rpms/selinux-policy/F-12 policy-20100106.patch, 1.55, 1.56 selinux-policy.spec, 1.1041, 1.1042
Miroslav Grepl
mgrepl at fedoraproject.org
Fri Mar 26 14:46:29 UTC 2010
Author: mgrepl
Update of /cvs/pkgs/rpms/selinux-policy/F-12
In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv627
Modified Files:
policy-20100106.patch selinux-policy.spec
Log Message:
- Allow pppd to read and write to modem devices
policy-20100106.patch:
config/appconfig-mcs/x_contexts | 109 ----
config/appconfig-mls/x_contexts | 109 ----
config/appconfig-standard/x_contexts | 109 ----
policy/flask/access_vectors | 55 +-
policy/flask/security_classes | 4
policy/modules/admin/consoletype.if | 4
policy/modules/admin/dmesg.fc | 1
policy/modules/admin/logrotate.te | 13
policy/modules/admin/logwatch.te | 5
policy/modules/admin/mcelog.fc | 2
policy/modules/admin/mcelog.if | 20
policy/modules/admin/mcelog.te | 31 +
policy/modules/admin/netutils.fc | 1
policy/modules/admin/netutils.te | 6
policy/modules/admin/prelink.te | 3
policy/modules/admin/quota.te | 1
policy/modules/admin/readahead.te | 3
policy/modules/admin/rpm.if | 60 ++
policy/modules/admin/rpm.te | 2
policy/modules/admin/shutdown.fc | 5
policy/modules/admin/shutdown.if | 100 ++++
policy/modules/admin/shutdown.te | 57 ++
policy/modules/admin/smoltclient.te | 2
policy/modules/admin/usermanage.te | 8
policy/modules/admin/vbetool.te | 13
policy/modules/admin/vpn.te | 7
policy/modules/apps/cdrecord.te | 2
policy/modules/apps/chrome.if | 5
policy/modules/apps/chrome.te | 15
policy/modules/apps/execmem.if | 10
policy/modules/apps/firewallgui.te | 6
policy/modules/apps/gnome.fc | 9
policy/modules/apps/gnome.if | 99 +++-
policy/modules/apps/gnome.te | 8
policy/modules/apps/gpg.fc | 2
policy/modules/apps/gpg.te | 10
policy/modules/apps/java.if | 1
policy/modules/apps/java.te | 1
policy/modules/apps/kdumpgui.te | 4
policy/modules/apps/mozilla.fc | 1
policy/modules/apps/mozilla.if | 36 +
policy/modules/apps/nsplugin.fc | 1
policy/modules/apps/nsplugin.if | 40 +
policy/modules/apps/nsplugin.te | 10
policy/modules/apps/openoffice.if | 1
policy/modules/apps/podsleuth.te | 1
policy/modules/apps/ptchown.te | 1
policy/modules/apps/pulseaudio.fc | 7
policy/modules/apps/pulseaudio.if | 70 ++
policy/modules/apps/pulseaudio.te | 41 +
policy/modules/apps/qemu.te | 1
policy/modules/apps/sambagui.te | 4
policy/modules/apps/sandbox.if | 54 +-
policy/modules/apps/sandbox.te | 49 +
policy/modules/apps/slocate.te | 3
policy/modules/apps/vmware.if | 18
policy/modules/apps/vmware.te | 11
policy/modules/apps/wine.if | 5
policy/modules/apps/wine.te | 18
policy/modules/apps/wm.if | 16
policy/modules/kernel/corecommands.fc | 5
policy/modules/kernel/corenetwork.if.in | 18
policy/modules/kernel/corenetwork.te.in | 11
policy/modules/kernel/devices.fc | 5
policy/modules/kernel/devices.if | 335 ++++++++++++-
policy/modules/kernel/devices.te | 25 -
policy/modules/kernel/domain.if | 24
policy/modules/kernel/domain.te | 6
policy/modules/kernel/files.fc | 2
policy/modules/kernel/files.if | 352 +++++++++++---
policy/modules/kernel/files.te | 7
policy/modules/kernel/filesystem.if | 212 ++++++++
policy/modules/kernel/filesystem.te | 12
policy/modules/kernel/kernel.if | 36 +
policy/modules/kernel/terminal.if | 247 +++++++++-
policy/modules/roles/auditadm.te | 2
policy/modules/roles/secadm.te | 2
policy/modules/roles/staff.te | 20
policy/modules/roles/sysadm.te | 12
policy/modules/roles/unconfineduser.fc | 5
policy/modules/roles/unconfineduser.te | 16
policy/modules/roles/unprivuser.te | 2
policy/modules/roles/xguest.te | 7
policy/modules/services/abrt.if | 5
policy/modules/services/abrt.te | 26 +
policy/modules/services/afs.te | 6
policy/modules/services/aisexec.fc | 2
policy/modules/services/aisexec.te | 8
policy/modules/services/amavis.te | 1
policy/modules/services/apache.fc | 11
policy/modules/services/apache.if | 48 +
policy/modules/services/apache.te | 47 +
policy/modules/services/apcupsd.te | 6
policy/modules/services/arpwatch.te | 2
policy/modules/services/asterisk.if | 19
policy/modules/services/asterisk.te | 1
policy/modules/services/avahi.fc | 2
policy/modules/services/avahi.if | 1
policy/modules/services/bind.if | 19
policy/modules/services/bluetooth.te | 2
policy/modules/services/cachefilesd.fc | 28 +
policy/modules/services/cachefilesd.if | 41 +
policy/modules/services/cachefilesd.te | 146 +++++
policy/modules/services/ccs.te | 6
policy/modules/services/chronyd.fc | 2
policy/modules/services/chronyd.te | 15
policy/modules/services/clogd.if | 24
policy/modules/services/clogd.te | 7
policy/modules/services/cobbler.fc | 5
policy/modules/services/cobbler.if | 156 ++++++
policy/modules/services/cobbler.te | 132 +++++
policy/modules/services/consolekit.te | 19
policy/modules/services/corosync.fc | 3
policy/modules/services/corosync.te | 15
policy/modules/services/cron.if | 18
policy/modules/services/cron.te | 9
policy/modules/services/cups.te | 8
policy/modules/services/dbus.if | 7
policy/modules/services/dcc.te | 2
policy/modules/services/devicekit.fc | 4
policy/modules/services/devicekit.te | 14
policy/modules/services/dhcp.if | 19
policy/modules/services/dhcp.te | 4
policy/modules/services/djbdns.if | 38 +
policy/modules/services/djbdns.te | 8
policy/modules/services/dnsmasq.fc | 2
policy/modules/services/dnsmasq.if | 38 +
policy/modules/services/dnsmasq.te | 8
policy/modules/services/dovecot.te | 6
policy/modules/services/exim.if | 18
policy/modules/services/fail2ban.if | 18
policy/modules/services/ftp.fc | 2
policy/modules/services/ftp.if | 37 +
policy/modules/services/ftp.te | 116 ++++
policy/modules/services/git.fc | 17
policy/modules/services/git.if | 466 ++++++++++++++----
policy/modules/services/git.te | 145 +++--
policy/modules/services/gpm.fc | 2
policy/modules/services/hal.te | 13
policy/modules/services/inn.te | 1
policy/modules/services/kerberos.if | 21
policy/modules/services/ldap.fc | 3
policy/modules/services/ldap.te | 13
policy/modules/services/likewise.fc | 54 ++
policy/modules/services/likewise.if | 105 ++++
policy/modules/services/likewise.te | 247 ++++++++++
policy/modules/services/lircd.te | 7
policy/modules/services/mailman.te | 1
policy/modules/services/memcached.te | 14
policy/modules/services/modemmanager.te | 2
policy/modules/services/mta.if | 38 +
policy/modules/services/mta.te | 1
policy/modules/services/munin.te | 3
policy/modules/services/mysql.te | 8
policy/modules/services/nagios.fc | 46 +
policy/modules/services/nagios.if | 28 +
policy/modules/services/nagios.te | 90 +++
policy/modules/services/networkmanager.fc | 1
policy/modules/services/networkmanager.if | 19
policy/modules/services/networkmanager.te | 2
policy/modules/services/nis.fc | 5
policy/modules/services/nis.te | 8
policy/modules/services/nut.te | 11
policy/modules/services/nx.if | 18
policy/modules/services/openvpn.te | 4
policy/modules/services/plymouth.fc | 5
policy/modules/services/plymouth.if | 304 ------------
policy/modules/services/plymouth.te | 102 ----
policy/modules/services/plymouthd.fc | 9
policy/modules/services/plymouthd.if | 322 +++++++++++++
policy/modules/services/plymouthd.te | 106 ++++
policy/modules/services/policykit.te | 21
policy/modules/services/postfix.if | 37 +
policy/modules/services/postfix.te | 9
policy/modules/services/ppp.fc | 2
policy/modules/services/ppp.te | 9
policy/modules/services/prelude.te | 2
policy/modules/services/qmail.if | 18
policy/modules/services/qpidd.fc | 9
policy/modules/services/qpidd.if | 236 +++++++++
policy/modules/services/qpidd.te | 61 ++
policy/modules/services/rgmanager.if | 40 +
policy/modules/services/rgmanager.te | 58 +-
policy/modules/services/rhcs.fc | 9
policy/modules/services/rhcs.if | 58 ++
policy/modules/services/rhcs.te | 278 ++---------
policy/modules/services/ricci.te | 8
policy/modules/services/rpc.if | 1
policy/modules/services/rpc.te | 8
policy/modules/services/rsync.if | 38 +
policy/modules/services/rsync.te | 1
policy/modules/services/samba.te | 20
policy/modules/services/sendmail.te | 4
policy/modules/services/setroubleshoot.te | 4
policy/modules/services/snmp.te | 5
policy/modules/services/snort.te | 2
policy/modules/services/spamassassin.if | 18
policy/modules/services/spamassassin.te | 6
policy/modules/services/squid.te | 12
policy/modules/services/ssh.if | 4
policy/modules/services/ssh.te | 84 ---
policy/modules/services/sssd.fc | 4
policy/modules/services/sssd.if | 85 ++-
policy/modules/services/sssd.te | 20
policy/modules/services/tftp.if | 20
policy/modules/services/tftp.te | 1
policy/modules/services/tgtd.te | 1
policy/modules/services/tor.fc | 1
policy/modules/services/tuned.fc | 3
policy/modules/services/tuned.te | 15
policy/modules/services/ucspitcp.te | 5
policy/modules/services/usbmuxd.fc | 6
policy/modules/services/usbmuxd.if | 64 ++
policy/modules/services/usbmuxd.te | 51 ++
policy/modules/services/virt.if | 10
policy/modules/services/virt.te | 26 -
policy/modules/services/xserver.fc | 18
policy/modules/services/xserver.if | 738 ++++++++++--------------------
policy/modules/services/xserver.te | 389 ++++++++-------
policy/modules/system/application.te | 16
policy/modules/system/authlogin.if | 4
policy/modules/system/daemontools.if | 62 ++
policy/modules/system/daemontools.te | 26 -
policy/modules/system/fstools.fc | 2
policy/modules/system/hostname.te | 3
policy/modules/system/hotplug.te | 4
policy/modules/system/init.if | 37 +
policy/modules/system/init.te | 28 +
policy/modules/system/ipsec.te | 13
policy/modules/system/iptables.if | 10
policy/modules/system/iptables.te | 6
policy/modules/system/iscsi.fc | 3
policy/modules/system/iscsi.te | 10
policy/modules/system/libraries.fc | 26 -
policy/modules/system/locallogin.te | 22
policy/modules/system/logging.fc | 7
policy/modules/system/logging.if | 18
policy/modules/system/logging.te | 10
policy/modules/system/lvm.fc | 1
policy/modules/system/lvm.if | 4
policy/modules/system/lvm.te | 6
policy/modules/system/miscfiles.fc | 5
policy/modules/system/miscfiles.if | 37 +
policy/modules/system/modutils.te | 2
policy/modules/system/mount.if | 56 ++
policy/modules/system/mount.te | 56 ++
policy/modules/system/selinuxutil.if | 21
policy/modules/system/selinuxutil.te | 1
policy/modules/system/sosreport.fc | 2
policy/modules/system/sosreport.if | 74 +++
policy/modules/system/sosreport.te | 129 +++++
policy/modules/system/sysnetwork.fc | 1
policy/modules/system/sysnetwork.if | 4
policy/modules/system/sysnetwork.te | 3
policy/modules/system/udev.te | 5
policy/modules/system/unconfined.if | 2
policy/modules/system/userdomain.fc | 2
policy/modules/system/userdomain.if | 45 +
policy/modules/system/xen.if | 2
policy/modules/system/xen.te | 22
policy/support/obj_perm_sets.spt | 8
policy/users | 2
262 files changed, 7061 insertions(+), 2330 deletions(-)
Index: policy-20100106.patch
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/F-12/policy-20100106.patch,v
retrieving revision 1.55
retrieving revision 1.56
diff -u -p -r1.55 -r1.56
--- policy-20100106.patch 23 Mar 2010 14:14:42 -0000 1.55
+++ policy-20100106.patch 26 Mar 2010 14:46:28 -0000 1.56
@@ -736,7 +736,7 @@ diff -b -B --ignore-all-space --exclude-
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.6.32/policy/modules/admin/prelink.te
--- nsaserefpolicy/policy/modules/admin/prelink.te 2010-01-18 18:24:22.564530406 +0100
-+++ serefpolicy-3.6.32/policy/modules/admin/prelink.te 2010-02-01 20:30:49.318160848 +0100
++++ serefpolicy-3.6.32/policy/modules/admin/prelink.te 2010-03-26 07:56:32.448610343 +0100
@@ -108,6 +108,7 @@
miscfiles_read_localization(prelink_t)
@@ -745,6 +745,15 @@ diff -b -B --ignore-all-space --exclude-
userdom_manage_user_home_content(prelink_t)
optional_policy(`
+@@ -156,6 +157,8 @@
+ files_search_var_lib(prelink_cron_system_t)
+ files_search_var_log(prelink_cron_system_t)
+
++files_dontaudit_search_all_mountpoints(prelink_cron_system_t)
++
+ init_chat(prelink_cron_system_t)
+ init_exec(prelink_cron_system_t)
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/quota.te serefpolicy-3.6.32/policy/modules/admin/quota.te
--- nsaserefpolicy/policy/modules/admin/quota.te 2009-09-16 16:01:19.000000000 +0200
+++ serefpolicy-3.6.32/policy/modules/admin/quota.te 2010-02-11 17:52:39.497458571 +0100
@@ -1182,7 +1191,7 @@ diff -b -B --ignore-all-space --exclude-
## <summary>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/chrome.te serefpolicy-3.6.32/policy/modules/apps/chrome.te
--- nsaserefpolicy/policy/modules/apps/chrome.te 2010-01-18 18:24:22.588542189 +0100
-+++ serefpolicy-3.6.32/policy/modules/apps/chrome.te 2010-03-18 15:08:01.040764195 +0100
++++ serefpolicy-3.6.32/policy/modules/apps/chrome.te 2010-03-26 07:54:33.452601074 +0100
@@ -23,8 +23,7 @@
#
# chrome_sandbox local policy
@@ -1193,12 +1202,13 @@ diff -b -B --ignore-all-space --exclude-
allow chrome_sandbox_t self:process { signal_perms setrlimit execmem execstack };
allow chrome_sandbox_t self:fifo_file manage_file_perms;
allow chrome_sandbox_t self:unix_stream_socket create_stream_socket_perms;
-@@ -45,10 +44,13 @@
+@@ -45,10 +44,14 @@
domain_dontaudit_read_all_domains_state(chrome_sandbox_t)
+dev_read_sysfs(chrome_sandbox_t)
dev_read_urand(chrome_sandbox_t)
++dev_rwx_zero(chrome_sandbox_t)
files_read_etc_files(chrome_sandbox_t)
@@ -1207,7 +1217,7 @@ diff -b -B --ignore-all-space --exclude-
userdom_rw_user_tmpfs_files(chrome_sandbox_t)
userdom_use_user_ptys(chrome_sandbox_t)
userdom_write_inherited_user_tmp_files(chrome_sandbox_t)
-@@ -59,15 +61,17 @@
+@@ -59,15 +62,17 @@
miscfiles_read_fonts(chrome_sandbox_t)
optional_policy(`
@@ -10058,7 +10068,7 @@ diff -b -B --ignore-all-space --exclude-
-')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.6.32/policy/modules/services/policykit.te
--- nsaserefpolicy/policy/modules/services/policykit.te 2010-01-18 18:24:22.850542758 +0100
-+++ serefpolicy-3.6.32/policy/modules/services/policykit.te 2010-03-02 16:54:44.272615486 +0100
++++ serefpolicy-3.6.32/policy/modules/services/policykit.te 2010-03-26 07:58:03.235601446 +0100
@@ -1,5 +1,5 @@
-policy_module(policykit, 1.0.1)
@@ -10118,7 +10128,7 @@ diff -b -B --ignore-all-space --exclude-
files_read_etc_files(policykit_auth_t)
files_read_usr_files(policykit_auth_t)
files_search_home(policykit_auth_t)
-@@ -129,8 +135,10 @@
+@@ -129,8 +135,11 @@
miscfiles_read_localization(policykit_auth_t)
miscfiles_read_fonts(policykit_auth_t)
@@ -10126,6 +10136,7 @@ diff -b -B --ignore-all-space --exclude-
userdom_dontaudit_read_user_home_content_files(policykit_auth_t)
+userdom_read_admin_home_files(policykit_auth_t)
++userdom_dontaudit_write_user_tmp_files(policykit_auth_t)
optional_policy(`
dbus_system_domain( policykit_auth_t, policykit_auth_exec_t)
@@ -10244,7 +10255,7 @@ diff -b -B --ignore-all-space --exclude-
/etc/ppp/peers(/.*)? gen_context(system_u:object_r:pppd_etc_rw_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.6.32/policy/modules/services/ppp.te
--- nsaserefpolicy/policy/modules/services/ppp.te 2010-01-18 18:24:22.860530341 +0100
-+++ serefpolicy-3.6.32/policy/modules/services/ppp.te 2010-02-16 17:01:56.727848442 +0100
++++ serefpolicy-3.6.32/policy/modules/services/ppp.te 2010-03-26 07:52:50.814601031 +0100
@@ -71,7 +71,7 @@
# PPPD Local policy
#
@@ -10254,7 +10265,7 @@ diff -b -B --ignore-all-space --exclude-
dontaudit pppd_t self:capability sys_tty_config;
allow pppd_t self:process signal;
allow pppd_t self:fifo_file rw_fifo_file_perms;
-@@ -122,6 +122,7 @@
+@@ -122,9 +122,11 @@
kernel_read_network_state(pppd_t)
kernel_request_load_module(pppd_t)
@@ -10262,7 +10273,11 @@ diff -b -B --ignore-all-space --exclude-
dev_read_urand(pppd_t)
dev_search_sysfs(pppd_t)
dev_read_sysfs(pppd_t)
-@@ -167,6 +168,7 @@
++dev_rw_modem(pppd_t)
+
+ corenet_all_recvfrom_unlabeled(pppd_t)
+ corenet_all_recvfrom_netlabel(pppd_t)
+@@ -167,6 +169,7 @@
auth_use_nsswitch(pppd_t)
@@ -10270,7 +10285,7 @@ diff -b -B --ignore-all-space --exclude-
logging_send_syslog_msg(pppd_t)
miscfiles_read_localization(pppd_t)
-@@ -192,6 +194,10 @@
+@@ -192,6 +195,10 @@
')
optional_policy(`
@@ -11487,6 +11502,17 @@ diff -b -B --ignore-all-space --exclude-
+ write_files_pattern($1, rsync_etc_t, rsync_etc_t)
+ files_search_etc($1)
+')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.6.32/policy/modules/services/rsync.te
+--- nsaserefpolicy/policy/modules/services/rsync.te 2010-01-18 18:24:22.881530638 +0100
++++ serefpolicy-3.6.32/policy/modules/services/rsync.te 2010-03-26 07:50:02.122850866 +0100
+@@ -124,6 +124,7 @@
+ ')
+
+ tunable_policy(`rsync_export_all_ro',`
++ files_getattr_all_pipes(rsync_t)
+ fs_read_noxattr_fs_files(rsync_t)
+ fs_read_nfs_files(rsync_t)
+ fs_read_cifs_files(rsync_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.6.32/policy/modules/services/samba.te
--- nsaserefpolicy/policy/modules/services/samba.te 2010-01-18 18:24:22.886540773 +0100
+++ serefpolicy-3.6.32/policy/modules/services/samba.te 2010-03-18 14:27:30.841764712 +0100
@@ -16241,13 +16267,14 @@ diff -b -B --ignore-all-space --exclude-
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.6.32/policy/modules/system/userdomain.fc
--- nsaserefpolicy/policy/modules/system/userdomain.fc 2010-01-18 18:24:22.977540055 +0100
-+++ serefpolicy-3.6.32/policy/modules/system/userdomain.fc 2010-01-18 18:27:02.791532114 +0100
-@@ -6,4 +6,5 @@
++++ serefpolicy-3.6.32/policy/modules/system/userdomain.fc 2010-03-26 15:26:10.081766491 +0100
+@@ -6,4 +6,6 @@
/dev/shm/pulse-shm.* gen_context(system_u:object_r:user_tmpfs_t,s0)
/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0)
HOME_DIR/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
+HOME_DIR/\.pki(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
HOME_DIR/\.gvfs(/.*)? <<none>>
++/root/\.cert(/.*)? gen_context(system_u:object_r:home_cert_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.32/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2010-01-18 18:24:22.983531669 +0100
+++ serefpolicy-3.6.32/policy/modules/system/userdomain.if 2010-03-09 16:30:07.806384243 +0100
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/F-12/selinux-policy.spec,v
retrieving revision 1.1041
retrieving revision 1.1042
diff -u -p -r1.1041 -r1.1042
--- selinux-policy.spec 23 Mar 2010 15:15:59 -0000 1.1041
+++ selinux-policy.spec 26 Mar 2010 14:46:28 -0000 1.1042
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.6.32
-Release: 106%{?dist}
+Release: 107%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -469,6 +469,9 @@ exit 0
%endif
%changelog
+* Fri Mar 26 2010 Miroslav Grepl <mgrepl at redhat.com> 3.6.32-107
+- Allow pppd to read and write to modem devices
+
* Thu Mar 23 2010 Miroslav Grepl <mgrepl at redhat.com> 3.6.32-106
- Allow mysqld_safe setsched, getsched
- Allow logrotate to transition to sssd
More information about the scm-commits
mailing list