[selinux-policy] - Disable nsplugin module
Miroslav Grepl
mgrepl at fedoraproject.org
Mon Nov 28 14:55:19 UTC 2011
commit 0ca57d1d0a5abddc3b9a27f71f3713b99caf1767
Author: Miroslav <mgrepl at redhat.com>
Date: Mon Nov 28 15:54:55 2011 +0100
- Disable nsplugin module
policy-F16.patch | 248 +++++++++++++++++++++++++++++++++++----------------
selinux-policy.spec | 2 +-
2 files changed, 173 insertions(+), 77 deletions(-)
---
diff --git a/policy-F16.patch b/policy-F16.patch
index eab41fe..39e0a72 100644
--- a/policy-F16.patch
+++ b/policy-F16.patch
@@ -8570,10 +8570,10 @@ index 0000000..8d7c751
+')
diff --git a/policy/modules/apps/namespace.te b/policy/modules/apps/namespace.te
new file mode 100644
-index 0000000..6d4ec21
+index 0000000..a337d62
--- /dev/null
+++ b/policy/modules/apps/namespace.te
-@@ -0,0 +1,40 @@
+@@ -0,0 +1,42 @@
+policy_module(namespace,1.0.0)
+
+########################################
@@ -8598,6 +8598,8 @@ index 0000000..6d4ec21
+
+kernel_read_system_state(namespace_init_t)
+
++corecmd_exec_shell(namespace_init_t)
++
+domain_use_interactive_fds(namespace_init_t)
+
+files_read_etc_files(namespace_init_t)
@@ -12554,7 +12556,7 @@ index 223ad43..d95e720 100644
rsync_exec(yam_t)
')
diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
-index 3fae11a..37d3b99 100644
+index 3fae11a..c82360e 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
@@ -97,8 +97,6 @@ ifdef(`distro_redhat',`
@@ -12791,7 +12793,7 @@ index 3fae11a..37d3b99 100644
/var/qmail/bin -d gen_context(system_u:object_r:bin_t,s0)
/var/qmail/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
-@@ -385,3 +401,11 @@ ifdef(`distro_suse', `
+@@ -385,3 +401,12 @@ ifdef(`distro_suse', `
ifdef(`distro_suse',`
/var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0)
')
@@ -12800,6 +12802,7 @@ index 3fae11a..37d3b99 100644
+# /usr/lib
+#
+
++/usr/lib/iscan/network -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/ruby/gems/.*/agents(/.*)? gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/virtualbox/VBoxManage -- gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/yp/.+ -- gen_context(system_u:object_r:bin_t,s0)
@@ -21553,7 +21556,7 @@ index 2be17d2..de3c13e 100644
+ userdom_execmod_user_home_files(staff_usertype)
+')
diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te
-index e14b961..b8f0df4 100644
+index e14b961..37bdf8d 100644
--- a/policy/modules/roles/sysadm.te
+++ b/policy/modules/roles/sysadm.te
@@ -5,13 +5,6 @@ policy_module(sysadm, 2.2.1)
@@ -21663,7 +21666,7 @@ index e14b961..b8f0df4 100644
optional_policy(`
- consoletype_run(sysadm_t, sysadm_r)
+ cron_admin_role(sysadm_r, sysadm_t)
-+ cron_role(sysadm_r, sysadm_t)
++ #cron_role(sysadm_r, sysadm_t)
')
optional_policy(`
@@ -27260,7 +27263,7 @@ index 44a1e3d..7cc67ec 100644
+ named_systemctl($1)
')
diff --git a/policy/modules/services/bind.te b/policy/modules/services/bind.te
-index 4deca04..fc86505 100644
+index 4deca04..7859fa1 100644
--- a/policy/modules/services/bind.te
+++ b/policy/modules/services/bind.te
@@ -6,16 +6,24 @@ policy_module(bind, 1.11.0)
@@ -27334,18 +27337,20 @@ index 4deca04..fc86505 100644
tunable_policy(`named_write_master_zones',`
manage_dirs_pattern(named_t, named_zone_t, named_zone_t)
manage_files_pattern(named_t, named_zone_t, named_zone_t)
-@@ -154,6 +170,10 @@ tunable_policy(`named_write_master_zones',`
+@@ -154,6 +170,12 @@ tunable_policy(`named_write_master_zones',`
')
optional_policy(`
++ # needed by FreeIPA with DNS support
+ dirsrv_stream_connect(named_t)
++ ldap_stream_connect(named_t)
+')
+
+optional_policy(`
init_dbus_chat_script(named_t)
sysnet_dbus_chat_dhcpc(named_t)
-@@ -198,18 +218,18 @@ allow ndc_t self:process { fork signal_perms };
+@@ -198,18 +220,18 @@ allow ndc_t self:process { fork signal_perms };
allow ndc_t self:fifo_file rw_fifo_file_perms;
allow ndc_t self:unix_stream_socket { connect create_stream_socket_perms };
allow ndc_t self:tcp_socket create_socket_perms;
@@ -27367,7 +27372,7 @@ index 4deca04..fc86505 100644
kernel_read_kernel_sysctls(ndc_t)
corenet_all_recvfrom_unlabeled(ndc_t)
-@@ -228,6 +248,8 @@ files_search_pids(ndc_t)
+@@ -228,6 +250,8 @@ files_search_pids(ndc_t)
fs_getattr_xattr_fs(ndc_t)
@@ -27376,7 +27381,7 @@ index 4deca04..fc86505 100644
init_use_fds(ndc_t)
init_use_script_ptys(ndc_t)
-@@ -235,24 +257,13 @@ logging_send_syslog_msg(ndc_t)
+@@ -235,24 +259,13 @@ logging_send_syslog_msg(ndc_t)
miscfiles_read_localization(ndc_t)
@@ -29917,7 +29922,7 @@ index 1f11572..717fb8d 100644
init_labeled_script_domtrans($1, clamd_initrc_exec_t)
diff --git a/policy/modules/services/clamav.te b/policy/modules/services/clamav.te
-index f758323..4bc077f 100644
+index f758323..4c06224 100644
--- a/policy/modules/services/clamav.te
+++ b/policy/modules/services/clamav.te
@@ -1,9 +1,16 @@
@@ -29991,7 +29996,7 @@ index f758323..4bc077f 100644
optional_policy(`
amavis_read_lib_files(clamd_t)
amavis_read_spool_files(clamd_t)
-@@ -142,13 +147,30 @@ optional_policy(`
+@@ -142,13 +147,31 @@ optional_policy(`
')
optional_policy(`
@@ -30011,6 +30016,7 @@ index f758323..4bc077f 100644
+
+optional_policy(`
+ spamd_stream_connect(clamd_t)
++ spamd_read_pid(clamd_t)
+')
+
tunable_policy(`clamd_use_jit',`
@@ -30023,7 +30029,7 @@ index f758323..4bc077f 100644
')
########################################
-@@ -178,10 +200,16 @@ files_pid_filetrans(freshclam_t, clamd_var_run_t, file)
+@@ -178,10 +201,16 @@ files_pid_filetrans(freshclam_t, clamd_var_run_t, file)
# log files (own logfiles only)
manage_files_pattern(freshclam_t, freshclam_var_log_t, freshclam_var_log_t)
@@ -30042,7 +30048,7 @@ index f758323..4bc077f 100644
corenet_all_recvfrom_unlabeled(freshclam_t)
corenet_all_recvfrom_netlabel(freshclam_t)
corenet_tcp_sendrecv_generic_if(freshclam_t)
-@@ -189,6 +217,7 @@ corenet_tcp_sendrecv_generic_node(freshclam_t)
+@@ -189,6 +218,7 @@ corenet_tcp_sendrecv_generic_node(freshclam_t)
corenet_tcp_sendrecv_all_ports(freshclam_t)
corenet_tcp_sendrecv_clamd_port(freshclam_t)
corenet_tcp_connect_http_port(freshclam_t)
@@ -30050,7 +30056,7 @@ index f758323..4bc077f 100644
corenet_sendrecv_http_client_packets(freshclam_t)
dev_read_rand(freshclam_t)
-@@ -207,16 +236,18 @@ miscfiles_read_localization(freshclam_t)
+@@ -207,16 +237,18 @@ miscfiles_read_localization(freshclam_t)
clamav_stream_connect(freshclam_t)
@@ -30073,7 +30079,7 @@ index f758323..4bc077f 100644
########################################
#
# clamscam local policy
-@@ -242,15 +273,29 @@ files_tmp_filetrans(clamscan_t, clamscan_tmp_t, { file dir })
+@@ -242,15 +274,29 @@ files_tmp_filetrans(clamscan_t, clamscan_tmp_t, { file dir })
manage_files_pattern(clamscan_t, clamd_var_lib_t, clamd_var_lib_t)
allow clamscan_t clamd_var_lib_t:dir list_dir_perms;
@@ -30103,7 +30109,7 @@ index f758323..4bc077f 100644
files_read_etc_files(clamscan_t)
files_read_etc_runtime_files(clamscan_t)
-@@ -264,10 +309,15 @@ miscfiles_read_public_files(clamscan_t)
+@@ -264,10 +310,15 @@ miscfiles_read_public_files(clamscan_t)
clamav_stream_connect(clamscan_t)
@@ -31175,10 +31181,10 @@ index 0000000..40a0157
+
diff --git a/policy/modules/services/collectd.te b/policy/modules/services/collectd.te
new file mode 100644
-index 0000000..e4d7098
+index 0000000..ca71d08
--- /dev/null
+++ b/policy/modules/services/collectd.te
-@@ -0,0 +1,79 @@
+@@ -0,0 +1,80 @@
+policy_module(collectd, 1.0.0)
+
+########################################
@@ -31252,17 +31258,32 @@ index 0000000..e4d7098
+
+optional_policy(`
+ apache_content_template(collectd)
-+
++
++ files_search_var_lib(httpd_collectd_script_t)
+ read_files_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
+ list_dirs_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
+ miscfiles_setattr_fonts_cache_dirs(httpd_collectd_script_t)
+')
+
diff --git a/policy/modules/services/colord.te b/policy/modules/services/colord.te
-index 74505cc..145a4eb 100644
+index 74505cc..246bbf9 100644
--- a/policy/modules/services/colord.te
+++ b/policy/modules/services/colord.te
-@@ -23,6 +23,7 @@ files_type(colord_var_lib_t)
+@@ -5,6 +5,13 @@ policy_module(colord, 1.0.0)
+ # Declarations
+ #
+
++## <desc>
++## <p>
++## Allow colord domain to connect to the network using TCP.
++## </p>
++## </desc>
++gen_tunable(colord_can_network_connect, false)
++
+ type colord_t;
+ type colord_exec_t;
+ dbus_system_domain(colord_t, colord_exec_t)
+@@ -23,9 +30,11 @@ files_type(colord_var_lib_t)
# colord local policy
#
allow colord_t self:capability { dac_read_search dac_override };
@@ -31270,7 +31291,11 @@ index 74505cc..145a4eb 100644
allow colord_t self:process signal;
allow colord_t self:fifo_file rw_fifo_file_perms;
allow colord_t self:netlink_kobject_uevent_socket create_socket_perms;
-@@ -41,8 +42,13 @@ manage_dirs_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
++allow colord_t self:tcp_socket create_stream_socket_perms;
+ allow colord_t self:udp_socket create_socket_perms;
+ allow colord_t self:unix_dgram_socket create_socket_perms;
+
+@@ -41,8 +50,14 @@ manage_dirs_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
manage_files_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
files_var_lib_filetrans(colord_t, colord_var_lib_t, { file dir })
@@ -31282,10 +31307,11 @@ index 74505cc..145a4eb 100644
+
+# reads *.ini files
+corecmd_exec_bin(colord_t)
++corecmd_exec_shell(colord_t)
corenet_all_recvfrom_unlabeled(colord_t)
corenet_all_recvfrom_netlabel(colord_t)
-@@ -50,6 +56,8 @@ corenet_udp_bind_generic_node(colord_t)
+@@ -50,6 +65,8 @@ corenet_udp_bind_generic_node(colord_t)
corenet_udp_bind_ipp_port(colord_t)
corenet_tcp_connect_ipp_port(colord_t)
@@ -31294,7 +31320,7 @@ index 74505cc..145a4eb 100644
dev_read_video_dev(colord_t)
dev_write_video_dev(colord_t)
dev_rw_printer(colord_t)
-@@ -65,21 +73,24 @@ files_list_mnt(colord_t)
+@@ -65,19 +82,36 @@ files_list_mnt(colord_t)
files_read_etc_files(colord_t)
files_read_usr_files(colord_t)
@@ -31315,19 +31341,24 @@ index 74505cc..145a4eb 100644
-sysnet_dns_name_resolve(colord_t)
+fs_getattr_tmpfs(colord_t)
+userdom_rw_user_tmpfs_files(colord_t)
-
--tunable_policy(`use_nfs_home_dirs',`
-- fs_read_nfs_files(colord_t)
--')
--
--tunable_policy(`use_samba_home_dirs',`
-- fs_read_cifs_files(colord_t)
--')
++
+userdom_home_reader(colord_t)
++
++tunable_policy(`colord_can_network_connect',`
++ corenet_tcp_connect_all_ports(colord_t)
++')
- optional_policy(`
- cups_read_config(colord_t)
-@@ -89,6 +100,12 @@ optional_policy(`
+ tunable_policy(`use_nfs_home_dirs',`
++ fs_getattr_nfs(colord_t)
+ fs_read_nfs_files(colord_t)
+ ')
+
+ tunable_policy(`use_samba_home_dirs',`
++ fs_getattr_cifs(colord_t)
+ fs_read_cifs_files(colord_t)
+ ')
+
+@@ -89,6 +123,12 @@ optional_policy(`
')
optional_policy(`
@@ -31340,7 +31371,7 @@ index 74505cc..145a4eb 100644
policykit_dbus_chat(colord_t)
policykit_domtrans_auth(colord_t)
policykit_read_lib(colord_t)
-@@ -96,5 +113,16 @@ optional_policy(`
+@@ -96,5 +136,16 @@ optional_policy(`
')
optional_policy(`
@@ -33674,7 +33705,7 @@ index c43ff4c..5da88b5 100644
init_labeled_script_domtrans($1, cvs_initrc_exec_t)
domain_system_change_exemption($1)
diff --git a/policy/modules/services/cvs.te b/policy/modules/services/cvs.te
-index 88e7e97..e18dc0b 100644
+index 88e7e97..1546703 100644
--- a/policy/modules/services/cvs.te
+++ b/policy/modules/services/cvs.te
@@ -6,9 +6,9 @@ policy_module(cvs, 1.9.0)
@@ -33704,7 +33735,16 @@ index 88e7e97..e18dc0b 100644
manage_dirs_pattern(cvs_t, cvs_data_t, cvs_data_t)
manage_files_pattern(cvs_t, cvs_data_t, cvs_data_t)
-@@ -112,4 +112,5 @@ optional_policy(`
+@@ -81,6 +81,8 @@ files_read_etc_runtime_files(cvs_t)
+ # for identd; cjp: this should probably only be inetd_child rules?
+ files_search_home(cvs_t)
+
++init_dontaudit_read_utmp(cvs_t)
++
+ logging_send_syslog_msg(cvs_t)
+ logging_send_audit_msgs(cvs_t)
+
+@@ -112,4 +114,5 @@ optional_policy(`
read_files_pattern(httpd_cvs_script_t, cvs_data_t, cvs_data_t)
manage_dirs_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t)
manage_files_pattern(httpd_cvs_script_t, cvs_tmp_t, cvs_tmp_t)
@@ -36415,7 +36455,7 @@ index 9bd812b..144cbb7 100644
+ dnsmasq_systemctl($1)
')
diff --git a/policy/modules/services/dnsmasq.te b/policy/modules/services/dnsmasq.te
-index fdaeeba..8542225 100644
+index fdaeeba..b1ea136 100644
--- a/policy/modules/services/dnsmasq.te
+++ b/policy/modules/services/dnsmasq.te
@@ -24,6 +24,9 @@ logging_log_file(dnsmasq_var_log_t)
@@ -36428,7 +36468,7 @@ index fdaeeba..8542225 100644
########################################
#
# Local policy
-@@ -48,11 +51,13 @@ files_var_lib_filetrans(dnsmasq_t, dnsmasq_lease_t, file)
+@@ -48,11 +51,14 @@ files_var_lib_filetrans(dnsmasq_t, dnsmasq_lease_t, file)
manage_files_pattern(dnsmasq_t, dnsmasq_var_log_t, dnsmasq_var_log_t)
logging_log_filetrans(dnsmasq_t, dnsmasq_var_log_t, file)
@@ -36439,11 +36479,12 @@ index fdaeeba..8542225 100644
kernel_read_kernel_sysctls(dnsmasq_t)
kernel_read_system_state(dnsmasq_t)
++kernel_read_network_state(dnsmasq_t)
+kernel_request_load_module(dnsmasq_t)
corenet_all_recvfrom_unlabeled(dnsmasq_t)
corenet_all_recvfrom_netlabel(dnsmasq_t)
-@@ -88,6 +93,8 @@ logging_send_syslog_msg(dnsmasq_t)
+@@ -88,6 +94,8 @@ logging_send_syslog_msg(dnsmasq_t)
miscfiles_read_localization(dnsmasq_t)
@@ -36452,7 +36493,7 @@ index fdaeeba..8542225 100644
userdom_dontaudit_use_unpriv_user_fds(dnsmasq_t)
userdom_dontaudit_search_user_home_dirs(dnsmasq_t)
-@@ -96,7 +103,20 @@ optional_policy(`
+@@ -96,7 +104,20 @@ optional_policy(`
')
optional_policy(`
@@ -36473,7 +36514,7 @@ index fdaeeba..8542225 100644
')
optional_policy(`
-@@ -114,4 +134,5 @@ optional_policy(`
+@@ -114,4 +135,5 @@ optional_policy(`
optional_policy(`
virt_manage_lib_files(dnsmasq_t)
virt_read_pid_files(dnsmasq_t)
@@ -43323,7 +43364,7 @@ index 67c7fdd..d7338be 100644
## <summary>
## Execute mailman CGI scripts in the
diff --git a/policy/modules/services/mailman.te b/policy/modules/services/mailman.te
-index af4d572..cea085e 100644
+index af4d572..0c0925e 100644
--- a/policy/modules/services/mailman.te
+++ b/policy/modules/services/mailman.te
@@ -19,6 +19,9 @@ logging_log_file(mailman_log_t)
@@ -43336,7 +43377,7 @@ index af4d572..cea085e 100644
mailman_domain_template(mail)
init_daemon_domain(mailman_mail_t, mailman_mail_exec_t)
-@@ -61,14 +64,22 @@ optional_policy(`
+@@ -61,14 +64,24 @@ optional_policy(`
# Mailman mail local policy
#
@@ -43358,10 +43399,12 @@ index af4d572..cea085e 100644
+corenet_tcp_connect_innd_port(mailman_mail_t)
+corenet_tcp_connect_spamd_port(mailman_mail_t)
+
++dev_read_urand(mailman_mail_t)
++
files_search_spool(mailman_mail_t)
fs_rw_anon_inodefs_files(mailman_mail_t)
-@@ -81,11 +92,16 @@ optional_policy(`
+@@ -81,11 +94,16 @@ optional_policy(`
')
optional_policy(`
@@ -43378,7 +43421,7 @@ index af4d572..cea085e 100644
')
########################################
-@@ -104,6 +120,8 @@ manage_lnk_files_pattern(mailman_queue_t, mailman_archive_t, mailman_archive_t)
+@@ -104,6 +122,8 @@ manage_lnk_files_pattern(mailman_queue_t, mailman_archive_t, mailman_archive_t)
kernel_read_proc_symlinks(mailman_queue_t)
@@ -43387,7 +43430,7 @@ index af4d572..cea085e 100644
auth_domtrans_chk_passwd(mailman_queue_t)
files_dontaudit_search_pids(mailman_queue_t)
-@@ -125,4 +143,4 @@ optional_policy(`
+@@ -125,4 +145,4 @@ optional_policy(`
optional_policy(`
su_exec(mailman_queue_t)
@@ -53190,7 +53233,7 @@ index 2855a44..58bb459 100644
+ allow $1 puppet_var_run_t:dir search_dir_perms;
+')
diff --git a/policy/modules/services/puppet.te b/policy/modules/services/puppet.te
-index 64c5f95..fb500de 100644
+index 64c5f95..e237da7 100644
--- a/policy/modules/services/puppet.te
+++ b/policy/modules/services/puppet.te
@@ -6,12 +6,19 @@ policy_module(puppet, 1.0.0)
@@ -53386,7 +53429,7 @@ index 64c5f95..fb500de 100644
#
allow puppetmaster_t self:capability { dac_read_search dac_override setuid setgid fowner chown fsetid sys_tty_config };
-@@ -171,29 +258,35 @@ allow puppetmaster_t self:fifo_file rw_fifo_file_perms;
+@@ -171,29 +258,36 @@ allow puppetmaster_t self:fifo_file rw_fifo_file_perms;
allow puppetmaster_t self:netlink_route_socket create_netlink_socket_perms;
allow puppetmaster_t self:socket create;
allow puppetmaster_t self:tcp_socket create_stream_socket_perms;
@@ -53419,13 +53462,14 @@ index 64c5f95..fb500de 100644
+allow puppetmaster_t puppet_tmp_t:dir relabel_dir_perms;
kernel_dontaudit_search_kernel_sysctl(puppetmaster_t)
++`kernel_read_network_state(puppetmaster_t)
kernel_read_system_state(puppetmaster_t)
kernel_read_crypto_sysctls(puppetmaster_t)
+kernel_read_kernel_sysctls(puppetmaster_t)
corecmd_exec_bin(puppetmaster_t)
corecmd_exec_shell(puppetmaster_t)
-@@ -206,21 +299,46 @@ corenet_tcp_bind_generic_node(puppetmaster_t)
+@@ -206,21 +300,46 @@ corenet_tcp_bind_generic_node(puppetmaster_t)
corenet_tcp_bind_puppet_port(puppetmaster_t)
corenet_sendrecv_puppet_server_packets(puppetmaster_t)
@@ -53475,7 +53519,7 @@ index 64c5f95..fb500de 100644
optional_policy(`
hostname_exec(puppetmaster_t)
')
-@@ -231,3 +349,9 @@ optional_policy(`
+@@ -231,3 +350,9 @@ optional_policy(`
rpm_exec(puppetmaster_t)
rpm_read_db(puppetmaster_t)
')
@@ -57937,7 +57981,7 @@ index 82cb169..48c023e 100644
+ samba_systemctl($1)
')
diff --git a/policy/modules/services/samba.te b/policy/modules/services/samba.te
-index e30bb63..d893f99 100644
+index e30bb63..bac0112 100644
--- a/policy/modules/services/samba.te
+++ b/policy/modules/services/samba.te
@@ -85,6 +85,9 @@ files_config_file(samba_etc_t)
@@ -58253,7 +58297,22 @@ index e30bb63..d893f99 100644
corenet_tcp_connect_epmap_port(winbind_t)
corenet_tcp_connect_all_unreserved_ports(winbind_t)
-@@ -863,6 +888,12 @@ userdom_manage_user_home_content_pipes(winbind_t)
+@@ -850,10 +875,14 @@ domain_use_interactive_fds(winbind_t)
+
+ files_read_etc_files(winbind_t)
+ files_read_usr_symlinks(winbind_t)
++files_list_var_lib(winbind_t)
+
+ logging_send_syslog_msg(winbind_t)
+
+ miscfiles_read_localization(winbind_t)
++miscfiles_read_generic_certs(winbind_t)
++
++sysnet_use_ldap(winbind_t)
+
+ userdom_dontaudit_use_unpriv_user_fds(winbind_t)
+ userdom_manage_user_home_content_dirs(winbind_t)
+@@ -863,6 +892,12 @@ userdom_manage_user_home_content_pipes(winbind_t)
userdom_manage_user_home_content_sockets(winbind_t)
userdom_user_home_dir_filetrans_user_home_content(winbind_t, { dir file lnk_file fifo_file sock_file })
@@ -58266,7 +58325,7 @@ index e30bb63..d893f99 100644
optional_policy(`
kerberos_use(winbind_t)
')
-@@ -904,7 +935,7 @@ logging_send_syslog_msg(winbind_helper_t)
+@@ -904,7 +939,7 @@ logging_send_syslog_msg(winbind_helper_t)
miscfiles_read_localization(winbind_helper_t)
@@ -58275,7 +58334,7 @@ index e30bb63..d893f99 100644
optional_policy(`
apache_append_log(winbind_helper_t)
-@@ -922,6 +953,18 @@ optional_policy(`
+@@ -922,6 +957,18 @@ optional_policy(`
#
optional_policy(`
@@ -58294,7 +58353,7 @@ index e30bb63..d893f99 100644
type samba_unconfined_script_t;
type samba_unconfined_script_exec_t;
domain_type(samba_unconfined_script_t)
-@@ -932,9 +975,12 @@ optional_policy(`
+@@ -932,9 +979,12 @@ optional_policy(`
allow smbd_t samba_unconfined_script_exec_t:dir search_dir_perms;
allow smbd_t samba_unconfined_script_exec_t:file ioctl;
@@ -58613,7 +58672,7 @@ index f1aea88..3e6a93f 100644
admin_pattern($1, saslauthd_var_run_t)
')
diff --git a/policy/modules/services/sasl.te b/policy/modules/services/sasl.te
-index cfc60dd..791c5b3 100644
+index cfc60dd..71d76cf 100644
--- a/policy/modules/services/sasl.te
+++ b/policy/modules/services/sasl.te
@@ -19,9 +19,6 @@ init_daemon_domain(saslauthd_t, saslauthd_exec_t)
@@ -58650,7 +58709,15 @@ index cfc60dd..791c5b3 100644
corenet_all_recvfrom_unlabeled(saslauthd_t)
corenet_all_recvfrom_netlabel(saslauthd_t)
-@@ -94,6 +94,7 @@ tunable_policy(`allow_saslauthd_read_shadow',`
+@@ -55,6 +55,7 @@ corenet_tcp_sendrecv_generic_if(saslauthd_t)
+ corenet_tcp_sendrecv_generic_node(saslauthd_t)
+ corenet_tcp_sendrecv_all_ports(saslauthd_t)
+ corenet_tcp_connect_pop_port(saslauthd_t)
++corenet_tcp_connect_zarafa_port(saslauthd_t)
+ corenet_sendrecv_pop_client_packets(saslauthd_t)
+
+ dev_read_urand(saslauthd_t)
+@@ -94,6 +95,7 @@ tunable_policy(`allow_saslauthd_read_shadow',`
optional_policy(`
kerberos_keytab_template(saslauthd, saslauthd_t)
@@ -59663,7 +59730,7 @@ index 6b3abf9..a785741 100644
+/var/spool/MD-Quarantine(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0)
+/var/spool/MIMEDefang(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0)
diff --git a/policy/modules/services/spamassassin.if b/policy/modules/services/spamassassin.if
-index c954f31..85e8212 100644
+index c954f31..4aac595 100644
--- a/policy/modules/services/spamassassin.if
+++ b/policy/modules/services/spamassassin.if
@@ -14,6 +14,7 @@
@@ -59782,7 +59849,7 @@ index c954f31..85e8212 100644
allow $1 spamd_tmp_t:file read_file_perms;
')
-@@ -223,5 +291,75 @@ interface(`spamassassin_dontaudit_getattr_spamd_tmp_sockets',`
+@@ -223,5 +291,94 @@ interface(`spamassassin_dontaudit_getattr_spamd_tmp_sockets',`
type spamd_tmp_t;
')
@@ -59790,6 +59857,25 @@ index c954f31..85e8212 100644
+ dontaudit $1 spamd_tmp_t:sock_file getattr_sock_file_perms;
+')
+
++#######################################
++## <summary>
++## Read spamd pid file.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to connect.
++## </summary>
++## </param>
++#
++interface(`spamd_read_pid',`
++ gen_require(`
++ type spamd_t, spamd_var_run_t;
++ ')
++
++ files_search_pids($1)
++ read_files_pattern($1, spamd_var_run_t, spamd_var_run_t)
++')
++
+########################################
+## <summary>
+## Connect to run spamd.
@@ -59860,7 +59946,7 @@ index c954f31..85e8212 100644
+ admin_pattern($1, spamd_var_run_t)
')
diff --git a/policy/modules/services/spamassassin.te b/policy/modules/services/spamassassin.te
-index ec1eb1e..fdb471a 100644
+index ec1eb1e..9d10f0b 100644
--- a/policy/modules/services/spamassassin.te
+++ b/policy/modules/services/spamassassin.te
@@ -6,56 +6,101 @@ policy_module(spamassassin, 2.4.0)
@@ -60280,7 +60366,15 @@ index ec1eb1e..fdb471a 100644
')
optional_policy(`
-@@ -451,3 +531,51 @@ optional_policy(`
+@@ -444,6 +524,7 @@ optional_policy(`
+ ')
+
+ optional_policy(`
++ mta_send_mail(spamd_t)
+ sendmail_stub(spamd_t)
+ mta_read_config(spamd_t)
+ ')
+@@ -451,3 +532,51 @@ optional_policy(`
optional_policy(`
udev_read_db(spamd_t)
')
@@ -60448,21 +60542,22 @@ index 4b2230e..950e65a 100644
+ kerberos_manage_host_rcache(squid_t)
+')
diff --git a/policy/modules/services/ssh.fc b/policy/modules/services/ssh.fc
-index 078bcd7..2d60774 100644
+index 078bcd7..84d29ee 100644
--- a/policy/modules/services/ssh.fc
+++ b/policy/modules/services/ssh.fc
-@@ -1,4 +1,10 @@
+@@ -1,4 +1,11 @@
HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
+HOME_DIR/\.shosts gen_context(system_u:object_r:ssh_home_t,s0)
+
+/var/lib/amanda/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
-+/var/lib/gitolite/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
++/var/lib/gitolite/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
++/var/lib/nocpulse/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
+
+/etc/rc\.d/init\.d/sshd -- gen_context(system_u:object_r:sshd_initrc_exec_t,s0)
/etc/ssh/primes -- gen_context(system_u:object_r:sshd_key_t,s0)
/etc/ssh/ssh_host_key -- gen_context(system_u:object_r:sshd_key_t,s0)
-@@ -14,3 +20,7 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
+@@ -14,3 +21,7 @@ HOME_DIR/\.ssh(/.*)? gen_context(system_u:object_r:ssh_home_t,s0)
/usr/sbin/sshd -- gen_context(system_u:object_r:sshd_exec_t,s0)
/var/run/sshd\.init\.pid -- gen_context(system_u:object_r:sshd_var_run_t,s0)
@@ -73997,7 +74092,7 @@ index 8b5c196..da41726 100644
+ role $2 types showmount_t;
')
diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
-index 15832c7..b90b726 100644
+index 15832c7..a50ceba 100644
--- a/policy/modules/system/mount.te
+++ b/policy/modules/system/mount.te
@@ -17,17 +17,29 @@ type mount_exec_t;
@@ -74078,7 +74173,7 @@ index 15832c7..b90b726 100644
kernel_dontaudit_write_debugfs_dirs(mount_t)
kernel_dontaudit_write_proc_dirs(mount_t)
# To load binfmt_misc kernel module
-@@ -57,65 +92,93 @@ kernel_request_load_module(mount_t)
+@@ -57,65 +92,94 @@ kernel_request_load_module(mount_t)
# required for mount.smbfs
corecmd_exec_bin(mount_t)
@@ -74087,6 +74182,7 @@ index 15832c7..b90b726 100644
dev_list_all_dev_nodes(mount_t)
+dev_read_usbfs(mount_t)
+dev_read_rand(mount_t)
++dev_read_urand(mount_t)
dev_read_sysfs(mount_t)
dev_dontaudit_write_sysfs_dirs(mount_t)
dev_rw_lvm_control(mount_t)
@@ -74181,7 +74277,7 @@ index 15832c7..b90b726 100644
logging_send_syslog_msg(mount_t)
-@@ -126,6 +189,8 @@ sysnet_use_portmap(mount_t)
+@@ -126,6 +190,8 @@ sysnet_use_portmap(mount_t)
seutil_read_config(mount_t)
userdom_use_all_users_fds(mount_t)
@@ -74190,7 +74286,7 @@ index 15832c7..b90b726 100644
ifdef(`distro_redhat',`
optional_policy(`
-@@ -141,26 +206,28 @@ ifdef(`distro_ubuntu',`
+@@ -141,26 +207,28 @@ ifdef(`distro_ubuntu',`
')
')
@@ -74229,7 +74325,7 @@ index 15832c7..b90b726 100644
corenet_tcp_bind_generic_port(mount_t)
corenet_udp_bind_generic_port(mount_t)
corenet_tcp_bind_reserved_port(mount_t)
-@@ -174,6 +241,8 @@ optional_policy(`
+@@ -174,6 +242,8 @@ optional_policy(`
fs_search_rpc(mount_t)
rpc_stub(mount_t)
@@ -74238,7 +74334,7 @@ index 15832c7..b90b726 100644
')
optional_policy(`
-@@ -181,6 +250,28 @@ optional_policy(`
+@@ -181,6 +251,28 @@ optional_policy(`
')
optional_policy(`
@@ -74267,7 +74363,7 @@ index 15832c7..b90b726 100644
ifdef(`hide_broken_symptoms',`
# for a bug in the X server
rhgb_dontaudit_rw_stream_sockets(mount_t)
-@@ -188,21 +279,87 @@ optional_policy(`
+@@ -188,21 +280,87 @@ optional_policy(`
')
')
diff --git a/selinux-policy.spec b/selinux-policy.spec
index cdb778b..308544c 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.10.0
-Release: 59%{?dist}
+Release: 61%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
More information about the scm-commits
mailing list