rpms/selinux-policy-targeted/devel policy-20050916.patch, 1.24, 1.25 selinux-policy-targeted.spec, 1.392, 1.393
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Thu Oct 20 19:14:27 UTC 2005
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy-targeted/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv30696
Modified Files:
policy-20050916.patch selinux-policy-targeted.spec
Log Message:
* Thu Oct 20 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-22
- Fix to make postfix read spamassasin files
policy-20050916.patch:
Makefile | 26 +-
attrib.te | 96 ++++++++++-
domains/misc/kernel.te | 2
domains/program/crond.te | 2
domains/program/fsadm.te | 7
domains/program/hostname.te | 2
domains/program/ifconfig.te | 5
domains/program/initrc.te | 20 ++
domains/program/ldconfig.te | 3
domains/program/load_policy.te | 7
domains/program/login.te | 21 +-
domains/program/modutil.te | 14 -
domains/program/mount.te | 6
domains/program/netutils.te | 3
domains/program/newrole.te | 4
domains/program/passwd.te | 1
domains/program/restorecon.te | 3
domains/program/setfiles.te | 4
domains/program/ssh.te | 6
domains/program/su.te | 9 +
domains/program/syslogd.te | 6
domains/program/unused/NetworkManager.te | 8
domains/program/unused/alsa.te | 2
domains/program/unused/amanda.te | 74 ++------
domains/program/unused/anaconda.te | 5
domains/program/unused/apache.te | 22 +-
domains/program/unused/apmd.te | 19 ++
domains/program/unused/auditd.te | 2
domains/program/unused/automount.te | 4
domains/program/unused/bluetooth.te | 72 ++++++++
domains/program/unused/cups.te | 20 +-
domains/program/unused/cvs.te | 3
domains/program/unused/cyrus.te | 2
domains/program/unused/dbusd.te | 4
domains/program/unused/dcc.te | 5
domains/program/unused/dhcpc.te | 7
domains/program/unused/dhcpd.te | 3
domains/program/unused/dovecot.te | 4
domains/program/unused/ftpd.te | 6
domains/program/unused/hald.te | 5
domains/program/unused/hotplug.te | 5
domains/program/unused/hwclock.te | 2
domains/program/unused/ipsec.te | 2
domains/program/unused/kudzu.te | 5
domains/program/unused/mta.te | 8
domains/program/unused/mysqld.te | 12 -
domains/program/unused/named.te | 29 ++-
domains/program/unused/nscd.te | 1
domains/program/unused/ntpd.te | 10 -
domains/program/unused/openct.te | 16 +
domains/program/unused/pamconsole.te | 2
domains/program/unused/pegasus.te | 37 ++++
domains/program/unused/ping.te | 3
domains/program/unused/postfix.te | 60 ++++--
domains/program/unused/pppd.te | 8
domains/program/unused/procmail.te | 11 +
domains/program/unused/readahead.te | 21 ++
domains/program/unused/rlogind.te | 4
domains/program/unused/roundup.te | 29 +++
domains/program/unused/rpcd.te | 18 +-
domains/program/unused/rsync.te | 3
domains/program/unused/samba.te | 12 +
domains/program/unused/sendmail.te | 3
domains/program/unused/snmpd.te | 6
domains/program/unused/squid.te | 3
domains/program/unused/udev.te | 10 -
domains/program/unused/utempter.te | 2
domains/program/unused/webalizer.te | 3
domains/program/unused/winbind.te | 1
domains/program/unused/xdm.te | 3
domains/program/unused/yppasswdd.te | 40 ++++
domains/program/unused/ypserv.te | 1
domains/program/useradd.te | 5
file_contexts/distros.fc | 2
file_contexts/program/apache.fc | 2
file_contexts/program/bluetooth.fc | 3
file_contexts/program/dhcpc.fc | 2
file_contexts/program/dhcpd.fc | 5
file_contexts/program/ftpd.fc | 5
file_contexts/program/games.fc | 11 -
file_contexts/program/ipsec.fc | 1
file_contexts/program/kudzu.fc | 2
file_contexts/program/openct.fc | 2
file_contexts/program/pegasus.fc | 11 +
file_contexts/program/pppd.fc | 2
file_contexts/program/readahead.fc | 1
file_contexts/program/roundup.fc | 2
file_contexts/program/rpm.fc | 4
file_contexts/program/rshd.fc | 1
file_contexts/program/rsync.fc | 2
file_contexts/program/squid.fc | 3
file_contexts/program/xdm.fc | 2
file_contexts/program/yppasswdd.fc | 2
file_contexts/program/ypserv.fc | 1
file_contexts/types.fc | 4
genfs_contexts | 3
macros/base_user_macros.te | 6
macros/core_macros.te | 3
macros/global_macros.te | 18 +-
macros/network_macros.te | 17 +
macros/program/apache_macros.te | 13 +
macros/program/bonobo_macros.te | 2
macros/program/cdrecord_macros.te | 2
macros/program/crontab_macros.te | 2
macros/program/dbusd_macros.te | 4
macros/program/gconf_macros.te | 2
macros/program/gift_macros.te | 2
macros/program/gpg_macros.te | 2
macros/program/i18n_input_macros.te | 21 ++
macros/program/lpr_macros.te | 2
macros/program/mta_macros.te | 4
macros/program/newrole_macros.te | 2
macros/program/pyzor_macros.te | 2
macros/program/razor_macros.te | 2
macros/program/su_macros.te | 4
macros/program/uml_macros.te | 2
macros/program/xdm_macros.te | 2
macros/user_macros.te | 6
man/man8/ftpd_selinux.8 | 19 +-
man/man8/httpd_selinux.8 | 9 +
man/man8/rsync_selinux.8 | 12 +
man/man8/samba_selinux.8 | 9 +
mcs | 210 +++++++++---------------
mls | 270 +++++++++++--------------------
net_contexts | 8
targeted/appconfig/root_default_contexts | 4
targeted/assert.te | 2
targeted/domains/program/ssh.te | 3
targeted/domains/program/xdm.te | 4
targeted/domains/unconfined.te | 16 +
tunables/distro.tun | 2
tunables/tunable.tun | 4
types/device.te | 4
types/devpts.te | 4
types/file.te | 21 +-
types/network.te | 13 -
types/security.te | 6
137 files changed, 1118 insertions(+), 584 deletions(-)
Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/devel/policy-20050916.patch,v
retrieving revision 1.24
retrieving revision 1.25
diff -u -r1.24 -r1.25
--- policy-20050916.patch 19 Oct 2005 21:28:32 -0000 1.24
+++ policy-20050916.patch 20 Oct 2005 19:14:19 -0000 1.25
@@ -996,7 +996,16 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/cups.te policy-1.27.1/domains/program/unused/cups.te
--- nsapolicy/domains/program/unused/cups.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/cups.te 2005-10-05 10:04:29.000000000 -0400
++++ policy-1.27.1/domains/program/unused/cups.te 2005-10-20 15:07:21.000000000 -0400
+@@ -48,7 +48,7 @@
+
+ # this is not ideal, and allowing setattr access to cupsd_etc_t is wrong
+ file_type_auto_trans(cupsd_t, cupsd_etc_t, cupsd_rw_etc_t, file)
+-file_type_auto_trans(cupsd_t, var_t, cupsd_rw_etc_t, file)
++file_type_auto_trans(cupsd_t, var_t, cupsd_rw_etc_t, { dir file })
+ allow cupsd_t cupsd_rw_etc_t:dir { setattr rw_dir_perms };
+ allow cupsd_t cupsd_etc_t:file setattr;
+ allow cupsd_t cupsd_etc_t:dir setattr;
@@ -188,6 +188,7 @@
# Uses networking to talk to the daemons
allow hplip_t self:unix_dgram_socket create_socket_perms;
@@ -1327,7 +1336,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/mysqld.te policy-1.27.1/domains/program/unused/mysqld.te
--- nsapolicy/domains/program/unused/mysqld.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/mysqld.te 2005-10-19 09:19:37.000000000 -0400
++++ policy-1.27.1/domains/program/unused/mysqld.te 2005-10-20 09:55:29.000000000 -0400
@@ -12,7 +12,7 @@
#
daemon_domain(mysqld, `, nscd_client_domain')
@@ -1337,7 +1346,7 @@
allow mysqld_t mysqld_var_run_t:sock_file create_file_perms;
-@@ -33,8 +33,8 @@
+@@ -33,16 +33,16 @@
allow initrc_t mysqld_log_t:file { write append setattr ioctl };
@@ -1348,9 +1357,10 @@
allow mysqld_t proc_t:file { getattr read };
-@@ -42,7 +42,7 @@
+ # Allow access to the mysqld databases
create_dir_file(mysqld_t, mysqld_db_t)
- allow mysqld_t var_lib_t:dir { getattr search };
+-allow mysqld_t var_lib_t:dir { getattr search };
++file_type_auto_trans(mysqld_t, var_lib_t, mysqld_db_t, { dir file })
-can_network_server(mysqld_t)
+can_network(mysqld_t)
@@ -1584,7 +1594,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/postfix.te policy-1.27.1/domains/program/unused/postfix.te
--- nsapolicy/domains/program/unused/postfix.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/postfix.te 2005-10-17 15:10:29.000000000 -0400
++++ policy-1.27.1/domains/program/unused/postfix.te 2005-10-20 14:53:16.000000000 -0400
@@ -54,6 +54,8 @@
allow postfix_$1_t proc_net_t:dir search;
allow postfix_$1_t proc_net_t:file { getattr read };
@@ -1696,7 +1706,7 @@
allow postfix_smtpd_t postfix_master_t:tcp_socket rw_stream_socket_perms;
allow postfix_smtpd_t { postfix_private_t postfix_public_t }:dir search;
allow postfix_smtpd_t { postfix_private_t postfix_public_t }:sock_file rw_file_perms;
-@@ -184,7 +193,6 @@
+@@ -184,10 +193,10 @@
# for prng_exch
allow postfix_smtpd_t postfix_spool_t:file rw_file_perms;
@@ -1704,7 +1714,11 @@
allow { postfix_smtp_t postfix_smtpd_t } postfix_prng_t:file rw_file_perms;
postfix_server_domain(local, `, mta_delivery_agent')
-@@ -196,7 +204,7 @@
++
+ ifdef(`procmail.te', `
+ domain_auto_trans(postfix_local_t, procmail_exec_t, procmail_t)
+ # for a bug in the postfix local program
+@@ -196,7 +205,7 @@
')
allow postfix_local_t etc_aliases_t:file r_file_perms;
allow postfix_local_t self:fifo_file rw_file_perms;
@@ -1713,7 +1727,7 @@
allow postfix_local_t postfix_spool_t:file rw_file_perms;
# for .forward - maybe we need a new type for it?
allow postfix_local_t postfix_private_t:dir search;
-@@ -204,7 +212,10 @@
+@@ -204,7 +213,12 @@
allow postfix_local_t postfix_master_t:unix_stream_socket connectto;
allow postfix_local_t postfix_public_t:dir search;
allow postfix_local_t postfix_public_t:sock_file write;
@@ -1722,10 +1736,12 @@
+can_exec(postfix_local_t,{ shell_exec_t bin_t })
+allow postfix_local_t mail_spool_t:dir { remove_name };
+allow postfix_local_t mail_spool_t:file { unlink };
++# For reading spamassasin
++r_dir_file(postfix_local_t, etc_mail_t)
define(`postfix_public_domain',`
postfix_server_domain($1)
-@@ -241,6 +252,7 @@
+@@ -241,6 +255,7 @@
allow postfix_postqueue_t postfix_public_t:dir search;
allow postfix_postqueue_t postfix_public_t:fifo_file getattr;
allow postfix_postqueue_t self:udp_socket { create ioctl };
@@ -1733,7 +1749,7 @@
allow postfix_master_t postfix_postqueue_exec_t:file getattr;
domain_auto_trans(postfix_master_t, postfix_postqueue_exec_t, postfix_postqueue_t)
allow postfix_postqueue_t initrc_t:process sigchld;
-@@ -260,7 +272,7 @@
+@@ -260,7 +275,7 @@
postfix_user_domain(showq)
# the following auto_trans is usually in postfix server domain
domain_auto_trans(postfix_master_t, postfix_showq_exec_t, postfix_showq_t)
@@ -1742,7 +1758,7 @@
r_dir_file(postfix_showq_t, postfix_spool_maildrop_t)
domain_auto_trans(postfix_postqueue_t, postfix_showq_exec_t, postfix_showq_t)
allow postfix_showq_t self:capability { setuid setgid };
-@@ -284,7 +296,9 @@
+@@ -284,7 +299,9 @@
allow postfix_postdrop_t { crond_t system_crond_t }:fifo_file rw_file_perms;')
# usually it does not need a UDP socket
allow postfix_postdrop_t self:udp_socket create_socket_perms;
@@ -1752,7 +1768,7 @@
postfix_public_domain(pickup)
allow postfix_pickup_t postfix_public_t:fifo_file rw_file_perms;
-@@ -329,7 +343,8 @@
+@@ -329,7 +346,8 @@
domain_auto_trans(postfix_pipe_t, procmail_exec_t, procmail_t)
')
ifdef(`sendmail.te', `
@@ -1762,7 +1778,7 @@
')
# Program for creating database files
-@@ -348,5 +363,3 @@
+@@ -348,5 +366,3 @@
dontaudit postfix_map_t var_t:dir search;
can_network_server(postfix_map_t)
allow postfix_map_t port_type:tcp_socket name_connect;
@@ -1954,7 +1970,7 @@
+allow rsync_t self:capability sys_chroot;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/samba.te policy-1.27.1/domains/program/unused/samba.te
--- nsapolicy/domains/program/unused/samba.te 2005-09-16 11:17:10.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/samba.te 2005-10-05 13:09:46.000000000 -0400
++++ policy-1.27.1/domains/program/unused/samba.te 2005-10-20 12:43:09.000000000 -0400
@@ -25,6 +25,9 @@
# not sure why it needs this
tmp_domain(smbd)
@@ -1981,7 +1997,7 @@
dontaudit smbd_t samba_log_t:dir remove_name;
+ifdef(`hide_broken_symptoms', `
-+dontaudit smbd_t { devpts_t boot_t default_t tmpfs_t }:dir getattr;
++dontaudit smbd_t { usbfs_t security_t devpts_t boot_t default_t tmpfs_t }:dir getattr;
+dontaudit smbd_t devpts_t:dir getattr;
+')
+allow smbd_t fs_t:filesystem quotaget;
@@ -1989,6 +2005,19 @@
allow smbd_t usr_t:file { getattr read };
# Access Samba shares.
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/sendmail.te policy-1.27.1/domains/program/unused/sendmail.te
+--- nsapolicy/domains/program/unused/sendmail.te 2005-09-12 16:40:29.000000000 -0400
++++ policy-1.27.1/domains/program/unused/sendmail.te 2005-10-20 14:50:44.000000000 -0400
+@@ -13,9 +13,6 @@
+ # daemon started by the init rc scripts.
+ #
+
+-# etc_mail_t is the type of /etc/mail.
+-type etc_mail_t, file_type, sysadmfile, usercanread;
+-
+ daemon_domain(sendmail, `, nscd_client_domain, mta_delivery_agent, mail_server_domain, mail_server_sender', nosysadm)
+
+ tmp_domain(sendmail)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/snmpd.te policy-1.27.1/domains/program/unused/snmpd.te
--- nsapolicy/domains/program/unused/snmpd.te 2005-09-12 16:40:28.000000000 -0400
+++ policy-1.27.1/domains/program/unused/snmpd.te 2005-10-07 15:05:58.000000000 -0400
@@ -3889,8 +3918,18 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/types/file.te policy-1.27.1/types/file.te
--- nsapolicy/types/file.te 2005-09-16 11:17:12.000000000 -0400
-+++ policy-1.27.1/types/file.te 2005-10-17 08:29:53.000000000 -0400
-@@ -307,8 +307,7 @@
++++ policy-1.27.1/types/file.te 2005-10-20 14:50:58.000000000 -0400
+@@ -84,6 +84,9 @@
+ #
+ type etc_t, file_type, sysadmfile;
+
++# etc_mail_t is the type of /etc/mail.
++type etc_mail_t, file_type, sysadmfile, usercanread;
++
+ #
+ # shadow_t is the type of the /etc/shadow file
+ #
+@@ -307,8 +310,7 @@
type hugetlbfs_t, mount_point, fs_type, sysadmfile;
allow hugetlbfs_t self:filesystem associate;
@@ -3900,7 +3939,7 @@
# udev_runtime_t is the type of the udev table file
type udev_runtime_t, file_type, sysadmfile;
-@@ -322,9 +321,15 @@
+@@ -322,9 +324,15 @@
type debugfs_t, fs_type, sysadmfile;
allow debugfs_t self:filesystem associate;
@@ -3916,7 +3955,7 @@
# removable_t is the default type of all removable media
type removable_t, file_type, sysadmfile, usercanread;
allow removable_t self:filesystem associate;
-@@ -332,11 +337,16 @@
+@@ -332,11 +340,16 @@
allow file_type noexattrfile:filesystem associate;
# Type for anonymous FTP data, used by ftp and rsync
@@ -3991,12 +4030,13 @@
type rsync_port_t, port_type, reserved_port_type;
diff --exclude-from=exclude -N -u -r nsapolicy/types/security.te policy-1.27.1/types/security.te
--- nsapolicy/types/security.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/types/security.te 2005-09-27 17:14:40.000000000 -0400
-@@ -13,12 +13,17 @@
++++ policy-1.27.1/types/security.te 2005-10-20 12:44:37.000000000 -0400
+@@ -13,12 +13,18 @@
# applied to selinuxfs inodes.
#
type security_t, mount_point, fs_type, mlstrustedobject;
+dontaudit domain security_t:dir search;
++dontaudit domain security_t:file { getattr read };
#
# policy_config_t is the type of /etc/security/selinux/*
Index: selinux-policy-targeted.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/devel/selinux-policy-targeted.spec,v
retrieving revision 1.392
retrieving revision 1.393
diff -u -r1.392 -r1.393
--- selinux-policy-targeted.spec 19 Oct 2005 21:28:32 -0000 1.392
+++ selinux-policy-targeted.spec 20 Oct 2005 19:14:20 -0000 1.393
@@ -10,7 +10,7 @@
Summary: SELinux %{type} policy configuration
Name: selinux-policy-%{type}
Version: 1.27.1
-Release: 21
+Release: 22
License: GPL
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -55,7 +55,7 @@
mv domains/misc/unused/kernel.te domains/misc/
mv domains/program/*.te domains/program/unused/
rm domains/*.te
-(cd domains/program/unused; mv acct.te anaconda.te amanda.te apache.te apmd.te arpwatch.te auditd.te bluetooth.te checkpolicy.te canna.te cardmgr.te chkpwd.te comsat.te consoletype.te cpucontrol.te cpuspeed.te cups.te cvs.te cyrus.te dbskkd.te dmidecode.te dbusd.te dhcpc.te dhcpd.te dictd.te dovecot.te fingerd.te firstboot.te fsadm.te ftpd.te getty.te hald.te hostname.te hotplug.te howl.te hwclock.te kudzu.te ifconfig.te init.te initrc.te inetd.te innd.te kerberos.te klogd.te ktalkd.te ldconfig.te load_policy.te login.te lpd.te newrole.te mailman.te modutil.te mta.te mysqld.te named.te netutils.te NetworkManager.te nscd.te ntpd.te passwd.te pegasus.te ping.te portmap.te postfix.te postgresql.te pppd.te privoxy.te radius.te radvd.te restorecon.te rlogind.te rpcd.te rshd.te rsync.te saslauthd.te samba.te setfiles.te slapd.te snmpd.te spamd.te squid.te stunnel.te su.te syslogd.te telnetd.te tftpd.te udev.te updfstab.te uucpd.te webalizer.te winbind.te ypbind.te yppasswd.te yps!
erv.te zebra.te ../)
+(cd domains/program/unused; mv acct.te anaconda.te amanda.te apache.te apmd.te arpwatch.te auditd.te bluetooth.te checkpolicy.te canna.te cardmgr.te chkpwd.te comsat.te consoletype.te cpucontrol.te cpuspeed.te cups.te cvs.te cyrus.te dbskkd.te dmidecode.te dbusd.te dhcpc.te dhcpd.te dictd.te dovecot.te fingerd.te firstboot.te fsadm.te ftpd.te getty.te hald.te hostname.te hotplug.te howl.te hwclock.te kudzu.te ifconfig.te init.te initrc.te inetd.te innd.te kerberos.te klogd.te ktalkd.te ldconfig.te load_policy.te login.te lpd.te newrole.te mailman.te modutil.te mta.te mysqld.te named.te netutils.te NetworkManager.te nscd.te ntpd.te passwd.te pegasus.te ping.te portmap.te postfix.te postgresql.te pppd.te privoxy.te radius.te radvd.te restorecon.te rlogind.te rpcd.te rshd.te rsync.te saslauthd.te samba.te setfiles.te slapd.te snmpd.te spamc.te spamd.te squid.te stunnel.te su.te syslogd.te telnetd.te tftpd.te udev.te updfstab.te uucpd.te webalizer.te winbind.te ypbind.te yppass!
wd.te ypserv.te zebra.te ../)
rm -rf domains/program/unused
rm -rf domains/misc/unused
cp -R %{type}/* .
@@ -248,6 +248,9 @@
exit 0
%changelog
+* Thu Oct 20 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-22
+- Fix to make postfix read spamassasin files
+
* Wed Oct 19 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-21
- Fixes for MLS
- Allow dhcp to write /etc/localtime
More information about the fedora-cvs-commits
mailing list