rpms/selinux-policy-targeted/devel policy-20050916.patch, 1.7, 1.8 selinux-policy-targeted.spec, 1.376, 1.377

fedora-cvs-commits at redhat.com fedora-cvs-commits at redhat.com
Fri Sep 23 19:26:22 UTC 2005


Author: dwalsh

Update of /cvs/dist/rpms/selinux-policy-targeted/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv31634

Modified Files:
	policy-20050916.patch selinux-policy-targeted.spec 
Log Message:
* Fri Sep 23 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-6
- Fix su behavior on MCS platform


policy-20050916.patch:
 Makefile                                 |   22 +++++----
 domains/program/crond.te                 |    2 
 domains/program/fsadm.te                 |    7 ++-
 domains/program/hostname.te              |    2 
 domains/program/ifconfig.te              |    3 -
 domains/program/initrc.te                |   17 +++++++
 domains/program/ldconfig.te              |    3 -
 domains/program/load_policy.te           |    7 +--
 domains/program/login.te                 |   21 ++++++---
 domains/program/modutil.te               |   14 +++---
 domains/program/mount.te                 |    5 +-
 domains/program/netutils.te              |    3 -
 domains/program/passwd.te                |    1 
 domains/program/restorecon.te            |    3 -
 domains/program/setfiles.te              |    2 
 domains/program/ssh.te                   |    6 ++
 domains/program/su.te                    |    9 +++
 domains/program/syslogd.te               |    2 
 domains/program/unused/NetworkManager.te |    3 -
 domains/program/unused/alsa.te           |    2 
 domains/program/unused/amanda.te         |   70 +++++++------------------------
 domains/program/unused/anaconda.te       |    5 --
 domains/program/unused/apache.te         |    9 ++-
 domains/program/unused/apmd.te           |   12 +++++
 domains/program/unused/auditd.te         |    2 
 domains/program/unused/automount.te      |    4 +
 domains/program/unused/bluetooth.te      |   17 +++++++
 domains/program/unused/cups.te           |   11 ++++
 domains/program/unused/cvs.te            |    3 +
 domains/program/unused/cyrus.te          |    2 
 domains/program/unused/dbusd.te          |    4 +
 domains/program/unused/dhcpc.te          |    5 +-
 domains/program/unused/dovecot.te        |    4 +
 domains/program/unused/hwclock.te        |    2 
 domains/program/unused/ipsec.te          |    2 
 domains/program/unused/kudzu.te          |    2 
 domains/program/unused/mta.te            |    8 +++
 domains/program/unused/mysqld.te         |    6 +-
 domains/program/unused/named.te          |   14 ++++--
 domains/program/unused/nscd.te           |    1 
 domains/program/unused/ntpd.te           |    7 +--
 domains/program/unused/openct.te         |   16 +++++++
 domains/program/unused/pamconsole.te     |    2 
 domains/program/unused/pegasus.te        |   31 +++++++++++++
 domains/program/unused/ping.te           |    3 -
 domains/program/unused/postfix.te        |    8 ++-
 domains/program/unused/pppd.te           |    5 +-
 domains/program/unused/procmail.te       |   11 +++-
 domains/program/unused/readahead.te      |   21 +++++++++
 domains/program/unused/rlogind.te        |    4 +
 domains/program/unused/roundup.te        |   29 ++++++++++++
 domains/program/unused/rpcd.te           |   12 ++++-
 domains/program/unused/samba.te          |   11 +++-
 domains/program/unused/snmpd.te          |    5 +-
 domains/program/unused/squid.te          |    3 -
 domains/program/unused/udev.te           |   10 +++-
 domains/program/unused/utempter.te       |    2 
 domains/program/unused/winbind.te        |    1 
 domains/program/unused/xdm.te            |    3 +
 domains/program/unused/yppasswdd.te      |   40 +++++++++++++++++
 domains/program/unused/ypserv.te         |    1 
 domains/program/useradd.te               |    5 +-
 file_contexts/distros.fc                 |    1 
 file_contexts/program/bluetooth.fc       |    1 
 file_contexts/program/dhcpc.fc           |    1 
 file_contexts/program/ftpd.fc            |    5 +-
 file_contexts/program/games.fc           |   11 +++-
 file_contexts/program/ipsec.fc           |    1 
 file_contexts/program/openct.fc          |    2 
 file_contexts/program/pegasus.fc         |   11 ++++
 file_contexts/program/pppd.fc            |    2 
 file_contexts/program/readahead.fc       |    1 
 file_contexts/program/roundup.fc         |    2 
 file_contexts/program/rpm.fc             |    4 +
 file_contexts/program/rsync.fc           |    2 
 file_contexts/program/xdm.fc             |    2 
 file_contexts/program/yppasswdd.fc       |    2 
 file_contexts/program/ypserv.fc          |    1 
 genfs_contexts                           |    2 
 macros/core_macros.te                    |    3 +
 macros/global_macros.te                  |   16 +++++--
 macros/network_macros.te                 |   17 +++++++
 macros/program/apache_macros.te          |   13 ++++-
 macros/program/cdrecord_macros.te        |    2 
 macros/program/i18n_input_macros.te      |   21 +++++++++
 macros/program/mta_macros.te             |    4 -
 macros/program/newrole_macros.te         |    2 
 macros/program/pyzor_macros.te           |    2 
 macros/program/razor_macros.te           |    2 
 macros/program/su_macros.te              |    2 
 macros/program/uml_macros.te             |    2 
 macros/user_macros.te                    |    1 
 man/man8/ftpd_selinux.8                  |   10 ++--
 man/man8/rsync_selinux.8                 |    6 +-
 mcs                                      |   16 ++++++-
 net_contexts                             |    6 ++
 targeted/appconfig/root_default_contexts |    4 +
 targeted/domains/program/ssh.te          |    3 +
 targeted/domains/program/xdm.te          |    4 +
 targeted/domains/unconfined.te           |   18 +++++++
 tunables/distro.tun                      |    2 
 tunables/tunable.tun                     |    4 -
 types/devpts.te                          |    4 +
 types/file.te                            |   12 +++--
 types/network.te                         |    2 
 types/security.te                        |    5 ++
 106 files changed, 599 insertions(+), 182 deletions(-)

Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/devel/policy-20050916.patch,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- policy-20050916.patch	21 Sep 2005 19:26:17 -0000	1.7
+++ policy-20050916.patch	23 Sep 2005 19:26:15 -0000	1.8
@@ -264,6 +264,15 @@
  ifdef(`gnome-pty-helper.te', `allow netutils_t sysadm_gph_t:fd use;')
  allow netutils_t proc_t:dir search;
  
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/passwd.te policy-1.27.1/domains/program/passwd.te
+--- nsapolicy/domains/program/passwd.te	2005-09-16 11:17:08.000000000 -0400
++++ policy-1.27.1/domains/program/passwd.te	2005-09-23 15:19:26.000000000 -0400
+@@ -153,5 +153,4 @@
+ 
+ ifdef(`targeted_policy', `
+ role system_r types sysadm_passwd_t;
+-allow sysadm_passwd_t devpts_t:chr_file rw_file_perms;
+ ')
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/restorecon.te policy-1.27.1/domains/program/restorecon.te
 --- nsapolicy/domains/program/restorecon.te	2005-09-16 11:17:08.000000000 -0400
 +++ policy-1.27.1/domains/program/restorecon.te	2005-09-20 21:33:02.000000000 -0400
@@ -322,8 +331,8 @@
 +')
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/su.te policy-1.27.1/domains/program/su.te
 --- nsapolicy/domains/program/su.te	2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/su.te	2005-09-20 21:33:02.000000000 -0400
-@@ -12,3 +12,10 @@
++++ policy-1.27.1/domains/program/su.te	2005-09-23 15:22:36.000000000 -0400
+@@ -12,3 +12,12 @@
  
  # Everything else is in the su_domain macro in
  # macros/program/su_macros.te.
@@ -332,6 +341,8 @@
 +ifdef(`targeted_policy', `
 +range_transition unconfined_t su_exec_t s0 - s0:c0.c127;
 +domain_auto_trans(unconfined_t, su_exec_t, sysadm_su_t)
++can_exec(sysadm_su_t, bin_t)
++rw_dir_create_file(sysadm_su_t, home_dir_type)
 +')
 +')
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/syslogd.te policy-1.27.1/domains/program/syslogd.te
@@ -700,6 +711,19 @@
 +range_transition initrc_t cupsd_exec_t s0 - s0:c0.c127;
 +')
 +
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/cvs.te policy-1.27.1/domains/program/unused/cvs.te
+--- nsapolicy/domains/program/unused/cvs.te	2005-09-16 11:17:08.000000000 -0400
++++ policy-1.27.1/domains/program/unused/cvs.te	2005-09-22 10:16:51.000000000 -0400
+@@ -23,6 +23,9 @@
+ allow cvs_t etc_runtime_t:file { getattr read };
+ allow system_mail_t cvs_data_t:file { getattr read };
+ dontaudit cvs_t devtty_t:chr_file { read write };
++ifdef(`kerberos.te', `
+ # Allow kerberos to work
+ allow cvs_t { krb5_keytab_t krb5_conf_t }:file r_file_perms;
+ dontaudit cvs_t krb5_conf_t:file write;
++')
++
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/cyrus.te policy-1.27.1/domains/program/unused/cyrus.te
 --- nsapolicy/domains/program/unused/cyrus.te	2005-09-16 11:17:09.000000000 -0400
 +++ policy-1.27.1/domains/program/unused/cyrus.te	2005-09-20 21:33:02.000000000 -0400
@@ -732,8 +756,16 @@
 +allow system_dbusd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dhcpc.te policy-1.27.1/domains/program/unused/dhcpc.te
 --- nsapolicy/domains/program/unused/dhcpc.te	2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dhcpc.te	2005-09-20 21:33:02.000000000 -0400
-@@ -134,7 +134,6 @@
++++ policy-1.27.1/domains/program/unused/dhcpc.te	2005-09-23 14:52:52.000000000 -0400
+@@ -120,6 +120,7 @@
+ allow dhcpc_t self:packet_socket create_socket_perms;
+ allow dhcpc_t var_lib_t:dir search;
+ file_type_auto_trans(dhcpc_t, dhcp_state_t, dhcpc_state_t, file)
++allow dhcpc_t dhcp_state_t:file { getattr read };
+ 
+ allow dhcpc_t bin_t:dir { getattr search };
+ allow dhcpc_t bin_t:lnk_file read;
+@@ -134,7 +135,6 @@
  allow dhcpc_t home_root_t:dir search;
  allow initrc_t dhcpc_state_t:file { getattr read };
  dontaudit dhcpc_t var_lock_t:dir search;
@@ -741,7 +773,7 @@
  allow dhcpc_t self:netlink_route_socket r_netlink_socket_perms;
  dontaudit dhcpc_t domain:dir getattr;
  allow dhcpc_t initrc_var_run_t:file rw_file_perms;
-@@ -145,6 +144,7 @@
+@@ -145,6 +145,7 @@
  ifdef(`ypbind.te', `
  domain_auto_trans(dhcpc_t, ypbind_exec_t, ypbind_t)
  allow dhcpc_t ypbind_var_run_t:file { r_file_perms unlink };
@@ -749,7 +781,7 @@
  ')
  ifdef(`ntpd.te', `
  domain_auto_trans(dhcpc_t, ntpd_exec_t, ntpd_t)
-@@ -161,5 +161,5 @@
+@@ -161,5 +162,5 @@
  ifdef(`unconfined.te', `
  allow unconfined_t dhcpc_t:dbus send_msg;
  allow dhcpc_t unconfined_t:dbus send_msg;
@@ -919,6 +951,14 @@
  allow NetworkManager_t var_lib_t:dir search;
  dontaudit NetworkManager_t user_tty_type:chr_file { read write };
 +dontaudit NetworkManager_t security_t:dir search;
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/nscd.te policy-1.27.1/domains/program/unused/nscd.te
+--- nsapolicy/domains/program/unused/nscd.te	2005-09-12 16:40:28.000000000 -0400
++++ policy-1.27.1/domains/program/unused/nscd.te	2005-09-23 11:52:52.000000000 -0400
+@@ -76,3 +76,4 @@
+ log_domain(nscd)
+ r_dir_file(nscd_t, cert_t)
+ allow nscd_t tun_tap_device_t:chr_file { read write };
++allow nscd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ntpd.te policy-1.27.1/domains/program/unused/ntpd.te
 --- nsapolicy/domains/program/unused/ntpd.te	2005-09-16 11:17:09.000000000 -0400
 +++ policy-1.27.1/domains/program/unused/ntpd.te	2005-09-20 21:33:02.000000000 -0400
@@ -1297,7 +1337,22 @@
  ')
 diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/udev.te policy-1.27.1/domains/program/unused/udev.te
 --- nsapolicy/domains/program/unused/udev.te	2005-09-16 11:17:10.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/udev.te	2005-09-20 21:33:02.000000000 -0400
++++ policy-1.27.1/domains/program/unused/udev.te	2005-09-23 14:49:34.000000000 -0400
+@@ -28,12 +28,12 @@
+ type udev_tdb_t, file_type, sysadmfile, dev_fs;
+ typealias udev_tdb_t alias udev_tbl_t;
+ file_type_auto_trans(udev_t, device_t, udev_tdb_t, file)
+-allow udev_t self:capability { chown dac_override dac_read_search fowner fsetid sys_admin sys_nice mknod net_raw net_admin sys_rawio };
++allow udev_t self:capability { chown dac_override dac_read_search fowner fsetid sys_admin sys_nice mknod net_raw net_admin sys_rawio sys_nice };
+ allow udev_t self:file { getattr read };
+ allow udev_t self:unix_stream_socket {connectto create_stream_socket_perms};
+ allow udev_t self:unix_dgram_socket create_socket_perms;
+ allow udev_t self:fifo_file rw_file_perms;
+-allow udev_t self:netlink_kobject_uevent_socket { create bind read setopt }; 
++allow udev_t self:netlink_kobject_uevent_socket create_socket_perms; 
+ allow udev_t device_t:file { unlink rw_file_perms };
+ allow udev_t device_t:sock_file create_file_perms;
+ allow udev_t device_t:lnk_file create_lnk_perms;
 @@ -140,7 +140,13 @@
  r_dir_file(udev_t, domain)
  allow udev_t modules_dep_t:file r_file_perms;
@@ -2163,6 +2218,17 @@
  
  # Allow user_r to reach sysadm_r via su, sudo, or userhelper.
  # Otherwise, only staff_r can do so.
+diff --exclude-from=exclude -N -u -r nsapolicy/types/devpts.te policy-1.27.1/types/devpts.te
+--- nsapolicy/types/devpts.te	2005-09-12 16:40:26.000000000 -0400
++++ policy-1.27.1/types/devpts.te	2005-09-23 15:18:57.000000000 -0400
+@@ -18,4 +18,6 @@
+ #
+ type devpts_t, mount_point, fs_type;
+ 
+-
++ifdef(`targeted_policy', `
++typeattribute devpts_t ttyfile;
++')
 diff --exclude-from=exclude -N -u -r nsapolicy/types/file.te policy-1.27.1/types/file.te
 --- nsapolicy/types/file.te	2005-09-16 11:17:12.000000000 -0400
 +++ policy-1.27.1/types/file.te	2005-09-20 21:33:02.000000000 -0400


Index: selinux-policy-targeted.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/devel/selinux-policy-targeted.spec,v
retrieving revision 1.376
retrieving revision 1.377
diff -u -r1.376 -r1.377
--- selinux-policy-targeted.spec	21 Sep 2005 19:26:17 -0000	1.376
+++ selinux-policy-targeted.spec	23 Sep 2005 19:26:15 -0000	1.377
@@ -11,7 +11,7 @@
 Summary: SELinux %{type} policy configuration
 Name: selinux-policy-%{type}
 Version: 1.27.1
-Release: 5
+Release: 6
 License: GPL
 Group: System Environment/Base
 Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -246,6 +246,9 @@
 exit 0
 
 %changelog
+* Fri Sep 23 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-6
+- Fix su behavior on MCS platform
+
 * Wed Sep 21 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-5
 - Fix xferlog for vsftpd
 - Make apmd unconfined in targeted until we have a standard way of running apmd




More information about the fedora-cvs-commits mailing list