[Date Prev][Date Next] [Thread Prev][Thread Next]
[Thread Index]
[Date Index]
[Author Index]
rpms/selinux-policy-targeted/devel policy-20050916.patch, 1.16, 1.17 selinux-policy-targeted.spec, 1.385, 1.386
- From: fedora-cvs-commits redhat com
- To: fedora-cvs-commits redhat com
- Subject: rpms/selinux-policy-targeted/devel policy-20050916.patch, 1.16, 1.17 selinux-policy-targeted.spec, 1.385, 1.386
- Date: Tue, 11 Oct 2005 16:02:32 -0400
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy-targeted/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv1747
Modified Files:
policy-20050916.patch selinux-policy-targeted.spec
Log Message:
* Tue Oct 11 2005 Dan Walsh <dwalsh redhat com> 1.27.1-15
- Allow ftpd to upload to homedirs
policy-20050916.patch:
Makefile | 26 ++--
attrib.te | 3
domains/misc/kernel.te | 2
domains/program/crond.te | 2
domains/program/fsadm.te | 7 -
domains/program/hostname.te | 2
domains/program/ifconfig.te | 5
domains/program/initrc.te | 17 +++
domains/program/ldconfig.te | 3
domains/program/load_policy.te | 7 -
domains/program/login.te | 21 ++-
domains/program/modutil.te | 14 +-
domains/program/mount.te | 5
domains/program/netutils.te | 3
domains/program/newrole.te | 4
domains/program/passwd.te | 1
domains/program/restorecon.te | 3
domains/program/setfiles.te | 4
domains/program/ssh.te | 6 -
domains/program/su.te | 9 +
domains/program/syslogd.te | 6 -
domains/program/unused/NetworkManager.te | 3
domains/program/unused/alsa.te | 2
domains/program/unused/amanda.te | 74 +++-----------
domains/program/unused/anaconda.te | 5
domains/program/unused/apache.te | 17 +--
domains/program/unused/apmd.te | 13 ++
domains/program/unused/auditd.te | 2
domains/program/unused/automount.te | 4
domains/program/unused/bluetooth.te | 63 +++++++++++
domains/program/unused/cups.te | 18 ++-
domains/program/unused/cvs.te | 3
domains/program/unused/cyrus.te | 2
domains/program/unused/dbusd.te | 4
domains/program/unused/dhcpc.te | 5
domains/program/unused/dhcpd.te | 3
domains/program/unused/dovecot.te | 4
domains/program/unused/ftpd.te | 6 -
domains/program/unused/hald.te | 5
domains/program/unused/hotplug.te | 5
domains/program/unused/hwclock.te | 2
domains/program/unused/ipsec.te | 2
domains/program/unused/kudzu.te | 5
domains/program/unused/mta.te | 8 +
domains/program/unused/mysqld.te | 6 -
domains/program/unused/named.te | 29 ++++-
domains/program/unused/nscd.te | 1
domains/program/unused/ntpd.te | 10 -
domains/program/unused/openct.te | 16 +++
domains/program/unused/pamconsole.te | 2
domains/program/unused/pegasus.te | 37 +++++++
domains/program/unused/ping.te | 3
domains/program/unused/postfix.te | 30 +++--
domains/program/unused/pppd.te | 8 -
domains/program/unused/procmail.te | 11 +-
domains/program/unused/readahead.te | 21 +++
domains/program/unused/rlogind.te | 4
domains/program/unused/roundup.te | 29 +++++
domains/program/unused/rpcd.te | 13 ++
domains/program/unused/rsync.te | 3
domains/program/unused/samba.te | 12 +-
domains/program/unused/snmpd.te | 6 -
domains/program/unused/squid.te | 3
domains/program/unused/udev.te | 10 +
domains/program/unused/utempter.te | 2
domains/program/unused/webalizer.te | 3
domains/program/unused/winbind.te | 1
domains/program/unused/xdm.te | 3
domains/program/unused/yppasswdd.te | 40 +++++++
domains/program/unused/ypserv.te | 1
domains/program/useradd.te | 5
file_contexts/distros.fc | 2
file_contexts/program/bluetooth.fc | 3
file_contexts/program/dhcpc.fc | 2
file_contexts/program/dhcpd.fc | 1
file_contexts/program/ftpd.fc | 5
file_contexts/program/games.fc | 11 +-
file_contexts/program/ipsec.fc | 1
file_contexts/program/openct.fc | 2
file_contexts/program/pegasus.fc | 11 ++
file_contexts/program/pppd.fc | 2
file_contexts/program/readahead.fc | 1
file_contexts/program/roundup.fc | 2
file_contexts/program/rpm.fc | 4
file_contexts/program/rsync.fc | 2
file_contexts/program/xdm.fc | 2
file_contexts/program/yppasswdd.fc | 2
file_contexts/program/ypserv.fc | 1
file_contexts/types.fc | 2
genfs_contexts | 2
macros/base_user_macros.te | 6 +
macros/core_macros.te | 3
macros/global_macros.te | 18 ++-
macros/network_macros.te | 17 +++
macros/program/apache_macros.te | 13 ++
macros/program/cdrecord_macros.te | 2
macros/program/i18n_input_macros.te | 21 +++
macros/program/mta_macros.te | 4
macros/program/newrole_macros.te | 2
macros/program/pyzor_macros.te | 2
macros/program/razor_macros.te | 2
macros/program/su_macros.te | 4
macros/program/uml_macros.te | 2
macros/user_macros.te | 1
man/man8/ftpd_selinux.8 | 19 +--
man/man8/httpd_selinux.8 | 9 +
man/man8/rsync_selinux.8 | 12 +-
man/man8/samba_selinux.8 | 9 +
mcs | 146 +++++++++++++++++++++++++++
mls | 163 ++++++++++++++++++++++++++++---
net_contexts | 6 +
targeted/appconfig/root_default_contexts | 4
targeted/assert.te | 2
targeted/domains/program/ssh.te | 3
targeted/domains/program/xdm.te | 4
targeted/domains/unconfined.te | 16 ++-
tunables/distro.tun | 2
tunables/tunable.tun | 4
types/devpts.te | 4
types/file.te | 15 ++
types/network.te | 12 +-
types/security.te | 5
122 files changed, 1054 insertions(+), 250 deletions(-)
Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/devel/policy-20050916.patch,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -r1.16 -r1.17
--- policy-20050916.patch 7 Oct 2005 20:26:02 -0000 1.16
+++ policy-20050916.patch 11 Oct 2005 20:01:53 -0000 1.17
@@ -731,8 +731,8 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/bluetooth.te policy-1.27.1/domains/program/unused/bluetooth.te
--- nsapolicy/domains/program/unused/bluetooth.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/bluetooth.te 2005-09-27 17:14:40.000000000 -0400
-@@ -11,11 +11,17 @@
++++ policy-1.27.1/domains/program/unused/bluetooth.te 2005-10-11 14:00:24.000000000 -0400
+@@ -11,16 +11,23 @@
daemon_domain(bluetooth)
file_type_auto_trans(bluetooth_t, var_run_t, bluetooth_var_run_t, sock_file)
@@ -742,6 +742,7 @@
+var_lib_domain(bluetooth)
# Use capabilities.
++allow bluetooth_t self:file read;
allow bluetooth_t self:capability { net_admin net_raw sys_tty_config };
+allow bluetooth_t self:process getsched;
+allow bluetooth_t proc_t:file { getattr read };
@@ -750,7 +751,13 @@
lock_domain(bluetooth)
-@@ -35,6 +41,7 @@
+ # Use the network.
+-can_network_server(bluetooth_t)
++can_network(bluetooth_t)
+ can_ypbind(bluetooth_t)
+ ifdef(`dbusd.te', `
+ dbusd_client(system, bluetooth)
+@@ -35,6 +42,7 @@
# bluetooth_conf_t is the type of the /etc/bluetooth dir.
type bluetooth_conf_t, file_type, sysadmfile;
@@ -758,7 +765,7 @@
# Read /etc/bluetooth
allow bluetooth_t bluetooth_conf_t:dir search;
-@@ -44,5 +51,57 @@
+@@ -44,5 +52,56 @@
allow bluetooth_t usbfs_t:dir r_dir_perms;
allow bluetooth_t usbfs_t:file rw_file_perms;
allow bluetooth_t bin_t:dir search;
@@ -813,10 +820,9 @@
+allow unpriv_userdomain bluetooth_t:dbus send_msg;
+')
+allow bluetooth_helper_t bluetooth_t:socket { read write };
-+
+
+dontaudit bluetooth_helper_t default_t:dir { read search };
+dontaudit bluetooth_helper_t { devtty_t ttyfile }:chr_file { read write };
-
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/cups.te policy-1.27.1/domains/program/unused/cups.te
--- nsapolicy/domains/program/unused/cups.te 2005-09-16 11:17:08.000000000 -0400
+++ policy-1.27.1/domains/program/unused/cups.te 2005-10-05 10:04:29.000000000 -0400
@@ -993,10 +999,37 @@
create_dir_file(dovecot_t, dovecot_spool_t)
create_dir_file(mta_delivery_agent, dovecot_spool_t)
allow dovecot_t mail_spool_t:lnk_file read;
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ftpd.te policy-1.27.1/domains/program/unused/ftpd.te
+--- nsapolicy/domains/program/unused/ftpd.te 2005-09-16 11:17:09.000000000 -0400
++++ policy-1.27.1/domains/program/unused/ftpd.te 2005-10-11 10:48:45.000000000 -0400
+@@ -99,9 +99,11 @@
+
+ if (ftp_home_dir) {
+ # allow access to /home
+-allow ftpd_t home_root_t:dir { getattr search };
+-allow ftpd_t home_dir_type:dir r_dir_perms;
++allow ftpd_t home_root_t:dir r_dir_perms;
+ create_dir_file(ftpd_t, home_type)
++ifdef(`targeted_policy', `
++file_type_auto_trans(ftpd_t, user_home_dir_t, user_home_t)
++')
+ }
+ if (use_nfs_home_dirs && ftp_home_dir) {
+ r_dir_file(ftpd_t, nfs_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/hald.te policy-1.27.1/domains/program/unused/hald.te
--- nsapolicy/domains/program/unused/hald.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/hald.te 2005-09-27 17:14:40.000000000 -0400
-@@ -100,4 +100,4 @@
++++ policy-1.27.1/domains/program/unused/hald.te 2005-10-11 14:51:10.000000000 -0400
+@@ -24,7 +24,8 @@
+ allow hald_t self:dbus send_msg;
+ ')
+
+-allow hald_t { self proc_t }:file { getattr read };
++allow hald_t self:file { getattr read };
++allow hald_t proc_t:file rw_file_perms;
+
+ allow hald_t { bin_t sbin_t }:dir search;
+ allow hald_t self:fifo_file rw_file_perms;
+@@ -100,4 +101,4 @@
ifdef(`mount.te', `
domain_auto_trans(hald_t, mount_exec_t, mount_t)
')
@@ -1621,7 +1654,7 @@
+allow roundup_t etc_t:file { getattr read };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/rpcd.te policy-1.27.1/domains/program/unused/rpcd.te
--- nsapolicy/domains/program/unused/rpcd.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/rpcd.te 2005-09-27 17:14:40.000000000 -0400
++++ policy-1.27.1/domains/program/unused/rpcd.te 2005-10-11 12:55:16.000000000 -0400
@@ -19,7 +19,7 @@
can_network($1_t)
allow $1_t port_type:tcp_socket name_connect;
@@ -1631,8 +1664,12 @@
read_locale($1_t)
allow $1_t self:capability net_bind_service;
dontaudit $1_t self:capability net_admin;
-@@ -151,3 +151,13 @@
- allow gssd_t self:capability setuid;
+@@ -148,6 +148,15 @@
+ allow gssd_t rpc_pipefs_t:dir r_dir_perms;
+ allow gssd_t rpc_pipefs_t:sock_file { read write };
+ allow gssd_t rpc_pipefs_t:file r_file_perms;
+-allow gssd_t self:capability setuid;
++allow gssd_t self:capability { dac_override dac_read_search setuid };
allow nfsd_t devtty_t:chr_file rw_file_perms;
allow rpcd_t devtty_t:chr_file rw_file_perms;
+
@@ -1644,7 +1681,16 @@
+r_dir_file(gssd_t, user_tmpfile)
+')
+}
-+
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/rsync.te policy-1.27.1/domains/program/unused/rsync.te
+--- nsapolicy/domains/program/unused/rsync.te 2005-09-16 11:17:09.000000000 -0400
++++ policy-1.27.1/domains/program/unused/rsync.te 2005-10-11 12:50:03.000000000 -0400
+@@ -15,5 +15,4 @@
+ type rsync_data_t, file_type, sysadmfile;
+ r_dir_file(rsync_t, rsync_data_t)
+ anonymous_domain(rsync)
+-
+-
++allow rsync_t self:capability sys_chroot;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/samba.te policy-1.27.1/domains/program/unused/samba.te
--- nsapolicy/domains/program/unused/samba.te 2005-09-16 11:17:10.000000000 -0400
+++ policy-1.27.1/domains/program/unused/samba.te 2005-10-05 13:09:46.000000000 -0400
@@ -1905,7 +1951,7 @@
/usr/lib/ladspa/analogue_osc_1416\.so -- system_u:object_r:texrel_shlib_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/bluetooth.fc policy-1.27.1/file_contexts/program/bluetooth.fc
--- nsapolicy/file_contexts/program/bluetooth.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/bluetooth.fc 2005-09-27 17:14:40.000000000 -0400
++++ policy-1.27.1/file_contexts/program/bluetooth.fc 2005-10-11 13:07:16.000000000 -0400
@@ -1,8 +1,11 @@
# bluetooth
/etc/bluetooth(/.*)? system_u:object_r:bluetooth_conf_t
@@ -1916,7 +1962,7 @@
/usr/sbin/hciattach -- system_u:object_r:bluetooth_exec_t
/var/run/sdp -s system_u:object_r:bluetooth_var_run_t
/usr/sbin/hid2hci -- system_u:object_r:bluetooth_exec_t
-+/usr/bin/bluepin -- system_u:object_r:bluetooth_helper_exec_t
++/usr/bin/blue.*pin -- system_u:object_r:bluetooth_helper_exec_t
+/var/lib/bluetooth(/.*)? system_u:object_r:bluetooth_var_lib_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/dhcpc.fc policy-1.27.1/file_contexts/program/dhcpc.fc
--- nsapolicy/file_contexts/program/dhcpc.fc 2005-09-12 16:40:27.000000000 -0400
@@ -2113,6 +2159,22 @@
# needs more work
genfscon eventpollfs / system_u:object_r:eventpollfs_t
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/base_user_macros.te policy-1.27.1/macros/base_user_macros.te
+--- nsapolicy/macros/base_user_macros.te 2005-09-16 11:17:11.000000000 -0400
++++ policy-1.27.1/macros/base_user_macros.te 2005-10-11 10:36:32.000000000 -0400
+@@ -40,6 +40,12 @@
+ allow $1_t $1_home_t:{ notdevfile_class_set dir } { relabelfrom relabelto };
+ can_setfscreate($1_t)
+
++ifdef(`ftpd.te' , `
++if (ftpd_is_daemon) {
++file_type_auto_trans(ftpd_t, $1_home_dir_t, $1_home_t)
++}
++')
++
+ allow $1_t self:capability { setgid chown fowner };
+ dontaudit $1_t self:capability { sys_nice fsetid };
+
diff --exclude-from=exclude -N -u -r nsapolicy/macros/core_macros.te policy-1.27.1/macros/core_macros.te
--- nsapolicy/macros/core_macros.te 2005-09-12 16:40:27.000000000 -0400
+++ policy-1.27.1/macros/core_macros.te 2005-09-27 17:14:40.000000000 -0400
Index: selinux-policy-targeted.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/devel/selinux-policy-targeted.spec,v
retrieving revision 1.385
retrieving revision 1.386
diff -u -r1.385 -r1.386
--- selinux-policy-targeted.spec 7 Oct 2005 20:26:02 -0000 1.385
+++ selinux-policy-targeted.spec 11 Oct 2005 20:01:54 -0000 1.386
@@ -10,7 +10,7 @@
Summary: SELinux %{type} policy configuration
Name: selinux-policy-%{type}
Version: 1.27.1
-Release: 14
+Release: 15
License: GPL
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -248,6 +248,9 @@
exit 0
%changelog
+* Tue Oct 11 2005 Dan Walsh <dwalsh redhat com> 1.27.1-15
+- Allow ftpd to upload to homedirs
+
* Fri Oct 7 2005 Dan Walsh <dwalsh redhat com> 1.27.1-14
- Increase sensitivities to 16
- Increase Capabilities to 256
[Date Prev][Date Next] [Thread Prev][Thread Next]
[Thread Index]
[Date Index]
[Author Index]