rpms/selinux-policy-strict/devel policy-20050916.patch, 1.19, 1.20 selinux-policy-strict.spec, 1.392, 1.393

fedora-cvs-commits at redhat.com fedora-cvs-commits at redhat.com
Thu Oct 13 13:45:32 UTC 2005


Author: dwalsh

Update of /cvs/dist/rpms/selinux-policy-strict/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv8058

Modified Files:
	policy-20050916.patch selinux-policy-strict.spec 
Log Message:
* Thu Oct 13 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-16
- Apply Russells fixes 


policy-20050916.patch:
 Makefile                                 |   26 ++--
 attrib.te                                |   36 ++++++
 domains/misc/kernel.te                   |    2 
 domains/program/crond.te                 |    2 
 domains/program/fsadm.te                 |    7 -
 domains/program/hostname.te              |    2 
 domains/program/ifconfig.te              |    5 
 domains/program/initrc.te                |   17 +++
 domains/program/ldconfig.te              |    3 
 domains/program/load_policy.te           |    7 -
 domains/program/login.te                 |   21 ++-
 domains/program/modutil.te               |   14 +-
 domains/program/mount.te                 |    6 -
 domains/program/netutils.te              |    3 
 domains/program/newrole.te               |    4 
 domains/program/passwd.te                |    1 
 domains/program/restorecon.te            |    3 
 domains/program/setfiles.te              |    4 
 domains/program/ssh.te                   |    6 -
 domains/program/su.te                    |    9 +
 domains/program/syslogd.te               |    6 -
 domains/program/unused/NetworkManager.te |    3 
 domains/program/unused/alsa.te           |    2 
 domains/program/unused/amanda.te         |   74 +++-----------
 domains/program/unused/anaconda.te       |    5 
 domains/program/unused/apache.te         |   17 +--
 domains/program/unused/apmd.te           |   13 ++
 domains/program/unused/auditd.te         |    2 
 domains/program/unused/automount.te      |    4 
 domains/program/unused/bluetooth.te      |   70 ++++++++++++-
 domains/program/unused/cups.te           |   18 ++-
 domains/program/unused/cvs.te            |    3 
 domains/program/unused/cyrus.te          |    2 
 domains/program/unused/dbusd.te          |    4 
 domains/program/unused/dcc.te            |    5 
 domains/program/unused/dhcpc.te          |    5 
 domains/program/unused/dhcpd.te          |    3 
 domains/program/unused/dovecot.te        |    4 
 domains/program/unused/ftpd.te           |    6 -
 domains/program/unused/hald.te           |    5 
 domains/program/unused/hotplug.te        |    5 
 domains/program/unused/hwclock.te        |    2 
 domains/program/unused/ipsec.te          |    2 
 domains/program/unused/kudzu.te          |    5 
 domains/program/unused/mta.te            |    8 +
 domains/program/unused/mysqld.te         |    6 -
 domains/program/unused/named.te          |   29 ++++-
 domains/program/unused/nscd.te           |    1 
 domains/program/unused/ntpd.te           |   10 -
 domains/program/unused/openct.te         |   16 +++
 domains/program/unused/pamconsole.te     |    2 
 domains/program/unused/pegasus.te        |   37 +++++++
 domains/program/unused/ping.te           |    3 
 domains/program/unused/postfix.te        |   30 +++--
 domains/program/unused/pppd.te           |    8 -
 domains/program/unused/procmail.te       |   11 +-
 domains/program/unused/readahead.te      |   21 +++
 domains/program/unused/rlogind.te        |    4 
 domains/program/unused/roundup.te        |   29 +++++
 domains/program/unused/rpcd.te           |   13 ++
 domains/program/unused/rsync.te          |    3 
 domains/program/unused/samba.te          |   12 +-
 domains/program/unused/snmpd.te          |    6 -
 domains/program/unused/squid.te          |    3 
 domains/program/unused/udev.te           |   10 +
 domains/program/unused/utempter.te       |    2 
 domains/program/unused/webalizer.te      |    3 
 domains/program/unused/winbind.te        |    1 
 domains/program/unused/xdm.te            |    3 
 domains/program/unused/yppasswdd.te      |   40 +++++++
 domains/program/unused/ypserv.te         |    1 
 domains/program/useradd.te               |    5 
 file_contexts/distros.fc                 |    2 
 file_contexts/program/bluetooth.fc       |    3 
 file_contexts/program/dhcpc.fc           |    2 
 file_contexts/program/dhcpd.fc           |    1 
 file_contexts/program/ftpd.fc            |    5 
 file_contexts/program/games.fc           |   11 +-
 file_contexts/program/ipsec.fc           |    1 
 file_contexts/program/openct.fc          |    2 
 file_contexts/program/pegasus.fc         |   11 ++
 file_contexts/program/pppd.fc            |    2 
 file_contexts/program/readahead.fc       |    1 
 file_contexts/program/roundup.fc         |    2 
 file_contexts/program/rpm.fc             |    4 
 file_contexts/program/rshd.fc            |    1 
 file_contexts/program/rsync.fc           |    2 
 file_contexts/program/xdm.fc             |    2 
 file_contexts/program/yppasswdd.fc       |    2 
 file_contexts/program/ypserv.fc          |    1 
 file_contexts/types.fc                   |    2 
 genfs_contexts                           |    2 
 macros/base_user_macros.te               |    6 +
 macros/core_macros.te                    |    3 
 macros/global_macros.te                  |   18 ++-
 macros/network_macros.te                 |   17 +++
 macros/program/apache_macros.te          |   13 ++
 macros/program/cdrecord_macros.te        |    2 
 macros/program/i18n_input_macros.te      |   21 +++
 macros/program/mta_macros.te             |    4 
 macros/program/newrole_macros.te         |    2 
 macros/program/pyzor_macros.te           |    2 
 macros/program/razor_macros.te           |    2 
 macros/program/su_macros.te              |    4 
 macros/program/uml_macros.te             |    2 
 macros/user_macros.te                    |    2 
 man/man8/ftpd_selinux.8                  |   19 +--
 man/man8/httpd_selinux.8                 |    9 +
 man/man8/rsync_selinux.8                 |   12 +-
 man/man8/samba_selinux.8                 |    9 +
 mcs                                      |  146 +++++++++++++++++++++++++++
 mls                                      |  163 ++++++++++++++++++++++++++++---
 net_contexts                             |    6 +
 targeted/appconfig/root_default_contexts |    4 
 targeted/assert.te                       |    2 
 targeted/domains/program/ssh.te          |    3 
 targeted/domains/program/xdm.te          |    4 
 targeted/domains/unconfined.te           |   16 ++-
 tunables/distro.tun                      |    2 
 tunables/tunable.tun                     |    4 
 types/devpts.te                          |    4 
 types/file.te                            |   15 ++
 types/network.te                         |   12 +-
 types/security.te                        |    5 
 124 files changed, 1096 insertions(+), 256 deletions(-)

Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/policy-20050916.patch,v
retrieving revision 1.19
retrieving revision 1.20
diff -u -r1.19 -r1.20
--- policy-20050916.patch	11 Oct 2005 19:59:13 -0000	1.19
+++ policy-20050916.patch	13 Oct 2005 13:45:27 -0000	1.20
@@ -1,7 +1,57 @@
 diff --exclude-from=exclude -N -u -r nsapolicy/attrib.te policy-1.27.1/attrib.te
 --- nsapolicy/attrib.te	2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/attrib.te	2005-10-04 12:21:54.000000000 -0400
-@@ -443,6 +443,9 @@
++++ policy-1.27.1/attrib.te	2005-10-13 09:30:54.000000000 -0400
+@@ -17,17 +17,48 @@
+ # Attributes for MLS:
+ #
+ 
++# Read files and search directories that have a classification higher than
++# subject clearance
+ attribute mlsfileread;
++
++# Read files and search directories with a classification higher than the
++# effective clearance but not higher than the clearance
+ attribute mlsfilereadtoclr;
++
++# Write files and directories in situations where MLS normally denies writes
+ attribute mlsfilewrite;
++
++# Write files and directories where clearance of the subject dominates the
++# classification of the file/dir and the classification of the file/dir
++# dominates the effective clearance of the subject.
+ attribute mlsfilewritetoclr;
++
++# Increase the classification and/or effective classification of the object
++# regardless of the clearance of the subject.
+ attribute mlsfileupgrade;
++
++# Decrease the classification and/or effective classification of the object
++# regardless of the clearance of the subject.  NB An new label with an
++# incomparable effective classification and an equal classification is
++# considered a downgrade as is an incomparable classification
+ attribute mlsfiledowngrade;
+ 
++# Read network data with a lower effective classification than the effective
++# clearance of the process
+ attribute mlsnetread;
+-attribute mlsnetreadtoclr;
++
++# Read network data with a lower effective classification than the effective
++# clearance of the process when the classification of the process is higherattribute mlsnetreadtoclr;
++
++# Write network data with a higher effective classification or with a
++# classification higher than the clearance of the subject
+ attribute mlsnetwrite;
++
++# Write network data where the clearance of the process dominates the
++# effective classification of the data and the effective classification of
++# the data dominates the effective clearance of the subject.
+ attribute mlsnetwritetoclr;
++
+ attribute mlsnetupgrade;
+ attribute mlsnetdowngrade;
+ attribute mlsnetrecvall;
+@@ -443,6 +474,9 @@
  # Attribute to designate unrestricted access
  attribute unrestricted;
  
@@ -13,13 +63,13 @@
  
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/misc/kernel.te policy-1.27.1/domains/misc/kernel.te
 --- nsapolicy/domains/misc/kernel.te	2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/misc/kernel.te	2005-10-05 10:05:53.000000000 -0400
++++ policy-1.27.1/domains/misc/kernel.te	2005-10-13 09:32:32.000000000 -0400
 @@ -30,7 +30,7 @@
  
  ifdef(`mls_policy', `
  # run init with maximum MLS range
 -range_transition kernel_t init_exec_t s0 - s9:c0.c127;
-+range_transition kernel_t init_exec_t s0 - s9:c0.c255;
++range_transition kernel_t init_exec_t s0 - s15:c0.c255;
  ')
  
  # Share state with the init process.
@@ -267,7 +317,7 @@
  allow update_modules_t urandom_device_t:chr_file { getattr read };
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/mount.te policy-1.27.1/domains/program/mount.te
 --- nsapolicy/domains/program/mount.te	2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/mount.te	2005-09-27 17:14:40.000000000 -0400
++++ policy-1.27.1/domains/program/mount.te	2005-10-13 09:24:55.000000000 -0400
 @@ -16,13 +16,14 @@
  role sysadm_r types mount_t;
  role system_r types mount_t;
@@ -285,6 +335,12 @@
  allow mount_t self:process { fork signal_perms };
  
  allow mount_t file_type:dir search;
+@@ -86,5 +87,4 @@
+ 
+ allow kernel_t mount_t:tcp_socket { read write };
+ allow mount_t self:capability { setgid setuid };
+-allow user_t mount_t:tcp_socket write;
+ allow mount_t proc_t:lnk_file read;
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/netutils.te policy-1.27.1/domains/program/netutils.te
 --- nsapolicy/domains/program/netutils.te	2005-09-12 16:40:28.000000000 -0400
 +++ policy-1.27.1/domains/program/netutils.te	2005-09-27 17:14:40.000000000 -0400
@@ -731,7 +787,7 @@
 +
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/bluetooth.te policy-1.27.1/domains/program/unused/bluetooth.te
 --- nsapolicy/domains/program/unused/bluetooth.te	2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/bluetooth.te	2005-10-11 14:00:24.000000000 -0400
++++ policy-1.27.1/domains/program/unused/bluetooth.te	2005-10-12 14:29:26.000000000 -0400
 @@ -11,16 +11,23 @@
  daemon_domain(bluetooth)
  
@@ -765,14 +821,14 @@
  
  # Read /etc/bluetooth
  allow bluetooth_t bluetooth_conf_t:dir search;
-@@ -44,5 +52,56 @@
+@@ -44,5 +52,63 @@
  allow bluetooth_t usbfs_t:dir r_dir_perms;
  allow bluetooth_t usbfs_t:file rw_file_perms; 
  allow bluetooth_t bin_t:dir search;
 -can_exec(bluetooth_t, bin_t)
 +can_exec(bluetooth_t, { bin_t shell_exec_t })
 +allow bluetooth_t bin_t:lnk_file read;
-+
+ 
 +#Handle bluetooth serial devices
 +allow bluetooth_t tty_device_t:chr_file rw_file_perms;
 +allow bluetooth_t self:fifo_file rw_file_perms;
@@ -792,7 +848,7 @@
 +allow bluetooth_helper_t bin_t:lnk_file read;
 +allow bluetooth_helper_t self:capability sys_nice;
 +allow bluetooth_helper_t self:fifo_file rw_file_perms;
-+allow bluetooth_helper_t self:process fork;
++allow bluetooth_helper_t self:process { fork getsched sigchld };
 +allow bluetooth_helper_t self:shm create_shm_perms;
 +allow bluetooth_helper_t self:unix_stream_socket create_stream_socket_perms;
 +allow bluetooth_helper_t { etc_t etc_runtime_t }:file { getattr read };
@@ -820,9 +876,16 @@
 +allow unpriv_userdomain bluetooth_t:dbus send_msg;
 +')
 +allow bluetooth_helper_t bluetooth_t:socket { read write };
- 
++allow bluetooth_helper_t self:unix_dgram_socket create_socket_perms;
++allow bluetooth_helper_t self:unix_stream_socket connectto;
++tmp_domain(bluetooth_helper)
++allow bluetooth_helper_t urandom_device_t:chr_file r_dir_perms;
++
 +dontaudit bluetooth_helper_t default_t:dir { read search };
 +dontaudit bluetooth_helper_t { devtty_t ttyfile }:chr_file { read write };
++dontaudit bluetooth_helper_t home_dir_type:dir r_dir_perms;
++allow bluetooth_helper_t xserver_log_t:dir search;
++allow bluetooth_helper_t xserver_log_t:file { getattr read };
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/cups.te policy-1.27.1/domains/program/unused/cups.te
 --- nsapolicy/domains/program/unused/cups.te	2005-09-16 11:17:08.000000000 -0400
 +++ policy-1.27.1/domains/program/unused/cups.te	2005-10-05 10:04:29.000000000 -0400
@@ -931,6 +994,21 @@
  allow system_dbusd_t self:unix_stream_socket connectto;
 +allow system_dbusd_t self:unix_stream_socket connectto;
 +allow system_dbusd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dcc.te policy-1.27.1/domains/program/unused/dcc.te
+--- nsapolicy/domains/program/unused/dcc.te	2005-09-12 16:40:29.000000000 -0400
++++ policy-1.27.1/domains/program/unused/dcc.te	2005-10-13 09:26:05.000000000 -0400
+@@ -200,9 +200,8 @@
+ can_exec_any(dcc_script_t)
+ dcc_common(dcc_script)
+ 
+-# Allow calling the script from an init script (initrt_t) or from
+-# rc.local (staff_t)
+-domain_auto_trans({ initrc_t staff_t }, dcc_script_exec_t, dcc_script_t)
++# Allow calling the script from an init script (initrt_t) 
++domain_auto_trans(initrc_t, dcc_script_exec_t, dcc_script_t)
+ 
+ # Start up the daemon process.  These scripts run 'su' to change to
+ # the dcc user (even though the default dcc user is root).
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dhcpc.te policy-1.27.1/domains/program/unused/dhcpc.te
 --- nsapolicy/domains/program/unused/dhcpc.te	2005-09-16 11:17:09.000000000 -0400
 +++ policy-1.27.1/domains/program/unused/dhcpc.te	2005-09-27 17:14:40.000000000 -0400
@@ -2094,6 +2172,14 @@
 +ifdef(`mls_policy', `
 +/sbin/cpio			--	system_u:object_r:rpm_exec_t
 +')
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/rshd.fc policy-1.27.1/file_contexts/program/rshd.fc
+--- nsapolicy/file_contexts/program/rshd.fc	2005-09-12 16:40:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/rshd.fc	2005-10-13 08:39:09.000000000 -0400
+@@ -1,3 +1,4 @@
+ # rshd.
+ /usr/sbin/in\.rshd	--	system_u:object_r:rshd_exec_t
++/usr/sbin/in\.rexecd	--	system_u:object_r:rshd_exec_t
+ /usr/kerberos/sbin/kshd	--	system_u:object_r:rshd_exec_t
 diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/rsync.fc policy-1.27.1/file_contexts/program/rsync.fc
 --- nsapolicy/file_contexts/program/rsync.fc	2005-09-12 16:40:27.000000000 -0400
 +++ policy-1.27.1/file_contexts/program/rsync.fc	2005-09-27 17:14:40.000000000 -0400
@@ -2454,7 +2540,7 @@
  
 diff --exclude-from=exclude -N -u -r nsapolicy/macros/user_macros.te policy-1.27.1/macros/user_macros.te
 --- nsapolicy/macros/user_macros.te	2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/macros/user_macros.te	2005-09-27 17:14:40.000000000 -0400
++++ policy-1.27.1/macros/user_macros.te	2005-10-13 09:26:43.000000000 -0400
 @@ -121,6 +121,7 @@
  # user domains.
  ifelse($1, sysadm, `',`
@@ -2463,6 +2549,14 @@
  ')
  ifdef(`slocate.te', `locate_domain($1)')
  ifdef(`lockdev.te', `lockdev_domain($1)')
+@@ -225,7 +226,6 @@
+ 
+ allow $1_t self:dir search;
+ allow $1_t self:file { getattr read };
+-allow secadm_t self:fifo_file rw_file_perms;
+ 
+ allow $1_t self:lnk_file read;
+ allow $1_t self:unix_stream_socket create_socket_perms;
 diff --exclude-from=exclude -N -u -r nsapolicy/Makefile policy-1.27.1/Makefile
 --- nsapolicy/Makefile	2005-09-16 11:17:08.000000000 -0400
 +++ policy-1.27.1/Makefile	2005-10-05 10:02:18.000000000 -0400
@@ -2836,7 +2930,7 @@
  #
 diff --exclude-from=exclude -N -u -r nsapolicy/mls policy-1.27.1/mls
 --- nsapolicy/mls	2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/mls	2005-10-05 09:42:58.000000000 -0400
++++ policy-1.27.1/mls	2005-10-13 09:27:34.000000000 -0400
 @@ -13,12 +13,17 @@
  sensitivity s7;
  sensitivity s8;


Index: selinux-policy-strict.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/selinux-policy-strict.spec,v
retrieving revision 1.392
retrieving revision 1.393
diff -u -r1.392 -r1.393
--- selinux-policy-strict.spec	11 Oct 2005 19:59:13 -0000	1.392
+++ selinux-policy-strict.spec	13 Oct 2005 13:45:27 -0000	1.393
@@ -10,7 +10,7 @@
 Summary: SELinux %{type} policy configuration
 Name: selinux-policy-%{type}
 Version: 1.27.1
-Release: 15
+Release: 16
 License: GPL
 Group: System Environment/Base
 Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -244,6 +244,9 @@
 exit 0
 
 %changelog
+* Thu Oct 13 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-16
+- Apply Russells fixes 
+
 * Tue Oct 11 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-15
 - Allow ftpd to upload to homedirs
 




More information about the fedora-cvs-commits mailing list