[Date Prev][Date Next] [Thread Prev][Thread Next] [Thread Index] [Date Index] [Author Index]
rpms/selinux-policy-targeted/devel policy-20050629.patch, 1.3, 1.4 selinux-policy-targeted.spec, 1.334, 1.335

From: fedora-cvs-commits redhat com
To: fedora-cvs-commits redhat com
Subject: rpms/selinux-policy-targeted/devel policy-20050629.patch, 1.3, 1.4 selinux-policy-targeted.spec, 1.334, 1.335
Date: Tue, 5 Jul 2005 16:12:17 -0400
Author: dwalsh

Update of /cvs/dist/rpms/selinux-policy-targeted/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv25905

Modified Files:
	policy-20050629.patch selinux-policy-targeted.spec 
Log Message:
* Tue Jul 5 2005 Dan Walsh <dwalsh redhat com> 1.24-4
- Allow dovecot to access cert_t
- Add redhat tunable


policy-20050629.patch:
 Makefile                                 |   23 +--
 attrib.te                                |    2 
 domains/misc/kernel.te                   |    7 
 domains/misc/local.te                    |    5 
 domains/program/crond.te                 |    5 
 domains/program/fsadm.te                 |    5 
 domains/program/getty.te                 |    7 
 domains/program/init.te                  |    4 
 domains/program/initrc.te                |   11 +
 domains/program/klogd.te                 |    2 
 domains/program/login.te                 |    4 
 domains/program/modutil.te               |    2 
 domains/program/mount.te                 |    4 
 domains/program/netutils.te              |    2 
 domains/program/passwd.te                |    5 
 domains/program/restorecon.te            |    5 
 domains/program/ssh.te                   |    6 
 domains/program/syslogd.te               |    3 
 domains/program/unused/NetworkManager.te |    9 +
 domains/program/unused/acct.te           |    2 
 domains/program/unused/afs.te            |    1 
 domains/program/unused/alsa.te           |   17 ++
 domains/program/unused/amanda.te         |    7 
 domains/program/unused/amavis.te         |    5 
 domains/program/unused/apache.te         |    5 
 domains/program/unused/apmd.te           |    6 
 domains/program/unused/asterisk.te       |    2 
 domains/program/unused/auditd.te         |   10 +
 domains/program/unused/bluetooth.te      |    3 
 domains/program/unused/bonobo.te         |    9 +
 domains/program/unused/ciped.te          |    5 
 domains/program/unused/clamav.te         |    1 
 domains/program/unused/clockspeed.te     |    2 
 domains/program/unused/consoletype.te    |    2 
 domains/program/unused/cups.te           |   37 ++++
 domains/program/unused/cyrus.te          |    7 
 domains/program/unused/dante.te          |    1 
 domains/program/unused/dcc.te            |    3 
 domains/program/unused/ddclient.te       |    4 
 domains/program/unused/dhcpc.te          |   17 +-
 domains/program/unused/dhcpd.te          |    3 
 domains/program/unused/dictd.te          |    1 
 domains/program/unused/distcc.te         |    1 
 domains/program/unused/dovecot.te        |    5 
 domains/program/unused/ethereal.te       |   48 ++++++
 domains/program/unused/evolution.te      |   13 +
 domains/program/unused/fingerd.te        |    1 
 domains/program/unused/gatekeeper.te     |    1 
 domains/program/unused/gconf.te          |   12 +
 domains/program/unused/gift.te           |    2 
 domains/program/unused/gnome.te          |    7 
 domains/program/unused/gnome_vfs.te      |    9 +
 domains/program/unused/gpg.te            |    3 
 domains/program/unused/hald.te           |    4 
 domains/program/unused/hotplug.te        |    6 
 domains/program/unused/howl.te           |    1 
 domains/program/unused/i18n_input.te     |    7 
 domains/program/unused/iceauth.te        |   12 +
 domains/program/unused/imazesrv.te       |    1 
 domains/program/unused/inetd.te          |    7 
 domains/program/unused/innd.te           |    1 
 domains/program/unused/ircd.te           |    1 
 domains/program/unused/jabberd.te        |    3 
 domains/program/unused/lpd.te            |    1 
 domains/program/unused/lrrd.te           |    1 
 domains/program/unused/mdadm.te          |    2 
 domains/program/unused/monopd.te         |    1 
 domains/program/unused/mozilla.te        |    6 
 domains/program/unused/mysqld.te         |    4 
 domains/program/unused/named.te          |    1 
 domains/program/unused/nessusd.te        |    1 
 domains/program/unused/nscd.te           |    2 
 domains/program/unused/ntpd.te           |    1 
 domains/program/unused/openvpn.te        |    2 
 domains/program/unused/orbit.te          |    7 
 domains/program/unused/pam.te            |    5 
 domains/program/unused/pamconsole.te     |    2 
 domains/program/unused/ping.te           |    2 
 domains/program/unused/postgresql.te     |    4 
 domains/program/unused/postgrey.te       |    2 
 domains/program/unused/pppd.te           |    7 
 domains/program/unused/pxe.te            |    1 
 domains/program/unused/pyzor.te          |    2 
 domains/program/unused/radius.te         |    2 
 domains/program/unused/radvd.te          |    3 
 domains/program/unused/razor.te          |    2 
 domains/program/unused/rpcd.te           |   11 +
 domains/program/unused/samba.te          |    3 
 domains/program/unused/snmpd.te          |    1 
 domains/program/unused/sound-server.te   |    1 
 domains/program/unused/spamd.te          |    1 
 domains/program/unused/squid.te          |    1 
 domains/program/unused/ssh-agent.te      |    3 
 domains/program/unused/stunnel.te        |    1 
 domains/program/unused/tftpd.te          |    2 
 domains/program/unused/thunderbird.te    |    9 +
 domains/program/unused/transproxy.te     |    2 
 domains/program/unused/ucspi-tcp.te      |    2 
 domains/program/unused/udev.te           |    2 
 domains/program/unused/utempter.te       |    5 
 domains/program/unused/watchdog.te       |    2 
 domains/program/unused/winbind.te        |    3 
 domains/program/unused/xdm.te            |   23 ++-
 domains/program/unused/xserver.te        |    3 
 domains/program/unused/zebra.te          |    1 
 domains/user.te                          |   14 +
 file_contexts/distros.fc                 |   21 --
 file_contexts/program/alsa.fc            |    3 
 file_contexts/program/apache.fc          |    2 
 file_contexts/program/bonobo.fc          |    1 
 file_contexts/program/cups.fc            |    6 
 file_contexts/program/cyrus.fc           |    1 
 file_contexts/program/ethereal.fc        |    3 
 file_contexts/program/evolution.fc       |    8 +
 file_contexts/program/fontconfig.fc      |    6 
 file_contexts/program/fsadm.fc           |    1 
 file_contexts/program/gconf.fc           |    5 
 file_contexts/program/gnome.fc           |    8 +
 file_contexts/program/gnome_vfs.fc       |    1 
 file_contexts/program/iceauth.fc         |    3 
 file_contexts/program/irc.fc             |    2 
 file_contexts/program/mozilla.fc         |    6 
 file_contexts/program/orbit.fc           |    3 
 file_contexts/program/thunderbird.fc     |    2 
 file_contexts/program/xauth.fc           |    1 
 file_contexts/program/xdm.fc             |    1 
 file_contexts/program/xserver.fc         |    2 
 file_contexts/types.fc                   |   26 +--
 macros/admin_macros.te                   |   12 +
 macros/base_user_macros.te               |   79 ++++++----
 macros/content_macros.te                 |  185 ++++++++++++++++++++++++
 macros/global_macros.te                  |  121 +--------------
 macros/home_macros.te                    |  130 +++++++++++++++++
 macros/network_macros.te                 |    2 
 macros/program/apache_macros.te          |    5 
 macros/program/bonobo_macros.te          |  119 +++++++++++++++
 macros/program/crontab_macros.te         |    4 
 macros/program/dbusd_macros.te           |    5 
 macros/program/ethereal_macros.te        |   83 ++++++++++
 macros/program/evolution_macros.te       |  235 +++++++++++++++++++++++++++++++
 macros/program/fontconfig_macros.te      |   38 ++++-
 macros/program/games_domain.te           |   38 +----
 macros/program/gconf_macros.te           |   56 +++++++
 macros/program/gift_macros.te            |   60 ++-----
 macros/program/gnome_macros.te           |  115 +++++++++++++++
 macros/program/gnome_vfs_macros.te       |   49 ++++++
 macros/program/gpg_agent_macros.te       |    1 
 macros/program/gpg_macros.te             |   45 -----
 macros/program/ice_macros.te             |   38 +++++
 macros/program/iceauth_macros.te         |   40 +++++
 macros/program/inetd_macros.te           |    1 
 macros/program/irc_macros.te             |    1 
 macros/program/lpr_macros.te             |   24 ---
 macros/program/mail_client_macros.te     |   54 +++++++
 macros/program/mozilla_macros.te         |  131 ++++++-----------
 macros/program/mplayer_macros.te         |   15 +
 macros/program/orbit_macros.te           |   44 +++++
 macros/program/pyzor_macros.te           |    1 
 macros/program/razor_macros.te           |    1 
 macros/program/spamassassin_macros.te    |    9 -
 macros/program/ssh_agent_macros.te       |    3 
 macros/program/ssh_macros.te             |    5 
 macros/program/thunderbird_macros.te     |   57 +++++++
 macros/program/tvtime_macros.te          |    1 
 macros/program/userhelper_macros.te      |    3 
 macros/program/x_client_macros.te        |   12 -
 macros/program/xauth_macros.te           |    1 
 macros/program/xdm_macros.te             |   11 +
 macros/program/xserver_macros.te         |   17 +-
 macros/user_macros.te                    |    8 -
 mls                                      |   41 ++---
 net_contexts                             |  135 +++++------------
 targeted/domains/program/ssh.te          |    1 
 targeted/domains/program/xdm.te          |    1 
 tunables/distro.tun                      |    2 
 tunables/tunable.tun                     |    4 
 types/device.te                          |    7 
 types/devpts.te                          |    2 
 types/file.te                            |   14 +
 types/network.te                         |   98 ++++++++++--
 types/security.te                        |    2 
 181 files changed, 2071 insertions(+), 764 deletions(-)

Index: policy-20050629.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/devel/policy-20050629.patch,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- policy-20050629.patch	3 Jul 2005 14:40:21 -0000	1.3
+++ policy-20050629.patch	5 Jul 2005 20:12:12 -0000	1.4
@@ -43,6 +43,21 @@
 +# need to create a type enforcement (.te) file in domains/program
 +# and a file context (.fc) file in file_context/program.
 +
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/crond.te policy-1.24/domains/program/crond.te
+--- nsapolicy/domains/program/crond.te	2005-05-25 11:28:09.000000000 -0400
++++ policy-1.24/domains/program/crond.te	2005-07-03 11:10:58.000000000 -0400
+@@ -128,9 +128,8 @@
+ allow system_crond_t var_lib_t:file create_file_perms;
+ 
+ # Update whatis files.
+-allow system_crond_t catman_t:dir create_dir_perms;
+-allow system_crond_t catman_t:file create_file_perms;
+-allow system_crond_t man_t:file r_file_perms;
++allow system_crond_t man_t:dir create_dir_perms;
++allow system_crond_t man_t:file create_file_perms;
+ allow system_crond_t man_t:lnk_file read;
+ 
+ # Write /var/lock/makewhatis.lock.
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/fsadm.te policy-1.24/domains/program/fsadm.te
 --- nsapolicy/domains/program/fsadm.te	2005-06-01 06:11:22.000000000 -0400
 +++ policy-1.24/domains/program/fsadm.te	2005-07-03 09:51:22.000000000 -0400
@@ -200,6 +215,19 @@
  #
  # This rule needs to be generalized.  Only admin, initrc should have it.
  #
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/netutils.te policy-1.24/domains/program/netutils.te
+--- nsapolicy/domains/program/netutils.te	2005-04-27 10:28:49.000000000 -0400
++++ policy-1.24/domains/program/netutils.te	2005-07-03 11:43:16.000000000 -0400
+@@ -21,7 +21,9 @@
+ tmp_domain(netutils)
+ 
+ domain_auto_trans(initrc_t, netutils_exec_t, netutils_t)
++ifdef(`targeted_policy', `', `
+ domain_auto_trans(sysadm_t, netutils_exec_t, netutils_t)
++')
+ 
+ # Inherit and use descriptors from init.
+ allow netutils_t { userdomain init_t }:fd use;
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/passwd.te policy-1.24/domains/program/passwd.te
 --- nsapolicy/domains/program/passwd.te	2005-05-25 11:28:09.000000000 -0400
 +++ policy-1.24/domains/program/passwd.te	2005-07-03 09:51:23.000000000 -0400
@@ -414,7 +442,7 @@
  domain_auto_trans(httpd_t, httpdcontent, httpd_sys_script_t)
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/apmd.te policy-1.24/domains/program/unused/apmd.te
 --- nsapolicy/domains/program/unused/apmd.te	2005-05-25 11:28:09.000000000 -0400
-+++ policy-1.24/domains/program/unused/apmd.te	2005-07-03 09:51:23.000000000 -0400
++++ policy-1.24/domains/program/unused/apmd.te	2005-07-03 13:02:30.000000000 -0400
 @@ -21,7 +21,7 @@
  allow apm_t privfd:fd use;
  allow apm_t admin_tty_type:chr_file rw_file_perms;
@@ -433,6 +461,15 @@
  can_sysctl(apmd_t)
  allow apmd_t sysfs_t:file write;
  
+@@ -54,7 +54,7 @@
+ allow apmd_t self:process getsession;
+ 
+ # Use capabilities.
+-allow apmd_t self:capability { sys_admin sys_nice sys_time };
++allow apmd_t self:capability { sys_admin sys_nice sys_time kill };
+ 
+ # controlling an orderly resume of PCMCIA requires creating device
+ # nodes 254,{0,1,2} for some reason.
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/asterisk.te policy-1.24/domains/program/unused/asterisk.te
 --- nsapolicy/domains/program/unused/asterisk.te	2005-04-27 10:28:49.000000000 -0400
 +++ policy-1.24/domains/program/unused/asterisk.te	2005-07-03 09:51:23.000000000 -0400
@@ -767,8 +804,16 @@
  
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dovecot.te policy-1.24/domains/program/unused/dovecot.te
 --- nsapolicy/domains/program/unused/dovecot.te	2005-05-25 11:28:09.000000000 -0400
-+++ policy-1.24/domains/program/unused/dovecot.te	2005-07-03 09:51:23.000000000 -0400
-@@ -52,6 +52,10 @@
++++ policy-1.24/domains/program/unused/dovecot.te	2005-07-05 07:10:48.000000000 -0400
+@@ -35,6 +35,7 @@
+ allow dovecot_t urandom_device_t:chr_file { getattr read };
+ allow dovecot_t cert_t:dir search;
+ r_dir_file(dovecot_t, dovecot_cert_t)
++r_dir_file(dovecot_t, cert_t)
+ 
+ allow dovecot_t { self proc_t }:file { getattr read };
+ allow dovecot_t self:fifo_file rw_file_perms;
+@@ -52,6 +53,10 @@
  # Dovecot auth daemon
  #
  daemon_sub_domain(dovecot_t, dovecot_auth, `, auth_chkpwd')
@@ -1242,12 +1287,13 @@
 +
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/nscd.te policy-1.24/domains/program/unused/nscd.te
 --- nsapolicy/domains/program/unused/nscd.te	2005-04-27 10:28:52.000000000 -0400
-+++ policy-1.24/domains/program/unused/nscd.te	2005-07-03 09:51:23.000000000 -0400
-@@ -74,3 +74,4 @@
++++ policy-1.24/domains/program/unused/nscd.te	2005-07-03 11:55:45.000000000 -0400
+@@ -74,3 +74,5 @@
  allow nscd_t tmp_t:lnk_file read;
  allow nscd_t { urandom_device_t random_device_t }:chr_file { getattr read };
  log_domain(nscd)
 +r_dir_file(nscd_t, cert_t)
++allow nscd_t tun_tap_device_t:chr_file { read write };
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ntpd.te policy-1.24/domains/program/unused/ntpd.te
 --- nsapolicy/domains/program/unused/ntpd.te	2005-05-02 14:06:54.000000000 -0400
 +++ policy-1.24/domains/program/unused/ntpd.te	2005-07-03 09:51:23.000000000 -0400
@@ -1421,6 +1467,23 @@
  daemon_domain(radiusd, `, auth')
  
  etcdir_domain(radiusd)
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/radvd.te policy-1.24/domains/program/unused/radvd.te
+--- nsapolicy/domains/program/unused/radvd.te	2005-04-27 10:28:52.000000000 -0400
++++ policy-1.24/domains/program/unused/radvd.te	2005-07-05 15:55:58.000000000 -0400
+@@ -15,11 +15,12 @@
+ 
+ allow radvd_t self:{ rawip_socket unix_dgram_socket } rw_socket_perms;
+ 
+-allow radvd_t self:capability net_raw;
++allow radvd_t self:capability { net_raw setgid };
+ allow radvd_t self:{ unix_dgram_socket rawip_socket } create;
+ allow radvd_t self:unix_stream_socket create_socket_perms;
+ 
+ can_network_server(radvd_t)
++can_ypbind(radvd_t)
+ 
+ allow radvd_t proc_t:dir r_dir_perms;
+ allow radvd_t proc_t:file { getattr read };
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/razor.te policy-1.24/domains/program/unused/razor.te
 --- nsapolicy/domains/program/unused/razor.te	2005-05-02 14:06:54.000000000 -0400
 +++ policy-1.24/domains/program/unused/razor.te	2005-07-03 09:51:23.000000000 -0400
@@ -1647,6 +1710,19 @@
  log_domain(watchdog)
  
  allow watchdog_t etc_t:file r_file_perms;
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/winbind.te policy-1.24/domains/program/unused/winbind.te
+--- nsapolicy/domains/program/unused/winbind.te	2005-05-25 11:28:10.000000000 -0400
++++ policy-1.24/domains/program/unused/winbind.te	2005-07-05 16:05:23.000000000 -0400
+@@ -21,6 +21,9 @@
+ type samba_log_t, file_type, sysadmfile, logfile;
+ type samba_var_t, file_type, sysadmfile;
+ type samba_secrets_t, file_type, sysadmfile;
++allow smbd_t winbind_t:unix_stream_socket connectto;
++allow smbd_t winbind_var_run_t:dir r_dir_perms;
++allow smbd_t winbind_var_run_t:sock_file getattr;
+ ')
+ rw_dir_file(winbind_t, samba_etc_t)
+ rw_dir_create_file(winbind_t, samba_log_t)
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/xdm.te policy-1.24/domains/program/unused/xdm.te
 --- nsapolicy/domains/program/unused/xdm.te	2005-05-25 11:28:10.000000000 -0400
 +++ policy-1.24/domains/program/unused/xdm.te	2005-07-03 09:51:23.000000000 -0400
@@ -2024,8 +2100,18 @@
  /tmp/\.ICE-unix/.*	-s	<<none>>
 diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/types.fc policy-1.24/file_contexts/types.fc
 --- nsapolicy/file_contexts/types.fc	2005-06-01 06:11:22.000000000 -0400
-+++ policy-1.24/file_contexts/types.fc	2005-07-03 09:51:23.000000000 -0400
-@@ -249,6 +249,7 @@
++++ policy-1.24/file_contexts/types.fc	2005-07-03 11:10:58.000000000 -0400
+@@ -68,8 +68,7 @@
+ # /var
+ #
+ /var(/.*)?			system_u:object_r:var_t
+-/var/catman(/.*)?		system_u:object_r:catman_t
+-/var/cache/man(/.*)?		system_u:object_r:catman_t
++/var/cache/man(/.*)?		system_u:object_r:man_t
+ /var/yp(/.*)?			system_u:object_r:var_yp_t
+ /var/lib(/.*)?			system_u:object_r:var_lib_t
+ /var/lib/nfs(/.*)?		system_u:object_r:var_lib_nfs_t
+@@ -249,6 +248,7 @@
  /dev/dri/.+		-c	system_u:object_r:dri_device_t
  /dev/radeon		-c	system_u:object_r:dri_device_t
  /dev/agpgart		-c	system_u:object_r:agp_device_t
@@ -2033,7 +2119,7 @@
  
  #
  # Misc
-@@ -261,13 +262,13 @@
+@@ -261,13 +261,13 @@
  # /opt
  #
  /opt(/.*)?			system_u:object_r:usr_t
@@ -2054,7 +2140,7 @@
  
  #
  # /etc
-@@ -354,6 +355,8 @@
+@@ -354,6 +354,8 @@
  /usr/share/man(/.*)?		system_u:object_r:man_t
  /usr/share/mc/extfs/.*	--	system_u:object_r:bin_t
  /usr/share(/.*)?/lib(64)?(/.*)?	system_u:object_r:usr_t
@@ -2063,7 +2149,7 @@
  
  # nvidia share libraries
  /usr/x11R6/lib/modules/extensions/libglx\.so(\.[^/]*)* -- system_u:object_r:texrel_shlib_t
-@@ -386,8 +389,8 @@
+@@ -386,8 +388,8 @@
  /usr/local/src(/.*)?		system_u:object_r:src_t
  /usr/local/man(/.*)?		system_u:object_r:man_t
  /usr/local/.*\.so(\.[^/]*)*	--	system_u:object_r:shlib_t
@@ -2074,7 +2160,7 @@
  
  
  #
-@@ -471,6 +474,7 @@
+@@ -471,6 +473,7 @@
  /usr/lib/locale(/.*)?		system_u:object_r:locale_t
  /etc/localtime		--	system_u:object_r:locale_t
  /etc/localtime		-l	system_u:object_r:etc_t
@@ -2082,7 +2168,7 @@
  
  #
  # Gnu Cash
-@@ -499,6 +503,7 @@
+@@ -499,6 +502,7 @@
  #
  /usr/lib(64)?/[^/]*thunderbird[^/]*/thunderbird --      system_u:object_r:bin_t
  /usr/lib(64)?/[^/]*thunderbird[^/]*/thunderbird-bin -- system_u:object_r:bin_t
@@ -2126,7 +2212,7 @@
  
 diff --exclude-from=exclude -N -u -r nsapolicy/macros/base_user_macros.te policy-1.24/macros/base_user_macros.te
 --- nsapolicy/macros/base_user_macros.te	2005-06-01 06:11:23.000000000 -0400
-+++ policy-1.24/macros/base_user_macros.te	2005-07-03 09:51:23.000000000 -0400
++++ policy-1.24/macros/base_user_macros.te	2005-07-03 11:10:58.000000000 -0400
 @@ -2,12 +2,6 @@
  # Macros for all user login domains.
  #
@@ -2196,7 +2282,18 @@
  
  can_exec($1_t, { removable_t noexattrfile } )
  if (user_rw_noexattrfile) {
-@@ -182,10 +190,11 @@
+@@ -137,10 +145,6 @@
+ allow $1_t cardmgr_var_run_t:file { getattr read };
+ ')
+ 
+-# Read and write /var/catman.
+-allow $1_t catman_t:dir rw_dir_perms;
+-allow $1_t catman_t:file create_file_perms;
+-
+ # Modify mail spool file.
+ allow $1_t mail_spool_t:dir r_dir_perms;
+ allow $1_t mail_spool_t:file rw_file_perms;
+@@ -182,10 +186,11 @@
  ifdef(`screen.te', `screen_domain($1)')
  ifdef(`tvtime.te', `tvtime_domain($1)')
  ifdef(`mozilla.te', `mozilla_domain($1)')
@@ -2209,7 +2306,7 @@
  ifdef(`startx.te', `xserver_domain($1)')
  ifdef(`lpr.te', `lpr_domain($1)')
  ifdef(`ssh.te', `ssh_domain($1)')
-@@ -196,10 +205,24 @@
+@@ -196,10 +201,24 @@
  ifdef(`uml.te', `uml_domain($1)')
  ifdef(`cdrecord.te', `cdrecord_domain($1)')
  ifdef(`mplayer.te', `mplayer_domains($1)')
@@ -2235,7 +2332,7 @@
  # Instantiate a derived domain for user cron jobs.
  ifdef(`crond.te', `crond_domain($1)')
  
-@@ -294,8 +317,6 @@
+@@ -294,8 +313,6 @@
  x_client_domain($1, $1)
  
  ifdef(`xserver.te', `
@@ -2244,7 +2341,7 @@
  allow $1_t xserver_misc_device_t:{ chr_file blk_file } rw_file_perms;
  ')
  
-@@ -354,6 +375,10 @@
+@@ -354,6 +371,10 @@
  
  r_dir_file($1_t, src_t)
  
@@ -2255,7 +2352,7 @@
  if (read_default_t) {
  allow $1_t default_t:dir r_dir_perms;
  allow $1_t default_t:notdevfile_class_set r_file_perms;
-@@ -375,8 +400,6 @@
+@@ -375,8 +396,6 @@
  dontaudit $1_t self:socket create;
  dontaudit $1_t sysctl_net_t:dir search;
  
@@ -2910,6 +3007,27 @@
 +orbit_connect($2, $1)
 +
 +') dnl bonobo_connect
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/crontab_macros.te policy-1.24/macros/program/crontab_macros.te
+--- nsapolicy/macros/program/crontab_macros.te	2005-04-27 10:28:54.000000000 -0400
++++ policy-1.24/macros/program/crontab_macros.te	2005-07-03 11:04:57.000000000 -0400
+@@ -41,8 +41,6 @@
+ # Use capabilities dac_override is to create the file in the directory
+ # under /tmp
+ allow $1_crontab_t $1_crontab_t:capability { setuid setgid chown dac_override };
+-dontaudit $1_crontab_t proc_t:dir search;
+-dontaudit $1_crontab_t selinux_config_t:dir search;
+ 
+ # Type for temporary files.
+ file_type_auto_trans($1_crontab_t, tmp_t, $1_tmp_t, { dir file })
+@@ -64,7 +62,7 @@
+ ')dnl end ifdef fcron
+ 
+ # for the checks used by crontab -u
+-dontaudit $1_crontab_t security_t:dir search;
++can_getsecurity($1_crontab_t)
+ 
+ # crontab signals crond by updating the mtime on the spooldir
+ allow $1_crontab_t cron_spool_t:dir setattr;
 diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/dbusd_macros.te policy-1.24/macros/program/dbusd_macros.te
 --- nsapolicy/macros/program/dbusd_macros.te	2005-04-27 10:28:54.000000000 -0400
 +++ policy-1.24/macros/program/dbusd_macros.te	2005-07-03 09:53:31.000000000 -0400
@@ -5138,6 +5256,39 @@
  type xserver_log_t, file_type, sysadmfile;
  type xdm_xserver_tmp_t, file_type, sysadmfile;
  type xdm_rw_etc_t, file_type, sysadmfile;
+diff --exclude-from=exclude -N -u -r nsapolicy/tunables/distro.tun policy-1.24/tunables/distro.tun
+--- nsapolicy/tunables/distro.tun	2005-02-24 14:51:09.000000000 -0500
++++ policy-1.24/tunables/distro.tun	2005-07-05 16:10:33.000000000 -0400
+@@ -5,7 +5,7 @@
+ # appropriate ifdefs.
+ 
+ 
+-dnl define(`distro_redhat')
++define(`distro_redhat')
+ 
+ dnl define(`distro_suse')
+ 
+diff --exclude-from=exclude -N -u -r nsapolicy/tunables/tunable.tun policy-1.24/tunables/tunable.tun
+--- nsapolicy/tunables/tunable.tun	2005-05-25 11:28:11.000000000 -0400
++++ policy-1.24/tunables/tunable.tun	2005-07-05 16:11:12.000000000 -0400
+@@ -2,7 +2,7 @@
+ dnl define(`user_can_mount')
+ 
+ # Allow rpm to run unconfined.
+-dnl define(`unlimitedRPM')
++define(`unlimitedRPM')
+ 
+ # Allow privileged utilities like hotplug and insmod to run unconfined.
+ dnl define(`unlimitedUtils')
+@@ -20,7 +20,7 @@
+ 
+ # Do not audit things that we know to be broken but which
+ # are not security risks
+-dnl define(`hide_broken_symptoms')
++define(`hide_broken_symptoms')
+ 
+ # Allow user_r to reach sysadm_r via su, sudo, or userhelper.
+ # Otherwise, only staff_r can do so.
 diff --exclude-from=exclude -N -u -r nsapolicy/types/device.te policy-1.24/types/device.te
 --- nsapolicy/types/device.te	2005-05-25 11:28:11.000000000 -0400
 +++ policy-1.24/types/device.te	2005-07-03 09:57:22.000000000 -0400
@@ -5166,7 +5317,7 @@
  # devpts_t is the type of the devpts file system and 
 diff --exclude-from=exclude -N -u -r nsapolicy/types/file.te policy-1.24/types/file.te
 --- nsapolicy/types/file.te	2005-05-25 11:28:11.000000000 -0400
-+++ policy-1.24/types/file.te	2005-07-03 09:58:31.000000000 -0400
++++ policy-1.24/types/file.te	2005-07-03 11:10:58.000000000 -0400
 @@ -137,7 +137,11 @@
  # texrel_shlib_t is the type of shared objects in the system lib
  # directories, which require text relocation.
@@ -5179,7 +5330,27 @@
  
  # ld_so_t is the type of the system dynamic loaders.
  #
-@@ -325,4 +329,8 @@
+@@ -212,11 +216,6 @@
+ type wtmp_t, file_type, sysadmfile, logfile;
+ 
+ #
+-# catman_t is the type for /var/catman.
+-#
+-type catman_t, file_type, sysadmfile, tmpfile;
+-
+-#
+ # cron_spool_t is the type for /var/spool/cron.
+ #
+ type cron_spool_t, file_type, sysadmfile;
+@@ -240,6 +239,7 @@
+ # man_t is the type for the man directories.
+ #
+ type man_t, file_type, sysadmfile;
++typealias man_t alias catman_t;
+ 
+ #
+ # readable_t is a general type for
+@@ -325,4 +325,8 @@
  # Type for anonymous FTP data, used by ftp and rsync
  type ftpd_anon_t, file_type, sysadmfile, customizable;
  


Index: selinux-policy-targeted.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/devel/selinux-policy-targeted.spec,v
retrieving revision 1.334
retrieving revision 1.335
diff -u -r1.334 -r1.335
--- selinux-policy-targeted.spec	3 Jul 2005 14:40:21 -0000	1.334
+++ selinux-policy-targeted.spec	5 Jul 2005 20:12:12 -0000	1.335
@@ -11,7 +11,7 @@
 Summary: SELinux %{type} policy configuration
 Name: selinux-policy-%{type}
 Version: 1.24
-Release: 2
+Release: 4
 License: GPL
 Group: System Environment/Base
 Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -207,6 +207,7 @@
 %config %{_sysconfdir}/selinux/%{type}/src/policy/constraints
 %dir %{_sysconfdir}/selinux/%{type}/src/policy/domains
 %config %{_sysconfdir}/selinux/%{type}/src/policy/domains/*
+%config(noreplace) %{_sysconfdir}/selinux/%{type}/src/policy/domains/misc/local.te
 %dir %{_sysconfdir}/selinux/%{type}/src/policy/file_contexts
 %config %{_sysconfdir}/selinux/%{type}/src/policy/file_contexts/*
 %dir %{_sysconfdir}/selinux/%{type}/src/policy/flask
@@ -235,6 +236,10 @@
 exit 0
 
 %changelog
+* Tue Jul 5 2005 Dan Walsh <dwalsh redhat com> 1.24-4
+- Allow dovecot to access cert_t
+- Add redhat tunable
+
 * Sat Jul 2 2005 Dan Walsh <dwalsh redhat com> 1.24-2
 - Allow getty to run pppd
 - Allow netplugd to work
[Date Prev][Date Next] [Thread Prev][Thread Next] [Thread Index] [Date Index] [Author Index]