[selinux-policy/f21] * Fri Nov 07 2014 Lukas Vrabec <lvrabec at redhat.com> 3.13.1-94 - Added interface userdom_dontaudit_ma
Lukas Vrabec
lvrabec at fedoraproject.org
Fri Nov 7 22:13:07 UTC 2014
commit 2e4525b49ce269dbf350a0db68bf21737e3f8349
Author: Lukas Vrabec <lvrabec at redhat.com>
Date: Fri Nov 7 23:12:47 2014 +0100
* Fri Nov 07 2014 Lukas Vrabec <lvrabec at redhat.com> 3.13.1-94
- Added interface userdom_dontaudit_manage_user_home_dirs
- New interface dev_rw_uhid_dev
- Fix unconfined_server_dbus_chat() interface.
- Allow login domains to create kernel keyring with different level.
- Dontaudit policykit_auth_t to write to user home dirs. BZ (1157256)
- Make tuned as unconfined domain.
- Allow bluetooth read/write uhid devices. BZ (1161169)
- Add fixes for hypervkvp daemon
- make zoneminder as dbus client by default.
- Allow guest to connect to libvirt using unix_stream_socket.
- Allow all bus client domains to dbus chat with unconfined_service_t.
- Allow inetd service without own policy to run in inetd_child_t which is unconfined domain.
- Make opensm as nsswitch domain to make it working with sssd.
- Allow brctl to read meminfo.
- Allow winbind-helper to execute ntlm_auth in the caller domain.
- Make plymouthd as nsswitch domain to make it working with sssd.
- Make drbd as nsswitch domain to make it working with sssd
- Make conman as nsswitch domain to make ipmitool.exp runing as conman_t working.
- Add support for /var/lib/sntp directory.
policy-f21-base.patch | 557 ++++++++++++++++++++++++----------------------
policy-f21-contrib.patch | 220 +++++++++++-------
selinux-policy.spec | 23 ++-
3 files changed, 448 insertions(+), 352 deletions(-)
---
diff --git a/policy-f21-base.patch b/policy-f21-base.patch
index 014ec9a..94677a0 100644
--- a/policy-f21-base.patch
+++ b/policy-f21-base.patch
@@ -6068,7 +6068,7 @@ index b31c054..872ff1b 100644
+/usr/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0)
+/usr/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0)
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
-index 76f285e..d36451a 100644
+index 76f285e..0e6161d 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -143,13 +143,32 @@ interface(`dev_relabel_all_dev_nodes',`
@@ -6569,7 +6569,7 @@ index 76f285e..d36451a 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2043,7 +2285,101 @@ interface(`dev_getattr_framebuffer_dev',`
+@@ -2043,7 +2285,99 @@ interface(`dev_getattr_framebuffer_dev',`
## </summary>
## </param>
#
@@ -6638,8 +6638,6 @@ index 76f285e..d36451a 100644
+ rw_blk_files_pattern($1, device_t, infiniband_device_t)
+')
+
-+
-+
+########################################
+## <summary>
+## Get the attributes of the framebuffer device node.
@@ -6672,7 +6670,7 @@ index 76f285e..d36451a 100644
gen_require(`
type device_t, framebuf_device_t;
')
-@@ -2402,7 +2738,97 @@ interface(`dev_filetrans_lirc',`
+@@ -2402,7 +2736,97 @@ interface(`dev_filetrans_lirc',`
########################################
## <summary>
@@ -6771,7 +6769,7 @@ index 76f285e..d36451a 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2725,7 +3151,7 @@ interface(`dev_write_misc',`
+@@ -2725,7 +3149,7 @@ interface(`dev_write_misc',`
## </summary>
## <param name="domain">
## <summary>
@@ -6780,7 +6778,7 @@ index 76f285e..d36451a 100644
## </summary>
## </param>
#
-@@ -2811,6 +3237,78 @@ interface(`dev_rw_modem',`
+@@ -2811,6 +3235,78 @@ interface(`dev_rw_modem',`
########################################
## <summary>
@@ -6859,7 +6857,7 @@ index 76f285e..d36451a 100644
## Get the attributes of the mouse devices.
## </summary>
## <param name="domain">
-@@ -2903,20 +3401,20 @@ interface(`dev_getattr_mtrr_dev',`
+@@ -2903,20 +3399,20 @@ interface(`dev_getattr_mtrr_dev',`
########################################
## <summary>
@@ -6884,7 +6882,7 @@ index 76f285e..d36451a 100644
## </p>
## </desc>
## <param name="domain">
-@@ -2925,43 +3423,34 @@ interface(`dev_getattr_mtrr_dev',`
+@@ -2925,43 +3421,34 @@ interface(`dev_getattr_mtrr_dev',`
## </summary>
## </param>
#
@@ -6940,7 +6938,7 @@ index 76f285e..d36451a 100644
## range registers (MTRR).
## </summary>
## <param name="domain">
-@@ -2970,13 +3459,13 @@ interface(`dev_write_mtrr',`
+@@ -2970,13 +3457,13 @@ interface(`dev_write_mtrr',`
## </summary>
## </param>
#
@@ -6957,7 +6955,7 @@ index 76f285e..d36451a 100644
')
########################################
-@@ -3144,48 +3633,102 @@ interface(`dev_create_null_dev',`
+@@ -3144,52 +3631,106 @@ interface(`dev_create_null_dev',`
########################################
## <summary>
@@ -7016,9 +7014,10 @@ index 76f285e..d36451a 100644
## <summary>
-## Domain allowed access.
+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## </param>
+ #
+-interface(`dev_getattr_printer_dev',`
+interface(`dev_dontaudit_getattr_nvram_dev',`
+ gen_require(`
+ type nvram_device_t;
@@ -7070,54 +7069,58 @@ index 76f285e..d36451a 100644
+## <param name="domain">
+## <summary>
+## Domain allowed access.
- ## </summary>
- ## </param>
- #
-@@ -3254,7 +3797,25 @@ interface(`dev_rw_printer',`
++## </summary>
++## </param>
++#
++interface(`dev_getattr_printer_dev',`
+ gen_require(`
+ type device_t, printer_device_t;
+ ')
+@@ -3254,7 +3795,7 @@ interface(`dev_rw_printer',`
########################################
## <summary>
-## Read printk devices (e.g., /dev/kmsg /dev/mcelog)
+## Relabel the printer device node.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
-+interface(`dev_relabel_printer',`
-+ gen_require(`
-+ type printer_device_t;
-+ ')
-+
-+ allow $1 printer_device_t:chr_file relabel_chr_file_perms;
-+')
-+
-+########################################
-+## <summary>
-+## Read and write the printer device.
## </summary>
## <param name="domain">
## <summary>
-@@ -3262,12 +3823,13 @@ interface(`dev_rw_printer',`
+@@ -3262,12 +3803,31 @@ interface(`dev_rw_printer',`
## </summary>
## </param>
#
-interface(`dev_read_printk',`
-+interface(`dev_manage_printer',`
++interface(`dev_relabel_printer',`
gen_require(`
- type device_t, printk_device_t;
-+ type device_t, printer_device_t;
++ type printer_device_t;
')
- read_chr_files_pattern($1, device_t, printk_device_t)
++ allow $1 printer_device_t:chr_file relabel_chr_file_perms;
++')
++
++########################################
++## <summary>
++## Read and write the printer device.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_manage_printer',`
++ gen_require(`
++ type device_t, printer_device_t;
++ ')
++
+ manage_chr_files_pattern($1, device_t, printer_device_t)
+ dev_filetrans_printer_named_dev($1)
')
########################################
-@@ -3399,7 +3961,7 @@ interface(`dev_dontaudit_read_rand',`
+@@ -3399,7 +3959,7 @@ interface(`dev_dontaudit_read_rand',`
########################################
## <summary>
@@ -7126,7 +7129,7 @@ index 76f285e..d36451a 100644
## number generator devices (e.g., /dev/random)
## </summary>
## <param name="domain">
-@@ -3413,7 +3975,7 @@ interface(`dev_dontaudit_append_rand',`
+@@ -3413,7 +3973,7 @@ interface(`dev_dontaudit_append_rand',`
type random_device_t;
')
@@ -7135,7 +7138,7 @@ index 76f285e..d36451a 100644
')
########################################
-@@ -3855,6 +4417,96 @@ interface(`dev_getattr_sysfs_dirs',`
+@@ -3855,6 +4415,96 @@ interface(`dev_getattr_sysfs_dirs',`
########################################
## <summary>
@@ -7232,7 +7235,7 @@ index 76f285e..d36451a 100644
## Search the sysfs directories.
## </summary>
## <param name="domain">
-@@ -3904,6 +4556,7 @@ interface(`dev_list_sysfs',`
+@@ -3904,6 +4554,7 @@ interface(`dev_list_sysfs',`
type sysfs_t;
')
@@ -7240,7 +7243,7 @@ index 76f285e..d36451a 100644
list_dirs_pattern($1, sysfs_t, sysfs_t)
')
-@@ -3946,23 +4599,49 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
+@@ -3946,23 +4597,49 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
########################################
## <summary>
@@ -7294,7 +7297,7 @@ index 76f285e..d36451a 100644
########################################
## <summary>
## Read hardware state information.
-@@ -4016,6 +4695,62 @@ interface(`dev_rw_sysfs',`
+@@ -4016,6 +4693,62 @@ interface(`dev_rw_sysfs',`
########################################
## <summary>
@@ -7357,7 +7360,7 @@ index 76f285e..d36451a 100644
## Read and write the TPM device.
## </summary>
## <param name="domain">
-@@ -4113,6 +4848,25 @@ interface(`dev_write_urand',`
+@@ -4113,6 +4846,25 @@ interface(`dev_write_urand',`
########################################
## <summary>
@@ -7383,7 +7386,7 @@ index 76f285e..d36451a 100644
## Getattr generic the USB devices.
## </summary>
## <param name="domain">
-@@ -4123,7 +4877,7 @@ interface(`dev_write_urand',`
+@@ -4123,7 +4875,7 @@ interface(`dev_write_urand',`
#
interface(`dev_getattr_generic_usb_dev',`
gen_require(`
@@ -7392,7 +7395,7 @@ index 76f285e..d36451a 100644
')
getattr_chr_files_pattern($1, device_t, usb_device_t)
-@@ -4409,9 +5163,9 @@ interface(`dev_rw_usbfs',`
+@@ -4409,9 +5161,9 @@ interface(`dev_rw_usbfs',`
read_lnk_files_pattern($1, usbfs_t, usbfs_t)
')
@@ -7404,7 +7407,7 @@ index 76f285e..d36451a 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -4419,17 +5173,17 @@ interface(`dev_rw_usbfs',`
+@@ -4419,17 +5171,17 @@ interface(`dev_rw_usbfs',`
## </summary>
## </param>
#
@@ -7427,7 +7430,7 @@ index 76f285e..d36451a 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -4437,12 +5191,12 @@ interface(`dev_getattr_video_dev',`
+@@ -4437,12 +5189,12 @@ interface(`dev_getattr_video_dev',`
## </summary>
## </param>
#
@@ -7443,7 +7446,7 @@ index 76f285e..d36451a 100644
')
########################################
-@@ -4539,6 +5293,134 @@ interface(`dev_write_video_dev',`
+@@ -4539,6 +5291,134 @@ interface(`dev_write_video_dev',`
########################################
## <summary>
@@ -7578,7 +7581,7 @@ index 76f285e..d36451a 100644
## Allow read/write the vhost net device
## </summary>
## <param name="domain">
-@@ -4557,6 +5439,24 @@ interface(`dev_rw_vhost',`
+@@ -4557,6 +5437,24 @@ interface(`dev_rw_vhost',`
########################################
## <summary>
@@ -7603,7 +7606,7 @@ index 76f285e..d36451a 100644
## Read and write VMWare devices.
## </summary>
## <param name="domain">
-@@ -4762,6 +5662,44 @@ interface(`dev_rw_xserver_misc',`
+@@ -4762,6 +5660,44 @@ interface(`dev_rw_xserver_misc',`
########################################
## <summary>
@@ -7648,7 +7651,7 @@ index 76f285e..d36451a 100644
## Read and write to the zero device (/dev/zero).
## </summary>
## <param name="domain">
-@@ -4851,3 +5789,948 @@ interface(`dev_unconfined',`
+@@ -4851,3 +5787,966 @@ interface(`dev_unconfined',`
typeattribute $1 devices_unconfined_type;
')
@@ -7728,6 +7731,24 @@ index 76f285e..d36451a 100644
+
+########################################
+## <summary>
++## Read and write uhid devices.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`dev_rw_uhid_dev',`
++ gen_require(`
++ type device_t, uhid_device_t;
++ ')
++
++ rw_chr_files_pattern($1, device_t, uhid_device_t)
++')
++
++########################################
++## <summary>
+## Create all named devices with the correct label
+## </summary>
+## <param name="domain">
@@ -27237,7 +27258,7 @@ index 2479587..890e1e2 100644
/var/(db|adm)/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
/var/lib/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0)
diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
-index 3efd5b6..12dca57 100644
+index 3efd5b6..9e85ea0 100644
--- a/policy/modules/system/authlogin.if
+++ b/policy/modules/system/authlogin.if
@@ -23,11 +23,17 @@ interface(`auth_role',`
@@ -27299,7 +27320,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -95,48 +117,20 @@ interface(`auth_use_pam',`
+@@ -95,69 +117,67 @@ interface(`auth_use_pam',`
interface(`auth_login_pgm_domain',`
gen_require(`
type var_auth_t, auth_cache_t;
@@ -27353,7 +27374,10 @@ index 3efd5b6..12dca57 100644
mls_file_read_all_levels($1)
mls_file_write_all_levels($1)
-@@ -146,18 +140,43 @@ interface(`auth_login_pgm_domain',`
+ mls_file_upgrade($1)
+ mls_file_downgrade($1)
+ mls_process_set_level($1)
++ mls_process_write_to_clearance($1)
mls_fd_share_all_levels($1)
auth_use_pam($1)
@@ -27405,7 +27429,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -231,6 +250,25 @@ interface(`auth_domtrans_login_program',`
+@@ -231,6 +251,25 @@ interface(`auth_domtrans_login_program',`
########################################
## <summary>
@@ -27431,7 +27455,7 @@ index 3efd5b6..12dca57 100644
## Execute a login_program in the target domain,
## with a range transition.
## </summary>
-@@ -322,6 +360,24 @@ interface(`auth_rw_cache',`
+@@ -322,6 +361,24 @@ interface(`auth_rw_cache',`
########################################
## <summary>
@@ -27456,7 +27480,7 @@ index 3efd5b6..12dca57 100644
## Manage authentication cache
## </summary>
## <param name="domain">
-@@ -402,6 +458,8 @@ interface(`auth_domtrans_chk_passwd',`
+@@ -402,6 +459,8 @@ interface(`auth_domtrans_chk_passwd',`
optional_policy(`
samba_stream_connect_winbind($1)
')
@@ -27465,7 +27489,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -428,6 +486,24 @@ interface(`auth_domtrans_chkpwd',`
+@@ -428,6 +487,24 @@ interface(`auth_domtrans_chkpwd',`
########################################
## <summary>
@@ -27490,7 +27514,7 @@ index 3efd5b6..12dca57 100644
## Execute chkpwd programs in the chkpwd domain.
## </summary>
## <param name="domain">
-@@ -448,6 +524,25 @@ interface(`auth_run_chk_passwd',`
+@@ -448,6 +525,25 @@ interface(`auth_run_chk_passwd',`
auth_domtrans_chk_passwd($1)
role $2 types chkpwd_t;
@@ -27516,7 +27540,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -467,7 +562,6 @@ interface(`auth_domtrans_upd_passwd',`
+@@ -467,7 +563,6 @@ interface(`auth_domtrans_upd_passwd',`
domtrans_pattern($1, updpwd_exec_t, updpwd_t)
auth_dontaudit_read_shadow($1)
@@ -27524,7 +27548,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -664,6 +758,10 @@ interface(`auth_manage_shadow',`
+@@ -664,6 +759,10 @@ interface(`auth_manage_shadow',`
allow $1 shadow_t:file manage_file_perms;
typeattribute $1 can_read_shadow_passwords, can_write_shadow_passwords;
@@ -27535,7 +27559,7 @@ index 3efd5b6..12dca57 100644
')
#######################################
-@@ -763,7 +861,50 @@ interface(`auth_rw_faillog',`
+@@ -763,7 +862,50 @@ interface(`auth_rw_faillog',`
')
logging_search_logs($1)
@@ -27587,7 +27611,7 @@ index 3efd5b6..12dca57 100644
')
#######################################
-@@ -824,9 +965,29 @@ interface(`auth_rw_lastlog',`
+@@ -824,9 +966,29 @@ interface(`auth_rw_lastlog',`
allow $1 lastlog_t:file { rw_file_perms lock setattr };
')
@@ -27618,7 +27642,7 @@ index 3efd5b6..12dca57 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -834,12 +995,27 @@ interface(`auth_rw_lastlog',`
+@@ -834,12 +996,27 @@ interface(`auth_rw_lastlog',`
## </summary>
## </param>
#
@@ -27649,7 +27673,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -854,15 +1030,15 @@ interface(`auth_domtrans_pam',`
+@@ -854,15 +1031,15 @@ interface(`auth_domtrans_pam',`
#
interface(`auth_signal_pam',`
gen_require(`
@@ -27668,7 +27692,7 @@ index 3efd5b6..12dca57 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -875,13 +1051,33 @@ interface(`auth_signal_pam',`
+@@ -875,13 +1052,33 @@ interface(`auth_signal_pam',`
## </summary>
## </param>
#
@@ -27706,7 +27730,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -959,9 +1155,30 @@ interface(`auth_manage_var_auth',`
+@@ -959,9 +1156,30 @@ interface(`auth_manage_var_auth',`
')
files_search_var($1)
@@ -27740,7 +27764,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -1040,6 +1257,10 @@ interface(`auth_manage_pam_pid',`
+@@ -1040,6 +1258,10 @@ interface(`auth_manage_pam_pid',`
files_search_pids($1)
allow $1 pam_var_run_t:dir manage_dir_perms;
allow $1 pam_var_run_t:file manage_file_perms;
@@ -27751,7 +27775,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -1176,6 +1397,7 @@ interface(`auth_manage_pam_console_data',`
+@@ -1176,6 +1398,7 @@ interface(`auth_manage_pam_console_data',`
files_search_pids($1)
manage_files_pattern($1, pam_var_console_t, pam_var_console_t)
manage_lnk_files_pattern($1, pam_var_console_t, pam_var_console_t)
@@ -27759,7 +27783,7 @@ index 3efd5b6..12dca57 100644
')
#######################################
-@@ -1576,6 +1798,25 @@ interface(`auth_setattr_login_records',`
+@@ -1576,6 +1799,25 @@ interface(`auth_setattr_login_records',`
########################################
## <summary>
@@ -27785,7 +27809,7 @@ index 3efd5b6..12dca57 100644
## Read login records files (/var/log/wtmp).
## </summary>
## <param name="domain">
-@@ -1726,24 +1967,7 @@ interface(`auth_manage_login_records',`
+@@ -1726,24 +1968,7 @@ interface(`auth_manage_login_records',`
logging_rw_generic_log_dirs($1)
allow $1 wtmp_t:file manage_file_perms;
@@ -27811,7 +27835,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -1767,11 +1991,13 @@ interface(`auth_relabel_login_records',`
+@@ -1767,11 +1992,13 @@ interface(`auth_relabel_login_records',`
## <infoflow type="both" weight="10"/>
#
interface(`auth_use_nsswitch',`
@@ -27828,7 +27852,7 @@ index 3efd5b6..12dca57 100644
')
########################################
-@@ -1805,3 +2031,280 @@ interface(`auth_unconfined',`
+@@ -1805,3 +2032,280 @@ interface(`auth_unconfined',`
typeattribute $1 can_write_shadow_passwords;
typeattribute $1 can_relabelto_shadow_passwords;
')
@@ -42479,7 +42503,7 @@ index 0abaf84..8b34dbc 100644
-/usr/lib/openoffice/program/[^/]+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
-')
diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if
-index 5ca20a9..e749152 100644
+index 5ca20a9..cf27c0a 100644
--- a/policy/modules/system/unconfined.if
+++ b/policy/modules/system/unconfined.if
@@ -12,53 +12,57 @@
@@ -42532,10 +42556,10 @@ index 5ca20a9..e749152 100644
+ systemd_config_all_services($1)
+
+ domain_mmap_low($1)
-+
-+ ubac_process_exempt($1)
- tunable_policy(`allow_execheap',`
++ ubac_process_exempt($1)
++
+ tunable_policy(`selinuxuser_execheap',`
# Allow making the stack executable via mprotect.
allow $1 self:process execheap;
@@ -42590,7 +42614,7 @@ index 5ca20a9..e749152 100644
')
########################################
-@@ -175,381 +185,12 @@ interface(`unconfined_alias_domain',`
+@@ -175,361 +185,12 @@ interface(`unconfined_alias_domain',`
## </param>
#
interface(`unconfined_execmem_alias_program',`
@@ -42944,26 +42968,32 @@ index 5ca20a9..e749152 100644
- ')
-
- allow $1 unconfined_t:key create;
--')
--
--########################################
--## <summary>
++ refpolicywarn(`$0() has been deprecated.')
+ ')
+
+ ########################################
+ ## <summary>
-## Send messages to the unconfined domain over dbus.
--## </summary>
--## <param name="domain">
--## <summary>
--## Domain allowed access.
--## </summary>
--## </param>
--#
++## Connect to unconfined_server with a unix socket.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -537,19 +198,19 @@ interface(`unconfined_create_keys',`
+ ## </summary>
+ ## </param>
+ #
-interface(`unconfined_dbus_send',`
-- gen_require(`
++interface(`unconfined_server_stream_connect',`
+ gen_require(`
- type unconfined_t;
- class dbus send_msg;
-- ')
--
++ type unconfined_service_t;
+ ')
+
- allow $1 unconfined_t:dbus send_msg;
-+ refpolicywarn(`$0() has been deprecated.')
++ files_search_pids($1)
++ files_write_generic_pid_pipes($1)
++ allow $1 unconfined_service_t:unix_stream_socket { getattr connectto };
')
########################################
@@ -42974,12 +43004,12 @@ index 5ca20a9..e749152 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -557,20 +198,19 @@ interface(`unconfined_dbus_send',`
+@@ -557,20 +218,17 @@ interface(`unconfined_dbus_send',`
## </summary>
## </param>
#
-interface(`unconfined_dbus_chat',`
-+interface(`unconfined_server_stream_connect',`
++interface(`unconfined_server_domtrans',`
gen_require(`
- type unconfined_t;
- class dbus send_msg;
@@ -42988,25 +43018,23 @@ index 5ca20a9..e749152 100644
- allow $1 unconfined_t:dbus send_msg;
- allow unconfined_t $1:dbus send_msg;
-+ files_search_pids($1)
-+ files_write_generic_pid_pipes($1)
-+ allow $1 unconfined_service_t:unix_stream_socket { getattr connectto };
++ corecmd_bin_domtrans($1, unconfined_service_t)
')
########################################
## <summary>
-## Connect to the the unconfined DBUS
-## for service (acquire_svc).
-+## Connect to unconfined_server with a unix socket.
++## Allow caller domain to dbus chat unconfined_server.
## </summary>
## <param name="domain">
## <summary>
-@@ -578,11 +218,10 @@ interface(`unconfined_dbus_chat',`
+@@ -578,11 +236,11 @@ interface(`unconfined_dbus_chat',`
## </summary>
## </param>
#
-interface(`unconfined_dbus_connect',`
-+interface(`unconfined_server_domtrans',`
++interface(`unconfined_server_dbus_chat',`
gen_require(`
- type unconfined_t;
- class dbus acquire_svc;
@@ -43014,7 +43042,8 @@ index 5ca20a9..e749152 100644
')
- allow $1 unconfined_t:dbus acquire_svc;
-+ corecmd_bin_domtrans($1, unconfined_service_t)
++ allow $1 unconfined_service_t:dbus send_msg;
++ allow unconfined_service_t $1:dbus send_msg;
')
diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
index 5fe902d..a349d18 100644
@@ -43283,7 +43312,7 @@ index db75976..1ee08ec 100644
+/var/tmp/hsperfdata_root gen_context(system_u:object_r:user_tmp_t,s0)
+
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
-index 9dc60c6..0bed312 100644
+index 9dc60c6..2861886 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -30,9 +30,11 @@ template(`userdom_base_user_template',`
@@ -45057,7 +45086,32 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -1629,6 +2135,42 @@ interface(`userdom_relabelto_user_home_dirs',`
+@@ -1613,6 +2119,24 @@ interface(`userdom_manage_user_home_dirs',`
+
+ ########################################
+ ## <summary>
++## Create user home directories.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`userdom_dontaudit_manage_user_home_dirs',`
++ gen_require(`
++ type user_home_dir_t;
++ ')
++
++ dontaudit $1 user_home_dir_t:dir manage_dir_perms;
++')
++
++########################################
++## <summary>
+ ## Relabel to user home directories.
+ ## </summary>
+ ## <param name="domain">
+@@ -1629,6 +2153,42 @@ interface(`userdom_relabelto_user_home_dirs',`
allow $1 user_home_dir_t:dir relabelto;
')
@@ -45100,7 +45154,7 @@ index 9dc60c6..0bed312 100644
########################################
## <summary>
## Create directories in the home dir root with
-@@ -1708,6 +2250,8 @@ interface(`userdom_dontaudit_search_user_home_content',`
+@@ -1708,6 +2268,8 @@ interface(`userdom_dontaudit_search_user_home_content',`
')
dontaudit $1 user_home_t:dir search_dir_perms;
@@ -45109,7 +45163,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -1741,10 +2285,12 @@ interface(`userdom_list_all_user_home_content',`
+@@ -1741,10 +2303,12 @@ interface(`userdom_list_all_user_home_content',`
#
interface(`userdom_list_user_home_content',`
gen_require(`
@@ -45124,7 +45178,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -1769,7 +2315,7 @@ interface(`userdom_manage_user_home_content_dirs',`
+@@ -1769,7 +2333,7 @@ interface(`userdom_manage_user_home_content_dirs',`
########################################
## <summary>
@@ -45133,7 +45187,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1777,19 +2323,17 @@ interface(`userdom_manage_user_home_content_dirs',`
+@@ -1777,19 +2341,17 @@ interface(`userdom_manage_user_home_content_dirs',`
## </summary>
## </param>
#
@@ -45157,7 +45211,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1797,55 +2341,55 @@ interface(`userdom_delete_all_user_home_content_dirs',`
+@@ -1797,55 +2359,55 @@ interface(`userdom_delete_all_user_home_content_dirs',`
## </summary>
## </param>
#
@@ -45228,7 +45282,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1853,18 +2397,19 @@ interface(`userdom_dontaudit_setattr_user_home_content_files',`
+@@ -1853,18 +2415,19 @@ interface(`userdom_dontaudit_setattr_user_home_content_files',`
## </summary>
## </param>
#
@@ -45256,7 +45310,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -1872,55 +2417,55 @@ interface(`userdom_mmap_user_home_content_files',`
+@@ -1872,45 +2435,182 @@ interface(`userdom_mmap_user_home_content_files',`
## </summary>
## </param>
#
@@ -45314,59 +45368,48 @@ index 9dc60c6..0bed312 100644
#
-interface(`userdom_dontaudit_append_user_home_content_files',`
+interface(`userdom_relabel_user_tmp_dirs',`
- gen_require(`
-- type user_home_t;
++ gen_require(`
+ type user_tmp_t;
- ')
-
-- dontaudit $1 user_home_t:file append_file_perms;
++ ')
++
+ allow $1 user_tmp_t:dir relabel_dir_perms;
- ')
-
- ########################################
- ## <summary>
--## Do not audit attempts to write user home files.
++')
++
++########################################
++## <summary>
+## Do not audit attempts to set the
+## attributes of user home files.
- ## </summary>
- ## <param name="domain">
- ## <summary>
-@@ -1928,32 +2473,149 @@ interface(`userdom_dontaudit_append_user_home_content_files',`
- ## </summary>
- ## </param>
- #
--interface(`userdom_dontaudit_write_user_home_content_files',`
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain to not audit.
++## </summary>
++## </param>
++#
+interface(`userdom_dontaudit_setattr_user_home_content_files',`
- gen_require(`
- type user_home_t;
- ')
-
-- dontaudit $1 user_home_t:file write_file_perms;
++ gen_require(`
++ type user_home_t;
++ ')
++
+ dontaudit $1 user_home_t:file setattr_file_perms;
- ')
-
- ########################################
- ## <summary>
--## Delete all user home content files.
++')
++
++########################################
++## <summary>
+## Set the attributes of all user home directories.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
+## <rolecap/>
- #
--interface(`userdom_delete_all_user_home_content_files',`
++#
+interface(`userdom_setattr_all_user_home_content_dirs',`
- gen_require(`
-- attribute user_home_content_type;
-- type user_home_dir_t;
++ gen_require(`
+ attribute user_home_type;
- ')
-
-- userdom_search_user_home_content($1)
-- delete_files_pattern($1, { user_home_dir_t user_home_content_type }, user_home_content_type)
++ ')
++
+ allow $1 user_home_type:dir setattr_dir_perms;
+')
+
@@ -45463,51 +45506,45 @@ index 9dc60c6..0bed312 100644
+## </param>
+#
+interface(`userdom_dontaudit_append_user_home_content_files',`
-+ gen_require(`
-+ type user_home_t;
-+ ')
-+
-+ dontaudit $1 user_home_t:file append_file_perms;
-+')
-+
-+########################################
-+## <summary>
-+## Do not audit attempts to write user home files.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+interface(`userdom_dontaudit_write_user_home_content_files',`
-+ gen_require(`
-+ type user_home_t;
-+ ')
-+
-+ dontaudit $1 user_home_t:file write_file_perms;
- ')
+ gen_require(`
+ type user_home_t;
+ ')
+@@ -1938,7 +2638,7 @@ interface(`userdom_dontaudit_write_user_home_content_files',`
########################################
-@@ -1971,7 +2633,80 @@ interface(`userdom_delete_user_home_content_files',`
- type user_home_t;
+ ## <summary>
+-## Delete all user home content files.
++## Delete files in a user home subdirectory.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -1946,10 +2646,9 @@ interface(`userdom_dontaudit_write_user_home_content_files',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`userdom_delete_all_user_home_content_files',`
++interface(`userdom_delete_user_home_content_files',`
+ gen_require(`
+- attribute user_home_content_type;
+- type user_home_dir_t;
++ type user_home_t;
')
-- allow $1 user_home_t:file delete_file_perms;
-+ userdom_search_user_home_content($1)
-+ delete_files_pattern($1, { user_home_dir_t user_home_content_type }, user_home_content_type)
-+')
-+
-+########################################
-+## <summary>
+ userdom_search_user_home_content($1)
+@@ -1958,7 +2657,7 @@ interface(`userdom_delete_all_user_home_content_files',`
+
+ ########################################
+ ## <summary>
+-## Delete files in a user home subdirectory.
+## Delete all files in a user home subdirectory.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+#
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+@@ -1966,12 +2665,66 @@ interface(`userdom_delete_all_user_home_content_files',`
+ ## </summary>
+ ## </param>
+ #
+-interface(`userdom_delete_user_home_content_files',`
+interface(`userdom_delete_all_user_home_content_files',`
+ gen_require(`
+ attribute user_home_type;
@@ -45527,10 +45564,11 @@ index 9dc60c6..0bed312 100644
+## </param>
+#
+interface(`userdom_delete_user_home_content_sock_files',`
-+ gen_require(`
-+ type user_home_t;
-+ ')
-+
+ gen_require(`
+ type user_home_t;
+ ')
+
+- allow $1 user_home_t:file delete_file_perms;
+ allow $1 user_home_t:sock_file delete_file_perms;
+')
+
@@ -45571,7 +45609,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -2007,8 +2742,7 @@ interface(`userdom_read_user_home_content_symlinks',`
+@@ -2007,8 +2760,7 @@ interface(`userdom_read_user_home_content_symlinks',`
type user_home_dir_t, user_home_t;
')
@@ -45581,7 +45619,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -2024,20 +2758,14 @@ interface(`userdom_read_user_home_content_symlinks',`
+@@ -2024,20 +2776,14 @@ interface(`userdom_read_user_home_content_symlinks',`
#
interface(`userdom_exec_user_home_content_files',`
gen_require(`
@@ -45606,7 +45644,7 @@ index 9dc60c6..0bed312 100644
########################################
## <summary>
-@@ -2120,7 +2848,7 @@ interface(`userdom_manage_user_home_content_symlinks',`
+@@ -2120,7 +2866,7 @@ interface(`userdom_manage_user_home_content_symlinks',`
########################################
## <summary>
@@ -45615,7 +45653,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2128,19 +2856,17 @@ interface(`userdom_manage_user_home_content_symlinks',`
+@@ -2128,19 +2874,17 @@ interface(`userdom_manage_user_home_content_symlinks',`
## </summary>
## </param>
#
@@ -45639,7 +45677,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2148,12 +2874,12 @@ interface(`userdom_delete_all_user_home_content_symlinks',`
+@@ -2148,12 +2892,12 @@ interface(`userdom_delete_all_user_home_content_symlinks',`
## </summary>
## </param>
#
@@ -45655,7 +45693,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -2388,18 +3114,54 @@ interface(`userdom_dontaudit_manage_user_tmp_dirs',`
+@@ -2388,18 +3132,54 @@ interface(`userdom_dontaudit_manage_user_tmp_dirs',`
## </summary>
## </param>
#
@@ -45713,7 +45751,7 @@ index 9dc60c6..0bed312 100644
## Do not audit attempts to read users
## temporary files.
## </summary>
-@@ -2414,7 +3176,7 @@ interface(`userdom_dontaudit_read_user_tmp_files',`
+@@ -2414,7 +3194,7 @@ interface(`userdom_dontaudit_read_user_tmp_files',`
type user_tmp_t;
')
@@ -45722,7 +45760,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -2455,6 +3217,25 @@ interface(`userdom_rw_user_tmp_files',`
+@@ -2455,6 +3235,25 @@ interface(`userdom_rw_user_tmp_files',`
rw_files_pattern($1, user_tmp_t, user_tmp_t)
files_search_tmp($1)
')
@@ -45748,7 +45786,7 @@ index 9dc60c6..0bed312 100644
########################################
## <summary>
-@@ -2538,7 +3319,7 @@ interface(`userdom_manage_user_tmp_files',`
+@@ -2538,7 +3337,7 @@ interface(`userdom_manage_user_tmp_files',`
########################################
## <summary>
## Create, read, write, and delete user
@@ -45757,7 +45795,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2546,19 +3327,19 @@ interface(`userdom_manage_user_tmp_files',`
+@@ -2546,19 +3345,19 @@ interface(`userdom_manage_user_tmp_files',`
## </summary>
## </param>
#
@@ -45780,7 +45818,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2566,19 +3347,19 @@ interface(`userdom_manage_user_tmp_symlinks',`
+@@ -2566,19 +3365,19 @@ interface(`userdom_manage_user_tmp_symlinks',`
## </summary>
## </param>
#
@@ -45803,7 +45841,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2586,27 +3367,68 @@ interface(`userdom_manage_user_tmp_pipes',`
+@@ -2586,12 +3385,53 @@ interface(`userdom_manage_user_tmp_pipes',`
## </summary>
## </param>
#
@@ -45815,24 +45853,20 @@ index 9dc60c6..0bed312 100644
- manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
+ allow $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
- files_search_tmp($1)
- ')
-
++ files_search_tmp($1)
++')
+
- ########################################
- ## <summary>
--## Create objects in a user temporary directory
--## with an automatic type transition to
--## a specified private type.
++
++########################################
++## <summary>
+## Create, read, write, and delete user
+## temporary named pipes.
- ## </summary>
- ## <param name="domain">
- ## <summary>
- ## Domain allowed access.
- ## </summary>
- ## </param>
--## <param name="private_type">
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
+#
+interface(`userdom_manage_user_tmp_pipes',`
+ gen_require(`
@@ -45860,25 +45894,10 @@ index 9dc60c6..0bed312 100644
+ ')
+
+ manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
-+ files_search_tmp($1)
-+')
-+
-+########################################
-+## <summary>
-+## Create objects in a user temporary directory
-+## with an automatic type transition to
-+## a specified private type.
-+## </summary>
-+## <param name="domain">
-+## <summary>
-+## Domain allowed access.
-+## </summary>
-+## </param>
-+## <param name="private_type">
- ## <summary>
- ## The type of the object to create.
- ## </summary>
-@@ -2661,6 +3483,21 @@ interface(`userdom_tmp_filetrans_user_tmp',`
+ files_search_tmp($1)
+ ')
+
+@@ -2661,6 +3501,21 @@ interface(`userdom_tmp_filetrans_user_tmp',`
files_tmp_filetrans($1, user_tmp_t, $2, $3)
')
@@ -45900,7 +45919,7 @@ index 9dc60c6..0bed312 100644
########################################
## <summary>
## Read user tmpfs files.
-@@ -2672,18 +3509,13 @@ interface(`userdom_tmp_filetrans_user_tmp',`
+@@ -2672,18 +3527,13 @@ interface(`userdom_tmp_filetrans_user_tmp',`
## </param>
#
interface(`userdom_read_user_tmpfs_files',`
@@ -45922,7 +45941,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2692,19 +3524,13 @@ interface(`userdom_read_user_tmpfs_files',`
+@@ -2692,19 +3542,13 @@ interface(`userdom_read_user_tmpfs_files',`
## </param>
#
interface(`userdom_rw_user_tmpfs_files',`
@@ -45945,7 +45964,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -2713,13 +3539,56 @@ interface(`userdom_rw_user_tmpfs_files',`
+@@ -2713,13 +3557,56 @@ interface(`userdom_rw_user_tmpfs_files',`
## </param>
#
interface(`userdom_manage_user_tmpfs_files',`
@@ -46006,7 +46025,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -2814,6 +3683,24 @@ interface(`userdom_use_user_ttys',`
+@@ -2814,6 +3701,24 @@ interface(`userdom_use_user_ttys',`
########################################
## <summary>
@@ -46031,7 +46050,7 @@ index 9dc60c6..0bed312 100644
## Read and write a user domain pty.
## </summary>
## <param name="domain">
-@@ -2832,22 +3719,34 @@ interface(`userdom_use_user_ptys',`
+@@ -2832,22 +3737,34 @@ interface(`userdom_use_user_ptys',`
########################################
## <summary>
@@ -46074,7 +46093,7 @@ index 9dc60c6..0bed312 100644
## </desc>
## <param name="domain">
## <summary>
-@@ -2856,14 +3755,33 @@ interface(`userdom_use_user_ptys',`
+@@ -2856,14 +3773,33 @@ interface(`userdom_use_user_ptys',`
## </param>
## <infoflow type="both" weight="10"/>
#
@@ -46112,7 +46131,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -2882,8 +3800,27 @@ interface(`userdom_dontaudit_use_user_terminals',`
+@@ -2882,8 +3818,27 @@ interface(`userdom_dontaudit_use_user_terminals',`
type user_tty_device_t, user_devpts_t;
')
@@ -46142,7 +46161,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -2955,69 +3892,68 @@ interface(`userdom_spec_domtrans_unpriv_users',`
+@@ -2955,69 +3910,68 @@ interface(`userdom_spec_domtrans_unpriv_users',`
allow unpriv_userdomain $1:process sigchld;
')
@@ -46243,7 +46262,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -3025,12 +3961,12 @@ interface(`userdom_manage_unpriv_user_semaphores',`
+@@ -3025,12 +3979,12 @@ interface(`userdom_manage_unpriv_user_semaphores',`
## </summary>
## </param>
#
@@ -46258,7 +46277,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -3094,7 +4030,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
+@@ -3094,7 +4048,7 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
domain_entry_file_spec_domtrans($1, unpriv_userdomain)
allow unpriv_userdomain $1:fd use;
@@ -46267,7 +46286,7 @@ index 9dc60c6..0bed312 100644
allow unpriv_userdomain $1:process sigchld;
')
-@@ -3110,29 +4046,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
+@@ -3110,29 +4064,13 @@ interface(`userdom_entry_spec_domtrans_unpriv_users',`
#
interface(`userdom_search_user_home_content',`
gen_require(`
@@ -46301,7 +46320,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -3214,7 +4134,25 @@ interface(`userdom_dontaudit_use_user_ptys',`
+@@ -3214,7 +4152,25 @@ interface(`userdom_dontaudit_use_user_ptys',`
type user_devpts_t;
')
@@ -46328,7 +46347,7 @@ index 9dc60c6..0bed312 100644
')
########################################
-@@ -3269,12 +4207,13 @@ interface(`userdom_write_user_tmp_files',`
+@@ -3269,12 +4225,13 @@ interface(`userdom_write_user_tmp_files',`
type user_tmp_t;
')
@@ -46344,7 +46363,7 @@ index 9dc60c6..0bed312 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -3282,46 +4221,122 @@ interface(`userdom_write_user_tmp_files',`
+@@ -3282,49 +4239,125 @@ interface(`userdom_write_user_tmp_files',`
## </summary>
## </param>
#
@@ -46402,8 +46421,9 @@ index 9dc60c6..0bed312 100644
gen_require(`
- attribute userdomain;
+ type user_tmp_t;
-+ ')
-+
+ ')
+
+- allow $1 userdomain:process getattr;
+ dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
+')
+
@@ -46477,10 +46497,13 @@ index 9dc60c6..0bed312 100644
+interface(`userdom_getattr_all_users',`
+ gen_require(`
+ attribute userdomain;
- ')
++ ')
++
++ allow $1 userdomain:process getattr;
+ ')
- allow $1 userdomain:process getattr;
-@@ -3382,6 +4397,42 @@ interface(`userdom_signal_all_users',`
+ ########################################
+@@ -3382,6 +4415,42 @@ interface(`userdom_signal_all_users',`
allow $1 userdomain:process signal;
')
@@ -46523,7 +46546,7 @@ index 9dc60c6..0bed312 100644
########################################
## <summary>
## Send a SIGCHLD signal to all user domains.
-@@ -3402,6 +4453,60 @@ interface(`userdom_sigchld_all_users',`
+@@ -3402,6 +4471,60 @@ interface(`userdom_sigchld_all_users',`
########################################
## <summary>
@@ -46584,7 +46607,7 @@ index 9dc60c6..0bed312 100644
## Create keys for all user domains.
## </summary>
## <param name="domain">
-@@ -3435,4 +4540,1686 @@ interface(`userdom_dbus_send_all_users',`
+@@ -3435,4 +4558,1686 @@ interface(`userdom_dbus_send_all_users',`
')
allow $1 userdomain:dbus send_msg;
diff --git a/policy-f21-contrib.patch b/policy-f21-contrib.patch
index 8cc6002..52c1216 100644
--- a/policy-f21-contrib.patch
+++ b/policy-f21-contrib.patch
@@ -9707,7 +9707,7 @@ index c723a0a..3e8a553 100644
+ allow $1 bluetooth_unit_file_t:service all_service_perms;
')
diff --git a/bluetooth.te b/bluetooth.te
-index 851769e..055c97c 100644
+index 851769e..a069dc3 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -49,6 +49,9 @@ files_type(bluetooth_var_lib_t)
@@ -9757,7 +9757,13 @@ index 851769e..055c97c 100644
dev_read_sysfs(bluetooth_t)
dev_rw_usbfs(bluetooth_t)
-@@ -110,7 +124,6 @@ domain_use_interactive_fds(bluetooth_t)
+@@ -105,12 +119,12 @@ dev_rw_generic_usb_dev(bluetooth_t)
+ dev_read_urand(bluetooth_t)
+ dev_rw_input_dev(bluetooth_t)
+ dev_rw_wireless(bluetooth_t)
++dev_rw_uhid_dev(bluetooth_t)
+
+ domain_use_interactive_fds(bluetooth_t)
domain_dontaudit_search_all_domains_state(bluetooth_t)
files_read_etc_runtime_files(bluetooth_t)
@@ -9765,7 +9771,7 @@ index 851769e..055c97c 100644
fs_getattr_all_fs(bluetooth_t)
fs_search_auto_mountpoints(bluetooth_t)
-@@ -122,7 +135,6 @@ auth_use_nsswitch(bluetooth_t)
+@@ -122,7 +136,6 @@ auth_use_nsswitch(bluetooth_t)
logging_send_syslog_msg(bluetooth_t)
@@ -9773,7 +9779,7 @@ index 851769e..055c97c 100644
miscfiles_read_fonts(bluetooth_t)
miscfiles_read_hwdata(bluetooth_t)
-@@ -130,6 +142,10 @@ userdom_dontaudit_use_unpriv_user_fds(bluetooth_t)
+@@ -130,6 +143,10 @@ userdom_dontaudit_use_unpriv_user_fds(bluetooth_t)
userdom_dontaudit_use_user_terminals(bluetooth_t)
userdom_dontaudit_search_user_home_dirs(bluetooth_t)
@@ -9784,7 +9790,7 @@ index 851769e..055c97c 100644
optional_policy(`
dbus_system_bus_client(bluetooth_t)
dbus_connect_system_bus(bluetooth_t)
-@@ -200,7 +216,6 @@ dev_read_urand(bluetooth_helper_t)
+@@ -200,7 +217,6 @@ dev_read_urand(bluetooth_helper_t)
domain_read_all_domains_state(bluetooth_helper_t)
files_read_etc_runtime_files(bluetooth_helper_t)
@@ -10317,15 +10323,23 @@ index 687d4c4..3c5a83a 100644
+ unconfined_domain(boinc_project_t)
+')
diff --git a/brctl.te b/brctl.te
-index c5a9113..6ad8ccb 100644
+index c5a9113..1919abd 100644
--- a/brctl.te
+++ b/brctl.te
-@@ -34,12 +34,9 @@ dev_write_sysfs_dirs(brctl_t)
+@@ -24,6 +24,7 @@ allow brctl_t self:unix_dgram_socket create_socket_perms;
+ allow brctl_t self:tcp_socket create_socket_perms;
+
+ kernel_request_load_module(brctl_t)
++kernel_read_system_state(brctl_t)
+ kernel_read_network_state(brctl_t)
+ kernel_read_sysctl(brctl_t)
+
+@@ -34,12 +35,8 @@ dev_write_sysfs_dirs(brctl_t)
domain_use_interactive_fds(brctl_t)
-files_read_etc_files(brctl_t)
-
+-
term_dontaudit_use_console(brctl_t)
-miscfiles_read_localization(brctl_t)
@@ -15514,7 +15528,7 @@ index 0000000..54b4b04
+')
diff --git a/conman.te b/conman.te
new file mode 100644
-index 0000000..ccff09f
+index 0000000..4772f64
--- /dev/null
+++ b/conman.te
@@ -0,0 +1,55 @@
@@ -15557,7 +15571,7 @@ index 0000000..ccff09f
+manage_files_pattern(conman_t, conman_var_run_t, conman_var_run_t)
+files_pid_filetrans(conman_t, conman_var_run_t, file)
+
-+auth_read_passwd(conman_t)
++auth_use_nsswitch(conman_t)
+
+corenet_tcp_bind_generic_node(conman_t)
+corenet_tcp_bind_conman_port(conman_t)
@@ -20732,7 +20746,7 @@ index dda905b..ccd0ba9 100644
/var/named/chroot/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
+')
diff --git a/dbus.if b/dbus.if
-index 62d22cb..e1b35aa 100644
+index 62d22cb..f8ab4af 100644
--- a/dbus.if
+++ b/dbus.if
@@ -1,4 +1,4 @@
@@ -20858,7 +20872,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -103,91 +129,84 @@ template(`dbus_role_template',`
+@@ -103,91 +129,88 @@ template(`dbus_role_template',`
#
interface(`dbus_system_bus_client',`
gen_require(`
@@ -20888,6 +20902,10 @@ index 62d22cb..e1b35aa 100644
stream_connect_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t, system_dbusd_t)
-
dbus_read_config($1)
++
++ optional_policy(`
++ unconfined_server_dbus_chat($1)
++ ')
')
#######################################
@@ -20984,7 +21002,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -195,15 +214,18 @@ interface(`dbus_connect_spec_session_bus',`
+@@ -195,15 +218,18 @@ interface(`dbus_connect_spec_session_bus',`
## </summary>
## </param>
#
@@ -21009,7 +21027,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -211,57 +233,39 @@ interface(`dbus_session_bus_client',`
+@@ -211,57 +237,39 @@ interface(`dbus_session_bus_client',`
## </summary>
## </param>
#
@@ -21081,7 +21099,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -269,15 +273,19 @@ interface(`dbus_spec_session_bus_client',`
+@@ -269,15 +277,19 @@ interface(`dbus_spec_session_bus_client',`
## </summary>
## </param>
#
@@ -21107,7 +21125,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -285,44 +293,52 @@ interface(`dbus_send_session_bus',`
+@@ -285,44 +297,52 @@ interface(`dbus_send_session_bus',`
## </summary>
## </param>
#
@@ -21174,7 +21192,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -330,18 +346,18 @@ interface(`dbus_send_spec_session_bus',`
+@@ -330,18 +350,18 @@ interface(`dbus_send_spec_session_bus',`
## </summary>
## </param>
#
@@ -21198,7 +21216,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -349,20 +365,18 @@ interface(`dbus_read_config',`
+@@ -349,20 +369,18 @@ interface(`dbus_read_config',`
## </summary>
## </param>
#
@@ -21224,7 +21242,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -370,26 +384,20 @@ interface(`dbus_read_lib_files',`
+@@ -370,26 +388,20 @@ interface(`dbus_read_lib_files',`
## </summary>
## </param>
#
@@ -21257,7 +21275,7 @@ index 62d22cb..e1b35aa 100644
## <param name="domain">
## <summary>
## Type to be used as a domain.
-@@ -397,81 +405,67 @@ interface(`dbus_manage_lib_files',`
+@@ -397,81 +409,67 @@ interface(`dbus_manage_lib_files',`
## </param>
## <param name="entry_point">
## <summary>
@@ -21367,7 +21385,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -479,18 +473,18 @@ interface(`dbus_spec_session_domain',`
+@@ -479,18 +477,18 @@ interface(`dbus_spec_session_domain',`
## </summary>
## </param>
#
@@ -21391,7 +21409,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -498,98 +492,100 @@ interface(`dbus_connect_system_bus',`
+@@ -498,98 +496,100 @@ interface(`dbus_connect_system_bus',`
## </summary>
## </param>
#
@@ -21535,7 +21553,7 @@ index 62d22cb..e1b35aa 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -597,28 +593,50 @@ interface(`dbus_use_system_bus_fds',`
+@@ -597,28 +597,50 @@ interface(`dbus_use_system_bus_fds',`
## </summary>
## </param>
#
@@ -25037,10 +25055,10 @@ index 0000000..2a614ed
+')
diff --git a/docker.te b/docker.te
new file mode 100644
-index 0000000..d03d41b
+index 0000000..a1ed007
--- /dev/null
+++ b/docker.te
-@@ -0,0 +1,281 @@
+@@ -0,0 +1,285 @@
+policy_module(docker, 1.0.0)
+
+########################################
@@ -25100,7 +25118,7 @@ index 0000000..d03d41b
+#
+# docker local policy
+#
-+allow docker_t self:capability { chown fowner fsetid mknod net_admin net_bind_service setfcap };
++allow docker_t self:capability { chown kill fowner fsetid mknod net_admin net_bind_service net_raw setfcap };
+allow docker_t self:process { getattr signal_perms };
+allow docker_t self:fifo_file rw_fifo_file_perms;
+allow docker_t self:unix_stream_socket create_stream_socket_perms;
@@ -25127,12 +25145,15 @@ index 0000000..d03d41b
+manage_lnk_files_pattern(docker_t, docker_tmpfs_t, docker_tmpfs_t)
+manage_fifo_files_pattern(docker_t, docker_tmpfs_t, docker_tmpfs_t)
+manage_chr_files_pattern(docker_t, docker_tmpfs_t, docker_tmpfs_t)
++manage_blk_files_pattern(docker_t, docker_tmpfs_t, docker_tmpfs_t)
++can_exec(docker_t, docker_tmpfs_t)
+fs_tmpfs_filetrans(docker_t, docker_tmpfs_t, { dir file })
+allow docker_t docker_tmpfs_t:chr_file mounton;
+
+manage_dirs_pattern(docker_t, docker_share_t, docker_share_t)
+manage_files_pattern(docker_t, docker_share_t, docker_share_t)
+manage_lnk_files_pattern(docker_t, docker_share_t, docker_share_t)
++allow docker_t docker_share_t:dir_file_class_set { relabelfrom relabelto };
+can_exec(docker_t, docker_share_t)
+docker_filetrans_named_content(docker_t)
+
@@ -25161,6 +25182,7 @@ index 0000000..d03d41b
+kernel_read_all_proc(docker_t)
+
+domain_use_interactive_fds(docker_t)
++domain_dontaudit_read_all_domains_state(docker_t)
+
+corecmd_exec_bin(docker_t)
+corecmd_exec_shell(docker_t)
@@ -26206,7 +26228,7 @@ index 9a21639..26c5986 100644
')
+
diff --git a/drbd.te b/drbd.te
-index f2516cc..6f78534 100644
+index f2516cc..70ddc24 100644
--- a/drbd.te
+++ b/drbd.te
@@ -18,17 +18,20 @@ files_type(drbd_var_lib_t)
@@ -26243,7 +26265,7 @@ index f2516cc..6f78534 100644
kernel_read_system_state(drbd_t)
-+auth_read_passwd(drbd_t)
++auth_use_nsswitch(drbd_t)
+
+can_exec(drbd_t, drbd_exec_t)
+
@@ -35165,10 +35187,10 @@ index 6517fad..b7ca833 100644
+ allow $1 hypervkvp_unit_file_t:service all_service_perms;
')
diff --git a/hypervkvp.te b/hypervkvp.te
-index 4eb7041..6f859e1 100644
+index 4eb7041..ccb563e 100644
--- a/hypervkvp.te
+++ b/hypervkvp.te
-@@ -5,24 +5,72 @@ policy_module(hypervkvp, 1.0.0)
+@@ -5,24 +5,81 @@ policy_module(hypervkvp, 1.0.0)
# Declarations
#
@@ -35203,7 +35225,7 @@ index 4eb7041..6f859e1 100644
#
-# Local policy
+# hyperv domain local policy
- #
++#
+
+allow hyperv_domain self:capability net_admin;
+allow hyperv_domain self:netlink_socket create_socket_perms;
@@ -35219,23 +35241,32 @@ index 4eb7041..6f859e1 100644
+########################################
#
+# hypervkvp local policy
-+#
-+
+ #
+
+-allow hypervkvpd_t self:fifo_file rw_fifo_file_perms;
+-allow hypervkvpd_t self:unix_stream_socket create_stream_socket_perms;
+manage_dirs_pattern(hypervkvp_t, hypervkvp_var_lib_t, hypervkvp_var_lib_t)
+manage_files_pattern(hypervkvp_t, hypervkvp_var_lib_t, hypervkvp_var_lib_t)
+files_var_lib_filetrans(hypervkvp_t, hypervkvp_var_lib_t, dir)
+
++domain_read_all_domains_state(hypervkvp_t)
++
+files_dontaudit_search_home(hypervkvp_t)
+
+logging_send_syslog_msg(hypervkvp_t)
+
+sysnet_dns_name_resolve(hypervkvp_t)
-
--allow hypervkvpd_t self:fifo_file rw_fifo_file_perms;
--allow hypervkvpd_t self:unix_stream_socket create_stream_socket_perms;
++sysnet_domtrans_dhcpc(hypervkvp_t)
++
++systemd_exec_systemctl(hypervkvp_t)
++
+userdom_dontaudit_search_admin_dir(hypervkvp_t)
+
+optional_policy(`
++ netutils_domtrans_ping(hypervkvp_t)
++')
++
++optional_policy(`
+ sysnet_exec_ifconfig(hypervkvp_t)
+')
+
@@ -35410,7 +35441,7 @@ index fbb54e7..05c3777 100644
########################################
diff --git a/inetd.te b/inetd.te
-index c6450df..93445b7 100644
+index c6450df..a28aa13 100644
--- a/inetd.te
+++ b/inetd.te
@@ -37,9 +37,9 @@ ifdef(`enable_mcs',`
@@ -35483,7 +35514,7 @@ index c6450df..93445b7 100644
########################################
#
# Child local policy
-@@ -220,6 +223,14 @@ kernel_read_kernel_sysctls(inetd_child_t)
+@@ -220,6 +223,16 @@ kernel_read_kernel_sysctls(inetd_child_t)
kernel_read_network_state(inetd_child_t)
kernel_read_system_state(inetd_child_t)
@@ -35495,10 +35526,12 @@ index c6450df..93445b7 100644
+corenet_tcp_sendrecv_all_ports(inetd_child_t)
+corenet_udp_sendrecv_all_ports(inetd_child_t)
+
++corecmd_bin_entry_type(inetd_child_t)
++
dev_read_urand(inetd_child_t)
fs_getattr_xattr_fs(inetd_child_t)
-@@ -230,7 +241,11 @@ auth_use_nsswitch(inetd_child_t)
+@@ -230,7 +243,11 @@ auth_use_nsswitch(inetd_child_t)
logging_send_syslog_msg(inetd_child_t)
@@ -58025,18 +58058,20 @@ index 8ec7859..719cffd 100644
fs_getattr_all_fs(ntop_t)
fs_search_auto_mountpoints(ntop_t)
diff --git a/ntp.fc b/ntp.fc
-index af3c91e..6882a3f 100644
+index af3c91e..2d41c4c 100644
--- a/ntp.fc
+++ b/ntp.fc
-@@ -13,6 +13,8 @@
+@@ -13,7 +13,10 @@
/usr/sbin/ntpdate -- gen_context(system_u:object_r:ntpdate_exec_t,s0)
/usr/sbin/sntp -- gen_context(system_u:object_r:ntpdate_exec_t,s0)
+/usr/lib/systemd/system/ntpd.* -- gen_context(system_u:object_r:ntpd_unit_file_t,s0)
+
/var/lib/ntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
++/var/lib/sntp(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
/var/lib/sntp-kod(/.*)? gen_context(system_u:object_r:ntp_drift_t,s0)
+ /var/log/ntp.* -- gen_context(system_u:object_r:ntpd_log_t,s0)
diff --git a/ntp.if b/ntp.if
index e96a309..2bacc3f 100644
--- a/ntp.if
@@ -58238,7 +58273,7 @@ index e96a309..2bacc3f 100644
+ files_var_lib_filetrans($1, ntp_drift_t, file, "sntp-kod")
')
diff --git a/ntp.te b/ntp.te
-index f81b113..5c71385 100644
+index f81b113..6f94328 100644
--- a/ntp.te
+++ b/ntp.te
@@ -18,6 +18,9 @@ role ntpd_roles types ntpd_t;
@@ -58251,15 +58286,16 @@ index f81b113..5c71385 100644
type ntp_conf_t;
files_config_file(ntp_conf_t)
-@@ -53,6 +56,7 @@ allow ntpd_t self:tcp_socket { accept listen };
+@@ -53,6 +56,8 @@ allow ntpd_t self:tcp_socket { accept listen };
manage_dirs_pattern(ntpd_t, ntp_drift_t, ntp_drift_t)
manage_files_pattern(ntpd_t, ntp_drift_t, ntp_drift_t)
++files_var_lib_filetrans(ntpd_t, ntp_drift_t, dir, "sntp")
+files_var_lib_filetrans(ntpd_t, ntp_drift_t, dir, "sntp-kod")
allow ntpd_t ntp_conf_t:file read_file_perms;
-@@ -60,9 +64,7 @@ read_files_pattern(ntpd_t, ntpd_key_t, ntpd_key_t)
+@@ -60,9 +65,7 @@ read_files_pattern(ntpd_t, ntpd_key_t, ntpd_key_t)
read_lnk_files_pattern(ntpd_t, ntpd_key_t, ntpd_key_t)
allow ntpd_t ntpd_log_t:dir setattr_dir_perms;
@@ -58270,7 +58306,7 @@ index f81b113..5c71385 100644
logging_log_filetrans(ntpd_t, ntpd_log_t, { file dir })
manage_dirs_pattern(ntpd_t, ntpd_tmp_t, ntpd_tmp_t)
-@@ -83,21 +85,16 @@ kernel_read_system_state(ntpd_t)
+@@ -83,21 +86,16 @@ kernel_read_system_state(ntpd_t)
kernel_read_network_state(ntpd_t)
kernel_request_load_module(ntpd_t)
@@ -58294,7 +58330,7 @@ index f81b113..5c71385 100644
corecmd_exec_bin(ntpd_t)
corecmd_exec_shell(ntpd_t)
-@@ -110,13 +107,15 @@ domain_use_interactive_fds(ntpd_t)
+@@ -110,13 +108,15 @@ domain_use_interactive_fds(ntpd_t)
domain_dontaudit_list_all_domains_state(ntpd_t)
files_read_etc_runtime_files(ntpd_t)
@@ -58311,7 +58347,7 @@ index f81b113..5c71385 100644
auth_use_nsswitch(ntpd_t)
-@@ -124,8 +123,6 @@ init_exec_script_files(ntpd_t)
+@@ -124,8 +124,6 @@ init_exec_script_files(ntpd_t)
logging_send_syslog_msg(ntpd_t)
@@ -61433,7 +61469,7 @@ index 0000000..776fda7
+')
diff --git a/opensm.te b/opensm.te
new file mode 100644
-index 0000000..32d1db4
+index 0000000..de03e94
--- /dev/null
+++ b/opensm.te
@@ -0,0 +1,45 @@
@@ -61474,7 +61510,7 @@ index 0000000..32d1db4
+
+kernel_read_system_state(opensm_t)
+
-+auth_read_passwd(opensm_t)
++auth_use_nsswitch(opensm_t)
+
+corecmd_exec_bin(opensm_t)
+
@@ -66390,7 +66426,7 @@ index 30e751f..61feb3a 100644
admin_pattern($1, plymouthd_var_run_t)
')
diff --git a/plymouthd.te b/plymouthd.te
-index 3078ce9..d2f68fa 100644
+index 3078ce9..18872dc 100644
--- a/plymouthd.te
+++ b/plymouthd.te
@@ -15,7 +15,7 @@ type plymouthd_exec_t;
@@ -66447,7 +66483,7 @@ index 3078ce9..d2f68fa 100644
+logging_link_generic_logs(plymouthd_t)
+logging_delete_generic_logs(plymouthd_t)
+
-+auth_read_passwd(plymouthd_t)
++auth_use_nsswitch(plymouthd_t)
+
miscfiles_read_fonts(plymouthd_t)
miscfiles_manage_fonts_cache(plymouthd_t)
@@ -66832,7 +66868,7 @@ index 032a84d..be00a65 100644
+ allow $1 policykit_auth_t:process signal;
')
diff --git a/policykit.te b/policykit.te
-index ee91778..6df7cf0 100644
+index ee91778..b00a474 100644
--- a/policykit.te
+++ b/policykit.te
@@ -7,9 +7,6 @@ policy_module(policykit, 1.3.0)
@@ -66998,7 +67034,7 @@ index ee91778..6df7cf0 100644
rw_files_pattern(policykit_auth_t, policykit_reload_t, policykit_reload_t)
-@@ -145,65 +159,79 @@ manage_dirs_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t)
+@@ -145,65 +159,80 @@ manage_dirs_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t)
manage_files_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t)
files_pid_filetrans(policykit_auth_t, policykit_var_run_t, { file dir })
@@ -67028,6 +67064,7 @@ index ee91778..6df7cf0 100644
userdom_dontaudit_read_user_home_content_files(policykit_auth_t)
+userdom_dontaudit_write_user_tmp_files(policykit_auth_t)
++userdom_dontaudit_manage_user_home_dirs(policykit_auth_t)
+userdom_read_admin_home_files(policykit_auth_t)
optional_policy(`
@@ -67090,7 +67127,7 @@ index ee91778..6df7cf0 100644
rw_files_pattern(policykit_grant_t, policykit_reload_t, policykit_reload_t)
-@@ -211,23 +239,20 @@ manage_files_pattern(policykit_grant_t, policykit_var_run_t, policykit_var_run_t
+@@ -211,23 +240,20 @@ manage_files_pattern(policykit_grant_t, policykit_var_run_t, policykit_var_run_t
manage_files_pattern(policykit_grant_t, policykit_var_lib_t, policykit_var_lib_t)
@@ -67117,7 +67154,7 @@ index ee91778..6df7cf0 100644
optional_policy(`
consolekit_dbus_chat(policykit_grant_t)
')
-@@ -235,26 +260,28 @@ optional_policy(`
+@@ -235,26 +261,28 @@ optional_policy(`
########################################
#
@@ -67152,7 +67189,7 @@ index ee91778..6df7cf0 100644
userdom_read_all_users_state(policykit_resolve_t)
optional_policy(`
-@@ -266,6 +293,6 @@ optional_policy(`
+@@ -266,6 +294,6 @@ optional_policy(`
')
optional_policy(`
@@ -87922,7 +87959,7 @@ index 50d07fb..bada62f 100644
+ allow $1 samba_unit_file_t:service all_service_perms;
')
diff --git a/samba.te b/samba.te
-index 2b7c441..9c52c41 100644
+index 2b7c441..fdfd40f 100644
--- a/samba.te
+++ b/samba.te
@@ -6,100 +6,80 @@ policy_module(samba, 1.16.3)
@@ -88836,13 +88873,13 @@ index 2b7c441..9c52c41 100644
-allow swat_t { nmbd_t smbd_t }:process { signal signull };
+samba_domtrans_smbd(swat_t)
+allow swat_t smbd_t:process { signal signull };
-
--allow swat_t smbd_var_run_t:file read_file_perms;
--allow swat_t smbd_var_run_t:file { lock delete_file_perms };
++
+samba_domtrans_nmbd(swat_t)
+allow swat_t nmbd_t:process { signal signull };
+allow nmbd_t swat_t:process signal;
-+
+
+-allow swat_t smbd_var_run_t:file read_file_perms;
+-allow swat_t smbd_var_run_t:file { lock delete_file_perms };
+read_files_pattern(swat_t, nmbd_var_run_t, nmbd_var_run_t)
+stream_connect_pattern(swat_t, nmbd_var_run_t, nmbd_var_run_t, nmbd_t)
+
@@ -89106,7 +89143,7 @@ index 2b7c441..9c52c41 100644
')
optional_policy(`
-@@ -959,31 +1017,29 @@ optional_policy(`
+@@ -959,31 +1017,35 @@ optional_policy(`
# Winbind helper local policy
#
@@ -89128,11 +89165,16 @@ index 2b7c441..9c52c41 100644
-domain_use_interactive_fds(winbind_helper_t)
-
-files_list_var_lib(winbind_helper_t)
--
++dev_read_urand(winbind_t)
+
term_list_ptys(winbind_helper_t)
++corecmd_exec_bin(winbind_helper_t)
++
+domain_use_interactive_fds(winbind_helper_t)
+
++files_list_tmp(winbind_helper_t)
++
auth_use_nsswitch(winbind_helper_t)
logging_send_syslog_msg(winbind_helper_t)
@@ -89144,7 +89186,7 @@ index 2b7c441..9c52c41 100644
optional_policy(`
apache_append_log(winbind_helper_t)
-@@ -997,25 +1053,38 @@ optional_policy(`
+@@ -997,25 +1059,38 @@ optional_policy(`
########################################
#
@@ -101541,7 +101583,7 @@ index e29db63..061fb98 100644
domain_system_change_exemption($1)
role_transition $2 tuned_initrc_exec_t system_r;
diff --git a/tuned.te b/tuned.te
-index 393a330..b500795 100644
+index 393a330..6893547 100644
--- a/tuned.te
+++ b/tuned.te
@@ -21,6 +21,9 @@ files_config_file(tuned_rw_etc_t)
@@ -101619,22 +101661,22 @@ index 393a330..b500795 100644
files_dontaudit_search_home(tuned_t)
-files_dontaudit_list_tmp(tuned_t)
+files_list_tmp(tuned_t)
-
--fs_getattr_xattr_fs(tuned_t)
++
+fs_getattr_all_fs(tuned_t)
+fs_search_all(tuned_t)
+fs_rw_hugetlbfs_files(tuned_t)
-+
+
+-fs_getattr_xattr_fs(tuned_t)
+auth_use_nsswitch(tuned_t)
logging_send_syslog_msg(tuned_t)
+#bug in tuned
+logging_manage_syslog_config(tuned_t)
+logging_filetrans_named_conf(tuned_t)
-+
-+mount_read_pid_files(tuned_t)
-miscfiles_read_localization(tuned_t)
++mount_read_pid_files(tuned_t)
++
+modutils_domtrans_insmod(tuned_t)
udev_read_pid_files(tuned_t)
@@ -101671,6 +101713,14 @@ index 393a330..b500795 100644
optional_policy(`
sysnet_domtrans_ifconfig(tuned_t)
')
+@@ -96,3 +139,7 @@ optional_policy(`
+ optional_policy(`
+ unconfined_dbus_send(tuned_t)
+ ')
++
++optional_policy(`
++ unconfined_domain(tuned_t)
++')
diff --git a/tvtime.if b/tvtime.if
index 1bb0f7c..372be2f 100644
--- a/tvtime.if
@@ -105205,7 +105255,7 @@ index facdee8..c7a2d97 100644
+ typeattribute $1 sandbox_caps_domain;
')
diff --git a/virt.te b/virt.te
-index f03dcf5..f960625 100644
+index f03dcf5..f3d6203 100644
--- a/virt.te
+++ b/virt.te
@@ -1,150 +1,241 @@
@@ -106210,7 +106260,7 @@ index f03dcf5..f960625 100644
+allow virt_domain self:process { setrlimit signal_perms getsched setsched };
+allow virt_domain self:fifo_file rw_fifo_file_perms;
+allow virt_domain self:shm create_shm_perms;
-+allow virt_domain self:unix_stream_socket create_stream_socket_perms;
++allow virt_domain self:unix_stream_socket { connectto create_stream_socket_perms };
+allow virt_domain self:unix_dgram_socket { create_socket_perms sendto };
+allow virt_domain self:tcp_socket create_stream_socket_perms;
+allow virt_domain self:udp_socket create_socket_perms;
@@ -108548,10 +108598,10 @@ index ae919b9..32cbf8c 100644
optional_policy(`
diff --git a/wine.if b/wine.if
-index fd2b6cc..938c4a7 100644
+index fd2b6cc..c5ea35d 100644
--- a/wine.if
+++ b/wine.if
-@@ -1,46 +1,57 @@
+@@ -1,46 +1,58 @@
-## <summary>Run Windows programs in Linux.</summary>
+## <summary>Wine Is Not an Emulator. Run Windows programs in Linux.</summary>
@@ -108627,10 +108677,11 @@ index fd2b6cc..938c4a7 100644
+ relabel_dirs_pattern($2, wine_home_t, wine_home_t)
+ relabel_files_pattern($2, wine_home_t, wine_home_t)
+ relabel_lnk_files_pattern($2, wine_home_t, wine_home_t)
++
')
#######################################
-@@ -72,31 +83,25 @@ interface(`wine_role',`
+@@ -72,31 +84,26 @@ interface(`wine_role',`
#
template(`wine_role_template',`
gen_require(`
@@ -108661,6 +108712,7 @@ index fd2b6cc..938c4a7 100644
userdom_unpriv_usertype($1, $1_wine_t)
- userdom_manage_user_tmpfs_files($1_wine_t)
+ userdom_manage_tmpfs_role($2, $1_wine_t)
++ userdom_manage_home_role($2 ,$1_wine_t)
domain_mmap_low($1_wine_t)
@@ -108671,7 +108723,7 @@ index fd2b6cc..938c4a7 100644
optional_policy(`
xserver_role($1_r, $1_wine_t)
')
-@@ -123,9 +128,8 @@ interface(`wine_domtrans',`
+@@ -123,9 +130,8 @@ interface(`wine_domtrans',`
########################################
## <summary>
@@ -108683,7 +108735,7 @@ index fd2b6cc..938c4a7 100644
## </summary>
## <param name="domain">
## <summary>
-@@ -140,11 +144,11 @@ interface(`wine_domtrans',`
+@@ -140,11 +146,11 @@ interface(`wine_domtrans',`
#
interface(`wine_run',`
gen_require(`
@@ -108697,7 +108749,7 @@ index fd2b6cc..938c4a7 100644
')
########################################
-@@ -165,3 +169,22 @@ interface(`wine_rw_shm',`
+@@ -165,3 +171,22 @@ interface(`wine_rw_shm',`
allow $1 wine_t:shm rw_shm_perms;
')
@@ -112172,7 +112224,7 @@ index 0000000..fb0519e
+
diff --git a/zoneminder.te b/zoneminder.te
new file mode 100644
-index 0000000..b66e76d
+index 0000000..184e3d5
--- /dev/null
+++ b/zoneminder.te
@@ -0,0 +1,187 @@
@@ -112313,16 +112365,16 @@ index 0000000..b66e76d
+
+optional_policy(`
+ tunable_policy(`zoneminder_run_sudo',`
-+ dbus_system_bus_client(zoneminder_t)
++ sudo_exec(zoneminder_t)
++ su_exec(zoneminder_t)
+ ')
+')
+
+optional_policy(`
-+ tunable_policy(`zoneminder_run_sudo',`
-+ sudo_exec(zoneminder_t)
-+ su_exec(zoneminder_t)
-+ ')
++ dbus_system_bus_client(zoneminder_t)
+')
++
++
+optional_policy(`
+ mysql_stream_connect(zoneminder_t)
+')
diff --git a/selinux-policy.spec b/selinux-policy.spec
index b79b3ad..4374952 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
-Release: 93%{?dist}
+Release: 94%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -604,6 +604,27 @@ SELinux Reference policy mls base module.
%endif
%changelog
+* Fri Nov 07 2014 Lukas Vrabec <lvrabec at redhat.com> 3.13.1-94
+- Added interface userdom_dontaudit_manage_user_home_dirs
+- New interface dev_rw_uhid_dev
+- Fix unconfined_server_dbus_chat() interface.
+- Allow login domains to create kernel keyring with different level.
+- Dontaudit policykit_auth_t to write to user home dirs. BZ (1157256)
+- Make tuned as unconfined domain.
+- Allow bluetooth read/write uhid devices. BZ (1161169)
+- Add fixes for hypervkvp daemon
+- make zoneminder as dbus client by default.
+- Allow guest to connect to libvirt using unix_stream_socket.
+- Allow all bus client domains to dbus chat with unconfined_service_t.
+- Allow inetd service without own policy to run in inetd_child_t which is unconfined domain.
+- Make opensm as nsswitch domain to make it working with sssd.
+- Allow brctl to read meminfo.
+- Allow winbind-helper to execute ntlm_auth in the caller domain.
+- Make plymouthd as nsswitch domain to make it working with sssd.
+- Make drbd as nsswitch domain to make it working with sssd
+- Make conman as nsswitch domain to make ipmitool.exp runing as conman_t working.
+- Add support for /var/lib/sntp directory.
+
* Mon Nov 03 2014 Lukas Vrabec <lvrabec at redhat.com> 3.13.1-93
- Add 15672 as amqp_port_t
- Add support for /dev/nvme controllerdevice nodes created by nvme driver.
More information about the scm-commits
mailing list