[selinux-policy: 2119/3172] trunk: 9 patches from dan.
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 22:08:02 UTC 2010
commit 63f0a71c8a6e2d45bbe6e040e69e78371241ce8d
Author: Chris PeBenito <cpebenito at tresys.com>
Date: Mon Jun 1 16:03:42 2009 +0000
trunk: 9 patches from dan.
man/man8/httpd_selinux.8 | 17 ++++++++---------
man/man8/kerberos_selinux.8 | 2 +-
man/man8/nfs_selinux.8 | 2 +-
man/man8/ypbind_selinux.8 | 2 +-
policy/modules/admin/brctl.te | 4 +++-
policy/modules/apps/ada.te | 4 ++--
policy/modules/apps/cdrecord.fc | 2 +-
policy/modules/apps/cdrecord.te | 2 +-
policy/modules/apps/screen.fc | 3 +--
policy/modules/apps/screen.te | 7 ++-----
10 files changed, 21 insertions(+), 24 deletions(-)
---
diff --git a/man/man8/httpd_selinux.8 b/man/man8/httpd_selinux.8
index 3d85afd..a939a74 100644
--- a/man/man8/httpd_selinux.8
+++ b/man/man8/httpd_selinux.8
@@ -22,7 +22,7 @@ The following file contexts types are defined for httpd:
.EX
httpd_sys_content_t
.EE
-- Set files with httpd_sys_content_t for content which is available from all httpd sys scripts and the daemon.
+- Set files with httpd_sys_content_t if you want httpd_sys_script_exec_t scripts and the daemon to read the file, and disallow other non sys scripts from access.
.EX
httpd_sys_script_exec_t
.EE
@@ -30,11 +30,11 @@ httpd_sys_script_exec_t
.EX
httpd_sys_content_rw_t
.EE
-- Set files with httpd_sys_content_rw_t if you want httpd_sys_script_exec_t scripts to read/write the data, and disallow other non sys scripts from access.
+- Set files with httpd_sys_content_rw_t if you want httpd_sys_script_exec_t scripts and the daemon to read/write the data, and disallow other non sys scripts from access.
.EX
httpd_sys_content_ra_t
.EE
-- Set files with httpd_sys_content_ra_t if you want httpd_sys_script_exec_t scripts to read/append to the file, and disallow other non sys scripts from access.
+- Set files with httpd_sys_content_ra_t if you want httpd_sys_script_exec_t scripts and the daemon to read/append to the file, and disallow other non sys scripts from access.
.EX
httpd_unconfined_script_exec_t
.EE
@@ -57,8 +57,7 @@ setsebool -P allow_httpd_sys_script_anon_write=1
.EE
.SH BOOLEANS
-SELinux policy is customizable based on least access required. So by
-default SElinux prevents certain http scripts from working. httpd policy is extremely flexible and has several booleans that allow you to manipulate the policy and run httpd with the tightest access possible.
+SELinux policy is customizable based on least access required. SElinux can be setup to prevent certain http scripts from working. httpd policy is extremely flexible and has several booleans that allow you to manipulate the policy and run httpd with the tightest access possible.
.PP
httpd can be setup to allow cgi scripts to be executed, set httpd_enable_cgi to allow this
@@ -67,7 +66,7 @@ setsebool -P httpd_enable_cgi 1
.EE
.PP
-httpd by default is not allowed to access users home directories. If you want to allow access to users home directories you need to set the httpd_enable_homedirs boolean and change the context of the files that you want people to access off the home dir.
+SELinux policy for httpd can be setup to not allowed to access users home directories. If you want to allow access to users home directories you need to set the httpd_enable_homedirs boolean and change the context of the files that you want people to access off the home dir.
.EX
setsebool -P httpd_enable_homedirs 1
@@ -75,7 +74,7 @@ chcon -R -t httpd_sys_content_t ~user/public_html
.EE
.PP
-httpd by default is not allowed access to the controlling terminal. In most cases this is preferred, because an intruder might be able to use the access to the terminal to gain privileges. But in certain situations httpd needs to prompt for a password to open a certificate file, in these cases, terminal access is required. Set the httpd_tty_comm boolean to allow terminal access.
+SELinux policy for httpd can be setup to not allow access to the controlling terminal. In most cases this is preferred, because an intruder might be able to use the access to the terminal to gain privileges. But in certain situations httpd needs to prompt for a password to open a certificate file, in these cases, terminal access is required. Set the httpd_tty_comm boolean to allow terminal access.
.EX
setsebool -P httpd_tty_comm 1
@@ -89,7 +88,7 @@ setsebool -P httpd_unified 0
.EE
.PP
-httpd can be configured to turn on sending email. By default http is not allowed to send mail. This is a security feature, since it would prevent a vulnerabiltiy in http from causing a spam attack. I certain situations, you may want http modules to send mail. You can turn on the httpd_send_mail boolean.
+SELinu policy for httpd can be configured to turn on sending email. This is a security feature, since it would prevent a vulnerabiltiy in http from causing a spam attack. I certain situations, you may want http modules to send mail. You can turn on the httpd_send_mail boolean.
.EX
setsebool -P httpd_can_sendmail 1
@@ -102,7 +101,7 @@ setsebool -P httpd_builtin_scripting 0
.EE
.PP
-httpd scripts by default are not allowed to connect out to the network.
+SELinux policy can be setup such that httpd scripts are not allowed to connect out to the network.
This would prevent a hacker from breaking into you httpd server and attacking
other machines. If you need scripts to be able to connect you can set the httpd_can_network_connect boolean on.
diff --git a/man/man8/kerberos_selinux.8 b/man/man8/kerberos_selinux.8
index a7bb0f7..a8f81c8 100644
--- a/man/man8/kerberos_selinux.8
+++ b/man/man8/kerberos_selinux.8
@@ -12,7 +12,7 @@ kerberos_selinux \- Security Enhanced Linux Policy for Kerberos.
.SH "DESCRIPTION"
Security-Enhanced Linux secures the system via flexible mandatory access
-control. By default Kerberos access is not allowed, since it requires daemons to be allowed greater access to certain secure files and additional access to the network.
+control. SELinux policy can be configured to deny Kerberos access to confined applications, since it requires daemons to be allowed greater access to certain secure files and additional access to the network.
.SH BOOLEANS
.PP
You must set the allow_kerberos boolean to allow your system to work properly in a Kerberos environment.
diff --git a/man/man8/nfs_selinux.8 b/man/man8/nfs_selinux.8
index 91501d9..8e30c4c 100644
--- a/man/man8/nfs_selinux.8
+++ b/man/man8/nfs_selinux.8
@@ -6,7 +6,7 @@ nfs_selinux \- Security Enhanced Linux Policy for NFS
Security Enhanced Linux secures the NFS server via flexible mandatory access
control.
.SH BOOLEANS
-SELinux policy is customizable based on the least level of access required. By default, SELinux policy does not allow NFS to share files. If you want to share NFS partitions, and only allow read-only access to those NFS partitions, turn the nfs_export_all_ro boolean on:
+SELinux policy is customizable based on the least level of access required. SELinux can be configured to not allow NFS to share files. If you want to share NFS partitions, and only allow read-only access to those NFS partitions, turn the nfs_export_all_ro boolean on:
.TP
setsebool -P nfs_export_all_ro 1
diff --git a/man/man8/ypbind_selinux.8 b/man/man8/ypbind_selinux.8
index 6ea0d6c..5061a5f 100644
--- a/man/man8/ypbind_selinux.8
+++ b/man/man8/ypbind_selinux.8
@@ -4,7 +4,7 @@ ypbind_selinux \- Security Enhanced Linux Policy for NIS.
.SH "DESCRIPTION"
Security-Enhanced Linux secures the system via flexible mandatory access
-control. By default NIS is not allowed, since it requires daemons to be allowed greater access to the network.
+control. SELinux can be setup deny NIS from working, since it requires daemons to be allowed greater access to the network.
.SH BOOLEANS
.TP
You must set the allow_ypbind boolean to allow your system to work properly in a NIS environment.
diff --git a/policy/modules/admin/brctl.te b/policy/modules/admin/brctl.te
index e78f1c6..eabe379 100644
--- a/policy/modules/admin/brctl.te
+++ b/policy/modules/admin/brctl.te
@@ -1,4 +1,4 @@
-policy_module(brctl, 1.3.0)
+policy_module(brctl, 1.3.1)
########################################
#
@@ -25,6 +25,8 @@ kernel_load_module(brctl_t)
kernel_read_network_state(brctl_t)
kernel_read_sysctl(brctl_t)
+corenet_rw_tun_tap_dev(brctl_t)
+
dev_rw_sysfs(brctl_t)
dev_write_sysfs_dirs(brctl_t)
diff --git a/policy/modules/apps/ada.te b/policy/modules/apps/ada.te
index 5cb2983..ce76881 100644
--- a/policy/modules/apps/ada.te
+++ b/policy/modules/apps/ada.te
@@ -1,5 +1,5 @@
-policy_module(ada, 1.3.0)
+policy_module(ada, 1.3.1)
########################################
#
@@ -21,5 +21,5 @@ allow ada_t self:process { execstack execmem };
userdom_use_user_terminals(ada_t)
optional_policy(`
- unconfined_domain_noaudit(ada_t)
+ unconfined_domain(ada_t)
')
diff --git a/policy/modules/apps/cdrecord.fc b/policy/modules/apps/cdrecord.fc
index 12deb68..a24a80c 100644
--- a/policy/modules/apps/cdrecord.fc
+++ b/policy/modules/apps/cdrecord.fc
@@ -2,4 +2,4 @@
# /usr
#
/usr/bin/cdrecord -- gen_context(system_u:object_r:cdrecord_exec_t,s0)
-
+/usr/bin/growisofs -- gen_context(system_u:object_r:cdrecord_exec_t,s0)
diff --git a/policy/modules/apps/cdrecord.te b/policy/modules/apps/cdrecord.te
index a3148c7..b247e4e 100644
--- a/policy/modules/apps/cdrecord.te
+++ b/policy/modules/apps/cdrecord.te
@@ -1,5 +1,5 @@
-policy_module(cdrecord, 2.0.0)
+policy_module(cdrecord, 2.0.1)
########################################
#
diff --git a/policy/modules/apps/screen.fc b/policy/modules/apps/screen.fc
index b020416..1f2cde4 100644
--- a/policy/modules/apps/screen.fc
+++ b/policy/modules/apps/screen.fc
@@ -11,5 +11,4 @@ HOME_DIR/\.screenrc -- gen_context(system_u:object_r:screen_home_t,s0)
#
# /var
#
-/var/run/screens?/S-[^/]+ -d gen_context(system_u:object_r:screen_dir_t,s0)
-/var/run/screens?/S-[^/]+/.* <<none>>
+/var/run/screen(/.*)? gen_context(system_u:object_r:screen_var_run_t,s0)
diff --git a/policy/modules/apps/screen.te b/policy/modules/apps/screen.te
index a249b97..08e5d9d 100644
--- a/policy/modules/apps/screen.te
+++ b/policy/modules/apps/screen.te
@@ -1,14 +1,11 @@
-policy_module(screen, 2.0.1)
+policy_module(screen, 2.0.2)
########################################
#
# Declarations
#
-type screen_dir_t;
-files_pid_file(screen_dir_t)
-
type screen_exec_t;
application_executable_file(screen_exec_t)
@@ -25,6 +22,6 @@ ubac_constrained(screen_tmp_t)
type screen_var_run_t;
typealias screen_var_run_t alias { user_screen_var_run_t staff_screen_var_run_t sysadm_screen_var_run_t };
-typealias screen_var_run_t alias { auditadm_screen_var_run_t secadm_screen_var_run_t };
+typealias screen_var_run_t alias { auditadm_screen_var_run_t secadm_screen_var_run_t screen_dir_t };
files_pid_file(screen_var_run_t)
ubac_constrained(screen_var_run_t)
More information about the scm-commits
mailing list