rpms/selinux-policy-strict/FC-4 policy-20050916.patch, 1.9, 1.10 selinux-policy-strict.spec, 1.326, 1.327
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Tue Oct 25 20:12:15 UTC 2005
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy-strict/FC-4
In directory cvs.devel.redhat.com:/tmp/cvs-serv24270
Modified Files:
policy-20050916.patch selinux-policy-strict.spec
Log Message:
* Mon Oct 24 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.10
- Update to match Rawhide
policy-20050916.patch:
Makefile | 24 +-
attrib.te | 100 ++++++++++-
domains/admin.te | 2
domains/misc/kernel.te | 2
domains/program/crond.te | 2
domains/program/fsadm.te | 9 -
domains/program/hostname.te | 2
domains/program/ifconfig.te | 5
domains/program/init.te | 2
domains/program/initrc.te | 26 ++
domains/program/ldconfig.te | 3
domains/program/load_policy.te | 11 -
domains/program/login.te | 21 +-
domains/program/logrotate.te | 2
domains/program/modutil.te | 27 ++-
domains/program/mount.te | 6
domains/program/netutils.te | 3
domains/program/newrole.te | 4
domains/program/restorecon.te | 3
domains/program/setfiles.te | 4
domains/program/ssh.te | 6
domains/program/su.te | 9 +
domains/program/syslogd.te | 6
domains/program/tmpreaper.te | 2
domains/program/unused/NetworkManager.te | 13 +
domains/program/unused/alsa.te | 2
domains/program/unused/amanda.te | 74 ++------
domains/program/unused/anaconda.te | 5
domains/program/unused/apache.te | 22 +-
domains/program/unused/apmd.te | 19 ++
domains/program/unused/auditd.te | 8
domains/program/unused/automount.te | 4
domains/program/unused/bluetooth.te | 72 ++++++++
domains/program/unused/cups.te | 20 +-
domains/program/unused/cvs.te | 2
domains/program/unused/cyrus.te | 2
domains/program/unused/dbusd.te | 4
domains/program/unused/dcc.te | 5
domains/program/unused/dhcpc.te | 5
domains/program/unused/dhcpd.te | 3
domains/program/unused/dovecot.te | 4
domains/program/unused/ftpd.te | 6
domains/program/unused/hald.te | 5
domains/program/unused/hotplug.te | 5
domains/program/unused/hwclock.te | 1
domains/program/unused/ipsec.te | 2
domains/program/unused/kudzu.te | 5
domains/program/unused/mta.te | 8
domains/program/unused/mysqld.te | 10 -
domains/program/unused/named.te | 27 ++-
domains/program/unused/nscd.te | 1
domains/program/unused/ntpd.te | 10 -
domains/program/unused/openct.te | 16 +
domains/program/unused/pamconsole.te | 4
domains/program/unused/pegasus.te | 37 ++++
domains/program/unused/ping.te | 2
domains/program/unused/postfix.te | 58 ++++--
domains/program/unused/pppd.te | 16 +
domains/program/unused/procmail.te | 11 +
domains/program/unused/readahead.te | 21 ++
domains/program/unused/rlogind.te | 4
domains/program/unused/roundup.te | 29 +++
domains/program/unused/rpcd.te | 18 +-
domains/program/unused/rpm.te | 4
domains/program/unused/rsync.te | 3
domains/program/unused/samba.te | 12 +
domains/program/unused/sendmail.te | 3
domains/program/unused/snmpd.te | 6
domains/program/unused/spamd.te | 18 --
domains/program/unused/squid.te | 3
domains/program/unused/udev.te | 10 -
domains/program/unused/utempter.te | 2
domains/program/unused/webalizer.te | 3
domains/program/unused/winbind.te | 1
domains/program/unused/xdm.te | 3
domains/program/unused/yppasswdd.te | 40 ++++
domains/program/unused/ypserv.te | 1
domains/program/useradd.te | 5
file_contexts/distros.fc | 2
file_contexts/program/apache.fc | 2
file_contexts/program/bluetooth.fc | 3
file_contexts/program/dhcpc.fc | 2
file_contexts/program/dhcpd.fc | 5
file_contexts/program/ftpd.fc | 5
file_contexts/program/games.fc | 11 -
file_contexts/program/ipsec.fc | 1
file_contexts/program/openct.fc | 2
file_contexts/program/pegasus.fc | 11 +
file_contexts/program/pppd.fc | 2
file_contexts/program/readahead.fc | 1
file_contexts/program/roundup.fc | 2
file_contexts/program/rpm.fc | 4
file_contexts/program/rshd.fc | 1
file_contexts/program/rsync.fc | 2
file_contexts/program/squid.fc | 3
file_contexts/program/xdm.fc | 2
file_contexts/program/yppasswdd.fc | 2
file_contexts/program/ypserv.fc | 1
file_contexts/types.fc | 4
genfs_contexts | 3
macros/base_user_macros.te | 7
macros/core_macros.te | 9 +
macros/global_macros.te | 23 +-
macros/home_macros.te | 9 +
macros/network_macros.te | 17 +
macros/program/apache_macros.te | 13 +
macros/program/bonobo_macros.te | 2
macros/program/cdrecord_macros.te | 6
macros/program/chkpwd_macros.te | 3
macros/program/crontab_macros.te | 2
macros/program/dbusd_macros.te | 7
macros/program/gconf_macros.te | 2
macros/program/gift_macros.te | 2
macros/program/gpg_macros.te | 2
macros/program/i18n_input_macros.te | 21 ++
macros/program/lpr_macros.te | 2
macros/program/mta_macros.te | 4
macros/program/newrole_macros.te | 2
macros/program/pyzor_macros.te | 2
macros/program/razor_macros.te | 2
macros/program/su_macros.te | 4
macros/program/uml_macros.te | 2
macros/program/xdm_macros.te | 2
macros/user_macros.te | 7
man/man8/ftpd_selinux.8 | 19 +-
man/man8/httpd_selinux.8 | 9 +
man/man8/rsync_selinux.8 | 12 +
man/man8/samba_selinux.8 | 9 +
mcs | 210 +++++++++---------------
mls | 270 +++++++++++--------------------
net_contexts | 8
targeted/appconfig/root_default_contexts | 4
targeted/assert.te | 2
targeted/domains/program/sendmail.te | 1
targeted/domains/program/ssh.te | 3
targeted/domains/program/xdm.te | 4
targeted/domains/unconfined.te | 15 +
tunables/distro.tun | 2
tunables/tunable.tun | 4
types/device.te | 4
types/devpts.te | 4
types/file.te | 45 +----
types/network.te | 13 -
types/nfs.te | 1
types/security.te | 6
145 files changed, 1185 insertions(+), 638 deletions(-)
View full diff with command:
/usr/bin/cvs -f diff -kk -u -N -r 1.9 -r 1.10 policy-20050916.patch
Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/FC-4/policy-20050916.patch,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- policy-20050916.patch 20 Oct 2005 12:58:50 -0000 1.9
+++ policy-20050916.patch 25 Oct 2005 20:12:11 -0000 1.10
@@ -1,6 +1,6 @@
diff --exclude-from=exclude -N -u -r nsapolicy/attrib.te policy-1.27.1/attrib.te
--- nsapolicy/attrib.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/attrib.te 2005-10-20 08:55:14.000000000 -0400
++++ policy-1.27.1/attrib.te 2005-10-24 10:32:18.000000000 -0400
@@ -8,51 +8,130 @@
# explicitly declared here, and can then be associated with particular
# types in type declarations. Attribute names can then be used throughout
@@ -149,9 +149,32 @@
# For clients of nscd.
attribute nscd_client_domain;
+@@ -459,6 +541,10 @@
+ # For labeling of domains whos transition can be disabled
+ attribute transitionbool;
+
++# For labelling daemons that should not have a range transition to "s0"
++# included in the daemon_base_domain macro
++attribute no_daemon_range_trans;
++
+ # For labeling of file_context domains which users can change files to rather
+ # then the default file context. These file_context can survive a relabeling
+ # of the file system.
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/admin.te policy-1.27.1/domains/admin.te
+--- nsapolicy/domains/admin.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/admin.te 2005-10-24 10:32:36.000000000 -0400
+@@ -4,7 +4,7 @@
+
+ # sysadm_t is the system administrator domain.
+ type sysadm_t, domain, privlog, privowner, admin, userdomain, web_client_domain, privhome, etc_writer, privmodule, nscd_client_domain
+-ifdef(`direct_sysadm_daemon', `, priv_system_role')
++ifdef(`direct_sysadm_daemon', `, priv_system_role, privrangetrans')
+ ; dnl end of sysadm_t type declaration
+
+ allow privhome home_root_t:dir { getattr search };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/misc/kernel.te policy-1.27.1/domains/misc/kernel.te
--- nsapolicy/domains/misc/kernel.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/misc/kernel.te 2005-10-19 09:24:25.000000000 -0400
++++ policy-1.27.1/domains/misc/kernel.te 2005-10-24 10:17:29.000000000 -0400
@@ -30,7 +30,7 @@
ifdef(`mls_policy', `
@@ -163,7 +186,7 @@
# Share state with the init process.
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/crond.te policy-1.27.1/domains/program/crond.te
--- nsapolicy/domains/program/crond.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/crond.te 2005-10-19 09:24:25.000000000 -0400
++++ policy-1.27.1/domains/program/crond.te 2005-10-24 10:34:39.000000000 -0400
@@ -106,7 +106,7 @@
# Inherit and use descriptors from initrc for anacron.
@@ -175,7 +198,16 @@
allow system_crond_t self:capability { dac_read_search chown setgid setuid fowner net_bind_service fsetid };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/fsadm.te policy-1.27.1/domains/program/fsadm.te
--- nsapolicy/domains/program/fsadm.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/fsadm.te 2005-10-19 09:24:25.000000000 -0400
++++ policy-1.27.1/domains/program/fsadm.te 2005-10-24 10:34:39.000000000 -0400
+@@ -12,7 +12,7 @@
+ # administration.
+ # fsadm_exec_t is the type of the corresponding programs.
+ #
+-type fsadm_t, domain, privlog, fs_domain, mlsfileread;
++type fsadm_t, domain, privlog, fs_domain, mlsfileread, mlsfilewrite;
+ role system_r types fsadm_t;
+ role sysadm_r types fsadm_t;
+
@@ -102,10 +102,10 @@
allow fsadm_t kernel_t:system syslog_console;
@@ -198,7 +230,7 @@
+allow fsadm_t file_type:dir { getattr search };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/hostname.te policy-1.27.1/domains/program/hostname.te
--- nsapolicy/domains/program/hostname.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/hostname.te 2005-10-19 09:24:25.000000000 -0400
++++ policy-1.27.1/domains/program/hostname.te 2005-10-24 10:34:39.000000000 -0400
@@ -24,5 +24,5 @@
ifdef(`distro_redhat', `
allow hostname_t tmpfs_t:chr_file rw_file_perms;
@@ -208,7 +240,7 @@
allow hostname_t initrc_t:fd use;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/ifconfig.te policy-1.27.1/domains/program/ifconfig.te
--- nsapolicy/domains/program/ifconfig.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/ifconfig.te 2005-10-19 09:24:25.000000000 -0400
++++ policy-1.27.1/domains/program/ifconfig.te 2005-10-24 10:34:39.000000000 -0400
@@ -52,7 +52,8 @@
allow ifconfig_t self:udp_socket create_socket_perms;
@@ -230,7 +262,16 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/initrc.te policy-1.27.1/domains/program/initrc.te
--- nsapolicy/domains/program/initrc.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/initrc.te 2005-10-19 09:24:25.000000000 -0400
++++ policy-1.27.1/domains/program/initrc.te 2005-10-24 10:34:39.000000000 -0400
+@@ -12,7 +12,7 @@
+ # initrc_exec_t is the type of the init program.
+ #
+ # do not use privmail for sendmail as it creates a type transition conflict
+-type initrc_t, fs_domain, ifdef(`unlimitedRC', `admin, etc_writer, privmem, auth_write, ') domain, privlog, privowner, privmodule, ifdef(`sendmail.te', `', `privmail,') ifdef(`distro_debian', `etc_writer, ') sysctl_kernel_writer, nscd_client_domain, mlsfileread, mlsfilewrite, mlsprocread, mlsprocwrite;
++type initrc_t, fs_domain, ifdef(`unlimitedRC', `admin, etc_writer, privmem, auth_write, ') domain, privlog, privowner, privmodule, ifdef(`sendmail.te', `', `privmail,') ifdef(`distro_debian', `etc_writer, ') sysctl_kernel_writer, nscd_client_domain, mlsfileread, mlsfilewrite, mlsprocread, mlsprocwrite, privrangetrans;
+
+ role system_r types initrc_t;
+ uses_shlib(initrc_t);
@@ -56,6 +56,10 @@
can_create_pty(initrc)
@@ -259,7 +300,18 @@
')dnl end distro_redhat
allow initrc_t system_map_t:{ file lnk_file } r_file_perms;
-@@ -322,3 +334,9 @@
+@@ -271,6 +283,10 @@
+ ifdef(`direct_sysadm_daemon', `
+ role_transition sysadm_r initrc_exec_t system_r;
+ domain_auto_trans(sysadm_t, initrc_exec_t, initrc_t)
++ifdef(`mls_policy', `
++typeattribute initrc_t mlsrangetrans;
++range_transition sysadm_t initrc_exec_t s0 - s15:c0.c255;
++')
+ ')
+
+ #
+@@ -322,3 +338,9 @@
ifdef(`dbusd.te', `
allow initrc_t system_dbusd_var_run_t:sock_file write;
')
@@ -269,9 +321,21 @@
+ifdef(`use_mcs', `
+range_transition sysadm_t initrc_exec_t s0;
+')
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/init.te policy-1.27.1/domains/program/init.te
+--- nsapolicy/domains/program/init.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/init.te 2005-10-24 10:34:39.000000000 -0400
+@@ -14,7 +14,7 @@
+ # by init during initialization. This pipe is used
+ # to communicate with init.
+ #
+-type init_t, domain, privlog, sysctl_kernel_writer, nscd_client_domain, mlsrangetrans, mlsfileread, mlsfilewrite;
++type init_t, domain, privlog, sysctl_kernel_writer, nscd_client_domain, mlsrangetrans, mlsfileread, mlsfilewrite, mlsprocwrite;
+ role system_r types init_t;
+ uses_shlib(init_t);
+ type init_exec_t, file_type, sysadmfile, exec_type;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/ldconfig.te policy-1.27.1/domains/program/ldconfig.te
--- nsapolicy/domains/program/ldconfig.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/ldconfig.te 2005-10-19 09:24:25.000000000 -0400
++++ policy-1.27.1/domains/program/ldconfig.te 2005-10-24 10:34:39.000000000 -0400
@@ -16,7 +16,8 @@
domain_auto_trans({ sysadm_t initrc_t }, ldconfig_exec_t, ldconfig_t)
@@ -284,8 +348,19 @@
uses_shlib(ldconfig_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/load_policy.te policy-1.27.1/domains/program/load_policy.te
--- nsapolicy/domains/program/load_policy.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/load_policy.te 2005-10-19 09:24:25.000000000 -0400
-@@ -45,11 +45,12 @@
++++ policy-1.27.1/domains/program/load_policy.te 2005-10-24 10:34:39.000000000 -0400
+@@ -8,6 +8,10 @@
+ # load_policy_t is the domain type for load_policy
+ # load_policy_exec_t is the file type for the executable
+
++# boolean to determine whether the system permits loading policy, setting
++# enforcing mode, and changing boolean values. Set this to true and you
++# have to reboot to set it back
++bool secure_mode_policyload false;
+
+ type load_policy_t, domain;
+ role sysadm_r types load_policy_t;
+@@ -45,11 +49,12 @@
allow load_policy_t root_t:dir search;
allow load_policy_t etc_t:dir search;
@@ -303,7 +378,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/login.te policy-1.27.1/domains/program/login.te
--- nsapolicy/domains/program/login.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/domains/program/login.te 2005-10-19 09:24:25.000000000 -0400
++++ policy-1.27.1/domains/program/login.te 2005-10-24 10:34:39.000000000 -0400
@@ -62,6 +62,11 @@
ifdef(`pamconsole.te', `
@@ -350,12 +425,24 @@
+ifdef(`use_mcs', `
+ifdef(`getty.te', `
-+range_transition getty_t login_exec_t s0 - s0:c0.c255;
++range_transition getty_t login_exec_t s0 - s0:c0.c127;
+')
+')
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/logrotate.te policy-1.27.1/domains/program/logrotate.te
+--- nsapolicy/domains/program/logrotate.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/logrotate.te 2005-10-24 10:34:39.000000000 -0400
+@@ -13,7 +13,7 @@
+ # logrotate_t is the domain for the logrotate program.
[...1671 lines suppressed...]
@@ -3760,7 +4096,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/targeted/domains/program/xdm.te policy-1.27.1/targeted/domains/program/xdm.te
--- nsapolicy/targeted/domains/program/xdm.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/targeted/domains/program/xdm.te 2005-10-19 09:24:26.000000000 -0400
++++ policy-1.27.1/targeted/domains/program/xdm.te 2005-10-24 10:35:25.000000000 -0400
@@ -20,3 +20,7 @@
type xdm_tmp_t, file_type, sysadmfile;
domain_auto_trans(initrc_t, xdm_exec_t, xdm_t)
@@ -3771,7 +4107,7 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/targeted/domains/unconfined.te policy-1.27.1/targeted/domains/unconfined.te
--- nsapolicy/targeted/domains/unconfined.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/targeted/domains/unconfined.te 2005-10-19 09:24:26.000000000 -0400
++++ policy-1.27.1/targeted/domains/unconfined.te 2005-10-24 10:17:29.000000000 -0400
@@ -63,6 +63,7 @@
bool use_samba_home_dirs false;
@@ -3800,7 +4136,7 @@
+
diff --exclude-from=exclude -N -u -r nsapolicy/tunables/distro.tun policy-1.27.1/tunables/distro.tun
--- nsapolicy/tunables/distro.tun 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/tunables/distro.tun 2005-10-19 09:24:26.000000000 -0400
++++ policy-1.27.1/tunables/distro.tun 2005-10-24 10:17:29.000000000 -0400
@@ -5,7 +5,7 @@
# appropriate ifdefs.
@@ -3812,7 +4148,7 @@
diff --exclude-from=exclude -N -u -r nsapolicy/tunables/tunable.tun policy-1.27.1/tunables/tunable.tun
--- nsapolicy/tunables/tunable.tun 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/tunables/tunable.tun 2005-10-19 09:24:26.000000000 -0400
++++ policy-1.27.1/tunables/tunable.tun 2005-10-24 10:17:29.000000000 -0400
@@ -1,5 +1,5 @@
# Allow rpm to run unconfined.
-dnl define(`unlimitedRPM')
@@ -3831,7 +4167,7 @@
# Otherwise, only staff_r can do so.
diff --exclude-from=exclude -N -u -r nsapolicy/types/device.te policy-1.27.1/types/device.te
--- nsapolicy/types/device.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/types/device.te 2005-10-19 09:24:26.000000000 -0400
++++ policy-1.27.1/types/device.te 2005-10-24 10:30:49.000000000 -0400
@@ -131,8 +131,8 @@
# Type for /dev/.devfsd
type devfs_control_t, device_type, dev_fs;
@@ -3845,7 +4181,7 @@
type power_device_t, device_type, dev_fs;
diff --exclude-from=exclude -N -u -r nsapolicy/types/devpts.te policy-1.27.1/types/devpts.te
--- nsapolicy/types/devpts.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/types/devpts.te 2005-10-19 09:24:26.000000000 -0400
++++ policy-1.27.1/types/devpts.te 2005-10-24 10:30:49.000000000 -0400
@@ -18,4 +18,6 @@
#
type devpts_t, mount_point, fs_type;
@@ -3856,55 +4192,100 @@
+')
diff --exclude-from=exclude -N -u -r nsapolicy/types/file.te policy-1.27.1/types/file.te
--- nsapolicy/types/file.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/types/file.te 2005-10-19 09:24:26.000000000 -0400
-@@ -307,8 +307,7 @@
- type hugetlbfs_t, mount_point, fs_type, sysadmfile;
- allow hugetlbfs_t self:filesystem associate;
++++ policy-1.27.1/types/file.te 2005-10-24 10:30:49.000000000 -0400
+@@ -84,6 +84,9 @@
+ #
+ type etc_t, file_type, sysadmfile;
+
++# etc_mail_t is the type of /etc/mail.
++type etc_mail_t, file_type, sysadmfile, usercanread;
++
+ #
+ # shadow_t is the type of the /etc/shadow file
+ #
+@@ -273,9 +276,6 @@
+ #
+ allow { file_type device_type ttyfile } fs_t:filesystem associate;
+
+-# Allow the pty to be associated with the file system.
+-allow devpts_t self:filesystem associate;
+-
+ type tmpfs_t, file_type, mount_point, sysadmfile, fs_type;
+ allow { logfile tmpfs_t tmpfile home_type } tmpfs_t:filesystem associate;
+ allow { logfile tmpfile home_type } tmp_t:filesystem associate;
+@@ -284,31 +284,14 @@
+ ')
+ type autofs_t, fs_type, noexattrfile, sysadmfile;
+-allow autofs_t self:filesystem associate;
+-
+ type usbdevfs_t, fs_type, mount_point, noexattrfile, sysadmfile;
+-allow usbdevfs_t self:filesystem associate;
+-
+ type sysfs_t, mount_point, fs_type, sysadmfile;
+-allow sysfs_t self:filesystem associate;
+-
+ type iso9660_t, fs_type, noexattrfile, sysadmfile;
+-allow iso9660_t self:filesystem associate;
+-
+ type romfs_t, fs_type, sysadmfile;
+-allow romfs_t self:filesystem associate;
+-
+ type ramfs_t, fs_type, sysadmfile;
+-allow ramfs_t self:filesystem associate;
+-
+ type dosfs_t, fs_type, noexattrfile, sysadmfile;
+-allow dosfs_t self:filesystem associate;
+-
+ type hugetlbfs_t, mount_point, fs_type, sysadmfile;
+-allow hugetlbfs_t self:filesystem associate;
+-
-type mqueue_t, mount_point, fs_type, sysadmfile;
-allow mqueue_t self:filesystem associate;
+typealias file_t alias mqueue_t;
# udev_runtime_t is the type of the udev table file
type udev_runtime_t, file_type, sysadmfile;
-@@ -322,9 +321,15 @@
- type debugfs_t, fs_type, sysadmfile;
- allow debugfs_t self:filesystem associate;
+@@ -317,26 +300,26 @@
+ type krb5_conf_t, file_type, sysadmfile;
+ type cifs_t, fs_type, noexattrfile, sysadmfile;
+-allow cifs_t self:filesystem associate;
+-
+ type debugfs_t, fs_type, sysadmfile;
+-allow debugfs_t self:filesystem associate;
+-
+type configfs_t, fs_type, sysadmfile;
-+allow configfs_t self:filesystem associate;
-+
type inotifyfs_t, fs_type, sysadmfile;
- allow inotifyfs_t self:filesystem associate;
-
+-allow inotifyfs_t self:filesystem associate;
+type capifs_t, fs_type, sysadmfile;
-+allow capifs_t self:filesystem associate;
-+
+
# removable_t is the default type of all removable media
type removable_t, file_type, sysadmfile, usercanread;
- allow removable_t self:filesystem associate;
-@@ -332,11 +337,16 @@
+-allow removable_t self:filesystem associate;
+ allow file_type removable_t:filesystem associate;
allow file_type noexattrfile:filesystem associate;
# Type for anonymous FTP data, used by ftp and rsync
-type ftpd_anon_t, file_type, sysadmfile, customizable;
-type ftpd_anon_rw_t, file_type, sysadmfile, customizable;
+-
+-allow customizable self:filesystem associate;
+type public_content_t, file_type, sysadmfile, customizable;
+type public_content_rw_t, file_type, sysadmfile, customizable;
+typealias public_content_t alias ftpd_anon_t;
+typealias public_content_rw_t alias ftpd_anon_rw_t;
- allow customizable self:filesystem associate;
-
# type for /tmp/.ICE-unix
type ice_tmp_t, file_type, sysadmfile, tmpfile;
+# type for /usr/share/hwdata
+type hwdata_t, file_type, sysadmfile;
++allow { fs_type file_type } self:filesystem associate;
+
diff --exclude-from=exclude -N -u -r nsapolicy/types/network.te policy-1.27.1/types/network.te
--- nsapolicy/types/network.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/types/network.te 2005-10-19 09:24:26.000000000 -0400
++++ policy-1.27.1/types/network.te 2005-10-24 10:30:49.000000000 -0400
@@ -18,7 +18,7 @@
type dhcpd_port_t, port_type, reserved_port_type;
type smbd_port_t, port_type, reserved_port_type;
@@ -3956,14 +4337,24 @@
type inetd_child_port_t, port_type, reserved_port_type;
type ktalkd_port_t, port_type, reserved_port_type;
type rsync_port_t, port_type, reserved_port_type;
+diff --exclude-from=exclude -N -u -r nsapolicy/types/nfs.te policy-1.27.1/types/nfs.te
+--- nsapolicy/types/nfs.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/types/nfs.te 2005-10-24 10:30:49.000000000 -0400
+@@ -18,5 +18,4 @@
+ #
+ # Allow NFS files to be associated with an NFS file system.
+ #
+-allow nfs_t self:filesystem associate;
+ allow file_type nfs_t:filesystem associate;
diff --exclude-from=exclude -N -u -r nsapolicy/types/security.te policy-1.27.1/types/security.te
--- nsapolicy/types/security.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/types/security.te 2005-10-19 09:24:26.000000000 -0400
-@@ -13,12 +13,17 @@
++++ policy-1.27.1/types/security.te 2005-10-24 10:30:49.000000000 -0400
+@@ -13,12 +13,18 @@
# applied to selinuxfs inodes.
#
type security_t, mount_point, fs_type, mlstrustedobject;
+dontaudit domain security_t:dir search;
++dontaudit domain security_t:file { getattr read };
#
# policy_config_t is the type of /etc/security/selinux/*
Index: selinux-policy-strict.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/FC-4/selinux-policy-strict.spec,v
retrieving revision 1.326
retrieving revision 1.327
diff -u -r1.326 -r1.327
--- selinux-policy-strict.spec 20 Oct 2005 12:58:50 -0000 1.326
+++ selinux-policy-strict.spec 25 Oct 2005 20:12:11 -0000 1.327
@@ -11,7 +11,7 @@
Summary: SELinux %{type} policy configuration
Name: selinux-policy-%{type}
Version: 1.27.1
-Release: 2.9
+Release: 2.10
License: GPL
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -229,6 +229,9 @@
exit 0
%changelog
+* Mon Oct 24 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.10
+- Update to match Rawhide
+
* Wed Oct 19 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.9
- Fix mysql
- Add spamd.te
More information about the fedora-cvs-commits
mailing list