rpms/selinux-policy/F-11 policy-20090521.patch, 1.67, 1.68 selinux-policy.spec, 1.917, 1.918

Miroslav Grepl mgrepl at fedoraproject.org
Tue Mar 23 17:35:58 UTC 2010 

Author: mgrepl

Update of /cvs/pkgs/rpms/selinux-policy/F-11
In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv13100

Modified Files:
	policy-20090521.patch selinux-policy.spec 
Log Message:
- Dontaudit fail2ban leaks



policy-20090521.patch:
 man/man8/nfs_selinux.8                    |    6 
 man/man8/samba_selinux.8                  |    4 
 policy/mcs                                |   12 -
 policy/modules/admin/certwatch.te         |    4 
 policy/modules/admin/dmesg.te             |    3 
 policy/modules/admin/kismet.te            |   16 +
 policy/modules/admin/logrotate.te         |    6 
 policy/modules/admin/mrtg.te              |    8 
 policy/modules/admin/netutils.te          |    2 
 policy/modules/admin/prelink.te           |    9 
 policy/modules/admin/readahead.te         |    2 
 policy/modules/admin/rpm.fc               |    1 
 policy/modules/admin/rpm.if               |   46 +++++
 policy/modules/admin/rpm.te               |    4 
 policy/modules/admin/shorewall.fc         |   13 +
 policy/modules/admin/shorewall.if         |  166 ++++++++++++++++++
 policy/modules/admin/shorewall.te         |  103 +++++++++++
 policy/modules/admin/sudo.if              |    4 
 policy/modules/admin/tzdata.te            |    2 
 policy/modules/admin/usermanage.if        |    3 
 policy/modules/admin/usermanage.te        |    3 
 policy/modules/admin/vpn.te               |    1 
 policy/modules/apps/awstats.te            |    2 
 policy/modules/apps/calamaris.te          |    4 
 policy/modules/apps/gitosis.fc            |    4 
 policy/modules/apps/gitosis.if            |   96 ++++++++++
 policy/modules/apps/gitosis.te            |   43 ++++
 policy/modules/apps/gnome.te              |   10 +
 policy/modules/apps/gpg.if                |    2 
 policy/modules/apps/gpg.te                |    1 
 policy/modules/apps/java.te               |    2 
 policy/modules/apps/mozilla.if            |   16 +
 policy/modules/apps/mozilla.te            |   14 -
 policy/modules/apps/nsplugin.if           |    2 
 policy/modules/apps/ptchown.fc            |    2 
 policy/modules/apps/ptchown.if            |   22 ++
 policy/modules/apps/ptchown.te            |   40 ++++
 policy/modules/apps/qemu.fc               |    1 
 policy/modules/apps/qemu.te               |    8 
 policy/modules/apps/sandbox.if            |  134 +++++++++++---
 policy/modules/apps/sandbox.te            |  274 +++++++++++++++++++++++++++---
 policy/modules/apps/screen.if             |    1 
 policy/modules/apps/slocate.te            |    1 
 policy/modules/apps/vmware.fc             |    1 
 policy/modules/apps/vmware.te             |    6 
 policy/modules/kernel/corecommands.fc     |   10 -
 policy/modules/kernel/corenetwork.if.in   |   18 +
 policy/modules/kernel/corenetwork.te.in   |    5 
 policy/modules/kernel/devices.fc          |    3 
 policy/modules/kernel/devices.if          |  145 +++++++++++++++
 policy/modules/kernel/devices.te          |   13 +
 policy/modules/kernel/domain.if           |   45 +---
 policy/modules/kernel/domain.te           |   31 +++
 policy/modules/kernel/files.if            |    4 
 policy/modules/kernel/kernel.if           |    2 
 policy/modules/kernel/storage.fc          |    1 
 policy/modules/kernel/storage.if          |    2 
 policy/modules/kernel/terminal.if         |   19 ++
 policy/modules/roles/staff.te             |   12 +
 policy/modules/roles/sysadm.if            |   35 +++
 policy/modules/roles/sysadm.te            |    4 
 policy/modules/roles/unconfineduser.te    |   10 -
 policy/modules/roles/unprivuser.te        |    4 
 policy/modules/roles/xguest.te            |    6 
 policy/modules/services/afs.fc            |    2 
 policy/modules/services/afs.te            |    1 
 policy/modules/services/apache.fc         |    5 
 policy/modules/services/apache.if         |    3 
 policy/modules/services/apache.te         |   16 +
 policy/modules/services/apm.te            |    4 
 policy/modules/services/automount.if      |   18 +
 policy/modules/services/avahi.te          |    3 
 policy/modules/services/bluetooth.te      |    1 
 policy/modules/services/clamav.te         |    6 
 policy/modules/services/cobbler.fc        |    2 
 policy/modules/services/cobbler.if        |   21 ++
 policy/modules/services/cobbler.te        |   10 +
 policy/modules/services/consolekit.te     |    5 
 policy/modules/services/cron.if           |   19 --
 policy/modules/services/cron.te           |    2 
 policy/modules/services/cups.fc           |    2 
 policy/modules/services/cups.te           |   29 ++-
 policy/modules/services/cyrus.te          |    1 
 policy/modules/services/dbus.if           |   28 +++
 policy/modules/services/dcc.te            |   10 -
 policy/modules/services/ddclient.if       |   25 ++
 policy/modules/services/devicekit.te      |    6 
 policy/modules/services/dnsmasq.te        |    8 
 policy/modules/services/dovecot.if        |   34 +--
 policy/modules/services/dovecot.te        |   39 +++-
 policy/modules/services/exim.te           |    7 
 policy/modules/services/fail2ban.if       |   38 ++++
 policy/modules/services/fail2ban.te       |    1 
 policy/modules/services/fetchmail.te      |    2 
 policy/modules/services/fprintd.te        |   10 -
 policy/modules/services/ftp.te            |   15 +
 policy/modules/services/gnomeclock.te     |    1 
 policy/modules/services/gpsd.fc           |    3 
 policy/modules/services/gpsd.te           |   19 +-
 policy/modules/services/hal.te            |   15 +
 policy/modules/services/hddtemp.fc        |    4 
 policy/modules/services/hddtemp.if        |   38 ++++
 policy/modules/services/hddtemp.te        |   40 ++++
 policy/modules/services/kerberos.if       |    2 
 policy/modules/services/kerberos.te       |   12 +
 policy/modules/services/lircd.te          |    7 
 policy/modules/services/mailman.if        |    1 
 policy/modules/services/milter.if         |    2 
 policy/modules/services/mta.if            |    1 
 policy/modules/services/mta.te            |    1 
 policy/modules/services/mysql.te          |    7 
 policy/modules/services/networkmanager.fc |    2 
 policy/modules/services/networkmanager.te |    3 
 policy/modules/services/nis.te            |    3 
 policy/modules/services/nslcd.fc          |    4 
 policy/modules/services/nslcd.if          |  144 +++++++++++++++
 policy/modules/services/nslcd.te          |   50 +++++
 policy/modules/services/nx.fc             |    3 
 policy/modules/services/nx.if             |   20 ++
 policy/modules/services/openvpn.te        |   14 +
 policy/modules/services/pcscd.if          |    3 
 policy/modules/services/pcscd.te          |    3 
 policy/modules/services/polkit.fc         |    2 
 policy/modules/services/polkit.if         |    2 
 policy/modules/services/polkit.te         |    3 
 policy/modules/services/postfix.if        |   26 ++
 policy/modules/services/postfix.te        |   27 --
 policy/modules/services/postgresql.te     |    2 
 policy/modules/services/ppp.if            |    6 
 policy/modules/services/ppp.te            |    2 
 policy/modules/services/privoxy.te        |    3 
 policy/modules/services/pyzor.fc          |    2 
 policy/modules/services/pyzor.te          |    2 
 policy/modules/services/radvd.te          |    2 
 policy/modules/services/rpc.te            |   15 +
 policy/modules/services/rpcbind.if        |   20 ++
 policy/modules/services/rsync.te          |    2 
 policy/modules/services/samba.te          |   13 +
 policy/modules/services/sasl.te           |    6 
 policy/modules/services/sendmail.if       |   39 ++++
 policy/modules/services/sendmail.te       |    8 
 policy/modules/services/setroubleshoot.te |    5 
 policy/modules/services/shorewall.fc      |   12 -
 policy/modules/services/shorewall.if      |  166 ------------------
 policy/modules/services/shorewall.te      |  102 -----------
 policy/modules/services/smartmon.te       |    4 
 policy/modules/services/snmp.if           |   37 ++++
 policy/modules/services/snmp.te           |    4 
 policy/modules/services/spamassassin.fc   |    8 
 policy/modules/services/spamassassin.if   |   18 +
 policy/modules/services/spamassassin.te   |    6 
 policy/modules/services/squid.te          |    2 
 policy/modules/services/ssh.if            |   23 ++
 policy/modules/services/ssh.te            |   14 +
 policy/modules/services/sssd.fc           |    7 
 policy/modules/services/sssd.if           |   16 -
 policy/modules/services/sssd.te           |   41 ++--
 policy/modules/services/tftp.fc           |    2 
 policy/modules/services/uucp.te           |    2 
 policy/modules/services/virt.fc           |    1 
 policy/modules/services/virt.te           |   30 ++-
 policy/modules/services/xserver.fc        |    3 
 policy/modules/services/xserver.if        |   41 ++++
 policy/modules/services/xserver.te        |   18 +
 policy/modules/system/authlogin.fc        |    3 
 policy/modules/system/authlogin.if        |  270 ++++++++++++++++++-----------
 policy/modules/system/authlogin.te        |   27 +-
 policy/modules/system/hotplug.te          |    4 
 policy/modules/system/init.fc             |    2 
 policy/modules/system/init.if             |   23 ++
 policy/modules/system/init.te             |    6 
 policy/modules/system/ipsec.te            |   61 +++++-
 policy/modules/system/iptables.te         |   11 +
 policy/modules/system/iscsi.te            |    1 
 policy/modules/system/libraries.fc        |   21 ++
 policy/modules/system/locallogin.te       |    6 
 policy/modules/system/logging.fc          |    2 
 policy/modules/system/logging.te          |    4 
 policy/modules/system/miscfiles.fc        |    1 
 policy/modules/system/miscfiles.if        |   18 +
 policy/modules/system/mount.if            |    8 
 policy/modules/system/mount.te            |    1 
 policy/modules/system/sysnetwork.if       |    1 
 policy/modules/system/sysnetwork.te       |   17 +
 policy/modules/system/udev.fc             |    1 
 policy/modules/system/udev.te             |   10 +
 policy/modules/system/unconfined.if       |    2 
 policy/modules/system/userdomain.fc       |    1 
 policy/modules/system/userdomain.if       |   57 +++++-
 policy/modules/system/userdomain.te       |    4 
 policy/modules/system/virtual.te          |    5 
 policy/modules/system/xen.te              |    1 
 192 files changed, 2865 insertions(+), 695 deletions(-)

Index: policy-20090521.patch
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/F-11/policy-20090521.patch,v
retrieving revision 1.67
retrieving revision 1.68
diff -u -p -r1.67 -r1.68
--- policy-20090521.patch	19 Feb 2010 16:24:29 -0000	1.67
+++ policy-20090521.patch	23 Mar 2010 17:35:56 -0000	1.68
@@ -2903,7 +2903,16 @@ diff -b -B --ignore-all-space --exclude-
 +
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.te serefpolicy-3.6.12/policy/modules/services/dcc.te
 --- nsaserefpolicy/policy/modules/services/dcc.te	2010-01-19 12:51:12.038608550 +0100
-+++ serefpolicy-3.6.12/policy/modules/services/dcc.te	2010-01-19 12:51:30.769617885 +0100
++++ serefpolicy-3.6.12/policy/modules/services/dcc.te	2010-03-04 09:45:09.255844739 +0100
+@@ -81,7 +81,7 @@
+ # dcc daemon controller local policy
+ #
+ 
+-allow cdcc_t self:capability setuid;
++allow cdcc_t self:capability { setgid setuid };
+ allow cdcc_t self:unix_dgram_socket create_socket_perms;
+ allow cdcc_t self:udp_socket create_socket_perms;
+ 
 @@ -130,11 +130,13 @@
  
  # Access files in /var/dcc. The map file can be updated
@@ -3243,11 +3252,31 @@ diff -b -B --ignore-all-space --exclude-
  optional_policy(`
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.if serefpolicy-3.6.12/policy/modules/services/fail2ban.if
 --- nsaserefpolicy/policy/modules/services/fail2ban.if	2010-01-19 12:51:12.050618388 +0100
-+++ serefpolicy-3.6.12/policy/modules/services/fail2ban.if	2010-01-19 13:00:27.397857214 +0100
-@@ -98,6 +98,24 @@
++++ serefpolicy-3.6.12/policy/modules/services/fail2ban.if	2010-03-23 18:28:08.468391521 +0100
+@@ -98,6 +98,44 @@
  	allow $1 fail2ban_var_run_t:file read_file_perms;
  ')
  
++#######################################
++## <summary>
++##  dontaudit read and write an leaked file descriptors
++## </summary>
++## <param name="domain">
++##  <summary>
++##  The type of the process performing this action.
++##  </summary>
++## </param>
++#
++nterface(`fail2ban_dontaudit_leaks',`
++    gen_require(`
++        type fail2ban_t;
++    ')
++
++    dontaudit $1 fail2ban_t:tcp_socket { read write };
++    dontaudit $1 fail2ban_t:unix_dgram_socket { read write };
++    dontaudit $1 fail2ban_t:unix_stream_socket { read write };
++')
++
 +######################################
 +## <summary>
 +## Read and write to an fail2ban unix stream socket.
@@ -3720,6 +3749,17 @@ diff -b -B --ignore-all-space --exclude-
  ')
  
  ########################################
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.6.12/policy/modules/services/mta.te
+--- nsaserefpolicy/policy/modules/services/mta.te	2010-01-19 12:51:12.093617992 +0100
++++ serefpolicy-3.6.12/policy/modules/services/mta.te	2010-03-23 18:26:03.906640813 +0100
+@@ -187,6 +187,7 @@
+ 
+ optional_policy(`
+ 	fail2ban_append_log(system_mail_t)
++	fail2ban_dontaudit_leaks(system_mail_t)
+ 	')
+ 
+ 	optional_policy(`
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.6.12/policy/modules/services/mysql.te
 --- nsaserefpolicy/policy/modules/services/mysql.te	2010-01-19 12:51:12.099608000 +0100
 +++ serefpolicy-3.6.12/policy/modules/services/mysql.te	2010-01-19 12:51:30.790607217 +0100
@@ -6405,7 +6445,7 @@ diff -b -B --ignore-all-space --exclude-
  ipsec_setcontext_default_spd(setkey_t)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.6.12/policy/modules/system/iptables.te
 --- nsaserefpolicy/policy/modules/system/iptables.te	2010-01-19 12:51:12.220618087 +0100
-+++ serefpolicy-3.6.12/policy/modules/system/iptables.te	2010-02-19 17:01:13.929787818 +0100
++++ serefpolicy-3.6.12/policy/modules/system/iptables.te	2010-03-23 18:30:23.380639305 +0100
 @@ -43,6 +43,7 @@
  kernel_use_fds(iptables_t)
  
@@ -6422,7 +6462,15 @@ diff -b -B --ignore-all-space --exclude-
  
  logging_send_syslog_msg(iptables_t)
  
-@@ -101,10 +103,18 @@
+@@ -80,6 +82,7 @@
+ 
+ optional_policy(`
+ 	fail2ban_append_log(iptables_t)
++	fail2ban_dontaudit_leaks(iptables_t)
+ ')
+ 
+ optional_policy(`
+@@ -101,10 +104,18 @@
  ')
  
  optional_policy(`
@@ -6454,8 +6502,8 @@ diff -b -B --ignore-all-space --exclude-
  
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.6.12/policy/modules/system/libraries.fc
 --- nsaserefpolicy/policy/modules/system/libraries.fc	2010-01-19 12:51:12.224618317 +0100
-+++ serefpolicy-3.6.12/policy/modules/system/libraries.fc	2010-01-19 12:51:30.901607506 +0100
-@@ -139,8 +139,10 @@
++++ serefpolicy-3.6.12/policy/modules/system/libraries.fc	2010-02-25 12:39:10.321617329 +0100
+@@ -139,14 +139,17 @@
  /usr/lib(64)?/(nvidia/)?libGL(core)?\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib(64)?/fglrx/.*\.so(\.[^/]*)*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib(64)?/libGLU\.so(\.[^/]*)*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -6466,7 +6514,14 @@ diff -b -B --ignore-all-space --exclude-
  /usr/lib(64)?/sse2/libx264\.so(\.[^/]*)* 	-- gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib(64)?(/.*)?/libnvidia.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib(64)?(/.*)?/nvidia_drv.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -159,6 +161,10 @@
+ /usr/lib(64)?/nvidia-graphics(-[^/]*/)?libGL(core)?\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/nvidia-graphics(-[^/]*/)?libnvidia.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/nvidia-graphics(-[^/]*/)?libXvMCNVIDIA\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/vdpau/libvdpau_nvidia\.so.*  --   gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/xorg/libGL\.so(\.[^/]*)*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/xorg/modules/glesx\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/xulrunner-[^/]*/libgtkembedmoz\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+@@ -159,6 +162,10 @@
  /usr/NX/lib/libjpeg\.so.* 		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
  
  /usr/X11R6/lib/libGL\.so.* 		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -6477,7 +6532,7 @@ diff -b -B --ignore-all-space --exclude-
  /usr/X11R6/lib/libXvMCNVIDIA\.so.* 	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
  
  /usr/x11R6/lib/modules/extensions/libglx\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -167,6 +173,8 @@
+@@ -167,6 +174,8 @@
  /usr/lib(64)?/xorg/modules/drivers/nvidia_drv\.o -- gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib(64)?/xorg/modules/extensions/nvidia(-[^/]*)?/libglx\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
  
@@ -6486,7 +6541,7 @@ diff -b -B --ignore-all-space --exclude-
  ifdef(`distro_debian',`
  /usr/lib32				-l	gen_context(system_u:object_r:lib_t,s0)
  ')
-@@ -190,6 +198,7 @@
+@@ -190,6 +199,7 @@
  /usr/lib/firefox-[^/]*/plugins/nppdf.so	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib/libFLAC\.so.*			--	gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib/mozilla/plugins/nppdf\.so 	-- 	gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -6494,7 +6549,7 @@ diff -b -B --ignore-all-space --exclude-
  /usr/lib/maxima/[^/]+/binary-gcl/maxima	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib/mozilla/plugins/libvlcplugin\.so --	gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib/nx/libXcomp\.so.*		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -284,6 +293,7 @@
+@@ -284,6 +294,7 @@
  /usr/lib(64)?/python2.4/site-packages/M2Crypto/__m2crypto\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
  
  # vmware 
@@ -6502,7 +6557,7 @@ diff -b -B --ignore-all-space --exclude-
  /usr/lib(64)?/vmware/lib(/.*)?/libgdk-x11-.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib(64)?/vmware/lib(/.*)?/HConfig\.so --	gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib(64)?/vmware/(.*/)?VmPerl\.so	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -329,6 +339,8 @@
+@@ -329,6 +340,8 @@
  
  /var/mailman/pythonlib(/.*)?/.+\.so(\..*)? --	gen_context(system_u:object_r:lib_t,s0)
  
@@ -6511,7 +6566,7 @@ diff -b -B --ignore-all-space --exclude-
  /var/lib/spamassassin/compiled/.*\.so.*    --     gen_context(system_u:object_r:lib_t,s0)
  
  ifdef(`distro_suse',`
-@@ -366,9 +378,17 @@
+@@ -366,9 +379,17 @@
  /usr/matlab.*\.so(\.[^/]*)*		gen_context(system_u:object_r:textrel_shlib_t,s0)
  /opt/local/matlab.*\.so(\.[^/]*)*	gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/local/matlab.*\.so(\.[^/]*)*	gen_context(system_u:object_r:textrel_shlib_t,s0)


Index: selinux-policy.spec
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/F-11/selinux-policy.spec,v
retrieving revision 1.917
retrieving revision 1.918
diff -u -p -r1.917 -r1.918
--- selinux-policy.spec	19 Feb 2010 16:24:29 -0000	1.917
+++ selinux-policy.spec	23 Mar 2010 17:35:57 -0000	1.918
@@ -20,7 +20,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.6.12
-Release: 95%{?dist}
+Release: 96%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -442,6 +442,9 @@ exit 0
 %endif
 
 %changelog
+* Tue Mar 23 2010 Miroslav Grepl <mgrepl at redhat.com> 3.6.12-96
+- Dontaudit fail2ban leaks 
+
 * Fri Feb 19 2010 Miroslav Grepl <mgrepl at redhat.com> 3.6.12-95
 - Fixes for avahi policy

More information about the scm-commits mailing list