[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

rpms/selinux-policy-strict/devel policy-20050629.patch, 1.4, 1.5 selinux-policy-strict.spec, 1.341, 1.342



Author: dwalsh

Update of /cvs/dist/rpms/selinux-policy-strict/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv23207

Modified Files:
	policy-20050629.patch selinux-policy-strict.spec 
Log Message:
* Wed Jul 6 2005 Dan Walsh <dwalsh redhat com> 1.24-5
- Add winbind_helper_t


policy-20050629.patch:
 Makefile                                 |   23 +--
 attrib.te                                |    2 
 domains/misc/kernel.te                   |    7 
 domains/misc/local.te                    |    5 
 domains/program/crond.te                 |    5 
 domains/program/fsadm.te                 |    5 
 domains/program/getty.te                 |    7 
 domains/program/init.te                  |    4 
 domains/program/initrc.te                |   11 +
 domains/program/klogd.te                 |    2 
 domains/program/login.te                 |    4 
 domains/program/modutil.te               |    2 
 domains/program/mount.te                 |    4 
 domains/program/netutils.te              |    2 
 domains/program/passwd.te                |    5 
 domains/program/restorecon.te            |    5 
 domains/program/ssh.te                   |    6 
 domains/program/syslogd.te               |    3 
 domains/program/unused/NetworkManager.te |    9 +
 domains/program/unused/acct.te           |    2 
 domains/program/unused/afs.te            |    1 
 domains/program/unused/alsa.te           |   17 ++
 domains/program/unused/amanda.te         |    7 
 domains/program/unused/amavis.te         |    5 
 domains/program/unused/apache.te         |    5 
 domains/program/unused/apmd.te           |    6 
 domains/program/unused/asterisk.te       |    2 
 domains/program/unused/auditd.te         |   10 +
 domains/program/unused/bluetooth.te      |    3 
 domains/program/unused/bonobo.te         |    9 +
 domains/program/unused/ciped.te          |    5 
 domains/program/unused/clamav.te         |    1 
 domains/program/unused/clockspeed.te     |    2 
 domains/program/unused/consoletype.te    |    2 
 domains/program/unused/cups.te           |   37 ++++
 domains/program/unused/cyrus.te          |    7 
 domains/program/unused/dante.te          |    1 
 domains/program/unused/dcc.te            |    3 
 domains/program/unused/ddclient.te       |    4 
 domains/program/unused/dhcpc.te          |   17 +-
 domains/program/unused/dhcpd.te          |    3 
 domains/program/unused/dictd.te          |    1 
 domains/program/unused/distcc.te         |    1 
 domains/program/unused/dovecot.te        |    5 
 domains/program/unused/ethereal.te       |   48 ++++++
 domains/program/unused/evolution.te      |   13 +
 domains/program/unused/fingerd.te        |    1 
 domains/program/unused/gatekeeper.te     |    1 
 domains/program/unused/gconf.te          |   12 +
 domains/program/unused/gift.te           |    2 
 domains/program/unused/gnome.te          |    7 
 domains/program/unused/gnome_vfs.te      |    9 +
 domains/program/unused/gpg.te            |    3 
 domains/program/unused/hald.te           |    4 
 domains/program/unused/hotplug.te        |    6 
 domains/program/unused/howl.te           |    1 
 domains/program/unused/i18n_input.te     |    7 
 domains/program/unused/iceauth.te        |   12 +
 domains/program/unused/imazesrv.te       |    1 
 domains/program/unused/inetd.te          |    7 
 domains/program/unused/innd.te           |    1 
 domains/program/unused/ircd.te           |    1 
 domains/program/unused/jabberd.te        |    3 
 domains/program/unused/lpd.te            |    1 
 domains/program/unused/lrrd.te           |    1 
 domains/program/unused/mdadm.te          |    2 
 domains/program/unused/monopd.te         |    1 
 domains/program/unused/mozilla.te        |    6 
 domains/program/unused/mysqld.te         |    4 
 domains/program/unused/named.te          |    1 
 domains/program/unused/nessusd.te        |    1 
 domains/program/unused/nscd.te           |    2 
 domains/program/unused/ntpd.te           |    1 
 domains/program/unused/openvpn.te        |    2 
 domains/program/unused/orbit.te          |    7 
 domains/program/unused/pam.te            |    5 
 domains/program/unused/pamconsole.te     |    2 
 domains/program/unused/ping.te           |    2 
 domains/program/unused/postgresql.te     |    4 
 domains/program/unused/postgrey.te       |    2 
 domains/program/unused/pppd.te           |    7 
 domains/program/unused/pxe.te            |    1 
 domains/program/unused/pyzor.te          |    2 
 domains/program/unused/radius.te         |    2 
 domains/program/unused/radvd.te          |    3 
 domains/program/unused/razor.te          |    2 
 domains/program/unused/rpcd.te           |   11 +
 domains/program/unused/samba.te          |    3 
 domains/program/unused/snmpd.te          |    1 
 domains/program/unused/sound-server.te   |    1 
 domains/program/unused/spamd.te          |    1 
 domains/program/unused/squid.te          |    4 
 domains/program/unused/ssh-agent.te      |    3 
 domains/program/unused/stunnel.te        |    1 
 domains/program/unused/tftpd.te          |    2 
 domains/program/unused/thunderbird.te    |    9 +
 domains/program/unused/transproxy.te     |    2 
 domains/program/unused/ucspi-tcp.te      |    2 
 domains/program/unused/udev.te           |    2 
 domains/program/unused/utempter.te       |    5 
 domains/program/unused/watchdog.te       |    2 
 domains/program/unused/winbind.te        |   10 +
 domains/program/unused/xdm.te            |   23 ++-
 domains/program/unused/xserver.te        |    3 
 domains/program/unused/zebra.te          |    1 
 domains/user.te                          |   14 +
 file_contexts/distros.fc                 |   21 --
 file_contexts/program/alsa.fc            |    3 
 file_contexts/program/apache.fc          |    2 
 file_contexts/program/bonobo.fc          |    1 
 file_contexts/program/cups.fc            |    6 
 file_contexts/program/cyrus.fc           |    1 
 file_contexts/program/ethereal.fc        |    3 
 file_contexts/program/evolution.fc       |    8 +
 file_contexts/program/fontconfig.fc      |    6 
 file_contexts/program/fsadm.fc           |    1 
 file_contexts/program/gconf.fc           |    5 
 file_contexts/program/gnome.fc           |    8 +
 file_contexts/program/gnome_vfs.fc       |    1 
 file_contexts/program/iceauth.fc         |    3 
 file_contexts/program/irc.fc             |    2 
 file_contexts/program/mozilla.fc         |    6 
 file_contexts/program/orbit.fc           |    3 
 file_contexts/program/thunderbird.fc     |    2 
 file_contexts/program/winbind.fc         |    1 
 file_contexts/program/xauth.fc           |    1 
 file_contexts/program/xdm.fc             |    1 
 file_contexts/program/xserver.fc         |    2 
 file_contexts/types.fc                   |   26 +--
 macros/admin_macros.te                   |   12 +
 macros/base_user_macros.te               |   79 ++++++----
 macros/content_macros.te                 |  185 ++++++++++++++++++++++++
 macros/global_macros.te                  |  121 +--------------
 macros/home_macros.te                    |  130 +++++++++++++++++
 macros/network_macros.te                 |    2 
 macros/program/apache_macros.te          |    5 
 macros/program/bonobo_macros.te          |  119 +++++++++++++++
 macros/program/crontab_macros.te         |    4 
 macros/program/dbusd_macros.te           |    5 
 macros/program/ethereal_macros.te        |   83 ++++++++++
 macros/program/evolution_macros.te       |  235 +++++++++++++++++++++++++++++++
 macros/program/fontconfig_macros.te      |   38 ++++-
 macros/program/games_domain.te           |   38 +----
 macros/program/gconf_macros.te           |   56 +++++++
 macros/program/gift_macros.te            |   60 ++-----
 macros/program/gnome_macros.te           |  115 +++++++++++++++
 macros/program/gnome_vfs_macros.te       |   49 ++++++
 macros/program/gpg_agent_macros.te       |    1 
 macros/program/gpg_macros.te             |   45 -----
 macros/program/ice_macros.te             |   38 +++++
 macros/program/iceauth_macros.te         |   40 +++++
 macros/program/inetd_macros.te           |    1 
 macros/program/irc_macros.te             |    1 
 macros/program/lpr_macros.te             |   24 ---
 macros/program/mail_client_macros.te     |   54 +++++++
 macros/program/mozilla_macros.te         |  131 ++++++-----------
 macros/program/mplayer_macros.te         |   15 +
 macros/program/orbit_macros.te           |   44 +++++
 macros/program/pyzor_macros.te           |    1 
 macros/program/razor_macros.te           |    1 
 macros/program/spamassassin_macros.te    |    9 -
 macros/program/ssh_agent_macros.te       |    3 
 macros/program/ssh_macros.te             |    5 
 macros/program/thunderbird_macros.te     |   57 +++++++
 macros/program/tvtime_macros.te          |    1 
 macros/program/userhelper_macros.te      |    3 
 macros/program/x_client_macros.te        |   12 -
 macros/program/xauth_macros.te           |    1 
 macros/program/xdm_macros.te             |   11 +
 macros/program/xserver_macros.te         |   17 +-
 macros/user_macros.te                    |    8 -
 mls                                      |   41 ++---
 net_contexts                             |  135 +++++------------
 targeted/domains/program/ssh.te          |    1 
 targeted/domains/program/xdm.te          |    1 
 tunables/distro.tun                      |    2 
 tunables/tunable.tun                     |    4 
 types/device.te                          |    7 
 types/devpts.te                          |    2 
 types/file.te                            |   14 +
 types/network.te                         |   98 ++++++++++--
 types/security.te                        |    2 
 182 files changed, 2082 insertions(+), 764 deletions(-)

Index: policy-20050629.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/policy-20050629.patch,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- policy-20050629.patch	5 Jul 2005 20:12:06 -0000	1.4
+++ policy-20050629.patch	6 Jul 2005 14:27:15 -0000	1.5
@@ -1592,7 +1592,7 @@
  general_domain_access(spamd_t)
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/squid.te policy-1.24/domains/program/unused/squid.te
 --- nsapolicy/domains/program/unused/squid.te	2005-06-01 06:11:22.000000000 -0400
-+++ policy-1.24/domains/program/unused/squid.te	2005-07-03 09:51:23.000000000 -0400
++++ policy-1.24/domains/program/unused/squid.te	2005-07-06 10:21:19.000000000 -0400
 @@ -61,6 +61,7 @@
  
  # tcp port 8080 and udp port 3130 is http_cache_port_t (see net_contexts)
@@ -1601,6 +1601,13 @@
  
  # to allow running programs from /usr/lib/squid (IE unlinkd)
  # also allow exec()ing itself
+@@ -77,3 +78,6 @@
+ #squid requires the following when run in diskd mode, the recommended setting
+ allow squid_t tmpfs_t:file { read write };
+ r_dir_file(squid_t, cert_t)
++ifdef(`winbind.te', `
++domain_auto_trans(squid_t, winbind_helper_exec_t, winbind_helper_t)
++')
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ssh-agent.te policy-1.24/domains/program/unused/ssh-agent.te
 --- nsapolicy/domains/program/unused/ssh-agent.te	2005-04-27 10:28:53.000000000 -0400
 +++ policy-1.24/domains/program/unused/ssh-agent.te	2005-07-03 09:51:23.000000000 -0400
@@ -1712,7 +1719,7 @@
  allow watchdog_t etc_t:file r_file_perms;
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/winbind.te policy-1.24/domains/program/unused/winbind.te
 --- nsapolicy/domains/program/unused/winbind.te	2005-05-25 11:28:10.000000000 -0400
-+++ policy-1.24/domains/program/unused/winbind.te	2005-07-05 16:05:23.000000000 -0400
++++ policy-1.24/domains/program/unused/winbind.te	2005-07-06 10:21:09.000000000 -0400
 @@ -21,6 +21,9 @@
  type samba_log_t, file_type, sysadmfile, logfile;
  type samba_var_t, file_type, sysadmfile;
@@ -1723,6 +1730,17 @@
  ')
  rw_dir_file(winbind_t, samba_etc_t)
  rw_dir_create_file(winbind_t, samba_log_t)
+@@ -33,3 +36,10 @@
+ can_kerberos(winbind_t)
+ allow winbind_t self:netlink_route_socket r_netlink_socket_perms;
+ allow winbind_t winbind_var_run_t:sock_file create_file_perms;
++
++application_domain(winbind_helper, `, nscd_client_domain')
++access_terminal(winbind_helper_t, sysadm)
++read_locale(winbind_helper_t) 
++r_dir_file(winbind_helper_t, samba_etc_t)
++allow winbind_helper_t self:unix_dgram_socket create_socket_perms;
++allow winbind_helper_t winbind_var_run_t:dir r_dir_perms;
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/xdm.te policy-1.24/domains/program/unused/xdm.te
 --- nsapolicy/domains/program/unused/xdm.te	2005-05-25 11:28:10.000000000 -0400
 +++ policy-1.24/domains/program/unused/xdm.te	2005-07-03 09:51:23.000000000 -0400
@@ -2069,6 +2087,14 @@
 @@ -0,0 +1,2 @@
 +/usr/bin/thunderbird.*			--	system_u:object_r:thunderbird_exec_t
 +HOME_DIR/\.thunderbird(/.*)?			system_u:object_r:ROLE_thunderbird_home_t
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/winbind.fc policy-1.24/file_contexts/program/winbind.fc
+--- nsapolicy/file_contexts/program/winbind.fc	2005-02-24 14:51:09.000000000 -0500
++++ policy-1.24/file_contexts/program/winbind.fc	2005-07-06 10:21:51.000000000 -0400
+@@ -8,3 +8,4 @@
+ /var/cache/samba(/.*)?		system_u:object_r:samba_var_t
+ ')
+ /var/cache/samba/winbindd_privileged(/.*)?	system_u:object_r:winbind_var_run_t
++/usr/bin/ntlm_auth --	system_u:object_r:winbind_helper_exec_t
 diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/xauth.fc policy-1.24/file_contexts/program/xauth.fc
 --- nsapolicy/file_contexts/program/xauth.fc	2005-03-11 15:31:06.000000000 -0500
 +++ policy-1.24/file_contexts/program/xauth.fc	2005-07-03 09:51:23.000000000 -0400


Index: selinux-policy-strict.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/selinux-policy-strict.spec,v
retrieving revision 1.341
retrieving revision 1.342
diff -u -r1.341 -r1.342
--- selinux-policy-strict.spec	5 Jul 2005 20:12:06 -0000	1.341
+++ selinux-policy-strict.spec	6 Jul 2005 14:27:15 -0000	1.342
@@ -11,7 +11,7 @@
 Summary: SELinux %{type} policy configuration
 Name: selinux-policy-%{type}
 Version: 1.24
-Release: 4
+Release: 5
 License: GPL
 Group: System Environment/Base
 Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -229,6 +229,9 @@
 exit 0
 
 %changelog
+* Wed Jul 6 2005 Dan Walsh <dwalsh redhat com> 1.24-5
+- Add winbind_helper_t
+
 * Tue Jul 5 2005 Dan Walsh <dwalsh redhat com> 1.24-4
 - Allow dovecot to access cert_t
 - Add redhat tunable


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]