[selinux-policy] - Turn on deny_ptrace boolean for the Rawhide run, so we can t - Cups exchanges dbus messages with i
Miroslav Grepl
mgrepl at fedoraproject.org
Tue Jan 24 15:35:03 UTC 2012
commit 0c0b390b070e0f20fbb4cee2ab3f48ef5d106fbe
Author: Miroslav Grepl <mgrepl at redhat.com>
Date: Tue Jan 24 16:34:52 2012 +0100
- Turn on deny_ptrace boolean for the Rawhide run, so we can t
- Cups exchanges dbus messages with init
- udisk2 needs to send syslog messages
- certwatch needs to read /etc/passwd
policy-F16.patch | 79 +++++++++++++++++++++++++++++++++-----------------
selinux-policy.spec | 8 ++++-
2 files changed, 59 insertions(+), 28 deletions(-)
---
diff --git a/policy-F16.patch b/policy-F16.patch
index d3646ba..c731329 100644
--- a/policy-F16.patch
+++ b/policy-F16.patch
@@ -859,10 +859,18 @@ index 9a62a1d..eb017ef 100644
kernel_read_network_state(brctl_t)
kernel_read_sysctl(brctl_t)
diff --git a/policy/modules/admin/certwatch.te b/policy/modules/admin/certwatch.te
-index 6b02433..1e28e62 100644
+index 6b02433..575a8d2 100644
--- a/policy/modules/admin/certwatch.te
+++ b/policy/modules/admin/certwatch.te
-@@ -34,8 +34,8 @@ logging_send_syslog_msg(certwatch_t)
+@@ -27,6 +27,7 @@ files_list_tmp(certwatch_t)
+ fs_list_inotifyfs(certwatch_t)
+
+ auth_manage_cache(certwatch_t)
++auth_read_passwd(certwatch_t)
+ auth_var_filetrans_cache(certwatch_t)
+
+ logging_send_syslog_msg(certwatch_t)
+@@ -34,8 +35,8 @@ logging_send_syslog_msg(certwatch_t)
miscfiles_read_all_certs(certwatch_t)
miscfiles_read_localization(certwatch_t)
@@ -34385,7 +34393,7 @@ index 305ddf4..c9de648 100644
admin_pattern($1, ptal_etc_t)
diff --git a/policy/modules/services/cups.te b/policy/modules/services/cups.te
-index 0f28095..0172ea8 100644
+index 0f28095..f4f2dc5 100644
--- a/policy/modules/services/cups.te
+++ b/policy/modules/services/cups.te
@@ -15,6 +15,7 @@ files_pid_file(cupsd_config_var_run_t)
@@ -34465,7 +34473,16 @@ index 0f28095..0172ea8 100644
optional_policy(`
apm_domtrans_client(cupsd_t)
')
-@@ -297,8 +297,10 @@ optional_policy(`
+@@ -287,6 +287,8 @@ optional_policy(`
+ optional_policy(`
+ dbus_system_bus_client(cupsd_t)
+
++ init_dbus_chat(cupsd_t)
++
+ userdom_dbus_send_all_users(cupsd_t)
+
+ optional_policy(`
+@@ -297,8 +299,10 @@ optional_policy(`
hal_dbus_chat(cupsd_t)
')
@@ -34476,7 +34493,7 @@ index 0f28095..0172ea8 100644
')
')
-@@ -311,10 +313,22 @@ optional_policy(`
+@@ -311,10 +315,22 @@ optional_policy(`
')
optional_policy(`
@@ -34499,7 +34516,7 @@ index 0f28095..0172ea8 100644
mta_send_mail(cupsd_t)
')
-@@ -371,8 +385,9 @@ files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { lnk_file file dir })
+@@ -371,8 +387,9 @@ files_tmp_filetrans(cupsd_config_t, cupsd_tmp_t, { lnk_file file dir })
allow cupsd_config_t cupsd_var_run_t:file read_file_perms;
@@ -34510,7 +34527,7 @@ index 0f28095..0172ea8 100644
domtrans_pattern(cupsd_config_t, hplip_exec_t, hplip_t)
-@@ -393,6 +408,10 @@ dev_read_sysfs(cupsd_config_t)
+@@ -393,6 +410,10 @@ dev_read_sysfs(cupsd_config_t)
dev_read_urand(cupsd_config_t)
dev_read_rand(cupsd_config_t)
dev_rw_generic_usb_dev(cupsd_config_t)
@@ -34521,7 +34538,7 @@ index 0f28095..0172ea8 100644
files_search_all_mountpoints(cupsd_config_t)
-@@ -425,11 +444,11 @@ seutil_dontaudit_search_config(cupsd_config_t)
+@@ -425,11 +446,11 @@ seutil_dontaudit_search_config(cupsd_config_t)
userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t)
userdom_dontaudit_search_user_home_dirs(cupsd_config_t)
@@ -34535,7 +34552,7 @@ index 0f28095..0172ea8 100644
ifdef(`distro_redhat',`
optional_policy(`
rpm_read_db(cupsd_config_t)
-@@ -453,6 +472,10 @@ optional_policy(`
+@@ -453,6 +474,10 @@ optional_policy(`
')
optional_policy(`
@@ -34546,7 +34563,7 @@ index 0f28095..0172ea8 100644
hal_domtrans(cupsd_config_t)
hal_read_tmp_files(cupsd_config_t)
hal_dontaudit_use_fds(hplip_t)
-@@ -467,6 +490,10 @@ optional_policy(`
+@@ -467,6 +492,10 @@ optional_policy(`
')
optional_policy(`
@@ -34557,7 +34574,7 @@ index 0f28095..0172ea8 100644
policykit_dbus_chat(cupsd_config_t)
userdom_read_all_users_state(cupsd_config_t)
')
-@@ -587,23 +614,22 @@ auth_use_nsswitch(cups_pdf_t)
+@@ -587,23 +616,22 @@ auth_use_nsswitch(cups_pdf_t)
miscfiles_read_localization(cups_pdf_t)
miscfiles_read_fonts(cups_pdf_t)
@@ -34590,7 +34607,7 @@ index 0f28095..0172ea8 100644
')
########################################
-@@ -639,7 +665,7 @@ manage_files_pattern(hplip_t, hplip_var_lib_t, hplip_var_lib_t)
+@@ -639,7 +667,7 @@ manage_files_pattern(hplip_t, hplip_var_lib_t, hplip_var_lib_t)
manage_lnk_files_pattern(hplip_t, hplip_var_lib_t, hplip_var_lib_t)
manage_fifo_files_pattern(hplip_t, hplip_tmp_t, hplip_tmp_t)
@@ -34599,7 +34616,7 @@ index 0f28095..0172ea8 100644
manage_files_pattern(hplip_t, hplip_var_run_t, hplip_var_run_t)
files_pid_filetrans(hplip_t, hplip_var_run_t, file)
-@@ -685,6 +711,7 @@ domain_use_interactive_fds(hplip_t)
+@@ -685,6 +713,7 @@ domain_use_interactive_fds(hplip_t)
files_read_etc_files(hplip_t)
files_read_etc_runtime_files(hplip_t)
files_read_usr_files(hplip_t)
@@ -34607,7 +34624,7 @@ index 0f28095..0172ea8 100644
logging_send_syslog_msg(hplip_t)
-@@ -696,8 +723,10 @@ userdom_dontaudit_use_unpriv_user_fds(hplip_t)
+@@ -696,8 +725,10 @@ userdom_dontaudit_use_unpriv_user_fds(hplip_t)
userdom_dontaudit_search_user_home_dirs(hplip_t)
userdom_dontaudit_search_user_home_content(hplip_t)
@@ -36014,7 +36031,7 @@ index f706b99..d41e4fe 100644
+ #logging_log_filetrans($1, devicekit_var_log_t, file, "pm-suspend.log")
')
diff --git a/policy/modules/services/devicekit.te b/policy/modules/services/devicekit.te
-index f231f17..f277ea6 100644
+index f231f17..4f7e166 100644
--- a/policy/modules/services/devicekit.te
+++ b/policy/modules/services/devicekit.te
@@ -26,6 +26,9 @@ files_pid_file(devicekit_var_run_t)
@@ -36078,7 +36095,7 @@ index f231f17..f277ea6 100644
fs_list_inotifyfs(devicekit_disk_t)
fs_manage_fusefs_dirs(devicekit_disk_t)
fs_mount_all_fs(devicekit_disk_t)
-@@ -127,7 +138,7 @@ storage_raw_write_fixed_disk(devicekit_disk_t)
+@@ -127,10 +138,12 @@ storage_raw_write_fixed_disk(devicekit_disk_t)
storage_raw_read_removable_device(devicekit_disk_t)
storage_raw_write_removable_device(devicekit_disk_t)
@@ -36087,7 +36104,12 @@ index f231f17..f277ea6 100644
auth_use_nsswitch(devicekit_disk_t)
-@@ -178,55 +189,84 @@ optional_policy(`
++logging_send_syslog_msg(devicekit_disk_t)
++
+ miscfiles_read_localization(devicekit_disk_t)
+
+ userdom_read_all_users_state(devicekit_disk_t)
+@@ -178,55 +191,84 @@ optional_policy(`
virt_manage_images(devicekit_disk_t)
')
@@ -36177,7 +36199,7 @@ index f231f17..f277ea6 100644
userdom_read_all_users_state(devicekit_power_t)
-@@ -235,7 +275,12 @@ optional_policy(`
+@@ -235,7 +277,12 @@ optional_policy(`
')
optional_policy(`
@@ -36190,7 +36212,7 @@ index f231f17..f277ea6 100644
')
optional_policy(`
-@@ -261,14 +306,21 @@ optional_policy(`
+@@ -261,14 +308,21 @@ optional_policy(`
')
optional_policy(`
@@ -36213,7 +36235,7 @@ index f231f17..f277ea6 100644
policykit_dbus_chat(devicekit_power_t)
policykit_domtrans_auth(devicekit_power_t)
policykit_read_lib(devicekit_power_t)
-@@ -276,9 +328,30 @@ optional_policy(`
+@@ -276,9 +330,30 @@ optional_policy(`
')
optional_policy(`
@@ -80325,10 +80347,10 @@ index ce2fbb9..8b34dbc 100644
-/usr/lib32/openoffice/program/[^/]+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
-')
diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if
-index 416e668..3d4780b 100644
+index 416e668..bb3d52b 100644
--- a/policy/modules/system/unconfined.if
+++ b/policy/modules/system/unconfined.if
-@@ -12,27 +12,34 @@
+@@ -12,53 +12,63 @@
#
interface(`unconfined_domain_noaudit',`
gen_require(`
@@ -80370,7 +80392,10 @@ index 416e668..3d4780b 100644
kernel_unconfined($1)
corenet_unconfined($1)
-@@ -43,22 +50,27 @@ interface(`unconfined_domain_noaudit',`
+ dev_unconfined($1)
+ domain_unconfined($1)
+- domain_dontaudit_read_all_domains_state($1)
+- domain_dontaudit_ptrace_all_domains($1)
files_unconfined($1)
fs_unconfined($1)
selinux_unconfined($1)
@@ -80402,7 +80427,7 @@ index 416e668..3d4780b 100644
# auditallow $1 self:process execstack;
')
-@@ -69,6 +81,7 @@ interface(`unconfined_domain_noaudit',`
+@@ -69,6 +79,7 @@ interface(`unconfined_domain_noaudit',`
optional_policy(`
# Communicate via dbusd.
dbus_system_bus_unconfined($1)
@@ -80410,7 +80435,7 @@ index 416e668..3d4780b 100644
')
optional_policy(`
-@@ -122,6 +135,10 @@ interface(`unconfined_domain_noaudit',`
+@@ -122,6 +133,10 @@ interface(`unconfined_domain_noaudit',`
## </param>
#
interface(`unconfined_domain',`
@@ -80421,7 +80446,7 @@ index 416e668..3d4780b 100644
unconfined_domain_noaudit($1)
tunable_policy(`allow_execheap',`
-@@ -150,7 +167,7 @@ interface(`unconfined_domain',`
+@@ -150,7 +165,7 @@ interface(`unconfined_domain',`
## </param>
#
interface(`unconfined_alias_domain',`
@@ -80430,7 +80455,7 @@ index 416e668..3d4780b 100644
')
########################################
-@@ -176,414 +193,5 @@ interface(`unconfined_alias_domain',`
+@@ -176,414 +191,5 @@ interface(`unconfined_alias_domain',`
## </param>
#
interface(`unconfined_execmem_alias_program',`
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 2d06f64..83ada10 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -16,7 +16,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.10.0
-Release: 78%{?dist}
+Release: 79%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -471,6 +471,12 @@ SELinux Reference policy mls base module.
%endif
%changelog
+* Tue Jan 24 2012 Miroslav Grepl <mgrepl at redhat.com> 3.10.0-79
+- Turn on deny_ptrace boolean for the Rawhide run, so we can test this out
+- Cups exchanges dbus messages with init
+- udisk2 needs to send syslog messages
+- certwatch needs to read /etc/passwd
+
* Mon Jan 23 2012 Miroslav Grepl <mgrepl at redhat.com> 3.10.0-78
- Add labeling for udisks2
- Allow fsadmin to communicate with the systemd process
More information about the scm-commits
mailing list