[selinux-policy/f16] - Allow nmbd to manage sock file in /var/run/nmbd - ricci_modservice send syslog msgs - Stop transit
Miroslav Grepl
mgrepl at fedoraproject.org
Wed Oct 5 10:55:18 UTC 2011
commit a2ff5daaceb8b75767ac241898ba73d396d88905
Author: Miroslav <mgrepl at redhat.com>
Date: Wed Oct 5 12:54:54 2011 +0200
- Allow nmbd to manage sock file in /var/run/nmbd
- ricci_modservice send syslog msgs
- Stop transitioning from unconfined_t to ldconfig_t, but make sure /etc/ld.so.cache is labeled correctly
- Allow systemd_logind_t to manage /run/USER/dconf/user
policy-F16.patch | 130 +++++++++++++++++++++++++-------------------------
selinux-policy.spec | 8 +++-
2 files changed, 72 insertions(+), 66 deletions(-)
---
diff --git a/policy-F16.patch b/policy-F16.patch
index 9591fd2..848fc92 100644
--- a/policy-F16.patch
+++ b/policy-F16.patch
@@ -11166,10 +11166,10 @@ index 0000000..b78aa77
+
diff --git a/policy/modules/apps/thumb.te b/policy/modules/apps/thumb.te
new file mode 100644
-index 0000000..73e7983
+index 0000000..fc5b449
--- /dev/null
+++ b/policy/modules/apps/thumb.te
-@@ -0,0 +1,127 @@
+@@ -0,0 +1,123 @@
+policy_module(thumb, 1.0.0)
+
+########################################
@@ -11258,10 +11258,6 @@ index 0000000..73e7983
+
+userdom_use_inherited_user_ptys(thumb_t)
+
-+optional_policy(`
-+ dbus_dontaudit_session_bus_connect(thumb_t)
-+')
-+
+# optional_policy(`
+# gnome_read_gconf_home_files(thumb_t)
+# gnome_read_gstreamer_home_content(thumb_t)
@@ -13644,7 +13640,7 @@ index 6cf8784..935a96c 100644
+#
+/sys(/.*)? gen_context(system_u:object_r:sysfs_t,s0)
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
-index f820f3b..7139ab3 100644
+index f820f3b..60394ec 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -146,14 +146,33 @@ interface(`dev_relabel_all_dev_nodes',`
@@ -14044,11 +14040,13 @@ index f820f3b..7139ab3 100644
## </summary>
## </param>
#
-@@ -2932,7 +3168,7 @@ interface(`dev_dontaudit_write_mtrr',`
+@@ -2931,8 +3167,8 @@ interface(`dev_dontaudit_write_mtrr',`
+ type mtrr_device_t;
')
- dontaudit $1 mtrr_device_t:file write;
+- dontaudit $1 mtrr_device_t:file write;
- dontaudit $1 mtrr_device_t:chr_file write;
++ dontaudit $1 mtrr_device_t:file write_file_perms;
+ dontaudit $1 mtrr_device_t:chr_file write_chr_file_perms;
')
@@ -21423,7 +21421,7 @@ index 0000000..8b2cdf3
+
diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
new file mode 100644
-index 0000000..fcc8949
+index 0000000..e1113e0
--- /dev/null
+++ b/policy/modules/roles/unconfineduser.te
@@ -0,0 +1,503 @@
@@ -21530,7 +21528,7 @@ index 0000000..fcc8949
+init_domtrans_script(unconfined_t)
+init_telinit(unconfined_t)
+
-+libs_run_ldconfig(unconfined_t, unconfined_r)
++lib_filetrans_named_content(unconfined_t)
+
+logging_send_syslog_msg(unconfined_t)
+logging_run_auditctl(unconfined_t, unconfined_r)
@@ -37459,18 +37457,10 @@ index 671d8fd..25c7ab8 100644
+ dontaudit gnomeclock_t $1:dbus send_msg;
+')
diff --git a/policy/modules/services/gnomeclock.te b/policy/modules/services/gnomeclock.te
-index 4fde46b..ab59945 100644
+index 4fde46b..86ba356 100644
--- a/policy/modules/services/gnomeclock.te
+++ b/policy/modules/services/gnomeclock.te
-@@ -9,24 +9,31 @@ type gnomeclock_t;
- type gnomeclock_exec_t;
- dbus_system_domain(gnomeclock_t, gnomeclock_exec_t)
-
-+systemd_systemctl_domain(gnomeclock)
-+
- ########################################
- #
- # gnomeclock local policy
+@@ -15,18 +15,23 @@ dbus_system_domain(gnomeclock_t, gnomeclock_exec_t)
#
allow gnomeclock_t self:capability { sys_nice sys_time sys_ptrace };
@@ -37497,7 +37487,7 @@ index 4fde46b..ab59945 100644
miscfiles_read_localization(gnomeclock_t)
miscfiles_manage_localization(gnomeclock_t)
-@@ -35,12 +42,52 @@ miscfiles_etc_filetrans_localization(gnomeclock_t)
+@@ -35,10 +40,33 @@ miscfiles_etc_filetrans_localization(gnomeclock_t)
userdom_read_all_users_state(gnomeclock_t)
optional_policy(`
@@ -37531,25 +37521,6 @@ index 4fde46b..ab59945 100644
policykit_dbus_chat(gnomeclock_t)
policykit_domtrans_auth(gnomeclock_t)
policykit_read_lib(gnomeclock_t)
- policykit_read_reload(gnomeclock_t)
- ')
-+
-+#######################################
-+#
-+# gnomeclock systemctl local policy
-+#
-+
-+files_dontaudit_remove_etc_dir(gnomeclock_systemctl_t)
-+files_manage_etc_symlinks(gnomeclock_systemctl_t)
-+
-+miscfiles_read_localization(gnomeclock_systemctl_t)
-+
-+systemd_dontaudit_read_unit_files(gnomeclock_systemctl_t)
-+
-+optional_policy(`
-+ ntp_read_unit_file(gnomeclock_systemctl_t)
-+ ntp_read_state(gnomeclock_systemctl_t)
-+')
diff --git a/policy/modules/services/gpm.if b/policy/modules/services/gpm.if
index 7d97298..d6b2959 100644
--- a/policy/modules/services/gpm.if
@@ -52467,7 +52438,7 @@ index f7826f9..679d185 100644
+ admin_pattern($1, ricci_var_run_t)
+')
diff --git a/policy/modules/services/ricci.te b/policy/modules/services/ricci.te
-index 33e72e8..28d2775 100644
+index 33e72e8..7582159 100644
--- a/policy/modules/services/ricci.te
+++ b/policy/modules/services/ricci.te
@@ -7,9 +7,11 @@ policy_module(ricci, 1.7.0)
@@ -52615,7 +52586,7 @@ index 33e72e8..28d2775 100644
miscfiles_read_localization(ricci_modrpm_t)
optional_policy(`
-@@ -394,8 +416,6 @@ files_search_usr(ricci_modservice_t)
+@@ -394,10 +416,10 @@ files_search_usr(ricci_modservice_t)
# Needed for running chkconfig
files_manage_etc_symlinks(ricci_modservice_t)
@@ -52623,8 +52594,12 @@ index 33e72e8..28d2775 100644
-
init_domtrans_script(ricci_modservice_t)
++logging_send_syslog_msg(ricci_modservice_t)
++
miscfiles_read_localization(ricci_modservice_t)
-@@ -405,6 +425,10 @@ optional_policy(`
+
+ optional_policy(`
+@@ -405,6 +427,10 @@ optional_policy(`
')
optional_policy(`
@@ -52635,7 +52610,7 @@ index 33e72e8..28d2775 100644
nscd_dontaudit_search_pid(ricci_modservice_t)
')
-@@ -444,22 +468,22 @@ files_read_etc_runtime_files(ricci_modstorage_t)
+@@ -444,22 +470,22 @@ files_read_etc_runtime_files(ricci_modstorage_t)
files_read_usr_files(ricci_modstorage_t)
files_read_kernel_modules(ricci_modstorage_t)
@@ -52665,7 +52640,7 @@ index 33e72e8..28d2775 100644
optional_policy(`
aisexec_stream_connect(ricci_modstorage_t)
corosync_stream_connect(ricci_modstorage_t)
-@@ -471,12 +495,24 @@ optional_policy(`
+@@ -471,12 +497,24 @@ optional_policy(`
')
optional_policy(`
@@ -53831,7 +53806,7 @@ index 82cb169..87d1eec 100644
+ samba_systemctl($1)
')
diff --git a/policy/modules/services/samba.te b/policy/modules/services/samba.te
-index e30bb63..fed972d 100644
+index e30bb63..49941ec 100644
--- a/policy/modules/services/samba.te
+++ b/policy/modules/services/samba.te
@@ -85,6 +85,9 @@ files_config_file(samba_etc_t)
@@ -53983,18 +53958,19 @@ index e30bb63..fed972d 100644
########################################
#
# nmbd Local policy
-@@ -484,8 +487,9 @@ allow nmbd_t self:udp_socket create_socket_perms;
+@@ -484,8 +487,10 @@ allow nmbd_t self:udp_socket create_socket_perms;
allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto };
allow nmbd_t self:unix_stream_socket { create_stream_socket_perms connectto };
+manage_dirs_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t)
manage_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t)
-files_pid_filetrans(nmbd_t, nmbd_var_run_t, file)
-+files_pid_filetrans(nmbd_t, nmbd_var_run_t, { dir file })
++manage_sock_files_pattern(nmbd_t, nmbd_var_run_t, nmbd_var_run_t)
++files_pid_filetrans(nmbd_t, nmbd_var_run_t, { dir file sock_file })
read_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
read_lnk_files_pattern(nmbd_t, samba_etc_t, samba_etc_t)
-@@ -560,13 +564,13 @@ allow smbcontrol_t self:fifo_file rw_file_perms;
+@@ -560,13 +565,13 @@ allow smbcontrol_t self:fifo_file rw_file_perms;
allow smbcontrol_t self:unix_stream_socket create_stream_socket_perms;
allow smbcontrol_t nmbd_t:process { signal signull };
@@ -54012,7 +53988,7 @@ index e30bb63..fed972d 100644
samba_read_config(smbcontrol_t)
samba_rw_var_files(smbcontrol_t)
samba_search_var(smbcontrol_t)
-@@ -574,11 +578,19 @@ samba_read_winbind_pid(smbcontrol_t)
+@@ -574,11 +579,19 @@ samba_read_winbind_pid(smbcontrol_t)
domain_use_interactive_fds(smbcontrol_t)
@@ -54033,7 +54009,7 @@ index e30bb63..fed972d 100644
########################################
#
-@@ -644,19 +656,21 @@ auth_use_nsswitch(smbmount_t)
+@@ -644,19 +657,21 @@ auth_use_nsswitch(smbmount_t)
miscfiles_read_localization(smbmount_t)
@@ -54058,7 +54034,7 @@ index e30bb63..fed972d 100644
########################################
#
# SWAT Local policy
-@@ -677,7 +691,7 @@ samba_domtrans_nmbd(swat_t)
+@@ -677,7 +692,7 @@ samba_domtrans_nmbd(swat_t)
allow swat_t nmbd_t:process { signal signull };
allow nmbd_t swat_t:process signal;
@@ -54067,7 +54043,7 @@ index e30bb63..fed972d 100644
allow swat_t smbd_port_t:tcp_socket name_bind;
-@@ -692,12 +706,14 @@ manage_files_pattern(swat_t, samba_log_t, samba_log_t)
+@@ -692,12 +707,14 @@ manage_files_pattern(swat_t, samba_log_t, samba_log_t)
manage_files_pattern(swat_t, samba_etc_t, samba_secrets_t)
manage_files_pattern(swat_t, samba_var_t, samba_var_t)
@@ -54082,7 +54058,7 @@ index e30bb63..fed972d 100644
manage_dirs_pattern(swat_t, swat_tmp_t, swat_tmp_t)
manage_files_pattern(swat_t, swat_tmp_t, swat_tmp_t)
-@@ -710,6 +726,7 @@ allow swat_t winbind_exec_t:file mmap_file_perms;
+@@ -710,6 +727,7 @@ allow swat_t winbind_exec_t:file mmap_file_perms;
domtrans_pattern(swat_t, winbind_exec_t, winbind_t)
allow swat_t winbind_t:process { signal signull };
@@ -54090,7 +54066,7 @@ index e30bb63..fed972d 100644
allow swat_t winbind_var_run_t:dir { write add_name remove_name };
allow swat_t winbind_var_run_t:sock_file { create unlink };
-@@ -754,6 +771,8 @@ logging_search_logs(swat_t)
+@@ -754,6 +772,8 @@ logging_search_logs(swat_t)
miscfiles_read_localization(swat_t)
@@ -54099,7 +54075,7 @@ index e30bb63..fed972d 100644
optional_policy(`
cups_read_rw_config(swat_t)
cups_stream_connect(swat_t)
-@@ -806,15 +825,16 @@ rw_files_pattern(winbind_t, smbd_tmp_t, smbd_tmp_t)
+@@ -806,15 +826,16 @@ rw_files_pattern(winbind_t, smbd_tmp_t, smbd_tmp_t)
allow winbind_t winbind_log_t:file manage_file_perms;
logging_log_filetrans(winbind_t, winbind_log_t, file)
@@ -54121,7 +54097,7 @@ index e30bb63..fed972d 100644
kernel_read_kernel_sysctls(winbind_t)
kernel_read_system_state(winbind_t)
-@@ -833,6 +853,7 @@ corenet_udp_sendrecv_all_ports(winbind_t)
+@@ -833,6 +854,7 @@ corenet_udp_sendrecv_all_ports(winbind_t)
corenet_tcp_bind_generic_node(winbind_t)
corenet_udp_bind_generic_node(winbind_t)
corenet_tcp_connect_smbd_port(winbind_t)
@@ -54129,7 +54105,7 @@ index e30bb63..fed972d 100644
corenet_tcp_connect_epmap_port(winbind_t)
corenet_tcp_connect_all_unreserved_ports(winbind_t)
-@@ -863,6 +884,12 @@ userdom_manage_user_home_content_pipes(winbind_t)
+@@ -863,6 +885,12 @@ userdom_manage_user_home_content_pipes(winbind_t)
userdom_manage_user_home_content_sockets(winbind_t)
userdom_user_home_dir_filetrans_user_home_content(winbind_t, { dir file lnk_file fifo_file sock_file })
@@ -54142,7 +54118,7 @@ index e30bb63..fed972d 100644
optional_policy(`
kerberos_use(winbind_t)
')
-@@ -904,7 +931,7 @@ logging_send_syslog_msg(winbind_helper_t)
+@@ -904,7 +932,7 @@ logging_send_syslog_msg(winbind_helper_t)
miscfiles_read_localization(winbind_helper_t)
@@ -54151,7 +54127,7 @@ index e30bb63..fed972d 100644
optional_policy(`
apache_append_log(winbind_helper_t)
-@@ -922,6 +949,18 @@ optional_policy(`
+@@ -922,6 +950,18 @@ optional_policy(`
#
optional_policy(`
@@ -54170,7 +54146,7 @@ index e30bb63..fed972d 100644
type samba_unconfined_script_t;
type samba_unconfined_script_exec_t;
domain_type(samba_unconfined_script_t)
-@@ -932,9 +971,12 @@ optional_policy(`
+@@ -932,9 +972,12 @@ optional_policy(`
allow smbd_t samba_unconfined_script_exec_t:dir search_dir_perms;
allow smbd_t samba_unconfined_script_exec_t:file ioctl;
@@ -67047,7 +67023,7 @@ index 560dc48..6673319 100644
+/opt/google/picasa/.*\.yti -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+/opt/google/talkplugin/.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
diff --git a/policy/modules/system/libraries.if b/policy/modules/system/libraries.if
-index 808ba93..ed84884 100644
+index 808ba93..8f5a243 100644
--- a/policy/modules/system/libraries.if
+++ b/policy/modules/system/libraries.if
@@ -207,6 +207,23 @@ interface(`libs_search_lib',`
@@ -67130,6 +67106,29 @@ index 808ba93..ed84884 100644
')
########################################
+@@ -534,3 +533,22 @@ interface(`lib_filetrans_shared_lib',`
+ interface(`files_lib_filetrans_shared_lib',`
+ refpolicywarn(`$0($*) has been deprecated.')
+ ')
++
++########################################
++## <summary>
++## Transition to lib named content
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`lib_filetrans_named_content',`
++ gen_require(`
++ type ld_so_cache_t;
++ ')
++
++ files_etc_filetrans($1, ld_so_cache_t, file, "ld.so.cache")
++ files_etc_filetrans($1, ld_so_cache_t, file, "ld.so.preload")
++')
diff --git a/policy/modules/system/libraries.te b/policy/modules/system/libraries.te
index e5836d3..eae9427 100644
--- a/policy/modules/system/libraries.te
@@ -71332,10 +71331,10 @@ index 0000000..46a3ec0
+
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644
-index 0000000..ff4814a
+index 0000000..3790267
--- /dev/null
+++ b/policy/modules/system/systemd.te
-@@ -0,0 +1,369 @@
+@@ -0,0 +1,370 @@
+policy_module(systemd, 1.0.0)
+
+#######################################
@@ -71471,6 +71470,7 @@ index 0000000..ff4814a
+optional_policy(`
+ # we label /run/user/$USER/dconf as config_home_t
+ gnome_manage_home_config_dirs(systemd_logind_t)
++ gnome_manage_home_config(systemd_logind_t)
+')
+
+optional_policy(`
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 2a0d606..4ec3037 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.10.0
-Release: 36%{?dist}
+Release: 37%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -466,6 +466,12 @@ SELinux Reference policy mls base module.
%endif
%changelog
+* Wed Oct 5 2011 Miroslav Grepl <mgrepl at redhat.com> 3.10.0-37
+- Allow nmbd to manage sock file in /var/run/nmbd
+- ricci_modservice send syslog msgs
+- Stop transitioning from unconfined_t to ldconfig_t, but make sure /etc/ld.so.cache is labeled correctly
+- Allow systemd_logind_t to manage /run/USER/dconf/user
+
* Mon Oct 3 2011 Miroslav Grepl <mgrepl at redhat.com> 3.10.0-36
- Allow logrotate setuid and setgid since logrotate is supposed to do it
- Fixes for thumb policy by grift
More information about the scm-commits
mailing list