rpms/selinux-policy-strict/devel policy-20050916.patch, 1.16, 1.17 selinux-policy-strict.spec, 1.388, 1.389 selinux.csh, 1.6, 1.7 selinux.sh, 1.6, 1.7
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Tue Oct 4 16:31:20 UTC 2005
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy-strict/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv19736
Modified Files:
policy-20050916.patch selinux-policy-strict.spec selinux.csh
selinux.sh
Log Message:
* Tue Oct 4 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-13
- Fixes for pegasus, add newrole policy for targeted
- Fixes for postgres
policy-20050916.patch:
Makefile | 22 +++++----
attrib.te | 3 +
domains/program/crond.te | 2
domains/program/fsadm.te | 7 ++
domains/program/hostname.te | 2
domains/program/ifconfig.te | 5 +-
domains/program/initrc.te | 17 ++++++-
domains/program/ldconfig.te | 3 -
domains/program/load_policy.te | 7 +-
domains/program/login.te | 21 +++++---
domains/program/modutil.te | 14 +++--
domains/program/mount.te | 5 +-
domains/program/netutils.te | 3 -
domains/program/newrole.te | 4 +
domains/program/passwd.te | 1
domains/program/restorecon.te | 3 -
domains/program/setfiles.te | 4 -
domains/program/ssh.te | 6 ++
domains/program/su.te | 9 +++
domains/program/syslogd.te | 6 +-
domains/program/unused/NetworkManager.te | 3 -
domains/program/unused/alsa.te | 2
domains/program/unused/amanda.te | 74 +++++++------------------------
domains/program/unused/anaconda.te | 5 --
domains/program/unused/apache.te | 17 ++++---
domains/program/unused/apmd.te | 13 +++++
domains/program/unused/auditd.te | 2
domains/program/unused/automount.te | 4 +
domains/program/unused/bluetooth.te | 61 +++++++++++++++++++++++++
domains/program/unused/cups.te | 18 +++++--
domains/program/unused/cvs.te | 3 +
domains/program/unused/cyrus.te | 2
domains/program/unused/dbusd.te | 4 +
domains/program/unused/dhcpc.te | 5 +-
domains/program/unused/dhcpd.te | 3 -
domains/program/unused/dovecot.te | 4 +
domains/program/unused/hald.te | 2
domains/program/unused/hotplug.te | 5 +-
domains/program/unused/hwclock.te | 2
domains/program/unused/ipsec.te | 2
domains/program/unused/kudzu.te | 5 +-
domains/program/unused/mta.te | 8 +++
domains/program/unused/mysqld.te | 6 +-
domains/program/unused/named.te | 29 ++++++++++--
domains/program/unused/nscd.te | 1
domains/program/unused/ntpd.te | 10 ++--
domains/program/unused/openct.te | 16 ++++++
domains/program/unused/pamconsole.te | 2
domains/program/unused/pegasus.te | 37 +++++++++++++++
domains/program/unused/ping.te | 3 -
domains/program/unused/postfix.te | 30 +++++++-----
domains/program/unused/pppd.te | 8 ++-
domains/program/unused/procmail.te | 11 +++-
domains/program/unused/readahead.te | 21 ++++++++
domains/program/unused/rlogind.te | 4 +
domains/program/unused/roundup.te | 29 ++++++++++++
domains/program/unused/rpcd.te | 12 ++++-
domains/program/unused/samba.te | 11 +++-
domains/program/unused/snmpd.te | 5 +-
domains/program/unused/squid.te | 3 -
domains/program/unused/udev.te | 10 +++-
domains/program/unused/utempter.te | 2
domains/program/unused/webalizer.te | 3 +
domains/program/unused/winbind.te | 1
domains/program/unused/xdm.te | 3 +
domains/program/unused/yppasswdd.te | 40 ++++++++++++++++
domains/program/unused/ypserv.te | 1
domains/program/useradd.te | 5 +-
file_contexts/distros.fc | 2
file_contexts/program/bluetooth.fc | 3 +
file_contexts/program/dhcpc.fc | 2
file_contexts/program/dhcpd.fc | 1
file_contexts/program/ftpd.fc | 5 +-
file_contexts/program/games.fc | 11 +++-
file_contexts/program/ipsec.fc | 1
file_contexts/program/openct.fc | 2
file_contexts/program/pegasus.fc | 11 ++++
file_contexts/program/pppd.fc | 2
file_contexts/program/readahead.fc | 1
file_contexts/program/roundup.fc | 2
file_contexts/program/rpm.fc | 4 +
file_contexts/program/rsync.fc | 2
file_contexts/program/xdm.fc | 2
file_contexts/program/yppasswdd.fc | 2
file_contexts/program/ypserv.fc | 1
file_contexts/types.fc | 2
genfs_contexts | 2
macros/core_macros.te | 3 +
macros/global_macros.te | 18 +++++--
macros/network_macros.te | 17 ++++++-
macros/program/apache_macros.te | 13 ++++-
macros/program/cdrecord_macros.te | 2
macros/program/i18n_input_macros.te | 21 ++++++++
macros/program/mta_macros.te | 4 -
macros/program/newrole_macros.te | 2
macros/program/pyzor_macros.te | 2
macros/program/razor_macros.te | 2
macros/program/su_macros.te | 4 -
macros/program/uml_macros.te | 2
macros/user_macros.te | 1
man/man8/ftpd_selinux.8 | 19 ++++---
man/man8/httpd_selinux.8 | 9 +++
man/man8/rsync_selinux.8 | 12 +++--
man/man8/samba_selinux.8 | 9 +++
mcs | 16 ++++++
net_contexts | 6 ++
targeted/appconfig/root_default_contexts | 4 +
targeted/assert.te | 2
targeted/domains/program/ssh.te | 3 +
targeted/domains/program/xdm.te | 4 +
targeted/domains/unconfined.te | 16 +++++-
tunables/distro.tun | 2
tunables/tunable.tun | 4 -
types/devpts.te | 4 +
types/file.te | 15 ++++--
types/network.te | 12 ++---
types/security.te | 5 ++
117 files changed, 755 insertions(+), 227 deletions(-)
Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/policy-20050916.patch,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -r1.16 -r1.17
--- policy-20050916.patch 29 Sep 2005 20:05:20 -0000 1.16
+++ policy-20050916.patch 4 Oct 2005 16:30:55 -0000 1.17
@@ -1,3 +1,16 @@
+diff --exclude-from=exclude -N -u -r nsapolicy/attrib.te policy-1.27.1/attrib.te
+--- nsapolicy/attrib.te 2005-09-16 11:17:08.000000000 -0400
++++ policy-1.27.1/attrib.te 2005-10-04 12:21:54.000000000 -0400
+@@ -443,6 +443,9 @@
+ # Attribute to designate unrestricted access
+ attribute unrestricted;
+
++# Attribute to designate can transition to unconfined_t
++attribute unconfinedtrans;
++
+ # For clients of nscd.
+ attribute nscd_client_domain;
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/crond.te policy-1.27.1/domains/program/crond.te
--- nsapolicy/domains/program/crond.te 2005-09-16 11:17:08.000000000 -0400
+++ policy-1.27.1/domains/program/crond.te 2005-09-27 17:14:40.000000000 -0400
@@ -273,6 +286,17 @@
ifdef(`gnome-pty-helper.te', `allow netutils_t sysadm_gph_t:fd use;')
allow netutils_t proc_t:dir search;
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/newrole.te policy-1.27.1/domains/program/newrole.te
+--- nsapolicy/domains/program/newrole.te 2005-09-12 16:40:29.000000000 -0400
++++ policy-1.27.1/domains/program/newrole.te 2005-10-04 12:27:43.000000000 -0400
+@@ -18,3 +18,7 @@
+ allow newrole_t initrc_var_run_t:file rw_file_perms;
+
+ role secadm_r types newrole_t;
++
++ifdef(`targeted_policy', `
++typeattribute newrole_t unconfinedtrans;
++')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/passwd.te policy-1.27.1/domains/program/passwd.te
--- nsapolicy/domains/program/passwd.te 2005-09-16 11:17:08.000000000 -0400
+++ policy-1.27.1/domains/program/passwd.te 2005-09-27 17:14:40.000000000 -0400
@@ -1251,8 +1275,8 @@
+nsswitch_domain(pam_console_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/pegasus.te policy-1.27.1/domains/program/unused/pegasus.te
--- nsapolicy/domains/program/unused/pegasus.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/domains/program/unused/pegasus.te 2005-09-27 17:14:40.000000000 -0400
-@@ -0,0 +1,31 @@
++++ policy-1.27.1/domains/program/unused/pegasus.te 2005-10-04 12:12:44.000000000 -0400
+@@ -0,0 +1,37 @@
+#DESC pegasus - The Open Group Pegasus CIM/WBEM Server
+#
+# Author: Jason Vas Dias <jvdias at redhat.com>
@@ -1262,17 +1286,20 @@
+#
+# Rules for the pegasus domain
+#
-+daemon_domain(pegasus, `, nscd_client_domain')
++daemon_domain(pegasus, `, nscd_client_domain, auth')
+type pegasus_data_t, file_type, sysadmfile;
+type pegasus_conf_t, file_type, sysadmfile;
+type pegasus_mof_t, file_type, sysadmfile;
+type pegasus_conf_exec_t, file_type, exec_type, sysadmfile;
-+allow pegasus_t self:capability { dac_override net_bind_service };
++allow pegasus_t self:capability { dac_override net_bind_service audit_write };
+can_network_tcp(pegasus_t);
+nsswitch_domain(pegasus_t);
+allow pegasus_t pegasus_var_run_t:sock_file { create setattr };
+allow pegasus_t self:unix_dgram_socket create_socket_perms;
+allow pegasus_t self:unix_stream_socket create_stream_socket_perms;
++allow pegasus_t self:file { read getattr };
++allow pegasus_t self:fifo_file rw_file_perms;
++allow pegasus_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
+allow pegasus_t { pegasus_http_port_t pegasus_https_port_t }:tcp_socket { name_bind name_connect };
+allow pegasus_t proc_t:file { getattr read };
+allow pegasus_t sysctl_vm_t:dir search;
@@ -1284,6 +1311,9 @@
+rw_dir_create_file(pegasus_t, pegasus_conf_t)
+rw_dir_create_file(pegasus_t, pegasus_data_t)
+rw_dir_create_file(pegasus_conf_exec_t, pegasus_conf_t)
++allow pegasus_t shadow_t:file { getattr read };
++dontaudit pegasus_t selinux_config_t:dir search;
++
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ping.te policy-1.27.1/domains/program/unused/ping.te
--- nsapolicy/domains/program/unused/ping.te 2005-09-16 11:17:09.000000000 -0400
+++ policy-1.27.1/domains/program/unused/ping.te 2005-09-27 17:14:40.000000000 -0400
@@ -1305,7 +1335,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/postfix.te policy-1.27.1/domains/program/unused/postfix.te
--- nsapolicy/domains/program/unused/postfix.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/postfix.te 2005-09-27 17:14:40.000000000 -0400
++++ policy-1.27.1/domains/program/unused/postfix.te 2005-10-04 11:59:51.000000000 -0400
@@ -54,6 +54,8 @@
allow postfix_$1_t proc_net_t:dir search;
allow postfix_$1_t proc_net_t:file { getattr read };
@@ -1325,15 +1355,22 @@
read_sysctl(postfix_master_t)
domain_auto_trans(initrc_t, postfix_master_exec_t, postfix_master_t)
-@@ -98,6 +103,7 @@
+@@ -97,10 +102,12 @@
+ dontaudit postfix_master_t selinux_config_t:dir search;
can_exec({ sysadm_mail_t system_mail_t }, postfix_master_exec_t)
ifdef(`distro_redhat', `
++# compatability for old default main.cf
file_type_auto_trans({ sysadm_mail_t system_mail_t postfix_master_t }, postfix_etc_t, etc_aliases_t)
-+file_type_auto_trans({ sysadm_mail_t system_mail_t postfix_master_t }, etc_t, etc_aliases_t)
- ', `
- file_type_auto_trans({ sysadm_mail_t system_mail_t }, etc_t, etc_aliases_t)
- ')
-@@ -121,7 +127,7 @@
+-', `
+-file_type_auto_trans({ sysadm_mail_t system_mail_t }, etc_t, etc_aliases_t)
++# for newer main.cf that uses /etc/aliases
++file_type_auto_trans(postfix_master_t, etc_t, etc_aliases_t)
+ ')
++file_type_auto_trans({ sysadm_mail_t system_mail_t }, etc_t, etc_aliases_t)
+ allow postfix_master_t sendmail_exec_t:file r_file_perms;
+ allow postfix_master_t sbin_t:lnk_file { getattr read };
+ ifdef(`pppd.te', `
+@@ -121,7 +128,7 @@
can_network(postfix_master_t)
allow postfix_master_t port_type:tcp_socket name_connect;
can_ypbind(postfix_master_t)
@@ -1342,7 +1379,7 @@
allow postfix_master_t postfix_spool_maildrop_t:dir rw_dir_perms;
allow postfix_master_t postfix_spool_maildrop_t:file { unlink rename getattr };
allow postfix_master_t postfix_prng_t:file getattr;
-@@ -135,13 +141,11 @@
+@@ -135,14 +142,10 @@
')
create_dir_file(postfix_master_t, postfix_spool_flush_t)
@@ -1351,12 +1388,13 @@
# for ls to get the current context
allow postfix_master_t self:file { getattr read };
- # for SSP
+-# for SSP
-allow postfix_master_t urandom_device_t:chr_file read;
-
+-
# allow access to deferred queue and allow removing bogus incoming entries
allow postfix_master_t postfix_spool_t:dir create_dir_perms;
-@@ -163,7 +167,6 @@
+ allow postfix_master_t postfix_spool_t:file create_file_perms;
+@@ -163,7 +166,6 @@
allow postfix_smtp_t postfix_spool_t:file rw_file_perms;
allow postfix_smtp_t { postfix_private_t postfix_public_t }:dir search;
allow postfix_smtp_t { postfix_private_t postfix_public_t }:sock_file write;
@@ -1364,7 +1402,7 @@
allow postfix_smtp_t postfix_master_t:unix_stream_socket connectto;
# if you have two different mail servers on the same host let them talk via
# SMTP, also if one mail server wants to talk to itself then allow it and let
-@@ -172,7 +175,6 @@
+@@ -172,7 +174,6 @@
can_tcp_connect(postfix_smtp_t, mail_server_domain)
postfix_server_domain(smtpd)
@@ -1372,25 +1410,32 @@
allow postfix_smtpd_t postfix_master_t:tcp_socket rw_stream_socket_perms;
allow postfix_smtpd_t { postfix_private_t postfix_public_t }:dir search;
allow postfix_smtpd_t { postfix_private_t postfix_public_t }:sock_file rw_file_perms;
-@@ -184,7 +186,7 @@
+@@ -184,7 +185,6 @@
# for prng_exch
allow postfix_smtpd_t postfix_spool_t:file rw_file_perms;
-
-+dontaudit postfix_smtpd_t { home_root_t boot_t }:dir getattr;
allow { postfix_smtp_t postfix_smtpd_t } postfix_prng_t:file rw_file_perms;
postfix_server_domain(local, `, mta_delivery_agent')
-@@ -196,7 +198,7 @@
+@@ -196,7 +196,7 @@
')
allow postfix_local_t etc_aliases_t:file r_file_perms;
allow postfix_local_t self:fifo_file rw_file_perms;
-allow postfix_local_t self:process setrlimit;
-+allow postfix_local_t postfix_local_t:process { setsched setrlimit };
++allow postfix_local_t self:process { setsched setrlimit };
allow postfix_local_t postfix_spool_t:file rw_file_perms;
# for .forward - maybe we need a new type for it?
allow postfix_local_t postfix_private_t:dir search;
-@@ -260,7 +262,7 @@
+@@ -241,6 +241,7 @@
+ allow postfix_postqueue_t postfix_public_t:dir search;
+ allow postfix_postqueue_t postfix_public_t:fifo_file getattr;
+ allow postfix_postqueue_t self:udp_socket { create ioctl };
++allow postfix_postqueue_t self:tcp_socket create;
+ allow postfix_master_t postfix_postqueue_exec_t:file getattr;
+ domain_auto_trans(postfix_master_t, postfix_postqueue_exec_t, postfix_postqueue_t)
+ allow postfix_postqueue_t initrc_t:process sigchld;
+@@ -260,7 +261,7 @@
postfix_user_domain(showq)
# the following auto_trans is usually in postfix server domain
domain_auto_trans(postfix_master_t, postfix_showq_exec_t, postfix_showq_t)
@@ -1399,6 +1444,14 @@
r_dir_file(postfix_showq_t, postfix_spool_maildrop_t)
domain_auto_trans(postfix_postqueue_t, postfix_showq_exec_t, postfix_showq_t)
allow postfix_showq_t self:capability { setuid setgid };
+@@ -284,6 +285,7 @@
+ allow postfix_postdrop_t { crond_t system_crond_t }:fifo_file rw_file_perms;')
+ # usually it does not need a UDP socket
+ allow postfix_postdrop_t self:udp_socket create_socket_perms;
++allow postfix_postdrop_t self:tcp_socket create;
+ allow postfix_postdrop_t self:capability sys_resource;
+
+ postfix_public_domain(pickup)
@@ -329,7 +331,8 @@
domain_auto_trans(postfix_pipe_t, procmail_exec_t, procmail_t)
')
@@ -1409,15 +1462,11 @@
')
# Program for creating database files
-@@ -348,5 +351,8 @@
- dontaudit postfix_map_t var_t:dir search;
- can_network_server(postfix_map_t)
+@@ -350,3 +353,4 @@
allow postfix_map_t port_type:tcp_socket name_connect;
-+r_dir_file(postfix_local_t, etc_mail_t)
allow postfix_local_t mail_spool_t:dir { remove_name };
allow postfix_local_t mail_spool_t:file { unlink };
+can_exec(postfix_local_t, bin_t)
-+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/pppd.te policy-1.27.1/domains/program/unused/pppd.te
--- nsapolicy/domains/program/unused/pppd.te 2005-09-16 11:17:09.000000000 -0400
+++ policy-1.27.1/domains/program/unused/pppd.te 2005-09-29 14:04:48.000000000 -0400
@@ -1817,8 +1866,16 @@
read_sysctl(useradd_t)
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/distros.fc policy-1.27.1/file_contexts/distros.fc
--- nsapolicy/file_contexts/distros.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/distros.fc 2005-09-27 17:14:40.000000000 -0400
-@@ -99,6 +99,7 @@
++++ policy-1.27.1/file_contexts/distros.fc 2005-10-03 14:43:17.000000000 -0400
+@@ -89,6 +89,7 @@
+ /usr/lib/valgrind/hp2ps -- system_u:object_r:texrel_shlib_t
+ /usr/lib/valgrind/stage2 -- system_u:object_r:texrel_shlib_t
+ /usr/lib/valgrind/vg.*\.so -- system_u:object_r:texrel_shlib_t
++/usr/lib/.*/libxpcom_core.so -- system_u:object_r:texrel_shlib_t
+ /usr/lib/.*/program(/.*)? system_u:object_r:bin_t
+ /usr/lib/.*/program/.*\.so.* system_u:object_r:shlib_t
+ /usr/lib/.*/program/libicudata\.so.* -- system_u:object_r:texrel_shlib_t
+@@ -99,6 +100,7 @@
/usr/lib(64)?/.*/program/librecentfile\.so -- system_u:object_r:texrel_shlib_t
/usr/lib(64)?/.*/program/libsvx680li\.so -- system_u:object_r:texrel_shlib_t
/usr/lib(64)?/.*/program/libcomphelp4gcc3\.so -- system_u:object_r:texrel_shlib_t
@@ -2051,7 +2108,7 @@
')
diff --exclude-from=exclude -N -u -r nsapolicy/macros/global_macros.te policy-1.27.1/macros/global_macros.te
--- nsapolicy/macros/global_macros.te 2005-09-16 11:17:11.000000000 -0400
-+++ policy-1.27.1/macros/global_macros.te 2005-09-29 08:46:50.000000000 -0400
++++ policy-1.27.1/macros/global_macros.te 2005-09-30 10:26:28.000000000 -0400
@@ -157,6 +157,11 @@
r_dir_file($1, locale_t)
')
@@ -2105,6 +2162,15 @@
# Mount/unmount any filesystem.
allow $1 fs_type:filesystem *;
+@@ -653,7 +661,7 @@
+ allow $1 port_type:tcp_socket name_connect;
+
+ # Bind to any network address.
+-allow $1 port_type:{ tcp_socket udp_socket } name_bind;
++allow $1 port_type:{ rawip_socket tcp_socket udp_socket } name_bind;
+ allow $1 node_type:{ tcp_socket udp_socket rawip_socket } node_bind;
+ allow $1 file_type:{ unix_stream_socket unix_dgram_socket } name_bind;
+
diff --exclude-from=exclude -N -u -r nsapolicy/macros/network_macros.te policy-1.27.1/macros/network_macros.te
--- nsapolicy/macros/network_macros.te 2005-09-16 11:17:11.000000000 -0400
+++ policy-1.27.1/macros/network_macros.te 2005-09-27 17:14:40.000000000 -0400
@@ -2563,6 +2629,18 @@
+system_r:remote_login_t system_r:unconfined_t
+system_r:rshd_t system_r:unconfined_t
+system_r:crond_t system_r:unconfined_t
+diff --exclude-from=exclude -N -u -r nsapolicy/targeted/assert.te policy-1.27.1/targeted/assert.te
+--- nsapolicy/targeted/assert.te 2005-09-16 11:17:12.000000000 -0400
++++ policy-1.27.1/targeted/assert.te 2005-10-04 12:22:32.000000000 -0400
+@@ -22,7 +22,7 @@
+
+ # Confined domains must never touch an unconfined domain except to
+ # send SIGCHLD for child termination notifications.
+-neverallow { domain -unrestricted } unconfined_t:process ~sigchld;
++neverallow { domain -unrestricted -unconfinedtrans } unconfined_t:process ~sigchld;
+
+ # Confined domains must never see /proc/pid entries for an unconfined domain.
+ neverallow { domain -unrestricted -snmpd_t } unconfined_t:dir { getattr search };
diff --exclude-from=exclude -N -u -r nsapolicy/targeted/domains/program/ssh.te policy-1.27.1/targeted/domains/program/ssh.te
--- nsapolicy/targeted/domains/program/ssh.te 2005-09-12 16:40:26.000000000 -0400
+++ policy-1.27.1/targeted/domains/program/ssh.te 2005-09-27 17:14:40.000000000 -0400
@@ -2586,7 +2664,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/targeted/domains/unconfined.te policy-1.27.1/targeted/domains/unconfined.te
--- nsapolicy/targeted/domains/unconfined.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/targeted/domains/unconfined.te 2005-09-27 17:14:40.000000000 -0400
++++ policy-1.27.1/targeted/domains/unconfined.te 2005-10-04 12:22:11.000000000 -0400
@@ -7,15 +7,14 @@
type unconfined_t, domain, privuser, privhome, privrole, privowner, admin, auth_write, fs_domain, privmem;
role system_r types unconfined_t;
@@ -2612,7 +2690,7 @@
# Allow system to run with NIS
bool allow_ypbind false;
-@@ -77,3 +77,17 @@
+@@ -77,3 +77,15 @@
allow domain self:process execmem;
}
@@ -2621,12 +2699,10 @@
+typealias unconfined_t alias i18n_input_t;
+typealias var_run_t alias i18n_input_var_run_t;
+ifdef(`su.te', `
-+# Needed to get su working
-+bool secure_mode false;
+typealias unconfined_t alias { sysadm_chkpwd_t };
+typealias tmp_t alias { sysadm_tmp_t sshd_tmp_t };
+su_domain(sysadm)
-+typeattribute sysadm_su_t unrestricted;
++typeattribute sysadm_su_t unconfinedtrans;
+role system_r types sysadm_su_t;
+')
+
Index: selinux-policy-strict.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/selinux-policy-strict.spec,v
retrieving revision 1.388
retrieving revision 1.389
diff -u -r1.388 -r1.389
--- selinux-policy-strict.spec 29 Sep 2005 19:42:09 -0000 1.388
+++ selinux-policy-strict.spec 4 Oct 2005 16:30:59 -0000 1.389
@@ -11,7 +11,7 @@
Summary: SELinux %{type} policy configuration
Name: selinux-policy-%{type}
Version: 1.27.1
-Release: 11
+Release: 13
License: GPL
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -242,6 +242,10 @@
exit 0
%changelog
+* Tue Oct 4 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-13
+- Fixes for pegasus, add newrole policy for targeted
+- Fixes for postgres
+
* Thu Sep 29 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-11
- Allow reading of public_content_rw_t without setting boolean
- Fix man pages
Index: selinux.csh
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/selinux.csh,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -r1.6 -r1.7
--- selinux.csh 29 Jun 2005 20:39:01 -0000 1.6
+++ selinux.csh 4 Oct 2005 16:31:00 -0000 1.7
@@ -10,7 +10,7 @@
foreach DIR ( $DIRS )
[ -d $DIR ] || mkdir -p $DIR
end
-set RESTORED=`/sbin/restorecon -v $DIRS |& cat`
+set RESTORED=`/sbin/restorecon -o /dev/stdout $DIRS >& /dev/null`
if ( $status == 0 && "$RESTORED" != "" ) then
set RESULT=`echo "$RESTORED" | awk '{ print $3 }'`
echo "Restoring SELinux context for:"
Index: selinux.sh
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/selinux.sh,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -r1.6 -r1.7
--- selinux.sh 29 Jun 2005 20:39:01 -0000 1.6
+++ selinux.sh 4 Oct 2005 16:31:00 -0000 1.7
@@ -25,7 +25,7 @@
[ -d $DIR ] || mkdir -m 700 -p $DIR
done
-RESTORED=`/sbin/restorecon -v $DIRS 2>&1`
+RESTORED=`/sbin/restorecon -o /dev/stdout $DIRS 2>&1`
if [ $? -a ! -z "$RESTORED" ]; then
RESULT=`echo "$RESTORED" | awk '{ print $3 }'`
echo "Restoring SELinux context for:"
More information about the fedora-cvs-commits
mailing list