[selinux-policy] - default trans rules for Rawhide policy - Make sure sound_devices controlC* are labeled correctly
Miroslav Grepl
mgrepl at fedoraproject.org
Tue Dec 20 18:41:44 UTC 2011
commit 67539d56f8c61fbc4a51eff142233aee8cd1517a
Author: Miroslav Grepl <mgrepl at redhat.com>
Date: Tue Dec 20 19:41:35 2011 +0100
- default trans rules for Rawhide policy
- Make sure sound_devices controlC* are labeled correctly on creation
- sssd now needs sys_admin
- Allow snmp to read all proc_type
- Allow to setup users homedir with quota.group
policy-F16.patch | 195 ++++++++++++++++++++++++++++++++++++--------------
selinux-policy.spec | 9 ++-
2 files changed, 148 insertions(+), 56 deletions(-)
---
diff --git a/policy-F16.patch b/policy-F16.patch
index 77c32ff..a8547ef 100644
--- a/policy-F16.patch
+++ b/policy-F16.patch
@@ -226,10 +226,17 @@ index 4705ab6..0f0bb47 100644
+gen_tunable(allow_console_login,false)
+
diff --git a/policy/mcs b/policy/mcs
-index df8e0fa..09eea90 100644
+index df8e0fa..38146ed 100644
--- a/policy/mcs
+++ b/policy/mcs
-@@ -69,16 +69,32 @@ gen_levels(1,mcs_num_cats)
+@@ -1,4 +1,6 @@
+ ifdef(`enable_mcs',`
++default_range dir_file_class_set target low;
++
+ #
+ # Define sensitivities
+ #
+@@ -69,16 +71,32 @@ gen_levels(1,mcs_num_cats)
# - /proc/pid operations are not constrained.
mlsconstrain file { read ioctl lock execute execute_no_trans }
@@ -266,7 +273,7 @@ index df8e0fa..09eea90 100644
# New filesystem object labels must be dominated by the relabeling subject
# clearance, also the objects are single-level.
-@@ -87,10 +103,13 @@ mlsconstrain file { create relabelto }
+@@ -87,10 +105,13 @@ mlsconstrain file { create relabelto }
# new file labels must be dominated by the relabeling subject clearance
mlsconstrain { dir file lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom }
@@ -282,7 +289,7 @@ index df8e0fa..09eea90 100644
mlsconstrain process { transition dyntransition }
(( h1 dom h2 ) or ( t1 == mcssetcats ));
-@@ -101,6 +120,9 @@ mlsconstrain process { ptrace }
+@@ -101,6 +122,9 @@ mlsconstrain process { ptrace }
mlsconstrain process { sigkill sigstop }
(( h1 dom h2 ) or ( t1 == mcskillall ));
@@ -292,7 +299,7 @@ index df8e0fa..09eea90 100644
#
# MCS policy for SELinux-enabled databases
#
-@@ -144,4 +166,21 @@ mlsconstrain db_language { drop getattr setattr relabelfrom execute }
+@@ -144,4 +168,21 @@ mlsconstrain db_language { drop getattr setattr relabelfrom execute }
mlsconstrain db_blob { drop getattr setattr relabelfrom read write import export }
( h1 dom h2 );
@@ -2335,10 +2342,16 @@ index af55369..5d940f8 100644
+ miscfiles_read_man_pages(prelink_t)
+')
diff --git a/policy/modules/admin/quota.fc b/policy/modules/admin/quota.fc
-index f387230..98adfd2 100644
+index f387230..e63f9c6 100644
--- a/policy/modules/admin/quota.fc
+++ b/policy/modules/admin/quota.fc
-@@ -8,12 +8,18 @@ HOME_ROOT/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
+@@ -1,4 +1,5 @@
+ HOME_ROOT/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
++HOME_DIR/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
+
+ /a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
+
+@@ -8,12 +9,18 @@ HOME_ROOT/a?quota\.(user|group) -- gen_context(system_u:object_r:quota_db_t,s0)
/sbin/quota(check|on) -- gen_context(system_u:object_r:quota_exec_t,s0)
@@ -2423,7 +2436,7 @@ index bf75d99..d1af9cf 100644
+ domtrans_pattern($1, quota_nld_exec_t, quota_nld_t)
+')
diff --git a/policy/modules/admin/quota.te b/policy/modules/admin/quota.te
-index 5dd42f5..bef4392 100644
+index 5dd42f5..c0b7cd0 100644
--- a/policy/modules/admin/quota.te
+++ b/policy/modules/admin/quota.te
@@ -15,6 +15,13 @@ files_type(quota_db_t)
@@ -2440,17 +2453,21 @@ index 5dd42f5..bef4392 100644
########################################
#
# Local policy
-@@ -34,6 +41,9 @@ files_home_filetrans(quota_t, quota_db_t, file)
+@@ -34,6 +41,13 @@ files_home_filetrans(quota_t, quota_db_t, file)
files_usr_filetrans(quota_t, quota_db_t, file)
files_var_filetrans(quota_t, quota_db_t, file)
files_spool_filetrans(quota_t, quota_db_t, file)
-+mta_spool_filetrans(quota_t, quota_db_t, file)
-+mta_spool_filetrans(quota_t, quota_db_t, file)
-+mta_spool_filetrans_queue(quota_t, quota_db_t, file)
++userdom_user_home_dir_filetrans(quota_t, quota_db_t, file)
++
++optional_policy(`
++ mta_spool_filetrans(quota_t, quota_db_t, file)
++ mta_spool_filetrans(quota_t, quota_db_t, file)
++ mta_spool_filetrans_queue(quota_t, quota_db_t, file)
++')
kernel_list_proc(quota_t)
kernel_read_proc_symlinks(quota_t)
-@@ -72,7 +82,7 @@ init_use_script_ptys(quota_t)
+@@ -72,7 +86,7 @@ init_use_script_ptys(quota_t)
logging_send_syslog_msg(quota_t)
@@ -2459,7 +2476,7 @@ index 5dd42f5..bef4392 100644
userdom_dontaudit_use_unpriv_user_fds(quota_t)
optional_policy(`
-@@ -82,3 +92,34 @@ optional_policy(`
+@@ -82,3 +96,34 @@ optional_policy(`
optional_policy(`
udev_read_db(quota_t)
')
@@ -7904,7 +7921,7 @@ index 0bac996..ca2388d 100644
+userdom_use_inherited_user_terminals(lockdev_t)
diff --git a/policy/modules/apps/mozilla.fc b/policy/modules/apps/mozilla.fc
-index 93ac529..800b5c8 100644
+index 93ac529..4c0895e 100644
--- a/policy/modules/apps/mozilla.fc
+++ b/policy/modules/apps/mozilla.fc
@@ -1,8 +1,14 @@
@@ -7922,13 +7939,15 @@ index 93ac529..800b5c8 100644
#
# /bin
-@@ -14,16 +20,24 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
+@@ -14,16 +20,28 @@ HOME_DIR/\.phoenix(/.*)? gen_context(system_u:object_r:mozilla_home_t,s0)
/usr/bin/epiphany -- gen_context(system_u:object_r:mozilla_exec_t,s0)
/usr/bin/mozilla-[0-9].* -- gen_context(system_u:object_r:mozilla_exec_t,s0)
/usr/bin/mozilla-bin-[0-9].* -- gen_context(system_u:object_r:mozilla_exec_t,s0)
++ifdef(`distro_redhat',`
+/usr/bin/nspluginscan -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
+/usr/bin/nspluginviewer -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
+/usr/lib/nspluginwrapper/npviewer.bin -- gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
++')
#
# /lib
@@ -7955,7 +7974,9 @@ index 93ac529..800b5c8 100644
+
+/usr/lib/mozilla/plugins-wrapped(/.*)? gen_context(system_u:object_r:mozilla_plugin_rw_t,s0)
+
++ifdef(`distro_redhat',`
+/usr/lib/nspluginwrapper/plugin-config -- gen_context(system_u:object_r:mozilla_plugin_config_exec_t,s0)
++')
diff --git a/policy/modules/apps/mozilla.if b/policy/modules/apps/mozilla.if
index fbb5c5a..ffeec16 100644
--- a/policy/modules/apps/mozilla.if
@@ -8176,15 +8197,12 @@ index fbb5c5a..ffeec16 100644
+')
+
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
-index 2e9318b..bb90a3b 100644
+index 2e9318b..04159de 100644
--- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te
-@@ -23,8 +23,9 @@ type mozilla_conf_t;
- files_config_file(mozilla_conf_t)
-
+@@ -25,6 +25,7 @@ files_config_file(mozilla_conf_t)
type mozilla_home_t;
--typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t };
-+typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t nsplugin_home_t };
+ typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t };
typealias mozilla_home_t alias { auditadm_mozilla_home_t secadm_mozilla_home_t };
+files_poly_member(mozilla_home_t)
userdom_user_home_content(mozilla_home_t)
@@ -8203,7 +8221,7 @@ index 2e9318b..bb90a3b 100644
files_tmpfs_file(mozilla_plugin_tmpfs_t)
ubac_constrained(mozilla_plugin_tmpfs_t)
-+type mozilla_plugin_rw_t alias nsplugin_rw_t;
++type mozilla_plugin_rw_t;
+files_type(mozilla_plugin_rw_t)
+
+type mozilla_plugin_config_t;
@@ -8421,7 +8439,7 @@ index 2e9318b..bb90a3b 100644
')
optional_policy(`
-@@ -438,18 +460,88 @@ optional_policy(`
+@@ -438,18 +460,97 @@ optional_policy(`
')
optional_policy(`
@@ -8513,6 +8531,15 @@ index 2e9318b..bb90a3b 100644
+
+optional_policy(`
+ xserver_use_user_fonts(mozilla_plugin_config_t)
++')
++ifdef(`distro_redhat',`
++ typealias mozilla_plugin_t alias nsplugin_t;
++ typealias mozilla_plugin_exec_t alias nsplugin_exec_t;
++ typealias mozilla_plugin_rw_t alias nsplugin_rw_t;
++ typealias mozilla_plugin_tmp_t alias nsplugin_tmp_t;
++ typealias mozilla_home_t alias nsplugin_home_t;
++ typealias mozilla_plugin_config_t alias nsplugin_config_t;
++ typealias mozilla_plugin_config_exec_t alias nsplugin_config_exec_t;
')
diff --git a/policy/modules/apps/mplayer.if b/policy/modules/apps/mplayer.if
index d8ea41d..8bdc526 100644
@@ -14858,7 +14885,7 @@ index 6cf8784..2354089 100644
+/usr/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0)
+/usr/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0)
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
-index f820f3b..cc3f02e 100644
+index f820f3b..1082bb5 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -146,14 +146,33 @@ interface(`dev_relabel_all_dev_nodes',`
@@ -15542,7 +15569,7 @@ index f820f3b..cc3f02e 100644
## Read and write to the zero device (/dev/zero).
## </summary>
## <param name="domain">
-@@ -4784,3 +5174,812 @@ interface(`dev_unconfined',`
+@@ -4784,3 +5174,822 @@ interface(`dev_unconfined',`
typeattribute $1 devices_unconfined_type;
')
@@ -16271,6 +16298,16 @@ index f820f3b..cc3f02e 100644
+ filetrans_pattern($1, device_t, xen_device_t, chr_file, "blktap9")
+ filetrans_pattern($1, device_t, xen_device_t, chr_file, "gntdev")
+ filetrans_pattern($1, device_t, xen_device_t, chr_file, "gntalloc")
++ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC0")
++ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC1")
++ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC2")
++ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC3")
++ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC4")
++ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC5")
++ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC6")
++ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC7")
++ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC8")
++ filetrans_pattern($1, device_t, sound_device_t, chr_file, "controlC9")
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "patmgr0")
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "patmgr1")
+ filetrans_pattern($1, device_t, sound_device_t, chr_file, "srnd0")
@@ -16356,10 +16393,18 @@ index f820f3b..cc3f02e 100644
+ filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card9")
+')
diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
-index 08f01e7..8f727be 100644
+index 08f01e7..d8c1d48 100644
--- a/policy/modules/kernel/devices.te
+++ b/policy/modules/kernel/devices.te
-@@ -108,6 +108,7 @@ dev_node(ksm_device_t)
+@@ -20,6 +20,7 @@ files_mountpoint(device_t)
+ files_associate_tmp(device_t)
+ fs_type(device_t)
+ fs_use_trans devtmpfs gen_context(system_u:object_r:device_t,s0);
++dev_node(device_t)
+
+ #
+ # Type for /dev/agpgart
+@@ -108,6 +109,7 @@ dev_node(ksm_device_t)
#
type kvm_device_t;
dev_node(kvm_device_t)
@@ -16367,7 +16412,7 @@ index 08f01e7..8f727be 100644
#
# Type for /dev/lirc
-@@ -118,6 +119,12 @@ dev_node(lirc_device_t)
+@@ -118,6 +120,12 @@ dev_node(lirc_device_t)
#
# Type for /dev/mapper/control
#
@@ -16380,7 +16425,7 @@ index 08f01e7..8f727be 100644
type lvm_control_t;
dev_node(lvm_control_t)
-@@ -218,6 +225,10 @@ files_mountpoint(sysfs_t)
+@@ -218,6 +226,10 @@ files_mountpoint(sysfs_t)
fs_type(sysfs_t)
genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0)
@@ -16391,7 +16436,7 @@ index 08f01e7..8f727be 100644
#
# Type for /dev/tpm
#
-@@ -265,6 +276,7 @@ dev_node(v4l_device_t)
+@@ -265,6 +277,7 @@ dev_node(v4l_device_t)
#
type vhost_device_t;
dev_node(vhost_device_t)
@@ -16399,7 +16444,7 @@ index 08f01e7..8f727be 100644
# Type for vmware devices.
type vmware_device_t;
-@@ -310,5 +322,5 @@ files_associate_tmp(device_node)
+@@ -310,5 +323,5 @@ files_associate_tmp(device_node)
#
allow devices_unconfined_type self:capability sys_rawio;
@@ -19523,7 +19568,7 @@ index 7be4ddf..f7021a0 100644
+
+/sys/class/net/ib.* gen_context(system_u:object_r:sysctl_net_t,s0)
diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if
-index 6346378..34c6897 100644
+index 6346378..3bfb1f8 100644
--- a/policy/modules/kernel/kernel.if
+++ b/policy/modules/kernel/kernel.if
@@ -345,13 +345,8 @@ interface(`kernel_load_module',`
@@ -19540,7 +19585,32 @@ index 6346378..34c6897 100644
')
########################################
-@@ -2072,7 +2067,7 @@ interface(`kernel_dontaudit_list_all_sysctls',`
+@@ -1464,6 +1459,24 @@ interface(`kernel_dontaudit_list_all_proc',`
+
+ ########################################
+ ## <summary>
++## Allow attempts to read all proc types.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`kernel_read_all_proc',`
++ gen_require(`
++ attribute proc_type;
++ ')
++
++ read_files_pattern($1, proc_type, proc_type)
++')
++
++########################################
++## <summary>
+ ## Do not audit attempts by caller to search
+ ## the base directory of sysctls.
+ ## </summary>
+@@ -2072,7 +2085,7 @@ interface(`kernel_dontaudit_list_all_sysctls',`
')
dontaudit $1 sysctl_type:dir list_dir_perms;
@@ -19549,7 +19619,7 @@ index 6346378..34c6897 100644
')
########################################
-@@ -2293,7 +2288,7 @@ interface(`kernel_read_unlabeled_state',`
+@@ -2293,7 +2306,7 @@ interface(`kernel_read_unlabeled_state',`
## </summary>
## <param name="domain">
## <summary>
@@ -19558,7 +19628,7 @@ index 6346378..34c6897 100644
## </summary>
## </param>
#
-@@ -2475,6 +2470,24 @@ interface(`kernel_rw_unlabeled_blk_files',`
+@@ -2475,6 +2488,24 @@ interface(`kernel_rw_unlabeled_blk_files',`
########################################
## <summary>
@@ -19583,7 +19653,7 @@ index 6346378..34c6897 100644
## Do not audit attempts by caller to get attributes for
## unlabeled character devices.
## </summary>
-@@ -2619,7 +2632,7 @@ interface(`kernel_sendrecv_unlabeled_association',`
+@@ -2619,7 +2650,7 @@ interface(`kernel_sendrecv_unlabeled_association',`
allow $1 unlabeled_t:association { sendto recvfrom };
# temporary hack until labeling on packets is supported
@@ -19592,7 +19662,7 @@ index 6346378..34c6897 100644
')
########################################
-@@ -2657,6 +2670,24 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',`
+@@ -2657,6 +2688,24 @@ interface(`kernel_dontaudit_sendrecv_unlabeled_association',`
########################################
## <summary>
@@ -19617,7 +19687,7 @@ index 6346378..34c6897 100644
## Receive TCP packets from an unlabeled connection.
## </summary>
## <desc>
-@@ -2684,6 +2715,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',`
+@@ -2684,6 +2733,25 @@ interface(`kernel_tcp_recvfrom_unlabeled',`
########################################
## <summary>
@@ -19643,7 +19713,7 @@ index 6346378..34c6897 100644
## Do not audit attempts to receive TCP packets from an unlabeled
## connection.
## </summary>
-@@ -2793,6 +2843,33 @@ interface(`kernel_raw_recvfrom_unlabeled',`
+@@ -2793,6 +2861,33 @@ interface(`kernel_raw_recvfrom_unlabeled',`
allow $1 unlabeled_t:rawip_socket recvfrom;
')
@@ -19677,7 +19747,7 @@ index 6346378..34c6897 100644
########################################
## <summary>
-@@ -2948,6 +3025,24 @@ interface(`kernel_relabelfrom_unlabeled_database',`
+@@ -2948,6 +3043,24 @@ interface(`kernel_relabelfrom_unlabeled_database',`
########################################
## <summary>
@@ -19702,12 +19772,12 @@ index 6346378..34c6897 100644
## Unconfined access to kernel module resources.
## </summary>
## <param name="domain">
-@@ -2962,4 +3057,43 @@ interface(`kernel_unconfined',`
+@@ -2962,4 +3075,43 @@ interface(`kernel_unconfined',`
')
typeattribute $1 kern_unconfined;
+ kernel_load_module($1)
- ')
++')
+
+########################################
+## <summary>
@@ -19744,7 +19814,7 @@ index 6346378..34c6897 100644
+ ')
+
+ typeattribute $1 proc_type;
-+')
+ ')
+
diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te
index d91c62f..8852535 100644
@@ -54903,16 +54973,18 @@ index 5a9630c..61f0099 100644
+ allow $1 qpidd_t:shm rw_shm_perms;
')
diff --git a/policy/modules/services/qpid.te b/policy/modules/services/qpid.te
-index cb7ecb5..3df1532 100644
+index cb7ecb5..08d19e6 100644
--- a/policy/modules/services/qpid.te
+++ b/policy/modules/services/qpid.te
-@@ -12,12 +12,12 @@ init_daemon_domain(qpidd_t, qpidd_exec_t)
+@@ -12,12 +12,15 @@ init_daemon_domain(qpidd_t, qpidd_exec_t)
type qpidd_initrc_exec_t;
init_script_file(qpidd_initrc_exec_t)
-type qpidd_var_lib_t;
-files_type(qpidd_var_lib_t)
--
++type qpidd_tmpfs_t;
++files_tmpfs_file(qpidd_tmpfs_t)
+
type qpidd_var_run_t;
files_pid_file(qpidd_var_run_t)
@@ -54922,12 +54994,16 @@ index cb7ecb5..3df1532 100644
########################################
#
# qpidd local policy
-@@ -30,27 +30,30 @@ allow qpidd_t self:shm create_shm_perms;
+@@ -30,27 +33,34 @@ allow qpidd_t self:shm create_shm_perms;
allow qpidd_t self:tcp_socket create_stream_socket_perms;
allow qpidd_t self:unix_stream_socket create_stream_socket_perms;
-manage_dirs_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
-manage_files_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
++manage_dirs_pattern(qpidd_t, qpidd_tmpfs_t, qpidd_tmpfs_t)
++manage_files_pattern(qpidd_t, qpidd_tmpfs_t, qpidd_tmpfs_t)
++fs_tmpfs_filetrans(qpidd_t, qpidd_tmpfs_t, { dir file })
++
+manage_dirs_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
+manage_files_pattern(qpidd_t, qpidd_var_lib_t, qpidd_var_lib_t)
files_var_lib_filetrans(qpidd_t, qpidd_var_lib_t, { file dir })
@@ -54958,7 +55034,7 @@ index cb7ecb5..3df1532 100644
logging_send_syslog_msg(qpidd_t)
-@@ -61,3 +64,8 @@ sysnet_dns_name_resolve(qpidd_t)
+@@ -61,3 +71,8 @@ sysnet_dns_name_resolve(qpidd_t)
optional_policy(`
corosync_stream_connect(qpidd_t)
')
@@ -60256,7 +60332,7 @@ index 275f9fb..f1343b7 100644
init_labeled_script_domtrans($1, snmpd_initrc_exec_t)
domain_system_change_exemption($1)
diff --git a/policy/modules/services/snmp.te b/policy/modules/services/snmp.te
-index 3d8d1b3..9c747d4 100644
+index 3d8d1b3..1d22eed 100644
--- a/policy/modules/services/snmp.te
+++ b/policy/modules/services/snmp.te
@@ -4,6 +4,7 @@ policy_module(snmp, 1.11.0)
@@ -60284,7 +60360,7 @@ index 3d8d1b3..9c747d4 100644
allow snmpd_t self:tcp_socket create_stream_socket_perms;
allow snmpd_t self:udp_socket connected_stream_socket_perms;
-@@ -41,10 +44,11 @@ manage_files_pattern(snmpd_t, snmpd_var_lib_t, snmpd_var_lib_t)
+@@ -41,18 +44,18 @@ manage_files_pattern(snmpd_t, snmpd_var_lib_t, snmpd_var_lib_t)
manage_sock_files_pattern(snmpd_t, snmpd_var_lib_t, snmpd_var_lib_t)
files_usr_filetrans(snmpd_t, snmpd_var_lib_t, file)
files_var_filetrans(snmpd_t, snmpd_var_lib_t, { file dir sock_file })
@@ -60298,7 +60374,16 @@ index 3d8d1b3..9c747d4 100644
kernel_read_device_sysctls(snmpd_t)
kernel_read_kernel_sysctls(snmpd_t)
-@@ -94,15 +98,19 @@ files_search_home(snmpd_t)
+ kernel_read_fs_sysctls(snmpd_t)
+ kernel_read_net_sysctls(snmpd_t)
+ kernel_read_proc_symlinks(snmpd_t)
+-kernel_read_system_state(snmpd_t)
+-kernel_read_network_state(snmpd_t)
++kernel_read_all_proc(snmpd_t)
+
+ corecmd_exec_bin(snmpd_t)
+ corecmd_exec_shell(snmpd_t)
+@@ -94,15 +97,19 @@ files_search_home(snmpd_t)
fs_getattr_all_dirs(snmpd_t)
fs_getattr_all_fs(snmpd_t)
fs_search_auto_mountpoints(snmpd_t)
@@ -60319,7 +60404,7 @@ index 3d8d1b3..9c747d4 100644
logging_send_syslog_msg(snmpd_t)
-@@ -115,7 +123,7 @@ sysnet_read_config(snmpd_t)
+@@ -115,7 +122,7 @@ sysnet_read_config(snmpd_t)
userdom_dontaudit_use_unpriv_user_fds(snmpd_t)
userdom_dontaudit_search_user_home_dirs(snmpd_t)
@@ -62424,7 +62509,7 @@ index 941380a..4afc698 100644
# Allow sssd_t to restart the apache service
sssd_initrc_domtrans($1)
diff --git a/policy/modules/services/sssd.te b/policy/modules/services/sssd.te
-index 8ffa257..eb8979d 100644
+index 8ffa257..b698994 100644
--- a/policy/modules/services/sssd.te
+++ b/policy/modules/services/sssd.te
@@ -17,6 +17,7 @@ files_pid_file(sssd_public_t)
@@ -62441,7 +62526,7 @@ index 8ffa257..eb8979d 100644
#
-allow sssd_t self:capability { dac_read_search dac_override kill sys_nice setgid setuid };
+
-+allow sssd_t self:capability { chown dac_read_search dac_override kill net_admin sys_nice setgid setuid };
++allow sssd_t self:capability { chown dac_read_search dac_override kill net_admin sys_nice setgid setuid sys_admin };
allow sssd_t self:process { setfscreate setsched sigkill signal getsched };
-allow sssd_t self:fifo_file rw_file_perms;
+allow sssd_t self:fifo_file rw_fifo_file_perms;
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 478f7d9..739af41 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -16,7 +16,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.10.0
-Release: 70%{?dist}
+Release: 71%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -471,6 +471,13 @@ SELinux Reference policy mls base module.
%endif
%changelog
+* Tue Dec 20 2011 Miroslav Grepl <mgrepl at redhat.com> 3.10.0-71
+- default trans rules for Rawhide policy
+- Make sure sound_devices controlC* are labeled correctly on creation
+- sssd now needs sys_admin
+- Allow snmp to read all proc_type
+- Allow to setup users homedir with quota.group
+
* Mon Dec 19 2011 Miroslav Grepl <mgrepl at redhat.com> 3.10.0-70
- Add httpd_can_connect_ldap() interface
- apcupsd_t needs to use seriel ports connected to usb devices
More information about the scm-commits
mailing list