[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

rpms/selinux-policy-strict/FC-4 policy-20050916.patch, 1.14, 1.15 selinux-policy-strict.spec, 1.331, 1.332



Author: dwalsh

Update of /cvs/dist/rpms/selinux-policy-strict/FC-4
In directory cvs.devel.redhat.com:/tmp/cvs-serv9252

Modified Files:
	policy-20050916.patch selinux-policy-strict.spec 
Log Message:
* Wed Nov 9 2005 Dan Walsh <dwalsh redhat com> 1.27.1-2.14
- remove lvm.static
- Fix slapd
- Fix innd


policy-20050916.patch:
 Makefile                                 |   24 +-
 attrib.te                                |  100 +++++++++-
 domains/admin.te                         |    2 
 domains/misc/kernel.te                   |    2 
 domains/program/crond.te                 |    2 
 domains/program/fsadm.te                 |    9 
 domains/program/getty.te                 |    2 
 domains/program/hostname.te              |    2 
 domains/program/ifconfig.te              |    5 
 domains/program/init.te                  |    2 
 domains/program/initrc.te                |   26 ++
 domains/program/ldconfig.te              |    3 
 domains/program/load_policy.te           |   11 -
 domains/program/login.te                 |   23 +-
 domains/program/logrotate.te             |    2 
 domains/program/modutil.te               |   27 +-
 domains/program/mount.te                 |    6 
 domains/program/netutils.te              |    3 
 domains/program/newrole.te               |    4 
 domains/program/passwd.te                |    2 
 domains/program/restorecon.te            |    6 
 domains/program/setfiles.te              |    4 
 domains/program/ssh.te                   |    6 
 domains/program/su.te                    |    9 
 domains/program/syslogd.te               |    6 
 domains/program/tmpreaper.te             |    2 
 domains/program/unused/NetworkManager.te |   13 +
 domains/program/unused/alsa.te           |    2 
 domains/program/unused/amanda.te         |   74 +------
 domains/program/unused/anaconda.te       |    5 
 domains/program/unused/apache.te         |   23 +-
 domains/program/unused/apmd.te           |   19 +
 domains/program/unused/auditd.te         |    8 
 domains/program/unused/automount.te      |    4 
 domains/program/unused/avahi.te          |   31 +++
 domains/program/unused/bluetooth.te      |   72 +++++++
 domains/program/unused/cups.te           |   20 +-
 domains/program/unused/cvs.te            |    2 
 domains/program/unused/cyrus.te          |   10 -
 domains/program/unused/dbusd.te          |    4 
 domains/program/unused/dcc.te            |    5 
 domains/program/unused/dhcpc.te          |    6 
 domains/program/unused/dhcpd.te          |    4 
 domains/program/unused/dovecot.te        |    4 
 domains/program/unused/exim.te           |  309 +++++++++++++++++++++++++++++++
 domains/program/unused/ftpd.te           |    6 
 domains/program/unused/hald.te           |    5 
 domains/program/unused/hotplug.te        |    5 
 domains/program/unused/hwclock.te        |    1 
 domains/program/unused/ipsec.te          |    2 
 domains/program/unused/kudzu.te          |    5 
 domains/program/unused/mta.te            |    8 
 domains/program/unused/mysqld.te         |   10 -
 domains/program/unused/named.te          |   27 ++
 domains/program/unused/nscd.te           |    1 
 domains/program/unused/ntpd.te           |   10 -
 domains/program/unused/openct.te         |   16 +
 domains/program/unused/pamconsole.te     |    4 
 domains/program/unused/pegasus.te        |   36 +++
 domains/program/unused/ping.te           |    2 
 domains/program/unused/postfix.te        |   63 ++++--
 domains/program/unused/postgresql.te     |   11 -
 domains/program/unused/pppd.te           |   23 +-
 domains/program/unused/procmail.te       |   13 +
 domains/program/unused/radius.te         |    3 
 domains/program/unused/readahead.te      |   21 ++
 domains/program/unused/rlogind.te        |    4 
 domains/program/unused/roundup.te        |   29 ++
 domains/program/unused/rpcd.te           |   18 +
 domains/program/unused/rpm.te            |    4 
 domains/program/unused/rsync.te          |    3 
 domains/program/unused/samba.te          |   15 +
 domains/program/unused/saslauthd.te      |    1 
 domains/program/unused/sendmail.te       |    3 
 domains/program/unused/slapd.te          |   25 ++
 domains/program/unused/snmpd.te          |    6 
 domains/program/unused/spamd.te          |   28 --
 domains/program/unused/squid.te          |    3 
 domains/program/unused/udev.te           |   10 -
 domains/program/unused/utempter.te       |    2 
 domains/program/unused/webalizer.te      |    3 
 domains/program/unused/winbind.te        |    1 
 domains/program/unused/xdm.te            |    3 
 domains/program/unused/yppasswdd.te      |   40 ++++
 domains/program/unused/ypserv.te         |    1 
 domains/program/useradd.te               |    5 
 file_contexts/distros.fc                 |    2 
 file_contexts/program/apache.fc          |    3 
 file_contexts/program/bluetooth.fc       |    3 
 file_contexts/program/compat.fc          |    4 
 file_contexts/program/dhcpc.fc           |    2 
 file_contexts/program/dhcpd.fc           |    5 
 file_contexts/program/ftpd.fc            |    5 
 file_contexts/program/games.fc           |   11 -
 file_contexts/program/innd.fc            |   15 -
 file_contexts/program/ipsec.fc           |    1 
 file_contexts/program/openct.fc          |    2 
 file_contexts/program/pegasus.fc         |    9 
 file_contexts/program/pppd.fc            |    2 
 file_contexts/program/readahead.fc       |    1 
 file_contexts/program/roundup.fc         |    2 
 file_contexts/program/rpm.fc             |    4 
 file_contexts/program/rshd.fc            |    1 
 file_contexts/program/rsync.fc           |    2 
 file_contexts/program/slapd.fc           |   12 +
 file_contexts/program/squid.fc           |    3 
 file_contexts/program/xdm.fc             |    2 
 file_contexts/program/yppasswdd.fc       |    2 
 file_contexts/program/ypserv.fc          |    1 
 file_contexts/types.fc                   |    4 
 genfs_contexts                           |    3 
 macros/base_user_macros.te               |    7 
 macros/core_macros.te                    |    9 
 macros/global_macros.te                  |   25 +-
 macros/home_macros.te                    |    9 
 macros/network_macros.te                 |   17 +
 macros/program/apache_macros.te          |   13 +
 macros/program/bonobo_macros.te          |    2 
 macros/program/cdrecord_macros.te        |    6 
 macros/program/chkpwd_macros.te          |    8 
 macros/program/crontab_macros.te         |    2 
 macros/program/dbusd_macros.te           |    7 
 macros/program/gconf_macros.te           |    2 
 macros/program/gift_macros.te            |    2 
 macros/program/gpg_macros.te             |    2 
 macros/program/i18n_input_macros.te      |   21 ++
 macros/program/lpr_macros.te             |    2 
 macros/program/mta_macros.te             |    4 
 macros/program/newrole_macros.te         |    2 
 macros/program/pyzor_macros.te           |    2 
 macros/program/razor_macros.te           |    2 
 macros/program/su_macros.te              |    4 
 macros/program/uml_macros.te             |    2 
 macros/program/xdm_macros.te             |    2 
 macros/program/ypbind_macros.te          |    1 
 macros/user_macros.te                    |    7 
 man/man8/ftpd_selinux.8                  |   19 +
 man/man8/httpd_selinux.8                 |    9 
 man/man8/rsync_selinux.8                 |   12 -
 man/man8/samba_selinux.8                 |    9 
 mcs                                      |  210 ++++++++-------------
 mls                                      |  270 ++++++++++-----------------
 net_contexts                             |   12 +
 targeted/appconfig/root_default_contexts |    4 
 targeted/assert.te                       |    2 
 targeted/domains/program/compat.te       |    1 
 targeted/domains/program/sendmail.te     |    1 
 targeted/domains/program/ssh.te          |    3 
 targeted/domains/program/xdm.te          |    4 
 targeted/domains/unconfined.te           |   15 +
 tunables/distro.tun                      |    2 
 tunables/tunable.tun                     |    4 
 types/device.te                          |    4 
 types/devpts.te                          |    4 
 types/file.te                            |   45 +---
 types/network.te                         |   13 -
 types/nfs.te                             |    1 
 types/security.te                        |    6 
 158 files changed, 1624 insertions(+), 668 deletions(-)

Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/FC-4/policy-20050916.patch,v
retrieving revision 1.14
retrieving revision 1.15
diff -u -r1.14 -r1.15
--- policy-20050916.patch	4 Nov 2005 12:38:41 -0000	1.14
+++ policy-20050916.patch	10 Nov 2005 01:59:50 -0000	1.15
@@ -228,6 +228,18 @@
 +
 +# for tune2fs
 +allow fsadm_t file_type:dir { getattr search };
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/getty.te policy-1.27.1/domains/program/getty.te
+--- nsapolicy/domains/program/getty.te	2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/getty.te	2005-11-09 20:30:51.000000000 -0500
+@@ -8,7 +8,7 @@
+ #
+ # Rules for the getty_t domain.
+ #
+-init_service_domain(getty, `, privfd')
++init_service_domain(getty, `, privfd, privmail, mlsfileread, mlsfilewrite')
+ 
+ etcdir_domain(getty)
+ 
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/hostname.te policy-1.27.1/domains/program/hostname.te
 --- nsapolicy/domains/program/hostname.te	2005-09-16 11:17:27.000000000 -0400
 +++ policy-1.27.1/domains/program/hostname.te	2005-11-03 18:21:50.000000000 -0500
@@ -378,7 +390,16 @@
  
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/login.te policy-1.27.1/domains/program/login.te
 --- nsapolicy/domains/program/login.te	2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/login.te	2005-11-03 18:21:50.000000000 -0500
++++ policy-1.27.1/domains/program/login.te	2005-11-09 20:32:38.000000000 -0500
+@@ -13,7 +13,7 @@
+ 
+ # $1 is the name of the domain (local or remote)
+ define(`login_domain', `
+-type $1_login_t, domain, privuser, privrole, privlog, auth_chkpwd, privowner, privfd, nscd_client_domain, mlsfilewrite, mlsprocsetsl, mlsfileupgrade, mlsfiledowngrade;
++type $1_login_t, domain, privuser, privrole, privlog, auth_chkpwd, privowner, privfd, nscd_client_domain, mlsfileread, mlsfilewrite, mlsprocsetsl, mlsfileupgrade, mlsfiledowngrade;
+ role system_r types $1_login_t;
+ 
+ dontaudit $1_login_t shadow_t:file { getattr read };
 @@ -62,6 +62,11 @@
  
  ifdef(`pamconsole.te', `
@@ -577,6 +598,18 @@
 +ifdef(`targeted_policy', `
 +typeattribute newrole_t unconfinedtrans;
 +')
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/passwd.te policy-1.27.1/domains/program/passwd.te
+--- nsapolicy/domains/program/passwd.te	2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/passwd.te	2005-11-09 20:32:17.000000000 -0500
+@@ -42,7 +42,7 @@
+ allow $1_t etc_t:lnk_file read;
+ 
+ # Use capabilities.
+-allow $1_t self:capability { chown dac_override fsetid setuid setgid sys_resource };
++allow $1_t self:capability { chown dac_override fsetid setuid setgid sys_resource audit_control audit_write };
+ 
+ # Access terminals.
+ allow $1_t { ttyfile ptyfile }:chr_file rw_file_perms;
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/restorecon.te policy-1.27.1/domains/program/restorecon.te
 --- nsapolicy/domains/program/restorecon.te	2005-09-16 11:17:27.000000000 -0400
 +++ policy-1.27.1/domains/program/restorecon.te	2005-11-03 18:21:50.000000000 -0500
@@ -1322,16 +1355,17 @@
  # the dcc user (even though the default dcc user is root).
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dhcpc.te policy-1.27.1/domains/program/unused/dhcpc.te
 --- nsapolicy/domains/program/unused/dhcpc.te	2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dhcpc.te	2005-11-03 18:21:50.000000000 -0500
-@@ -120,6 +120,7 @@
++++ policy-1.27.1/domains/program/unused/dhcpc.te	2005-11-09 20:33:51.000000000 -0500
+@@ -120,6 +120,8 @@
  allow dhcpc_t self:packet_socket create_socket_perms;
  allow dhcpc_t var_lib_t:dir search;
  file_type_auto_trans(dhcpc_t, dhcp_state_t, dhcpc_state_t, file)
++rw_dir_create_file(dhcpc_t, dhcpc_state_t)
 +allow dhcpc_t dhcp_state_t:file { getattr read };
  
  allow dhcpc_t bin_t:dir { getattr search };
  allow dhcpc_t bin_t:lnk_file read;
-@@ -134,7 +135,6 @@
+@@ -134,7 +136,6 @@
  allow dhcpc_t home_root_t:dir search;
  allow initrc_t dhcpc_state_t:file { getattr read };
  dontaudit dhcpc_t var_lock_t:dir search;
@@ -1339,7 +1373,7 @@
  allow dhcpc_t self:netlink_route_socket r_netlink_socket_perms;
  dontaudit dhcpc_t domain:dir getattr;
  allow dhcpc_t initrc_var_run_t:file rw_file_perms;
-@@ -145,6 +145,7 @@
+@@ -145,6 +146,7 @@
  ifdef(`ypbind.te', `
  domain_auto_trans(dhcpc_t, ypbind_exec_t, ypbind_t)
  allow dhcpc_t ypbind_var_run_t:file { r_file_perms unlink };
@@ -1347,7 +1381,7 @@
  ')
  ifdef(`ntpd.te', `
  domain_auto_trans(dhcpc_t, ntpd_exec_t, ntpd_t)
-@@ -163,3 +164,5 @@
+@@ -163,3 +165,5 @@
  allow dhcpc_t unconfined_t:dbus send_msg;
  ')dnl end ifdef unconfined.te
  ')
@@ -1355,7 +1389,7 @@
 +allow dhcpc_t locale_t:file write;
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dhcpd.te policy-1.27.1/domains/program/unused/dhcpd.te
 --- nsapolicy/domains/program/unused/dhcpd.te	2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dhcpd.te	2005-11-03 18:21:50.000000000 -0500
++++ policy-1.27.1/domains/program/unused/dhcpd.te	2005-11-09 20:33:52.000000000 -0500
 @@ -17,8 +17,6 @@
  #
  daemon_domain(dhcpd, `, nscd_client_domain')
@@ -1373,6 +1407,14 @@
  can_ypbind(dhcpd_t)
  allow dhcpd_t self:unix_dgram_socket create_socket_perms;
  allow dhcpd_t self:unix_stream_socket create_socket_perms;
+@@ -46,6 +45,7 @@
+ allow dhcpd_t dhcp_etc_t:file { read getattr };
+ allow dhcpd_t dhcp_etc_t:dir search;
+ file_type_auto_trans(dhcpd_t, dhcp_state_t, dhcpd_state_t, file)
++rw_dir_create_file(dhcpd_t, dhcpd_state_t)
+ 
+ allow dhcpd_t etc_t:lnk_file read;
+ allow dhcpd_t { etc_t etc_runtime_t }:file r_file_perms;
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dovecot.te policy-1.27.1/domains/program/unused/dovecot.te
 --- nsapolicy/domains/program/unused/dovecot.te	2005-09-16 11:17:27.000000000 -0400
 +++ policy-1.27.1/domains/program/unused/dovecot.te	2005-11-03 18:21:50.000000000 -0500
@@ -2315,7 +2357,7 @@
 +}
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/pppd.te policy-1.27.1/domains/program/unused/pppd.te
 --- nsapolicy/domains/program/unused/pppd.te	2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/pppd.te	2005-11-03 18:21:50.000000000 -0500
++++ policy-1.27.1/domains/program/unused/pppd.te	2005-11-09 20:35:54.000000000 -0500
 @@ -14,7 +14,7 @@
  #
  bool pppd_for_user false;
@@ -2350,7 +2392,7 @@
  
  # for scripts
  allow pppd_t self:fifo_file rw_file_perms;
-@@ -104,14 +106,16 @@
+@@ -104,14 +106,18 @@
  dontaudit pppd_t initrc_var_run_t:file { lock write };
  
  # pppd needs to load kernel modules for certain modems
@@ -2358,10 +2400,12 @@
 -if (pppd_can_insmod) {
  ifdef(`modutil.te', `
 +bool pppd_can_insmod false;
++typeattribute ifconfig_t privsysmod;
 +
 +if (pppd_can_insmod && !secure_mode_insmod) {
  domain_auto_trans(pppd_t, insmod_exec_t, insmod_t)
 -')
++allow ifconfig_t self:capability sys_module;
  }
  
 -daemon_domain(pptp)
@@ -2371,7 +2415,7 @@
  can_network_client_tcp(pptp_t)
  allow pptp_t { reserved_port_type port_t }:tcp_socket name_connect;
  can_exec(pptp_t, hostname_exec_t)
-@@ -120,11 +124,11 @@
+@@ -120,11 +126,11 @@
  allow pptp_t self:unix_stream_socket { connectto create_stream_socket_perms };
  allow pptp_t self:unix_dgram_socket create_socket_perms;
  can_exec(pptp_t, pppd_etc_rw_t)
@@ -2385,14 +2429,14 @@
  allow pppd_t pptp_t:process signal;
  allow pptp_t self:capability net_raw;
  allow pptp_t self:fifo_file { read write };
-@@ -144,3 +148,4 @@
+@@ -144,3 +150,4 @@
  # Allow /etc/ppp/ip-{up,down} to run most anything
  type pppd_script_exec_t, file_type, sysadmfile;
  domain_auto_trans(pppd_t, pppd_script_exec_t, initrc_t)
 +allow pppd_t initrc_t:process noatsecure;
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/procmail.te policy-1.27.1/domains/program/unused/procmail.te
 --- nsapolicy/domains/program/unused/procmail.te	2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/procmail.te	2005-11-03 18:21:50.000000000 -0500
++++ policy-1.27.1/domains/program/unused/procmail.te	2005-11-09 20:35:05.000000000 -0500
 @@ -19,8 +19,7 @@
  uses_shlib(procmail_t)
  allow procmail_t device_t:dir search;
@@ -2403,16 +2447,18 @@
  
  allow procmail_t self:capability { sys_nice chown setuid setgid dac_override };
  
-@@ -60,6 +59,14 @@
+@@ -60,6 +59,16 @@
  allow procmail_t usr_t:file { getattr ioctl read };
  ifdef(`spamassassin.te', `
  can_exec(procmail_t, spamassassin_exec_t)
-+can_resolve(procmail_t)
 +allow procmail_t port_t:udp_socket name_bind;
 +allow procmail_t tmp_t:dir getattr;
 +')
++ifdef(`spamc.te', `
++can_exec(procmail_t, spamc_exec_t)
++')
++
 +ifdef(`targeted_policy', `
-+can_resolve(procmail_t)
 +allow procmail_t port_t:udp_socket name_bind;
 +allow procmail_t tmp_t:dir getattr;
  ')
@@ -2637,6 +2683,47 @@
  daemon_domain(sendmail, `, nscd_client_domain, mta_delivery_agent, mail_server_domain, mail_server_sender', nosysadm)
  
  tmp_domain(sendmail)
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/slapd.te policy-1.27.1/domains/program/unused/slapd.te
+--- nsapolicy/domains/program/unused/slapd.te	2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/slapd.te	2005-11-09 20:36:34.000000000 -0500
+@@ -24,8 +24,9 @@
+ can_network(slapd_t)
+ allow slapd_t port_type:tcp_socket name_connect;
+ can_ypbind(slapd_t)
+-allow slapd_t self:fifo_file { read write };
+-allow slapd_t self:unix_stream_socket create_socket_perms;
++allow slapd_t self:fifo_file rw_file_perms;
++allow slapd_t self:unix_stream_socket create_stream_socket_perms;
++file_type_auto_trans(slapd_t,var_run_t,slapd_var_run_t,sock_file)
+ allow slapd_t self:unix_dgram_socket create_socket_perms;
+ # allow any domain to connect to the LDAP server
+ can_tcp_connect(domain, slapd_t)
+@@ -55,7 +56,23 @@
+ 
+ read_sysctl(slapd_t)
+ 
+-allow slapd_t usr_t:file { read getattr };
+-allow slapd_t urandom_device_t:chr_file { getattr read };
++allow slapd_t usr_t:{ lnk_file file } { read getattr };
++allow slapd_t urandom_device_t:chr_file { getattr read ioctl };
+ allow slapd_t self:netlink_route_socket r_netlink_socket_perms;
+ r_dir_file(slapd_t, cert_t)
++
++
++type slapd_cert_t, file_type, sysadmfile;
++allow slapd_t bin_t:dir search;
++can_exec(slapd_t, bin_t)
++r_dir_file(slapd_t, proc_net_t)
++allow slapd_t self:capability { chown sys_nice };
++allow slapd_t self:file { getattr read };
++allow slapd_t self:process { execstack getsched };
++allow slapd_t sysctl_net_t:dir r_dir_perms;
++lock_domain(slapd)
++create_dir_file(slapd_t, slapd_lock_t)
++dontaudit slapd_t devpts_t:dir search;
++rw_dir_create_file(slapd_t, slapd_cert_t)
++allow slapd_t usr_t:dir { add_name write };
++allow slapd_t usr_t:file { create write };
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/snmpd.te policy-1.27.1/domains/program/unused/snmpd.te
 --- nsapolicy/domains/program/unused/snmpd.te	2005-09-16 11:17:27.000000000 -0400
 +++ policy-1.27.1/domains/program/unused/snmpd.te	2005-11-03 18:21:50.000000000 -0500
@@ -2947,7 +3034,7 @@
 +/var/lib/bluetooth(/.*)?	system_u:object_r:bluetooth_var_lib_t
 diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/compat.fc policy-1.27.1/file_contexts/program/compat.fc
 --- nsapolicy/file_contexts/program/compat.fc	2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/compat.fc	2005-11-03 18:25:57.000000000 -0500
++++ policy-1.27.1/file_contexts/program/compat.fc	2005-11-09 20:24:55.000000000 -0500
 @@ -43,6 +43,7 @@
  /sbin/hdparm		--	system_u:object_r:fsadm_exec_t
  /sbin/raidstart		--	system_u:object_r:fsadm_exec_t
@@ -2956,16 +3043,13 @@
  /sbin/blockdev		--	system_u:object_r:fsadm_exec_t
  /sbin/losetup.*		--	system_u:object_r:fsadm_exec_t
  /sbin/jfs_.*		--	system_u:object_r:fsadm_exec_t
-@@ -55,6 +56,12 @@
+@@ -55,6 +56,9 @@
  /usr/bin/partition_uuid	--	system_u:object_r:fsadm_exec_t
  /sbin/partprobe		--	system_u:object_r:fsadm_exec_t
  ')
 +ifdef(`lvm.te', `', `
 +/sbin/lvm.static	--	system_u:object_r:lvm_exec_t
 +')
-+ifdef(`lvm.te', `', `
-+/sbin/lvm.static	--	system_u:object_r:lvm_exec_t
-+')
  ifdef(`kudzu.te', `', `
  # kudzu
  /usr/sbin/kudzu	--	system_u:object_r:kudzu_exec_t
@@ -3047,6 +3131,43 @@
 +/usr/bin/civserver.*	--	system_u:object_r:games_exec_t
 +')dnl end non-Debian section
  
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/innd.fc policy-1.27.1/file_contexts/program/innd.fc
+--- nsapolicy/file_contexts/program/innd.fc	2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/innd.fc	2005-11-09 20:38:06.000000000 -0500
+@@ -18,25 +18,26 @@
+ /usr/lib(64)?/news/bin/archive	--	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/batcher	--	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/buffchan	--	system_u:object_r:innd_exec_t
++/usr/lib(64)?/news/bin/controlchan --	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/convdate	--	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/ctlinnd	--	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/cvtbatch	--	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/expire	--	system_u:object_r:innd_exec_t
+-/usr/lib(64)?/news/bin/expireover	--	system_u:object_r:innd_exec_t
++/usr/lib(64)?/news/bin/expireover --	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/fastrm	--	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/filechan	--	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/getlist	--	system_u:object_r:innd_exec_t
+-/usr/lib(64)?/news/bin/grephistory	--	system_u:object_r:innd_exec_t
++/usr/lib(64)?/news/bin/grephistory --	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/inews	--	system_u:object_r:innd_exec_t
+-/usr/lib(64)?/news/bin/innconfval	--	system_u:object_r:innd_exec_t
++/usr/lib(64)?/news/bin/innconfval --	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/inndf	--	system_u:object_r:innd_exec_t
+-/usr/lib(64)?/news/bin/inndstart	--	system_u:object_r:innd_exec_t
++/usr/lib(64)?/news/bin/inndstart --	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/innfeed	--	system_u:object_r:innd_exec_t
+-/usr/lib(64)?/news/bin/innxbatch	--	system_u:object_r:innd_exec_t
++/usr/lib(64)?/news/bin/innxbatch --	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/innxmit	--	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/makedbz	--	system_u:object_r:innd_exec_t
+-/usr/lib(64)?/news/bin/makehistory	--	system_u:object_r:innd_exec_t
+-/usr/lib(64)?/news/bin/newsrequeue	--	system_u:object_r:innd_exec_t
++/usr/lib(64)?/news/bin/makehistory --	system_u:object_r:innd_exec_t
++/usr/lib(64)?/news/bin/newsrequeue --	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/nnrpd	--	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/nntpget	--	system_u:object_r:innd_exec_t
+ /usr/lib(64)?/news/bin/ovdb_recover	--	system_u:object_r:innd_exec_t
 diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/ipsec.fc policy-1.27.1/file_contexts/program/ipsec.fc
 --- nsapolicy/file_contexts/program/ipsec.fc	2005-09-16 11:17:27.000000000 -0400
 +++ policy-1.27.1/file_contexts/program/ipsec.fc	2005-11-03 18:21:50.000000000 -0500
@@ -3126,6 +3247,25 @@
  /usr/bin/rsync	--	system_u:object_r:rsync_exec_t
 -/srv/([^/]*/)?rsync(/.*)?	system_u:object_r:ftpd_anon_t
 +/srv/([^/]*/)?rsync(/.*)?	system_u:object_r:public_content_t
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/slapd.fc policy-1.27.1/file_contexts/program/slapd.fc
+--- nsapolicy/file_contexts/program/slapd.fc	2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/slapd.fc	2005-11-09 20:38:46.000000000 -0500
+@@ -5,3 +5,15 @@
+ /var/run/slapd\.args	--	system_u:object_r:slapd_var_run_t
+ /etc/ldap/slapd\.conf	--	system_u:object_r:slapd_etc_t
+ /var/run/slapd\.pid	--	system_u:object_r:slapd_var_run_t
++/var/run/ldapi		-s	system_u:object_r:slapd_var_run_t
++/opt/(fedora|redhat)-ds(/.*)?/bin/slapd/server/ns-slapd   --	system_u:object_r:slapd_exec_t
++/opt/(fedora|redhat)-ds/slapd-[^/]+/logs(/.*)? 	system_u:object_r:slapd_var_run_t
++/opt/(fedora|redhat)-ds/slapd-[^/]+/locks(/.*)?	system_u:object_r:slapd_lock_t
++/opt/(fedora|redhat)-ds/slapd-[^/]+/tmp(/.*)? system_u:object_r:slapd_var_run_t
++/opt/(fedora|redhat)-ds/slapd-[^/]+/config(/.*)? system_u:object_r:slapd_var_run_t
++/opt/(fedora|redhat)-ds/slapd-[^/]+/db(/.*)? system_u:object_r:slapd_db_t
++/opt/(fedora|redhat)-ds/slapd-[^/]+/bak(/.*)? system_u:object_r:slapd_db_t
++/opt/(fedora|redhat)-ds/slapd-[^/]+/start-slapd system_u:object_r:initrc_exec_t
++/opt/(fedora|redhat)-ds/slapd-[^/]+/stop-slapd system_u:object_r:initrc_exec_t
++/opt/(fedora|redhat)-ds/alias(/.*)? system_u:object_r:slapd_cert_t
++/opt/(fedora|redhat)-ds/alias/[^/]+so.* system_u:object_r:shlib_t
 diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/squid.fc policy-1.27.1/file_contexts/program/squid.fc
 --- nsapolicy/file_contexts/program/squid.fc	2005-09-16 11:17:27.000000000 -0400
 +++ policy-1.27.1/file_contexts/program/squid.fc	2005-11-03 18:25:49.000000000 -0500
@@ -4583,7 +4723,7 @@
  #
 diff --exclude-from=exclude -N -u -r nsapolicy/net_contexts policy-1.27.1/net_contexts
 --- nsapolicy/net_contexts	2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/net_contexts	2005-11-03 18:21:50.000000000 -0500
++++ policy-1.27.1/net_contexts	2005-11-09 20:25:54.000000000 -0500
 @@ -50,6 +50,10 @@
  portcon tcp 53 system_u:object_r:dns_port_t
  
@@ -4595,7 +4735,15 @@
  portcon udp 68  system_u:object_r:dhcpc_port_t
  portcon udp 70 system_u:object_r:gopher_port_t
  portcon tcp 70 system_u:object_r:gopher_port_t
-@@ -111,8 +115,6 @@
+@@ -61,6 +65,7 @@
+ portcon tcp 443  system_u:object_r:http_port_t
+ portcon tcp 488  system_u:object_r:http_port_t
+ portcon tcp 8008  system_u:object_r:http_port_t
++portcon tcp 8090  system_u:object_r:http_port_t
+ 
+ portcon tcp 106 system_u:object_r:pop_port_t
+ portcon tcp 109 system_u:object_r:pop_port_t
+@@ -111,8 +116,6 @@
  portcon tcp 749 system_u:object_r:kerberos_admin_port_t
  portcon tcp 750 system_u:object_r:kerberos_port_t
  portcon udp 750 system_u:object_r:kerberos_port_t
@@ -4604,7 +4752,13 @@
  portcon tcp 783 system_u:object_r:spamd_port_t
  portcon tcp 540 system_u:object_r:uucpd_port_t
  portcon tcp 2401 system_u:object_r:cvs_port_t
-@@ -164,6 +166,8 @@
+@@ -161,9 +164,14 @@
+ portcon tcp 5432 system_u:object_r:postgresql_port_t
+ portcon tcp 5666 system_u:object_r:inetd_child_port_t
+ portcon tcp 5703 system_u:object_r:ptal_port_t
++portcon tcp 9290 system_u:object_r:hplip_port_t
++portcon tcp 9291 system_u:object_r:hplip_port_t
++portcon tcp 9292 system_u:object_r:hplip_port_t
  portcon tcp 50000 system_u:object_r:hplip_port_t
  portcon tcp 50002 system_u:object_r:hplip_port_t
  portcon tcp 5900  system_u:object_r:vnc_port_t 


Index: selinux-policy-strict.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/FC-4/selinux-policy-strict.spec,v
retrieving revision 1.331
retrieving revision 1.332
diff -u -r1.331 -r1.332
--- selinux-policy-strict.spec	3 Nov 2005 23:31:20 -0000	1.331
+++ selinux-policy-strict.spec	10 Nov 2005 01:59:50 -0000	1.332
@@ -11,7 +11,7 @@
 Summary: SELinux %{type} policy configuration
 Name: selinux-policy-%{type}
 Version: 1.27.1
-Release: 2.13
+Release: 2.14
 License: GPL
 Group: System Environment/Base
 Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -229,6 +229,11 @@
 exit 0
 
 %changelog
+* Wed Nov 9 2005 Dan Walsh <dwalsh redhat com> 1.27.1-2.14
+- remove lvm.static
+- Fix slapd
+- Fix innd
+
 * Thu Nov 3 2005 Dan Walsh <dwalsh redhat com> 1.27.1-2.13
 - Fix radius to use pam
 - Fix samba to add fowner


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]