[selinux-policy] - Allow postgresql to manage rgmanager pid files - Allow postgresql to read ccs data - Allow systemd
Miroslav Grepl
mgrepl at fedoraproject.org
Thu Mar 7 10:50:50 UTC 2013
commit 06b84e33000625f187625ccf7aaab5c8589654cd
Author: Miroslav Grepl <mgrepl at redhat.com>
Date: Thu Mar 7 11:49:39 2013 +0100
- Allow postgresql to manage rgmanager pid files
- Allow postgresql to read ccs data
- Allow systemd_domain to send dbus messages to policykit
- Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create
- All systemd domains that create content are reading the file_context file and setfscreat
- Systemd domains need to search through init_var_run_t
- Allow sshd to communicate with libvirt to set containers labels
- Add interface to manage pid files
- Allow NetworkManger_t to read /etc/hostname
- Dontaudit leaked locked files into openshift_domains
- Add fixes for oo-cgroup-read - it nows creates tmp files
- Allow gluster to manage all directories as well as files
- Dontaudit chrome_sandbox_nacl_t using user terminals
- Allow sysstat to manage its own log files
- Allow virtual machines to setrlimit and send itself signals.
- Add labeling for /var/run/hplip
policy-rawhide-base.patch | 213 +++++++++++++++++++++++++------------
policy-rawhide-contrib.patch | 239 +++++++++++++++++++++++++++++-------------
selinux-policy.spec | 20 ++++-
3 files changed, 330 insertions(+), 142 deletions(-)
---
diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch
index 4a010e7..85f3e81 100644
--- a/policy-rawhide-base.patch
+++ b/policy-rawhide-base.patch
@@ -7634,7 +7634,7 @@ index 6a1e4d1..adafd25 100644
+ dontaudit $1 domain:socket_class_set { read write };
')
diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
-index cf04cb5..8601a3e 100644
+index cf04cb5..431baa5 100644
--- a/policy/modules/kernel/domain.te
+++ b/policy/modules/kernel/domain.te
@@ -4,6 +4,29 @@ policy_module(domain, 1.11.0)
@@ -7760,7 +7760,7 @@ index cf04cb5..8601a3e 100644
# Create/access any System V IPC objects.
allow unconfined_domain_type domain:{ sem msgq shm } *;
-@@ -166,5 +227,262 @@ allow unconfined_domain_type domain:lnk_file { read_lnk_file_perms ioctl lock };
+@@ -166,5 +227,261 @@ allow unconfined_domain_type domain:lnk_file { read_lnk_file_perms ioctl lock };
# act on all domains keys
allow unconfined_domain_type domain:key *;
@@ -8022,7 +8022,6 @@ index cf04cb5..8601a3e 100644
+ prelink_exec(domain)
+ ')
+')
-+
diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
index c2c6e05..d0e6d1c 100644
--- a/policy/modules/kernel/files.fc
@@ -17466,7 +17465,7 @@ index 9d2f311..9e87525 100644
+ postgresql_filetrans_named_content($1)
')
diff --git a/policy/modules/services/postgresql.te b/policy/modules/services/postgresql.te
-index 346d011..d84cfd8 100644
+index 346d011..a00f4ea 100644
--- a/policy/modules/services/postgresql.te
+++ b/policy/modules/services/postgresql.te
@@ -19,25 +19,32 @@ gen_require(`
@@ -17479,15 +17478,15 @@ index 346d011..d84cfd8 100644
+## <p>
+## Allow postgresql to use ssh and rsync for point-in-time recovery
+## </p>
- ## </desc>
--gen_tunable(sepgsql_enable_users_ddl, false)
++## </desc>
+gen_tunable(postgresql_can_rsync, false)
+
+## <desc>
+## <p>
+## Allow unprivileged users to execute DDL statement
+## </p>
-+## </desc>
+ ## </desc>
+-gen_tunable(sepgsql_enable_users_ddl, false)
+gen_tunable(postgresql_selinux_users_ddl, true)
## <desc>
@@ -17566,16 +17565,27 @@ index 346d011..d84cfd8 100644
seutil_libselinux_linked(postgresql_t)
seutil_read_default_contexts(postgresql_t)
-@@ -367,7 +373,7 @@ optional_policy(`
+@@ -364,10 +370,18 @@ userdom_dontaudit_search_user_home_dirs(postgresql_t)
+ userdom_dontaudit_use_user_terminals(postgresql_t)
+
+ optional_policy(`
++ ccs_read_config(postgresql_t)
++')
++
++optional_policy(`
mta_getattr_spool(postgresql_t)
')
-tunable_policy(`allow_execmem',`
++optional_policy(`
++ rgmanager_manage_pid_files(postgresql_t)
++')
++
+tunable_policy(`deny_execmem',`',`
allow postgresql_t self:process execmem;
')
-@@ -485,10 +491,52 @@ dontaudit { postgresql_t sepgsql_admin_type sepgsql_client_type sepgsql_unconfin
+@@ -485,10 +499,52 @@ dontaudit { postgresql_t sepgsql_admin_type sepgsql_client_type sepgsql_unconfin
# It is always allowed to operate temporary objects for any database client.
allow sepgsql_client_type sepgsql_temp_object_t:{db_schema db_table db_column db_tuple db_sequence db_view db_procedure} ~{ relabelto relabelfrom };
@@ -17632,7 +17642,7 @@ index 346d011..d84cfd8 100644
allow sepgsql_client_type sepgsql_schema_t:db_schema { add_name remove_name };
')
-@@ -536,7 +584,7 @@ allow sepgsql_admin_type sepgsql_module_type:db_database install_module;
+@@ -536,7 +592,7 @@ allow sepgsql_admin_type sepgsql_module_type:db_database install_module;
kernel_relabelfrom_unlabeled_database(sepgsql_admin_type)
@@ -17641,7 +17651,7 @@ index 346d011..d84cfd8 100644
allow sepgsql_admin_type sepgsql_database_type:db_database *;
allow sepgsql_admin_type sepgsql_schema_type:db_schema *;
-@@ -589,3 +637,17 @@ allow sepgsql_unconfined_type sepgsql_blob_type:db_blob *;
+@@ -589,3 +645,17 @@ allow sepgsql_unconfined_type sepgsql_blob_type:db_blob *;
allow sepgsql_unconfined_type sepgsql_module_type:db_database install_module;
kernel_relabelfrom_unlabeled_database(sepgsql_unconfined_type)
@@ -18323,7 +18333,7 @@ index fe0c682..da12170 100644
+ allow $1 sshd_devpts_t:chr_file rw_inherited_chr_file_perms;
+')
diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te
-index 5fc0391..8d190be 100644
+index 5fc0391..ab68072 100644
--- a/policy/modules/services/ssh.te
+++ b/policy/modules/services/ssh.te
@@ -6,44 +6,52 @@ policy_module(ssh, 2.3.3)
@@ -18651,7 +18661,7 @@ index 5fc0391..8d190be 100644
rpm_use_script_fds(sshd_t)
')
-@@ -279,6 +335,32 @@ optional_policy(`
+@@ -279,13 +335,68 @@ optional_policy(`
')
optional_policy(`
@@ -18684,7 +18694,13 @@ index 5fc0391..8d190be 100644
unconfined_shell_domtrans(sshd_t)
')
-@@ -286,6 +368,29 @@ optional_policy(`
+ optional_policy(`
++ kernel_write_proc_files(sshd_t)
++ virt_transition_svirt_lxc(sshd_t, system_r)
++ virt_stream_connect(sshd_t)
++')
++
++optional_policy(`
xserver_domtrans_xauth(sshd_t)
')
@@ -18714,7 +18730,7 @@ index 5fc0391..8d190be 100644
########################################
#
# ssh_keygen local policy
-@@ -294,19 +399,26 @@ optional_policy(`
+@@ -294,19 +405,26 @@ optional_policy(`
# ssh_keygen_t is the type of the ssh-keygen program when run at install time
# and by sysadm_t
@@ -18742,7 +18758,7 @@ index 5fc0391..8d190be 100644
dev_read_urand(ssh_keygen_t)
term_dontaudit_use_console(ssh_keygen_t)
-@@ -323,6 +435,12 @@ auth_use_nsswitch(ssh_keygen_t)
+@@ -323,6 +441,12 @@ auth_use_nsswitch(ssh_keygen_t)
logging_send_syslog_msg(ssh_keygen_t)
userdom_dontaudit_use_unpriv_user_fds(ssh_keygen_t)
@@ -18755,7 +18771,7 @@ index 5fc0391..8d190be 100644
optional_policy(`
seutil_sigchld_newrole(ssh_keygen_t)
-@@ -331,3 +449,138 @@ optional_policy(`
+@@ -331,3 +455,138 @@ optional_policy(`
optional_policy(`
udev_read_db(ssh_keygen_t)
')
@@ -26319,10 +26335,10 @@ index 9e54bf9..35992c7 100644
+userdom_read_user_tmp_files(setkey_t)
diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
-index 1b93eb7..5effebe 100644
+index 1b93eb7..b2532aa 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
-@@ -1,7 +1,8 @@
+@@ -1,21 +1,27 @@
/etc/rc\.d/init\.d/ip6?tables -- gen_context(system_u:object_r:iptables_initrc_exec_t,s0)
-/etc/rc\.d/init\.d/ebtables -- gen_context(system_u:object_r:iptables_initrc_exec_t,s0)
-/etc/sysconfig/ip6?tables.* -- gen_context(system_u:object_r:iptables_conf_t,s0)
@@ -26334,7 +26350,15 @@ index 1b93eb7..5effebe 100644
/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0)
/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
-@@ -14,8 +15,13 @@
+ /sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/ip6?tables -- gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/ip6?tables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
+-/sbin/ip6?tables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
++/sbin/ip6?tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
++/sbin/ip6?tables-restore.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
++/sbin/ip6?tables-multi.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
+ /sbin/ipvsadm -- gen_context(system_u:object_r:iptables_exec_t,s0)
+ /sbin/ipvsadm-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
/sbin/ipvsadm-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
/sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
@@ -26345,9 +26369,9 @@ index 1b93eb7..5effebe 100644
-/usr/sbin/iptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/usr/sbin/iptables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
-/usr/sbin/iptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
-+/usr/sbin/ip6?tables -- gen_context(system_u:object_r:iptables_exec_t,s0)
-+/usr/sbin/ip6?tables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
-+/usr/sbin/ip6?tables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0)
++/usr/sbin/ip6?tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
++/usr/sbin/ip6?tables-restore.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
++/usr/sbin/ip6?tables-multi.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ipvsadm -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ipvsadm-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ipvsadm-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
@@ -29642,7 +29666,7 @@ index 4584457..300c3f7 100644
+ domtrans_pattern($1, mount_ecryptfs_exec_t, mount_ecryptfs_t)
')
diff --git a/policy/modules/system/mount.te b/policy/modules/system/mount.te
-index 6a50270..b78f6a9 100644
+index 6a50270..bfb146f 100644
--- a/policy/modules/system/mount.te
+++ b/policy/modules/system/mount.te
@@ -10,35 +10,60 @@ policy_module(mount, 1.15.1)
@@ -29839,7 +29863,7 @@ index 6a50270..b78f6a9 100644
term_dontaudit_manage_pty_dirs(mount_t)
auth_use_nsswitch(mount_t)
-@@ -121,16 +187,20 @@ auth_use_nsswitch(mount_t)
+@@ -121,16 +187,19 @@ auth_use_nsswitch(mount_t)
init_use_fds(mount_t)
init_use_script_ptys(mount_t)
init_dontaudit_getattr_initctl(mount_t)
@@ -29849,7 +29873,7 @@ index 6a50270..b78f6a9 100644
logging_send_syslog_msg(mount_t)
-miscfiles_read_localization(mount_t)
-
+-
sysnet_use_portmap(mount_t)
seutil_read_config(mount_t)
@@ -29861,7 +29885,7 @@ index 6a50270..b78f6a9 100644
ifdef(`distro_redhat',`
optional_policy(`
-@@ -146,26 +216,27 @@ ifdef(`distro_ubuntu',`
+@@ -146,26 +215,27 @@ ifdef(`distro_ubuntu',`
')
')
@@ -29901,7 +29925,7 @@ index 6a50270..b78f6a9 100644
corenet_tcp_bind_generic_port(mount_t)
corenet_udp_bind_generic_port(mount_t)
corenet_tcp_bind_reserved_port(mount_t)
-@@ -179,6 +250,8 @@ optional_policy(`
+@@ -179,6 +249,8 @@ optional_policy(`
fs_search_rpc(mount_t)
rpc_stub(mount_t)
@@ -29910,7 +29934,7 @@ index 6a50270..b78f6a9 100644
')
optional_policy(`
-@@ -186,6 +259,32 @@ optional_policy(`
+@@ -186,6 +258,36 @@ optional_policy(`
')
optional_policy(`
@@ -29934,6 +29958,10 @@ index 6a50270..b78f6a9 100644
+')
+
+optional_policy(`
++ glusterd_domtrans(mount_t)
++')
++
++optional_policy(`
+ hal_write_log(mount_t)
+ hal_use_fds(mount_t)
+ hal_dontaudit_rw_pipes(mount_t)
@@ -29943,7 +29971,7 @@ index 6a50270..b78f6a9 100644
ifdef(`hide_broken_symptoms',`
# for a bug in the X server
rhgb_dontaudit_rw_stream_sockets(mount_t)
-@@ -194,24 +293,124 @@ optional_policy(`
+@@ -194,24 +296,124 @@ optional_policy(`
')
optional_policy(`
@@ -30003,20 +30031,20 @@ index 6a50270..b78f6a9 100644
+optional_policy(`
+ usbmuxd_stream_connect(mount_t)
+')
-+
-+optional_policy(`
+
+ optional_policy(`
+- files_etc_filetrans_etc_runtime(unconfined_mount_t, file)
+- unconfined_domain(unconfined_mount_t)
+ userhelper_exec_console(mount_t)
-+')
+ ')
+
+optional_policy(`
+ virt_read_blk_images(mount_t)
+')
-
- optional_policy(`
-- files_etc_filetrans_etc_runtime(unconfined_mount_t, file)
-- unconfined_domain(unconfined_mount_t)
++
++optional_policy(`
+ vmware_exec_host(mount_t)
- ')
++')
+
+######################################
+#
@@ -30147,7 +30175,7 @@ index d43f3b1..c4182e8 100644
+/etc/share/selinux/targeted(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
+/etc/share/selinux/mls(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if
-index 3822072..2639601 100644
+index 3822072..1029e3b 100644
--- a/policy/modules/system/selinuxutil.if
+++ b/policy/modules/system/selinuxutil.if
@@ -192,11 +192,22 @@ interface(`seutil_domtrans_newrole',`
@@ -30516,7 +30544,17 @@ index 3822072..2639601 100644
########################################
## <summary>
## Create, read, write, and delete the default_contexts files.
-@@ -999,6 +1270,26 @@ interface(`seutil_domtrans_semanage',`
+@@ -784,7 +1055,9 @@ interface(`seutil_read_file_contexts',`
+
+ files_search_etc($1)
+ allow $1 { selinux_config_t default_context_t }:dir search_dir_perms;
++ list_dirs_pattern($1, file_context_t, file_context_t)
+ read_files_pattern($1, file_context_t, file_context_t)
++ read_lnk_files_pattern($1, file_context_t, file_context_t)
+ ')
+
+ ########################################
+@@ -999,6 +1272,26 @@ interface(`seutil_domtrans_semanage',`
########################################
## <summary>
@@ -30543,7 +30581,7 @@ index 3822072..2639601 100644
## Execute semanage in the semanage domain, and
## allow the specified role the semanage domain,
## and use the caller's terminal.
-@@ -1017,11 +1308,66 @@ interface(`seutil_domtrans_semanage',`
+@@ -1017,11 +1310,66 @@ interface(`seutil_domtrans_semanage',`
#
interface(`seutil_run_semanage',`
gen_require(`
@@ -30612,7 +30650,7 @@ index 3822072..2639601 100644
')
########################################
-@@ -1044,6 +1390,9 @@ interface(`seutil_manage_module_store',`
+@@ -1044,6 +1392,9 @@ interface(`seutil_manage_module_store',`
manage_dirs_pattern($1, selinux_config_t, semanage_store_t)
manage_files_pattern($1, semanage_store_t, semanage_store_t)
filetrans_pattern($1, selinux_config_t, semanage_store_t, dir, "modules")
@@ -30622,7 +30660,7 @@ index 3822072..2639601 100644
')
#######################################
-@@ -1137,3 +1486,98 @@ interface(`seutil_dontaudit_libselinux_linked',`
+@@ -1137,3 +1488,98 @@ interface(`seutil_dontaudit_libselinux_linked',`
selinux_dontaudit_get_fs_mount($1)
seutil_dontaudit_read_config($1)
')
@@ -32229,10 +32267,13 @@ index b7686d5..9a50b11 100644
+')
diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
new file mode 100644
-index 0000000..595f756
+index 0000000..4e12420
--- /dev/null
+++ b/policy/modules/system/systemd.fc
-@@ -0,0 +1,39 @@
+@@ -0,0 +1,42 @@
++/etc/hostname -- gen_context(system_u:object_r:hostname_etc_t,s0)
++/etc/machine-info -- gen_context(system_u:object_r:hostname_etc_t,s0)
++
+/bin/systemd-notify -- gen_context(system_u:object_r:systemd_notify_exec_t,s0)
+/bin/systemctl -- gen_context(system_u:object_r:systemd_systemctl_exec_t,s0)
+/bin/systemd-tty-ask-password-agent -- gen_context(system_u:object_r:systemd_passwd_agent_exec_t,s0)
@@ -32274,10 +32315,10 @@ index 0000000..595f756
+/var/run/initramfs(/.*)? <<none>>
diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
new file mode 100644
-index 0000000..2961157
+index 0000000..fc080a1
--- /dev/null
+++ b/policy/modules/system/systemd.if
-@@ -0,0 +1,1042 @@
+@@ -0,0 +1,1064 @@
+## <summary>SELinux policy for systemd components</summary>
+
+#######################################
@@ -33068,6 +33109,25 @@ index 0000000..2961157
+ files_var_lib_filetrans($1, random_seed_t, file, "random_seed")
+')
+
++########################################
++## <summary>
++## Allow process to read hostname config file.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <rolecap/>
++#
++interface(`systemd_hostnamed_read_config',`
++ gen_require(`
++ type hostname_etc_t;
++ ')
++
++ files_search_etc($1)
++ allow $1 hostname_etc_t:file read_file_perms;
++')
+
+########################################
+## <summary>
@@ -33083,11 +33143,14 @@ index 0000000..2961157
+ gen_require(`
+ type systemd_passwd_var_run_t;
+ type systemd_logind_var_run_t;
++ type hostname_etc_t;
+ ')
+
+ files_pid_filetrans($1, systemd_logind_var_run_t, file, "nologin")
+ init_named_pid_filetrans($1, systemd_passwd_var_run_t, dir, "ask-password-block")
+ init_named_pid_filetrans($1, systemd_passwd_var_run_t, dir, "ask-password")
++ files_etc_filetrans($1, hostname_etc_t, file, "hostname" )
++ files_etc_filetrans($1, hostname_etc_t, file, "machine-info" )
+')
+
+########################################
@@ -33322,10 +33385,10 @@ index 0000000..2961157
+')
diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
new file mode 100644
-index 0000000..ac0a395
+index 0000000..90e063a
--- /dev/null
+++ b/policy/modules/system/systemd.te
-@@ -0,0 +1,624 @@
+@@ -0,0 +1,632 @@
+policy_module(systemd, 1.0.0)
+
+#######################################
@@ -33400,6 +33463,9 @@ index 0000000..ac0a395
+type systemd_hostnamed_exec_t;
+init_daemon_domain(systemd_hostnamed_t, systemd_hostnamed_exec_t)
+
++type hostname_etc_t;
++files_config_file(hostname_etc_t)
++
+type systemd_timedated_t, systemd_domain;
+type systemd_timedated_exec_t;
+init_daemon_domain(systemd_timedated_t, systemd_timedated_exec_t)
@@ -33538,10 +33604,6 @@ index 0000000..ac0a395
+')
+
+optional_policy(`
-+ policykit_dbus_chat(systemd_logind_t)
-+')
-+
-+optional_policy(`
+ rpm_dbus_chat(systemd_logind_t)
+')
+
@@ -33556,7 +33618,7 @@ index 0000000..ac0a395
+#
+
+allow systemd_passwd_agent_t self:capability { chown sys_tty_config dac_override };
-+allow systemd_passwd_agent_t self:process { setfscreate setsockcreate signal };
++allow systemd_passwd_agent_t self:process { setsockcreate };
+allow systemd_passwd_agent_t self:unix_dgram_socket create_socket_perms;
+
+manage_dirs_pattern(systemd_passwd_agent_t, systemd_passwd_var_run_t, systemd_passwd_var_run_t);
@@ -33671,9 +33733,6 @@ index 0000000..ac0a395
+miscfiles_relabel_man_pages(systemd_tmpfiles_t)
+miscfiles_delete_man_pages(systemd_tmpfiles_t)
+
-+seutil_read_config(systemd_tmpfiles_t)
-+seutil_read_file_contexts(systemd_tmpfiles_t)
-+
+ifdef(`distro_redhat',`
+ userdom_list_user_home_content(systemd_tmpfiles_t)
+ userdom_delete_all_user_home_content_dirs(systemd_tmpfiles_t)
@@ -33799,10 +33858,8 @@ index 0000000..ac0a395
+
+dev_write_kmsg(systemd_localed_t)
+
-+seutil_read_config(systemd_localed_t)
-+seutil_read_file_contexts(systemd_localed_t)
-+
+logging_stream_connect_syslog(systemd_localed_t)
++logging_send_syslog_msg(systemd_localed_t)
+
+miscfiles_manage_localization(systemd_localed_t)
+miscfiles_etc_filetrans_localization(systemd_localed_t)
@@ -33818,12 +33875,17 @@ index 0000000..ac0a395
+#
+# Hostnamed policy
+#
-+dontaudit systemd_hostnamed_t self:capability sys_ptrace;
++dontaudit systemd_hostnamed_t self:capability { sys_admin sys_ptrace };
+
+allow systemd_hostnamed_t self:fifo_file rw_fifo_file_perms;
+allow systemd_hostnamed_t self:unix_stream_socket create_stream_socket_perms;
+allow systemd_hostnamed_t self:unix_dgram_socket create_socket_perms;
+
++manage_files_pattern(systemd_hostnamed_t, hostname_etc_t, hostname_etc_t)
++manage_lnk_files_pattern(systemd_hostnamed_t, hostname_etc_t, hostname_etc_t)
++files_etc_filetrans(systemd_hostnamed_t, hostname_etc_t, file, "hostname" )
++files_etc_filetrans(systemd_hostnamed_t, hostname_etc_t, file, "machine-info" )
++
+kernel_dgram_send(systemd_hostnamed_t)
+
+dev_write_kmsg(systemd_hostnamed_t)
@@ -33835,6 +33897,9 @@ index 0000000..ac0a395
+
+logging_send_syslog_msg(systemd_hostnamed_t)
+
++userdom_read_all_users_state(systemd_hostnamed_t)
++userdom_dbus_send_all_users(systemd_hostnamed_t)
++
+optional_policy(`
+ dbus_system_bus_client(systemd_hostnamed_t)
+ dbus_connect_system_bus(systemd_hostnamed_t)
@@ -33845,7 +33910,7 @@ index 0000000..ac0a395
+# Timedated policy
+#
+allow systemd_timedated_t self:capability { sys_nice sys_time dac_override };
-+allow systemd_timedated_t self:process { getattr getsched signal setfscreate };
++allow systemd_timedated_t self:process { getattr getsched setfscreate };
+allow systemd_timedated_t self:fifo_file rw_fifo_file_perms;
+allow systemd_timedated_t self:unix_stream_socket create_stream_socket_perms;
+allow systemd_timedated_t self:unix_dgram_socket create_socket_perms;
@@ -33875,8 +33940,6 @@ index 0000000..ac0a395
+miscfiles_manage_localization(systemd_timedated_t)
+miscfiles_etc_filetrans_localization(systemd_timedated_t)
+
-+seutil_read_file_contexts(systemd_timedated_t)
-+
+userdom_read_all_users_state(systemd_timedated_t)
+
+optional_policy(`
@@ -33915,7 +33978,6 @@ index 0000000..ac0a395
+')
+
+optional_policy(`
-+ policykit_dbus_chat(systemd_timedated_t)
+ policykit_domtrans_auth(systemd_timedated_t)
+ policykit_read_lib(systemd_timedated_t)
+ policykit_read_reload(systemd_timedated_t)
@@ -33943,13 +34005,22 @@ index 0000000..ac0a395
+#
+# Common rules for systemd domains
+#
-+
++allow systemd_domain self:process { setfscreate signal_perms };
+files_read_etc_files(systemd_domain)
+files_read_etc_runtime_files(systemd_domain)
+files_read_usr_files(systemd_domain)
+
++init_search_pid_dirs(systemd_domain)
++
+logging_stream_connect_syslog(systemd_domain)
+
++seutil_read_config(systemd_domain)
++seutil_read_file_contexts(systemd_domain)
++
++optional_policy(`
++ policykit_dbus_chat(systemd_domain)
++')
++
diff --git a/policy/modules/system/udev.fc b/policy/modules/system/udev.fc
index 40928d8..49fd32e 100644
--- a/policy/modules/system/udev.fc
@@ -35321,7 +35392,7 @@ index db75976..65191bd 100644
+
+/var/run/user(/.*)? gen_context(system_u:object_r:user_tmp_t,s0)
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
-index 3c5dba7..ba7a400 100644
+index 3c5dba7..05bc969 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -30,9 +30,11 @@ template(`userdom_base_user_template',`
@@ -37987,10 +38058,12 @@ index 3c5dba7..ba7a400 100644
## Create keys for all user domains.
## </summary>
## <param name="domain">
-@@ -3439,3 +4197,1355 @@ interface(`userdom_dbus_send_all_users',`
+@@ -3438,4 +4196,1357 @@ interface(`userdom_dbus_send_all_users',`
+ ')
allow $1 userdomain:dbus send_msg;
- ')
++ ps_process_pattern($1, userdomain)
++')
+
+########################################
+## <summary>
@@ -39342,7 +39415,7 @@ index 3c5dba7..ba7a400 100644
+ ')
+
+ filetrans_pattern($1, user_tmpfs_t, $2, $3, $4)
-+')
+ ')
diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index e2b538b..6371ed6 100644
--- a/policy/modules/system/userdomain.te
diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch
index 867dc4d..9c1e9bd 100644
--- a/policy-rawhide-contrib.patch
+++ b/policy-rawhide-contrib.patch
@@ -10091,10 +10091,10 @@ index 0000000..efebae7
+')
diff --git a/chrome.te b/chrome.te
new file mode 100644
-index 0000000..2cce501
+index 0000000..a54bf63
--- /dev/null
+++ b/chrome.te
-@@ -0,0 +1,203 @@
+@@ -0,0 +1,204 @@
+policy_module(chrome,1.0.0)
+
+########################################
@@ -10293,6 +10293,7 @@ index 0000000..2cce501
+userdom_execute_user_tmpfs_files(chrome_sandbox_nacl_t)
+userdom_rw_inherited_user_tmp_files(chrome_sandbox_nacl_t)
+userdom_dontaudit_read_user_home_content_files(chrome_sandbox_nacl_t)
++userdom_dontaudit_use_user_terminals(chrome_sandbox_nacl_t)
+
+optional_policy(`
+ gnome_dontaudit_append_config_files(chrome_sandbox_nacl_t)
@@ -11596,10 +11597,10 @@ index 954309e..f4db2ca 100644
')
+
diff --git a/collectd.te b/collectd.te
-index 6471fa8..45f1622 100644
+index 6471fa8..afeb58c 100644
--- a/collectd.te
+++ b/collectd.te
-@@ -26,6 +26,9 @@ files_type(collectd_var_lib_t)
+@@ -26,8 +26,14 @@ files_type(collectd_var_lib_t)
type collectd_var_run_t;
files_pid_file(collectd_var_run_t)
@@ -11608,8 +11609,21 @@ index 6471fa8..45f1622 100644
+
apache_content_template(collectd)
++type httpd_collectd_script_tmp_t;
++files_tmp_file(httpd_collectd_script_tmp_t)
++
########################################
-@@ -48,21 +51,18 @@ files_pid_filetrans(collectd_t, collectd_var_run_t, file)
+ #
+ # Local policy
+@@ -38,6 +44,7 @@ allow collectd_t self:process { getsched setsched signal };
+ allow collectd_t self:fifo_file rw_fifo_file_perms;
+ allow collectd_t self:packet_socket create_socket_perms;
+ allow collectd_t self:unix_stream_socket { accept listen };
++allow collectd_t self:netlink_tcpdiag_socket create_socket_perms;
+
+ manage_dirs_pattern(collectd_t, collectd_var_lib_t, collectd_var_lib_t)
+ manage_files_pattern(collectd_t, collectd_var_lib_t, collectd_var_lib_t)
+@@ -48,21 +55,18 @@ files_pid_filetrans(collectd_t, collectd_var_run_t, file)
domain_use_interactive_fds(collectd_t)
@@ -11634,14 +11648,30 @@ index 6471fa8..45f1622 100644
logging_send_syslog_msg(collectd_t)
-@@ -87,4 +87,7 @@ optional_policy(`
- read_files_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
- list_dirs_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
- miscfiles_setattr_fonts_cache_dirs(httpd_collectd_script_t)
-+
-+ auth_read_passwd(httpd_collectd_script_t)
- ')
+@@ -80,11 +84,17 @@ optional_policy(`
+
+ ########################################
+ #
+-# Web local policy
++# Web collectd local policy
+ #
+
+-optional_policy(`
+- read_files_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
+- list_dirs_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
+- miscfiles_setattr_fonts_cache_dirs(httpd_collectd_script_t)
+-')
++
++files_search_var_lib(httpd_collectd_script_t)
++read_files_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
++list_dirs_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
++miscfiles_setattr_fonts_cache_dirs(httpd_collectd_script_t)
++
++manage_dirs_pattern(httpd_collectd_script_t, httpd_collectd_script_tmp_t, httpd_collectd_script_tmp_t)
++manage_files_pattern(httpd_collectd_script_t, httpd_collectd_script_tmp_t, httpd_collectd_script_tmp_t)
++files_tmp_filetrans(httpd_collectd_script_t, httpd_collectd_script_tmp_t, { file dir })
+
++auth_read_passwd(httpd_collectd_script_t)
diff --git a/colord.fc b/colord.fc
index 717ea0b..22e0385 100644
--- a/colord.fc
@@ -15640,10 +15670,10 @@ index 6ce66e7..1d0337a 100644
optional_policy(`
diff --git a/cups.fc b/cups.fc
-index 949011e..85b210b 100644
+index 949011e..0332f88 100644
--- a/cups.fc
+++ b/cups.fc
-@@ -1,77 +1,85 @@
+@@ -1,77 +1,86 @@
-/etc/alchemist/namespace/printconf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
-/etc/cups(/.*)? gen_context(system_u:object_r:cupsd_etc_t,s0)
@@ -15760,6 +15790,7 @@ index 949011e..85b210b 100644
+/var/ccpd(/.*)? gen_context(system_u:object_r:cupsd_var_run_t,s0)
+/var/ekpd(/.*)? gen_context(system_u:object_r:cupsd_var_run_t,s0)
+/var/run/cups(/.*)? gen_context(system_u:object_r:cupsd_var_run_t,mls_systemhigh)
++/var/run/hplip(/.*) gen_context(system_u:object_r:cupsd_var_run_t,s0)
+/var/run/hp.*\.pid -- gen_context(system_u:object_r:cupsd_var_run_t,s0)
+/var/run/hp.*\.port -- gen_context(system_u:object_r:cupsd_var_run_t,s0)
/var/run/ptal-printd(/.*)? gen_context(system_u:object_r:ptal_var_run_t,s0)
@@ -23526,7 +23557,7 @@ index 9eacb2c..229782f 100644
init_labeled_script_domtrans($1, { glance_api_initrc_exec_t glance_registry_initrc_exec_t })
domain_system_change_exemption($1)
diff --git a/glance.te b/glance.te
-index e0a4f46..70277e8 100644
+index e0a4f46..0a1aec6 100644
--- a/glance.te
+++ b/glance.te
@@ -7,8 +7,7 @@ policy_module(glance, 1.0.2)
@@ -23560,7 +23591,7 @@ index e0a4f46..70277e8 100644
allow glance_domain self:fifo_file rw_fifo_file_perms;
allow glance_domain self:unix_stream_socket create_stream_socket_perms;
allow glance_domain self:tcp_socket { accept listen };
-@@ -56,10 +58,6 @@ manage_files_pattern(glance_domain, glance_var_lib_t, glance_var_lib_t)
+@@ -56,27 +58,21 @@ manage_files_pattern(glance_domain, glance_var_lib_t, glance_var_lib_t)
manage_dirs_pattern(glance_domain, glance_var_run_t, glance_var_run_t)
manage_files_pattern(glance_domain, glance_var_run_t, glance_var_run_t)
@@ -23571,7 +23602,11 @@ index e0a4f46..70277e8 100644
corenet_tcp_sendrecv_generic_if(glance_domain)
corenet_tcp_sendrecv_generic_node(glance_domain)
corenet_tcp_sendrecv_all_ports(glance_domain)
-@@ -70,13 +68,10 @@ corecmd_exec_shell(glance_domain)
+ corenet_tcp_bind_generic_node(glance_domain)
++corenet_tcp_connect_mysqld_port(glance_domain)
+
+ corecmd_exec_bin(glance_domain)
+ corecmd_exec_shell(glance_domain)
dev_read_urand(glance_domain)
@@ -23586,7 +23621,7 @@ index e0a4f46..70277e8 100644
sysnet_dns_name_resolve(glance_domain)
########################################
-@@ -88,8 +83,15 @@ manage_dirs_pattern(glance_registry_t, glance_registry_tmp_t, glance_registry_tm
+@@ -88,8 +84,14 @@ manage_dirs_pattern(glance_registry_t, glance_registry_tmp_t, glance_registry_tm
manage_files_pattern(glance_registry_t, glance_registry_tmp_t, glance_registry_tmp_t)
files_tmp_filetrans(glance_registry_t, glance_registry_tmp_t, { dir file })
@@ -23597,12 +23632,11 @@ index e0a4f46..70277e8 100644
+corenet_tcp_bind_generic_node(glance_registry_t)
corenet_sendrecv_glance_registry_server_packets(glance_registry_t)
corenet_tcp_bind_glance_registry_port(glance_registry_t)
-+corenet_tcp_connect_mysqld_port(glance_registry_t)
+corenet_tcp_connect_all_ephemeral_ports(glance_registry_t)
logging_send_syslog_msg(glance_registry_t)
-@@ -108,13 +110,19 @@ manage_files_pattern(glance_api_t, glance_tmp_t, glance_tmp_t)
+@@ -108,13 +110,20 @@ manage_files_pattern(glance_api_t, glance_tmp_t, glance_tmp_t)
files_tmp_filetrans(glance_api_t, glance_tmp_t, { dir file })
can_exec(glance_api_t, glance_tmp_t)
@@ -23616,12 +23650,13 @@ index e0a4f46..70277e8 100644
+corenet_tcp_bind_glance_port(glance_api_t)
corenet_sendrecv_glance_registry_client_packets(glance_api_t)
corenet_tcp_connect_glance_registry_port(glance_api_t)
-
++corenet_tcp_connect_mysqld_port(glance_api_t)
++
+corenet_tcp_connect_all_ephemeral_ports(glance_api_t)
+
+corenet_sendrecv_hplip_server_packets(glance_api_t)
+corenet_tcp_bind_hplip_port(glance_api_t)
-+
+
fs_getattr_xattr_fs(glance_api_t)
+
+optional_policy(`
@@ -23807,7 +23842,7 @@ index 0000000..1ed97fe
+
diff --git a/glusterd.te b/glusterd.te
new file mode 100644
-index 0000000..643f4bd
+index 0000000..190dcb1
--- /dev/null
+++ b/glusterd.te
@@ -0,0 +1,146 @@
@@ -23954,9 +23989,9 @@ index 0000000..643f4bd
+
+tunable_policy(`gluster_export_all_rw',`
+ fs_manage_noxattr_fs_files(glusterd_t)
++ files_manage_non_security_dirs(glusterd_t)
+ files_manage_non_security_files(glusterd_t)
+')
-+
diff --git a/glusterfs.fc b/glusterfs.fc
deleted file mode 100644
index 4bd6ade..0000000
@@ -31400,7 +31435,7 @@ index d3e7fc9..f20248c 100644
+ ')
')
diff --git a/keystone.te b/keystone.te
-index 3494d9b..343535a 100644
+index 3494d9b..124a2ab 100644
--- a/keystone.te
+++ b/keystone.te
@@ -21,10 +21,14 @@ files_type(keystone_var_lib_t)
@@ -31418,7 +31453,15 @@ index 3494d9b..343535a 100644
allow keystone_t self:fifo_file rw_fifo_file_perms;
allow keystone_t self:unix_stream_socket { accept listen };
-@@ -62,15 +66,17 @@ corenet_sendrecv_commplex_main_server_packets(keystone_t)
+@@ -57,20 +61,25 @@ corenet_all_recvfrom_netlabel(keystone_t)
+ corenet_tcp_sendrecv_generic_if(keystone_t)
+ corenet_tcp_sendrecv_generic_node(keystone_t)
+ corenet_tcp_bind_generic_node(keystone_t)
++corenet_tcp_connect_mysqld_port(keystone_t)
++
++corenet_tcp_connect_mysqld_port(keystone_t)
+
+ corenet_sendrecv_commplex_main_server_packets(keystone_t)
corenet_tcp_bind_commplex_main_port(keystone_t)
corenet_tcp_sendrecv_commplex_main_port(keystone_t)
@@ -39948,7 +39991,7 @@ index b744fe3..4c1b6a8 100644
init_labeled_script_domtrans($1, munin_initrc_exec_t)
domain_system_change_exemption($1)
diff --git a/munin.te b/munin.te
-index 97370e4..f076c38 100644
+index 97370e4..27d3100 100644
--- a/munin.te
+++ b/munin.te
@@ -40,12 +40,15 @@ munin_plugin_template(services)
@@ -39968,7 +40011,7 @@ index 97370e4..f076c38 100644
allow munin_plugin_domain self:fifo_file rw_fifo_file_perms;
allow munin_plugin_domain munin_t:tcp_socket rw_socket_perms;
-@@ -58,24 +61,16 @@ allow munin_plugin_domain munin_var_lib_t:dir search_dir_perms;
+@@ -58,23 +61,17 @@ allow munin_plugin_domain munin_var_lib_t:dir search_dir_perms;
manage_files_pattern(munin_plugin_domain, munin_plugin_state_t, munin_plugin_state_t)
@@ -39989,11 +40032,11 @@ index 97370e4..f076c38 100644
fs_getattr_all_fs(munin_plugin_domain)
-miscfiles_read_localization(munin_plugin_domain)
--
++auth_read_passwd(munin_plugin_domain)
+
optional_policy(`
nscd_use(munin_plugin_domain)
- ')
-@@ -114,7 +109,7 @@ manage_dirs_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
+@@ -114,7 +111,7 @@ manage_dirs_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
manage_files_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
manage_lnk_files_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
@@ -40002,7 +40045,7 @@ index 97370e4..f076c38 100644
manage_dirs_pattern(munin_t, munin_var_run_t, munin_var_run_t)
manage_files_pattern(munin_t, munin_var_run_t, munin_var_run_t)
-@@ -130,7 +125,6 @@ kernel_read_all_sysctls(munin_t)
+@@ -130,7 +127,6 @@ kernel_read_all_sysctls(munin_t)
corecmd_exec_bin(munin_t)
corecmd_exec_shell(munin_t)
@@ -40010,7 +40053,7 @@ index 97370e4..f076c38 100644
corenet_all_recvfrom_netlabel(munin_t)
corenet_tcp_sendrecv_generic_if(munin_t)
corenet_tcp_sendrecv_generic_node(munin_t)
-@@ -153,7 +147,6 @@ domain_use_interactive_fds(munin_t)
+@@ -153,7 +149,6 @@ domain_use_interactive_fds(munin_t)
domain_read_all_domains_state(munin_t)
files_read_etc_runtime_files(munin_t)
@@ -40018,7 +40061,7 @@ index 97370e4..f076c38 100644
files_list_spool(munin_t)
fs_getattr_all_fs(munin_t)
-@@ -165,7 +158,6 @@ logging_send_syslog_msg(munin_t)
+@@ -165,7 +160,6 @@ logging_send_syslog_msg(munin_t)
logging_read_all_logs(munin_t)
miscfiles_read_fonts(munin_t)
@@ -40026,7 +40069,7 @@ index 97370e4..f076c38 100644
miscfiles_setattr_fonts_cache_dirs(munin_t)
sysnet_exec_ifconfig(munin_t)
-@@ -173,13 +165,6 @@ sysnet_exec_ifconfig(munin_t)
+@@ -173,13 +167,6 @@ sysnet_exec_ifconfig(munin_t)
userdom_dontaudit_use_unpriv_user_fds(munin_t)
userdom_dontaudit_search_user_home_dirs(munin_t)
@@ -40040,7 +40083,7 @@ index 97370e4..f076c38 100644
optional_policy(`
cron_system_entry(munin_t, munin_exec_t)
-@@ -213,7 +198,6 @@ optional_policy(`
+@@ -213,7 +200,6 @@ optional_policy(`
optional_policy(`
postfix_list_spool(munin_t)
@@ -40048,7 +40091,7 @@ index 97370e4..f076c38 100644
')
optional_policy(`
-@@ -246,17 +230,17 @@ corenet_sendrecv_hddtemp_client_packets(disk_munin_plugin_t)
+@@ -246,17 +232,17 @@ corenet_sendrecv_hddtemp_client_packets(disk_munin_plugin_t)
corenet_tcp_connect_hddtemp_port(disk_munin_plugin_t)
corenet_tcp_sendrecv_hddtemp_port(disk_munin_plugin_t)
@@ -40070,7 +40113,7 @@ index 97370e4..f076c38 100644
sysnet_read_config(disk_munin_plugin_t)
-@@ -275,27 +259,36 @@ optional_policy(`
+@@ -275,27 +261,36 @@ optional_policy(`
allow mail_munin_plugin_t self:capability dac_override;
@@ -40111,7 +40154,7 @@ index 97370e4..f076c38 100644
')
optional_policy(`
-@@ -353,7 +346,11 @@ optional_policy(`
+@@ -353,7 +348,11 @@ optional_policy(`
')
optional_policy(`
@@ -40124,7 +40167,15 @@ index 97370e4..f076c38 100644
')
optional_policy(`
-@@ -413,3 +410,30 @@ optional_policy(`
+@@ -385,6 +384,7 @@ read_files_pattern(system_munin_plugin_t, munin_log_t, munin_log_t)
+
+ kernel_read_network_state(system_munin_plugin_t)
+ kernel_read_all_sysctls(system_munin_plugin_t)
++kernel_read_fs_sysctls(system_munin_plugin_t)
+
+ dev_read_sysfs(system_munin_plugin_t)
+ dev_read_urand(system_munin_plugin_t)
+@@ -413,3 +413,31 @@ optional_policy(`
optional_policy(`
unconfined_domain(unconfined_munin_plugin_t)
')
@@ -40146,7 +40197,8 @@ index 97370e4..f076c38 100644
+read_files_pattern(httpd_munin_script_t, munin_var_lib_t, munin_var_lib_t)
+read_files_pattern(httpd_munin_script_t, munin_etc_t, munin_etc_t)
+
-+allow httpd_munin_script_t munin_log_t:file read_file_perms;
++read_files_pattern(httpd_munin_script_t, munin_log_t, munin_log_t)
++append_files_pattern(httpd_munin_script_t, munin_log_t, munin_log_t)
+
+files_search_var_lib(httpd_munin_script_t)
+
@@ -42462,7 +42514,7 @@ index 0e8508c..b9c69d2 100644
+ files_etc_filetrans($1, NetworkManager_var_lib_t, file, "wireed-settings.conf")
')
diff --git a/networkmanager.te b/networkmanager.te
-index 0b48a30..da4eebb 100644
+index 0b48a30..0c6cd41 100644
--- a/networkmanager.te
+++ b/networkmanager.te
@@ -1,4 +1,4 @@
@@ -42786,7 +42838,7 @@ index 0b48a30..da4eebb 100644
')
optional_policy(`
-@@ -320,13 +342,14 @@ optional_policy(`
+@@ -320,13 +342,15 @@ optional_policy(`
')
optional_policy(`
@@ -42795,6 +42847,7 @@ index 0b48a30..da4eebb 100644
+ systemd_write_inhibit_pipes(NetworkManager_t)
+ systemd_read_logind_sessions_files(NetworkManager_t)
+ systemd_dbus_chat_logind(NetworkManager_t)
++ systemd_hostnamed_read_config(NetworkManager_t)
')
optional_policy(`
@@ -42805,7 +42858,7 @@ index 0b48a30..da4eebb 100644
')
optional_policy(`
-@@ -356,6 +379,5 @@ rw_sock_files_pattern(wpa_cli_t, NetworkManager_var_run_t, NetworkManager_var_ru
+@@ -356,6 +380,5 @@ rw_sock_files_pattern(wpa_cli_t, NetworkManager_var_run_t, NetworkManager_var_ru
init_dontaudit_use_fds(wpa_cli_t)
init_use_script_ptys(wpa_cli_t)
@@ -43499,10 +43552,10 @@ index 0000000..7d11148
+')
diff --git a/nova.te b/nova.te
new file mode 100644
-index 0000000..7ce9e62
+index 0000000..c3a9a89
--- /dev/null
+++ b/nova.te
-@@ -0,0 +1,326 @@
+@@ -0,0 +1,325 @@
+policy_module(nova, 1.0.0)
+
+########################################
@@ -43558,19 +43611,18 @@ index 0000000..7ce9e62
+manage_files_pattern(nova_domain, nova_var_run_t, nova_var_run_t)
+
+corenet_tcp_connect_amqp_port(nova_domain)
++corenet_tcp_connect_mysqld_port(nova_domain)
+
+corecmd_exec_bin(nova_domain)
+corecmd_exec_shell(nova_domain)
++corenet_tcp_connect_mysqld_port(nova_domain)
+
+dev_read_urand(nova_domain)
+
+fs_getattr_xattr_fs(nova_domain)
+
-+
+libs_exec_ldconfig(nova_domain)
+
-+
-+
+optional_policy(`
+ sysnet_read_config(nova_domain)
+')
@@ -48042,10 +48094,10 @@ index 0000000..407386d
+')
diff --git a/openshift.te b/openshift.te
new file mode 100644
-index 0000000..a23c70a
+index 0000000..d859b72
--- /dev/null
+++ b/openshift.te
-@@ -0,0 +1,472 @@
+@@ -0,0 +1,481 @@
+policy_module(openshift,1.0.0)
+
+gen_require(`
@@ -48112,6 +48164,9 @@ index 0000000..a23c70a
+type openshift_cgroup_read_exec_t;
+application_domain(openshift_cgroup_read_t, openshift_cgroup_read_exec_t)
+
++type openshift_cgroup_read_tmp_t, openshift_file_type;
++files_tmp_file(openshift_cgroup_read_tmp_t)
++
+type openshift_cron_t;
+type openshift_cron_exec_t;
+domain_type(openshift_cron_t)
@@ -48281,6 +48336,7 @@ index 0000000..a23c70a
+files_dontaudit_getattr_non_security_sockets(openshift_domain)
+files_dontaudit_setattr_non_security_dirs(openshift_domain)
+files_dontaudit_setattr_non_security_files(openshift_domain)
++files_dontaudit_rw_inherited_locks(openshift_domain)
+
+libs_exec_lib_files(openshift_domain)
+libs_exec_ld_so(openshift_domain)
@@ -48416,6 +48472,10 @@ index 0000000..a23c70a
+allow openshift_cgroup_read_t self:unix_stream_socket create_stream_socket_perms;
+allow openshift_cgroup_read_t openshift_initrc_t:fifo_file rw_inherited_fifo_file_perms;
+
++manage_dirs_pattern(openshift_cgroup_read_t, openshift_cgroup_read_tmp_t, openshift_cgroup_read_tmp_t)
++manage_files_pattern(openshift_cgroup_read_t, openshift_cgroup_read_tmp_t, openshift_cgroup_read_tmp_t)
++files_tmp_filetrans(openshift_cgroup_read_t, openshift_cgroup_read_tmp_t, { file dir })
++
+kernel_read_system_state(openshift_cgroup_read_t)
+
+miscfiles_read_localization(openshift_cgroup_read_t)
@@ -48425,12 +48485,12 @@ index 0000000..a23c70a
+')
+
+corecmd_exec_bin(openshift_cgroup_read_t)
++corecmd_exec_shell(openshift_cgroup_read_t)
+
+dev_read_urand(openshift_cgroup_read_t)
+
+domain_use_interactive_fds(openshift_cgroup_read_t)
+
-+
+fs_dontaudit_rw_anon_inodefs_files(openshift_cgroup_read_t)
+
+userdom_use_inherited_user_ptys(openshift_cgroup_read_t)
@@ -48442,6 +48502,7 @@ index 0000000..a23c70a
+
+allow openshift_domain openshift_cgroup_read_t:process { getattr signal signull sigkill };
+
++fs_list_cgroup_dirs(openshift_cgroup_read_t)
+fs_read_cgroup_files(openshift_cgroup_read_t)
+
+allow openshift_cgroup_read_t openshift_var_lib_t:dir list_dir_perms;
@@ -63284,7 +63345,7 @@ index 5421af0..91e69b8 100644
+/var/run/heartbeat(/.*)? gen_context(system_u:object_r:rgmanager_var_run_t,s0)
+/var/run/rgmanager\.pid -- gen_context(system_u:object_r:rgmanager_var_run_t,s0)
diff --git a/rgmanager.if b/rgmanager.if
-index 1c2f9aa..7d70a46 100644
+index 1c2f9aa..8af1f78 100644
--- a/rgmanager.if
+++ b/rgmanager.if
@@ -1,13 +1,13 @@
@@ -63314,8 +63375,29 @@ index 1c2f9aa..7d70a46 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -41,8 +40,7 @@ interface(`rgmanager_stream_connect',`
+@@ -39,10 +38,28 @@ interface(`rgmanager_stream_connect',`
+ stream_connect_pattern($1, rgmanager_var_run_t, rgmanager_var_run_t, rgmanager_t)
+ ')
++########################################
++## <summary>
++## Manage rgmanager pid files
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`rgmanager_manage_pid_files',`
++ gen_require(`
++ type rgmanager_var_run_t;
++ ')
++
++ files_search_pids($1)
++ manage_files_pattern($1, rgmanager_var_run_t, rgmanager_var_run_t)
++')
++
######################################
## <summary>
-## Create, read, write, and delete
@@ -63324,7 +63406,7 @@ index 1c2f9aa..7d70a46 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -61,8 +59,7 @@ interface(`rgmanager_manage_tmp_files',`
+@@ -61,8 +78,7 @@ interface(`rgmanager_manage_tmp_files',`
######################################
## <summary>
@@ -63334,7 +63416,7 @@ index 1c2f9aa..7d70a46 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -79,10 +76,28 @@ interface(`rgmanager_manage_tmpfs_files',`
+@@ -79,10 +95,28 @@ interface(`rgmanager_manage_tmpfs_files',`
manage_files_pattern($1, rgmanager_tmpfs_t, rgmanager_tmpfs_t)
')
@@ -63365,7 +63447,7 @@ index 1c2f9aa..7d70a46 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -91,7 +106,7 @@ interface(`rgmanager_manage_tmpfs_files',`
+@@ -91,7 +125,7 @@ interface(`rgmanager_manage_tmpfs_files',`
## </param>
## <param name="role">
## <summary>
@@ -63374,7 +63456,7 @@ index 1c2f9aa..7d70a46 100644
## </summary>
## </param>
## <rolecap/>
-@@ -102,8 +117,11 @@ interface(`rgmanager_admin',`
+@@ -102,8 +136,11 @@ interface(`rgmanager_admin',`
type rgmanager_tmpfs_t, rgmanager_var_log_t, rgmanager_var_run_t;
')
@@ -63387,7 +63469,7 @@ index 1c2f9aa..7d70a46 100644
init_labeled_script_domtrans($1, rgmanager_initrc_exec_t)
domain_system_change_exemption($1)
-@@ -121,3 +139,47 @@ interface(`rgmanager_admin',`
+@@ -121,3 +158,47 @@ interface(`rgmanager_admin',`
files_list_pids($1)
admin_pattern($1, rgmanager_var_run_t)
')
@@ -78776,10 +78858,21 @@ index c9824cb..1973f71 100644
userdom_dontaudit_use_unpriv_user_fds(sxid_t)
diff --git a/sysstat.te b/sysstat.te
-index c8b80b2..e6b8ab8 100644
+index c8b80b2..f041061 100644
--- a/sysstat.te
+++ b/sysstat.te
-@@ -38,6 +38,7 @@ kernel_read_kernel_sysctls(sysstat_t)
+@@ -24,9 +24,7 @@ allow sysstat_t self:capability { dac_override sys_admin sys_resource sys_tty_co
+ allow sysstat_t self:fifo_file rw_fifo_file_perms;
+
+ manage_dirs_pattern(sysstat_t,sysstat_log_t,sysstat_log_t)
+-append_files_pattern(sysstat_t, sysstat_log_t, sysstat_log_t)
+-create_files_pattern(sysstat_t, sysstat_log_t, sysstat_log_t)
+-setattr_files_pattern(sysstat_t, sysstat_log_t, sysstat_log_t)
++manage_files_pattern(sysstat_t, sysstat_log_t, sysstat_log_t)
+ manage_lnk_files_pattern(sysstat_t,sysstat_log_t,sysstat_log_t)
+ logging_log_filetrans(sysstat_t, sysstat_log_t, { file dir })
+
+@@ -38,6 +36,7 @@ kernel_read_kernel_sysctls(sysstat_t)
kernel_read_fs_sysctls(sysstat_t)
kernel_read_rpc_sysctls(sysstat_t)
@@ -78787,7 +78880,7 @@ index c8b80b2..e6b8ab8 100644
corecmd_exec_bin(sysstat_t)
dev_read_sysfs(sysstat_t)
-@@ -49,8 +50,10 @@ files_read_etc_runtime_files(sysstat_t)
+@@ -49,8 +48,10 @@ files_read_etc_runtime_files(sysstat_t)
fs_getattr_xattr_fs(sysstat_t)
fs_list_inotifyfs(sysstat_t)
@@ -78799,7 +78892,7 @@ index c8b80b2..e6b8ab8 100644
auth_use_nsswitch(sysstat_t)
-@@ -60,10 +63,9 @@ locallogin_use_fds(sysstat_t)
+@@ -60,10 +61,9 @@ locallogin_use_fds(sysstat_t)
logging_send_syslog_msg(sysstat_t)
@@ -81954,7 +82047,7 @@ index e29db63..061fb98 100644
domain_system_change_exemption($1)
role_transition $2 tuned_initrc_exec_t system_r;
diff --git a/tuned.te b/tuned.te
-index 7116181..9815e42 100644
+index 7116181..0bd0be9 100644
--- a/tuned.te
+++ b/tuned.te
@@ -21,6 +21,9 @@ files_config_file(tuned_rw_etc_t)
@@ -82000,7 +82093,11 @@ index 7116181..9815e42 100644
corecmd_exec_bin(tuned_t)
corecmd_exec_shell(tuned_t)
-@@ -67,28 +77,44 @@ dev_read_urand(tuned_t)
+@@ -64,31 +74,48 @@ corecmd_exec_shell(tuned_t)
+ dev_getattr_all_blk_files(tuned_t)
+ dev_getattr_all_chr_files(tuned_t)
+ dev_read_urand(tuned_t)
++dev_read_cpuid(tuned_t)
dev_rw_sysfs(tuned_t)
dev_rw_netcontrol(tuned_t)
@@ -85228,7 +85325,7 @@ index 9dec06c..d8a2b54 100644
+ allow svirt_lxc_domain $1:process sigchld;
')
diff --git a/virt.te b/virt.te
-index 1f22fba..d984f26 100644
+index 1f22fba..12f4354 100644
--- a/virt.te
+++ b/virt.te
@@ -1,94 +1,98 @@
@@ -85524,9 +85621,7 @@ index 1f22fba..d984f26 100644
-append_files_pattern(virt_domain, virt_var_lib_t, virt_var_lib_t)
-
-kernel_read_system_state(virt_domain)
-+# it was a part of auth_use_nsswitch
-+allow svirt_t self:netlink_route_socket r_netlink_socket_perms;
-
+-
-fs_getattr_xattr_fs(virt_domain)
-
-corecmd_exec_bin(virt_domain)
@@ -85644,7 +85739,9 @@ index 1f22fba..d984f26 100644
- fs_manage_dos_dirs(virt_domain)
- fs_manage_dos_files(virt_domain)
-')
--
++# it was a part of auth_use_nsswitch
++allow svirt_t self:netlink_route_socket r_netlink_socket_perms;
+
-optional_policy(`
- tunable_policy(`virt_use_xserver',`
- xserver_read_xdm_pid(virt_domain)
@@ -86097,7 +86194,7 @@ index 1f22fba..d984f26 100644
+# virtual domains common policy
+#
+allow virt_domain self:capability2 compromise_kernel;
-+allow virt_domain self:process { signal getsched signull };
++allow virt_domain self:process { setrlimit signal_perms getsched };
+allow virt_domain self:fifo_file rw_fifo_file_perms;
+allow virt_domain self:shm create_shm_perms;
+allow virt_domain self:unix_stream_socket create_stream_socket_perms;
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 1d8a7f4..b22b6a1 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.12.1
-Release: 18%{?dist}
+Release: 19%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -526,6 +526,24 @@ SELinux Reference policy mls base module.
%endif
%changelog
+* Thu Mar 7 2013 Miroslav Grepl <mgrepl at redhat.com> 3.12.1-19
+- Allow postgresql to manage rgmanager pid files
+- Allow postgresql to read ccs data
+- Allow systemd_domain to send dbus messages to policykit
+- Add labels for /etc/hostname and /etc/machine-info and allow systemd-hostnamed to create them
+- All systemd domains that create content are reading the file_context file and setfscreate
+- Systemd domains need to search through init_var_run_t
+- Allow sshd to communicate with libvirt to set containers labels
+- Add interface to manage pid files
+- Allow NetworkManger_t to read /etc/hostname
+- Dontaudit leaked locked files into openshift_domains
+- Add fixes for oo-cgroup-read - it nows creates tmp files
+- Allow gluster to manage all directories as well as files
+- Dontaudit chrome_sandbox_nacl_t using user terminals
+- Allow sysstat to manage its own log files
+- Allow virtual machines to setrlimit and send itself signals.
+- Add labeling for /var/run/hplip
+
* Mon Mar 4 2013 Miroslav Grepl <mgrepl at redhat.com> 3.12.1-18
- Fix POSTIN scriptlet
More information about the scm-commits
mailing list