rpms/selinux-policy-targeted/FC-4 policy-20050916.patch, 1.10, 1.11 selinux-policy-targeted.spec, 1.343, 1.344
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Tue Oct 18 18:22:57 UTC 2005
- Previous message (by thread): rpms/libsemanage/devel .cvsignore, 1.17, 1.18 libsemanage.spec, 1.21, 1.22 sources, 1.18, 1.19
- Next message (by thread): rpms/libselinux/devel .cvsignore, 1.80, 1.81 libselinux.spec, 1.129, 1.130 sources, 1.82, 1.83
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy-targeted/FC-4
In directory cvs.devel.redhat.com:/tmp/cvs-serv30972
Modified Files:
policy-20050916.patch selinux-policy-targeted.spec
Log Message:
* Mon Oct 17 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.8
- Fix gssd
policy-20050916.patch:
Makefile | 24 +--
attrib.te | 35 ++++
domains/misc/kernel.te | 2
domains/program/crond.te | 2
domains/program/fsadm.te | 7
domains/program/hostname.te | 2
domains/program/ifconfig.te | 5
domains/program/initrc.te | 20 ++
domains/program/ldconfig.te | 3
domains/program/load_policy.te | 7
domains/program/login.te | 21 +-
domains/program/modutil.te | 14 +
domains/program/mount.te | 6
domains/program/netutils.te | 3
domains/program/newrole.te | 4
domains/program/passwd.te | 1
domains/program/restorecon.te | 3
domains/program/setfiles.te | 4
domains/program/ssh.te | 6
domains/program/su.te | 9 +
domains/program/syslogd.te | 6
domains/program/unused/NetworkManager.te | 8 -
domains/program/unused/alsa.te | 2
domains/program/unused/amanda.te | 74 ++--------
domains/program/unused/anaconda.te | 5
domains/program/unused/apache.te | 22 ++-
domains/program/unused/apmd.te | 13 +
domains/program/unused/auditd.te | 2
domains/program/unused/automount.te | 4
domains/program/unused/bluetooth.te | 72 +++++++++
domains/program/unused/cups.te | 18 +-
domains/program/unused/cvs.te | 3
domains/program/unused/cyrus.te | 2
domains/program/unused/dbusd.te | 4
domains/program/unused/dcc.te | 5
domains/program/unused/dhcpc.te | 5
domains/program/unused/dhcpd.te | 3
domains/program/unused/dovecot.te | 4
domains/program/unused/ftpd.te | 6
domains/program/unused/hald.te | 5
domains/program/unused/hotplug.te | 5
domains/program/unused/hwclock.te | 2
domains/program/unused/ipsec.te | 2
domains/program/unused/kudzu.te | 5
domains/program/unused/mta.te | 8 +
domains/program/unused/mysqld.te | 6
domains/program/unused/named.te | 29 +++
domains/program/unused/nscd.te | 1
domains/program/unused/ntpd.te | 10 -
domains/program/unused/openct.te | 16 ++
domains/program/unused/pamconsole.te | 2
domains/program/unused/pegasus.te | 37 +++++
domains/program/unused/ping.te | 3
domains/program/unused/postfix.te | 57 ++++---
domains/program/unused/pppd.te | 8 -
domains/program/unused/procmail.te | 11 +
domains/program/unused/readahead.te | 21 ++
domains/program/unused/rlogind.te | 4
domains/program/unused/roundup.te | 29 +++
domains/program/unused/rpcd.te | 18 ++
domains/program/unused/rsync.te | 3
domains/program/unused/samba.te | 12 +
domains/program/unused/snmpd.te | 6
domains/program/unused/squid.te | 3
domains/program/unused/udev.te | 10 +
domains/program/unused/utempter.te | 2
domains/program/unused/webalizer.te | 3
domains/program/unused/winbind.te | 1
domains/program/unused/xdm.te | 3
domains/program/unused/yppasswdd.te | 40 +++++
domains/program/unused/ypserv.te | 1
domains/program/useradd.te | 5
file_contexts/distros.fc | 2
file_contexts/program/apache.fc | 2
file_contexts/program/bluetooth.fc | 3
file_contexts/program/dhcpc.fc | 2
file_contexts/program/dhcpd.fc | 5
file_contexts/program/ftpd.fc | 5
file_contexts/program/games.fc | 11 +
file_contexts/program/ipsec.fc | 1
file_contexts/program/openct.fc | 2
file_contexts/program/pegasus.fc | 11 +
file_contexts/program/pppd.fc | 2
file_contexts/program/readahead.fc | 1
file_contexts/program/roundup.fc | 2
file_contexts/program/rpm.fc | 4
file_contexts/program/rshd.fc | 1
file_contexts/program/rsync.fc | 2
file_contexts/program/squid.fc | 3
file_contexts/program/xdm.fc | 2
file_contexts/program/yppasswdd.fc | 2
file_contexts/program/ypserv.fc | 1
file_contexts/types.fc | 4
genfs_contexts | 3
macros/base_user_macros.te | 6
macros/core_macros.te | 3
macros/global_macros.te | 18 +-
macros/network_macros.te | 17 ++
macros/program/apache_macros.te | 13 +
macros/program/bonobo_macros.te | 2
macros/program/cdrecord_macros.te | 2
macros/program/crontab_macros.te | 2
macros/program/dbusd_macros.te | 4
macros/program/gconf_macros.te | 2
macros/program/gift_macros.te | 2
macros/program/gpg_macros.te | 2
macros/program/i18n_input_macros.te | 21 ++
macros/program/lpr_macros.te | 2
macros/program/mta_macros.te | 4
macros/program/newrole_macros.te | 2
macros/program/pyzor_macros.te | 2
macros/program/razor_macros.te | 2
macros/program/su_macros.te | 4
macros/program/uml_macros.te | 2
macros/program/xdm_macros.te | 2
macros/user_macros.te | 6
man/man8/ftpd_selinux.8 | 19 +-
man/man8/httpd_selinux.8 | 9 +
man/man8/rsync_selinux.8 | 12 +
man/man8/samba_selinux.8 | 9 +
mcs | 210 ++++++++++------------------
mls | 227 +++++++++++--------------------
net_contexts | 8 -
targeted/appconfig/root_default_contexts | 4
targeted/assert.te | 2
targeted/domains/program/ssh.te | 3
targeted/domains/program/xdm.te | 4
targeted/domains/unconfined.te | 15 ++
tunables/distro.tun | 2
tunables/tunable.tun | 4
types/device.te | 4
types/devpts.te | 4
types/file.te | 18 +-
types/network.te | 13 -
types/security.te | 5
135 files changed, 1030 insertions(+), 537 deletions(-)
Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/FC-4/policy-20050916.patch,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- policy-20050916.patch 17 Oct 2005 19:58:15 -0000 1.10
+++ policy-20050916.patch 18 Oct 2005 18:22:53 -0000 1.11
@@ -142,7 +142,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/initrc.te policy-1.27.1/domains/program/initrc.te
--- nsapolicy/domains/program/initrc.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/initrc.te 2005-10-17 15:57:56.000000000 -0400
++++ policy-1.27.1/domains/program/initrc.te 2005-10-18 14:19:49.000000000 -0400
@@ -56,6 +56,10 @@
can_create_pty(initrc)
@@ -171,7 +171,7 @@
')dnl end distro_redhat
allow initrc_t system_map_t:{ file lnk_file } r_file_perms;
-@@ -322,3 +334,10 @@
+@@ -322,3 +334,9 @@
ifdef(`dbusd.te', `
allow initrc_t system_dbusd_var_run_t:sock_file write;
')
@@ -181,7 +181,6 @@
+ifdef(`use_mcs', `
+range_transition sysadm_t initrc_exec_t s0;
+')
-+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/ldconfig.te policy-1.27.1/domains/program/ldconfig.te
--- nsapolicy/domains/program/ldconfig.te 2005-09-16 11:17:27.000000000 -0400
+++ policy-1.27.1/domains/program/ldconfig.te 2005-10-17 15:45:51.000000000 -0400
@@ -485,7 +484,7 @@
allow syslogd_t self:capability { dac_override net_admin net_bind_service sys_resource sys_tty_config };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/alsa.te policy-1.27.1/domains/program/unused/alsa.te
--- nsapolicy/domains/program/unused/alsa.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/alsa.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/alsa.te 2005-10-18 14:20:13.000000000 -0400
@@ -11,6 +11,8 @@
allow alsa_t self:unix_stream_socket create_stream_socket_perms;
allow alsa_t self:unix_dgram_socket create_socket_perms;
@@ -497,7 +496,7 @@
allow alsa_t self:capability { setgid setuid ipc_owner };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/amanda.te policy-1.27.1/domains/program/unused/amanda.te
--- nsapolicy/domains/program/unused/amanda.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/amanda.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/amanda.te 2005-10-18 14:20:13.000000000 -0400
@@ -84,7 +84,6 @@
# configuration files -> read only
@@ -659,7 +658,7 @@
+allow amanda_t file_type:fifo_file getattr;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/anaconda.te policy-1.27.1/domains/program/unused/anaconda.te
--- nsapolicy/domains/program/unused/anaconda.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/anaconda.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/anaconda.te 2005-10-18 14:20:13.000000000 -0400
@@ -17,11 +17,6 @@
role system_r types ldconfig_t;
domain_auto_trans(anaconda_t, ldconfig_exec_t, ldconfig_t)
@@ -674,7 +673,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/apache.te policy-1.27.1/domains/program/unused/apache.te
--- nsapolicy/domains/program/unused/apache.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/apache.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/apache.te 2005-10-18 14:20:13.000000000 -0400
@@ -113,9 +113,12 @@
can_network_server(httpd_t)
can_kerberos(httpd_t)
@@ -738,7 +737,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/apmd.te policy-1.27.1/domains/program/unused/apmd.te
--- nsapolicy/domains/program/unused/apmd.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/apmd.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/apmd.te 2005-10-18 14:20:13.000000000 -0400
@@ -47,6 +47,7 @@
# acpid also has a logfile
@@ -765,7 +764,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/auditd.te policy-1.27.1/domains/program/unused/auditd.te
--- nsapolicy/domains/program/unused/auditd.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/auditd.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/auditd.te 2005-10-18 14:20:13.000000000 -0400
@@ -65,3 +65,5 @@
allow auditctl_t privfd:fd use;
@@ -774,7 +773,7 @@
+can_exec(auditd_t, sbin_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/automount.te policy-1.27.1/domains/program/unused/automount.te
--- nsapolicy/domains/program/unused/automount.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/automount.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/automount.te 2005-10-18 14:20:13.000000000 -0400
@@ -34,7 +34,9 @@
can_exec(automount_t, { etc_t automount_etc_t })
@@ -800,7 +799,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/bluetooth.te policy-1.27.1/domains/program/unused/bluetooth.te
--- nsapolicy/domains/program/unused/bluetooth.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/bluetooth.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/bluetooth.te 2005-10-18 14:20:13.000000000 -0400
@@ -11,16 +11,23 @@
daemon_domain(bluetooth)
@@ -903,7 +902,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/cups.te policy-1.27.1/domains/program/unused/cups.te
--- nsapolicy/domains/program/unused/cups.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/cups.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/cups.te 2005-10-18 14:20:13.000000000 -0400
@@ -188,6 +188,7 @@
# Uses networking to talk to the daemons
allow hplip_t self:unix_dgram_socket create_socket_perms;
@@ -968,7 +967,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/cvs.te policy-1.27.1/domains/program/unused/cvs.te
--- nsapolicy/domains/program/unused/cvs.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/cvs.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/cvs.te 2005-10-18 14:20:13.000000000 -0400
@@ -23,6 +23,9 @@
allow cvs_t etc_runtime_t:file { getattr read };
allow system_mail_t cvs_data_t:file { getattr read };
@@ -981,7 +980,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/cyrus.te policy-1.27.1/domains/program/unused/cyrus.te
--- nsapolicy/domains/program/unused/cyrus.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/cyrus.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/cyrus.te 2005-10-18 14:20:13.000000000 -0400
@@ -42,7 +42,7 @@
create_dir_file(cyrus_t, mail_spool_t)
allow cyrus_t var_spool_t:dir search;
@@ -993,7 +992,7 @@
allow cyrus_t saslauthd_t:unix_stream_socket { connectto };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dbusd.te policy-1.27.1/domains/program/unused/dbusd.te
--- nsapolicy/domains/program/unused/dbusd.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dbusd.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/dbusd.te 2005-10-18 14:20:13.000000000 -0400
@@ -12,7 +12,7 @@
# dac_override: /var/run/dbus is owned by messagebus on Debian
@@ -1011,7 +1010,7 @@
+allow system_dbusd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dcc.te policy-1.27.1/domains/program/unused/dcc.te
--- nsapolicy/domains/program/unused/dcc.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dcc.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/dcc.te 2005-10-18 14:20:13.000000000 -0400
@@ -200,9 +200,8 @@
can_exec_any(dcc_script_t)
dcc_common(dcc_script)
@@ -1026,7 +1025,7 @@
# the dcc user (even though the default dcc user is root).
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dhcpc.te policy-1.27.1/domains/program/unused/dhcpc.te
--- nsapolicy/domains/program/unused/dhcpc.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dhcpc.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/dhcpc.te 2005-10-18 14:20:13.000000000 -0400
@@ -120,6 +120,7 @@
allow dhcpc_t self:packet_socket create_socket_perms;
allow dhcpc_t var_lib_t:dir search;
@@ -1060,7 +1059,7 @@
')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dhcpd.te policy-1.27.1/domains/program/unused/dhcpd.te
--- nsapolicy/domains/program/unused/dhcpd.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dhcpd.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/dhcpd.te 2005-10-18 14:20:13.000000000 -0400
@@ -17,8 +17,6 @@
#
daemon_domain(dhcpd, `, nscd_client_domain')
@@ -1080,7 +1079,7 @@
allow dhcpd_t self:unix_stream_socket create_socket_perms;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dovecot.te policy-1.27.1/domains/program/unused/dovecot.te
--- nsapolicy/domains/program/unused/dovecot.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dovecot.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/dovecot.te 2005-10-18 14:20:13.000000000 -0400
@@ -43,7 +43,9 @@
can_kerberos(dovecot_t)
@@ -1094,7 +1093,7 @@
allow dovecot_t mail_spool_t:lnk_file read;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ftpd.te policy-1.27.1/domains/program/unused/ftpd.te
--- nsapolicy/domains/program/unused/ftpd.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/ftpd.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/ftpd.te 2005-10-18 14:20:13.000000000 -0400
@@ -99,9 +99,11 @@
if (ftp_home_dir) {
@@ -1111,7 +1110,7 @@
r_dir_file(ftpd_t, nfs_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/hald.te policy-1.27.1/domains/program/unused/hald.te
--- nsapolicy/domains/program/unused/hald.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/hald.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/hald.te 2005-10-18 14:20:13.000000000 -0400
@@ -24,7 +24,8 @@
allow hald_t self:dbus send_msg;
')
@@ -1130,7 +1129,7 @@
+r_dir_file(hald_t, hwdata_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/hotplug.te policy-1.27.1/domains/program/unused/hotplug.te
--- nsapolicy/domains/program/unused/hotplug.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/hotplug.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/hotplug.te 2005-10-18 14:20:13.000000000 -0400
@@ -11,9 +11,9 @@
# hotplug_exec_t is the type of the hotplug executable.
#
@@ -1153,7 +1152,7 @@
allow hotplug_t printer_device_t:chr_file setattr;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/hwclock.te policy-1.27.1/domains/program/unused/hwclock.te
--- nsapolicy/domains/program/unused/hwclock.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/hwclock.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/hwclock.te 2005-10-18 14:20:13.000000000 -0400
@@ -21,7 +21,6 @@
domain_auto_trans(sysadm_t, hwclock_exec_t, hwclock_t)
')
@@ -1169,7 +1168,7 @@
+r_dir_file(hwclock_t, etc_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ipsec.te policy-1.27.1/domains/program/unused/ipsec.te
--- nsapolicy/domains/program/unused/ipsec.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/ipsec.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/ipsec.te 2005-10-18 14:20:13.000000000 -0400
@@ -219,7 +219,7 @@
dontaudit ipsec_mgmt_t selinux_config_t:dir search;
dontaudit ipsec_t ttyfile:chr_file { read write };
@@ -1181,7 +1180,7 @@
allow ipsec_mgmt_t self:{ tcp_socket udp_socket } create_socket_perms;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/kudzu.te policy-1.27.1/domains/program/unused/kudzu.te
--- nsapolicy/domains/program/unused/kudzu.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/kudzu.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/kudzu.te 2005-10-18 14:20:13.000000000 -0400
@@ -20,7 +20,7 @@
allow kudzu_t ramfs_t:dir search;
allow kudzu_t ramfs_t:sock_file write;
@@ -1210,7 +1209,7 @@
allow kudzu_t initrc_t:unix_stream_socket connectto;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/mta.te policy-1.27.1/domains/program/unused/mta.te
--- nsapolicy/domains/program/unused/mta.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/mta.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/mta.te 2005-10-18 14:20:13.000000000 -0400
@@ -31,6 +31,10 @@
create_dir_file(system_mail_t, mail_spool_t)
allow system_mail_t mail_spool_t:fifo_file rw_file_perms;
@@ -1232,7 +1231,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/mysqld.te policy-1.27.1/domains/program/unused/mysqld.te
--- nsapolicy/domains/program/unused/mysqld.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/mysqld.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/mysqld.te 2005-10-18 14:20:13.000000000 -0400
@@ -12,7 +12,7 @@
#
daemon_domain(mysqld, `, nscd_client_domain')
@@ -1262,7 +1261,7 @@
-allow mysqld_t self:netlink_route_socket r_netlink_socket_perms;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/named.te policy-1.27.1/domains/program/unused/named.te
--- nsapolicy/domains/program/unused/named.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/named.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/named.te 2005-10-18 14:20:13.000000000 -0400
@@ -36,7 +36,7 @@
allow named_t self:process { setsched setcap setrlimit };
@@ -1324,7 +1323,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/NetworkManager.te policy-1.27.1/domains/program/unused/NetworkManager.te
--- nsapolicy/domains/program/unused/NetworkManager.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/NetworkManager.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/NetworkManager.te 2005-10-18 14:20:13.000000000 -0400
@@ -11,7 +11,7 @@
# NetworkManager_t is the domain for the NetworkManager daemon.
# NetworkManager_exec_t is the type of the NetworkManager executable.
@@ -1346,7 +1345,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/nscd.te policy-1.27.1/domains/program/unused/nscd.te
--- nsapolicy/domains/program/unused/nscd.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/nscd.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/nscd.te 2005-10-18 14:20:13.000000000 -0400
@@ -76,3 +76,4 @@
log_domain(nscd)
r_dir_file(nscd_t, cert_t)
@@ -1354,7 +1353,7 @@
+allow nscd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ntpd.te policy-1.27.1/domains/program/unused/ntpd.te
--- nsapolicy/domains/program/unused/ntpd.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/ntpd.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/ntpd.te 2005-10-18 14:20:13.000000000 -0400
@@ -26,11 +26,11 @@
# for SSP
allow ntpd_t urandom_device_t:chr_file { getattr read };
@@ -1382,7 +1381,7 @@
can_exec(ntpd_t, initrc_exec_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/openct.te policy-1.27.1/domains/program/unused/openct.te
--- nsapolicy/domains/program/unused/openct.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/domains/program/unused/openct.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/openct.te 2005-10-18 14:20:13.000000000 -0400
@@ -0,0 +1,16 @@
+#DESC openct - read files in page cache
+#
@@ -1402,7 +1401,7 @@
+allow openct_t etc_t:file r_file_perms;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/pamconsole.te policy-1.27.1/domains/program/unused/pamconsole.te
--- nsapolicy/domains/program/unused/pamconsole.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/pamconsole.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/pamconsole.te 2005-10-18 14:20:13.000000000 -0400
@@ -25,6 +25,7 @@
# for /var/run/console.lock checking
allow pam_console_t { var_t var_run_t }:dir search;
@@ -1418,7 +1417,7 @@
+nsswitch_domain(pam_console_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/pegasus.te policy-1.27.1/domains/program/unused/pegasus.te
--- nsapolicy/domains/program/unused/pegasus.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/domains/program/unused/pegasus.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/pegasus.te 2005-10-18 14:20:13.000000000 -0400
@@ -0,0 +1,37 @@
+#DESC pegasus - The Open Group Pegasus CIM/WBEM Server
+#
@@ -1459,7 +1458,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ping.te policy-1.27.1/domains/program/unused/ping.te
--- nsapolicy/domains/program/unused/ping.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/ping.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/ping.te 2005-10-18 14:20:13.000000000 -0400
@@ -37,6 +37,7 @@
uses_shlib(ping_t)
can_network_client(ping_t)
@@ -1478,7 +1477,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/postfix.te policy-1.27.1/domains/program/unused/postfix.te
--- nsapolicy/domains/program/unused/postfix.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/postfix.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/postfix.te 2005-10-18 14:20:13.000000000 -0400
@@ -54,6 +54,8 @@
allow postfix_$1_t proc_net_t:dir search;
allow postfix_$1_t proc_net_t:file { getattr read };
@@ -1664,7 +1663,7 @@
-allow postfix_local_t mail_spool_t:file { unlink };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/pppd.te policy-1.27.1/domains/program/unused/pppd.te
--- nsapolicy/domains/program/unused/pppd.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/pppd.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/pppd.te 2005-10-18 14:20:13.000000000 -0400
@@ -14,7 +14,7 @@
#
bool pppd_for_user false;
@@ -1707,7 +1706,7 @@
+allow pppd_t initrc_t:process noatsecure;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/procmail.te policy-1.27.1/domains/program/unused/procmail.te
--- nsapolicy/domains/program/unused/procmail.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/procmail.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/procmail.te 2005-10-18 14:20:13.000000000 -0400
@@ -19,8 +19,7 @@
uses_shlib(procmail_t)
allow procmail_t device_t:dir search;
@@ -1735,7 +1734,7 @@
# Search /var/run.
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/readahead.te policy-1.27.1/domains/program/unused/readahead.te
--- nsapolicy/domains/program/unused/readahead.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/domains/program/unused/readahead.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/readahead.te 2005-10-18 14:20:13.000000000 -0400
@@ -0,0 +1,21 @@
+#DESC readahead - read files in page cache
+#
@@ -1760,7 +1759,7 @@
+dontaudit readahead_t device_type:blk_file read;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/rlogind.te policy-1.27.1/domains/program/unused/rlogind.te
--- nsapolicy/domains/program/unused/rlogind.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/rlogind.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/rlogind.te 2005-10-18 14:20:13.000000000 -0400
@@ -35,4 +35,6 @@
allow rlogind_t default_t:dir search;
typealias rlogind_port_t alias rlogin_port_t;
@@ -1771,7 +1770,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/roundup.te policy-1.27.1/domains/program/unused/roundup.te
--- nsapolicy/domains/program/unused/roundup.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/domains/program/unused/roundup.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/roundup.te 2005-10-18 14:20:13.000000000 -0400
@@ -0,0 +1,29 @@
+# Roundup Issue Tracking System
+#
@@ -1804,7 +1803,7 @@
+allow roundup_t etc_t:file { getattr read };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/rpcd.te policy-1.27.1/domains/program/unused/rpcd.te
--- nsapolicy/domains/program/unused/rpcd.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/rpcd.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/rpcd.te 2005-10-18 14:20:13.000000000 -0400
@@ -19,7 +19,7 @@
can_network($1_t)
allow $1_t port_type:tcp_socket name_connect;
@@ -1814,7 +1813,7 @@
read_locale($1_t)
allow $1_t self:capability net_bind_service;
dontaudit $1_t self:capability net_admin;
-@@ -148,6 +148,15 @@
+@@ -148,6 +148,20 @@
allow gssd_t rpc_pipefs_t:dir r_dir_perms;
allow gssd_t rpc_pipefs_t:sock_file { read write };
allow gssd_t rpc_pipefs_t:file r_file_perms;
@@ -1825,15 +1824,20 @@
+
+bool allow_gssd_read_tmp true;
+if (allow_gssd_read_tmp) {
++#
++#needs to be able to udpate the kerberos ticket file
++#
+ifdef(`targeted_policy', `
+r_dir_file(gssd_t, tmp_t)
++allow gssd_t tmp_t:file write;
+', `
+r_dir_file(gssd_t, user_tmpfile)
++allow gssd_t user_tmpfile:file write;
+')
+}
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/rsync.te policy-1.27.1/domains/program/unused/rsync.te
--- nsapolicy/domains/program/unused/rsync.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/rsync.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/rsync.te 2005-10-18 14:20:13.000000000 -0400
@@ -15,5 +15,4 @@
type rsync_data_t, file_type, sysadmfile;
r_dir_file(rsync_t, rsync_data_t)
@@ -1843,7 +1847,7 @@
+allow rsync_t self:capability sys_chroot;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/samba.te policy-1.27.1/domains/program/unused/samba.te
--- nsapolicy/domains/program/unused/samba.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/samba.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/samba.te 2005-10-18 14:20:13.000000000 -0400
@@ -25,6 +25,9 @@
# not sure why it needs this
tmp_domain(smbd)
@@ -1880,7 +1884,7 @@
# Access Samba shares.
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/snmpd.te policy-1.27.1/domains/program/unused/snmpd.te
--- nsapolicy/domains/program/unused/snmpd.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/snmpd.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/snmpd.te 2005-10-18 14:20:13.000000000 -0400
@@ -22,8 +22,9 @@
# for the .index file
@@ -1910,7 +1914,7 @@
dontaudit snmpd_t selinux_config_t:dir search;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/squid.te policy-1.27.1/domains/program/unused/squid.te
--- nsapolicy/domains/program/unused/squid.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/squid.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/squid.te 2005-10-18 14:20:13.000000000 -0400
@@ -60,7 +60,7 @@
can_tcp_connect(web_client_domain, squid_t)
@@ -1928,7 +1932,7 @@
')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/udev.te policy-1.27.1/domains/program/unused/udev.te
--- nsapolicy/domains/program/unused/udev.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/udev.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/udev.te 2005-10-18 14:20:13.000000000 -0400
@@ -28,12 +28,12 @@
type udev_tdb_t, file_type, sysadmfile, dev_fs;
typealias udev_tdb_t alias udev_tbl_t;
@@ -1960,7 +1964,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/utempter.te policy-1.27.1/domains/program/unused/utempter.te
--- nsapolicy/domains/program/unused/utempter.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/utempter.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/utempter.te 2005-10-18 14:20:13.000000000 -0400
@@ -19,6 +19,8 @@
type utempter_exec_t, file_type, sysadmfile, exec_type;
domain_auto_trans(userdomain, utempter_exec_t, utempter_t)
@@ -1972,7 +1976,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/webalizer.te policy-1.27.1/domains/program/unused/webalizer.te
--- nsapolicy/domains/program/unused/webalizer.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/webalizer.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/webalizer.te 2005-10-18 14:20:13.000000000 -0400
@@ -20,6 +20,9 @@
#read apache log
allow webalizer_t var_log_t:dir r_dir_perms;
@@ -1985,7 +1989,7 @@
var_lib_domain(webalizer)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/winbind.te policy-1.27.1/domains/program/unused/winbind.te
--- nsapolicy/domains/program/unused/winbind.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/winbind.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/winbind.te 2005-10-18 14:20:13.000000000 -0400
@@ -44,6 +44,7 @@
r_dir_file(winbind_t, samba_etc_t)
allow winbind_helper_t self:unix_dgram_socket create_socket_perms;
@@ -1996,7 +2000,7 @@
allow winbind_helper_t privfd:fd use;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/xdm.te policy-1.27.1/domains/program/unused/xdm.te
--- nsapolicy/domains/program/unused/xdm.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/xdm.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/xdm.te 2005-10-18 14:20:13.000000000 -0400
@@ -371,3 +371,6 @@
dontaudit xdm_t ice_tmp_t:dir { getattr setattr };
@@ -2006,7 +2010,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/yppasswdd.te policy-1.27.1/domains/program/unused/yppasswdd.te
--- nsapolicy/domains/program/unused/yppasswdd.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/domains/program/unused/yppasswdd.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/yppasswdd.te 2005-10-18 14:20:13.000000000 -0400
@@ -0,0 +1,40 @@
+#DESC yppassdd - NIS password update daemon
+#
@@ -2050,7 +2054,7 @@
+rw_dir_create_file(yppasswdd_t, var_yp_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ypserv.te policy-1.27.1/domains/program/unused/ypserv.te
--- nsapolicy/domains/program/unused/ypserv.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/ypserv.te 2005-10-17 15:45:26.000000000 -0400
++++ policy-1.27.1/domains/program/unused/ypserv.te 2005-10-18 14:20:13.000000000 -0400
@@ -39,3 +39,4 @@
')
allow ypserv_t reserved_port_t:{ udp_socket tcp_socket } name_bind;
@@ -2361,7 +2365,7 @@
genfscon eventpollfs / system_u:object_r:eventpollfs_t
diff --exclude-from=exclude -N -u -r nsapolicy/macros/base_user_macros.te policy-1.27.1/macros/base_user_macros.te
--- nsapolicy/macros/base_user_macros.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/macros/base_user_macros.te 2005-10-17 15:48:43.000000000 -0400
++++ policy-1.27.1/macros/base_user_macros.te 2005-10-18 14:21:21.000000000 -0400
@@ -40,6 +40,12 @@
allow $1_t $1_home_t:{ notdevfile_class_set dir } { relabelfrom relabelto };
can_setfscreate($1_t)
@@ -2377,7 +2381,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/macros/core_macros.te policy-1.27.1/macros/core_macros.te
--- nsapolicy/macros/core_macros.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/macros/core_macros.te 2005-10-17 15:48:43.000000000 -0400
++++ policy-1.27.1/macros/core_macros.te 2005-10-18 14:21:21.000000000 -0400
@@ -620,6 +620,9 @@
# Label pty files with a derived type.
type_transition $1_t devpts_t:chr_file $1_devpts_t;
@@ -2390,7 +2394,7 @@
')
diff --exclude-from=exclude -N -u -r nsapolicy/macros/global_macros.te policy-1.27.1/macros/global_macros.te
--- nsapolicy/macros/global_macros.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/macros/global_macros.te 2005-10-17 15:48:43.000000000 -0400
++++ policy-1.27.1/macros/global_macros.te 2005-10-18 14:21:21.000000000 -0400
@@ -157,6 +157,11 @@
r_dir_file($1, locale_t)
')
@@ -2455,7 +2459,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/macros/network_macros.te policy-1.27.1/macros/network_macros.te
--- nsapolicy/macros/network_macros.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/macros/network_macros.te 2005-10-17 15:48:43.000000000 -0400
++++ policy-1.27.1/macros/network_macros.te 2005-10-18 14:21:21.000000000 -0400
@@ -153,7 +153,8 @@
')dnl end can_network definition
@@ -2486,7 +2490,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/apache_macros.te policy-1.27.1/macros/program/apache_macros.te
--- nsapolicy/macros/program/apache_macros.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/macros/program/apache_macros.te 2005-10-17 15:48:16.000000000 -0400
++++ policy-1.27.1/macros/program/apache_macros.te 2005-10-18 14:20:55.000000000 -0400
@@ -38,7 +38,7 @@
allow httpd_$1_script_t etc_runtime_t:file { getattr read };
read_locale(httpd_$1_script_t)
@@ -2527,9 +2531,22 @@
+
+
')
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/bonobo_macros.te policy-1.27.1/macros/program/bonobo_macros.te
+--- nsapolicy/macros/program/bonobo_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/program/bonobo_macros.te 2005-10-18 14:20:55.000000000 -0400
+@@ -72,9 +72,7 @@
+ # here temporarily, since bonobo runs as ROLE_t by default anyway
+ domain_auto_trans($1_bonobo_t, bin_t, $1_t)
+
+-ifdef(`xdm.te', `
+ can_pipe_xdm($1_bonobo_t)
+-')
+
+ ') dnl ifdef bonobo_domain_args
+ ') dnl bonobo_domain
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/cdrecord_macros.te policy-1.27.1/macros/program/cdrecord_macros.te
--- nsapolicy/macros/program/cdrecord_macros.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/macros/program/cdrecord_macros.te 2005-10-17 15:48:16.000000000 -0400
++++ policy-1.27.1/macros/program/cdrecord_macros.te 2005-10-18 14:20:55.000000000 -0400
@@ -41,7 +41,7 @@
allow $1_cdrecord_t self:capability { ipc_lock sys_nice setuid dac_override sys_rawio };
@@ -2539,9 +2556,85 @@
allow $1_cdrecord_t $1_home_t:dir search;
allow $1_cdrecord_t $1_home_dir_t:dir r_dir_perms;
allow $1_cdrecord_t $1_home_t:file r_file_perms;
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/crontab_macros.te policy-1.27.1/macros/program/crontab_macros.te
+--- nsapolicy/macros/program/crontab_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/program/crontab_macros.te 2005-10-18 14:20:55.000000000 -0400
+@@ -40,7 +40,7 @@
+
+ # Use capabilities dac_override is to create the file in the directory
+ # under /tmp
+-allow $1_crontab_t $1_crontab_t:capability { setuid setgid chown dac_override };
++allow $1_crontab_t self:capability { setuid setgid chown dac_override };
+
+ # Type for temporary files.
+ file_type_auto_trans($1_crontab_t, tmp_t, $1_tmp_t, { dir file })
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/dbusd_macros.te policy-1.27.1/macros/program/dbusd_macros.te
+--- nsapolicy/macros/program/dbusd_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/program/dbusd_macros.te 2005-10-18 14:20:55.000000000 -0400
+@@ -29,9 +29,7 @@
+ r_dir_file($1_dbusd_t, etc_dbusd_t)
+ tmp_domain($1_dbusd)
+ allow $1_dbusd_t self:process fork;
+-ifdef(`xdm.te', `
+ can_pipe_xdm($1_dbusd_t)
+-')
+
+ allow $1_dbusd_t self:unix_stream_socket create_stream_socket_perms;
+ allow $1_dbusd_t self:unix_dgram_socket create_socket_perms;
+@@ -71,11 +69,11 @@
+ # For connecting to the bus
+ allow $2_t $1_dbusd_t:unix_stream_socket connectto;
+
+-') dnl endif dbusd.te
+ ifelse(`system', `$1', `
+ allow { $2_t } { var_run_t system_dbusd_var_run_t }:dir search;
+ allow { $2_t } system_dbusd_var_run_t:sock_file write;
+ ',`') dnl endif system
++') dnl endif dbusd.te
+ ')
+
+ # can_dbusd_converse(dbus_type, domain_prefix_a, domain_prefix_b)
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/gconf_macros.te policy-1.27.1/macros/program/gconf_macros.te
+--- nsapolicy/macros/program/gconf_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/program/gconf_macros.te 2005-10-18 14:20:55.000000000 -0400
+@@ -31,8 +31,8 @@
+ # /tmp/gconfd-USER
+ tmp_domain($1_gconfd)
+
+-ifdef(`xdm.te', `
+ can_pipe_xdm($1_gconfd_t)
++ifdef(`xdm.te', `
+ allow xdm_t $1_gconfd_t:process signal;
+ ')
+
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/gift_macros.te policy-1.27.1/macros/program/gift_macros.te
+--- nsapolicy/macros/program/gift_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/program/gift_macros.te 2005-10-18 14:20:55.000000000 -0400
+@@ -90,9 +90,7 @@
+ r_dir_file($1_giftd_t, usr_t)
+
+ # Connect to xdm
+-ifdef(`xdm.te', `
+ can_pipe_xdm($1_giftd_t)
+-')
+
+ ') dnl giftd_domain
+
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/gpg_macros.te policy-1.27.1/macros/program/gpg_macros.te
+--- nsapolicy/macros/program/gpg_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/program/gpg_macros.te 2005-10-18 14:20:55.000000000 -0400
+@@ -108,8 +108,6 @@
+ # for nscd
+ dontaudit $1_gpg_helper_t var_t:dir search;
+
+-ifdef(`xdm.te', `
+ can_pipe_xdm($1_gpg_t)
+-')
+
+ ')dnl end gpg_domain definition
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/i18n_input_macros.te policy-1.27.1/macros/program/i18n_input_macros.te
--- nsapolicy/macros/program/i18n_input_macros.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/macros/program/i18n_input_macros.te 2005-10-17 15:48:16.000000000 -0400
++++ policy-1.27.1/macros/program/i18n_input_macros.te 2005-10-18 14:20:55.000000000 -0400
@@ -0,0 +1,21 @@
+#
+# Macros for i18n_input
@@ -2564,9 +2657,21 @@
+')
+
+
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/lpr_macros.te policy-1.27.1/macros/program/lpr_macros.te
+--- nsapolicy/macros/program/lpr_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/program/lpr_macros.te 2005-10-18 14:20:55.000000000 -0400
+@@ -39,7 +39,7 @@
+ can_ypbind($1_lpr_t)
+
+ # Use capabilities.
+-allow $1_lpr_t $1_lpr_t:capability { setuid dac_override net_bind_service chown };
++allow $1_lpr_t self:capability { setuid dac_override net_bind_service chown };
+
+ allow $1_lpr_t self:unix_stream_socket create_stream_socket_perms;
+
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/mta_macros.te policy-1.27.1/macros/program/mta_macros.te
--- nsapolicy/macros/program/mta_macros.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/macros/program/mta_macros.te 2005-10-17 15:48:16.000000000 -0400
++++ policy-1.27.1/macros/program/mta_macros.te 2005-10-18 14:20:55.000000000 -0400
@@ -34,7 +34,7 @@
uses_shlib($1_mail_t)
@@ -2587,7 +2692,7 @@
# For when the user wants to send mail via port 25 localhost
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/newrole_macros.te policy-1.27.1/macros/program/newrole_macros.te
--- nsapolicy/macros/program/newrole_macros.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/macros/program/newrole_macros.te 2005-10-17 15:48:16.000000000 -0400
++++ policy-1.27.1/macros/program/newrole_macros.te 2005-10-18 14:20:55.000000000 -0400
@@ -20,6 +20,8 @@
read_locale($1_t)
read_sysctl($1_t)
@@ -2599,7 +2704,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/pyzor_macros.te policy-1.27.1/macros/program/pyzor_macros.te
--- nsapolicy/macros/program/pyzor_macros.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/macros/program/pyzor_macros.te 2005-10-17 15:48:16.000000000 -0400
++++ policy-1.27.1/macros/program/pyzor_macros.te 2005-10-18 14:20:55.000000000 -0400
@@ -64,6 +64,6 @@
# Allow pyzor to be run by hand. Needed by any action other than
@@ -2610,7 +2715,7 @@
')
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/razor_macros.te policy-1.27.1/macros/program/razor_macros.te
--- nsapolicy/macros/program/razor_macros.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/macros/program/razor_macros.te 2005-10-17 15:48:16.000000000 -0400
++++ policy-1.27.1/macros/program/razor_macros.te 2005-10-18 14:20:55.000000000 -0400
@@ -70,6 +70,6 @@
# Allow razor to be run by hand. Needed by any action other than
@@ -2621,7 +2726,7 @@
')
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/su_macros.te policy-1.27.1/macros/program/su_macros.te
--- nsapolicy/macros/program/su_macros.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/macros/program/su_macros.te 2005-10-17 15:48:16.000000000 -0400
++++ policy-1.27.1/macros/program/su_macros.te 2005-10-18 14:20:55.000000000 -0400
@@ -54,7 +54,7 @@
allow $1_su_t self:process { setsched setrlimit };
allow $1_su_t device_t:dir search;
@@ -2642,7 +2747,7 @@
# Caused by su - init scripts
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/uml_macros.te policy-1.27.1/macros/program/uml_macros.te
--- nsapolicy/macros/program/uml_macros.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/macros/program/uml_macros.te 2005-10-17 15:48:16.000000000 -0400
++++ policy-1.27.1/macros/program/uml_macros.te 2005-10-18 14:20:55.000000000 -0400
@@ -81,7 +81,7 @@
allow uml_net_t $1_uml_t:unix_stream_socket { read write };
allow uml_net_t $1_uml_t:unix_dgram_socket { read write };
@@ -2652,9 +2757,21 @@
dontaudit uml_net_t $1_uml_rw_t:dir { getattr search };
')dnl end ifdef uml_net.te
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/xdm_macros.te policy-1.27.1/macros/program/xdm_macros.te
+--- nsapolicy/macros/program/xdm_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/program/xdm_macros.te 2005-10-18 14:20:55.000000000 -0400
+@@ -6,6 +6,8 @@
+ #
+
+ define(`can_pipe_xdm', `
++ifdef(`xdm.te', `
+ allow $1 xdm_t:fd use;
+ allow $1 xdm_t:fifo_file { getattr read write ioctl };
++')
+ ') dnl can_pipe_xdm
diff --exclude-from=exclude -N -u -r nsapolicy/macros/user_macros.te policy-1.27.1/macros/user_macros.te
--- nsapolicy/macros/user_macros.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/macros/user_macros.te 2005-10-17 15:48:43.000000000 -0400
++++ policy-1.27.1/macros/user_macros.te 2005-10-18 14:21:21.000000000 -0400
@@ -121,6 +121,7 @@
# user domains.
ifelse($1, sysadm, `',`
@@ -2663,11 +2780,29 @@
')
ifdef(`slocate.te', `locate_domain($1)')
ifdef(`lockdev.te', `lockdev_domain($1)')
-@@ -225,7 +226,6 @@
+@@ -143,7 +144,7 @@
+ allow $1_t port_t:tcp_socket name_bind;
+ }
+ # port access is audited even if dac would not have allowed it, so dontaudit it here
+-dontaudit $1_t reserved_port_type:tcp_socket name_bind;
++dontaudit $1_t { reserved_port_type reserved_port_t }:tcp_socket name_bind;
+
+ # Allow system log read
+ if (user_dmesg) {
+@@ -203,6 +204,7 @@
+
+ # Grant read/search permissions to some of /proc.
+ r_dir_file($1_t, proc_t)
++# netstat needs to access proc_net_t; if you want to hide this info use dontaudit here instead
+ r_dir_file($1_t, proc_net_t)
+
+ base_file_read_access($1_t)
+@@ -225,7 +227,7 @@
allow $1_t self:dir search;
allow $1_t self:file { getattr read };
-allow secadm_t self:fifo_file rw_file_perms;
++allow $1_t self:fifo_file rw_file_perms;
allow $1_t self:lnk_file read;
allow $1_t self:unix_stream_socket create_socket_perms;
@@ -3353,7 +3488,7 @@
#
diff --exclude-from=exclude -N -u -r nsapolicy/net_contexts policy-1.27.1/net_contexts
--- nsapolicy/net_contexts 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/net_contexts 2005-10-12 14:40:15.000000000 -0400
++++ policy-1.27.1/net_contexts 2005-10-18 14:21:39.000000000 -0400
@@ -50,6 +50,10 @@
portcon tcp 53 system_u:object_r:dns_port_t
@@ -3365,7 +3500,16 @@
portcon udp 68 system_u:object_r:dhcpc_port_t
portcon udp 70 system_u:object_r:gopher_port_t
portcon tcp 70 system_u:object_r:gopher_port_t
-@@ -164,6 +168,8 @@
+@@ -111,8 +115,6 @@
+ portcon tcp 749 system_u:object_r:kerberos_admin_port_t
+ portcon tcp 750 system_u:object_r:kerberos_port_t
+ portcon udp 750 system_u:object_r:kerberos_port_t
+-portcon tcp 4444 system_u:object_r:kerberos_master_port_t
+-portcon udp 4444 system_u:object_r:kerberos_master_port_t
+ portcon tcp 783 system_u:object_r:spamd_port_t
+ portcon tcp 540 system_u:object_r:uucpd_port_t
+ portcon tcp 2401 system_u:object_r:cvs_port_t
+@@ -164,6 +166,8 @@
portcon tcp 50000 system_u:object_r:hplip_port_t
portcon tcp 50002 system_u:object_r:hplip_port_t
portcon tcp 5900 system_u:object_r:vnc_port_t
@@ -3477,9 +3621,23 @@
# Allow user_r to reach sysadm_r via su, sudo, or userhelper.
# Otherwise, only staff_r can do so.
+diff --exclude-from=exclude -N -u -r nsapolicy/types/device.te policy-1.27.1/types/device.te
+--- nsapolicy/types/device.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/types/device.te 2005-10-18 14:19:04.000000000 -0400
+@@ -131,8 +131,8 @@
+ # Type for /dev/.devfsd
+ type devfs_control_t, device_type, dev_fs;
+
+-# Type for /dev/cpu/mtrr
+-type mtrr_device_t, device_type, dev_fs;
++# Type for /dev/cpu/mtrr and /proc/mtrr
++type mtrr_device_t, device_type, dev_fs, proc_fs;
+
+ # Type for /dev/pmu
+ type power_device_t, device_type, dev_fs;
diff --exclude-from=exclude -N -u -r nsapolicy/types/devpts.te policy-1.27.1/types/devpts.te
--- nsapolicy/types/devpts.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/types/devpts.te 2005-10-12 14:40:15.000000000 -0400
++++ policy-1.27.1/types/devpts.te 2005-10-18 14:19:04.000000000 -0400
@@ -18,4 +18,6 @@
#
type devpts_t, mount_point, fs_type;
@@ -3490,7 +3648,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/types/file.te policy-1.27.1/types/file.te
--- nsapolicy/types/file.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/types/file.te 2005-10-17 15:41:06.000000000 -0400
++++ policy-1.27.1/types/file.te 2005-10-18 14:19:04.000000000 -0400
@@ -307,8 +307,7 @@
type hugetlbfs_t, mount_point, fs_type, sysadmfile;
allow hugetlbfs_t self:filesystem associate;
@@ -3538,7 +3696,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/types/network.te policy-1.27.1/types/network.te
--- nsapolicy/types/network.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/types/network.te 2005-10-12 14:40:15.000000000 -0400
++++ policy-1.27.1/types/network.te 2005-10-18 14:19:04.000000000 -0400
@@ -18,7 +18,7 @@
type dhcpd_port_t, port_type, reserved_port_type;
type smbd_port_t, port_type, reserved_port_type;
@@ -3548,7 +3706,15 @@
type http_port_t, port_type, reserved_port_type;
type ipp_port_t, port_type, reserved_port_type;
type gopher_port_t, port_type, reserved_port_type;
-@@ -105,7 +105,7 @@
+@@ -45,7 +45,6 @@
+ #
+ type kerberos_port_t, port_type, reserved_port_type;
+ type kerberos_admin_port_t, port_type, reserved_port_type;
+-type kerberos_master_port_t, port_type;
+
+ #
+ # Ports used to communicate with portmap server
+@@ -105,7 +104,7 @@
type printer_port_t, port_type, reserved_port_type;
type mysqld_port_t, port_type;
type postgresql_port_t, port_type;
@@ -3557,7 +3723,7 @@
type howl_port_t, port_type;
type dict_port_t, port_type;
type syslogd_port_t, port_type, reserved_port_type;
-@@ -120,11 +120,13 @@
+@@ -120,11 +119,13 @@
type zebra_port_t, port_type;
type i18n_input_port_t, port_type;
type vnc_port_t, port_type;
@@ -3573,7 +3739,7 @@
type postgrey_port_t, port_type;
type asterisk_port_t, port_type;
type utcpserver_port_t, port_type;
-@@ -157,7 +159,7 @@
+@@ -157,7 +158,7 @@
type telnetd_port_t, port_type, reserved_port_type;
type comsat_port_t, port_type, reserved_port_type;
type cvs_port_t, port_type;
@@ -3584,7 +3750,7 @@
type rsync_port_t, port_type, reserved_port_type;
diff --exclude-from=exclude -N -u -r nsapolicy/types/security.te policy-1.27.1/types/security.te
--- nsapolicy/types/security.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/types/security.te 2005-10-12 14:40:15.000000000 -0400
++++ policy-1.27.1/types/security.te 2005-10-18 14:19:04.000000000 -0400
@@ -13,12 +13,17 @@
# applied to selinuxfs inodes.
#
Index: selinux-policy-targeted.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/FC-4/selinux-policy-targeted.spec,v
retrieving revision 1.343
retrieving revision 1.344
diff -u -r1.343 -r1.344
--- selinux-policy-targeted.spec 17 Oct 2005 19:52:35 -0000 1.343
+++ selinux-policy-targeted.spec 18 Oct 2005 18:22:53 -0000 1.344
@@ -9,7 +9,7 @@
Summary: SELinux %{type} policy configuration
Name: selinux-policy-%{type}
Version: 1.27.1
-Release: 2.7
+Release: 2.8
License: GPL
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -236,6 +236,9 @@
exit 0
%changelog
+* Mon Oct 17 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.8
+- Fix gssd
+
* Mon Oct 17 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.7
- Update to match rawhide
- Previous message (by thread): rpms/libsemanage/devel .cvsignore, 1.17, 1.18 libsemanage.spec, 1.21, 1.22 sources, 1.18, 1.19
- Next message (by thread): rpms/libselinux/devel .cvsignore, 1.80, 1.81 libselinux.spec, 1.129, 1.130 sources, 1.82, 1.83
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the fedora-cvs-commits
mailing list