rpms/selinux-policy-targeted/devel policy-20050916.patch, 1.20, 1.21 selinux-policy-targeted.spec, 1.388, 1.389
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Mon Oct 17 19:58:30 UTC 2005
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy-targeted/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv26241
Modified Files:
policy-20050916.patch selinux-policy-targeted.spec
Log Message:
* Mon Oct 17 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-18
- Cleanup category defs
- Add configfs_t
- Allow http to run with mod_ftpd
- Fix initrc_exec_t scripts to run with the correct securitylevel
- Fixes for postfix_local
policy-20050916.patch:
Makefile | 26 +--
attrib.te | 35 ++++
domains/misc/kernel.te | 2
domains/program/crond.te | 2
domains/program/fsadm.te | 7
domains/program/hostname.te | 2
domains/program/ifconfig.te | 5
domains/program/initrc.te | 18 ++
domains/program/ldconfig.te | 3
domains/program/load_policy.te | 7
domains/program/login.te | 21 +-
domains/program/modutil.te | 14 +
domains/program/mount.te | 6
domains/program/netutils.te | 3
domains/program/newrole.te | 4
domains/program/passwd.te | 1
domains/program/restorecon.te | 3
domains/program/setfiles.te | 4
domains/program/ssh.te | 6
domains/program/su.te | 9 +
domains/program/syslogd.te | 6
domains/program/unused/NetworkManager.te | 8 -
domains/program/unused/alsa.te | 2
domains/program/unused/amanda.te | 74 ++--------
domains/program/unused/anaconda.te | 5
domains/program/unused/apache.te | 22 ++-
domains/program/unused/apmd.te | 13 +
domains/program/unused/auditd.te | 2
domains/program/unused/automount.te | 4
domains/program/unused/bluetooth.te | 72 +++++++++
domains/program/unused/cups.te | 18 +-
domains/program/unused/cvs.te | 3
domains/program/unused/cyrus.te | 2
domains/program/unused/dbusd.te | 4
domains/program/unused/dcc.te | 5
domains/program/unused/dhcpc.te | 5
domains/program/unused/dhcpd.te | 3
domains/program/unused/dovecot.te | 4
domains/program/unused/ftpd.te | 6
domains/program/unused/hald.te | 5
domains/program/unused/hotplug.te | 5
domains/program/unused/hwclock.te | 2
domains/program/unused/ipsec.te | 2
domains/program/unused/kudzu.te | 5
domains/program/unused/mta.te | 8 +
domains/program/unused/mysqld.te | 6
domains/program/unused/named.te | 29 +++
domains/program/unused/nscd.te | 1
domains/program/unused/ntpd.te | 10 -
domains/program/unused/openct.te | 16 ++
domains/program/unused/pamconsole.te | 2
domains/program/unused/pegasus.te | 37 +++++
domains/program/unused/ping.te | 3
domains/program/unused/postfix.te | 57 ++++---
domains/program/unused/pppd.te | 8 -
domains/program/unused/procmail.te | 11 +
domains/program/unused/readahead.te | 21 ++
domains/program/unused/rlogind.te | 4
domains/program/unused/roundup.te | 29 +++
domains/program/unused/rpcd.te | 13 +
domains/program/unused/rsync.te | 3
domains/program/unused/samba.te | 12 +
domains/program/unused/snmpd.te | 6
domains/program/unused/squid.te | 3
domains/program/unused/udev.te | 10 +
domains/program/unused/utempter.te | 2
domains/program/unused/webalizer.te | 3
domains/program/unused/winbind.te | 1
domains/program/unused/xdm.te | 3
domains/program/unused/yppasswdd.te | 40 +++++
domains/program/unused/ypserv.te | 1
domains/program/useradd.te | 5
file_contexts/distros.fc | 2
file_contexts/program/apache.fc | 2
file_contexts/program/bluetooth.fc | 3
file_contexts/program/dhcpc.fc | 2
file_contexts/program/dhcpd.fc | 5
file_contexts/program/ftpd.fc | 5
file_contexts/program/games.fc | 11 +
file_contexts/program/ipsec.fc | 1
file_contexts/program/openct.fc | 2
file_contexts/program/pegasus.fc | 11 +
file_contexts/program/pppd.fc | 2
file_contexts/program/readahead.fc | 1
file_contexts/program/roundup.fc | 2
file_contexts/program/rpm.fc | 4
file_contexts/program/rshd.fc | 1
file_contexts/program/rsync.fc | 2
file_contexts/program/squid.fc | 3
file_contexts/program/xdm.fc | 2
file_contexts/program/yppasswdd.fc | 2
file_contexts/program/ypserv.fc | 1
file_contexts/types.fc | 4
genfs_contexts | 3
macros/base_user_macros.te | 6
macros/core_macros.te | 3
macros/global_macros.te | 18 +-
macros/network_macros.te | 17 ++
macros/program/apache_macros.te | 13 +
macros/program/cdrecord_macros.te | 2
macros/program/i18n_input_macros.te | 21 ++
macros/program/mta_macros.te | 4
macros/program/newrole_macros.te | 2
macros/program/pyzor_macros.te | 2
macros/program/razor_macros.te | 2
macros/program/su_macros.te | 4
macros/program/uml_macros.te | 2
macros/user_macros.te | 2
man/man8/ftpd_selinux.8 | 19 +-
man/man8/httpd_selinux.8 | 9 +
man/man8/rsync_selinux.8 | 12 +
man/man8/samba_selinux.8 | 9 +
mcs | 210 ++++++++++------------------
mls | 227 +++++++++++--------------------
net_contexts | 6
targeted/appconfig/root_default_contexts | 4
targeted/assert.te | 2
targeted/domains/program/ssh.te | 3
targeted/domains/program/xdm.te | 4
targeted/domains/unconfined.te | 16 +-
tunables/distro.tun | 2
tunables/tunable.tun | 4
types/devpts.te | 4
types/file.te | 18 +-
types/network.te | 12 -
types/security.te | 5
126 files changed, 1012 insertions(+), 522 deletions(-)
Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/devel/policy-20050916.patch,v
retrieving revision 1.20
retrieving revision 1.21
diff -u -r1.20 -r1.21
--- policy-20050916.patch 13 Oct 2005 21:42:47 -0000 1.20
+++ policy-20050916.patch 17 Oct 2005 19:58:26 -0000 1.21
@@ -142,7 +142,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/initrc.te policy-1.27.1/domains/program/initrc.te
--- nsapolicy/domains/program/initrc.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/initrc.te 2005-09-27 17:14:40.000000000 -0400
++++ policy-1.27.1/domains/program/initrc.te 2005-10-17 10:31:12.000000000 -0400
@@ -56,6 +56,10 @@
can_create_pty(initrc)
@@ -171,13 +171,14 @@
')dnl end distro_redhat
allow initrc_t system_map_t:{ file lnk_file } r_file_perms;
-@@ -322,3 +334,6 @@
+@@ -322,3 +334,7 @@
ifdef(`dbusd.te', `
allow initrc_t system_dbusd_var_run_t:sock_file write;
')
+
+# Slapd needs to read cert files from its initscript
+r_dir_file(initrc_t, cert_t)
++range_transition sysadm_t initrc_exec_t s0;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/ldconfig.te policy-1.27.1/domains/program/ldconfig.te
--- nsapolicy/domains/program/ldconfig.te 2005-09-12 16:40:28.000000000 -0400
+++ policy-1.27.1/domains/program/ldconfig.te 2005-09-27 17:14:40.000000000 -0400
@@ -670,7 +671,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/apache.te policy-1.27.1/domains/program/unused/apache.te
--- nsapolicy/domains/program/unused/apache.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/apache.te 2005-09-29 16:06:57.000000000 -0400
++++ policy-1.27.1/domains/program/unused/apache.te 2005-10-17 14:35:06.000000000 -0400
@@ -113,9 +113,12 @@
can_network_server(httpd_t)
can_kerberos(httpd_t)
@@ -723,6 +724,15 @@
domain_auto_trans(httpd_t, httpdcontent, httpd_sys_script_t)
create_dir_file(httpd_t, httpdcontent)
}
+@@ -404,3 +407,8 @@
+ allow system_mail_t httpd_squirrelmail_t:file { append read };
+ dontaudit system_mail_t httpd_t:tcp_socket { read write };
+ ')
++bool httpd_enable_ftp_server false;
++if (httpd_enable_ftp_server) {
++allow httpd_t ftp_port_t:tcp_socket name_bind;
++}
++
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/apmd.te policy-1.27.1/domains/program/unused/apmd.te
--- nsapolicy/domains/program/unused/apmd.te 2005-09-16 11:17:08.000000000 -0400
+++ policy-1.27.1/domains/program/unused/apmd.te 2005-09-27 17:14:40.000000000 -0400
@@ -1311,7 +1321,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/NetworkManager.te policy-1.27.1/domains/program/unused/NetworkManager.te
--- nsapolicy/domains/program/unused/NetworkManager.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/NetworkManager.te 2005-09-27 17:14:40.000000000 -0400
++++ policy-1.27.1/domains/program/unused/NetworkManager.te 2005-10-15 13:59:56.000000000 -0400
@@ -11,7 +11,7 @@
# NetworkManager_t is the domain for the NetworkManager daemon.
# NetworkManager_exec_t is the type of the NetworkManager executable.
@@ -1321,11 +1331,16 @@
can_network(NetworkManager_t)
allow NetworkManager_t port_type:tcp_socket name_connect;
-@@ -109,3 +109,4 @@
+@@ -109,3 +109,9 @@
')
allow NetworkManager_t var_lib_t:dir search;
dontaudit NetworkManager_t user_tty_type:chr_file { read write };
+dontaudit NetworkManager_t security_t:dir search;
++
++ifdef(`consoletype.te', `
++can_exec(NetworkManager_t, consoletype_exec_t)
++')
++
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/nscd.te policy-1.27.1/domains/program/unused/nscd.te
--- nsapolicy/domains/program/unused/nscd.te 2005-09-12 16:40:28.000000000 -0400
+++ policy-1.27.1/domains/program/unused/nscd.te 2005-09-27 17:14:40.000000000 -0400
@@ -1460,7 +1475,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/postfix.te policy-1.27.1/domains/program/unused/postfix.te
--- nsapolicy/domains/program/unused/postfix.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/postfix.te 2005-10-13 17:41:52.000000000 -0400
++++ policy-1.27.1/domains/program/unused/postfix.te 2005-10-17 15:10:29.000000000 -0400
@@ -54,6 +54,8 @@
allow postfix_$1_t proc_net_t:dir search;
allow postfix_$1_t proc_net_t:file { getattr read };
@@ -1470,7 +1485,7 @@
allow postfix_$1_t tmp_t:dir getattr;
-@@ -69,8 +71,15 @@
+@@ -69,16 +71,23 @@
postfix_domain(master, `, mail_server_domain')
rhgb_domain(postfix_master_t)
@@ -1486,13 +1501,21 @@
domain_auto_trans(initrc_t, postfix_master_exec_t, postfix_master_t)
allow initrc_t postfix_master_t:process { noatsecure siginh rlimitinh };
-@@ -86,9 +95,16 @@
- domain_auto_trans(sysadm_mail_t, postfix_master_exec_t, system_mail_t)
+-ifdef(`direct_sysadm_daemon', `
+-
+ domain_auto_trans(sysadm_t, postfix_master_exec_t, postfix_master_t)
+ allow sysadm_t postfix_master_t:process { noatsecure siginh rlimitinh };
++ifdef(`targeted_policy', `', `
+ role_transition sysadm_r postfix_master_exec_t system_r;
++')
+ allow postfix_master_t postfix_etc_t:file rw_file_perms;
+ dontaudit postfix_master_t admin_tty_type:chr_file { read write };
+ allow postfix_master_t devpts_t:dir search;
+@@ -87,7 +96,13 @@
allow system_mail_t sysadm_t:process sigchld;
allow system_mail_t privfd:fd use;
--
- ')dnl end direct_sysadm_daemon
+-')dnl end direct_sysadm_daemon
+ifdef(`pppd.te', `
+domain_auto_trans(pppd_t, postfix_master_exec_t, postfix_master_t)
+')
@@ -1500,11 +1523,10 @@
+ifdef(`targeted_policy', `
+}
+')
-+
+
allow postfix_master_t privfd:fd use;
ifdef(`newrole.te', `allow postfix_master_t newrole_t:process sigchld;')
- allow postfix_master_t initrc_devpts_t:chr_file rw_file_perms;
-@@ -97,15 +113,15 @@
+@@ -97,15 +112,15 @@
dontaudit postfix_master_t selinux_config_t:dir search;
can_exec({ sysadm_mail_t system_mail_t }, postfix_master_exec_t)
ifdef(`distro_redhat', `
@@ -1525,7 +1547,7 @@
can_exec(postfix_master_t, { ls_exec_t sbin_t })
allow postfix_master_t self:fifo_file rw_file_perms;
allow postfix_master_t usr_t:file r_file_perms;
-@@ -121,7 +137,7 @@
+@@ -121,7 +136,7 @@
can_network(postfix_master_t)
allow postfix_master_t port_type:tcp_socket name_connect;
can_ypbind(postfix_master_t)
@@ -1534,7 +1556,7 @@
allow postfix_master_t postfix_spool_maildrop_t:dir rw_dir_perms;
allow postfix_master_t postfix_spool_maildrop_t:file { unlink rename getattr };
allow postfix_master_t postfix_prng_t:file getattr;
-@@ -135,14 +151,10 @@
+@@ -135,14 +150,10 @@
')
create_dir_file(postfix_master_t, postfix_spool_flush_t)
@@ -1549,7 +1571,7 @@
# allow access to deferred queue and allow removing bogus incoming entries
allow postfix_master_t postfix_spool_t:dir create_dir_perms;
allow postfix_master_t postfix_spool_t:file create_file_perms;
-@@ -163,7 +175,6 @@
+@@ -163,7 +174,6 @@
allow postfix_smtp_t postfix_spool_t:file rw_file_perms;
allow postfix_smtp_t { postfix_private_t postfix_public_t }:dir search;
allow postfix_smtp_t { postfix_private_t postfix_public_t }:sock_file write;
@@ -1557,7 +1579,7 @@
allow postfix_smtp_t postfix_master_t:unix_stream_socket connectto;
# if you have two different mail servers on the same host let them talk via
# SMTP, also if one mail server wants to talk to itself then allow it and let
-@@ -172,7 +183,6 @@
+@@ -172,7 +182,6 @@
can_tcp_connect(postfix_smtp_t, mail_server_domain)
postfix_server_domain(smtpd)
@@ -1565,7 +1587,7 @@
allow postfix_smtpd_t postfix_master_t:tcp_socket rw_stream_socket_perms;
allow postfix_smtpd_t { postfix_private_t postfix_public_t }:dir search;
allow postfix_smtpd_t { postfix_private_t postfix_public_t }:sock_file rw_file_perms;
-@@ -184,7 +194,6 @@
+@@ -184,7 +193,6 @@
# for prng_exch
allow postfix_smtpd_t postfix_spool_t:file rw_file_perms;
@@ -1573,7 +1595,7 @@
allow { postfix_smtp_t postfix_smtpd_t } postfix_prng_t:file rw_file_perms;
postfix_server_domain(local, `, mta_delivery_agent')
-@@ -196,7 +205,7 @@
+@@ -196,7 +204,7 @@
')
allow postfix_local_t etc_aliases_t:file r_file_perms;
allow postfix_local_t self:fifo_file rw_file_perms;
@@ -1582,7 +1604,19 @@
allow postfix_local_t postfix_spool_t:file rw_file_perms;
# for .forward - maybe we need a new type for it?
allow postfix_local_t postfix_private_t:dir search;
-@@ -241,6 +250,7 @@
+@@ -204,7 +212,10 @@
+ allow postfix_local_t postfix_master_t:unix_stream_socket connectto;
+ allow postfix_local_t postfix_public_t:dir search;
+ allow postfix_local_t postfix_public_t:sock_file write;
+-can_exec(postfix_local_t, shell_exec_t)
++tmp_domain(postfix_local)
++can_exec(postfix_local_t,{ shell_exec_t bin_t })
++allow postfix_local_t mail_spool_t:dir { remove_name };
++allow postfix_local_t mail_spool_t:file { unlink };
+
+ define(`postfix_public_domain',`
+ postfix_server_domain($1)
+@@ -241,6 +252,7 @@
allow postfix_postqueue_t postfix_public_t:dir search;
allow postfix_postqueue_t postfix_public_t:fifo_file getattr;
allow postfix_postqueue_t self:udp_socket { create ioctl };
@@ -1590,7 +1624,7 @@
allow postfix_master_t postfix_postqueue_exec_t:file getattr;
domain_auto_trans(postfix_master_t, postfix_postqueue_exec_t, postfix_postqueue_t)
allow postfix_postqueue_t initrc_t:process sigchld;
-@@ -260,7 +270,7 @@
+@@ -260,7 +272,7 @@
postfix_user_domain(showq)
# the following auto_trans is usually in postfix server domain
domain_auto_trans(postfix_master_t, postfix_showq_exec_t, postfix_showq_t)
@@ -1599,7 +1633,7 @@
r_dir_file(postfix_showq_t, postfix_spool_maildrop_t)
domain_auto_trans(postfix_postqueue_t, postfix_showq_exec_t, postfix_showq_t)
allow postfix_showq_t self:capability { setuid setgid };
-@@ -284,7 +294,9 @@
+@@ -284,7 +296,9 @@
allow postfix_postdrop_t { crond_t system_crond_t }:fifo_file rw_file_perms;')
# usually it does not need a UDP socket
allow postfix_postdrop_t self:udp_socket create_socket_perms;
@@ -1609,7 +1643,7 @@
postfix_public_domain(pickup)
allow postfix_pickup_t postfix_public_t:fifo_file rw_file_perms;
-@@ -329,7 +341,8 @@
+@@ -329,7 +343,8 @@
domain_auto_trans(postfix_pipe_t, procmail_exec_t, procmail_t)
')
ifdef(`sendmail.te', `
@@ -1619,11 +1653,12 @@
')
# Program for creating database files
-@@ -350,3 +363,4 @@
+@@ -348,5 +363,3 @@
+ dontaudit postfix_map_t var_t:dir search;
+ can_network_server(postfix_map_t)
allow postfix_map_t port_type:tcp_socket name_connect;
- allow postfix_local_t mail_spool_t:dir { remove_name };
- allow postfix_local_t mail_spool_t:file { unlink };
-+can_exec(postfix_local_t, bin_t)
+-allow postfix_local_t mail_spool_t:dir { remove_name };
+-allow postfix_local_t mail_spool_t:file { unlink };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/pppd.te policy-1.27.1/domains/program/unused/pppd.te
--- nsapolicy/domains/program/unused/pppd.te 2005-09-16 11:17:09.000000000 -0400
+++ policy-1.27.1/domains/program/unused/pppd.te 2005-09-29 14:04:48.000000000 -0400
@@ -2061,6 +2096,18 @@
# Fedora Extras packages: ladspa, imlib2, ocaml
/usr/lib/ladspa/analogue_osc_1416\.so -- system_u:object_r:texrel_shlib_t
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/apache.fc policy-1.27.1/file_contexts/program/apache.fc
+--- nsapolicy/file_contexts/program/apache.fc 2005-09-16 11:17:10.000000000 -0400
++++ policy-1.27.1/file_contexts/program/apache.fc 2005-10-17 08:33:08.000000000 -0400
+@@ -9,6 +9,8 @@
+ /var/cache/httpd(/.*)? system_u:object_r:httpd_cache_t
+ /var/cache/php-eaccelerator(/.*)? system_u:object_r:httpd_cache_t
+ /var/cache/php-mmcache(/.*)? system_u:object_r:httpd_cache_t
++/var/cache/mason(/.*)? system_u:object_r:httpd_cache_t
++/var/cache/rt3(/.*)? system_u:object_r:httpd_cache_t
+ /etc/httpd -d system_u:object_r:httpd_config_t
+ /etc/httpd/conf.* system_u:object_r:httpd_config_t
+ /etc/httpd/logs system_u:object_r:httpd_log_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/bluetooth.fc policy-1.27.1/file_contexts/program/bluetooth.fc
--- nsapolicy/file_contexts/program/bluetooth.fc 2005-09-12 16:40:27.000000000 -0400
+++ policy-1.27.1/file_contexts/program/bluetooth.fc 2005-10-11 13:07:16.000000000 -0400
@@ -2093,7 +2140,20 @@
# pump
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/dhcpd.fc policy-1.27.1/file_contexts/program/dhcpd.fc
--- nsapolicy/file_contexts/program/dhcpd.fc 2005-09-16 11:17:10.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/dhcpd.fc 2005-09-27 17:14:40.000000000 -0400
++++ policy-1.27.1/file_contexts/program/dhcpd.fc 2005-10-14 07:58:24.000000000 -0400
+@@ -2,10 +2,10 @@
+ /etc/dhcpd\.conf -- system_u:object_r:dhcp_etc_t
+ /etc/dhcp3(/.*)? system_u:object_r:dhcp_etc_t
+ /usr/sbin/dhcpd.* -- system_u:object_r:dhcpd_exec_t
+-/var/lib/dhcp(3)?/dhcpd\.leases.* -- system_u:object_r:dhcpd_state_t
++/var/lib/dhcp([3d])?/dhcpd\.leases.* -- system_u:object_r:dhcpd_state_t
+ /var/run/dhcpd\.pid -- system_u:object_r:dhcpd_var_run_t
+ ifdef(`dhcp_defined', `', `
+-/var/lib/dhcp(3)? -d system_u:object_r:dhcp_state_t
++/var/lib/dhcp([3d])? -d system_u:object_r:dhcp_state_t
+ define(`dhcp_defined')
+ ')
+
@@ -13,6 +13,7 @@
/etc/dhcp -d system_u:object_r:dhcp_etc_t
/etc/dhcp(/.*)? -- system_u:object_r:dhcp_etc_t
@@ -2222,6 +2282,16 @@
/usr/bin/rsync -- system_u:object_r:rsync_exec_t
-/srv/([^/]*/)?rsync(/.*)? system_u:object_r:ftpd_anon_t
+/srv/([^/]*/)?rsync(/.*)? system_u:object_r:public_content_t
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/squid.fc policy-1.27.1/file_contexts/program/squid.fc
+--- nsapolicy/file_contexts/program/squid.fc 2005-09-12 16:40:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/squid.fc 2005-10-17 10:03:53.000000000 -0400
+@@ -6,3 +6,6 @@
+ /etc/squid(/.*)? system_u:object_r:squid_conf_t
+ /var/run/squid\.pid -- system_u:object_r:squid_var_run_t
+ /usr/share/squid(/.*)? system_u:object_r:squid_conf_t
++ifdef(`httpd.te', `
++/usr/lib/squid/cachemgr.cgi -- system_u:object_r:httpd_exec_t
++')
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/xdm.fc policy-1.27.1/file_contexts/program/xdm.fc
--- nsapolicy/file_contexts/program/xdm.fc 2005-09-12 16:40:27.000000000 -0400
+++ policy-1.27.1/file_contexts/program/xdm.fc 2005-09-27 17:14:40.000000000 -0400
@@ -2250,7 +2320,7 @@
/etc/ypserv\.conf -- system_u:object_r:ypserv_conf_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/types.fc policy-1.27.1/file_contexts/types.fc
--- nsapolicy/file_contexts/types.fc 2005-09-16 11:17:10.000000000 -0400
-+++ policy-1.27.1/file_contexts/types.fc 2005-09-27 17:14:40.000000000 -0400
++++ policy-1.27.1/file_contexts/types.fc 2005-10-15 14:02:25.000000000 -0400
@@ -133,6 +133,7 @@
/dev/dcbri[0-9]+ -c system_u:object_r:tty_device_t
/dev/irlpt[0-9]+ -c system_u:object_r:printer_device_t
@@ -2267,15 +2337,22 @@
#
# initrd mount point, only used during boot
+@@ -511,3 +513,5 @@
+ #
+ /srv(/.*)? system_u:object_r:var_t
+
++/etc/sysconfig/network-scripts/ifup-.* -- system_u:object_r:bin_t
++/etc/sysconfig/network-scripts/ifdown-.* -- system_u:object_r:bin_t
diff --exclude-from=exclude -N -u -r nsapolicy/genfs_contexts policy-1.27.1/genfs_contexts
--- nsapolicy/genfs_contexts 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/genfs_contexts 2005-10-06 17:35:05.000000000 -0400
-@@ -94,7 +94,7 @@
++++ policy-1.27.1/genfs_contexts 2005-10-17 08:30:31.000000000 -0400
+@@ -94,7 +94,8 @@
genfscon debugfs / system_u:object_r:debugfs_t
genfscon inotifyfs / system_u:object_r:inotifyfs_t
genfscon hugetlbfs / system_u:object_r:hugetlbfs_t
-genfscon mqueue / system_u:object_r:mqueue_t
+genfscon capifs / system_u:object_r:capifs_t
++genfscon configfs / system_u:object_r:configfs_t
# needs more work
genfscon eventpollfs / system_u:object_r:eventpollfs_t
@@ -2793,139 +2870,203 @@
diff --exclude-from=exclude -N -u -r nsapolicy/mcs policy-1.27.1/mcs
--- nsapolicy/mcs 2005-09-15 16:13:03.000000000 -0400
-+++ policy-1.27.1/mcs 2005-10-05 09:43:32.000000000 -0400
-@@ -146,13 +146,141 @@
- category c125;
- category c126;
- category c127;
-+category c128;
-+category c129;
-+category c130;
-+category c131;
-+category c132;
-+category c133;
-+category c134;
-+category c135;
-+category c136;
-+category c137;
-+category c138;
-+category c139;
-+category c140;
-+category c141;
-+category c142;
-+category c143;
-+category c144;
-+category c145;
-+category c146;
-+category c147;
-+category c148;
-+category c149;
-+category c150;
-+category c151;
-+category c152;
-+category c153;
-+category c154;
-+category c155;
-+category c156;
-+category c157;
-+category c158;
-+category c159;
-+category c160;
-+category c161;
-+category c162;
-+category c163;
-+category c164;
-+category c165;
-+category c166;
-+category c167;
-+category c168;
-+category c169;
-+category c170;
-+category c171;
-+category c172;
-+category c173;
-+category c174;
-+category c175;
-+category c176;
-+category c177;
-+category c178;
-+category c179;
-+category c180;
-+category c181;
-+category c182;
-+category c183;
-+category c184;
-+category c185;
-+category c186;
-+category c187;
-+category c188;
-+category c189;
-+category c190;
-+category c191;
-+category c192;
-+category c193;
-+category c194;
-+category c195;
-+category c196;
-+category c197;
-+category c198;
-+category c199;
-+category c200;
-+category c201;
-+category c202;
-+category c203;
-+category c204;
-+category c205;
-+category c206;
-+category c207;
-+category c208;
-+category c209;
-+category c210;
-+category c211;
-+category c212;
-+category c213;
-+category c214;
-+category c215;
-+category c216;
-+category c217;
-+category c218;
-+category c219;
-+category c220;
-+category c221;
-+category c222;
-+category c223;
-+category c224;
-+category c225;
-+category c226;
-+category c227;
-+category c228;
-+category c229;
-+category c230;
-+category c231;
-+category c232;
-+category c233;
-+category c234;
-+category c235;
-+category c236;
-+category c237;
-+category c238;
-+category c239;
-+category c240;
-+category c241;
-+category c242;
-+category c243;
-+category c244;
-+category c245;
-+category c246;
-+category c247;
-+category c248;
-+category c249;
-+category c250;
-+category c251;
-+category c252;
-+category c253;
-+category c254;
-+category c255;
++++ policy-1.27.1/mcs 2005-10-14 08:06:48.000000000 -0400
+@@ -18,141 +18,77 @@
+ #
+ # Each category has a name and zero or more aliases.
+ #
+-category c0;
+-category c1;
+-category c2;
+-category c3;
+-category c4;
+-category c5;
+-category c6;
+-category c7;
+-category c8;
+-category c9;
+-category c10;
+-category c11;
+-category c12;
+-category c13;
+-category c14;
+-category c15;
+-category c16;
+-category c17;
+-category c18;
+-category c19;
+-category c20;
+-category c21;
+-category c22;
+-category c23;
+-category c24;
+-category c25;
+-category c26;
+-category c27;
+-category c28;
+-category c29;
+-category c30;
+-category c31;
+-category c32;
+-category c33;
+-category c34;
+-category c35;
+-category c36;
+-category c37;
+-category c38;
+-category c39;
+-category c40;
+-category c41;
+-category c42;
+-category c43;
+-category c44;
+-category c45;
+-category c46;
+-category c47;
+-category c48;
+-category c49;
+-category c50;
+-category c51;
+-category c52;
+-category c53;
+-category c54;
+-category c55;
+-category c56;
+-category c57;
+-category c58;
+-category c59;
+-category c60;
+-category c61;
+-category c62;
+-category c63;
+-category c64;
+-category c65;
+-category c66;
+-category c67;
+-category c68;
+-category c69;
+-category c70;
+-category c71;
+-category c72;
+-category c73;
+-category c74;
+-category c75;
+-category c76;
+-category c77;
+-category c78;
+-category c79;
+-category c80;
+-category c81;
+-category c82;
+-category c83;
+-category c84;
+-category c85;
+-category c86;
+-category c87;
+-category c88;
+-category c89;
+-category c90;
+-category c91;
+-category c92;
+-category c93;
+-category c94;
+-category c95;
+-category c96;
+-category c97;
+-category c98;
+-category c99;
+-category c100;
+-category c101;
+-category c102;
+-category c103;
+-category c104;
+-category c105;
+-category c106;
+-category c107;
+-category c108;
+-category c109;
+-category c110;
+-category c111;
+-category c112;
+-category c113;
+-category c114;
+-category c115;
+-category c116;
+-category c117;
+-category c118;
+-category c119;
+-category c120;
+-category c121;
+-category c122;
+-category c123;
+-category c124;
+-category c125;
+-category c126;
+-category c127;
++category c0; category c1; category c2; category c3;
++category c4; category c5; category c6; category c7;
++category c8; category c9; category c10; category c11;
++category c12; category c13; category c14; category c15;
++category c16; category c17; category c18; category c19;
++category c20; category c21; category c22; category c23;
++category c24; category c25; category c26; category c27;
++category c28; category c29; category c30; category c31;
++category c32; category c33; category c34; category c35;
++category c36; category c37; category c38; category c39;
++category c40; category c41; category c42; category c43;
++category c44; category c45; category c46; category c47;
++category c48; category c49; category c50; category c51;
++category c52; category c53; category c54; category c55;
++category c56; category c57; category c58; category c59;
++category c60; category c61; category c62; category c63;
++category c64; category c65; category c66; category c67;
++category c68; category c69; category c70; category c71;
++category c72; category c73; category c74; category c75;
++category c76; category c77; category c78; category c79;
++category c80; category c81; category c82; category c83;
++category c84; category c85; category c86; category c87;
++category c88; category c89; category c90; category c91;
++category c92; category c93; category c94; category c95;
++category c96; category c97; category c98; category c99;
++category c100; category c101; category c102; category c103;
++category c104; category c105; category c106; category c107;
++category c108; category c109; category c110; category c111;
++category c112; category c113; category c114; category c115;
++category c116; category c117; category c118; category c119;
++category c120; category c121; category c122; category c123;
++category c124; category c125; category c126; category c127;
++category c128; category c129; category c130; category c131;
++category c132; category c133; category c134; category c135;
++category c136; category c137; category c138; category c139;
++category c140; category c141; category c142; category c143;
++category c144; category c145; category c146; category c147;
++category c148; category c149; category c150; category c151;
++category c152; category c153; category c154; category c155;
++category c156; category c157; category c158; category c159;
++category c160; category c161; category c162; category c163;
++category c164; category c165; category c166; category c167;
++category c168; category c169; category c170; category c171;
++category c172; category c173; category c174; category c175;
++category c176; category c177; category c178; category c179;
++category c180; category c181; category c182; category c183;
++category c184; category c185; category c186; category c187;
++category c188; category c189; category c190; category c191;
++category c192; category c193; category c194; category c195;
++category c196; category c197; category c198; category c199;
++category c200; category c201; category c202; category c203;
++category c204; category c205; category c206; category c207;
++category c208; category c209; category c210; category c211;
++category c212; category c213; category c214; category c215;
++category c216; category c217; category c218; category c219;
++category c220; category c221; category c222; category c223;
++category c224; category c225; category c226; category c227;
++category c228; category c229; category c230; category c231;
++category c232; category c233; category c234; category c235;
++category c236; category c237; category c238; category c239;
++category c240; category c241; category c242; category c243;
++category c244; category c245; category c246; category c247;
++category c248; category c249; category c250; category c251;
++category c252; category c253; category c254; category c255;
#
@@ -2937,7 +3078,7 @@
#
# Define the MCS policy
-@@ -200,9 +328,23 @@
+@@ -200,9 +136,23 @@
#
# Only files are constrained by MCS at this stage.
#
@@ -2964,7 +3105,7 @@
#
diff --exclude-from=exclude -N -u -r nsapolicy/mls policy-1.27.1/mls
--- nsapolicy/mls 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/mls 2005-10-13 09:27:34.000000000 -0400
++++ policy-1.27.1/mls 2005-10-14 08:07:13.000000000 -0400
@@ -13,12 +13,17 @@
sensitivity s7;
sensitivity s8;
@@ -2985,138 +3126,202 @@
#
-@@ -154,22 +159,156 @@
- category c125;
- category c126;
- category c127;
-+category c128;
-+category c129;
-+category c130;
-+category c131;
-+category c132;
-+category c133;
-+category c134;
-+category c135;
-+category c136;
-+category c137;
-+category c138;
-+category c139;
-+category c140;
-+category c141;
-+category c142;
-+category c143;
-+category c144;
-+category c145;
-+category c146;
-+category c147;
-+category c148;
-+category c149;
-+category c150;
-+category c151;
-+category c152;
-+category c153;
-+category c154;
-+category c155;
-+category c156;
-+category c157;
-+category c158;
-+category c159;
-+category c160;
-+category c161;
-+category c162;
-+category c163;
-+category c164;
-+category c165;
-+category c166;
-+category c167;
-+category c168;
-+category c169;
-+category c170;
-+category c171;
-+category c172;
-+category c173;
-+category c174;
-+category c175;
-+category c176;
-+category c177;
-+category c178;
-+category c179;
-+category c180;
-+category c181;
-+category c182;
-+category c183;
-+category c184;
-+category c185;
-+category c186;
-+category c187;
-+category c188;
-+category c189;
-+category c190;
-+category c191;
-+category c192;
-+category c193;
-+category c194;
-+category c195;
-+category c196;
-+category c197;
-+category c198;
-+category c199;
-+category c200;
-+category c201;
-+category c202;
-+category c203;
-+category c204;
-+category c205;
-+category c206;
-+category c207;
-+category c208;
-+category c209;
-+category c210;
-+category c211;
-+category c212;
-+category c213;
-+category c214;
-+category c215;
-+category c216;
-+category c217;
-+category c218;
-+category c219;
-+category c220;
-+category c221;
-+category c222;
-+category c223;
-+category c224;
-+category c225;
-+category c226;
-+category c227;
-+category c228;
-+category c229;
-+category c230;
-+category c231;
-+category c232;
-+category c233;
-+category c234;
-+category c235;
-+category c236;
-+category c237;
-+category c238;
-+category c239;
-+category c240;
-+category c241;
-+category c242;
-+category c243;
-+category c244;
-+category c245;
-+category c246;
-+category c247;
-+category c248;
-+category c249;
-+category c250;
-+category c251;
-+category c252;
-+category c253;
-+category c254;
-+category c255;
+@@ -26,150 +31,92 @@
+ #
+ # Each category has a name and zero or more aliases.
+ #
+-category c0;
+-category c1;
+-category c2;
+-category c3;
+-category c4;
+-category c5;
+-category c6;
+-category c7;
+-category c8;
+-category c9;
+-category c10;
+-category c11;
+-category c12;
+-category c13;
+-category c14;
+-category c15;
+-category c16;
+-category c17;
+-category c18;
+-category c19;
+-category c20;
+-category c21;
+-category c22;
+-category c23;
+-category c24;
+-category c25;
+-category c26;
+-category c27;
+-category c28;
+-category c29;
+-category c30;
+-category c31;
+-category c32;
+-category c33;
+-category c34;
+-category c35;
+-category c36;
+-category c37;
+-category c38;
+-category c39;
+-category c40;
+-category c41;
+-category c42;
+-category c43;
+-category c44;
+-category c45;
+-category c46;
+-category c47;
+-category c48;
+-category c49;
+-category c50;
+-category c51;
+-category c52;
+-category c53;
+-category c54;
+-category c55;
+-category c56;
+-category c57;
+-category c58;
+-category c59;
+-category c60;
+-category c61;
+-category c62;
+-category c63;
+-category c64;
+-category c65;
+-category c66;
+-category c67;
+-category c68;
+-category c69;
+-category c70;
+-category c71;
+-category c72;
+-category c73;
+-category c74;
+-category c75;
+-category c76;
+-category c77;
+-category c78;
+-category c79;
+-category c80;
+-category c81;
+-category c82;
+-category c83;
+-category c84;
+-category c85;
+-category c86;
+-category c87;
+-category c88;
+-category c89;
+-category c90;
+-category c91;
+-category c92;
+-category c93;
+-category c94;
+-category c95;
+-category c96;
+-category c97;
+-category c98;
+-category c99;
+-category c100;
+-category c101;
+-category c102;
+-category c103;
+-category c104;
+-category c105;
+-category c106;
+-category c107;
+-category c108;
+-category c109;
+-category c110;
+-category c111;
+-category c112;
+-category c113;
+-category c114;
+-category c115;
+-category c116;
+-category c117;
+-category c118;
+-category c119;
+-category c120;
+-category c121;
+-category c122;
+-category c123;
+-category c124;
+-category c125;
+-category c126;
+-category c127;
++category c0; category c1; category c2; category c3;
++category c4; category c5; category c6; category c7;
++category c8; category c9; category c10; category c11;
++category c12; category c13; category c14; category c15;
++category c16; category c17; category c18; category c19;
++category c20; category c21; category c22; category c23;
++category c24; category c25; category c26; category c27;
++category c28; category c29; category c30; category c31;
++category c32; category c33; category c34; category c35;
++category c36; category c37; category c38; category c39;
++category c40; category c41; category c42; category c43;
++category c44; category c45; category c46; category c47;
++category c48; category c49; category c50; category c51;
++category c52; category c53; category c54; category c55;
++category c56; category c57; category c58; category c59;
++category c60; category c61; category c62; category c63;
++category c64; category c65; category c66; category c67;
++category c68; category c69; category c70; category c71;
++category c72; category c73; category c74; category c75;
++category c76; category c77; category c78; category c79;
++category c80; category c81; category c82; category c83;
++category c84; category c85; category c86; category c87;
++category c88; category c89; category c90; category c91;
++category c92; category c93; category c94; category c95;
++category c96; category c97; category c98; category c99;
++category c100; category c101; category c102; category c103;
++category c104; category c105; category c106; category c107;
++category c108; category c109; category c110; category c111;
++category c112; category c113; category c114; category c115;
++category c116; category c117; category c118; category c119;
++category c120; category c121; category c122; category c123;
++category c124; category c125; category c126; category c127;
++category c128; category c129; category c130; category c131;
++category c132; category c133; category c134; category c135;
++category c136; category c137; category c138; category c139;
++category c140; category c141; category c142; category c143;
++category c144; category c145; category c146; category c147;
++category c148; category c149; category c150; category c151;
++category c152; category c153; category c154; category c155;
++category c156; category c157; category c158; category c159;
++category c160; category c161; category c162; category c163;
++category c164; category c165; category c166; category c167;
++category c168; category c169; category c170; category c171;
++category c172; category c173; category c174; category c175;
++category c176; category c177; category c178; category c179;
++category c180; category c181; category c182; category c183;
++category c184; category c185; category c186; category c187;
++category c188; category c189; category c190; category c191;
++category c192; category c193; category c194; category c195;
++category c196; category c197; category c198; category c199;
++category c200; category c201; category c202; category c203;
++category c204; category c205; category c206; category c207;
++category c208; category c209; category c210; category c211;
++category c212; category c213; category c214; category c215;
++category c216; category c217; category c218; category c219;
++category c220; category c221; category c222; category c223;
++category c224; category c225; category c226; category c227;
++category c228; category c229; category c230; category c231;
++category c232; category c233; category c234; category c235;
++category c236; category c237; category c238; category c239;
++category c240; category c241; category c242; category c243;
++category c244; category c245; category c246; category c247;
++category c248; category c249; category c250; category c251;
++category c252; category c253; category c254; category c255;
#
@@ -3306,7 +3511,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/types/file.te policy-1.27.1/types/file.te
--- nsapolicy/types/file.te 2005-09-16 11:17:12.000000000 -0400
-+++ policy-1.27.1/types/file.te 2005-09-27 17:14:40.000000000 -0400
++++ policy-1.27.1/types/file.te 2005-10-17 08:29:53.000000000 -0400
@@ -307,8 +307,7 @@
type hugetlbfs_t, mount_point, fs_type, sysadmfile;
allow hugetlbfs_t self:filesystem associate;
@@ -3317,7 +3522,13 @@
# udev_runtime_t is the type of the udev table file
type udev_runtime_t, file_type, sysadmfile;
-@@ -325,6 +324,9 @@
+@@ -322,9 +321,15 @@
+ type debugfs_t, fs_type, sysadmfile;
+ allow debugfs_t self:filesystem associate;
+
++type configfs_t, fs_type, sysadmfile;
++allow configfs_t self:filesystem associate;
++
type inotifyfs_t, fs_type, sysadmfile;
allow inotifyfs_t self:filesystem associate;
@@ -3327,7 +3538,7 @@
# removable_t is the default type of all removable media
type removable_t, file_type, sysadmfile, usercanread;
allow removable_t self:filesystem associate;
-@@ -332,11 +334,16 @@
+@@ -332,11 +337,16 @@
allow file_type noexattrfile:filesystem associate;
# Type for anonymous FTP data, used by ftp and rsync
Index: selinux-policy-targeted.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/devel/selinux-policy-targeted.spec,v
retrieving revision 1.388
retrieving revision 1.389
diff -u -r1.388 -r1.389
--- selinux-policy-targeted.spec 13 Oct 2005 21:42:47 -0000 1.388
+++ selinux-policy-targeted.spec 17 Oct 2005 19:58:26 -0000 1.389
@@ -10,7 +10,7 @@
Summary: SELinux %{type} policy configuration
Name: selinux-policy-%{type}
Version: 1.27.1
-Release: 17
+Release: 18
License: GPL
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -248,6 +248,13 @@
exit 0
%changelog
+* Mon Oct 17 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-18
+- Cleanup category defs
+- Add configfs_t
+- Allow http to run with mod_ftpd
+- Fix initrc_exec_t scripts to run with the correct securitylevel
+- Fixes for postfix_local
+
* Thu Oct 13 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-17
- Fix protections on seusers
- Add disable_postfix_trans boolean
More information about the fedora-cvs-commits
mailing list