rpms/selinux-policy-strict/devel policy-20050606.patch, 1.12, 1.13 selinux-policy-strict.spec, 1.329, 1.330 selinux.csh, 1.4, 1.5 selinux.sh, 1.4, 1.5
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Sat Jun 18 03:11:32 UTC 2005
- Previous message (by thread): rpms/mod_perl/FC-4 .cvsignore, 1.14, 1.15 mod_perl.spec, 1.29, 1.30 sources, 1.14, 1.15
- Next message (by thread): rpms/selinux-policy-targeted/devel policy-20050606.patch, 1.10, 1.11 selinux-policy-targeted.spec, 1.323, 1.324
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy-strict/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv29902
Modified Files:
policy-20050606.patch selinux-policy-strict.spec selinux.csh
selinux.sh
Log Message:
* Fri Jun 17 2005 Dan Walsh <dwalsh at redhat.com> 1.23.18-12
- Fix NetworkManager policy
- Fix dovecot cert labeleing
policy-20050606.patch:
Makefile | 14 -
attrib.te | 2
domains/misc/kernel.te | 7
domains/misc/local.te | 5
domains/program/fsadm.te | 5
domains/program/init.te | 4
domains/program/initrc.te | 11 +
domains/program/klogd.te | 2
domains/program/login.te | 2
domains/program/modutil.te | 2
domains/program/mount.te | 4
domains/program/restorecon.te | 5
domains/program/ssh.te | 2
domains/program/syslogd.te | 2
domains/program/unused/NetworkManager.te | 5
domains/program/unused/acct.te | 2
domains/program/unused/alsa.te | 17 ++
domains/program/unused/amanda.te | 5
domains/program/unused/apache.te | 2
domains/program/unused/auditd.te | 2
domains/program/unused/bonobo.te | 9 +
domains/program/unused/consoletype.te | 2
domains/program/unused/cups.te | 30 +++
domains/program/unused/dhcpc.te | 14 +
domains/program/unused/ethereal.te | 48 ++++++
domains/program/unused/evolution.te | 13 +
domains/program/unused/gconf.te | 12 +
domains/program/unused/gift.te | 1
domains/program/unused/gnome.te | 7
domains/program/unused/gnome_vfs.te | 9 +
domains/program/unused/gpg.te | 3
domains/program/unused/hotplug.te | 2
domains/program/unused/i18n_input.te | 4
domains/program/unused/iceauth.te | 12 +
domains/program/unused/innd.te | 1
domains/program/unused/mozilla.te | 6
domains/program/unused/mysqld.te | 3
domains/program/unused/nscd.te | 1
domains/program/unused/orbit.te | 7
domains/program/unused/pam.te | 5
domains/program/unused/pamconsole.te | 2
domains/program/unused/ping.te | 2
domains/program/unused/rpcd.te | 5
domains/program/unused/samba.te | 3
domains/program/unused/thunderbird.te | 9 +
domains/program/unused/udev.te | 2
domains/program/unused/utempter.te | 5
domains/program/unused/xdm.te | 22 ++
domains/program/unused/xserver.te | 3
domains/user.te | 14 +
file_contexts/distros.fc | 21 --
file_contexts/program/alsa.fc | 3
file_contexts/program/apache.fc | 2
file_contexts/program/bonobo.fc | 1
file_contexts/program/cups.fc | 3
file_contexts/program/ethereal.fc | 3
file_contexts/program/evolution.fc | 8 +
file_contexts/program/fontconfig.fc | 6
file_contexts/program/gconf.fc | 5
file_contexts/program/gnome.fc | 8 +
file_contexts/program/gnome_vfs.fc | 1
file_contexts/program/iceauth.fc | 3
file_contexts/program/irc.fc | 2
file_contexts/program/mozilla.fc | 4
file_contexts/program/orbit.fc | 3
file_contexts/program/thunderbird.fc | 2
file_contexts/program/xauth.fc | 1
file_contexts/program/xdm.fc | 1
file_contexts/program/xserver.fc | 2
file_contexts/types.fc | 5
macros/admin_macros.te | 12 +
macros/base_user_macros.te | 75 ++++++---
macros/content_macros.te | 185 +++++++++++++++++++++++
macros/global_macros.te | 121 +--------------
macros/home_macros.te | 130 ++++++++++++++++
macros/program/bonobo_macros.te | 119 +++++++++++++++
macros/program/dbusd_macros.te | 3
macros/program/ethereal_macros.te | 83 ++++++++++
macros/program/evolution_macros.te | 241 +++++++++++++++++++++++++++++++
macros/program/fontconfig_macros.te | 38 ++++
macros/program/games_domain.te | 38 +---
macros/program/gconf_macros.te | 56 +++++++
macros/program/gift_macros.te | 60 ++-----
macros/program/gnome_macros.te | 115 ++++++++++++++
macros/program/gnome_vfs_macros.te | 49 ++++++
macros/program/gpg_agent_macros.te | 1
macros/program/gpg_macros.te | 45 -----
macros/program/ice_macros.te | 38 ++++
macros/program/iceauth_macros.te | 40 +++++
macros/program/irc_macros.te | 1
macros/program/lpr_macros.te | 24 ---
macros/program/mail_client_macros.te | 48 ++++++
macros/program/mozilla_macros.te | 131 +++++-----------
macros/program/mplayer_macros.te | 15 +
macros/program/orbit_macros.te | 44 +++++
macros/program/pyzor_macros.te | 1
macros/program/razor_macros.te | 1
macros/program/spamassassin_macros.te | 9 -
macros/program/ssh_agent_macros.te | 3
macros/program/thunderbird_macros.te | 57 +++++++
macros/program/tvtime_macros.te | 1
macros/program/userhelper_macros.te | 3
macros/program/x_client_macros.te | 12 -
macros/program/xauth_macros.te | 1
macros/program/xdm_macros.te | 11 +
macros/program/xserver_macros.te | 17 +-
macros/user_macros.te | 8 -
mls | 41 ++---
net_contexts | 31 ++-
targeted/domains/program/crond.te | 2
targeted/domains/unconfined.te | 10 -
tunables/distro.tun | 2
tunables/tunable.tun | 4
types/device.te | 7
types/devpts.te | 2
types/file.te | 8 +
types/network.te | 9 -
types/security.te | 2
118 files changed, 1847 insertions(+), 547 deletions(-)
Index: policy-20050606.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/policy-20050606.patch,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -r1.12 -r1.13
--- policy-20050606.patch 17 Jun 2005 03:33:45 -0000 1.12
+++ policy-20050606.patch 18 Jun 2005 03:11:29 -0000 1.13
@@ -260,6 +260,28 @@
+allow alsa_t devpts_t:chr_file { read write };
+allow alsa_t etc_t:file { getattr read };
+domain_auto_trans(pam_console_t, alsa_exec_t, alsa_t)
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/amanda.te policy-1.23.18/domains/program/unused/amanda.te
+--- nsapolicy/domains/program/unused/amanda.te 2005-06-01 06:11:22.000000000 -0400
++++ policy-1.23.18/domains/program/unused/amanda.te 2005-06-17 15:45:49.000000000 -0400
+@@ -167,7 +167,8 @@
+
+ can_network_server(amanda_t);
+ can_ypbind(amanda_t);
+-
++can_exec(amanda_t, sbin_t);
++
+ allow amanda_t self:fifo_file { getattr read write ioctl lock };
+ allow amanda_t self:unix_stream_socket { connect create read write };
+
+@@ -303,7 +304,7 @@
+
+ allow amanda_t file_type:dir {getattr read search };
+ allow amanda_t file_type:{ lnk_file file chr_file blk_file } {getattr read };
+-allow amanda_t device_type:{ blk_file chr_file } getattr;
++allow amanda_t device_type:{ blk_file chr_file } { getattr read };
+ domain_auto_trans(amanda_t, fsadm_exec_t, fsadm_t)
+
+ dontaudit amanda_t file_type:sock_file getattr;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/apache.te policy-1.23.18/domains/program/unused/apache.te
--- nsapolicy/domains/program/unused/apache.te 2005-05-25 11:28:09.000000000 -0400
+++ policy-1.23.18/domains/program/unused/apache.te 2005-06-08 09:04:15.000000000 -0400
@@ -542,12 +564,22 @@
ifdef(`lpd.te', `
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/i18n_input.te policy-1.23.18/domains/program/unused/i18n_input.te
--- nsapolicy/domains/program/unused/i18n_input.te 2005-05-07 00:41:09.000000000 -0400
-+++ policy-1.23.18/domains/program/unused/i18n_input.te 2005-06-08 09:04:15.000000000 -0400
-@@ -30,3 +30,4 @@
++++ policy-1.23.18/domains/program/unused/i18n_input.te 2005-06-17 22:06:15.000000000 -0400
+@@ -23,6 +23,7 @@
+ allow i18n_input_t self:process { setsched setpgid };
+
+ allow i18n_input_t { bin_t sbin_t }:dir search;
++can_exec(i18n_input_t, bin_t)
+
+ allow i18n_input_t etc_t:file r_file_perms;
+ allow i18n_input_t self:unix_dgram_socket create_socket_perms;
+@@ -30,3 +31,6 @@
allow i18n_input_t i18n_input_var_run_t:dir create_dir_perms;
allow i18n_input_t i18n_input_var_run_t:sock_file create_file_perms;
allow i18n_input_t usr_t:file { getattr read };
+allow i18n_input_t home_root_t:dir search;
++allow i18n_input_t etc_runtime_t:file { getattr read };
++allow i18n_input_t proc_t:file { getattr read };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/iceauth.te policy-1.23.18/domains/program/unused/iceauth.te
--- nsapolicy/domains/program/unused/iceauth.te 1969-12-31 19:00:00.000000000 -0500
+++ policy-1.23.18/domains/program/unused/iceauth.te 2005-06-08 09:04:15.000000000 -0400
@@ -610,7 +642,7 @@
+allow mysqld_t self:netlink_route_socket r_netlink_socket_perms;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/NetworkManager.te policy-1.23.18/domains/program/unused/NetworkManager.te
--- nsapolicy/domains/program/unused/NetworkManager.te 2005-05-02 14:06:54.000000000 -0400
-+++ policy-1.23.18/domains/program/unused/NetworkManager.te 2005-06-16 17:52:42.000000000 -0400
++++ policy-1.23.18/domains/program/unused/NetworkManager.te 2005-06-17 21:59:38.000000000 -0400
@@ -42,6 +42,7 @@
allow named_t NetworkManager_t:udp_socket { read write };
allow named_t NetworkManager_t:netlink_route_socket { read write };
@@ -619,7 +651,15 @@
')
allow NetworkManager_t selinux_config_t:dir search;
-@@ -70,7 +71,7 @@
+@@ -54,6 +55,7 @@
+ allow NetworkManager_t hald_t:dbus send_msg;
+ allow hald_t NetworkManager_t:dbus send_msg;
+ ')
++allow NetworkManager_t self:dbus send_msg;
+ allow NetworkManager_t initrc_t:dbus send_msg;
+ allow initrc_t NetworkManager_t:dbus send_msg;
+ ifdef(`targeted_policy', `
+@@ -70,7 +72,7 @@
allow NetworkManager_t { sbin_t bin_t }:dir search;
allow NetworkManager_t bin_t:lnk_file read;
@@ -628,7 +668,7 @@
# in /etc created by NetworkManager will be labelled net_conf_t.
file_type_auto_trans(NetworkManager_t, etc_t, net_conf_t, file)
-@@ -91,3 +92,4 @@
+@@ -91,3 +93,4 @@
allow NetworkManager_t self:netlink_route_socket r_netlink_socket_perms;
domain_auto_trans(NetworkManager_t, initrc_exec_t, initrc_t)
@@ -708,6 +748,26 @@
-
+allow nfsd_t devtty_t:chr_file rw_file_perms;
+allow rpcd_t devtty_t:chr_file rw_file_perms;
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/samba.te policy-1.23.18/domains/program/unused/samba.te
+--- nsapolicy/domains/program/unused/samba.te 2005-05-25 11:28:10.000000000 -0400
++++ policy-1.23.18/domains/program/unused/samba.te 2005-06-17 07:09:39.000000000 -0400
+@@ -9,7 +9,7 @@
+ # Declarations for Samba
+ #
+
+-daemon_domain(smbd, `, auth_chkpwd')
++daemon_domain(smbd, `, auth_chkpwd, nscd_client_domain')
+ daemon_domain(nmbd)
+ type samba_etc_t, file_type, sysadmfile, usercanread;
+ type samba_log_t, file_type, sysadmfile, logfile;
+@@ -68,6 +68,7 @@
+ allow smbd_t samba_log_t:file { create ra_file_perms };
+ allow smbd_t var_log_t:dir search;
+ allow smbd_t samba_log_t:dir ra_dir_perms;
++dontaudit smbd_t samba_log_t:dir remove_name;
+
+ allow smbd_t usr_t:file { getattr read };
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/thunderbird.te policy-1.23.18/domains/program/unused/thunderbird.te
--- nsapolicy/domains/program/unused/thunderbird.te 1969-12-31 19:00:00.000000000 -0500
+++ policy-1.23.18/domains/program/unused/thunderbird.te 2005-06-08 09:04:15.000000000 -0400
@@ -853,7 +913,7 @@
') dnl reach_sysadm
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/distros.fc policy-1.23.18/file_contexts/distros.fc
--- nsapolicy/file_contexts/distros.fc 2005-05-25 11:28:10.000000000 -0400
-+++ policy-1.23.18/file_contexts/distros.fc 2005-06-16 14:02:43.000000000 -0400
++++ policy-1.23.18/file_contexts/distros.fc 2005-06-17 16:00:50.000000000 -0400
@@ -1,7 +1,6 @@
ifdef(`distro_redhat', `
/usr/share/system-config-network(/netconfig)?/[^/]+\.py -- system_u:object_r:bin_t
@@ -862,7 +922,17 @@
/etc/sysconfig/network-scripts/.*resolv\.conf -- system_u:object_r:net_conf_t
/usr/share/rhn/rhn_applet/applet\.py -- system_u:object_r:bin_t
/usr/share/rhn/rhn_applet/eggtrayiconmodule\.so -- system_u:object_r:shlib_t
-@@ -89,18 +88,9 @@
+@@ -36,9 +35,6 @@
+ /usr/share/texmf/web2c/mktexdir -- system_u:object_r:bin_t
+ /usr/share/texmf/web2c/mktexnam -- system_u:object_r:bin_t
+ /usr/share/texmf/web2c/mktexupd -- system_u:object_r:bin_t
+-/usr/share/ssl/certs(/.*)? system_u:object_r:cert_t
+-/usr/share/ssl/private(/.*)? system_u:object_r:cert_t
+-/etc/pki(/.*)? system_u:object_r:cert_t
+ /etc/rhgb(/.*)? -d system_u:object_r:mnt_t
+ /usr/share/ssl/misc(/.*)? system_u:object_r:bin_t
+ #
+@@ -89,18 +85,9 @@
/usr/X11R6/lib/modules/dri/.*\.so -- system_u:object_r:texrel_shlib_t
/usr/X11R6/lib/libOSMesa\.so.* -- system_u:object_r:texrel_shlib_t
/usr/lib/libHermes\.so.* -- system_u:object_r:texrel_shlib_t
@@ -884,7 +954,7 @@
/usr/lib/.*/program/libicudata\.so.* -- system_u:object_r:texrel_shlib_t
/usr/lib/.*/program/libsts645li\.so -- system_u:object_r:texrel_shlib_t
/usr/lib/.*/program/libvclplug_gen645li\.so -- system_u:object_r:texrel_shlib_t
-@@ -156,7 +146,7 @@
+@@ -156,7 +143,7 @@
/usr(/.*)?/Reader/intellinux/plug_ins/.*\.api -- system_u:object_r:shlib_t
/usr(/.*)?/Reader/intellinux/plug_ins/AcroForm\.api -- system_u:object_r:texrel_shlib_t
/usr(/.*)?/Reader/intellinux/plug_ins/EScript\.api -- system_u:object_r:texrel_shlib_t
@@ -1058,7 +1128,7 @@
/tmp/\.ICE-unix/.* -s <<none>>
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/types.fc policy-1.23.18/file_contexts/types.fc
--- nsapolicy/file_contexts/types.fc 2005-06-01 06:11:22.000000000 -0400
-+++ policy-1.23.18/file_contexts/types.fc 2005-06-14 12:46:58.000000000 -0400
++++ policy-1.23.18/file_contexts/types.fc 2005-06-17 16:00:39.000000000 -0400
@@ -249,6 +249,7 @@
/dev/dri/.+ -c system_u:object_r:dri_device_t
/dev/radeon -c system_u:object_r:dri_device_t
@@ -1067,7 +1137,24 @@
#
# Misc
-@@ -499,6 +500,7 @@
+@@ -354,6 +355,8 @@
+ /usr/share/man(/.*)? system_u:object_r:man_t
+ /usr/share/mc/extfs/.* -- system_u:object_r:bin_t
+ /usr/share(/.*)?/lib(64)?(/.*)? system_u:object_r:usr_t
++/usr/share/ssl/certs(/.*)? system_u:object_r:cert_t
++/usr/share/ssl/private(/.*)? system_u:object_r:cert_t
+
+ # nvidia share libraries
+ /usr/x11R6/lib/modules/extensions/libglx\.so(\.[^/]*)* -- system_u:object_r:texrel_shlib_t
+@@ -471,6 +474,7 @@
+ /usr/lib/locale(/.*)? system_u:object_r:locale_t
+ /etc/localtime -- system_u:object_r:locale_t
+ /etc/localtime -l system_u:object_r:etc_t
++/etc/pki(/.*)? system_u:object_r:cert_t
+
+ #
+ # Gnu Cash
+@@ -499,6 +503,7 @@
#
/usr/lib(64)?/[^/]*thunderbird[^/]*/thunderbird -- system_u:object_r:bin_t
/usr/lib(64)?/[^/]*thunderbird[^/]*/thunderbird-bin -- system_u:object_r:bin_t
Index: selinux-policy-strict.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/selinux-policy-strict.spec,v
retrieving revision 1.329
retrieving revision 1.330
diff -u -r1.329 -r1.330
--- selinux-policy-strict.spec 17 Jun 2005 03:33:45 -0000 1.329
+++ selinux-policy-strict.spec 18 Jun 2005 03:11:29 -0000 1.330
@@ -11,7 +11,7 @@
Summary: SELinux %{type} policy configuration
Name: selinux-policy-%{type}
Version: 1.23.18
-Release: 11
+Release: 12
License: GPL
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -227,6 +227,10 @@
exit 0
%changelog
+* Fri Jun 17 2005 Dan Walsh <dwalsh at redhat.com> 1.23.18-12
+- Fix NetworkManager policy
+- Fix dovecot cert labeleing
+
* Thu Jun 16 2005 Dan Walsh <dwalsh at redhat.com> 1.23.18-11
- Fix NetworkManager dhcpd communications
- Fix hotplug
Index: selinux.csh
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/selinux.csh,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- selinux.csh 16 Jun 2005 18:49:21 -0000 1.4
+++ selinux.csh 18 Jun 2005 03:11:29 -0000 1.5
@@ -1,14 +1,17 @@
[ `/usr/bin/id -u` -gt 500 ] || exit
([ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled) || exit
-set DIRS=" /tmp/orbit-$USER $HOME/.fonts $HOME/.fonts/auto $HOME/.gnome2 $HOME/.gnome2/share/fonts $HOME/.gnome2/share/cursor-fonts $HOME/.gnome2_private $HOME/.gpg $HOME/.mozilla $HOME/.mplayer $HOME/.evolution $HOME/.thunderbird "
+eval set `grep ^SELINUXTYPE /etc/selinux/config`
+
+[ $SELINUXTYPE = strict ] || exit
+
+set DIRS="/tmp/orbit-$USER $HOME/.fonts $HOME/.fonts/auto $HOME/.gnome2 $HOME/.gnome2/share/fonts $HOME/.gnome2/share/cursor-fonts $HOME/.gnome2_private $HOME/.gpg $HOME/.mozilla $HOME/.mplayer $HOME/.evolution $HOME/.thunderbird"
foreach DIR ( $DIRS )
[ -d $DIR ] || mkdir -p $DIR
end
set RESTORED=`/sbin/restorecon -v $DIRS |& cat`
-echo $RESTORED
-if ( `test ! -z "$RESTORED"` ) then
+if ( $status == 0 && "$RESTORED" != "" ) then
set RESULT=`echo "$RESTORED" | awk '{ print $3 }'`
echo "Restoring SELinux context for:"
echo $RESULT | sed 's| |\n|g'
Index: selinux.sh
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/selinux.sh,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- selinux.sh 16 Jun 2005 18:49:21 -0000 1.4
+++ selinux.sh 18 Jun 2005 03:11:29 -0000 1.5
@@ -1,6 +1,11 @@
[ `/usr/bin/id -u` -gt 500 ] || return
+
([ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled) || return
+. /etc/selinux/config
+
+[ $SELINUXTYPE = strict ] || return
+
DIRS=" \
/tmp/orbit-$USER \
$HOME/.fonts \
@@ -21,7 +26,7 @@
done
RESTORED=`/sbin/restorecon -v $DIRS 2>&1`
-if [ ! -z "$RESTORED" ]; then
+if [ $? -a ! -z "$RESTORED" ]; then
RESULT=`echo "$RESTORED" | awk '{ print $3 }'`
echo "Restoring SELinux context for:"
echo $RESULT | sed 's| |\n|g'
- Previous message (by thread): rpms/mod_perl/FC-4 .cvsignore, 1.14, 1.15 mod_perl.spec, 1.29, 1.30 sources, 1.14, 1.15
- Next message (by thread): rpms/selinux-policy-targeted/devel policy-20050606.patch, 1.10, 1.11 selinux-policy-targeted.spec, 1.323, 1.324
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the fedora-cvs-commits
mailing list