rpms/selinux-policy-targeted/devel policy-20050916.patch, 1.19, 1.20 selinux-policy-targeted.spec, 1.387, 1.388
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Thu Oct 13 21:42:52 UTC 2005
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy-targeted/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv7461
Modified Files:
policy-20050916.patch selinux-policy-targeted.spec
Log Message:
* Thu Oct 13 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-17
- Fix protections on seusers
- Add disable_postfix_trans boolean
policy-20050916.patch:
Makefile | 26 ++--
attrib.te | 35 ++++++
domains/misc/kernel.te | 2
domains/program/crond.te | 2
domains/program/fsadm.te | 7 -
domains/program/hostname.te | 2
domains/program/ifconfig.te | 5
domains/program/initrc.te | 17 +++
domains/program/ldconfig.te | 3
domains/program/load_policy.te | 7 -
domains/program/login.te | 21 ++-
domains/program/modutil.te | 14 +-
domains/program/mount.te | 6 -
domains/program/netutils.te | 3
domains/program/newrole.te | 4
domains/program/passwd.te | 1
domains/program/restorecon.te | 3
domains/program/setfiles.te | 4
domains/program/ssh.te | 6 -
domains/program/su.te | 9 +
domains/program/syslogd.te | 6 -
domains/program/unused/NetworkManager.te | 3
domains/program/unused/alsa.te | 2
domains/program/unused/amanda.te | 74 +++-----------
domains/program/unused/anaconda.te | 5
domains/program/unused/apache.te | 17 +--
domains/program/unused/apmd.te | 13 ++
domains/program/unused/auditd.te | 2
domains/program/unused/automount.te | 4
domains/program/unused/bluetooth.te | 72 +++++++++++++
domains/program/unused/cups.te | 18 ++-
domains/program/unused/cvs.te | 3
domains/program/unused/cyrus.te | 2
domains/program/unused/dbusd.te | 4
domains/program/unused/dcc.te | 5
domains/program/unused/dhcpc.te | 5
domains/program/unused/dhcpd.te | 3
domains/program/unused/dovecot.te | 4
domains/program/unused/ftpd.te | 6 -
domains/program/unused/hald.te | 5
domains/program/unused/hotplug.te | 5
domains/program/unused/hwclock.te | 2
domains/program/unused/ipsec.te | 2
domains/program/unused/kudzu.te | 5
domains/program/unused/mta.te | 8 +
domains/program/unused/mysqld.te | 6 -
domains/program/unused/named.te | 29 ++++-
domains/program/unused/nscd.te | 1
domains/program/unused/ntpd.te | 10 -
domains/program/unused/openct.te | 16 +++
domains/program/unused/pamconsole.te | 2
domains/program/unused/pegasus.te | 37 +++++++
domains/program/unused/ping.te | 3
domains/program/unused/postfix.te | 48 +++++----
domains/program/unused/pppd.te | 8 -
domains/program/unused/procmail.te | 11 +-
domains/program/unused/readahead.te | 21 +++
domains/program/unused/rlogind.te | 4
domains/program/unused/roundup.te | 29 +++++
domains/program/unused/rpcd.te | 13 ++
domains/program/unused/rsync.te | 3
domains/program/unused/samba.te | 12 +-
domains/program/unused/snmpd.te | 6 -
domains/program/unused/squid.te | 3
domains/program/unused/udev.te | 10 +
domains/program/unused/utempter.te | 2
domains/program/unused/webalizer.te | 3
domains/program/unused/winbind.te | 1
domains/program/unused/xdm.te | 3
domains/program/unused/yppasswdd.te | 40 +++++++
domains/program/unused/ypserv.te | 1
domains/program/useradd.te | 5
file_contexts/distros.fc | 2
file_contexts/program/bluetooth.fc | 3
file_contexts/program/dhcpc.fc | 2
file_contexts/program/dhcpd.fc | 1
file_contexts/program/ftpd.fc | 5
file_contexts/program/games.fc | 11 +-
file_contexts/program/ipsec.fc | 1
file_contexts/program/openct.fc | 2
file_contexts/program/pegasus.fc | 11 ++
file_contexts/program/pppd.fc | 2
file_contexts/program/readahead.fc | 1
file_contexts/program/roundup.fc | 2
file_contexts/program/rpm.fc | 4
file_contexts/program/rshd.fc | 1
file_contexts/program/rsync.fc | 2
file_contexts/program/xdm.fc | 2
file_contexts/program/yppasswdd.fc | 2
file_contexts/program/ypserv.fc | 1
file_contexts/types.fc | 2
genfs_contexts | 2
macros/base_user_macros.te | 6 +
macros/core_macros.te | 3
macros/global_macros.te | 18 ++-
macros/network_macros.te | 17 +++
macros/program/apache_macros.te | 13 ++
macros/program/cdrecord_macros.te | 2
macros/program/i18n_input_macros.te | 21 +++
macros/program/mta_macros.te | 4
macros/program/newrole_macros.te | 2
macros/program/pyzor_macros.te | 2
macros/program/razor_macros.te | 2
macros/program/su_macros.te | 4
macros/program/uml_macros.te | 2
macros/user_macros.te | 2
man/man8/ftpd_selinux.8 | 19 +--
man/man8/httpd_selinux.8 | 9 +
man/man8/rsync_selinux.8 | 12 +-
man/man8/samba_selinux.8 | 9 +
mcs | 146 +++++++++++++++++++++++++++
mls | 163 ++++++++++++++++++++++++++++---
net_contexts | 6 +
targeted/appconfig/root_default_contexts | 4
targeted/assert.te | 2
targeted/domains/program/ssh.te | 3
targeted/domains/program/xdm.te | 4
targeted/domains/unconfined.te | 16 ++-
tunables/distro.tun | 2
tunables/tunable.tun | 4
types/devpts.te | 4
types/file.te | 15 ++
types/network.te | 12 +-
types/security.te | 5
124 files changed, 1112 insertions(+), 259 deletions(-)
Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/devel/policy-20050916.patch,v
retrieving revision 1.19
retrieving revision 1.20
diff -u -r1.19 -r1.20
--- policy-20050916.patch 13 Oct 2005 14:12:51 -0000 1.19
+++ policy-20050916.patch 13 Oct 2005 21:42:47 -0000 1.20
@@ -1460,7 +1460,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/postfix.te policy-1.27.1/domains/program/unused/postfix.te
--- nsapolicy/domains/program/unused/postfix.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/postfix.te 2005-10-04 11:59:51.000000000 -0400
++++ policy-1.27.1/domains/program/unused/postfix.te 2005-10-13 17:41:52.000000000 -0400
@@ -54,6 +54,8 @@
allow postfix_$1_t proc_net_t:dir search;
allow postfix_$1_t proc_net_t:file { getattr read };
@@ -1470,7 +1470,7 @@
allow postfix_$1_t tmp_t:dir getattr;
-@@ -69,6 +71,9 @@
+@@ -69,8 +71,15 @@
postfix_domain(master, `, mail_server_domain')
rhgb_domain(postfix_master_t)
@@ -1479,8 +1479,32 @@
+
read_sysctl(postfix_master_t)
++ifdef(`targeted_policy', `
++bool disable_postfix_trans false;
++if (!disable_postfix_trans) {
++')
domain_auto_trans(initrc_t, postfix_master_exec_t, postfix_master_t)
-@@ -97,10 +102,12 @@
+ allow initrc_t postfix_master_t:process { noatsecure siginh rlimitinh };
+
+@@ -86,9 +95,16 @@
+ domain_auto_trans(sysadm_mail_t, postfix_master_exec_t, system_mail_t)
+ allow system_mail_t sysadm_t:process sigchld;
+ allow system_mail_t privfd:fd use;
+-
+ ')dnl end direct_sysadm_daemon
+
++ifdef(`pppd.te', `
++domain_auto_trans(pppd_t, postfix_master_exec_t, postfix_master_t)
++')
++
++ifdef(`targeted_policy', `
++}
++')
++
+ allow postfix_master_t privfd:fd use;
+ ifdef(`newrole.te', `allow postfix_master_t newrole_t:process sigchld;')
+ allow postfix_master_t initrc_devpts_t:chr_file rw_file_perms;
+@@ -97,15 +113,15 @@
dontaudit postfix_master_t selinux_config_t:dir search;
can_exec({ sysadm_mail_t system_mail_t }, postfix_master_exec_t)
ifdef(`distro_redhat', `
@@ -1494,8 +1518,14 @@
+file_type_auto_trans({ sysadm_mail_t system_mail_t }, etc_t, etc_aliases_t)
allow postfix_master_t sendmail_exec_t:file r_file_perms;
allow postfix_master_t sbin_t:lnk_file { getattr read };
- ifdef(`pppd.te', `
-@@ -121,7 +128,7 @@
+-ifdef(`pppd.te', `
+-domain_auto_trans(pppd_t, postfix_master_exec_t, postfix_master_t)
+-')
++
+ can_exec(postfix_master_t, { ls_exec_t sbin_t })
+ allow postfix_master_t self:fifo_file rw_file_perms;
+ allow postfix_master_t usr_t:file r_file_perms;
+@@ -121,7 +137,7 @@
can_network(postfix_master_t)
allow postfix_master_t port_type:tcp_socket name_connect;
can_ypbind(postfix_master_t)
@@ -1504,7 +1534,7 @@
allow postfix_master_t postfix_spool_maildrop_t:dir rw_dir_perms;
allow postfix_master_t postfix_spool_maildrop_t:file { unlink rename getattr };
allow postfix_master_t postfix_prng_t:file getattr;
-@@ -135,14 +142,10 @@
+@@ -135,14 +151,10 @@
')
create_dir_file(postfix_master_t, postfix_spool_flush_t)
@@ -1519,7 +1549,7 @@
# allow access to deferred queue and allow removing bogus incoming entries
allow postfix_master_t postfix_spool_t:dir create_dir_perms;
allow postfix_master_t postfix_spool_t:file create_file_perms;
-@@ -163,7 +166,6 @@
+@@ -163,7 +175,6 @@
allow postfix_smtp_t postfix_spool_t:file rw_file_perms;
allow postfix_smtp_t { postfix_private_t postfix_public_t }:dir search;
allow postfix_smtp_t { postfix_private_t postfix_public_t }:sock_file write;
@@ -1527,7 +1557,7 @@
allow postfix_smtp_t postfix_master_t:unix_stream_socket connectto;
# if you have two different mail servers on the same host let them talk via
# SMTP, also if one mail server wants to talk to itself then allow it and let
-@@ -172,7 +174,6 @@
+@@ -172,7 +183,6 @@
can_tcp_connect(postfix_smtp_t, mail_server_domain)
postfix_server_domain(smtpd)
@@ -1535,7 +1565,7 @@
allow postfix_smtpd_t postfix_master_t:tcp_socket rw_stream_socket_perms;
allow postfix_smtpd_t { postfix_private_t postfix_public_t }:dir search;
allow postfix_smtpd_t { postfix_private_t postfix_public_t }:sock_file rw_file_perms;
-@@ -184,7 +185,6 @@
+@@ -184,7 +194,6 @@
# for prng_exch
allow postfix_smtpd_t postfix_spool_t:file rw_file_perms;
@@ -1543,7 +1573,7 @@
allow { postfix_smtp_t postfix_smtpd_t } postfix_prng_t:file rw_file_perms;
postfix_server_domain(local, `, mta_delivery_agent')
-@@ -196,7 +196,7 @@
+@@ -196,7 +205,7 @@
')
allow postfix_local_t etc_aliases_t:file r_file_perms;
allow postfix_local_t self:fifo_file rw_file_perms;
@@ -1552,7 +1582,7 @@
allow postfix_local_t postfix_spool_t:file rw_file_perms;
# for .forward - maybe we need a new type for it?
allow postfix_local_t postfix_private_t:dir search;
-@@ -241,6 +241,7 @@
+@@ -241,6 +250,7 @@
allow postfix_postqueue_t postfix_public_t:dir search;
allow postfix_postqueue_t postfix_public_t:fifo_file getattr;
allow postfix_postqueue_t self:udp_socket { create ioctl };
@@ -1560,7 +1590,7 @@
allow postfix_master_t postfix_postqueue_exec_t:file getattr;
domain_auto_trans(postfix_master_t, postfix_postqueue_exec_t, postfix_postqueue_t)
allow postfix_postqueue_t initrc_t:process sigchld;
-@@ -260,7 +261,7 @@
+@@ -260,7 +270,7 @@
postfix_user_domain(showq)
# the following auto_trans is usually in postfix server domain
domain_auto_trans(postfix_master_t, postfix_showq_exec_t, postfix_showq_t)
@@ -1569,15 +1599,17 @@
r_dir_file(postfix_showq_t, postfix_spool_maildrop_t)
domain_auto_trans(postfix_postqueue_t, postfix_showq_exec_t, postfix_showq_t)
allow postfix_showq_t self:capability { setuid setgid };
-@@ -284,6 +285,7 @@
+@@ -284,7 +294,9 @@
allow postfix_postdrop_t { crond_t system_crond_t }:fifo_file rw_file_perms;')
# usually it does not need a UDP socket
allow postfix_postdrop_t self:udp_socket create_socket_perms;
+allow postfix_postdrop_t self:tcp_socket create;
allow postfix_postdrop_t self:capability sys_resource;
++allow postfix_postdrop_t self:tcp_socket create;
postfix_public_domain(pickup)
-@@ -329,7 +331,8 @@
+ allow postfix_pickup_t postfix_public_t:fifo_file rw_file_perms;
+@@ -329,7 +341,8 @@
domain_auto_trans(postfix_pipe_t, procmail_exec_t, procmail_t)
')
ifdef(`sendmail.te', `
@@ -1587,7 +1619,7 @@
')
# Program for creating database files
-@@ -350,3 +353,4 @@
+@@ -350,3 +363,4 @@
allow postfix_map_t port_type:tcp_socket name_connect;
allow postfix_local_t mail_spool_t:dir { remove_name };
allow postfix_local_t mail_spool_t:file { unlink };
Index: selinux-policy-targeted.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/devel/selinux-policy-targeted.spec,v
retrieving revision 1.387
retrieving revision 1.388
diff -u -r1.387 -r1.388
--- selinux-policy-targeted.spec 13 Oct 2005 13:45:33 -0000 1.387
+++ selinux-policy-targeted.spec 13 Oct 2005 21:42:47 -0000 1.388
@@ -10,7 +10,7 @@
Summary: SELinux %{type} policy configuration
Name: selinux-policy-%{type}
Version: 1.27.1
-Release: 16
+Release: 17
License: GPL
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -91,7 +91,7 @@
touch ${RPM_BUILD_ROOT}%{_sysconfdir}/selinux/%{type}/src/policy/policy.conf
touch ${RPM_BUILD_ROOT}%{_sysconfdir}/selinux/config
touch ${RPM_BUILD_ROOT}%{_sysconfdir}/selinux/%{type}/booleans.local
-install -m0600 %{SOURCE4} ${RPM_BUILD_ROOT}%{_sysconfdir}/selinux/%{type}/seusers
+install -m0644 %{SOURCE4} ${RPM_BUILD_ROOT}%{_sysconfdir}/selinux/%{type}/seusers
%clean
rm -rf ${RPM_BUILD_ROOT}
@@ -248,6 +248,10 @@
exit 0
%changelog
+* Thu Oct 13 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-17
+- Fix protections on seusers
+- Add disable_postfix_trans boolean
+
* Thu Oct 13 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-16
- Apply Russells fixes
More information about the fedora-cvs-commits
mailing list