rpms/selinux-policy-targeted/FC-4 policy-20050916.patch, 1.17, 1.18 selinux-policy-targeted.spec, 1.349, 1.350
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Thu Nov 10 01:53:22 UTC 2005
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy-targeted/FC-4
In directory cvs.devel.redhat.com:/tmp/cvs-serv9128
Modified Files:
policy-20050916.patch selinux-policy-targeted.spec
Log Message:
* Wed Nov 9 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.14
- remove lvm.static
- Fix slapd
- Fix innd
policy-20050916.patch:
Makefile | 24 +-
attrib.te | 100 +++++++++-
domains/admin.te | 2
domains/misc/kernel.te | 2
domains/program/crond.te | 2
domains/program/fsadm.te | 9
domains/program/getty.te | 2
domains/program/hostname.te | 2
domains/program/ifconfig.te | 5
domains/program/init.te | 2
domains/program/initrc.te | 26 ++
domains/program/ldconfig.te | 3
domains/program/load_policy.te | 11 -
domains/program/login.te | 23 +-
domains/program/logrotate.te | 2
domains/program/modutil.te | 27 +-
domains/program/mount.te | 6
domains/program/netutils.te | 3
domains/program/newrole.te | 4
domains/program/passwd.te | 2
domains/program/restorecon.te | 6
domains/program/setfiles.te | 4
domains/program/ssh.te | 6
domains/program/su.te | 9
domains/program/syslogd.te | 6
domains/program/tmpreaper.te | 2
domains/program/unused/NetworkManager.te | 13 +
domains/program/unused/alsa.te | 2
domains/program/unused/amanda.te | 74 +------
domains/program/unused/anaconda.te | 5
domains/program/unused/apache.te | 23 +-
domains/program/unused/apmd.te | 19 +
domains/program/unused/auditd.te | 8
domains/program/unused/automount.te | 4
domains/program/unused/avahi.te | 31 +++
domains/program/unused/bluetooth.te | 72 +++++++
domains/program/unused/cups.te | 20 +-
domains/program/unused/cvs.te | 2
domains/program/unused/cyrus.te | 10 -
domains/program/unused/dbusd.te | 4
domains/program/unused/dcc.te | 5
domains/program/unused/dhcpc.te | 6
domains/program/unused/dhcpd.te | 4
domains/program/unused/dovecot.te | 4
domains/program/unused/exim.te | 309 +++++++++++++++++++++++++++++++
domains/program/unused/ftpd.te | 6
domains/program/unused/hald.te | 5
domains/program/unused/hotplug.te | 5
domains/program/unused/hwclock.te | 1
domains/program/unused/ipsec.te | 2
domains/program/unused/kudzu.te | 5
domains/program/unused/mta.te | 8
domains/program/unused/mysqld.te | 10 -
domains/program/unused/named.te | 27 ++
domains/program/unused/nscd.te | 1
domains/program/unused/ntpd.te | 10 -
domains/program/unused/openct.te | 16 +
domains/program/unused/pamconsole.te | 4
domains/program/unused/pegasus.te | 36 +++
domains/program/unused/ping.te | 2
domains/program/unused/postfix.te | 63 ++++--
domains/program/unused/postgresql.te | 11 -
domains/program/unused/pppd.te | 23 +-
domains/program/unused/procmail.te | 13 +
domains/program/unused/radius.te | 3
domains/program/unused/readahead.te | 21 ++
domains/program/unused/rlogind.te | 4
domains/program/unused/roundup.te | 29 ++
domains/program/unused/rpcd.te | 18 +
domains/program/unused/rpm.te | 4
domains/program/unused/rsync.te | 3
domains/program/unused/samba.te | 15 +
domains/program/unused/saslauthd.te | 1
domains/program/unused/sendmail.te | 3
domains/program/unused/slapd.te | 25 ++
domains/program/unused/snmpd.te | 6
domains/program/unused/spamd.te | 28 --
domains/program/unused/squid.te | 3
domains/program/unused/udev.te | 10 -
domains/program/unused/utempter.te | 2
domains/program/unused/webalizer.te | 3
domains/program/unused/winbind.te | 1
domains/program/unused/xdm.te | 3
domains/program/unused/yppasswdd.te | 40 ++++
domains/program/unused/ypserv.te | 1
domains/program/useradd.te | 5
file_contexts/distros.fc | 2
file_contexts/program/apache.fc | 3
file_contexts/program/bluetooth.fc | 3
file_contexts/program/compat.fc | 4
file_contexts/program/dhcpc.fc | 2
file_contexts/program/dhcpd.fc | 5
file_contexts/program/ftpd.fc | 5
file_contexts/program/games.fc | 11 -
file_contexts/program/innd.fc | 15 -
file_contexts/program/ipsec.fc | 1
file_contexts/program/openct.fc | 2
file_contexts/program/pegasus.fc | 9
file_contexts/program/pppd.fc | 2
file_contexts/program/readahead.fc | 1
file_contexts/program/roundup.fc | 2
file_contexts/program/rpm.fc | 4
file_contexts/program/rshd.fc | 1
file_contexts/program/rsync.fc | 2
file_contexts/program/slapd.fc | 12 +
file_contexts/program/squid.fc | 3
file_contexts/program/xdm.fc | 2
file_contexts/program/yppasswdd.fc | 2
file_contexts/program/ypserv.fc | 1
file_contexts/types.fc | 4
genfs_contexts | 3
macros/base_user_macros.te | 7
macros/core_macros.te | 9
macros/global_macros.te | 25 +-
macros/home_macros.te | 9
macros/network_macros.te | 17 +
macros/program/apache_macros.te | 13 +
macros/program/bonobo_macros.te | 2
macros/program/cdrecord_macros.te | 6
macros/program/chkpwd_macros.te | 8
macros/program/crontab_macros.te | 2
macros/program/dbusd_macros.te | 7
macros/program/gconf_macros.te | 2
macros/program/gift_macros.te | 2
macros/program/gpg_macros.te | 2
macros/program/i18n_input_macros.te | 21 ++
macros/program/lpr_macros.te | 2
macros/program/mta_macros.te | 4
macros/program/newrole_macros.te | 2
macros/program/pyzor_macros.te | 2
macros/program/razor_macros.te | 2
macros/program/su_macros.te | 4
macros/program/uml_macros.te | 2
macros/program/xdm_macros.te | 2
macros/program/ypbind_macros.te | 1
macros/user_macros.te | 7
man/man8/ftpd_selinux.8 | 19 +
man/man8/httpd_selinux.8 | 9
man/man8/rsync_selinux.8 | 12 -
man/man8/samba_selinux.8 | 9
mcs | 210 ++++++++-------------
mls | 270 ++++++++++-----------------
net_contexts | 12 +
targeted/appconfig/root_default_contexts | 4
targeted/assert.te | 2
targeted/domains/program/compat.te | 1
targeted/domains/program/sendmail.te | 1
targeted/domains/program/ssh.te | 3
targeted/domains/program/xdm.te | 4
targeted/domains/unconfined.te | 15 +
tunables/distro.tun | 2
tunables/tunable.tun | 4
types/device.te | 4
types/devpts.te | 4
types/file.te | 45 +---
types/network.te | 13 -
types/nfs.te | 1
types/security.te | 6
158 files changed, 1624 insertions(+), 668 deletions(-)
Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/FC-4/policy-20050916.patch,v
retrieving revision 1.17
retrieving revision 1.18
diff -u -r1.17 -r1.18
--- policy-20050916.patch 4 Nov 2005 12:38:33 -0000 1.17
+++ policy-20050916.patch 10 Nov 2005 01:53:18 -0000 1.18
@@ -228,6 +228,18 @@
+
+# for tune2fs
+allow fsadm_t file_type:dir { getattr search };
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/getty.te policy-1.27.1/domains/program/getty.te
+--- nsapolicy/domains/program/getty.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/getty.te 2005-11-09 20:30:51.000000000 -0500
+@@ -8,7 +8,7 @@
+ #
+ # Rules for the getty_t domain.
+ #
+-init_service_domain(getty, `, privfd')
++init_service_domain(getty, `, privfd, privmail, mlsfileread, mlsfilewrite')
+
+ etcdir_domain(getty)
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/hostname.te policy-1.27.1/domains/program/hostname.te
--- nsapolicy/domains/program/hostname.te 2005-09-16 11:17:27.000000000 -0400
+++ policy-1.27.1/domains/program/hostname.te 2005-11-03 18:21:50.000000000 -0500
@@ -378,7 +390,16 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/login.te policy-1.27.1/domains/program/login.te
--- nsapolicy/domains/program/login.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/login.te 2005-11-03 18:21:50.000000000 -0500
++++ policy-1.27.1/domains/program/login.te 2005-11-09 20:32:38.000000000 -0500
+@@ -13,7 +13,7 @@
+
+ # $1 is the name of the domain (local or remote)
+ define(`login_domain', `
+-type $1_login_t, domain, privuser, privrole, privlog, auth_chkpwd, privowner, privfd, nscd_client_domain, mlsfilewrite, mlsprocsetsl, mlsfileupgrade, mlsfiledowngrade;
++type $1_login_t, domain, privuser, privrole, privlog, auth_chkpwd, privowner, privfd, nscd_client_domain, mlsfileread, mlsfilewrite, mlsprocsetsl, mlsfileupgrade, mlsfiledowngrade;
+ role system_r types $1_login_t;
+
+ dontaudit $1_login_t shadow_t:file { getattr read };
@@ -62,6 +62,11 @@
ifdef(`pamconsole.te', `
@@ -577,6 +598,18 @@
+ifdef(`targeted_policy', `
+typeattribute newrole_t unconfinedtrans;
+')
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/passwd.te policy-1.27.1/domains/program/passwd.te
+--- nsapolicy/domains/program/passwd.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/passwd.te 2005-11-09 20:32:17.000000000 -0500
+@@ -42,7 +42,7 @@
+ allow $1_t etc_t:lnk_file read;
+
+ # Use capabilities.
+-allow $1_t self:capability { chown dac_override fsetid setuid setgid sys_resource };
++allow $1_t self:capability { chown dac_override fsetid setuid setgid sys_resource audit_control audit_write };
+
+ # Access terminals.
+ allow $1_t { ttyfile ptyfile }:chr_file rw_file_perms;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/restorecon.te policy-1.27.1/domains/program/restorecon.te
--- nsapolicy/domains/program/restorecon.te 2005-09-16 11:17:27.000000000 -0400
+++ policy-1.27.1/domains/program/restorecon.te 2005-11-03 18:21:50.000000000 -0500
@@ -1322,16 +1355,17 @@
# the dcc user (even though the default dcc user is root).
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dhcpc.te policy-1.27.1/domains/program/unused/dhcpc.te
--- nsapolicy/domains/program/unused/dhcpc.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dhcpc.te 2005-11-03 18:21:50.000000000 -0500
-@@ -120,6 +120,7 @@
++++ policy-1.27.1/domains/program/unused/dhcpc.te 2005-11-09 20:33:51.000000000 -0500
+@@ -120,6 +120,8 @@
allow dhcpc_t self:packet_socket create_socket_perms;
allow dhcpc_t var_lib_t:dir search;
file_type_auto_trans(dhcpc_t, dhcp_state_t, dhcpc_state_t, file)
++rw_dir_create_file(dhcpc_t, dhcpc_state_t)
+allow dhcpc_t dhcp_state_t:file { getattr read };
allow dhcpc_t bin_t:dir { getattr search };
allow dhcpc_t bin_t:lnk_file read;
-@@ -134,7 +135,6 @@
+@@ -134,7 +136,6 @@
allow dhcpc_t home_root_t:dir search;
allow initrc_t dhcpc_state_t:file { getattr read };
dontaudit dhcpc_t var_lock_t:dir search;
@@ -1339,7 +1373,7 @@
allow dhcpc_t self:netlink_route_socket r_netlink_socket_perms;
dontaudit dhcpc_t domain:dir getattr;
allow dhcpc_t initrc_var_run_t:file rw_file_perms;
-@@ -145,6 +145,7 @@
+@@ -145,6 +146,7 @@
ifdef(`ypbind.te', `
domain_auto_trans(dhcpc_t, ypbind_exec_t, ypbind_t)
allow dhcpc_t ypbind_var_run_t:file { r_file_perms unlink };
@@ -1347,7 +1381,7 @@
')
ifdef(`ntpd.te', `
domain_auto_trans(dhcpc_t, ntpd_exec_t, ntpd_t)
-@@ -163,3 +164,5 @@
+@@ -163,3 +165,5 @@
allow dhcpc_t unconfined_t:dbus send_msg;
')dnl end ifdef unconfined.te
')
@@ -1355,7 +1389,7 @@
+allow dhcpc_t locale_t:file write;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dhcpd.te policy-1.27.1/domains/program/unused/dhcpd.te
--- nsapolicy/domains/program/unused/dhcpd.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dhcpd.te 2005-11-03 18:21:50.000000000 -0500
++++ policy-1.27.1/domains/program/unused/dhcpd.te 2005-11-09 20:33:52.000000000 -0500
@@ -17,8 +17,6 @@
#
daemon_domain(dhcpd, `, nscd_client_domain')
@@ -1373,6 +1407,14 @@
can_ypbind(dhcpd_t)
allow dhcpd_t self:unix_dgram_socket create_socket_perms;
allow dhcpd_t self:unix_stream_socket create_socket_perms;
+@@ -46,6 +45,7 @@
+ allow dhcpd_t dhcp_etc_t:file { read getattr };
+ allow dhcpd_t dhcp_etc_t:dir search;
+ file_type_auto_trans(dhcpd_t, dhcp_state_t, dhcpd_state_t, file)
++rw_dir_create_file(dhcpd_t, dhcpd_state_t)
+
+ allow dhcpd_t etc_t:lnk_file read;
+ allow dhcpd_t { etc_t etc_runtime_t }:file r_file_perms;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dovecot.te policy-1.27.1/domains/program/unused/dovecot.te
--- nsapolicy/domains/program/unused/dovecot.te 2005-09-16 11:17:27.000000000 -0400
+++ policy-1.27.1/domains/program/unused/dovecot.te 2005-11-03 18:21:50.000000000 -0500
@@ -2315,7 +2357,7 @@
+}
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/pppd.te policy-1.27.1/domains/program/unused/pppd.te
--- nsapolicy/domains/program/unused/pppd.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/pppd.te 2005-11-03 18:21:50.000000000 -0500
++++ policy-1.27.1/domains/program/unused/pppd.te 2005-11-09 20:35:54.000000000 -0500
@@ -14,7 +14,7 @@
#
bool pppd_for_user false;
@@ -2350,7 +2392,7 @@
# for scripts
allow pppd_t self:fifo_file rw_file_perms;
-@@ -104,14 +106,16 @@
+@@ -104,14 +106,18 @@
dontaudit pppd_t initrc_var_run_t:file { lock write };
# pppd needs to load kernel modules for certain modems
@@ -2358,10 +2400,12 @@
-if (pppd_can_insmod) {
ifdef(`modutil.te', `
+bool pppd_can_insmod false;
++typeattribute ifconfig_t privsysmod;
+
+if (pppd_can_insmod && !secure_mode_insmod) {
domain_auto_trans(pppd_t, insmod_exec_t, insmod_t)
-')
++allow ifconfig_t self:capability sys_module;
}
-daemon_domain(pptp)
@@ -2371,7 +2415,7 @@
can_network_client_tcp(pptp_t)
allow pptp_t { reserved_port_type port_t }:tcp_socket name_connect;
can_exec(pptp_t, hostname_exec_t)
-@@ -120,11 +124,11 @@
+@@ -120,11 +126,11 @@
allow pptp_t self:unix_stream_socket { connectto create_stream_socket_perms };
allow pptp_t self:unix_dgram_socket create_socket_perms;
can_exec(pptp_t, pppd_etc_rw_t)
@@ -2385,14 +2429,14 @@
allow pppd_t pptp_t:process signal;
allow pptp_t self:capability net_raw;
allow pptp_t self:fifo_file { read write };
-@@ -144,3 +148,4 @@
+@@ -144,3 +150,4 @@
# Allow /etc/ppp/ip-{up,down} to run most anything
type pppd_script_exec_t, file_type, sysadmfile;
domain_auto_trans(pppd_t, pppd_script_exec_t, initrc_t)
+allow pppd_t initrc_t:process noatsecure;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/procmail.te policy-1.27.1/domains/program/unused/procmail.te
--- nsapolicy/domains/program/unused/procmail.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/procmail.te 2005-11-03 18:21:50.000000000 -0500
++++ policy-1.27.1/domains/program/unused/procmail.te 2005-11-09 20:35:05.000000000 -0500
@@ -19,8 +19,7 @@
uses_shlib(procmail_t)
allow procmail_t device_t:dir search;
@@ -2403,16 +2447,18 @@
allow procmail_t self:capability { sys_nice chown setuid setgid dac_override };
-@@ -60,6 +59,14 @@
+@@ -60,6 +59,16 @@
allow procmail_t usr_t:file { getattr ioctl read };
ifdef(`spamassassin.te', `
can_exec(procmail_t, spamassassin_exec_t)
-+can_resolve(procmail_t)
+allow procmail_t port_t:udp_socket name_bind;
+allow procmail_t tmp_t:dir getattr;
+')
++ifdef(`spamc.te', `
++can_exec(procmail_t, spamc_exec_t)
++')
++
+ifdef(`targeted_policy', `
-+can_resolve(procmail_t)
+allow procmail_t port_t:udp_socket name_bind;
+allow procmail_t tmp_t:dir getattr;
')
@@ -2637,6 +2683,47 @@
daemon_domain(sendmail, `, nscd_client_domain, mta_delivery_agent, mail_server_domain, mail_server_sender', nosysadm)
tmp_domain(sendmail)
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/slapd.te policy-1.27.1/domains/program/unused/slapd.te
+--- nsapolicy/domains/program/unused/slapd.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/slapd.te 2005-11-09 20:36:34.000000000 -0500
+@@ -24,8 +24,9 @@
+ can_network(slapd_t)
+ allow slapd_t port_type:tcp_socket name_connect;
+ can_ypbind(slapd_t)
+-allow slapd_t self:fifo_file { read write };
+-allow slapd_t self:unix_stream_socket create_socket_perms;
++allow slapd_t self:fifo_file rw_file_perms;
++allow slapd_t self:unix_stream_socket create_stream_socket_perms;
++file_type_auto_trans(slapd_t,var_run_t,slapd_var_run_t,sock_file)
+ allow slapd_t self:unix_dgram_socket create_socket_perms;
+ # allow any domain to connect to the LDAP server
+ can_tcp_connect(domain, slapd_t)
+@@ -55,7 +56,23 @@
+
+ read_sysctl(slapd_t)
+
+-allow slapd_t usr_t:file { read getattr };
+-allow slapd_t urandom_device_t:chr_file { getattr read };
++allow slapd_t usr_t:{ lnk_file file } { read getattr };
++allow slapd_t urandom_device_t:chr_file { getattr read ioctl };
+ allow slapd_t self:netlink_route_socket r_netlink_socket_perms;
+ r_dir_file(slapd_t, cert_t)
++
++
++type slapd_cert_t, file_type, sysadmfile;
++allow slapd_t bin_t:dir search;
++can_exec(slapd_t, bin_t)
++r_dir_file(slapd_t, proc_net_t)
++allow slapd_t self:capability { chown sys_nice };
++allow slapd_t self:file { getattr read };
++allow slapd_t self:process { execstack getsched };
++allow slapd_t sysctl_net_t:dir r_dir_perms;
++lock_domain(slapd)
++create_dir_file(slapd_t, slapd_lock_t)
++dontaudit slapd_t devpts_t:dir search;
++rw_dir_create_file(slapd_t, slapd_cert_t)
++allow slapd_t usr_t:dir { add_name write };
++allow slapd_t usr_t:file { create write };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/snmpd.te policy-1.27.1/domains/program/unused/snmpd.te
--- nsapolicy/domains/program/unused/snmpd.te 2005-09-16 11:17:27.000000000 -0400
+++ policy-1.27.1/domains/program/unused/snmpd.te 2005-11-03 18:21:50.000000000 -0500
@@ -2947,7 +3034,7 @@
+/var/lib/bluetooth(/.*)? system_u:object_r:bluetooth_var_lib_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/compat.fc policy-1.27.1/file_contexts/program/compat.fc
--- nsapolicy/file_contexts/program/compat.fc 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/compat.fc 2005-11-03 18:25:57.000000000 -0500
++++ policy-1.27.1/file_contexts/program/compat.fc 2005-11-09 20:24:55.000000000 -0500
@@ -43,6 +43,7 @@
/sbin/hdparm -- system_u:object_r:fsadm_exec_t
/sbin/raidstart -- system_u:object_r:fsadm_exec_t
@@ -2956,16 +3043,13 @@
/sbin/blockdev -- system_u:object_r:fsadm_exec_t
/sbin/losetup.* -- system_u:object_r:fsadm_exec_t
/sbin/jfs_.* -- system_u:object_r:fsadm_exec_t
-@@ -55,6 +56,12 @@
+@@ -55,6 +56,9 @@
/usr/bin/partition_uuid -- system_u:object_r:fsadm_exec_t
/sbin/partprobe -- system_u:object_r:fsadm_exec_t
')
+ifdef(`lvm.te', `', `
+/sbin/lvm.static -- system_u:object_r:lvm_exec_t
+')
-+ifdef(`lvm.te', `', `
-+/sbin/lvm.static -- system_u:object_r:lvm_exec_t
-+')
ifdef(`kudzu.te', `', `
# kudzu
/usr/sbin/kudzu -- system_u:object_r:kudzu_exec_t
@@ -3047,6 +3131,43 @@
+/usr/bin/civserver.* -- system_u:object_r:games_exec_t
+')dnl end non-Debian section
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/innd.fc policy-1.27.1/file_contexts/program/innd.fc
+--- nsapolicy/file_contexts/program/innd.fc 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/innd.fc 2005-11-09 20:38:06.000000000 -0500
+@@ -18,25 +18,26 @@
+ /usr/lib(64)?/news/bin/archive -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/batcher -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/buffchan -- system_u:object_r:innd_exec_t
++/usr/lib(64)?/news/bin/controlchan -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/convdate -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/ctlinnd -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/cvtbatch -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/expire -- system_u:object_r:innd_exec_t
+-/usr/lib(64)?/news/bin/expireover -- system_u:object_r:innd_exec_t
++/usr/lib(64)?/news/bin/expireover -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/fastrm -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/filechan -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/getlist -- system_u:object_r:innd_exec_t
+-/usr/lib(64)?/news/bin/grephistory -- system_u:object_r:innd_exec_t
++/usr/lib(64)?/news/bin/grephistory -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/inews -- system_u:object_r:innd_exec_t
+-/usr/lib(64)?/news/bin/innconfval -- system_u:object_r:innd_exec_t
++/usr/lib(64)?/news/bin/innconfval -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/inndf -- system_u:object_r:innd_exec_t
+-/usr/lib(64)?/news/bin/inndstart -- system_u:object_r:innd_exec_t
++/usr/lib(64)?/news/bin/inndstart -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/innfeed -- system_u:object_r:innd_exec_t
+-/usr/lib(64)?/news/bin/innxbatch -- system_u:object_r:innd_exec_t
++/usr/lib(64)?/news/bin/innxbatch -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/innxmit -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/makedbz -- system_u:object_r:innd_exec_t
+-/usr/lib(64)?/news/bin/makehistory -- system_u:object_r:innd_exec_t
+-/usr/lib(64)?/news/bin/newsrequeue -- system_u:object_r:innd_exec_t
++/usr/lib(64)?/news/bin/makehistory -- system_u:object_r:innd_exec_t
++/usr/lib(64)?/news/bin/newsrequeue -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/nnrpd -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/nntpget -- system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/ovdb_recover -- system_u:object_r:innd_exec_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/ipsec.fc policy-1.27.1/file_contexts/program/ipsec.fc
--- nsapolicy/file_contexts/program/ipsec.fc 2005-09-16 11:17:27.000000000 -0400
+++ policy-1.27.1/file_contexts/program/ipsec.fc 2005-11-03 18:21:50.000000000 -0500
@@ -3126,6 +3247,25 @@
/usr/bin/rsync -- system_u:object_r:rsync_exec_t
-/srv/([^/]*/)?rsync(/.*)? system_u:object_r:ftpd_anon_t
+/srv/([^/]*/)?rsync(/.*)? system_u:object_r:public_content_t
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/slapd.fc policy-1.27.1/file_contexts/program/slapd.fc
+--- nsapolicy/file_contexts/program/slapd.fc 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/slapd.fc 2005-11-09 20:38:46.000000000 -0500
+@@ -5,3 +5,15 @@
+ /var/run/slapd\.args -- system_u:object_r:slapd_var_run_t
+ /etc/ldap/slapd\.conf -- system_u:object_r:slapd_etc_t
+ /var/run/slapd\.pid -- system_u:object_r:slapd_var_run_t
++/var/run/ldapi -s system_u:object_r:slapd_var_run_t
++/opt/(fedora|redhat)-ds(/.*)?/bin/slapd/server/ns-slapd -- system_u:object_r:slapd_exec_t
++/opt/(fedora|redhat)-ds/slapd-[^/]+/logs(/.*)? system_u:object_r:slapd_var_run_t
++/opt/(fedora|redhat)-ds/slapd-[^/]+/locks(/.*)? system_u:object_r:slapd_lock_t
++/opt/(fedora|redhat)-ds/slapd-[^/]+/tmp(/.*)? system_u:object_r:slapd_var_run_t
++/opt/(fedora|redhat)-ds/slapd-[^/]+/config(/.*)? system_u:object_r:slapd_var_run_t
++/opt/(fedora|redhat)-ds/slapd-[^/]+/db(/.*)? system_u:object_r:slapd_db_t
++/opt/(fedora|redhat)-ds/slapd-[^/]+/bak(/.*)? system_u:object_r:slapd_db_t
++/opt/(fedora|redhat)-ds/slapd-[^/]+/start-slapd system_u:object_r:initrc_exec_t
++/opt/(fedora|redhat)-ds/slapd-[^/]+/stop-slapd system_u:object_r:initrc_exec_t
++/opt/(fedora|redhat)-ds/alias(/.*)? system_u:object_r:slapd_cert_t
++/opt/(fedora|redhat)-ds/alias/[^/]+so.* system_u:object_r:shlib_t
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/squid.fc policy-1.27.1/file_contexts/program/squid.fc
--- nsapolicy/file_contexts/program/squid.fc 2005-09-16 11:17:27.000000000 -0400
+++ policy-1.27.1/file_contexts/program/squid.fc 2005-11-03 18:25:49.000000000 -0500
@@ -4583,7 +4723,7 @@
#
diff --exclude-from=exclude -N -u -r nsapolicy/net_contexts policy-1.27.1/net_contexts
--- nsapolicy/net_contexts 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/net_contexts 2005-11-03 18:21:50.000000000 -0500
++++ policy-1.27.1/net_contexts 2005-11-09 20:25:54.000000000 -0500
@@ -50,6 +50,10 @@
portcon tcp 53 system_u:object_r:dns_port_t
@@ -4595,7 +4735,15 @@
portcon udp 68 system_u:object_r:dhcpc_port_t
portcon udp 70 system_u:object_r:gopher_port_t
portcon tcp 70 system_u:object_r:gopher_port_t
-@@ -111,8 +115,6 @@
+@@ -61,6 +65,7 @@
+ portcon tcp 443 system_u:object_r:http_port_t
+ portcon tcp 488 system_u:object_r:http_port_t
+ portcon tcp 8008 system_u:object_r:http_port_t
++portcon tcp 8090 system_u:object_r:http_port_t
+
+ portcon tcp 106 system_u:object_r:pop_port_t
+ portcon tcp 109 system_u:object_r:pop_port_t
+@@ -111,8 +116,6 @@
portcon tcp 749 system_u:object_r:kerberos_admin_port_t
portcon tcp 750 system_u:object_r:kerberos_port_t
portcon udp 750 system_u:object_r:kerberos_port_t
@@ -4604,7 +4752,13 @@
portcon tcp 783 system_u:object_r:spamd_port_t
portcon tcp 540 system_u:object_r:uucpd_port_t
portcon tcp 2401 system_u:object_r:cvs_port_t
-@@ -164,6 +166,8 @@
+@@ -161,9 +164,14 @@
+ portcon tcp 5432 system_u:object_r:postgresql_port_t
+ portcon tcp 5666 system_u:object_r:inetd_child_port_t
+ portcon tcp 5703 system_u:object_r:ptal_port_t
++portcon tcp 9290 system_u:object_r:hplip_port_t
++portcon tcp 9291 system_u:object_r:hplip_port_t
++portcon tcp 9292 system_u:object_r:hplip_port_t
portcon tcp 50000 system_u:object_r:hplip_port_t
portcon tcp 50002 system_u:object_r:hplip_port_t
portcon tcp 5900 system_u:object_r:vnc_port_t
Index: selinux-policy-targeted.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/FC-4/selinux-policy-targeted.spec,v
retrieving revision 1.349
retrieving revision 1.350
diff -u -r1.349 -r1.350
--- selinux-policy-targeted.spec 3 Nov 2005 23:30:50 -0000 1.349
+++ selinux-policy-targeted.spec 10 Nov 2005 01:53:18 -0000 1.350
@@ -9,7 +9,7 @@
Summary: SELinux %{type} policy configuration
Name: selinux-policy-%{type}
Version: 1.27.1
-Release: 2.13
+Release: 2.14
License: GPL
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -236,6 +236,11 @@
exit 0
%changelog
+* Wed Nov 9 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.14
+- remove lvm.static
+- Fix slapd
+- Fix innd
+
* Thu Nov 3 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.13
- Fix radius to use pam
- Fix samba to add fowner
More information about the fedora-cvs-commits
mailing list