[selinux-policy] +- Allow mozilla_plugin_t to manage mozilla_home_t +- Allow ssh derived domain to execute ssh-keygen
Miroslav Grepl
mgrepl at fedoraproject.org
Thu Dec 8 16:16:02 UTC 2011
commit 202bb4cfa30ff580946bc09d9d0b1ef63d785ee8
Author: Miroslav <mgrepl at redhat.com>
Date: Thu Dec 8 17:15:52 2011 +0100
+- Allow mozilla_plugin_t to manage mozilla_home_t
+- Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain
+- Add label for tumblerd
policy-F16.patch | 98 ++++++++++++++++++++++++++++-----------------------
selinux-policy.spec | 7 +++-
2 files changed, 60 insertions(+), 45 deletions(-)
---
diff --git a/policy-F16.patch b/policy-F16.patch
index 34541cc..25d1257 100644
--- a/policy-F16.patch
+++ b/policy-F16.patch
@@ -8114,7 +8114,7 @@ index fbb5c5a..e187982 100644
+ allow $1 mozilla_plugin_rw_t:dir rw_dir_perms;
')
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
-index 2e9318b..fc7a18e 100644
+index 2e9318b..bb90a3b 100644
--- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te
@@ -23,8 +23,9 @@ type mozilla_conf_t;
@@ -8247,9 +8247,9 @@ index 2e9318b..fc7a18e 100644
can_exec(mozilla_plugin_t, mozilla_home_t)
-read_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t)
-+manage_dirs_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t)
-+manage_files_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t)
-+manage_lnk_files_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t)
++manage_dirs_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t)
++manage_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t)
++manage_lnk_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t)
manage_dirs_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
@@ -12732,7 +12732,7 @@ index 223ad43..d95e720 100644
rsync_exec(yam_t)
')
diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
-index 3fae11a..5d00aa0 100644
+index 3fae11a..cdd0dcf 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
@@ -1,7 +1,7 @@
@@ -12791,7 +12791,7 @@ index 3fae11a..5d00aa0 100644
/opt/gutenprint/cups/lib/filter(/.*)? gen_context(system_u:object_r:bin_t,s0)
-@@ -179,67 +174,90 @@ ifdef(`distro_gentoo',`
+@@ -179,67 +174,91 @@ ifdef(`distro_gentoo',`
/opt/vmware/workstation/lib/lib/wrapper-gtk24\.sh -- gen_context(system_u:object_r:bin_t,s0)
')
@@ -12900,6 +12900,7 @@ index 3fae11a..5d00aa0 100644
+/usr/lib/rpm/rpmk -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/rpm/rpmq -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/rpm/rpmv -- gen_context(system_u:object_r:bin_t,s0)
++/usr/lib/tumbler-[^/]*/tumblerd -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/sftp-server -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/vte/gnome-pty-helper -- gen_context(system_u:object_r:bin_t,s0)
@@ -12927,7 +12928,7 @@ index 3fae11a..5d00aa0 100644
/usr/libexec(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/libexec/git-core/git-shell -- gen_context(system_u:object_r:shell_exec_t,s0)
-@@ -247,11 +265,18 @@ ifdef(`distro_gentoo',`
+@@ -247,11 +266,18 @@ ifdef(`distro_gentoo',`
/usr/libexec/openssh/sftp-server -- gen_context(system_u:object_r:bin_t,s0)
@@ -12947,7 +12948,7 @@ index 3fae11a..5d00aa0 100644
/usr/sbin/scponlyc -- gen_context(system_u:object_r:shell_exec_t,s0)
/usr/sbin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0)
/usr/sbin/smrsh -- gen_context(system_u:object_r:shell_exec_t,s0)
-@@ -267,6 +292,10 @@ ifdef(`distro_gentoo',`
+@@ -267,6 +293,10 @@ ifdef(`distro_gentoo',`
/usr/share/cluster/.*\.sh gen_context(system_u:object_r:bin_t,s0)
/usr/share/cluster/ocf-shellfuncs -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/cluster/svclib_nfslock -- gen_context(system_u:object_r:bin_t,s0)
@@ -12958,7 +12959,7 @@ index 3fae11a..5d00aa0 100644
/usr/share/e16/misc(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/gedit-2/plugins/externaltools/tools(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/gitolite/hooks/common/update -- gen_context(system_u:object_r:bin_t,s0)
-@@ -286,15 +315,19 @@ ifdef(`distro_gentoo',`
+@@ -286,15 +316,19 @@ ifdef(`distro_gentoo',`
/usr/share/smolt/client(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall/compiler\.pl -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/shorewall/configpath -- gen_context(system_u:object_r:bin_t,s0)
@@ -12979,7 +12980,7 @@ index 3fae11a..5d00aa0 100644
ifdef(`distro_gentoo', `
/usr/.*-.*-linux-gnu/gcc-bin/.*(/.*)? gen_context(system_u:object_r:bin_t,s0)
-@@ -306,10 +339,11 @@ ifdef(`distro_redhat', `
+@@ -306,10 +340,11 @@ ifdef(`distro_redhat', `
/etc/gdm/[^/]+ -d gen_context(system_u:object_r:bin_t,s0)
/etc/gdm/[^/]+/.* gen_context(system_u:object_r:bin_t,s0)
@@ -12993,7 +12994,7 @@ index 3fae11a..5d00aa0 100644
/usr/lib/vmware-tools/(s)?bin32(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib/vmware-tools/(s)?bin64(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/authconfig/authconfig-gtk\.py -- gen_context(system_u:object_r:bin_t,s0)
-@@ -319,9 +353,11 @@ ifdef(`distro_redhat', `
+@@ -319,9 +354,11 @@ ifdef(`distro_redhat', `
/usr/share/clamav/clamd-gen -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/clamav/freshclam-sleep -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/createrepo(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -13005,7 +13006,7 @@ index 3fae11a..5d00aa0 100644
/usr/share/pwlib/make/ptlib-config -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/pydict/pydict\.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/rhn/rhn_applet/applet\.py -- gen_context(system_u:object_r:bin_t,s0)
-@@ -363,7 +399,7 @@ ifdef(`distro_redhat', `
+@@ -363,7 +400,7 @@ ifdef(`distro_redhat', `
ifdef(`distro_suse', `
/usr/lib/cron/run-crons -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib/samba/classic/.* -- gen_context(system_u:object_r:bin_t,s0)
@@ -13014,7 +13015,7 @@ index 3fae11a..5d00aa0 100644
/usr/share/apache2/[^/]* -- gen_context(system_u:object_r:bin_t,s0)
')
-@@ -375,8 +411,8 @@ ifdef(`distro_suse', `
+@@ -375,8 +412,8 @@ ifdef(`distro_suse', `
/var/ftp/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
/var/lib/asterisk/agi-bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -13025,7 +13026,7 @@ index 3fae11a..5d00aa0 100644
/var/qmail/bin -d gen_context(system_u:object_r:bin_t,s0)
/var/qmail/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
-@@ -385,3 +421,12 @@ ifdef(`distro_suse', `
+@@ -385,3 +422,12 @@ ifdef(`distro_suse', `
ifdef(`distro_suse',`
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
')
@@ -61166,10 +61167,10 @@ index 078bcd7..84d29ee 100644
+/root/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
+/root/\.shosts gen_context(system_u:object_r:ssh_home_t,s0)
diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
-index 22adaca..c2efd25 100644
+index 22adaca..6ec295a 100644
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
-@@ -32,10 +32,10 @@
+@@ -32,10 +32,11 @@
## </param>
#
template(`ssh_basic_client_template',`
@@ -61177,11 +61178,12 @@ index 22adaca..c2efd25 100644
gen_require(`
attribute ssh_server;
type ssh_exec_t, sshd_key_t, sshd_tmp_t;
++ type ssh_keysign_exec_t, ssh_keysign_t;
+ type ssh_home_t;
')
##############################
-@@ -47,10 +47,6 @@ template(`ssh_basic_client_template',`
+@@ -47,10 +48,6 @@ template(`ssh_basic_client_template',`
application_domain($1_ssh_t, ssh_exec_t)
role $3 types $1_ssh_t;
@@ -61192,7 +61194,15 @@ index 22adaca..c2efd25 100644
##############################
#
# Client local policy
-@@ -93,18 +89,18 @@ template(`ssh_basic_client_template',`
+@@ -89,22 +86,26 @@ template(`ssh_basic_client_template',`
+ # or "regular" (not special like sshd_extern_t) servers
+ allow $2 ssh_server:unix_stream_socket rw_stream_socket_perms;
+
++ # derived domain can execute ssh-keysign
++ domtrans_pattern($1_ssh_t, ssh_keysign_exec_t, ssh_keysign_t)
++ role $3 types ssh_keysign_t;
++
+ # allow ps to show ssh
ps_process_pattern($2, $1_ssh_t)
# user can manage the keys and config
@@ -61219,7 +61229,7 @@ index 22adaca..c2efd25 100644
kernel_read_kernel_sysctls($1_ssh_t)
kernel_read_system_state($1_ssh_t)
-@@ -116,6 +112,8 @@ template(`ssh_basic_client_template',`
+@@ -116,6 +117,8 @@ template(`ssh_basic_client_template',`
corenet_tcp_sendrecv_all_ports($1_ssh_t)
corenet_tcp_connect_ssh_port($1_ssh_t)
corenet_sendrecv_ssh_client_packets($1_ssh_t)
@@ -61228,7 +61238,7 @@ index 22adaca..c2efd25 100644
dev_read_urand($1_ssh_t)
-@@ -148,6 +146,29 @@ template(`ssh_basic_client_template',`
+@@ -148,6 +151,29 @@ template(`ssh_basic_client_template',`
')
')
@@ -61258,7 +61268,7 @@ index 22adaca..c2efd25 100644
#######################################
## <summary>
## The template to define a ssh server.
-@@ -168,7 +189,7 @@ template(`ssh_basic_client_template',`
+@@ -168,7 +194,7 @@ template(`ssh_basic_client_template',`
## </summary>
## </param>
#
@@ -61267,7 +61277,7 @@ index 22adaca..c2efd25 100644
type $1_t, ssh_server;
auth_login_pgm_domain($1_t)
-@@ -181,16 +202,18 @@ template(`ssh_server_template', `
+@@ -181,16 +207,18 @@ template(`ssh_server_template', `
type $1_var_run_t;
files_pid_file($1_var_run_t)
@@ -61289,7 +61299,7 @@ index 22adaca..c2efd25 100644
term_create_pty($1_t, $1_devpts_t)
manage_files_pattern($1_t, $1_tmpfs_t, $1_tmpfs_t)
-@@ -206,6 +229,7 @@ template(`ssh_server_template', `
+@@ -206,6 +234,7 @@ template(`ssh_server_template', `
kernel_read_kernel_sysctls($1_t)
kernel_read_network_state($1_t)
@@ -61297,7 +61307,7 @@ index 22adaca..c2efd25 100644
corenet_all_recvfrom_unlabeled($1_t)
corenet_all_recvfrom_netlabel($1_t)
-@@ -220,10 +244,13 @@ template(`ssh_server_template', `
+@@ -220,10 +249,13 @@ template(`ssh_server_template', `
corenet_tcp_bind_generic_node($1_t)
corenet_udp_bind_generic_node($1_t)
corenet_tcp_bind_ssh_port($1_t)
@@ -61313,7 +61323,7 @@ index 22adaca..c2efd25 100644
auth_rw_login_records($1_t)
auth_rw_faillog($1_t)
-@@ -234,6 +261,7 @@ template(`ssh_server_template', `
+@@ -234,6 +266,7 @@ template(`ssh_server_template', `
corecmd_getattr_bin_files($1_t)
domain_interactive_fd($1_t)
@@ -61321,7 +61331,7 @@ index 22adaca..c2efd25 100644
files_read_etc_files($1_t)
files_read_etc_runtime_files($1_t)
-@@ -243,21 +271,13 @@ template(`ssh_server_template', `
+@@ -243,21 +276,13 @@ template(`ssh_server_template', `
miscfiles_read_localization($1_t)
@@ -61345,7 +61355,7 @@ index 22adaca..c2efd25 100644
optional_policy(`
kerberos_use($1_t)
-@@ -268,6 +288,14 @@ template(`ssh_server_template', `
+@@ -268,6 +293,14 @@ template(`ssh_server_template', `
files_read_var_lib_symlinks($1_t)
nx_spec_domtrans_server($1_t)
')
@@ -61360,7 +61370,7 @@ index 22adaca..c2efd25 100644
')
########################################
-@@ -290,11 +318,11 @@ template(`ssh_server_template', `
+@@ -290,11 +323,11 @@ template(`ssh_server_template', `
## User domain for the role
## </summary>
## </param>
@@ -61373,7 +61383,7 @@ index 22adaca..c2efd25 100644
type ssh_t, ssh_exec_t, ssh_tmpfs_t, ssh_home_t;
type ssh_agent_exec_t, ssh_keysign_t, ssh_tmpfs_t;
type ssh_agent_tmp_t;
-@@ -327,17 +355,20 @@ template(`ssh_role_template',`
+@@ -327,17 +360,20 @@ template(`ssh_role_template',`
# allow ps to show ssh
ps_process_pattern($3, ssh_t)
@@ -61395,7 +61405,7 @@ index 22adaca..c2efd25 100644
##############################
#
-@@ -359,7 +390,7 @@ template(`ssh_role_template',`
+@@ -359,7 +395,7 @@ template(`ssh_role_template',`
stream_connect_pattern($3, ssh_agent_tmp_t, ssh_agent_tmp_t, $1_ssh_agent_t)
# Allow the user shell to signal the ssh program.
@@ -61404,7 +61414,7 @@ index 22adaca..c2efd25 100644
# allow ps to show ssh
ps_process_pattern($3, $1_ssh_agent_t)
-@@ -381,7 +412,6 @@ template(`ssh_role_template',`
+@@ -381,7 +417,6 @@ template(`ssh_role_template',`
files_read_etc_files($1_ssh_agent_t)
files_read_etc_runtime_files($1_ssh_agent_t)
@@ -61412,7 +61422,7 @@ index 22adaca..c2efd25 100644
libs_read_lib_files($1_ssh_agent_t)
-@@ -393,28 +423,15 @@ template(`ssh_role_template',`
+@@ -393,28 +428,15 @@ template(`ssh_role_template',`
seutil_dontaudit_read_config($1_ssh_agent_t)
# Write to the user domain tty.
@@ -61428,15 +61438,15 @@ index 22adaca..c2efd25 100644
-
- tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_files($1_ssh_agent_t)
-
+-
- # transition back to normal privs upon exec
- fs_nfs_domtrans($1_ssh_agent_t, $3)
- ')
-+ ssh_exec_keygen($3)
- tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_files($1_ssh_agent_t)
--
++ ssh_exec_keygen($3)
+
- # transition back to normal privs upon exec
- fs_cifs_domtrans($1_ssh_agent_t, $3)
- ')
@@ -61444,7 +61454,7 @@ index 22adaca..c2efd25 100644
optional_policy(`
nis_use_ypbind($1_ssh_agent_t)
-@@ -464,6 +481,24 @@ interface(`ssh_signal',`
+@@ -464,6 +486,24 @@ interface(`ssh_signal',`
########################################
## <summary>
@@ -61469,7 +61479,7 @@ index 22adaca..c2efd25 100644
## Read a ssh server unnamed pipe.
## </summary>
## <param name="domain">
-@@ -477,8 +512,27 @@ interface(`ssh_read_pipes',`
+@@ -477,8 +517,27 @@ interface(`ssh_read_pipes',`
type sshd_t;
')
@@ -61498,7 +61508,7 @@ index 22adaca..c2efd25 100644
########################################
## <summary>
## Read and write a ssh server unnamed pipe.
-@@ -494,7 +548,7 @@ interface(`ssh_rw_pipes',`
+@@ -494,7 +553,7 @@ interface(`ssh_rw_pipes',`
type sshd_t;
')
@@ -61507,7 +61517,7 @@ index 22adaca..c2efd25 100644
')
########################################
-@@ -586,6 +640,24 @@ interface(`ssh_domtrans',`
+@@ -586,6 +645,24 @@ interface(`ssh_domtrans',`
########################################
## <summary>
@@ -61532,7 +61542,7 @@ index 22adaca..c2efd25 100644
## Execute the ssh client in the caller domain.
## </summary>
## <param name="domain">
-@@ -618,7 +690,7 @@ interface(`ssh_setattr_key_files',`
+@@ -618,7 +695,7 @@ interface(`ssh_setattr_key_files',`
type sshd_key_t;
')
@@ -61541,7 +61551,7 @@ index 22adaca..c2efd25 100644
files_search_pids($1)
')
-@@ -643,6 +715,42 @@ interface(`ssh_agent_exec',`
+@@ -643,6 +720,42 @@ interface(`ssh_agent_exec',`
########################################
## <summary>
@@ -61584,7 +61594,7 @@ index 22adaca..c2efd25 100644
## Read ssh home directory content
## </summary>
## <param name="domain">
-@@ -682,6 +790,50 @@ interface(`ssh_domtrans_keygen',`
+@@ -682,6 +795,50 @@ interface(`ssh_domtrans_keygen',`
########################################
## <summary>
@@ -61635,7 +61645,7 @@ index 22adaca..c2efd25 100644
## Read ssh server keys
## </summary>
## <param name="domain">
-@@ -695,7 +847,7 @@ interface(`ssh_dontaudit_read_server_keys',`
+@@ -695,7 +852,7 @@ interface(`ssh_dontaudit_read_server_keys',`
type sshd_key_t;
')
@@ -61644,7 +61654,7 @@ index 22adaca..c2efd25 100644
')
######################################
-@@ -735,3 +887,63 @@ interface(`ssh_delete_tmp',`
+@@ -735,3 +892,63 @@ interface(`ssh_delete_tmp',`
files_search_tmp($1)
delete_files_pattern($1, sshd_tmp_t, sshd_tmp_t)
')
diff --git a/selinux-policy.spec b/selinux-policy.spec
index aea6f29..503daba 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.10.0
-Release: 66%{?dist}
+Release: 67%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -470,6 +470,11 @@ SELinux Reference policy mls base module.
%endif
%changelog
+* Thu Dec 8 2011 Miroslav Grepl <mgrepl at redhat.com> 3.10.0-67
+- Allow mozilla_plugin_t to manage mozilla_home_t
+- Allow ssh derived domain to execute ssh-keygen in the ssh_keygen_t domain
+- Add label for tumblerd
+
* Wed Dec 7 2011 Miroslav Grepl <mgrepl at redhat.com> 3.10.0-66
- Fixes for xguest package
More information about the scm-commits
mailing list