[selinux-policy/f16] - Begin removing qemu_t domain, we really no longer need this domain. - systemd_passwd needs dac_ov
Miroslav Grepl
mgrepl at fedoraproject.org
Thu Oct 27 15:26:54 UTC 2011
commit 8becee1975fd6376afbe5b4b759e34e05d789be3
Author: Miroslav <mgrepl at redhat.com>
Date: Thu Oct 27 17:26:43 2011 +0200
- Begin removing qemu_t domain, we really no longer need this domain.
- systemd_passwd needs dac_overide to communicate with users TTY's
- Allow svirt_lxc domains to send kill signals within their container
policy-F16.patch | 52 ++++++++++++++++++++++++--------------------------
selinux-policy.spec | 7 +++++-
2 files changed, 31 insertions(+), 28 deletions(-)
---
diff --git a/policy-F16.patch b/policy-F16.patch
index ffb6ad5..5356641 100644
--- a/policy-F16.patch
+++ b/policy-F16.patch
@@ -20736,7 +20736,7 @@ index be4de58..7e8b6ec 100644
init_exec(secadm_t)
diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
-index 2be17d2..2c588ca 100644
+index 2be17d2..b172ab4 100644
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -8,12 +8,55 @@ policy_module(staff, 2.2.0)
@@ -20795,7 +20795,7 @@ index 2be17d2..2c588ca 100644
optional_policy(`
apache_role(staff_r, staff_t)
')
-@@ -27,19 +70,113 @@ optional_policy(`
+@@ -27,19 +70,107 @@ optional_policy(`
')
optional_policy(`
@@ -20883,12 +20883,6 @@ index 2be17d2..2c588ca 100644
')
optional_policy(`
-+ qemu_run(staff_t, staff_r)
-+ virt_manage_tmpfs_files(staff_t)
-+ virt_filetrans_home_content(staff_t)
-+')
-+
-+optional_policy(`
+ rtkit_scheduled(staff_t)
+')
+
@@ -20911,7 +20905,7 @@ index 2be17d2..2c588ca 100644
')
optional_policy(`
-@@ -48,10 +185,48 @@ optional_policy(`
+@@ -48,10 +179,48 @@ optional_policy(`
')
optional_policy(`
@@ -20960,7 +20954,7 @@ index 2be17d2..2c588ca 100644
xserver_role(staff_r, staff_t)
')
-@@ -89,18 +264,10 @@ ifndef(`distro_redhat',`
+@@ -89,18 +258,10 @@ ifndef(`distro_redhat',`
')
optional_policy(`
@@ -20979,7 +20973,7 @@ index 2be17d2..2c588ca 100644
java_role(staff_r, staff_t)
')
-@@ -121,10 +288,6 @@ ifndef(`distro_redhat',`
+@@ -121,10 +282,6 @@ ifndef(`distro_redhat',`
')
optional_policy(`
@@ -20990,7 +20984,7 @@ index 2be17d2..2c588ca 100644
pyzor_role(staff_r, staff_t)
')
-@@ -137,10 +300,6 @@ ifndef(`distro_redhat',`
+@@ -137,10 +294,6 @@ ifndef(`distro_redhat',`
')
optional_policy(`
@@ -21001,7 +20995,7 @@ index 2be17d2..2c588ca 100644
spamassassin_role(staff_r, staff_t)
')
-@@ -172,3 +331,7 @@ ifndef(`distro_redhat',`
+@@ -172,3 +325,7 @@ ifndef(`distro_redhat',`
wireshark_role(staff_r, staff_t)
')
')
@@ -61079,7 +61073,7 @@ index 7c5d8d8..d711fd5 100644
+')
+
diff --git a/policy/modules/services/virt.te b/policy/modules/services/virt.te
-index 3eca020..148ce98 100644
+index 3eca020..d2d599b 100644
--- a/policy/modules/services/virt.te
+++ b/policy/modules/services/virt.te
@@ -5,56 +5,81 @@ policy_module(virt, 1.4.0)
@@ -61528,10 +61522,15 @@ index 3eca020..148ce98 100644
# Manages /etc/sysconfig/system-config-firewall
iptables_manage_config(virtd_t)
-@@ -365,6 +519,12 @@ optional_policy(`
- qemu_signal(virtd_t)
- qemu_kill(virtd_t)
- qemu_setsched(virtd_t)
+@@ -360,11 +514,12 @@ optional_policy(`
+ ')
+
+ optional_policy(`
+- qemu_domtrans(virtd_t)
+- qemu_read_state(virtd_t)
+- qemu_signal(virtd_t)
+- qemu_kill(virtd_t)
+- qemu_setsched(virtd_t)
+ qemu_entry_type(virt_domain)
+ qemu_exec(virt_domain)
+')
@@ -61541,7 +61540,7 @@ index 3eca020..148ce98 100644
')
optional_policy(`
-@@ -394,20 +554,36 @@ optional_policy(`
+@@ -394,20 +549,36 @@ optional_policy(`
# virtual domains common policy
#
@@ -61581,7 +61580,7 @@ index 3eca020..148ce98 100644
corecmd_exec_bin(virt_domain)
corecmd_exec_shell(virt_domain)
-@@ -418,10 +594,11 @@ corenet_tcp_sendrecv_generic_node(virt_domain)
+@@ -418,10 +589,11 @@ corenet_tcp_sendrecv_generic_node(virt_domain)
corenet_tcp_sendrecv_all_ports(virt_domain)
corenet_tcp_bind_generic_node(virt_domain)
corenet_tcp_bind_vnc_port(virt_domain)
@@ -61594,7 +61593,7 @@ index 3eca020..148ce98 100644
dev_read_rand(virt_domain)
dev_read_sound(virt_domain)
dev_read_urand(virt_domain)
-@@ -429,10 +606,12 @@ dev_write_sound(virt_domain)
+@@ -429,10 +601,12 @@ dev_write_sound(virt_domain)
dev_rw_ksm(virt_domain)
dev_rw_kvm(virt_domain)
dev_rw_qemu(virt_domain)
@@ -61607,7 +61606,7 @@ index 3eca020..148ce98 100644
files_read_usr_files(virt_domain)
files_read_var_files(virt_domain)
files_search_all(virt_domain)
-@@ -440,25 +619,360 @@ files_search_all(virt_domain)
+@@ -440,25 +614,359 @@ files_search_all(virt_domain)
fs_getattr_tmpfs(virt_domain)
fs_rw_anon_inodefs_files(virt_domain)
fs_rw_tmpfs_files(virt_domain)
@@ -61772,8 +61771,6 @@ index 3eca020..148ce98 100644
+
+allow virtd_lxc_t virt_image_type:dir mounton;
+
-+allow virtd_lxc_t virt_domain:process { getattr getsched setsched transition signal signull sigkill };
-+
+domtrans_pattern(virtd_t, virtd_lxc_exec_t, virtd_lxc_t)
+allow virtd_t virtd_lxc_t:process { signal signull sigkill };
+
@@ -61846,11 +61843,12 @@ index 3eca020..148ce98 100644
+#
+# virt_lxc_domain local policy
+#
-+allow svirt_lxc_domain self:capability { setuid setgid dac_override };
++allow svirt_lxc_domain self:capability { kill setuid setgid dac_override };
+dontaudit svirt_lxc_domain self:capability sys_ptrace;
+
+allow virtd_t svirt_lxc_domain:process { signal_perms };
+allow virtd_lxc_t svirt_lxc_domain:process { getattr getsched setsched transition signal signull sigkill };
++
+allow svirt_lxc_domain virtd_lxc_t:fd use;
+allow svirt_lxc_domain virtd_lxc_var_run_t:dir search_dir_perms;
+dontaudit svirt_lxc_domain virtd_lxc_t:unix_stream_socket { read write };
@@ -73473,7 +73471,7 @@ index 0000000..79c358c
+
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644
-index 0000000..a84b8e7
+index 0000000..84e0e66
--- /dev/null
+++ b/policy/modules/system/systemd.te
@@ -0,0 +1,371 @@
@@ -73624,7 +73622,7 @@ index 0000000..a84b8e7
+# Local policy
+#
+
-+allow systemd_passwd_agent_t self:capability { chown sys_tty_config };
++allow systemd_passwd_agent_t self:capability { chown sys_tty_config dac_override };
+allow systemd_passwd_agent_t self:process { setfscreate setsockcreate signal };
+allow systemd_passwd_agent_t self:unix_dgram_socket create_socket_perms;
+
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 5c069fc..ecbc3d7 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.10.0
-Release: 50%{?dist}
+Release: 51%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -466,6 +466,11 @@ SELinux Reference policy mls base module.
%endif
%changelog
+* Thu Oct 27 2011 Miroslav Grepl <mgrepl at redhat.com> 3.10.0-51
+- Begin removing qemu_t domain, we really no longer need this domain.
+- systemd_passwd needs dac_overide to communicate with users TTY's
+- Allow svirt_lxc domains to send kill signals within their container
+
* Wed Oct 25 2011 Miroslav Grepl <mgrepl at redhat.com> 3.10.0-50
- Allow policykit to talk to the systemd via dbus
- Move chrome_sandbox_nacl_t to permissive domains
More information about the scm-commits
mailing list