rpms/selinux-policy-strict/devel policy-20051021.patch, 1.9, 1.10 selinux-policy-strict.spec, 1.408, 1.409
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Fri Oct 28 19:22:28 UTC 2005
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy-strict/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv11460
Modified Files:
policy-20051021.patch selinux-policy-strict.spec
Log Message:
* Fri Oct 28 2005 Dan Walsh <dwalsh at redhat.com> 1.27.2-9
- Add avahi policy
policy-20051021.patch:
Makefile | 14 -
attrib.te | 18 +
domains/admin.te | 2
domains/misc/kernel.te | 2
domains/program/fsadm.te | 2
domains/program/ifconfig.te | 2
domains/program/init.te | 2
domains/program/initrc.te | 13 +
domains/program/logrotate.te | 2
domains/program/modutil.te | 8
domains/program/newrole.te | 4
domains/program/restorecon.te | 4
domains/program/setfiles.te | 2
domains/program/ssh.te | 2
domains/program/su.te | 4
domains/program/syslogd.te | 4
domains/program/tmpreaper.te | 2
domains/program/unused/NetworkManager.te | 10 +
domains/program/unused/amanda.te | 21 +-
domains/program/unused/apache.te | 15 +
domains/program/unused/apmd.te | 13 +
domains/program/unused/auditd.te | 6
domains/program/unused/avahi.te | 29 ++
domains/program/unused/bluetooth.te | 57 +++++
domains/program/unused/cups.te | 11 -
domains/program/unused/dbusd.te | 2
domains/program/unused/dhcpc.te | 3
domains/program/unused/dhcpd.te | 3
domains/program/unused/exim.te | 309 +++++++++++++++++++++++++++++++
domains/program/unused/ftpd.te | 6
domains/program/unused/hald.te | 5
domains/program/unused/hotplug.te | 5
domains/program/unused/ipsec.te | 2
domains/program/unused/kudzu.te | 3
domains/program/unused/mysqld.te | 6
domains/program/unused/named.te | 17 +
domains/program/unused/nscd.te | 1
domains/program/unused/ntpd.te | 5
domains/program/unused/pamconsole.te | 2
domains/program/unused/pegasus.te | 16 +
domains/program/unused/ping.te | 2
domains/program/unused/postfix.te | 54 +++--
domains/program/unused/postgresql.te | 11 -
domains/program/unused/pppd.te | 22 +-
domains/program/unused/rpcd.te | 16 +
domains/program/unused/rpm.te | 4
domains/program/unused/rsync.te | 3
domains/program/unused/samba.te | 3
domains/program/unused/sendmail.te | 3
domains/program/unused/snmpd.te | 1
domains/program/unused/spamd.te | 28 --
domains/program/unused/udev.te | 8
domains/program/unused/webalizer.te | 3
domains/program/unused/xdm.te | 2
domains/program/unused/yppasswdd.te | 40 ++++
file_contexts/distros.fc | 1
file_contexts/program/apache.fc | 2
file_contexts/program/avahi.fc | 4
file_contexts/program/backup.fc | 2
file_contexts/program/bluetooth.fc | 2
file_contexts/program/dhcpc.fc | 1
file_contexts/program/dhcpd.fc | 5
file_contexts/program/exim.fc | 18 +
file_contexts/program/ftpd.fc | 5
file_contexts/program/games.fc | 3
file_contexts/program/kudzu.fc | 2
file_contexts/program/pegasus.fc | 6
file_contexts/program/rshd.fc | 1
file_contexts/program/rsync.fc | 2
file_contexts/program/squid.fc | 3
file_contexts/program/yppasswdd.fc | 2
file_contexts/types.fc | 4
genfs_contexts | 1
macros/base_user_macros.te | 7
macros/global_macros.te | 25 --
macros/home_macros.te | 9
macros/program/chkpwd_macros.te | 7
macros/program/dbusd_macros.te | 1
macros/program/exim_macros.te | 75 +++++++
macros/program/su_macros.te | 2
macros/program/ypbind_macros.te | 1
macros/user_macros.te | 1
man/man8/ftpd_selinux.8 | 19 +
man/man8/httpd_selinux.8 | 9
man/man8/rsync_selinux.8 | 12 -
man/man8/samba_selinux.8 | 9
mcs | 194 ++++++-------------
mls | 227 ++++++++--------------
targeted/assert.te | 2
targeted/domains/program/sendmail.te | 1
targeted/domains/program/ssh.te | 2
targeted/domains/program/xdm.te | 4
targeted/domains/unconfined.te | 7
tunables/distro.tun | 2
tunables/tunable.tun | 4
types/devpts.te | 4
types/file.te | 43 +---
types/network.te | 10 -
types/nfs.te | 1
types/security.te | 2
100 files changed, 1069 insertions(+), 509 deletions(-)
Index: policy-20051021.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/policy-20051021.patch,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- policy-20051021.patch 28 Oct 2005 14:41:47 -0000 1.9
+++ policy-20051021.patch 28 Oct 2005 19:22:25 -0000 1.10
@@ -227,12 +227,12 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/restorecon.te policy-1.27.2/domains/program/restorecon.te
--- nsapolicy/domains/program/restorecon.te 2005-10-21 11:36:15.000000000 -0400
-+++ policy-1.27.2/domains/program/restorecon.te 2005-10-27 10:26:28.000000000 -0400
++++ policy-1.27.2/domains/program/restorecon.te 2005-10-28 10:58:06.000000000 -0400
@@ -63,3 +63,7 @@
allow restorecon_t kernel_t:fifo_file { read write };
allow restorecon_t kernel_t:unix_dgram_socket { read write };
r_dir_file(restorecon_t, { selinux_config_t file_context_t default_context_t } )
-+allow restorecon_t autofs_t:dir search;
++allow restorecon_t autofs_t:dir r_dir_perms;
+ifdef(`targeted_policy', `
+allow restorecon_t devpts_t:chr_file getattr;
+')
@@ -446,6 +446,39 @@
allow auditd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay nlmsg_readpriv };
allow auditd_t self:unix_dgram_socket create_socket_perms;
allow auditd_t self:capability { audit_write audit_control sys_nice sys_resource };
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/avahi.te policy-1.27.2/domains/program/unused/avahi.te
+--- nsapolicy/domains/program/unused/avahi.te 1969-12-31 19:00:00.000000000 -0500
++++ policy-1.27.2/domains/program/unused/avahi.te 2005-10-28 15:20:50.000000000 -0400
+@@ -0,0 +1,29 @@
++#DESC avahi - mDNS/DNS-SD daemon implementing Apple’s ZeroConf architecture
++#
++# Author: Dan Walsh <dwalsh at redhat.com>
++#
++
++daemon_domain(avahi, `, privsysmod')
++r_dir_file(avahi_t, proc_net_t)
++can_network_server(avahi_t)
++can_ypbind(avahi_t)
++allow avahi_t self:unix_stream_socket { connectto create_stream_socket_perms };
++allow avahi_t self:unix_dgram_socket create_socket_perms;
++allow avahi_t self:capability { dac_override setgid chown kill setuid };
++allow avahi_t urandom_device_t:chr_file r_file_perms;
++allow avahi_t howl_port_t:{ udp_socket tcp_socket } name_bind;
++allow avahi_t self:fifo_file { read write };
++allow avahi_t self:netlink_route_socket r_netlink_socket_perms;
++allow avahi_t self:process setrlimit;
++allow avahi_t etc_t:file { getattr read };
++allow avahi_t initrc_t:process { signal signull };
++allow avahi_t system_dbusd_t:dbus { acquire_svc send_msg };
++allow avahi_t avahi_var_run_t:dir setattr;
++allow avahi_t avahi_var_run_t:sock_file create_file_perms;
++
++ifdef(`dbusd.te', `
++dbusd_client(system, avahi)
++allow avahi_t unconfined_t:dbus send_msg;
++allow unconfined_t avahi_t:dbus send_msg;
++')
++
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/bluetooth.te policy-1.27.2/domains/program/unused/bluetooth.te
--- nsapolicy/domains/program/unused/bluetooth.te 2005-10-21 11:36:15.000000000 -0400
+++ policy-1.27.2/domains/program/unused/bluetooth.te 2005-10-27 10:26:28.000000000 -0400
@@ -1190,7 +1223,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/postfix.te policy-1.27.2/domains/program/unused/postfix.te
--- nsapolicy/domains/program/unused/postfix.te 2005-10-21 11:36:15.000000000 -0400
-+++ policy-1.27.2/domains/program/unused/postfix.te 2005-10-27 10:26:28.000000000 -0400
++++ policy-1.27.2/domains/program/unused/postfix.te 2005-10-28 13:42:12.000000000 -0400
@@ -54,6 +54,8 @@
allow postfix_$1_t proc_net_t:dir search;
allow postfix_$1_t proc_net_t:file { getattr read };
@@ -1306,13 +1339,16 @@
allow postfix_local_t postfix_spool_t:file rw_file_perms;
# for .forward - maybe we need a new type for it?
allow postfix_local_t postfix_private_t:dir search;
-@@ -207,7 +213,12 @@
+@@ -207,7 +213,15 @@
allow postfix_local_t postfix_master_t:unix_stream_socket connectto;
allow postfix_local_t postfix_public_t:dir search;
allow postfix_local_t postfix_public_t:sock_file write;
-can_exec(postfix_local_t, shell_exec_t)
+tmp_domain(postfix_local)
+can_exec(postfix_local_t,{ shell_exec_t bin_t })
++ifdef(`spamc.te'
++can_exec(postfix_local_t, spamc_exec_t)
++')
+allow postfix_local_t mail_spool_t:dir { remove_name };
+allow postfix_local_t mail_spool_t:file { unlink };
+# For reading spamassasin
@@ -1320,7 +1356,7 @@
define(`postfix_public_domain',`
postfix_server_domain($1)
-@@ -244,6 +255,7 @@
+@@ -244,6 +258,7 @@
allow postfix_postqueue_t postfix_public_t:dir search;
allow postfix_postqueue_t postfix_public_t:fifo_file getattr;
allow postfix_postqueue_t self:udp_socket { create ioctl };
@@ -1328,7 +1364,15 @@
allow postfix_master_t postfix_postqueue_exec_t:file getattr;
domain_auto_trans(postfix_master_t, postfix_postqueue_exec_t, postfix_postqueue_t)
allow postfix_postqueue_t initrc_t:process sigchld;
-@@ -287,7 +299,9 @@
+@@ -274,6 +289,7 @@
+ dontaudit postfix_showq_t net_conf_t:file r_file_perms;
+
+ postfix_user_domain(postdrop, `, mta_user_agent')
++can_resolve(postfix_postdrop_t)
+ allow postfix_postdrop_t postfix_spool_maildrop_t:dir rw_dir_perms;
+ allow postfix_postdrop_t postfix_spool_maildrop_t:file create_file_perms;
+ allow postfix_postdrop_t user_mail_domain:unix_stream_socket rw_socket_perms;
+@@ -287,7 +303,9 @@
allow postfix_postdrop_t { crond_t system_crond_t }:fifo_file rw_file_perms;')
# usually it does not need a UDP socket
allow postfix_postdrop_t self:udp_socket create_socket_perms;
@@ -1338,7 +1382,7 @@
postfix_public_domain(pickup)
allow postfix_pickup_t postfix_public_t:fifo_file rw_file_perms;
-@@ -352,5 +366,3 @@
+@@ -352,5 +370,3 @@
dontaudit postfix_map_t var_t:dir search;
can_network_server(postfix_map_t)
allow postfix_map_t port_type:tcp_socket name_connect;
@@ -1715,6 +1759,14 @@
/etc/httpd -d system_u:object_r:httpd_config_t
/etc/httpd/conf.* system_u:object_r:httpd_config_t
/etc/httpd/logs system_u:object_r:httpd_log_t
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/avahi.fc policy-1.27.2/file_contexts/program/avahi.fc
+--- nsapolicy/file_contexts/program/avahi.fc 1969-12-31 19:00:00.000000000 -0500
++++ policy-1.27.2/file_contexts/program/avahi.fc 2005-10-28 15:21:02.000000000 -0400
+@@ -0,0 +1,4 @@
++#DESC avahi - mDNS/DNS-SD daemon implementing Apple’s ZeroConf architecture
++/usr/sbin/avahi-daemon -- system_u:object_r:avahi_exec_t:s0
++/usr/sbin/avahi-dnsconfd -- system_u:object_r:avahi_exec_t:s0
++/var/run/avahi-daemon(/.*)? system_u:object_r:avahi_var_run_t:s0
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/backup.fc policy-1.27.2/file_contexts/program/backup.fc
--- nsapolicy/file_contexts/program/backup.fc 2005-10-21 11:36:15.000000000 -0400
+++ policy-1.27.2/file_contexts/program/backup.fc 2005-10-27 10:26:28.000000000 -0400
Index: selinux-policy-strict.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/selinux-policy-strict.spec,v
retrieving revision 1.408
retrieving revision 1.409
diff -u -r1.408 -r1.409
--- selinux-policy-strict.spec 28 Oct 2005 14:41:47 -0000 1.408
+++ selinux-policy-strict.spec 28 Oct 2005 19:22:25 -0000 1.409
@@ -9,7 +9,7 @@
Summary: SELinux %{type} policy configuration
Name: selinux-policy-%{type}
Version: 1.27.2
-Release: 8
+Release: 9
License: GPL
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -245,6 +245,9 @@
exit 0
%changelog
+* Fri Oct 28 2005 Dan Walsh <dwalsh at redhat.com> 1.27.2-9
+- Add avahi policy
+
* Fri Oct 28 2005 Dan Walsh <dwalsh at redhat.com> 1.27.2-8
- Allow spamd to rewrite ~/.spamassin file
More information about the fedora-cvs-commits
mailing list