
optional_policy(`
@@ -15933,7 +16039,7 @@ diff --exclude-from=exclude -N -u -r nsa
dbus_system_bus_client(devicekit_power_t)
allow devicekit_power_t devicekit_t:dbus send_msg;
-@@ -203,17 +263,23 @@
+@@ -203,17 +264,23 @@
optional_policy(`
hal_domtrans_mac(devicekit_power_t)
@@ -27184,7 +27290,7 @@ diff --exclude-from=exclude -N -u -r nsa
corenet_tcp_connect_http_port(httpd_w3c_validator_script_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.7.14/policy/modules/services/xserver.fc
--- nsaserefpolicy/policy/modules/services/xserver.fc 2009-07-14 14:19:57.000000000 -0400
-+++ serefpolicy-3.7.14/policy/modules/services/xserver.fc 2010-03-12 09:30:01.000000000 -0500
++++ serefpolicy-3.7.14/policy/modules/services/xserver.fc 2010-03-16 16:05:59.000000000 -0400
@@ -3,12 +3,21 @@
#
HOME_DIR/\.fonts\.conf -- gen_context(system_u:object_r:user_fonts_config_t,s0)
@@ -27236,8 +27342,8 @@ diff --exclude-from=exclude -N -u -r nsa
#
/usr/(s)?bin/gdm-binary -- gen_context(system_u:object_r:xdm_exec_t,s0)
-+/usr/bin/lxdm gen_context(system_u:object_r:xdm_exec_t,s0)
-+/usr/bin/lxdm-binary gen_context(system_u:object_r:xdm_exec_t,s0)
++/usr/(s)?bin/lxdm -- gen_context(system_u:object_r:xdm_exec_t,s0)
++/usr/(s)?bin/lxdm-binary -- gen_context(system_u:object_r:xdm_exec_t,s0)
/usr/(s)?bin/[xgkw]dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
/usr/bin/gpe-dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
/usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0)
@@ -27802,7 +27908,7 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.7.14/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2010-02-12 10:33:09.000000000 -0500
-+++ serefpolicy-3.7.14/policy/modules/services/xserver.te 2010-03-15 17:15:49.000000000 -0400
++++ serefpolicy-3.7.14/policy/modules/services/xserver.te 2010-03-17 08:37:53.000000000 -0400
@@ -36,6 +36,13 @@
## <desc>
@@ -28304,7 +28410,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -520,12 +663,49 @@
+@@ -520,12 +663,50 @@
')
optional_policy(`
@@ -28348,13 +28454,14 @@ diff --exclude-from=exclude -N -u -r nsa
optional_policy(`
+ gnome_read_gconf_config(xdm_t)
+ gnome_read_config(xdm_t)
++ gnome_append_gconf_home_files(xdm_t)
+')
+
+optional_policy(`
hostname_exec(xdm_t)
')
-@@ -543,9 +723,43 @@
+@@ -543,20 +724,59 @@
')
optional_policy(`
@@ -28398,7 +28505,13 @@ diff --exclude-from=exclude -N -u -r nsa
optional_policy(`
seutil_sigchld_newrole(xdm_t)
')
-@@ -555,8 +769,9 @@
+
+ optional_policy(`
++ shutdown_domtrans(xdm_t)
++')
++
++optional_policy(`
+ udev_read_db(xdm_t)
')
optional_policy(`
@@ -28410,7 +28523,7 @@ diff --exclude-from=exclude -N -u -r nsa
ifndef(`distro_redhat',`
allow xdm_t self:process { execheap execmem };
-@@ -565,7 +780,6 @@
+@@ -565,7 +785,6 @@
ifdef(`distro_rhel4',`
allow xdm_t self:process { execheap execmem };
')
@@ -28418,7 +28531,7 @@ diff --exclude-from=exclude -N -u -r nsa
optional_policy(`
userhelper_dontaudit_search_config(xdm_t)
-@@ -576,6 +790,10 @@
+@@ -576,6 +795,10 @@
')
optional_policy(`
@@ -28429,7 +28542,7 @@ diff --exclude-from=exclude -N -u -r nsa
xfs_stream_connect(xdm_t)
')
-@@ -600,10 +818,9 @@
+@@ -600,10 +823,9 @@
# execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack
@@ -28441,7 +28554,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow xserver_t self:fd use;
allow xserver_t self:fifo_file rw_fifo_file_perms;
allow xserver_t self:sock_file read_sock_file_perms;
-@@ -615,6 +832,18 @@
+@@ -615,6 +837,18 @@
allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow xserver_t self:tcp_socket create_stream_socket_perms;
allow xserver_t self:udp_socket create_socket_perms;
@@ -28460,7 +28573,7 @@ diff --exclude-from=exclude -N -u -r nsa
manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
-@@ -634,12 +863,19 @@
+@@ -634,12 +868,19 @@
manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
files_search_var_lib(xserver_t)
@@ -28482,7 +28595,7 @@ diff --exclude-from=exclude -N -u -r nsa
kernel_read_system_state(xserver_t)
kernel_read_device_sysctls(xserver_t)
-@@ -673,7 +909,6 @@
+@@ -673,7 +914,6 @@
dev_rw_agp(xserver_t)
dev_rw_framebuffer(xserver_t)
dev_manage_dri_dev(xserver_t)
@@ -28490,7 +28603,7 @@ diff --exclude-from=exclude -N -u -r nsa
dev_create_generic_dirs(xserver_t)
dev_setattr_generic_dirs(xserver_t)
# raw memory access is needed if not using the frame buffer
-@@ -683,9 +918,12 @@
+@@ -683,9 +923,12 @@
dev_rw_xserver_misc(xserver_t)
# read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev(xserver_t)
@@ -28504,7 +28617,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_read_etc_files(xserver_t)
files_read_etc_runtime_files(xserver_t)
-@@ -700,8 +938,13 @@
+@@ -700,8 +943,13 @@
fs_search_nfs(xserver_t)
fs_search_auto_mountpoints(xserver_t)
fs_search_ramfs(xserver_t)
@@ -28518,7 +28631,7 @@ diff --exclude-from=exclude -N -u -r nsa
selinux_validate_context(xserver_t)
selinux_compute_access_vector(xserver_t)
-@@ -723,11 +966,14 @@
+@@ -723,11 +971,14 @@
miscfiles_read_localization(xserver_t)
miscfiles_read_fonts(xserver_t)
@@ -28533,7 +28646,7 @@ diff --exclude-from=exclude -N -u -r nsa
userdom_search_user_home_dirs(xserver_t)
userdom_use_user_ttys(xserver_t)
-@@ -779,12 +1025,24 @@
+@@ -779,12 +1030,24 @@
')
optional_policy(`
@@ -28559,7 +28672,7 @@ diff --exclude-from=exclude -N -u -r nsa
unconfined_domtrans(xserver_t)
')
-@@ -811,7 +1069,7 @@
+@@ -811,7 +1074,7 @@
allow xserver_t xdm_var_lib_t:file { getattr read };
dontaudit xserver_t xdm_var_lib_t:dir search;
@@ -28568,7 +28681,7 @@ diff --exclude-from=exclude -N -u -r nsa
# Label pid and temporary files with derived types.
manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
-@@ -832,9 +1090,14 @@
+@@ -832,9 +1095,14 @@
# to read ROLE_home_t - examine this in more detail
# (xauth?)
userdom_read_user_home_content_files(xserver_t)
@@ -28583,7 +28696,7 @@ diff --exclude-from=exclude -N -u -r nsa
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(xserver_t)
fs_manage_nfs_files(xserver_t)
-@@ -849,11 +1112,14 @@
+@@ -849,11 +1117,14 @@
optional_policy(`
dbus_system_bus_client(xserver_t)
@@ -28600,7 +28713,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -999,3 +1265,33 @@
+@@ -999,3 +1270,33 @@
allow xserver_unconfined_type xextension_type:x_extension *;
allow xserver_unconfined_type { x_domain xserver_t }:x_resource *;
allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *;
@@ -31768,7 +31881,7 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.7.14/policy/modules/system/mount.te
--- nsaserefpolicy/policy/modules/system/mount.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.14/policy/modules/system/mount.te 2010-03-12 09:30:01.000000000 -0500
++++ serefpolicy-3.7.14/policy/modules/system/mount.te 2010-03-16 17:04:35.000000000 -0400
@@ -18,8 +18,15 @@
init_system_domain(mount_t, mount_exec_t)
role system_r types mount_t;
@@ -31818,7 +31931,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow mount_t mount_loopback_t:file read_file_perms;
-@@ -47,21 +71,38 @@
+@@ -47,30 +71,49 @@
files_tmp_filetrans(mount_t, mount_tmp_t, { file dir })
@@ -31858,8 +31971,11 @@ diff --exclude-from=exclude -N -u -r nsa
files_search_all(mount_t)
files_read_etc_files(mount_t)
-@@ -70,7 +111,7 @@
+ files_manage_etc_runtime_files(mount_t)
+ files_etc_filetrans_etc_runtime(mount_t, file)
files_mounton_all_mountpoints(mount_t)
++# ntfs-3g checks whether the mountpoint is writable before mounting
++files_write_all_mountpoints(mount_t)
files_unmount_rootfs(mount_t)
# These rules need to be generalized. Only admin, initrc should have it:
-files_relabelto_all_file_type_fs(mount_t)
@@ -31867,7 +31983,7 @@ diff --exclude-from=exclude -N -u -r nsa
files_mount_all_file_type_fs(mount_t)
files_unmount_all_file_type_fs(mount_t)
# for when /etc/mtab loses its type
-@@ -80,15 +121,18 @@
+@@ -80,15 +123,18 @@
files_read_usr_files(mount_t)
files_list_mnt(mount_t)
@@ -31889,7 +32005,7 @@ diff --exclude-from=exclude -N -u -r nsa
mls_file_read_all_levels(mount_t)
mls_file_write_all_levels(mount_t)
-@@ -99,6 +143,7 @@
+@@ -99,6 +145,7 @@
storage_raw_write_fixed_disk(mount_t)
storage_raw_read_removable_device(mount_t)
storage_raw_write_removable_device(mount_t)
@@ -31897,7 +32013,7 @@ diff --exclude-from=exclude -N -u -r nsa
term_use_all_terms(mount_t)
-@@ -107,6 +152,8 @@
+@@ -107,6 +154,8 @@
init_use_fds(mount_t)
init_use_script_ptys(mount_t)
init_dontaudit_getattr_initctl(mount_t)
@@ -31906,7 +32022,7 @@ diff --exclude-from=exclude -N -u -r nsa
logging_send_syslog_msg(mount_t)
-@@ -117,6 +164,8 @@
+@@ -117,6 +166,8 @@
seutil_read_config(mount_t)
userdom_use_all_users_fds(mount_t)
@@ -31915,7 +32031,7 @@ diff --exclude-from=exclude -N -u -r nsa
ifdef(`distro_redhat',`
optional_policy(`
-@@ -132,10 +181,17 @@
+@@ -132,10 +183,17 @@
')
')
@@ -31933,7 +32049,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -165,6 +221,8 @@
+@@ -165,6 +223,8 @@
fs_search_rpc(mount_t)
rpc_stub(mount_t)
@@ -31942,7 +32058,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
optional_policy(`
-@@ -172,6 +230,25 @@
+@@ -172,6 +232,25 @@
')
optional_policy(`
@@ -31968,7 +32084,7 @@ diff --exclude-from=exclude -N -u -r nsa
ifdef(`hide_broken_symptoms',`
# for a bug in the X server
rhgb_dontaudit_rw_stream_sockets(mount_t)
-@@ -179,6 +256,11 @@
+@@ -179,6 +258,11 @@
')
')
@@ -31980,7 +32096,7 @@ diff --exclude-from=exclude -N -u -r nsa
# for kernel package installation
optional_policy(`
rpm_rw_pipes(mount_t)
-@@ -186,6 +268,19 @@
+@@ -186,6 +270,19 @@
optional_policy(`
samba_domtrans_smbmount(mount_t)
@@ -32000,7 +32116,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
########################################
-@@ -195,5 +290,41 @@
+@@ -195,5 +292,41 @@
optional_policy(`
files_etc_filetrans_etc_runtime(unconfined_mount_t, file)
@@ -33546,8 +33662,33 @@ diff --exclude-from=exclude -N -u -r nsa
+/var/run/libgpod(/.*)? gen_context(system_u:object_r:udev_var_run_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.if serefpolicy-3.7.14/policy/modules/system/udev.if
--- nsaserefpolicy/policy/modules/system/udev.if 2010-03-03 23:26:37.000000000 -0500
-+++ serefpolicy-3.7.14/policy/modules/system/udev.if 2010-03-12 09:30:01.000000000 -0500
-@@ -192,6 +192,7 @@
++++ serefpolicy-3.7.14/policy/modules/system/udev.if 2010-03-16 15:36:01.000000000 -0400
+@@ -20,6 +20,24 @@
+
+ ########################################
+ ## <summary>
++## Send kill signals to udev.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`udev_kill',`
++ gen_require(`
++ type udev_t;
++ ')
++
++ allow $1 udev_t:process sigkill;
++')
++
++########################################
++## <summary>
+ ## Execute udev in the udev domain.
+ ## </summary>
+ ## <param name="domain">
+@@ -192,6 +210,7 @@
dev_list_all_dev_nodes($1)
allow $1 udev_tbl_t:file rw_file_perms;
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-13/selinux-policy.spec,v
retrieving revision 1.987
retrieving revision 1.988
diff -u -p -r1.987 -r1.988
--- selinux-policy.spec 15 Mar 2010 21:02:57 -0000 1.987
+++ selinux-policy.spec 17 Mar 2010 14:08:33 -0000 1.988
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.7.14
-Release: 4%{?dist}
+Release: 5%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -466,6 +466,12 @@ exit 0
%endif
%changelog
+* Tue Mar 16 2010 Dan Walsh <dwalsh at redhat.com> 3.7.14-5
+- Allow boinc to read kernel sysctl
+- Fix snmp port definitions
+- Allow apache to read anon_inodefs
+
+
* Sun Mar 14 2010 Dan Walsh <dwalsh at redhat.com> 3.7.14-4
- Allow shutdown dac_override
More information about the scm-commits
mailing list