rpms/selinux-policy-strict/devel policy-20050916.patch, 1.1, 1.2 selinux-policy-strict.spec, 1.378, 1.379
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Sat Sep 17 11:44:20 UTC 2005
- Previous message (by thread): rpms/selinux-doc/devel .cvsignore, 1.14, 1.15 selinux-doc.spec, 1.15, 1.16 sources, 1.15, 1.16
- Next message (by thread): rpms/selinux-policy-targeted/devel policy-20050916.patch, 1.1, 1.2 selinux-policy-targeted.spec, 1.372, 1.373
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy-strict/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv15228
Modified Files:
policy-20050916.patch selinux-policy-strict.spec
Log Message:
* Sat Sep 17 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-2
- Allow gssd to read kerberos ticket files on /tmp
policy-20050916.patch:
Makefile | 22 +++++++-----
domains/program/crond.te | 2 -
domains/program/fsadm.te | 4 +-
domains/program/hostname.te | 2 -
domains/program/ifconfig.te | 3 +
domains/program/initrc.te | 13 +++++++
domains/program/ldconfig.te | 3 +
domains/program/load_policy.te | 6 +--
domains/program/login.te | 21 ++++++++----
domains/program/modutil.te | 14 ++++----
domains/program/mount.te | 3 +
domains/program/netutils.te | 3 +
domains/program/restorecon.te | 2 -
domains/program/setfiles.te | 2 -
domains/program/ssh.te | 6 ++-
domains/program/su.te | 7 ++++
domains/program/syslogd.te | 2 -
domains/program/unused/NetworkManager.te | 3 +
domains/program/unused/alsa.te | 2 +
domains/program/unused/amanda.te | 53 +++----------------------------
domains/program/unused/anaconda.te | 5 --
domains/program/unused/apache.te | 7 ++--
domains/program/unused/apmd.te | 8 ++++
domains/program/unused/auditd.te | 2 +
domains/program/unused/automount.te | 4 ++
domains/program/unused/bluetooth.te | 17 +++++++++
domains/program/unused/cups.te | 11 +++++-
domains/program/unused/cyrus.te | 2 -
domains/program/unused/dbusd.te | 4 +-
domains/program/unused/dhcpc.te | 4 +-
domains/program/unused/dovecot.te | 4 +-
domains/program/unused/hwclock.te | 2 -
domains/program/unused/kudzu.te | 2 -
domains/program/unused/mta.te | 4 ++
domains/program/unused/mysqld.te | 6 +--
domains/program/unused/ntpd.te | 2 -
domains/program/unused/openct.te | 16 +++++++++
domains/program/unused/pamconsole.te | 2 +
domains/program/unused/pegasus.te | 31 ++++++++++++++++++
domains/program/unused/ping.te | 3 +
domains/program/unused/postfix.te | 3 +
domains/program/unused/pppd.te | 3 +
domains/program/unused/procmail.te | 3 -
domains/program/unused/readahead.te | 21 ++++++++++++
domains/program/unused/roundup.te | 29 ++++++++++++++++
domains/program/unused/rpcd.te | 12 ++++++-
domains/program/unused/samba.te | 11 +++++-
domains/program/unused/snmpd.te | 5 +-
domains/program/unused/squid.te | 3 +
domains/program/unused/udev.te | 6 +++
domains/program/unused/winbind.te | 1
domains/program/unused/xdm.te | 3 +
domains/program/unused/ypserv.te | 1
domains/program/useradd.te | 1
file_contexts/distros.fc | 1
file_contexts/program/bluetooth.fc | 1
file_contexts/program/dhcpc.fc | 1
file_contexts/program/ipsec.fc | 1
file_contexts/program/openct.fc | 2 +
file_contexts/program/pegasus.fc | 11 ++++++
file_contexts/program/pppd.fc | 2 -
file_contexts/program/readahead.fc | 1
file_contexts/program/roundup.fc | 2 +
file_contexts/program/rpm.fc | 4 ++
file_contexts/program/xdm.fc | 2 -
file_contexts/program/ypserv.fc | 1
genfs_contexts | 2 -
macros/core_macros.te | 3 +
macros/global_macros.te | 8 +++-
macros/network_macros.te | 17 +++++++++
macros/program/apache_macros.te | 13 ++++++-
macros/program/cdrecord_macros.te | 2 -
macros/program/i18n_input_macros.te | 21 ++++++++++++
macros/program/mta_macros.te | 4 +-
macros/program/pyzor_macros.te | 2 -
macros/program/razor_macros.te | 2 -
macros/program/su_macros.te | 2 -
macros/program/uml_macros.te | 2 -
macros/user_macros.te | 1
mcs | 16 ++++++++-
net_contexts | 6 +++
targeted/appconfig/root_default_contexts | 4 ++
targeted/domains/program/ssh.te | 3 +
targeted/domains/program/xdm.te | 4 ++
targeted/domains/unconfined.te | 15 +++++++-
tunables/distro.tun | 2 -
tunables/tunable.tun | 4 +-
types/file.te | 6 ++-
types/network.te | 2 +
types/security.te | 4 ++
90 files changed, 443 insertions(+), 142 deletions(-)
Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/policy-20050916.patch,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- policy-20050916.patch 16 Sep 2005 15:57:44 -0000 1.1
+++ policy-20050916.patch 17 Sep 2005 11:44:17 -0000 1.2
@@ -848,7 +848,7 @@
+rw_dir_create_file(pegasus_conf_exec_t, pegasus_conf_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ping.te policy-1.27.1/domains/program/unused/ping.te
--- nsapolicy/domains/program/unused/ping.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/ping.te 2005-09-16 11:35:39.000000000 -0400
++++ policy-1.27.1/domains/program/unused/ping.te 2005-09-16 16:25:52.000000000 -0400
@@ -37,6 +37,7 @@
uses_shlib(ping_t)
can_network_client(ping_t)
@@ -857,6 +857,14 @@
can_ypbind(ping_t)
allow ping_t etc_t:file { getattr read };
allow ping_t self:unix_stream_socket create_socket_perms;
+@@ -58,6 +59,6 @@
+ dontaudit ping_t devtty_t:chr_file { read write };
+ dontaudit ping_t self:capability sys_tty_config;
+ ifdef(`hide_broken_symptoms', `
+-allow ping_t init_t:fd use;
++dontaudit ping_t init_t:fd use;
+ ')
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/postfix.te policy-1.27.1/domains/program/unused/postfix.te
--- nsapolicy/domains/program/unused/postfix.te 2005-09-12 16:40:29.000000000 -0400
+++ policy-1.27.1/domains/program/unused/postfix.te 2005-09-16 11:35:39.000000000 -0400
@@ -872,7 +880,16 @@
# Program for creating database files
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/pppd.te policy-1.27.1/domains/program/unused/pppd.te
--- nsapolicy/domains/program/unused/pppd.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/pppd.te 2005-09-16 11:35:39.000000000 -0400
++++ policy-1.27.1/domains/program/unused/pppd.te 2005-09-16 16:38:01.000000000 -0400
+@@ -36,7 +36,7 @@
+ can_ypbind(pppd_t)
+
+ # Use capabilities.
+-allow pppd_t self:capability { net_admin setuid setgid fsetid fowner net_raw dac_override };
++allow pppd_t self:capability { net_admin setuid setgid fsetid fowner net_raw dac_override sys_module };
+ lock_domain(pppd)
+
+ # Access secret files
@@ -54,6 +54,7 @@
can_exec(pppd_t, { shell_exec_t bin_t sbin_t etc_t ifconfig_exec_t })
allow pppd_t { bin_t sbin_t }:dir search;
@@ -954,7 +971,7 @@
+allow roundup_t etc_t:file { getattr read };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/rpcd.te policy-1.27.1/domains/program/unused/rpcd.te
--- nsapolicy/domains/program/unused/rpcd.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/rpcd.te 2005-09-16 11:35:39.000000000 -0400
++++ policy-1.27.1/domains/program/unused/rpcd.te 2005-09-16 14:12:28.000000000 -0400
@@ -19,7 +19,7 @@
can_network($1_t)
allow $1_t port_type:tcp_socket name_connect;
@@ -964,6 +981,20 @@
read_locale($1_t)
allow $1_t self:capability net_bind_service;
dontaudit $1_t self:capability net_admin;
+@@ -151,3 +151,13 @@
+ allow gssd_t self:capability setuid;
+ allow nfsd_t devtty_t:chr_file rw_file_perms;
+ allow rpcd_t devtty_t:chr_file rw_file_perms;
++
++bool allow_gssd_read_tmp true;
++if (allow_gssd_read_tmp) {
++ifdef(`targeted_policy', `
++r_dir_file(gssd_t, tmp_t)
++', `
++r_dir_file(gssd_t, user_tmpfile)
++')
++}
++
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/samba.te policy-1.27.1/domains/program/unused/samba.te
--- nsapolicy/domains/program/unused/samba.te 2005-09-16 11:17:10.000000000 -0400
+++ policy-1.27.1/domains/program/unused/samba.te 2005-09-16 11:35:39.000000000 -0400
Index: selinux-policy-strict.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/devel/selinux-policy-strict.spec,v
retrieving revision 1.378
retrieving revision 1.379
diff -u -r1.378 -r1.379
--- selinux-policy-strict.spec 16 Sep 2005 15:57:44 -0000 1.378
+++ selinux-policy-strict.spec 17 Sep 2005 11:44:17 -0000 1.379
@@ -11,7 +11,7 @@
Summary: SELinux %{type} policy configuration
Name: selinux-policy-%{type}
Version: 1.27.1
-Release: 1
+Release: 2
License: GPL
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -242,7 +242,10 @@
exit 0
%changelog
-* Fri Sep 17 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-1
+* Sat Sep 17 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-2
+- Allow gssd to read kerberos ticket files on /tmp
+
+* Fri Sep 16 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-1
-Update to latest from NSA
* Merged small patches from Russell Coker for the apostrophe,
dhcpc, fsadm, and setfiles policy.
- Previous message (by thread): rpms/selinux-doc/devel .cvsignore, 1.14, 1.15 selinux-doc.spec, 1.15, 1.16 sources, 1.15, 1.16
- Next message (by thread): rpms/selinux-policy-targeted/devel policy-20050916.patch, 1.1, 1.2 selinux-policy-targeted.spec, 1.372, 1.373
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the fedora-cvs-commits
mailing list