rpms/selinux-policy-targeted/devel policy-20050916.patch, 1.19, 1.20 selinux-policy-targeted.spec, 1.387, 1.388

fedora-cvs-commits at redhat.com fedora-cvs-commits at redhat.com
Thu Oct 13 21:42:52 UTC 2005


Author: dwalsh

Update of /cvs/dist/rpms/selinux-policy-targeted/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv7461

Modified Files:
	policy-20050916.patch selinux-policy-targeted.spec 
Log Message:
* Thu Oct 13 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-17
- Fix protections on seusers
- Add disable_postfix_trans boolean


policy-20050916.patch:
 Makefile                                 |   26 ++--
 attrib.te                                |   35 ++++++
 domains/misc/kernel.te                   |    2 
 domains/program/crond.te                 |    2 
 domains/program/fsadm.te                 |    7 -
 domains/program/hostname.te              |    2 
 domains/program/ifconfig.te              |    5 
 domains/program/initrc.te                |   17 +++
 domains/program/ldconfig.te              |    3 
 domains/program/load_policy.te           |    7 -
 domains/program/login.te                 |   21 ++-
 domains/program/modutil.te               |   14 +-
 domains/program/mount.te                 |    6 -
 domains/program/netutils.te              |    3 
 domains/program/newrole.te               |    4 
 domains/program/passwd.te                |    1 
 domains/program/restorecon.te            |    3 
 domains/program/setfiles.te              |    4 
 domains/program/ssh.te                   |    6 -
 domains/program/su.te                    |    9 +
 domains/program/syslogd.te               |    6 -
 domains/program/unused/NetworkManager.te |    3 
 domains/program/unused/alsa.te           |    2 
 domains/program/unused/amanda.te         |   74 +++-----------
 domains/program/unused/anaconda.te       |    5 
 domains/program/unused/apache.te         |   17 +--
 domains/program/unused/apmd.te           |   13 ++
 domains/program/unused/auditd.te         |    2 
 domains/program/unused/automount.te      |    4 
 domains/program/unused/bluetooth.te      |   72 +++++++++++++
 domains/program/unused/cups.te           |   18 ++-
 domains/program/unused/cvs.te            |    3 
 domains/program/unused/cyrus.te          |    2 
 domains/program/unused/dbusd.te          |    4 
 domains/program/unused/dcc.te            |    5 
 domains/program/unused/dhcpc.te          |    5 
 domains/program/unused/dhcpd.te          |    3 
 domains/program/unused/dovecot.te        |    4 
 domains/program/unused/ftpd.te           |    6 -
 domains/program/unused/hald.te           |    5 
 domains/program/unused/hotplug.te        |    5 
 domains/program/unused/hwclock.te        |    2 
 domains/program/unused/ipsec.te          |    2 
 domains/program/unused/kudzu.te          |    5 
 domains/program/unused/mta.te            |    8 +
 domains/program/unused/mysqld.te         |    6 -
 domains/program/unused/named.te          |   29 ++++-
 domains/program/unused/nscd.te           |    1 
 domains/program/unused/ntpd.te           |   10 -
 domains/program/unused/openct.te         |   16 +++
 domains/program/unused/pamconsole.te     |    2 
 domains/program/unused/pegasus.te        |   37 +++++++
 domains/program/unused/ping.te           |    3 
 domains/program/unused/postfix.te        |   48 +++++----
 domains/program/unused/pppd.te           |    8 -
 domains/program/unused/procmail.te       |   11 +-
 domains/program/unused/readahead.te      |   21 +++
 domains/program/unused/rlogind.te        |    4 
 domains/program/unused/roundup.te        |   29 +++++
 domains/program/unused/rpcd.te           |   13 ++
 domains/program/unused/rsync.te          |    3 
 domains/program/unused/samba.te          |   12 +-
 domains/program/unused/snmpd.te          |    6 -
 domains/program/unused/squid.te          |    3 
 domains/program/unused/udev.te           |   10 +
 domains/program/unused/utempter.te       |    2 
 domains/program/unused/webalizer.te      |    3 
 domains/program/unused/winbind.te        |    1 
 domains/program/unused/xdm.te            |    3 
 domains/program/unused/yppasswdd.te      |   40 +++++++
 domains/program/unused/ypserv.te         |    1 
 domains/program/useradd.te               |    5 
 file_contexts/distros.fc                 |    2 
 file_contexts/program/bluetooth.fc       |    3 
 file_contexts/program/dhcpc.fc           |    2 
 file_contexts/program/dhcpd.fc           |    1 
 file_contexts/program/ftpd.fc            |    5 
 file_contexts/program/games.fc           |   11 +-
 file_contexts/program/ipsec.fc           |    1 
 file_contexts/program/openct.fc          |    2 
 file_contexts/program/pegasus.fc         |   11 ++
 file_contexts/program/pppd.fc            |    2 
 file_contexts/program/readahead.fc       |    1 
 file_contexts/program/roundup.fc         |    2 
 file_contexts/program/rpm.fc             |    4 
 file_contexts/program/rshd.fc            |    1 
 file_contexts/program/rsync.fc           |    2 
 file_contexts/program/xdm.fc             |    2 
 file_contexts/program/yppasswdd.fc       |    2 
 file_contexts/program/ypserv.fc          |    1 
 file_contexts/types.fc                   |    2 
 genfs_contexts                           |    2 
 macros/base_user_macros.te               |    6 +
 macros/core_macros.te                    |    3 
 macros/global_macros.te                  |   18 ++-
 macros/network_macros.te                 |   17 +++
 macros/program/apache_macros.te          |   13 ++
 macros/program/cdrecord_macros.te        |    2 
 macros/program/i18n_input_macros.te      |   21 +++
 macros/program/mta_macros.te             |    4 
 macros/program/newrole_macros.te         |    2 
 macros/program/pyzor_macros.te           |    2 
 macros/program/razor_macros.te           |    2 
 macros/program/su_macros.te              |    4 
 macros/program/uml_macros.te             |    2 
 macros/user_macros.te                    |    2 
 man/man8/ftpd_selinux.8                  |   19 +--
 man/man8/httpd_selinux.8                 |    9 +
 man/man8/rsync_selinux.8                 |   12 +-
 man/man8/samba_selinux.8                 |    9 +
 mcs                                      |  146 +++++++++++++++++++++++++++
 mls                                      |  163 ++++++++++++++++++++++++++++---
 net_contexts                             |    6 +
 targeted/appconfig/root_default_contexts |    4 
 targeted/assert.te                       |    2 
 targeted/domains/program/ssh.te          |    3 
 targeted/domains/program/xdm.te          |    4 
 targeted/domains/unconfined.te           |   16 ++-
 tunables/distro.tun                      |    2 
 tunables/tunable.tun                     |    4 
 types/devpts.te                          |    4 
 types/file.te                            |   15 ++
 types/network.te                         |   12 +-
 types/security.te                        |    5 
 124 files changed, 1112 insertions(+), 259 deletions(-)

Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/devel/policy-20050916.patch,v
retrieving revision 1.19
retrieving revision 1.20
diff -u -r1.19 -r1.20
--- policy-20050916.patch	13 Oct 2005 14:12:51 -0000	1.19
+++ policy-20050916.patch	13 Oct 2005 21:42:47 -0000	1.20
@@ -1460,7 +1460,7 @@
  
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/postfix.te policy-1.27.1/domains/program/unused/postfix.te
 --- nsapolicy/domains/program/unused/postfix.te	2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/postfix.te	2005-10-04 11:59:51.000000000 -0400
++++ policy-1.27.1/domains/program/unused/postfix.te	2005-10-13 17:41:52.000000000 -0400
 @@ -54,6 +54,8 @@
  allow postfix_$1_t proc_net_t:dir search;
  allow postfix_$1_t proc_net_t:file { getattr read };
@@ -1470,7 +1470,7 @@
  
  allow postfix_$1_t tmp_t:dir getattr;
  
-@@ -69,6 +71,9 @@
+@@ -69,8 +71,15 @@
  postfix_domain(master, `, mail_server_domain')
  rhgb_domain(postfix_master_t)
  
@@ -1479,8 +1479,32 @@
 +
  read_sysctl(postfix_master_t)
  
++ifdef(`targeted_policy', `
++bool disable_postfix_trans false;
++if (!disable_postfix_trans) {
++')
  domain_auto_trans(initrc_t, postfix_master_exec_t, postfix_master_t)
-@@ -97,10 +102,12 @@
+ allow initrc_t postfix_master_t:process { noatsecure siginh rlimitinh };
+ 
+@@ -86,9 +95,16 @@
+ domain_auto_trans(sysadm_mail_t, postfix_master_exec_t, system_mail_t)
+ allow system_mail_t sysadm_t:process sigchld;
+ allow system_mail_t privfd:fd use;
+-
+ ')dnl end direct_sysadm_daemon
+ 
++ifdef(`pppd.te', `
++domain_auto_trans(pppd_t, postfix_master_exec_t, postfix_master_t)
++')
++
++ifdef(`targeted_policy', `
++}
++')
++
+ allow postfix_master_t privfd:fd use;
+ ifdef(`newrole.te', `allow postfix_master_t newrole_t:process sigchld;')
+ allow postfix_master_t initrc_devpts_t:chr_file rw_file_perms;
+@@ -97,15 +113,15 @@
  dontaudit postfix_master_t selinux_config_t:dir search;
  can_exec({ sysadm_mail_t system_mail_t }, postfix_master_exec_t)
  ifdef(`distro_redhat', `
@@ -1494,8 +1518,14 @@
 +file_type_auto_trans({ sysadm_mail_t system_mail_t }, etc_t, etc_aliases_t)
  allow postfix_master_t sendmail_exec_t:file r_file_perms;
  allow postfix_master_t sbin_t:lnk_file { getattr read };
- ifdef(`pppd.te', `
-@@ -121,7 +128,7 @@
+-ifdef(`pppd.te', `
+-domain_auto_trans(pppd_t, postfix_master_exec_t, postfix_master_t)
+-')
++
+ can_exec(postfix_master_t, { ls_exec_t sbin_t })
+ allow postfix_master_t self:fifo_file rw_file_perms;
+ allow postfix_master_t usr_t:file r_file_perms;
+@@ -121,7 +137,7 @@
  can_network(postfix_master_t)
  allow postfix_master_t port_type:tcp_socket name_connect;
  can_ypbind(postfix_master_t)
@@ -1504,7 +1534,7 @@
  allow postfix_master_t postfix_spool_maildrop_t:dir rw_dir_perms;
  allow postfix_master_t postfix_spool_maildrop_t:file { unlink rename getattr };
  allow postfix_master_t postfix_prng_t:file getattr;
-@@ -135,14 +142,10 @@
+@@ -135,14 +151,10 @@
  ')
  
  create_dir_file(postfix_master_t, postfix_spool_flush_t)
@@ -1519,7 +1549,7 @@
  # allow access to deferred queue and allow removing bogus incoming entries
  allow postfix_master_t postfix_spool_t:dir create_dir_perms;
  allow postfix_master_t postfix_spool_t:file create_file_perms;
-@@ -163,7 +166,6 @@
+@@ -163,7 +175,6 @@
  allow postfix_smtp_t postfix_spool_t:file rw_file_perms;
  allow postfix_smtp_t { postfix_private_t postfix_public_t }:dir search;
  allow postfix_smtp_t { postfix_private_t postfix_public_t }:sock_file write;
@@ -1527,7 +1557,7 @@
  allow postfix_smtp_t postfix_master_t:unix_stream_socket connectto;
  # if you have two different mail servers on the same host let them talk via
  # SMTP, also if one mail server wants to talk to itself then allow it and let
-@@ -172,7 +174,6 @@
+@@ -172,7 +183,6 @@
  can_tcp_connect(postfix_smtp_t, mail_server_domain)
  
  postfix_server_domain(smtpd)
@@ -1535,7 +1565,7 @@
  allow postfix_smtpd_t postfix_master_t:tcp_socket rw_stream_socket_perms;
  allow postfix_smtpd_t { postfix_private_t postfix_public_t }:dir search;
  allow postfix_smtpd_t { postfix_private_t postfix_public_t }:sock_file rw_file_perms;
-@@ -184,7 +185,6 @@
+@@ -184,7 +194,6 @@
  
  # for prng_exch
  allow postfix_smtpd_t postfix_spool_t:file rw_file_perms;
@@ -1543,7 +1573,7 @@
  allow { postfix_smtp_t postfix_smtpd_t } postfix_prng_t:file rw_file_perms;
  
  postfix_server_domain(local, `, mta_delivery_agent')
-@@ -196,7 +196,7 @@
+@@ -196,7 +205,7 @@
  ')
  allow postfix_local_t etc_aliases_t:file r_file_perms;
  allow postfix_local_t self:fifo_file rw_file_perms;
@@ -1552,7 +1582,7 @@
  allow postfix_local_t postfix_spool_t:file rw_file_perms;
  # for .forward - maybe we need a new type for it?
  allow postfix_local_t postfix_private_t:dir search;
-@@ -241,6 +241,7 @@
+@@ -241,6 +250,7 @@
  allow postfix_postqueue_t postfix_public_t:dir search;
  allow postfix_postqueue_t postfix_public_t:fifo_file getattr;
  allow postfix_postqueue_t self:udp_socket { create ioctl };
@@ -1560,7 +1590,7 @@
  allow postfix_master_t postfix_postqueue_exec_t:file getattr;
  domain_auto_trans(postfix_master_t, postfix_postqueue_exec_t, postfix_postqueue_t)
  allow postfix_postqueue_t initrc_t:process sigchld;
-@@ -260,7 +261,7 @@
+@@ -260,7 +270,7 @@
  postfix_user_domain(showq)
  # the following auto_trans is usually in postfix server domain
  domain_auto_trans(postfix_master_t, postfix_showq_exec_t, postfix_showq_t)
@@ -1569,15 +1599,17 @@
  r_dir_file(postfix_showq_t, postfix_spool_maildrop_t)
  domain_auto_trans(postfix_postqueue_t, postfix_showq_exec_t, postfix_showq_t)
  allow postfix_showq_t self:capability { setuid setgid };
-@@ -284,6 +285,7 @@
+@@ -284,7 +294,9 @@
  allow postfix_postdrop_t { crond_t system_crond_t }:fifo_file rw_file_perms;')
  # usually it does not need a UDP socket
  allow postfix_postdrop_t self:udp_socket create_socket_perms;
 +allow postfix_postdrop_t self:tcp_socket create;
  allow postfix_postdrop_t self:capability sys_resource;
++allow postfix_postdrop_t self:tcp_socket create;
  
  postfix_public_domain(pickup)
-@@ -329,7 +331,8 @@
+ allow postfix_pickup_t postfix_public_t:fifo_file rw_file_perms;
+@@ -329,7 +341,8 @@
  domain_auto_trans(postfix_pipe_t, procmail_exec_t, procmail_t)
  ')
  ifdef(`sendmail.te', `
@@ -1587,7 +1619,7 @@
  ')
  
  # Program for creating database files
-@@ -350,3 +353,4 @@
+@@ -350,3 +363,4 @@
  allow postfix_map_t port_type:tcp_socket name_connect;
  allow postfix_local_t mail_spool_t:dir { remove_name };
  allow postfix_local_t mail_spool_t:file { unlink };


Index: selinux-policy-targeted.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/devel/selinux-policy-targeted.spec,v
retrieving revision 1.387
retrieving revision 1.388
diff -u -r1.387 -r1.388
--- selinux-policy-targeted.spec	13 Oct 2005 13:45:33 -0000	1.387
+++ selinux-policy-targeted.spec	13 Oct 2005 21:42:47 -0000	1.388
@@ -10,7 +10,7 @@
 Summary: SELinux %{type} policy configuration
 Name: selinux-policy-%{type}
 Version: 1.27.1
-Release: 16
+Release: 17
 License: GPL
 Group: System Environment/Base
 Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -91,7 +91,7 @@
 touch ${RPM_BUILD_ROOT}%{_sysconfdir}/selinux/%{type}/src/policy/policy.conf
 touch ${RPM_BUILD_ROOT}%{_sysconfdir}/selinux/config
 touch ${RPM_BUILD_ROOT}%{_sysconfdir}/selinux/%{type}/booleans.local
-install -m0600 %{SOURCE4} ${RPM_BUILD_ROOT}%{_sysconfdir}/selinux/%{type}/seusers
+install -m0644 %{SOURCE4} ${RPM_BUILD_ROOT}%{_sysconfdir}/selinux/%{type}/seusers
 
 %clean
 rm -rf ${RPM_BUILD_ROOT}
@@ -248,6 +248,10 @@
 exit 0
 
 %changelog
+* Thu Oct 13 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-17
+- Fix protections on seusers
+- Add disable_postfix_trans boolean
+
 * Thu Oct 13 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-16
 - Apply Russells fixes 
 




More information about the fedora-cvs-commits mailing list