[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

rpms/selinux-policy-targeted/devel policy-20050629.patch, 1.2, 1.3 selinux-policy-targeted.spec, 1.333, 1.334



Author: dwalsh

Update of /cvs/dist/rpms/selinux-policy-targeted/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv12514

Modified Files:
	policy-20050629.patch selinux-policy-targeted.spec 
Log Message:
* Sat Jul 2 2005 Dan Walsh <dwalsh redhat com> 1.24-2
- Allow getty to run pppd
- Allow netplugd to work


policy-20050629.patch:
 Makefile                                 |   23 +--
 attrib.te                                |    2 
 domains/misc/kernel.te                   |    7 
 domains/misc/local.te                    |    5 
 domains/program/fsadm.te                 |    5 
 domains/program/getty.te                 |    7 
 domains/program/init.te                  |    4 
 domains/program/initrc.te                |   11 +
 domains/program/klogd.te                 |    2 
 domains/program/login.te                 |    4 
 domains/program/modutil.te               |    2 
 domains/program/mount.te                 |    4 
 domains/program/passwd.te                |    5 
 domains/program/restorecon.te            |    5 
 domains/program/ssh.te                   |    6 
 domains/program/syslogd.te               |    3 
 domains/program/unused/NetworkManager.te |    9 +
 domains/program/unused/acct.te           |    2 
 domains/program/unused/afs.te            |    1 
 domains/program/unused/alsa.te           |   17 ++
 domains/program/unused/amanda.te         |    7 
 domains/program/unused/amavis.te         |    5 
 domains/program/unused/apache.te         |    5 
 domains/program/unused/apmd.te           |    4 
 domains/program/unused/asterisk.te       |    2 
 domains/program/unused/auditd.te         |   10 +
 domains/program/unused/bluetooth.te      |    3 
 domains/program/unused/bonobo.te         |    9 +
 domains/program/unused/ciped.te          |    5 
 domains/program/unused/clamav.te         |    1 
 domains/program/unused/clockspeed.te     |    2 
 domains/program/unused/consoletype.te    |    2 
 domains/program/unused/cups.te           |   37 ++++
 domains/program/unused/cyrus.te          |    7 
 domains/program/unused/dante.te          |    1 
 domains/program/unused/dcc.te            |    3 
 domains/program/unused/ddclient.te       |    4 
 domains/program/unused/dhcpc.te          |   17 +-
 domains/program/unused/dhcpd.te          |    3 
 domains/program/unused/dictd.te          |    1 
 domains/program/unused/distcc.te         |    1 
 domains/program/unused/dovecot.te        |    4 
 domains/program/unused/ethereal.te       |   48 ++++++
 domains/program/unused/evolution.te      |   13 +
 domains/program/unused/fingerd.te        |    1 
 domains/program/unused/gatekeeper.te     |    1 
 domains/program/unused/gconf.te          |   12 +
 domains/program/unused/gift.te           |    2 
 domains/program/unused/gnome.te          |    7 
 domains/program/unused/gnome_vfs.te      |    9 +
 domains/program/unused/gpg.te            |    3 
 domains/program/unused/hald.te           |    4 
 domains/program/unused/hotplug.te        |    6 
 domains/program/unused/howl.te           |    1 
 domains/program/unused/i18n_input.te     |    7 
 domains/program/unused/iceauth.te        |   12 +
 domains/program/unused/imazesrv.te       |    1 
 domains/program/unused/inetd.te          |    7 
 domains/program/unused/innd.te           |    1 
 domains/program/unused/ircd.te           |    1 
 domains/program/unused/jabberd.te        |    3 
 domains/program/unused/lpd.te            |    1 
 domains/program/unused/lrrd.te           |    1 
 domains/program/unused/mdadm.te          |    2 
 domains/program/unused/monopd.te         |    1 
 domains/program/unused/mozilla.te        |    6 
 domains/program/unused/mysqld.te         |    4 
 domains/program/unused/named.te          |    1 
 domains/program/unused/nessusd.te        |    1 
 domains/program/unused/nscd.te           |    1 
 domains/program/unused/ntpd.te           |    1 
 domains/program/unused/openvpn.te        |    2 
 domains/program/unused/orbit.te          |    7 
 domains/program/unused/pam.te            |    5 
 domains/program/unused/pamconsole.te     |    2 
 domains/program/unused/ping.te           |    2 
 domains/program/unused/postgresql.te     |    4 
 domains/program/unused/postgrey.te       |    2 
 domains/program/unused/pppd.te           |    7 
 domains/program/unused/pxe.te            |    1 
 domains/program/unused/pyzor.te          |    2 
 domains/program/unused/radius.te         |    2 
 domains/program/unused/razor.te          |    2 
 domains/program/unused/rpcd.te           |   11 +
 domains/program/unused/samba.te          |    3 
 domains/program/unused/snmpd.te          |    1 
 domains/program/unused/sound-server.te   |    1 
 domains/program/unused/spamd.te          |    1 
 domains/program/unused/squid.te          |    1 
 domains/program/unused/ssh-agent.te      |    3 
 domains/program/unused/stunnel.te        |    1 
 domains/program/unused/tftpd.te          |    2 
 domains/program/unused/thunderbird.te    |    9 +
 domains/program/unused/transproxy.te     |    2 
 domains/program/unused/ucspi-tcp.te      |    2 
 domains/program/unused/udev.te           |    2 
 domains/program/unused/utempter.te       |    5 
 domains/program/unused/watchdog.te       |    2 
 domains/program/unused/xdm.te            |   23 ++-
 domains/program/unused/xserver.te        |    3 
 domains/program/unused/zebra.te          |    1 
 domains/user.te                          |   14 +
 file_contexts/distros.fc                 |   21 --
 file_contexts/program/alsa.fc            |    3 
 file_contexts/program/apache.fc          |    2 
 file_contexts/program/bonobo.fc          |    1 
 file_contexts/program/cups.fc            |    6 
 file_contexts/program/cyrus.fc           |    1 
 file_contexts/program/ethereal.fc        |    3 
 file_contexts/program/evolution.fc       |    8 +
 file_contexts/program/fontconfig.fc      |    6 
 file_contexts/program/fsadm.fc           |    1 
 file_contexts/program/gconf.fc           |    5 
 file_contexts/program/gnome.fc           |    8 +
 file_contexts/program/gnome_vfs.fc       |    1 
 file_contexts/program/iceauth.fc         |    3 
 file_contexts/program/irc.fc             |    2 
 file_contexts/program/mozilla.fc         |    6 
 file_contexts/program/orbit.fc           |    3 
 file_contexts/program/thunderbird.fc     |    2 
 file_contexts/program/xauth.fc           |    1 
 file_contexts/program/xdm.fc             |    1 
 file_contexts/program/xserver.fc         |    2 
 file_contexts/types.fc                   |   23 +--
 macros/admin_macros.te                   |   12 +
 macros/base_user_macros.te               |   75 ++++++---
 macros/content_macros.te                 |  185 ++++++++++++++++++++++++
 macros/global_macros.te                  |  121 +--------------
 macros/home_macros.te                    |  130 +++++++++++++++++
 macros/network_macros.te                 |    2 
 macros/program/apache_macros.te          |    5 
 macros/program/bonobo_macros.te          |  119 +++++++++++++++
 macros/program/dbusd_macros.te           |    5 
 macros/program/ethereal_macros.te        |   83 ++++++++++
 macros/program/evolution_macros.te       |  235 +++++++++++++++++++++++++++++++
 macros/program/fontconfig_macros.te      |   38 ++++-
 macros/program/games_domain.te           |   38 +----
 macros/program/gconf_macros.te           |   56 +++++++
 macros/program/gift_macros.te            |   60 ++-----
 macros/program/gnome_macros.te           |  115 +++++++++++++++
 macros/program/gnome_vfs_macros.te       |   49 ++++++
 macros/program/gpg_agent_macros.te       |    1 
 macros/program/gpg_macros.te             |   45 -----
 macros/program/ice_macros.te             |   38 +++++
 macros/program/iceauth_macros.te         |   40 +++++
 macros/program/inetd_macros.te           |    1 
 macros/program/irc_macros.te             |    1 
 macros/program/lpr_macros.te             |   24 ---
 macros/program/mail_client_macros.te     |   54 +++++++
 macros/program/mozilla_macros.te         |  131 ++++++-----------
 macros/program/mplayer_macros.te         |   15 +
 macros/program/orbit_macros.te           |   44 +++++
 macros/program/pyzor_macros.te           |    1 
 macros/program/razor_macros.te           |    1 
 macros/program/spamassassin_macros.te    |    9 -
 macros/program/ssh_agent_macros.te       |    3 
 macros/program/ssh_macros.te             |    5 
 macros/program/thunderbird_macros.te     |   57 +++++++
 macros/program/tvtime_macros.te          |    1 
 macros/program/userhelper_macros.te      |    3 
 macros/program/x_client_macros.te        |   12 -
 macros/program/xauth_macros.te           |    1 
 macros/program/xdm_macros.te             |   11 +
 macros/program/xserver_macros.te         |   17 +-
 macros/user_macros.te                    |    8 -
 mls                                      |   41 ++---
 net_contexts                             |  135 +++++------------
 targeted/domains/program/ssh.te          |    1 
 targeted/domains/program/xdm.te          |    1 
 types/device.te                          |    7 
 types/devpts.te                          |    2 
 types/file.te                            |    8 +
 types/network.te                         |   98 ++++++++++--
 types/security.te                        |    2 
 174 files changed, 2053 insertions(+), 742 deletions(-)

View full diff with command:
/usr/bin/cvs -f diff  -kk -u -N -r 1.2 -r 1.3 policy-20050629.patch
Index: policy-20050629.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/devel/policy-20050629.patch,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- policy-20050629.patch	29 Jun 2005 20:46:35 -0000	1.2
+++ policy-20050629.patch	3 Jul 2005 14:40:21 -0000	1.3
@@ -1,6 +1,6 @@
-diff --exclude-from=exclude -N -u -r nsapolicy/attrib.te policy-1.23.18/attrib.te
+diff --exclude-from=exclude -N -u -r nsapolicy/attrib.te policy-1.24/attrib.te
 --- nsapolicy/attrib.te	2005-05-25 11:28:09.000000000 -0400
-+++ policy-1.23.18/attrib.te	2005-06-08 09:04:15.000000000 -0400
++++ policy-1.24/attrib.te	2005-07-03 09:51:22.000000000 -0400
 @@ -30,7 +30,7 @@
  attribute mlsnetwritetoclr;
  attribute mlsnetupgrade;
@@ -10,9 +10,9 @@
  
  attribute mlsipcread;
  attribute mlsipcreadtoclr;
-diff --exclude-from=exclude -N -u -r nsapolicy/domains/misc/kernel.te policy-1.23.18/domains/misc/kernel.te
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/misc/kernel.te policy-1.24/domains/misc/kernel.te
 --- nsapolicy/domains/misc/kernel.te	2005-06-01 06:11:22.000000000 -0400
-+++ policy-1.23.18/domains/misc/kernel.te	2005-06-08 09:04:15.000000000 -0400
++++ policy-1.24/domains/misc/kernel.te	2005-07-03 09:51:22.000000000 -0400
 @@ -11,7 +11,7 @@
  # kernel_t is the domain of kernel threads.
  # It is also the target type when checking permissions in the system class.
@@ -34,18 +34,18 @@
  # Share state with the init process.
  allow kernel_t init_t:process share;
  
-diff --exclude-from=exclude -N -u -r nsapolicy/domains/misc/local.te policy-1.23.18/domains/misc/local.te
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/misc/local.te policy-1.24/domains/misc/local.te
 --- nsapolicy/domains/misc/local.te	1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.23.18/domains/misc/local.te	2005-06-09 14:57:58.000000000 -0400
++++ policy-1.24/domains/misc/local.te	2005-07-03 09:51:22.000000000 -0400
 @@ -0,0 +1,5 @@
 +# Local customization of existing policy should be done in this file.  
 +# If you are creating brand new policy for a new "target" domain, you
 +# need to create a type enforcement (.te) file in domains/program
 +# and a file context (.fc) file in file_context/program.
 +
-diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/fsadm.te policy-1.23.18/domains/program/fsadm.te
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/fsadm.te policy-1.24/domains/program/fsadm.te
 --- nsapolicy/domains/program/fsadm.te	2005-06-01 06:11:22.000000000 -0400
-+++ policy-1.23.18/domains/program/fsadm.te	2005-06-08 09:38:00.000000000 -0400
++++ policy-1.24/domains/program/fsadm.te	2005-07-03 09:51:22.000000000 -0400
 @@ -12,14 +12,14 @@
  # administration.
  # fsadm_exec_t is the type of the corresponding programs.
@@ -68,9 +68,23 @@
  allow fsadm_t { file_t unlabeled_t }:blk_file rw_file_perms;
  allow fsadm_t usbfs_t:dir { getattr search };
 +allow fsadm_t ramfs_t:fifo_file rw_file_perms;
-diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/initrc.te policy-1.23.18/domains/program/initrc.te
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/getty.te policy-1.24/domains/program/getty.te
+--- nsapolicy/domains/program/getty.te	2005-05-02 14:06:54.000000000 -0400
++++ policy-1.24/domains/program/getty.te	2005-07-03 09:51:22.000000000 -0400
+@@ -52,3 +52,10 @@
+ # for mgetty
+ var_run_domain(getty)
+ allow getty_t self:capability { fowner fsetid };
++
++#
++# getty needs to be able to run pppd
++#
++ifdef(`pppd.te', `
++domain_auto_trans(getty_t, pppd_exec_t, pppd_t)
++')
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/initrc.te policy-1.24/domains/program/initrc.te
 --- nsapolicy/domains/program/initrc.te	2005-05-25 11:28:09.000000000 -0400
-+++ policy-1.23.18/domains/program/initrc.te	2005-06-16 16:54:14.000000000 -0400
++++ policy-1.24/domains/program/initrc.te	2005-07-03 09:51:22.000000000 -0400
 @@ -12,7 +12,7 @@
  # initrc_exec_t is the type of the init program.
  #
@@ -103,9 +117,9 @@
  domain_trans(initrc_t, shell_exec_t, unconfined_t)
  allow initrc_t unconfined_t:system syslog_mod;
  ', `
-diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/init.te policy-1.23.18/domains/program/init.te
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/init.te policy-1.24/domains/program/init.te
 --- nsapolicy/domains/program/init.te	2005-05-25 11:28:09.000000000 -0400
-+++ policy-1.23.18/domains/program/init.te	2005-06-08 09:04:15.000000000 -0400
++++ policy-1.24/domains/program/init.te	2005-07-03 09:51:22.000000000 -0400
 @@ -14,11 +14,11 @@
  # by init during initialization.  This pipe is used
  # to communicate with init.
@@ -120,9 +134,9 @@
  
  # for init to determine whether SE Linux is active so it can know whether to
  # activate it
-diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/klogd.te policy-1.23.18/domains/program/klogd.te
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/klogd.te policy-1.24/domains/program/klogd.te
 --- nsapolicy/domains/program/klogd.te	2005-05-25 11:28:09.000000000 -0400
-+++ policy-1.23.18/domains/program/klogd.te	2005-06-08 09:04:15.000000000 -0400
++++ policy-1.24/domains/program/klogd.te	2005-07-03 09:51:23.000000000 -0400
 @@ -8,7 +8,7 @@
  #
  # Rules for the klogd_t domain.
@@ -132,9 +146,9 @@
  
  tmp_domain(klogd)
  allow klogd_t proc_t:dir r_dir_perms;
-diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/login.te policy-1.23.18/domains/program/login.te
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/login.te policy-1.24/domains/program/login.te
 --- nsapolicy/domains/program/login.te	2005-05-25 11:28:09.000000000 -0400
-+++ policy-1.23.18/domains/program/login.te	2005-06-24 23:34:03.000000000 -0400
++++ policy-1.24/domains/program/login.te	2005-07-03 09:51:23.000000000 -0400
 @@ -13,7 +13,7 @@
  
  # $1 is the name of the domain (local or remote)
@@ -153,9 +167,9 @@
  
  # Search for mail spool file.
  allow $1_login_t mail_spool_t:dir r_dir_perms;
-diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/modutil.te policy-1.23.18/domains/program/modutil.te
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/modutil.te policy-1.24/domains/program/modutil.te
 --- nsapolicy/domains/program/modutil.te	2005-06-01 06:11:22.000000000 -0400
-+++ policy-1.23.18/domains/program/modutil.te	2005-06-08 09:04:15.000000000 -0400
++++ policy-1.24/domains/program/modutil.te	2005-07-03 09:51:23.000000000 -0400
 @@ -72,7 +72,7 @@
  # Rules for the insmod_t domain.
  #
@@ -165,9 +179,9 @@
  ;
  role system_r types insmod_t;
  role sysadm_r types insmod_t;
-diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/mount.te policy-1.23.18/domains/program/mount.te
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/mount.te policy-1.24/domains/program/mount.te
 --- nsapolicy/domains/program/mount.te	2005-05-25 11:28:09.000000000 -0400
-+++ policy-1.23.18/domains/program/mount.te	2005-06-16 14:01:56.000000000 -0400
++++ policy-1.24/domains/program/mount.te	2005-07-03 09:51:23.000000000 -0400
 @@ -11,7 +11,7 @@
  
  type mount_exec_t, file_type, sysadmfile, exec_type;
@@ -186,9 +200,9 @@
  #
  # This rule needs to be generalized.  Only admin, initrc should have it.
  #
-diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/passwd.te policy-1.23.18/domains/program/passwd.te
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/passwd.te policy-1.24/domains/program/passwd.te
 --- nsapolicy/domains/program/passwd.te	2005-05-25 11:28:09.000000000 -0400
-+++ policy-1.23.18/domains/program/passwd.te	2005-06-25 07:05:49.000000000 -0400
++++ policy-1.24/domains/program/passwd.te	2005-07-03 09:51:23.000000000 -0400
 @@ -149,3 +149,8 @@
  allow passwd_t userdomain:process getattr;
  
@@ -198,9 +212,9 @@
 +role system_r types sysadm_passwd_t;
 +allow sysadm_passwd_t devpts_t:chr_file { read write };
 +')
-diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/restorecon.te policy-1.23.18/domains/program/restorecon.te
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/restorecon.te policy-1.24/domains/program/restorecon.te
 --- nsapolicy/domains/program/restorecon.te	2005-05-25 11:28:09.000000000 -0400
-+++ policy-1.23.18/domains/program/restorecon.te	2005-06-10 14:11:36.000000000 -0400
++++ policy-1.24/domains/program/restorecon.te	2005-07-03 09:51:23.000000000 -0400
 @@ -12,7 +12,7 @@
  #
  # needs auth_write attribute because it has relabelfrom/relabelto
@@ -224,9 +238,9 @@
  allow restorecon_t kernel_t:unix_dgram_socket { read write };
  r_dir_file(restorecon_t, { selinux_config_t file_context_t default_context_t } )
 -
-diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/ssh.te policy-1.23.18/domains/program/ssh.te
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/ssh.te policy-1.24/domains/program/ssh.te
 --- nsapolicy/domains/program/ssh.te	2005-05-25 11:28:09.000000000 -0400
-+++ policy-1.23.18/domains/program/ssh.te	2005-06-24 23:58:49.000000000 -0400
++++ policy-1.24/domains/program/ssh.te	2005-07-03 10:37:52.000000000 -0400
 @@ -19,13 +19,11 @@
  type sshd_exec_t, file_type, exec_type, sysadmfile;
  type sshd_key_t, file_type, sysadmfile;
@@ -242,9 +256,20 @@
  can_exec($1_t, sshd_exec_t)
  r_dir_file($1_t, self)
  role system_r types $1_t;
-diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/syslogd.te policy-1.23.18/domains/program/syslogd.te
+@@ -149,10 +147,8 @@
+ sshd_spawn_domain(sshd, unpriv_userdomain, userpty_type)
+ }
+ 
+-ifdef(`use_x_ports', `
+ # for X forwarding
+ allow sshd_t xserver_port_t:tcp_socket name_bind;
+-')
+ 
+ r_dir_file(sshd_t, selinux_config_t)
+ sshd_program_domain(sshd_extern)
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/syslogd.te policy-1.24/domains/program/syslogd.te
 --- nsapolicy/domains/program/syslogd.te	2005-05-25 11:28:09.000000000 -0400
-+++ policy-1.23.18/domains/program/syslogd.te	2005-06-18 06:38:54.000000000 -0400
++++ policy-1.24/domains/program/syslogd.te	2005-07-03 09:51:23.000000000 -0400
 @@ -25,7 +25,7 @@
  
  r_dir_file(syslogd_t, sysfs_t)
@@ -262,9 +287,9 @@
  allow syslogd_t syslogd_port_t:udp_socket name_bind;
  #
[...1843 lines suppressed...]
@@ -4525,9 +4603,9 @@
 +allow $1 xdm_t:fd use;
 +allow $1 xdm_t:fifo_file { getattr read write ioctl };
 +') dnl can_pipe_xdm
-diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/xserver_macros.te policy-1.23.18/macros/program/xserver_macros.te
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/xserver_macros.te policy-1.24/macros/program/xserver_macros.te
 --- nsapolicy/macros/program/xserver_macros.te	2005-05-02 14:06:57.000000000 -0400
-+++ policy-1.23.18/macros/program/xserver_macros.te	2005-06-08 09:04:15.000000000 -0400
++++ policy-1.24/macros/program/xserver_macros.te	2005-07-03 09:51:23.000000000 -0400
 @@ -79,6 +79,12 @@
  allow xdm_xserver_t init_t:fd use;
  
@@ -4576,9 +4654,9 @@
  ')dnl end macro definition
  
  ', `
-diff --exclude-from=exclude -N -u -r nsapolicy/macros/user_macros.te policy-1.23.18/macros/user_macros.te
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/user_macros.te policy-1.24/macros/user_macros.te
 --- nsapolicy/macros/user_macros.te	2005-06-01 06:11:23.000000000 -0400
-+++ policy-1.23.18/macros/user_macros.te	2005-06-16 14:05:32.000000000 -0400
++++ policy-1.24/macros/user_macros.te	2005-07-03 09:51:23.000000000 -0400
 @@ -21,7 +21,10 @@
  type $1_home_dir_t, file_type, sysadmfile, home_dir_type, home_type, user_home_dir_type, polydir;
  type $1_home_t, file_type, sysadmfile, home_type, user_home_type, $1_file_type, polymember;
@@ -4601,9 +4679,9 @@
  ')
  ')
  
-diff --exclude-from=exclude -N -u -r nsapolicy/Makefile policy-1.23.18/Makefile
+diff --exclude-from=exclude -N -u -r nsapolicy/Makefile policy-1.24/Makefile
 --- nsapolicy/Makefile	2005-05-25 11:28:09.000000000 -0400
-+++ policy-1.23.18/Makefile	2005-06-23 16:44:19.000000000 -0400
++++ policy-1.24/Makefile	2005-07-03 09:51:23.000000000 -0400
 @@ -70,7 +70,7 @@
  CONTEXTFILES += $(FCFILES)
  
@@ -4675,9 +4753,9 @@
  	rm -f tags
  	rm -f tmp/*
  	rm -f $(FC)
-diff --exclude-from=exclude -N -u -r nsapolicy/mls policy-1.23.18/mls
+diff --exclude-from=exclude -N -u -r nsapolicy/mls policy-1.24/mls
 --- nsapolicy/mls	2005-04-14 15:01:53.000000000 -0400
-+++ policy-1.23.18/mls	2005-06-08 09:04:15.000000000 -0400
++++ policy-1.24/mls	2005-07-03 09:51:23.000000000 -0400
 @@ -257,10 +257,10 @@
  # these access vectors have no MLS restrictions
  # { dir file lnk_file chr_file blk_file sock_file fifo_file } { ioctl lock swapon quotaon }
@@ -4768,9 +4846,9 @@
  
  
  
-diff --exclude-from=exclude -N -u -r nsapolicy/net_contexts policy-1.23.18/net_contexts
+diff --exclude-from=exclude -N -u -r nsapolicy/net_contexts policy-1.24/net_contexts
 --- nsapolicy/net_contexts	2005-05-25 11:28:09.000000000 -0400
-+++ policy-1.23.18/net_contexts	2005-06-27 07:14:04.000000000 -0400
++++ policy-1.24/net_contexts	2005-07-03 09:51:23.000000000 -0400
 @@ -17,7 +17,6 @@
  # protocol number context
  # protocol low-high context
@@ -5040,18 +5118,18 @@
  
  # Defaults for reserved ports.  Earlier portcon entries take precedence;
  # these entries just cover any remaining reserved ports not otherwise 
-diff --exclude-from=exclude -N -u -r nsapolicy/targeted/domains/program/ssh.te policy-1.23.18/targeted/domains/program/ssh.te
+diff --exclude-from=exclude -N -u -r nsapolicy/targeted/domains/program/ssh.te policy-1.24/targeted/domains/program/ssh.te
 --- nsapolicy/targeted/domains/program/ssh.te	2005-04-27 10:28:56.000000000 -0400
-+++ policy-1.23.18/targeted/domains/program/ssh.te	2005-06-18 07:17:39.000000000 -0400
++++ policy-1.24/targeted/domains/program/ssh.te	2005-07-03 09:51:23.000000000 -0400
 @@ -16,5 +16,4 @@
  type ssh_keysign_exec_t, file_type, sysadmfile, exec_type;
  type sshd_key_t, file_type, sysadmfile;
  type sshd_var_run_t, file_type, sysadmfile;
 -type ssh_port_t, port_type;
  domain_auto_trans(initrc_t, sshd_exec_t, sshd_t)
-diff --exclude-from=exclude -N -u -r nsapolicy/targeted/domains/program/xdm.te policy-1.23.18/targeted/domains/program/xdm.te
+diff --exclude-from=exclude -N -u -r nsapolicy/targeted/domains/program/xdm.te policy-1.24/targeted/domains/program/xdm.te
 --- nsapolicy/targeted/domains/program/xdm.te	2005-05-02 07:37:54.000000000 -0400
-+++ policy-1.23.18/targeted/domains/program/xdm.te	2005-06-18 07:18:55.000000000 -0400
++++ policy-1.24/targeted/domains/program/xdm.te	2005-07-03 10:01:05.000000000 -0400
 @@ -12,7 +12,6 @@
  #
  type xdm_exec_t, file_type, sysadmfile, exec_type;
@@ -5060,66 +5138,9 @@
  type xserver_log_t, file_type, sysadmfile;
  type xdm_xserver_tmp_t, file_type, sysadmfile;
  type xdm_rw_etc_t, file_type, sysadmfile;
-diff --exclude-from=exclude -N -u -r nsapolicy/targeted/domains/unconfined.te policy-1.23.18/targeted/domains/unconfined.te
---- nsapolicy/targeted/domains/unconfined.te	2005-05-25 11:28:11.000000000 -0400
-+++ policy-1.23.18/targeted/domains/unconfined.te	2005-06-16 13:48:06.000000000 -0400
-@@ -62,11 +62,6 @@
- # Support SAMBA home directories
- bool use_samba_home_dirs false;
- 
--if (allow_execmod) {
--allow unconfined_t { ld_so_t shlib_t }:file execmod;
--allow unconfined_t { bin_t sbin_t exec_type }:file execmod;
--}
--
- ifdef(`samba.te', `samba_domain(user)')
- 
- # Allow system to run with NIS
-@@ -77,8 +72,3 @@
- 
- # allow reading of default file context
- bool read_default_t true;
--
--if (allow_execmem) {
--allow domain self:process execmem;
--}
--
-diff --exclude-from=exclude -N -u -r nsapolicy/tunables/distro.tun policy-1.23.18/tunables/distro.tun
---- nsapolicy/tunables/distro.tun	2005-02-24 14:51:09.000000000 -0500
-+++ policy-1.23.18/tunables/distro.tun	2005-06-08 09:04:15.000000000 -0400
-@@ -5,7 +5,7 @@
- # appropriate ifdefs.
- 
- 
--dnl define(`distro_redhat')
-+define(`distro_redhat')
- 
- dnl define(`distro_suse')
- 
-diff --exclude-from=exclude -N -u -r nsapolicy/tunables/tunable.tun policy-1.23.18/tunables/tunable.tun
---- nsapolicy/tunables/tunable.tun	2005-05-25 11:28:11.000000000 -0400
-+++ policy-1.23.18/tunables/tunable.tun	2005-06-08 09:04:15.000000000 -0400
-@@ -2,7 +2,7 @@
- dnl define(`user_can_mount')
- 
- # Allow rpm to run unconfined.
--dnl define(`unlimitedRPM')
-+define(`unlimitedRPM')
- 
- # Allow privileged utilities like hotplug and insmod to run unconfined.
- dnl define(`unlimitedUtils')
-@@ -20,7 +20,7 @@
- 
- # Do not audit things that we know to be broken but which
- # are not security risks
--dnl define(`hide_broken_symptoms')
-+define(`hide_broken_symptoms')
- 
- # Allow user_r to reach sysadm_r via su, sudo, or userhelper.
- # Otherwise, only staff_r can do so.
-diff --exclude-from=exclude -N -u -r nsapolicy/types/device.te policy-1.23.18/types/device.te
+diff --exclude-from=exclude -N -u -r nsapolicy/types/device.te policy-1.24/types/device.te
 --- nsapolicy/types/device.te	2005-05-25 11:28:11.000000000 -0400
-+++ policy-1.23.18/types/device.te	2005-06-08 09:04:15.000000000 -0400
++++ policy-1.24/types/device.te	2005-07-03 09:57:22.000000000 -0400
 @@ -154,3 +154,10 @@
  
  # for other device nodes such as the NVidia binary-only driver
@@ -5131,9 +5152,9 @@
 +
 +
 +
-diff --exclude-from=exclude -N -u -r nsapolicy/types/devpts.te policy-1.23.18/types/devpts.te
+diff --exclude-from=exclude -N -u -r nsapolicy/types/devpts.te policy-1.24/types/devpts.te
 --- nsapolicy/types/devpts.te	2005-05-25 11:28:11.000000000 -0400
-+++ policy-1.23.18/types/devpts.te	2005-06-08 09:04:15.000000000 -0400
++++ policy-1.24/types/devpts.te	2005-07-03 09:58:04.000000000 -0400
 @@ -10,7 +10,7 @@
  #
  # ptmx_t is the type for /dev/ptmx.
@@ -5143,9 +5164,9 @@
  
  #
  # devpts_t is the type of the devpts file system and 
-diff --exclude-from=exclude -N -u -r nsapolicy/types/file.te policy-1.23.18/types/file.te
+diff --exclude-from=exclude -N -u -r nsapolicy/types/file.te policy-1.24/types/file.te
 --- nsapolicy/types/file.te	2005-05-25 11:28:11.000000000 -0400
-+++ policy-1.23.18/types/file.te	2005-06-25 16:08:39.000000000 -0400
++++ policy-1.24/types/file.te	2005-07-03 09:58:31.000000000 -0400
 @@ -137,7 +137,11 @@
  # texrel_shlib_t is the type of shared objects in the system lib
  # directories, which require text relocation.
@@ -5167,9 +5188,9 @@
 +# type for /tmp/.ICE-unix
 +type ice_tmp_t, file_type, sysadmfile, tmpfile;
  
-diff --exclude-from=exclude -N -u -r nsapolicy/types/network.te policy-1.23.18/types/network.te
+diff --exclude-from=exclude -N -u -r nsapolicy/types/network.te policy-1.24/types/network.te
 --- nsapolicy/types/network.te	2005-05-25 11:28:11.000000000 -0400
-+++ policy-1.23.18/types/network.te	2005-06-23 16:41:20.000000000 -0400
++++ policy-1.24/types/network.te	2005-07-03 09:51:23.000000000 -0400
 @@ -8,17 +8,7 @@
  # Modified by Russell Coker
  # Move port types to their respective domains, add ifdefs, other cleanups.
@@ -5294,9 +5315,9 @@
 +type afs_ka_port_t, port_type;
 +type afs_bos_port_t, port_type;
 +
-diff --exclude-from=exclude -N -u -r nsapolicy/types/security.te policy-1.23.18/types/security.te
+diff --exclude-from=exclude -N -u -r nsapolicy/types/security.te policy-1.24/types/security.te
 --- nsapolicy/types/security.te	2005-05-25 11:28:11.000000000 -0400
-+++ policy-1.23.18/types/security.te	2005-06-08 09:04:15.000000000 -0400
++++ policy-1.24/types/security.te	2005-07-03 09:58:20.000000000 -0400
 @@ -12,7 +12,7 @@
  # the permissions in the security class.  It is also
  # applied to selinuxfs inodes.


Index: selinux-policy-targeted.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/devel/selinux-policy-targeted.spec,v
retrieving revision 1.333
retrieving revision 1.334
diff -u -r1.333 -r1.334
--- selinux-policy-targeted.spec	29 Jun 2005 20:40:01 -0000	1.333
+++ selinux-policy-targeted.spec	3 Jul 2005 14:40:21 -0000	1.334
@@ -11,7 +11,7 @@
 Summary: SELinux %{type} policy configuration
 Name: selinux-policy-%{type}
 Version: 1.24
-Release: 1
+Release: 2
 License: GPL
 Group: System Environment/Base
 Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -235,6 +235,10 @@
 exit 0
 
 %changelog
+* Sat Jul 2 2005 Dan Walsh <dwalsh redhat com> 1.24-2
+- Allow getty to run pppd
+- Allow netplugd to work
+
 * Wed Jun 29 2005 Dan Walsh <dwalsh redhat com> 1.24-1
 - Upgrade from NSA
 	* Updated version for release.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]