rpms/selinux-policy-strict/FC-4 policy-20050916.patch, 1.1, 1.2 selinux-policy-strict.spec, 1.319, 1.320
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Tue Sep 27 13:45:05 UTC 2005
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy-strict/FC-4
In directory cvs.devel.redhat.com:/tmp/cvs-serv20054
Modified Files:
policy-20050916.patch selinux-policy-strict.spec
Log Message:
* Tue Sep 27 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.3
- Fixes for postfix, amanda, bluetooth
- Merge in changes from Rawhide.
policy-20050916.patch:
Makefile | 22 +++++----
domains/program/crond.te | 2
domains/program/fsadm.te | 7 ++-
domains/program/hostname.te | 2
domains/program/ifconfig.te | 3 -
domains/program/initrc.te | 17 +++++++
domains/program/ldconfig.te | 3 -
domains/program/load_policy.te | 7 +--
domains/program/login.te | 21 ++++++---
domains/program/modutil.te | 14 +++---
domains/program/mount.te | 5 +-
domains/program/netutils.te | 3 -
domains/program/passwd.te | 1
domains/program/restorecon.te | 3 -
domains/program/setfiles.te | 4 -
domains/program/ssh.te | 6 ++
domains/program/su.te | 9 +++
domains/program/syslogd.te | 2
domains/program/unused/NetworkManager.te | 3 -
domains/program/unused/alsa.te | 2
domains/program/unused/amanda.te | 70 +++++++------------------------
domains/program/unused/anaconda.te | 5 --
domains/program/unused/apache.te | 9 ++-
domains/program/unused/apmd.te | 13 +++++
domains/program/unused/auditd.te | 2
domains/program/unused/automount.te | 4 +
domains/program/unused/bluetooth.te | 61 ++++++++++++++++++++++++++-
domains/program/unused/cups.te | 16 +++++--
domains/program/unused/cvs.te | 3 +
domains/program/unused/cyrus.te | 2
domains/program/unused/dbusd.te | 4 +
domains/program/unused/dhcpc.te | 5 +-
domains/program/unused/dhcpd.te | 3 -
domains/program/unused/dovecot.te | 4 +
domains/program/unused/hald.te | 2
domains/program/unused/hotplug.te | 1
domains/program/unused/hwclock.te | 2
domains/program/unused/ipsec.te | 2
domains/program/unused/kudzu.te | 5 +-
domains/program/unused/mta.te | 8 +++
domains/program/unused/mysqld.te | 6 +-
domains/program/unused/named.te | 14 ++++--
domains/program/unused/nscd.te | 1
domains/program/unused/ntpd.te | 7 +--
domains/program/unused/openct.te | 16 +++++++
domains/program/unused/pamconsole.te | 2
domains/program/unused/pegasus.te | 31 +++++++++++++
domains/program/unused/ping.te | 3 -
domains/program/unused/postfix.te | 24 ++++++----
domains/program/unused/pppd.te | 7 +--
domains/program/unused/procmail.te | 11 +++-
domains/program/unused/readahead.te | 21 +++++++++
domains/program/unused/rlogind.te | 4 +
domains/program/unused/roundup.te | 29 ++++++++++++
domains/program/unused/rpcd.te | 12 ++++-
domains/program/unused/samba.te | 11 +++-
domains/program/unused/snmpd.te | 5 +-
domains/program/unused/squid.te | 3 -
domains/program/unused/udev.te | 10 +++-
domains/program/unused/utempter.te | 2
domains/program/unused/webalizer.te | 3 +
domains/program/unused/winbind.te | 1
domains/program/unused/xdm.te | 3 +
domains/program/unused/yppasswdd.te | 40 +++++++++++++++++
domains/program/unused/ypserv.te | 1
domains/program/useradd.te | 5 +-
file_contexts/distros.fc | 1
file_contexts/program/bluetooth.fc | 3 +
file_contexts/program/dhcpc.fc | 2
file_contexts/program/dhcpd.fc | 1
file_contexts/program/ftpd.fc | 5 +-
file_contexts/program/games.fc | 11 +++-
file_contexts/program/ipsec.fc | 1
file_contexts/program/openct.fc | 2
file_contexts/program/pegasus.fc | 11 ++++
file_contexts/program/pppd.fc | 2
file_contexts/program/readahead.fc | 1
file_contexts/program/roundup.fc | 2
file_contexts/program/rpm.fc | 4 +
file_contexts/program/rsync.fc | 2
file_contexts/program/xdm.fc | 2
file_contexts/program/yppasswdd.fc | 2
file_contexts/program/ypserv.fc | 1
file_contexts/types.fc | 2
genfs_contexts | 2
macros/core_macros.te | 3 +
macros/global_macros.te | 16 +++++--
macros/network_macros.te | 17 +++++++
macros/program/apache_macros.te | 13 ++++-
macros/program/cdrecord_macros.te | 2
macros/program/i18n_input_macros.te | 21 +++++++++
macros/program/mta_macros.te | 4 -
macros/program/newrole_macros.te | 2
macros/program/pyzor_macros.te | 2
macros/program/razor_macros.te | 2
macros/program/su_macros.te | 2
macros/program/uml_macros.te | 2
macros/user_macros.te | 1
man/man8/ftpd_selinux.8 | 10 ++--
man/man8/rsync_selinux.8 | 6 +-
mcs | 16 ++++++-
net_contexts | 6 ++
targeted/appconfig/root_default_contexts | 4 +
targeted/domains/program/ssh.te | 3 +
targeted/domains/program/xdm.te | 4 +
targeted/domains/unconfined.te | 15 ++++++
tunables/distro.tun | 2
tunables/tunable.tun | 4 -
types/devpts.te | 4 +
types/file.te | 15 ++++--
types/network.te | 12 +++--
types/security.te | 5 ++
112 files changed, 679 insertions(+), 200 deletions(-)
Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/FC-4/policy-20050916.patch,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- policy-20050916.patch 19 Sep 2005 18:53:32 -0000 1.1
+++ policy-20050916.patch 27 Sep 2005 13:45:02 -0000 1.2
@@ -1,6 +1,6 @@
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/crond.te policy-1.27.1/domains/program/crond.te
---- nsapolicy/domains/program/crond.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/crond.te 2005-09-16 11:35:39.000000000 -0400
+--- nsapolicy/domains/program/crond.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/crond.te 2005-09-27 09:30:49.000000000 -0400
@@ -106,7 +106,7 @@
# Inherit and use descriptors from initrc for anacron.
@@ -10,8 +10,9 @@
# Use capabilities.
allow system_crond_t self:capability { dac_read_search chown setgid setuid fowner net_bind_service fsetid };
---- nsapolicy/domains/program/fsadm.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/fsadm.te 2005-09-19 09:29:08.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/fsadm.te policy-1.27.1/domains/program/fsadm.te
+--- nsapolicy/domains/program/fsadm.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/fsadm.te 2005-09-27 09:30:49.000000000 -0400
@@ -102,10 +102,10 @@
allow fsadm_t kernel_t:system syslog_console;
@@ -32,8 +33,9 @@
+
+# for tune2fs
+allow fsadm_t file_type:dir { getattr search };
---- nsapolicy/domains/program/hostname.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/hostname.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/hostname.te policy-1.27.1/domains/program/hostname.te
+--- nsapolicy/domains/program/hostname.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/hostname.te 2005-09-27 09:30:49.000000000 -0400
@@ -24,5 +24,5 @@
ifdef(`distro_redhat', `
allow hostname_t tmpfs_t:chr_file rw_file_perms;
@@ -41,8 +43,9 @@
-allow hostname_t initrc_devpts_t:chr_file { read write };
+can_access_pty(hostname_t, initrc)
allow hostname_t initrc_t:fd use;
---- nsapolicy/domains/program/ifconfig.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/ifconfig.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/ifconfig.te policy-1.27.1/domains/program/ifconfig.te
+--- nsapolicy/domains/program/ifconfig.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/ifconfig.te 2005-09-27 09:30:49.000000000 -0400
@@ -52,7 +52,8 @@
allow ifconfig_t self:udp_socket create_socket_perms;
@@ -53,8 +56,9 @@
ifdef(`gnome-pty-helper.te', `allow ifconfig_t sysadm_gph_t:fd use;')
allow ifconfig_t tun_tap_device_t:chr_file { read write };
---- nsapolicy/domains/program/initrc.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/initrc.te 2005-09-19 09:43:12.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/initrc.te policy-1.27.1/domains/program/initrc.te
+--- nsapolicy/domains/program/initrc.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/initrc.te 2005-09-27 09:30:49.000000000 -0400
@@ -56,6 +56,10 @@
can_create_pty(initrc)
@@ -90,8 +94,9 @@
+
+# Slapd needs to read cert files from its initscript
+r_dir_file(initrc_t, cert_t)
---- nsapolicy/domains/program/ldconfig.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/ldconfig.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/ldconfig.te policy-1.27.1/domains/program/ldconfig.te
+--- nsapolicy/domains/program/ldconfig.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/ldconfig.te 2005-09-27 09:30:49.000000000 -0400
@@ -16,7 +16,8 @@
domain_auto_trans({ sysadm_t initrc_t }, ldconfig_exec_t, ldconfig_t)
@@ -102,8 +107,9 @@
allow ldconfig_t privfd:fd use;
uses_shlib(ldconfig_t)
---- nsapolicy/domains/program/load_policy.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/load_policy.te 2005-09-19 09:29:08.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/load_policy.te policy-1.27.1/domains/program/load_policy.te
+--- nsapolicy/domains/program/load_policy.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/load_policy.te 2005-09-27 09:30:49.000000000 -0400
@@ -45,11 +45,12 @@
allow load_policy_t root_t:dir search;
allow load_policy_t etc_t:dir search;
@@ -120,8 +126,9 @@
uses_shlib(load_policy_t)
allow load_policy_t self:capability dac_override;
---- nsapolicy/domains/program/login.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/login.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/login.te policy-1.27.1/domains/program/login.te
+--- nsapolicy/domains/program/login.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/login.te 2005-09-27 09:30:49.000000000 -0400
@@ -62,6 +62,11 @@
ifdef(`pamconsole.te', `
@@ -171,8 +178,9 @@
+range_transition getty_t login_exec_t s0 - s0:c0.c127;
+')
+')
---- nsapolicy/domains/program/modutil.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/modutil.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/modutil.te policy-1.27.1/domains/program/modutil.te
+--- nsapolicy/domains/program/modutil.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/modutil.te 2005-09-27 09:30:49.000000000 -0400
@@ -59,7 +59,8 @@
allow depmod_t modules_object_t:file unlink;
@@ -223,8 +231,9 @@
can_exec(update_modules_t, insmod_exec_t)
allow update_modules_t urandom_device_t:chr_file { getattr read };
---- nsapolicy/domains/program/mount.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/mount.te 2005-09-19 09:29:08.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/mount.te policy-1.27.1/domains/program/mount.te
+--- nsapolicy/domains/program/mount.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/mount.te 2005-09-27 09:30:49.000000000 -0400
@@ -16,13 +16,14 @@
role sysadm_r types mount_t;
role system_r types mount_t;
@@ -242,8 +251,9 @@
allow mount_t self:process { fork signal_perms };
allow mount_t file_type:dir search;
---- nsapolicy/domains/program/netutils.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/netutils.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/netutils.te policy-1.27.1/domains/program/netutils.te
+--- nsapolicy/domains/program/netutils.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/netutils.te 2005-09-27 09:30:49.000000000 -0400
@@ -55,7 +55,8 @@
# Access terminals.
@@ -254,8 +264,18 @@
ifdef(`gnome-pty-helper.te', `allow netutils_t sysadm_gph_t:fd use;')
allow netutils_t proc_t:dir search;
---- nsapolicy/domains/program/restorecon.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/restorecon.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/passwd.te policy-1.27.1/domains/program/passwd.te
+--- nsapolicy/domains/program/passwd.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/passwd.te 2005-09-27 09:31:50.000000000 -0400
+@@ -153,5 +153,4 @@
+
+ ifdef(`targeted_policy', `
+ role system_r types sysadm_passwd_t;
+-allow sysadm_passwd_t devpts_t:chr_file rw_file_perms;
+ ')
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/restorecon.te policy-1.27.1/domains/program/restorecon.te
+--- nsapolicy/domains/program/restorecon.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/restorecon.te 2005-09-27 09:32:12.000000000 -0400
@@ -19,7 +19,7 @@
role sysadm_r types restorecon_t;
role secadm_r types restorecon_t;
@@ -265,8 +285,23 @@
allow restorecon_t { tty_device_t admin_tty_type user_tty_type devtty_t }:chr_file { read write ioctl };
domain_auto_trans({ initrc_t sysadm_t secadm_t }, restorecon_exec_t, restorecon_t)
---- nsapolicy/domains/program/setfiles.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/setfiles.te 2005-09-16 11:35:39.000000000 -0400
+@@ -63,3 +63,4 @@
+ allow restorecon_t kernel_t:fifo_file { read write };
+ allow restorecon_t kernel_t:unix_dgram_socket { read write };
+ r_dir_file(restorecon_t, { selinux_config_t file_context_t default_context_t } )
++allow restorecon_t autofs_t:dir search;
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/setfiles.te policy-1.27.1/domains/program/setfiles.te
+--- nsapolicy/domains/program/setfiles.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/setfiles.te 2005-09-27 09:32:30.000000000 -0400
+@@ -12,7 +12,7 @@
+ #
+ # needs auth_write attribute because it has relabelfrom/relabelto
+ # access to shadow_t
+-type setfiles_t, domain, privlog, privowner, auth_write, change_context;
++type setfiles_t, domain, privlog, privowner, auth_write, change_context, mlsfileread, mlsfilewrite, mlsfileupgrade, mlsfiledowngrade;
+ type setfiles_exec_t, file_type, sysadmfile, exec_type;
+
+ role system_r types setfiles_t;
@@ -22,7 +22,7 @@
ifdef(`distro_redhat', `
domain_auto_trans(initrc_t, setfiles_exec_t, setfiles_t)
@@ -276,8 +311,9 @@
allow setfiles_t { ttyfile ptyfile tty_device_t admin_tty_type devtty_t }:chr_file { read write ioctl };
allow setfiles_t self:unix_dgram_socket create_socket_perms;
---- nsapolicy/domains/program/ssh.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/ssh.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/ssh.te policy-1.27.1/domains/program/ssh.te
+--- nsapolicy/domains/program/ssh.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/ssh.te 2005-09-27 09:30:49.000000000 -0400
@@ -153,6 +153,7 @@
#
sshd_program_domain(sshd)
@@ -302,9 +338,10 @@
+ifdef(`use_mcs', `
+range_transition initrc_t sshd_exec_t s0 - s0:c0.c127;
+')
---- nsapolicy/domains/program/su.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/su.te 2005-09-16 11:35:39.000000000 -0400
-@@ -12,3 +12,10 @@
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/su.te policy-1.27.1/domains/program/su.te
+--- nsapolicy/domains/program/su.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/su.te 2005-09-27 09:32:55.000000000 -0400
+@@ -12,3 +12,12 @@
# Everything else is in the su_domain macro in
# macros/program/su_macros.te.
@@ -313,10 +350,13 @@
+ifdef(`targeted_policy', `
+range_transition unconfined_t su_exec_t s0 - s0:c0.c127;
+domain_auto_trans(unconfined_t, su_exec_t, sysadm_su_t)
++can_exec(sysadm_su_t, bin_t)
++rw_dir_create_file(sysadm_su_t, home_dir_type)
+')
+')
---- nsapolicy/domains/program/syslogd.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/syslogd.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/syslogd.te policy-1.27.1/domains/program/syslogd.te
+--- nsapolicy/domains/program/syslogd.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/syslogd.te 2005-09-27 09:30:49.000000000 -0400
@@ -33,7 +33,7 @@
tmp_domain(syslogd)
@@ -326,8 +366,9 @@
# Use capabilities.
allow syslogd_t self:capability { dac_override net_admin net_bind_service sys_resource sys_tty_config };
---- nsapolicy/domains/program/unused/alsa.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/alsa.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/alsa.te policy-1.27.1/domains/program/unused/alsa.te
+--- nsapolicy/domains/program/unused/alsa.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/alsa.te 2005-09-27 09:36:53.000000000 -0400
@@ -11,6 +11,8 @@
allow alsa_t self:unix_stream_socket create_stream_socket_perms;
allow alsa_t self:unix_dgram_socket create_socket_perms;
@@ -337,8 +378,9 @@
type alsa_etc_rw_t, file_type, sysadmfile, usercanread;
rw_dir_create_file(alsa_t,alsa_etc_rw_t)
allow alsa_t self:capability { setgid setuid ipc_owner };
---- nsapolicy/domains/program/unused/amanda.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/amanda.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/amanda.te policy-1.27.1/domains/program/unused/amanda.te
+--- nsapolicy/domains/program/unused/amanda.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/amanda.te 2005-09-27 09:36:53.000000000 -0400
@@ -84,7 +84,6 @@
# configuration files -> read only
@@ -392,7 +434,16 @@
# access to fs_t
allow amanda_t fs_t:filesystem getattr;
-@@ -192,18 +166,8 @@
+@@ -159,6 +133,8 @@
+ allow amanda_t self:capability { chown dac_override setuid };
+ allow amanda_t self:process { fork sigchld setpgid signal };
+ allow amanda_t self:unix_dgram_socket create;
++allow amanda_t self:dir search;
++allow amanda_t self:file { getattr read };
+
+
+ ###################################
+@@ -192,18 +168,8 @@
########################
# access to user_home_t
@@ -411,7 +462,46 @@
##############################################################################
# AMANDA RECOVER DECLARATIONS
##############################################################################
-@@ -301,22 +265,17 @@
+@@ -214,7 +180,8 @@
+
+ # type for amrecover
+ type amanda_recover_t, domain;
+-role sysadm_r types { amanda_recover_t amanda_recover_dir_t };
++role sysadm_r types amanda_recover_t;
++role system_r types amanda_recover_t;
+
+ # exec types for amrecover
+ type amanda_recover_exec_t, file_type, sysadmfile, exec_type;
+@@ -236,22 +203,22 @@
+ uses_shlib(amanda_recover_t)
+ allow amanda_recover_t self:process { fork sigkill sigstop sigchld signal };
+ allow amanda_recover_t self:capability { fowner fsetid kill setgid setuid chown dac_override net_bind_service };
+-allow amanda_recover_t shell_exec_t:file { execute execute_no_trans getattr read };
++can_exec(amanda_recover_t, shell_exec_t)
+ allow amanda_recover_t privfd:fd use;
+
+
+ # amrecover network and process communication
+ #############################################
+
+-can_network_server(amanda_recover_t);
++can_network(amanda_recover_t);
++allow amanda_recover_t amanda_port_t:tcp_socket name_connect;
+ can_ypbind(amanda_recover_t);
++read_locale(amanda_recover_t);
+
+ allow amanda_recover_t self:fifo_file { getattr ioctl read write };
+ allow amanda_recover_t self:unix_stream_socket { connect create read write };
+-
+-allow amanda_t self:dir search;
+-allow amanda_t self:file { getattr read };
+-
++allow amanda_recover_t var_log_t:dir search;
++rw_dir_create_file(amanda_recover_t, amanda_log_t)
+
+ # amrecover file permissions
+ ############################
+@@ -301,22 +268,17 @@
#
allow inetd_t amanda_port_t:{ tcp_socket udp_socket } name_bind;
@@ -439,8 +529,9 @@
-dontaudit amanda_t usbfs_t:dir getattr;
+#amanda wants to check attributes on fifo_files
+allow amanda_t file_type:fifo_file getattr;
---- nsapolicy/domains/program/unused/anaconda.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/anaconda.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/anaconda.te policy-1.27.1/domains/program/unused/anaconda.te
+--- nsapolicy/domains/program/unused/anaconda.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/anaconda.te 2005-09-27 09:36:53.000000000 -0400
@@ -17,11 +17,6 @@
role system_r types ldconfig_t;
domain_auto_trans(anaconda_t, ldconfig_exec_t, ldconfig_t)
@@ -453,8 +544,9 @@
# Run other rc scripts in the anaconda_t domain.
domain_auto_trans(anaconda_t, initrc_exec_t, initrc_t)
---- nsapolicy/domains/program/unused/apache.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/apache.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/apache.te policy-1.27.1/domains/program/unused/apache.te
+--- nsapolicy/domains/program/unused/apache.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/apache.te 2005-09-27 09:36:53.000000000 -0400
@@ -113,9 +113,12 @@
can_network_server(httpd_t)
can_kerberos(httpd_t)
@@ -470,8 +562,18 @@
if (httpd_can_network_connect) {
can_network_client(httpd_t)
---- nsapolicy/domains/program/unused/apmd.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/apmd.te 2005-09-16 11:35:39.000000000 -0400
+@@ -222,7 +225,7 @@
+ # Creation of lock files for apache2
+ lock_domain(httpd)
+
+-# Allow apache to used ftpd_anon_t
++# Allow apache to used public_content_t
+ anonymous_domain(httpd)
+
+ # connect to mysql
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/apmd.te policy-1.27.1/domains/program/unused/apmd.te
+--- nsapolicy/domains/program/unused/apmd.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/apmd.te 2005-09-27 09:36:53.000000000 -0400
@@ -47,6 +47,7 @@
# acpid also has a logfile
@@ -480,7 +582,7 @@
ifdef(`distro_suse', `
var_lib_domain(apmd)
-@@ -140,3 +141,10 @@
+@@ -140,3 +141,15 @@
allow apmd_t user_tty_type:chr_file rw_file_perms;
# Access /dev/apm_bios.
allow initrc_t apm_bios_t:chr_file { setattr getattr read };
@@ -490,17 +592,24 @@
+')dnl end if logrotate.te
+allow apmd_t devpts_t:dir { getattr search };
+allow apmd_t security_t:dir search;
-+r_dir_file(apmd_t, usr_t)
---- nsapolicy/domains/program/unused/auditd.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/auditd.te 2005-09-16 11:35:39.000000000 -0400
++allow apmd_t usr_t:dir search;
++r_dir_file(apmd_t, hwdata_t)
++ifdef(`targeted_policy', `
++unconfined_domain(apmd_t)
++')
++
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/auditd.te policy-1.27.1/domains/program/unused/auditd.te
+--- nsapolicy/domains/program/unused/auditd.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/auditd.te 2005-09-27 09:36:53.000000000 -0400
@@ -65,3 +65,5 @@
allow auditctl_t privfd:fd use;
+allow auditd_t sbin_t:dir search;
+can_exec(auditd_t, sbin_t)
---- nsapolicy/domains/program/unused/automount.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/automount.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/automount.te policy-1.27.1/domains/program/unused/automount.te
+--- nsapolicy/domains/program/unused/automount.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/automount.te 2005-09-27 09:36:53.000000000 -0400
@@ -34,7 +34,9 @@
can_exec(automount_t, { etc_t automount_etc_t })
@@ -524,15 +633,17 @@
allow automount_t var_lib_t:dir search;
allow automount_t var_lib_nfs_t:dir search;
+
---- nsapolicy/domains/program/unused/bluetooth.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/bluetooth.te 2005-09-16 11:35:39.000000000 -0400
-@@ -11,11 +11,16 @@
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/bluetooth.te policy-1.27.1/domains/program/unused/bluetooth.te
+--- nsapolicy/domains/program/unused/bluetooth.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/bluetooth.te 2005-09-27 09:36:53.000000000 -0400
+@@ -11,11 +11,17 @@
daemon_domain(bluetooth)
file_type_auto_trans(bluetooth_t, var_run_t, bluetooth_var_run_t, sock_file)
+file_type_auto_trans(bluetooth_t, bluetooth_conf_t, bluetooth_conf_rw_t)
tmp_domain(bluetooth)
++var_lib_domain(bluetooth)
# Use capabilities.
allow bluetooth_t self:capability { net_admin net_raw sys_tty_config };
@@ -543,7 +654,7 @@
lock_domain(bluetooth)
-@@ -35,6 +40,7 @@
+@@ -35,6 +41,7 @@
# bluetooth_conf_t is the type of the /etc/bluetooth dir.
type bluetooth_conf_t, file_type, sysadmfile;
@@ -551,7 +662,7 @@
# Read /etc/bluetooth
allow bluetooth_t bluetooth_conf_t:dir search;
-@@ -44,5 +50,14 @@
+@@ -44,5 +51,57 @@
allow bluetooth_t usbfs_t:dir r_dir_perms;
allow bluetooth_t usbfs_t:file rw_file_perms;
allow bluetooth_t bin_t:dir search;
@@ -562,13 +673,57 @@
+#Handle bluetooth serial devices
+allow bluetooth_t tty_device_t:chr_file rw_file_perms;
+allow bluetooth_t self:fifo_file rw_file_perms;
-+allow bluetooth_t etc_t:file { getattr read };
++allow bluetooth_t { etc_t etc_runtime_t }:file { getattr read };
+r_dir_file(bluetooth_t, fonts_t)
+allow bluetooth_t urandom_device_t:chr_file r_file_perms;
+allow bluetooth_t usr_t:file { getattr read };
++
++application_domain(bluetooth_helper, `, nscd_client_domain')
++domain_auto_trans(bluetooth_t, bluetooth_helper_exec_t, bluetooth_helper_t)
++role system_r types bluetooth_helper_t;
++read_locale(bluetooth_helper_t)
++typeattribute bluetooth_helper_t unrestricted;
++r_dir_file(bluetooth_helper_t, domain)
++allow bluetooth_helper_t bin_t:dir { getattr search };
++can_exec(bluetooth_helper_t, { bin_t shell_exec_t })
++allow bluetooth_helper_t bin_t:lnk_file read;
++allow bluetooth_helper_t self:capability sys_nice;
++allow bluetooth_helper_t self:fifo_file rw_file_perms;
++allow bluetooth_helper_t self:process fork;
++allow bluetooth_helper_t self:shm create_shm_perms;
++allow bluetooth_helper_t self:unix_stream_socket create_stream_socket_perms;
++allow bluetooth_helper_t { etc_t etc_runtime_t }:file { getattr read };
++r_dir_file(bluetooth_helper_t, fonts_t)
++r_dir_file(bluetooth_helper_t, proc_t)
++read_sysctl(bluetooth_helper_t)
++allow bluetooth_helper_t tmp_t:dir search;
++allow bluetooth_helper_t usr_t:file { getattr read };
++allow bluetooth_helper_t home_dir_type:dir search;
++ifdef(`xserver.te', `
++allow bluetooth_helper_t xserver_log_t:dir search;
++allow bluetooth_helper_t xserver_log_t:file { getattr read };
++')
++ifdef(`targeted_policy', `
++allow bluetooth_helper_t tmp_t:sock_file { read write };
++allow bluetooth_helper_t tmpfs_t:file { read write };
++allow bluetooth_helper_t unconfined_t:unix_stream_socket connectto;
++allow bluetooth_t unconfined_t:dbus send_msg;
++allow unconfined_t bluetooth_t:dbus send_msg;
++', `
++ifdef(`xdm.te', `
++allow bluetooth_helper_t xdm_xserver_tmp_t:sock_file { read write };
++')
++allow bluetooth_t unpriv_userdomain:dbus send_msg;
++allow unpriv_userdomain bluetooth_t:dbus send_msg;
++')
++allow bluetooth_helper_t bluetooth_t:socket { read write };
++
++dontaudit bluetooth_helper_t default_t:dir { read search };
++dontaudit bluetooth_helper_t { devtty_t ttyfile }:chr_file { read write };
---- nsapolicy/domains/program/unused/cups.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/cups.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/cups.te policy-1.27.1/domains/program/unused/cups.te
+--- nsapolicy/domains/program/unused/cups.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/cups.te 2005-09-27 09:36:53.000000000 -0400
@@ -188,6 +188,7 @@
# Uses networking to talk to the daemons
allow hplip_t self:unix_dgram_socket create_socket_perms;
@@ -602,7 +757,19 @@
can_network_tcp(cupsd_config_t)
can_ypbind(cupsd_config_t)
-@@ -311,3 +316,7 @@
+@@ -256,9 +261,8 @@
+ ifdef(`hald.te', `
+
+ ifdef(`dbusd.te', `
+-allow cupsd_t hald_t:dbus send_msg;
+-allow cupsd_config_t hald_t:dbus send_msg;
+-allow hald_t cupsd_t:dbus send_msg;
++allow { cupsd_t cupsd_config_t } hald_t:dbus send_msg;
++allow hald_t { cupsd_t cupsd_config_t }:dbus send_msg;
+ ')dnl end if dbusd.te
+
+ allow hald_t cupsd_config_t:process signal;
+@@ -311,3 +315,7 @@
r_dir_file(cupsd_lpd_t, cupsd_etc_t)
r_dir_file(cupsd_lpd_t, cupsd_rw_etc_t)
allow cupsd_lpd_t ipp_port_t:tcp_socket name_connect;
@@ -610,8 +777,22 @@
+range_transition initrc_t cupsd_exec_t s0 - s0:c0.c127;
+')
+
---- nsapolicy/domains/program/unused/cyrus.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/cyrus.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/cvs.te policy-1.27.1/domains/program/unused/cvs.te
+--- nsapolicy/domains/program/unused/cvs.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/cvs.te 2005-09-27 09:36:53.000000000 -0400
+@@ -23,6 +23,9 @@
+ allow cvs_t etc_runtime_t:file { getattr read };
+ allow system_mail_t cvs_data_t:file { getattr read };
+ dontaudit cvs_t devtty_t:chr_file { read write };
++ifdef(`kerberos.te', `
+ # Allow kerberos to work
+ allow cvs_t { krb5_keytab_t krb5_conf_t }:file r_file_perms;
+ dontaudit cvs_t krb5_conf_t:file write;
++')
++
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/cyrus.te policy-1.27.1/domains/program/unused/cyrus.te
+--- nsapolicy/domains/program/unused/cyrus.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/cyrus.te 2005-09-27 09:36:53.000000000 -0400
@@ -42,7 +42,7 @@
create_dir_file(cyrus_t, mail_spool_t)
allow cyrus_t var_spool_t:dir search;
@@ -621,8 +802,9 @@
allow cyrus_t saslauthd_var_run_t:dir search;
allow cyrus_t saslauthd_var_run_t:sock_file { read write };
allow cyrus_t saslauthd_t:unix_stream_socket { connectto };
---- nsapolicy/domains/program/unused/dbusd.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dbusd.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dbusd.te policy-1.27.1/domains/program/unused/dbusd.te
+--- nsapolicy/domains/program/unused/dbusd.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/dbusd.te 2005-09-27 09:36:53.000000000 -0400
@@ -12,7 +12,7 @@
# dac_override: /var/run/dbus is owned by messagebus on Debian
@@ -638,9 +820,18 @@
allow system_dbusd_t self:unix_stream_socket connectto;
+allow system_dbusd_t self:unix_stream_socket connectto;
+allow system_dbusd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
---- nsapolicy/domains/program/unused/dhcpc.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dhcpc.te 2005-09-16 11:35:39.000000000 -0400
-@@ -134,7 +134,6 @@
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dhcpc.te policy-1.27.1/domains/program/unused/dhcpc.te
+--- nsapolicy/domains/program/unused/dhcpc.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/dhcpc.te 2005-09-27 09:36:53.000000000 -0400
+@@ -120,6 +120,7 @@
+ allow dhcpc_t self:packet_socket create_socket_perms;
+ allow dhcpc_t var_lib_t:dir search;
+ file_type_auto_trans(dhcpc_t, dhcp_state_t, dhcpc_state_t, file)
++allow dhcpc_t dhcp_state_t:file { getattr read };
+
+ allow dhcpc_t bin_t:dir { getattr search };
+ allow dhcpc_t bin_t:lnk_file read;
+@@ -134,7 +135,6 @@
allow dhcpc_t home_root_t:dir search;
allow initrc_t dhcpc_state_t:file { getattr read };
dontaudit dhcpc_t var_lock_t:dir search;
@@ -648,7 +839,7 @@
allow dhcpc_t self:netlink_route_socket r_netlink_socket_perms;
dontaudit dhcpc_t domain:dir getattr;
allow dhcpc_t initrc_var_run_t:file rw_file_perms;
-@@ -145,6 +144,7 @@
+@@ -145,6 +145,7 @@
ifdef(`ypbind.te', `
domain_auto_trans(dhcpc_t, ypbind_exec_t, ypbind_t)
allow dhcpc_t ypbind_var_run_t:file { r_file_perms unlink };
@@ -656,15 +847,36 @@
')
ifdef(`ntpd.te', `
domain_auto_trans(dhcpc_t, ntpd_exec_t, ntpd_t)
-@@ -161,5 +161,5 @@
+@@ -161,5 +162,5 @@
ifdef(`unconfined.te', `
allow unconfined_t dhcpc_t:dbus send_msg;
allow dhcpc_t unconfined_t:dbus send_msg;
-')dnl end ifdef unconfined.te
+')
')
---- nsapolicy/domains/program/unused/dovecot.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/dovecot.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dhcpd.te policy-1.27.1/domains/program/unused/dhcpd.te
+--- nsapolicy/domains/program/unused/dhcpd.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/dhcpd.te 2005-09-27 09:36:53.000000000 -0400
+@@ -17,8 +17,6 @@
+ #
+ daemon_domain(dhcpd, `, nscd_client_domain')
+
+-allow dhcpd_t dhcpd_port_t:udp_socket name_bind;
+-
+ # for UDP port 4011
+ allow dhcpd_t pxe_port_t:udp_socket name_bind;
+
+@@ -27,6 +25,7 @@
+ # Use the network.
+ can_network(dhcpd_t)
+ allow dhcpd_t port_type:tcp_socket name_connect;
++allow dhcpd_t dhcpd_port_t:{ tcp_socket udp_socket } name_bind;
+ can_ypbind(dhcpd_t)
+ allow dhcpd_t self:unix_dgram_socket create_socket_perms;
+ allow dhcpd_t self:unix_stream_socket create_socket_perms;
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dovecot.te policy-1.27.1/domains/program/unused/dovecot.te
+--- nsapolicy/domains/program/unused/dovecot.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/dovecot.te 2005-09-27 09:36:53.000000000 -0400
@@ -43,7 +43,9 @@
can_kerberos(dovecot_t)
@@ -676,8 +888,29 @@
create_dir_file(dovecot_t, dovecot_spool_t)
create_dir_file(mta_delivery_agent, dovecot_spool_t)
allow dovecot_t mail_spool_t:lnk_file read;
---- nsapolicy/domains/program/unused/hwclock.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/hwclock.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/hald.te policy-1.27.1/domains/program/unused/hald.te
+--- nsapolicy/domains/program/unused/hald.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/hald.te 2005-09-27 09:36:53.000000000 -0400
+@@ -100,4 +100,4 @@
+ ifdef(`mount.te', `
+ domain_auto_trans(hald_t, mount_exec_t, mount_t)
+ ')
+-
++r_dir_file(hald_t, hwdata_t)
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/hotplug.te policy-1.27.1/domains/program/unused/hotplug.te
+--- nsapolicy/domains/program/unused/hotplug.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/hotplug.te 2005-09-27 09:36:53.000000000 -0400
+@@ -132,6 +132,7 @@
+ allow hotplug_t sysfs_t:dir { getattr read search write };
+ allow hotplug_t sysfs_t:file rw_file_perms;
+ allow hotplug_t sysfs_t:lnk_file { getattr read };
++r_dir_file(hotplug_t, hwdata_t)
+ allow hotplug_t udev_runtime_t:file rw_file_perms;
+ ifdef(`lpd.te', `
+ allow hotplug_t printer_device_t:chr_file setattr;
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/hwclock.te policy-1.27.1/domains/program/unused/hwclock.te
+--- nsapolicy/domains/program/unused/hwclock.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/hwclock.te 2005-09-27 09:36:53.000000000 -0400
@@ -21,7 +21,6 @@
domain_auto_trans(sysadm_t, hwclock_exec_t, hwclock_t)
')
@@ -691,8 +924,9 @@
dontaudit hwclock_t file_t:dir search;
allow hwclock_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
+r_dir_file(hwclock_t, etc_t)
---- nsapolicy/domains/program/unused/ipsec.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/ipsec.te 2005-09-19 09:47:21.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ipsec.te policy-1.27.1/domains/program/unused/ipsec.te
+--- nsapolicy/domains/program/unused/ipsec.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/ipsec.te 2005-09-27 09:36:53.000000000 -0400
@@ -219,7 +219,7 @@
dontaudit ipsec_mgmt_t selinux_config_t:dir search;
dontaudit ipsec_t ttyfile:chr_file { read write };
@@ -702,8 +936,9 @@
allow ipsec_mgmt_t dev_fs:file_class_set getattr;
dontaudit ipsec_mgmt_t device_t:lnk_file read;
allow ipsec_mgmt_t self:{ tcp_socket udp_socket } create_socket_perms;
---- nsapolicy/domains/program/unused/kudzu.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/kudzu.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/kudzu.te policy-1.27.1/domains/program/unused/kudzu.te
+--- nsapolicy/domains/program/unused/kudzu.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/kudzu.te 2005-09-27 09:36:53.000000000 -0400
@@ -20,7 +20,7 @@
allow kudzu_t ramfs_t:dir search;
allow kudzu_t ramfs_t:sock_file write;
@@ -713,8 +948,26 @@
allow kudzu_t modules_object_t:dir r_dir_perms;
allow kudzu_t { modules_object_t modules_dep_t }:file { getattr read };
allow kudzu_t mouse_device_t:chr_file { read write };
---- nsapolicy/domains/program/unused/mta.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/mta.te 2005-09-19 09:48:48.000000000 -0400
+@@ -64,6 +64,7 @@
+ allow kudzu_t lib_t:file { read getattr };
+ # Read /usr/share/hwdata/.* and /usr/share/terminfo/l/linux
+ allow kudzu_t usr_t:file { read getattr };
++r_dir_file(kudzu_t, hwdata_t)
+
+ # Communicate with rhgb-client.
+ allow kudzu_t self:unix_stream_socket { connectto create_stream_socket_perms };
+@@ -107,6 +108,8 @@
+ ifdef(`userhelper.te', `
+ role system_r types sysadm_userhelper_t;
+ domain_auto_trans(kudzu_t, userhelper_exec_t, sysadm_userhelper_t)
++', `
++unconfined_domain(kudzu_t)
+ ')
+
+ allow kudzu_t initrc_t:unix_stream_socket connectto;
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/mta.te policy-1.27.1/domains/program/unused/mta.te
+--- nsapolicy/domains/program/unused/mta.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/mta.te 2005-09-27 09:36:53.000000000 -0400
@@ -31,6 +31,10 @@
create_dir_file(system_mail_t, mail_spool_t)
allow system_mail_t mail_spool_t:fifo_file rw_file_perms;
@@ -734,8 +987,9 @@
+typealias system_mail_t alias sysadm_mail_t;
+')
+
---- nsapolicy/domains/program/unused/mysqld.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/mysqld.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/mysqld.te policy-1.27.1/domains/program/unused/mysqld.te
+--- nsapolicy/domains/program/unused/mysqld.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/mysqld.te 2005-09-27 09:36:53.000000000 -0400
@@ -12,7 +12,7 @@
#
daemon_domain(mysqld, `, nscd_client_domain')
@@ -763,8 +1017,18 @@
allow system_crond_t mysqld_etc_t:file { getattr read };
')
-allow mysqld_t self:netlink_route_socket r_netlink_socket_perms;
---- nsapolicy/domains/program/unused/named.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/named.te 2005-09-19 09:29:22.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/named.te policy-1.27.1/domains/program/unused/named.te
+--- nsapolicy/domains/program/unused/named.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/named.te 2005-09-27 09:36:53.000000000 -0400
+@@ -36,7 +36,7 @@
+ allow named_t self:process { setsched setcap setrlimit };
+
+ # A type for configuration files of named.
+-type named_conf_t, file_type, sysadmfile;
++type named_conf_t, file_type, sysadmfile, mount_point;
+
+ # for primary zone files
+ type named_zone_t, file_type, sysadmfile;
@@ -113,13 +113,19 @@
read_locale(ndc_t)
can_tcp_connect(ndc_t, named_t)
@@ -787,8 +1051,15 @@
allow { ndc_t initrc_t } named_conf_t:file { getattr read };
allow ndc_t etc_t:dir r_dir_perms;
---- nsapolicy/domains/program/unused/NetworkManager.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/NetworkManager.te 2005-09-16 11:35:39.000000000 -0400
+@@ -161,3 +167,5 @@
+ ')
+ allow ndc_t self:netlink_route_socket r_netlink_socket_perms;
+ dontaudit ndc_t sysadm_tty_device_t:chr_file { ioctl };
++
++
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/NetworkManager.te policy-1.27.1/domains/program/unused/NetworkManager.te
+--- nsapolicy/domains/program/unused/NetworkManager.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/NetworkManager.te 2005-09-27 09:36:53.000000000 -0400
@@ -11,7 +11,7 @@
# NetworkManager_t is the domain for the NetworkManager daemon.
# NetworkManager_exec_t is the type of the NetworkManager executable.
@@ -803,8 +1074,17 @@
allow NetworkManager_t var_lib_t:dir search;
dontaudit NetworkManager_t user_tty_type:chr_file { read write };
+dontaudit NetworkManager_t security_t:dir search;
---- nsapolicy/domains/program/unused/ntpd.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/ntpd.te 2005-09-19 09:29:34.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/nscd.te policy-1.27.1/domains/program/unused/nscd.te
+--- nsapolicy/domains/program/unused/nscd.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/nscd.te 2005-09-27 09:36:53.000000000 -0400
+@@ -76,3 +76,4 @@
+ log_domain(nscd)
+ r_dir_file(nscd_t, cert_t)
+ allow nscd_t tun_tap_device_t:chr_file { read write };
++allow nscd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ntpd.te policy-1.27.1/domains/program/unused/ntpd.te
+--- nsapolicy/domains/program/unused/ntpd.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/ntpd.te 2005-09-27 09:36:53.000000000 -0400
@@ -26,9 +26,10 @@
# for SSP
allow ntpd_t urandom_device_t:chr_file { getattr read };
@@ -827,8 +1107,9 @@
')
can_exec(ntpd_t, initrc_exec_t)
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/openct.te policy-1.27.1/domains/program/unused/openct.te
--- nsapolicy/domains/program/unused/openct.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/domains/program/unused/openct.te 2005-09-16 11:35:39.000000000 -0400
++++ policy-1.27.1/domains/program/unused/openct.te 2005-09-27 09:36:53.000000000 -0400
@@ -0,0 +1,16 @@
+#DESC openct - read files in page cache
+#
@@ -846,8 +1127,9 @@
+#
+rw_dir_file(openct_t, usbfs_t)
+allow openct_t etc_t:file r_file_perms;
---- nsapolicy/domains/program/unused/pamconsole.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/pamconsole.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/pamconsole.te policy-1.27.1/domains/program/unused/pamconsole.te
+--- nsapolicy/domains/program/unused/pamconsole.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/pamconsole.te 2005-09-27 09:36:53.000000000 -0400
@@ -25,6 +25,7 @@
# for /var/run/console.lock checking
allow pam_console_t { var_t var_run_t }:dir search;
@@ -861,8 +1143,9 @@
allow initrc_t pam_var_console_t:file unlink;
allow pam_console_t file_context_t:file { getattr read };
+nsswitch_domain(pam_console_t)
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/pegasus.te policy-1.27.1/domains/program/unused/pegasus.te
--- nsapolicy/domains/program/unused/pegasus.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/domains/program/unused/pegasus.te 2005-09-16 11:35:39.000000000 -0400
++++ policy-1.27.1/domains/program/unused/pegasus.te 2005-09-27 09:36:53.000000000 -0400
@@ -0,0 +1,31 @@
+#DESC pegasus - The Open Group Pegasus CIM/WBEM Server
+#
@@ -895,8 +1178,9 @@
+rw_dir_create_file(pegasus_t, pegasus_conf_t)
+rw_dir_create_file(pegasus_t, pegasus_data_t)
+rw_dir_create_file(pegasus_conf_exec_t, pegasus_conf_t)
---- nsapolicy/domains/program/unused/ping.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/ping.te 2005-09-16 16:25:52.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ping.te policy-1.27.1/domains/program/unused/ping.te
+--- nsapolicy/domains/program/unused/ping.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/ping.te 2005-09-27 09:36:53.000000000 -0400
@@ -37,6 +37,7 @@
uses_shlib(ping_t)
can_network_client(ping_t)
@@ -913,9 +1197,19 @@
+dontaudit ping_t init_t:fd use;
')
---- nsapolicy/domains/program/unused/postfix.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/postfix.te 2005-09-19 09:48:48.000000000 -0400
-@@ -69,6 +69,9 @@
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/postfix.te policy-1.27.1/domains/program/unused/postfix.te
+--- nsapolicy/domains/program/unused/postfix.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/postfix.te 2005-09-27 09:36:53.000000000 -0400
+@@ -54,6 +54,8 @@
+ allow postfix_$1_t proc_net_t:dir search;
+ allow postfix_$1_t proc_net_t:file { getattr read };
+ can_exec(postfix_$1_t, postfix_$1_exec_t)
++r_dir_file(postfix_$1_t, cert_t)
++allow postfix_$1_t { urandom_device_t random_device_t }:chr_file { read getattr };
+
+ allow postfix_$1_t tmp_t:dir getattr;
+
+@@ -69,6 +71,9 @@
postfix_domain(master, `, mail_server_domain')
rhgb_domain(postfix_master_t)
@@ -925,7 +1219,72 @@
read_sysctl(postfix_master_t)
domain_auto_trans(initrc_t, postfix_master_exec_t, postfix_master_t)
-@@ -260,7 +263,7 @@
+@@ -98,6 +103,7 @@
+ can_exec({ sysadm_mail_t system_mail_t }, postfix_master_exec_t)
+ ifdef(`distro_redhat', `
+ file_type_auto_trans({ sysadm_mail_t system_mail_t postfix_master_t }, postfix_etc_t, etc_aliases_t)
++file_type_auto_trans({ sysadm_mail_t system_mail_t postfix_master_t }, etc_t, etc_aliases_t)
+ ', `
+ file_type_auto_trans({ sysadm_mail_t system_mail_t }, etc_t, etc_aliases_t)
+ ')
+@@ -121,7 +127,7 @@
+ can_network(postfix_master_t)
+ allow postfix_master_t port_type:tcp_socket name_connect;
+ can_ypbind(postfix_master_t)
+-allow postfix_master_t smtp_port_t:tcp_socket name_bind;
++allow postfix_master_t { amavisd_send_port_t smtp_port_t }:tcp_socket name_bind;
+ allow postfix_master_t postfix_spool_maildrop_t:dir rw_dir_perms;
+ allow postfix_master_t postfix_spool_maildrop_t:file { unlink rename getattr };
+ allow postfix_master_t postfix_prng_t:file getattr;
+@@ -135,13 +141,11 @@
+ ')
+
+ create_dir_file(postfix_master_t, postfix_spool_flush_t)
+-allow postfix_master_t random_device_t:chr_file { read getattr };
+ allow postfix_master_t postfix_prng_t:file rw_file_perms;
+ # for ls to get the current context
+ allow postfix_master_t self:file { getattr read };
+
+ # for SSP
+-allow postfix_master_t urandom_device_t:chr_file read;
+
+ # allow access to deferred queue and allow removing bogus incoming entries
+ allow postfix_master_t postfix_spool_t:dir create_dir_perms;
+@@ -163,7 +167,6 @@
+ allow postfix_smtp_t postfix_spool_t:file rw_file_perms;
+ allow postfix_smtp_t { postfix_private_t postfix_public_t }:dir search;
+ allow postfix_smtp_t { postfix_private_t postfix_public_t }:sock_file write;
+-allow postfix_smtp_t urandom_device_t:chr_file { getattr read };
+ allow postfix_smtp_t postfix_master_t:unix_stream_socket connectto;
+ # if you have two different mail servers on the same host let them talk via
+ # SMTP, also if one mail server wants to talk to itself then allow it and let
+@@ -172,7 +175,6 @@
+ can_tcp_connect(postfix_smtp_t, mail_server_domain)
+
+ postfix_server_domain(smtpd)
+-allow postfix_smtpd_t urandom_device_t:chr_file { getattr read };
+ allow postfix_smtpd_t postfix_master_t:tcp_socket rw_stream_socket_perms;
+ allow postfix_smtpd_t { postfix_private_t postfix_public_t }:dir search;
+ allow postfix_smtpd_t { postfix_private_t postfix_public_t }:sock_file rw_file_perms;
+@@ -184,7 +186,7 @@
+
+ # for prng_exch
+ allow postfix_smtpd_t postfix_spool_t:file rw_file_perms;
+-
++dontaudit postfix_smtpd_t { home_root_t boot_t }:dir getattr;
+ allow { postfix_smtp_t postfix_smtpd_t } postfix_prng_t:file rw_file_perms;
+
+ postfix_server_domain(local, `, mta_delivery_agent')
+@@ -196,7 +198,7 @@
+ ')
+ allow postfix_local_t etc_aliases_t:file r_file_perms;
+ allow postfix_local_t self:fifo_file rw_file_perms;
+-allow postfix_local_t self:process setrlimit;
++allow postfix_local_t postfix_local_t:process { setsched setrlimit };
+ allow postfix_local_t postfix_spool_t:file rw_file_perms;
+ # for .forward - maybe we need a new type for it?
+ allow postfix_local_t postfix_private_t:dir search;
+@@ -260,7 +262,7 @@
postfix_user_domain(showq)
# the following auto_trans is usually in postfix server domain
domain_auto_trans(postfix_master_t, postfix_showq_exec_t, postfix_showq_t)
@@ -934,7 +1293,7 @@
r_dir_file(postfix_showq_t, postfix_spool_maildrop_t)
domain_auto_trans(postfix_postqueue_t, postfix_showq_exec_t, postfix_showq_t)
allow postfix_showq_t self:capability { setuid setgid };
-@@ -329,7 +332,8 @@
+@@ -329,7 +331,8 @@
domain_auto_trans(postfix_pipe_t, procmail_exec_t, procmail_t)
')
ifdef(`sendmail.te', `
@@ -944,14 +1303,24 @@
')
# Program for creating database files
---- nsapolicy/domains/program/unused/pppd.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/pppd.te 2005-09-17 07:55:05.000000000 -0400
+@@ -348,5 +351,8 @@
+ dontaudit postfix_map_t var_t:dir search;
+ can_network_server(postfix_map_t)
+ allow postfix_map_t port_type:tcp_socket name_connect;
++r_dir_file(postfix_local_t, etc_mail_t)
+ allow postfix_local_t mail_spool_t:dir { remove_name };
+ allow postfix_local_t mail_spool_t:file { unlink };
++can_exec(postfix_local_t, bin_t)
++
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/pppd.te policy-1.27.1/domains/program/unused/pppd.te
+--- nsapolicy/domains/program/unused/pppd.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/pppd.te 2005-09-27 09:36:53.000000000 -0400
@@ -14,7 +14,7 @@
#
bool pppd_for_user false;
-daemon_domain(pppd, `, privmail')
-+daemon_domain(pppd, `, privmail, privsysmod')
++daemon_domain(pppd, `, privmail, privsysmod, nscd_client_domain')
type pppd_secret_t, file_type, sysadmfile;
# Define a separate type for /etc/ppp
@@ -972,8 +1341,18 @@
# Access /dev/ppp.
allow pppd_t ppp_device_t:chr_file rw_file_perms;
---- nsapolicy/domains/program/unused/procmail.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/procmail.te 2005-09-19 09:28:07.000000000 -0400
+@@ -111,7 +112,7 @@
+ ')
+ }
+
+-daemon_domain(pptp)
++daemon_domain(pptp, `, nscd_client_domain')
+ can_network_client_tcp(pptp_t)
+ allow pptp_t { reserved_port_type port_t }:tcp_socket name_connect;
+ can_exec(pptp_t, hostname_exec_t)
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/procmail.te policy-1.27.1/domains/program/unused/procmail.te
+--- nsapolicy/domains/program/unused/procmail.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/procmail.te 2005-09-27 09:36:53.000000000 -0400
@@ -19,8 +19,7 @@
uses_shlib(procmail_t)
allow procmail_t device_t:dir search;
@@ -999,8 +1378,9 @@
')
# Search /var/run.
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/readahead.te policy-1.27.1/domains/program/unused/readahead.te
--- nsapolicy/domains/program/unused/readahead.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/domains/program/unused/readahead.te 2005-09-16 11:35:39.000000000 -0400
++++ policy-1.27.1/domains/program/unused/readahead.te 2005-09-27 09:36:53.000000000 -0400
@@ -0,0 +1,21 @@
+#DESC readahead - read files in page cache
+#
@@ -1023,8 +1403,9 @@
+dontaudit readahead_t file_type:sock_file getattr;
+allow readahead_t proc_t:file { getattr read };
+dontaudit readahead_t device_type:blk_file read;
---- nsapolicy/domains/program/unused/rlogind.te 2005-09-16 11:17:09.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/rlogind.te 2005-09-19 09:29:40.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/rlogind.te policy-1.27.1/domains/program/unused/rlogind.te
+--- nsapolicy/domains/program/unused/rlogind.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/rlogind.te 2005-09-27 09:36:53.000000000 -0400
@@ -35,4 +35,6 @@
allow rlogind_t default_t:dir search;
typealias rlogind_port_t alias rlogin_port_t;
@@ -1033,8 +1414,9 @@
+ifdef(`kerberos.te', `
+allow rlogind_t krb5_keytab_t:file { getattr read };
+')
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/roundup.te policy-1.27.1/domains/program/unused/roundup.te
--- nsapolicy/domains/program/unused/roundup.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/domains/program/unused/roundup.te 2005-09-16 11:35:39.000000000 -0400
++++ policy-1.27.1/domains/program/unused/roundup.te 2005-09-27 09:36:53.000000000 -0400
@@ -0,0 +1,29 @@
+# Roundup Issue Tracking System
+#
@@ -1065,8 +1447,9 @@
+allow roundup_t usr_t:file { getattr read };
+allow roundup_t urandom_device_t:chr_file { getattr read };
+allow roundup_t etc_t:file { getattr read };
---- nsapolicy/domains/program/unused/rpcd.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/rpcd.te 2005-09-16 14:12:28.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/rpcd.te policy-1.27.1/domains/program/unused/rpcd.te
+--- nsapolicy/domains/program/unused/rpcd.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/rpcd.te 2005-09-27 09:36:53.000000000 -0400
@@ -19,7 +19,7 @@
can_network($1_t)
allow $1_t port_type:tcp_socket name_connect;
@@ -1090,8 +1473,9 @@
+')
+}
+
---- nsapolicy/domains/program/unused/samba.te 2005-09-16 11:17:10.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/samba.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/samba.te policy-1.27.1/domains/program/unused/samba.te
+--- nsapolicy/domains/program/unused/samba.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/samba.te 2005-09-27 09:36:53.000000000 -0400
@@ -25,6 +25,9 @@
# not sure why it needs this
tmp_domain(smbd)
@@ -1125,8 +1509,9 @@
allow smbd_t usr_t:file { getattr read };
# Access Samba shares.
---- nsapolicy/domains/program/unused/snmpd.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/snmpd.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/snmpd.te policy-1.27.1/domains/program/unused/snmpd.te
+--- nsapolicy/domains/program/unused/snmpd.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/snmpd.te 2005-09-27 09:36:53.000000000 -0400
@@ -22,8 +22,9 @@
# for the .index file
@@ -1147,8 +1532,9 @@
allow snmpd_t etc_t:lnk_file read;
allow snmpd_t { etc_t etc_runtime_t }:file r_file_perms;
allow snmpd_t { random_device_t urandom_device_t }:chr_file { getattr read };
---- nsapolicy/domains/program/unused/squid.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/squid.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/squid.te policy-1.27.1/domains/program/unused/squid.te
+--- nsapolicy/domains/program/unused/squid.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/squid.te 2005-09-27 09:36:53.000000000 -0400
@@ -60,7 +60,7 @@
can_tcp_connect(web_client_domain, squid_t)
@@ -1164,8 +1550,24 @@
allow winbind_helper_t squid_t:tcp_socket rw_socket_perms;
+allow winbind_helper_t squid_log_t:file ra_file_perms;
')
---- nsapolicy/domains/program/unused/udev.te 2005-09-16 11:17:10.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/udev.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/udev.te policy-1.27.1/domains/program/unused/udev.te
+--- nsapolicy/domains/program/unused/udev.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/udev.te 2005-09-27 09:36:53.000000000 -0400
+@@ -28,12 +28,12 @@
+ type udev_tdb_t, file_type, sysadmfile, dev_fs;
+ typealias udev_tdb_t alias udev_tbl_t;
+ file_type_auto_trans(udev_t, device_t, udev_tdb_t, file)
+-allow udev_t self:capability { chown dac_override dac_read_search fowner fsetid sys_admin sys_nice mknod net_raw net_admin sys_rawio };
++allow udev_t self:capability { chown dac_override dac_read_search fowner fsetid sys_admin sys_nice mknod net_raw net_admin sys_rawio sys_nice };
+ allow udev_t self:file { getattr read };
+ allow udev_t self:unix_stream_socket {connectto create_stream_socket_perms};
+ allow udev_t self:unix_dgram_socket create_socket_perms;
+ allow udev_t self:fifo_file rw_file_perms;
+-allow udev_t self:netlink_kobject_uevent_socket { create bind read setopt };
++allow udev_t self:netlink_kobject_uevent_socket create_socket_perms;
+ allow udev_t device_t:file { unlink rw_file_perms };
+ allow udev_t device_t:sock_file create_file_perms;
+ allow udev_t device_t:lnk_file create_lnk_perms;
@@ -140,7 +140,13 @@
r_dir_file(udev_t, domain)
allow udev_t modules_dep_t:file r_file_perms;
@@ -1180,8 +1582,9 @@
+range_transition kernel_t udev_exec_t s0 - s0:c0.c127;
+range_transition initrc_t udev_exec_t s0 - s0:c0.c127;
+')
---- nsapolicy/domains/program/unused/utempter.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/utempter.te 2005-09-19 09:29:46.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/utempter.te policy-1.27.1/domains/program/unused/utempter.te
+--- nsapolicy/domains/program/unused/utempter.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/utempter.te 2005-09-27 09:36:53.000000000 -0400
@@ -19,6 +19,8 @@
type utempter_exec_t, file_type, sysadmfile, exec_type;
domain_auto_trans(userdomain, utempter_exec_t, utempter_t)
@@ -1191,8 +1594,22 @@
# Use capabilities.
allow utempter_t self:capability setgid;
---- nsapolicy/domains/program/unused/winbind.te 2005-09-12 16:40:29.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/winbind.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/webalizer.te policy-1.27.1/domains/program/unused/webalizer.te
+--- nsapolicy/domains/program/unused/webalizer.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/webalizer.te 2005-09-27 09:36:53.000000000 -0400
+@@ -20,6 +20,9 @@
+ #read apache log
+ allow webalizer_t var_log_t:dir r_dir_perms;
+ r_dir_file(webalizer_t, httpd_log_t)
++ifdef(`ftpd.te', `
++allow webalizer_t xferlog_t:file { getattr read };
++')
+
+ #r/w /var/lib/webalizer
+ var_lib_domain(webalizer)
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/winbind.te policy-1.27.1/domains/program/unused/winbind.te
+--- nsapolicy/domains/program/unused/winbind.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/winbind.te 2005-09-27 09:36:53.000000000 -0400
@@ -44,6 +44,7 @@
r_dir_file(winbind_t, samba_etc_t)
allow winbind_helper_t self:unix_dgram_socket create_socket_perms;
@@ -1201,8 +1618,9 @@
allow winbind_helper_t winbind_var_run_t:dir r_dir_perms;
can_winbind(winbind_helper_t)
allow winbind_helper_t privfd:fd use;
---- nsapolicy/domains/program/unused/xdm.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/xdm.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/xdm.te policy-1.27.1/domains/program/unused/xdm.te
+--- nsapolicy/domains/program/unused/xdm.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/xdm.te 2005-09-27 09:36:53.000000000 -0400
@@ -371,3 +371,6 @@
dontaudit xdm_t ice_tmp_t:dir { getattr setattr };
@@ -1210,15 +1628,61 @@
+ifdef(`use_mcs', `
+range_transition initrc_t xdm_exec_t s0 - s0:c0.c127;
+')
---- nsapolicy/domains/program/unused/ypserv.te 2005-09-12 16:40:28.000000000 -0400
-+++ policy-1.27.1/domains/program/unused/ypserv.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/yppasswdd.te policy-1.27.1/domains/program/unused/yppasswdd.te
+--- nsapolicy/domains/program/unused/yppasswdd.te 1969-12-31 19:00:00.000000000 -0500
++++ policy-1.27.1/domains/program/unused/yppasswdd.te 2005-09-27 09:36:53.000000000 -0400
+@@ -0,0 +1,40 @@
++#DESC yppassdd - NIS password update daemon
++#
++# Authors: Dan Walsh <dwalsh at redhat.com>
++# Depends: portmap.te
++#
++
++#################################
++#
++# Rules for the yppasswdd_t domain.
++#
++daemon_domain(yppasswdd, `, auth_write, privowner')
++
++# Use capabilities.
++allow yppasswdd_t self:capability { net_bind_service };
++
++# Use the network.
++can_network_server(yppasswdd_t)
++
++read_sysctl(yppasswdd_t)
++
++# Send to portmap and initrc.
++can_udp_send(yppasswdd_t, portmap_t)
++can_udp_send(yppasswdd_t, initrc_t)
++
++allow yppasswdd_t reserved_port_t:{ udp_socket tcp_socket } name_bind;
++dontaudit yppasswdd_t reserved_port_type:{ tcp_socket udp_socket } name_bind;
++allow yppasswdd_t self:netlink_route_socket r_netlink_socket_perms;
++
++allow yppasswdd_t { etc_t etc_runtime_t }:file { getattr read };
++allow yppasswdd_t self:unix_dgram_socket create_socket_perms;
++allow yppasswdd_t self:unix_stream_socket create_stream_socket_perms;
++file_type_auto_trans(yppasswdd_t, etc_t, shadow_t, file)
++allow yppasswdd_t { etc_t shadow_t }:file { relabelfrom relabelto };
++can_setfscreate(yppasswdd_t)
++allow yppasswdd_t proc_t:file getattr;
++allow yppasswdd_t { bin_t sbin_t }:dir search;
++allow yppasswdd_t bin_t:lnk_file read;
++can_exec(yppasswdd_t, { bin_t shell_exec_t hostname_exec_t })
++allow yppasswdd_t self:fifo_file rw_file_perms;
++rw_dir_create_file(yppasswdd_t, var_yp_t)
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/ypserv.te policy-1.27.1/domains/program/unused/ypserv.te
+--- nsapolicy/domains/program/unused/ypserv.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/unused/ypserv.te 2005-09-27 09:36:53.000000000 -0400
@@ -39,3 +39,4 @@
')
allow ypserv_t reserved_port_t:{ udp_socket tcp_socket } name_bind;
dontaudit ypserv_t reserved_port_type:{ tcp_socket udp_socket } name_bind;
+can_exec(ypserv_t, bin_t)
---- nsapolicy/domains/program/useradd.te 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/domains/program/useradd.te 2005-09-19 09:29:40.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/useradd.te policy-1.27.1/domains/program/useradd.te
+--- nsapolicy/domains/program/useradd.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/domains/program/useradd.te 2005-09-27 09:30:49.000000000 -0400
@@ -55,7 +55,6 @@
# useradd/userdel request read/write for /var/log/lastlog, and read of /dev,
# but will operate without them.
@@ -1240,8 +1704,9 @@
# for getting the number of groups
read_sysctl(useradd_t)
---- nsapolicy/file_contexts/distros.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/distros.fc 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/distros.fc policy-1.27.1/file_contexts/distros.fc
+--- nsapolicy/file_contexts/distros.fc 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/distros.fc 2005-09-27 09:30:49.000000000 -0400
@@ -99,6 +99,7 @@
/usr/lib(64)?/.*/program/librecentfile\.so -- system_u:object_r:texrel_shlib_t
/usr/lib(64)?/.*/program/libsvx680li\.so -- system_u:object_r:texrel_shlib_t
@@ -1250,26 +1715,25 @@
# Fedora Extras packages: ladspa, imlib2, ocaml
/usr/lib/ladspa/analogue_osc_1416\.so -- system_u:object_r:texrel_shlib_t
---- nsapolicy/file_contexts/program/backup.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/backup.fc 2005-09-19 09:29:47.000000000 -0400
-@@ -3,4 +3,4 @@
- # calls tar) in backup_exec_t and label the directory for storing them as
- # backup_store_t, Debian uses /var/backups
- #/usr/local/bin/backup-script -- system_u:object_r:backup_exec_t
--/var/backups(/.*)? system_u:object_r:backup_store_t
-+/var/backups(/.*)? system_u:object_r:backup_store_t:s0
---- nsapolicy/file_contexts/program/bluetooth.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/bluetooth.fc 2005-09-16 11:35:39.000000000 -0400
-@@ -1,5 +1,6 @@
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/bluetooth.fc policy-1.27.1/file_contexts/program/bluetooth.fc
+--- nsapolicy/file_contexts/program/bluetooth.fc 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/bluetooth.fc 2005-09-27 09:37:14.000000000 -0400
+@@ -1,8 +1,11 @@
# bluetooth
/etc/bluetooth(/.*)? system_u:object_r:bluetooth_conf_t
+/etc/bluetooth/link_key system_u:object_r:bluetooth_conf_rw_t
/usr/bin/rfcomm -- system_u:object_r:bluetooth_exec_t
/usr/sbin/hcid -- system_u:object_r:bluetooth_exec_t
/usr/sbin/sdpd -- system_u:object_r:bluetooth_exec_t
---- nsapolicy/file_contexts/program/dhcpc.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/dhcpc.fc 2005-09-16 11:35:39.000000000 -0400
-@@ -4,6 +4,7 @@
+ /usr/sbin/hciattach -- system_u:object_r:bluetooth_exec_t
+ /var/run/sdp -s system_u:object_r:bluetooth_var_run_t
+ /usr/sbin/hid2hci -- system_u:object_r:bluetooth_exec_t
++/usr/bin/bluepin -- system_u:object_r:bluetooth_helper_exec_t
++/var/lib/bluetooth(/.*)? system_u:object_r:bluetooth_var_lib_t
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/dhcpc.fc policy-1.27.1/file_contexts/program/dhcpc.fc
+--- nsapolicy/file_contexts/program/dhcpc.fc 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/dhcpc.fc 2005-09-27 09:37:14.000000000 -0400
+@@ -4,9 +4,11 @@
/etc/dhclient.*conf -- system_u:object_r:dhcp_etc_t
/etc/dhclient-script -- system_u:object_r:dhcp_etc_t
/sbin/dhcpcd -- system_u:object_r:dhcpc_exec_t
@@ -1277,8 +1741,63 @@
/sbin/dhclient.* -- system_u:object_r:dhcpc_exec_t
/var/lib/dhcp(3)?/dhclient.* system_u:object_r:dhcpc_state_t
/var/lib/dhcpcd(/.*)? system_u:object_r:dhcpc_state_t
---- nsapolicy/file_contexts/program/ipsec.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/ipsec.fc 2005-09-16 11:35:39.000000000 -0400
++/var/lib/dhclient(/.*)? system_u:object_r:dhcpc_state_t
+ /var/run/dhclient.*\.pid -- system_u:object_r:dhcpc_var_run_t
+ /var/run/dhclient.*\.leases -- system_u:object_r:dhcpc_var_run_t
+ # pump
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/dhcpd.fc policy-1.27.1/file_contexts/program/dhcpd.fc
+--- nsapolicy/file_contexts/program/dhcpd.fc 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/dhcpd.fc 2005-09-27 09:37:14.000000000 -0400
+@@ -13,6 +13,7 @@
+ /etc/dhcp -d system_u:object_r:dhcp_etc_t
+ /etc/dhcp(/.*)? -- system_u:object_r:dhcp_etc_t
+ /var/lib/dhcp -d system_u:object_r:dhcp_state_t
++/var/lib/dhcpd(/.*)? system_u:object_r:dhcpd_state_t
+ /var/lib/dhcp/dhcpd\.leases.* -- system_u:object_r:dhcpd_state_t
+ /var/run/dhcp/dhcpd\.pid -- system_u:object_r:dhcpd_var_run_t
+
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/ftpd.fc policy-1.27.1/file_contexts/program/ftpd.fc
+--- nsapolicy/file_contexts/program/ftpd.fc 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/ftpd.fc 2005-09-27 09:37:14.000000000 -0400
+@@ -10,7 +10,8 @@
+ /var/run/proftpd/proftpd\.scoreboard -- system_u:object_r:ftpd_var_run_t
+ /var/log/muddleftpd\.log.* -- system_u:object_r:xferlog_t
+ /var/log/xferlog.* -- system_u:object_r:xferlog_t
++/var/log/vsftpd.* -- system_u:object_r:xferlog_t
+ /var/log/xferreport.* -- system_u:object_r:xferlog_t
+ /etc/cron\.monthly/proftpd -- system_u:object_r:ftpd_exec_t
+-/var/ftp(/.*)? system_u:object_r:ftpd_anon_t
+-/srv/([^/]*/)?ftp(/.*)? system_u:object_r:ftpd_anon_t
++/var/ftp(/.*)? system_u:object_r:public_content_t
++/srv/([^/]*/)?ftp(/.*)? system_u:object_r:public_content_t
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/games.fc policy-1.27.1/file_contexts/program/games.fc
+--- nsapolicy/file_contexts/program/games.fc 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/games.fc 2005-09-27 09:37:14.000000000 -0400
+@@ -1,8 +1,10 @@
+ # games
+-/usr/lib(64)?/games/.* -- system_u:object_r:games_exec_t
+-/var/games(/.*)? system_u:object_r:games_data_t
+-/usr/games/.* -- system_u:object_r:games_exec_t
++/usr/lib/games(/.*)? system_u:object_r:games_exec_t
+ /var/lib/games(/.*)? system_u:object_r:games_data_t
++ifdef(`distro_debian', `
++/usr/games/.* -- system_u:object_r:games_exec_t
++/var/games(/.*)? system_u:object_r:games_data_t
++', `
+ /usr/bin/micq -- system_u:object_r:games_exec_t
+ /usr/bin/blackjack -- system_u:object_r:games_exec_t
+ /usr/bin/gataxx -- system_u:object_r:games_exec_t
+@@ -53,4 +55,7 @@
+ /usr/bin/lskat -- system_u:object_r:games_exec_t
+ /usr/bin/lskatproc -- system_u:object_r:games_exec_t
+ /usr/bin/Maelstrom -- system_u:object_r:games_exec_t
++/usr/bin/civclient.* -- system_u:object_r:games_exec_t
++/usr/bin/civserver.* -- system_u:object_r:games_exec_t
++')dnl end non-Debian section
+
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/ipsec.fc policy-1.27.1/file_contexts/program/ipsec.fc
+--- nsapolicy/file_contexts/program/ipsec.fc 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/ipsec.fc 2005-09-27 09:37:14.000000000 -0400
@@ -21,6 +21,7 @@
/usr/lib(64)?/ipsec/spi -- system_u:object_r:ipsec_exec_t
/usr/local/lib(64)?/ipsec/spi -- system_u:object_r:ipsec_exec_t
@@ -1287,13 +1806,15 @@
# Kame
/usr/sbin/racoon -- system_u:object_r:ipsec_exec_t
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/openct.fc policy-1.27.1/file_contexts/program/openct.fc
--- nsapolicy/file_contexts/program/openct.fc 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/file_contexts/program/openct.fc 2005-09-16 11:35:39.000000000 -0400
++++ policy-1.27.1/file_contexts/program/openct.fc 2005-09-27 09:37:14.000000000 -0400
@@ -0,0 +1,2 @@
+/usr/sbin/openct-control -- system_u:object_r:openct_exec_t
+/var/run/openct(/.*)? system_u:object_r:openct_var_run_t
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/pegasus.fc policy-1.27.1/file_contexts/program/pegasus.fc
--- nsapolicy/file_contexts/program/pegasus.fc 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/file_contexts/program/pegasus.fc 2005-09-16 11:35:39.000000000 -0400
++++ policy-1.27.1/file_contexts/program/pegasus.fc 2005-09-27 09:37:14.000000000 -0400
@@ -0,0 +1,11 @@
+# File Contexts for The Open Group Pegasus (tog-pegasus) cimserver
+/usr/sbin/cimserver -- system_u:object_r:pegasus_exec_t
@@ -1306,8 +1827,9 @@
+/var/lib/Pegasus(/.*)? system_u:object_r:pegasus_data_t
+/var/run/tog-pegasus(/.*)? system_u:object_r:pegasus_var_run_t
+/usr/share/Pegasus/mof(/.*)?/.*\.mof system_u:object_r:pegasus_mof_t
---- nsapolicy/file_contexts/program/pppd.fc 2005-09-16 11:17:11.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/pppd.fc 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/pppd.fc policy-1.27.1/file_contexts/program/pppd.fc
+--- nsapolicy/file_contexts/program/pppd.fc 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/pppd.fc 2005-09-27 09:37:14.000000000 -0400
@@ -20,6 +20,6 @@
/etc/ppp/plugins/rp-pppoe\.so -- system_u:object_r:shlib_t
/etc/ppp/resolv\.conf -- system_u:object_r:pppd_etc_rw_t
@@ -1316,17 +1838,20 @@
+/var/run/pptp(/.*)? system_u:object_r:pptp_var_run_t
# Fix /etc/ppp {up,down} family scripts (see man pppd)
/etc/ppp/(auth|ip(v6|x)?)-(up|down) -- system_u:object_r:pppd_script_exec_t
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/readahead.fc policy-1.27.1/file_contexts/program/readahead.fc
--- nsapolicy/file_contexts/program/readahead.fc 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/file_contexts/program/readahead.fc 2005-09-16 11:35:39.000000000 -0400
++++ policy-1.27.1/file_contexts/program/readahead.fc 2005-09-27 09:37:14.000000000 -0400
@@ -0,0 +1 @@
+/usr/sbin/readahead -- system_u:object_r:readahead_exec_t
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/roundup.fc policy-1.27.1/file_contexts/program/roundup.fc
--- nsapolicy/file_contexts/program/roundup.fc 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/file_contexts/program/roundup.fc 2005-09-16 11:35:39.000000000 -0400
++++ policy-1.27.1/file_contexts/program/roundup.fc 2005-09-27 09:37:14.000000000 -0400
@@ -0,0 +1,2 @@
+/usr/bin/roundup-server -- system_u:object_r:roundup_exec_t
+/var/lib/roundup(/.*)? -- system_u:object_r:roundup_var_lib_t
---- nsapolicy/file_contexts/program/rpm.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/rpm.fc 2005-09-16 11:52:41.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/rpm.fc policy-1.27.1/file_contexts/program/rpm.fc
+--- nsapolicy/file_contexts/program/rpm.fc 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/rpm.fc 2005-09-27 09:37:14.000000000 -0400
@@ -23,3 +23,7 @@
/var/lib/YaST2(/.*)? system_u:object_r:rpm_var_lib_t
/var/log/YaST2(/.*)? system_u:object_r:rpm_log_t
@@ -1335,8 +1860,17 @@
+ifdef(`mls_policy', `
+/sbin/cpio -- system_u:object_r:rpm_exec_t
+')
---- nsapolicy/file_contexts/program/xdm.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/xdm.fc 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/rsync.fc policy-1.27.1/file_contexts/program/rsync.fc
+--- nsapolicy/file_contexts/program/rsync.fc 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/rsync.fc 2005-09-27 09:37:14.000000000 -0400
+@@ -1,3 +1,3 @@
+ # rsync program
+ /usr/bin/rsync -- system_u:object_r:rsync_exec_t
+-/srv/([^/]*/)?rsync(/.*)? system_u:object_r:ftpd_anon_t
++/srv/([^/]*/)?rsync(/.*)? system_u:object_r:public_content_t
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/xdm.fc policy-1.27.1/file_contexts/program/xdm.fc
+--- nsapolicy/file_contexts/program/xdm.fc 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/xdm.fc 2005-09-27 09:37:14.000000000 -0400
@@ -3,7 +3,7 @@
/usr/X11R6/bin/[xgkw]dm -- system_u:object_r:xdm_exec_t
/opt/kde3/bin/kdm -- system_u:object_r:xdm_exec_t
@@ -1346,15 +1880,42 @@
/var/[xgk]dm(/.*)? system_u:object_r:xserver_log_t
/usr/var/[xgkw]dm(/.*)? system_u:object_r:xserver_log_t
/var/log/[kw]dm\.log -- system_u:object_r:xserver_log_t
---- nsapolicy/file_contexts/program/ypserv.fc 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/file_contexts/program/ypserv.fc 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/yppasswdd.fc policy-1.27.1/file_contexts/program/yppasswdd.fc
+--- nsapolicy/file_contexts/program/yppasswdd.fc 1969-12-31 19:00:00.000000000 -0500
++++ policy-1.27.1/file_contexts/program/yppasswdd.fc 2005-09-27 09:37:14.000000000 -0400
+@@ -0,0 +1,2 @@
++# yppasswd
++/usr/sbin/rpc.yppasswdd -- system_u:object_r:yppasswdd_exec_t
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/ypserv.fc policy-1.27.1/file_contexts/program/ypserv.fc
+--- nsapolicy/file_contexts/program/ypserv.fc 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/program/ypserv.fc 2005-09-27 09:37:14.000000000 -0400
@@ -1,3 +1,4 @@
# ypserv
/usr/sbin/ypserv -- system_u:object_r:ypserv_exec_t
+/usr/lib/yp/.+ -- system_u:object_r:bin_t
/etc/ypserv\.conf -- system_u:object_r:ypserv_conf_t
---- nsapolicy/genfs_contexts 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/genfs_contexts 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/types.fc policy-1.27.1/file_contexts/types.fc
+--- nsapolicy/file_contexts/types.fc 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/file_contexts/types.fc 2005-09-27 09:43:08.000000000 -0400
+@@ -133,6 +133,7 @@
+ /dev/dcbri[0-9]+ -c system_u:object_r:tty_device_t
+ /dev/irlpt[0-9]+ -c system_u:object_r:printer_device_t
+ /dev/ircomm[0-9]+ -c system_u:object_r:tty_device_t
++/dev/rfcomm[0-9]+ -c system_u:object_r:tty_device_t
+ /dev/isdn.* -c system_u:object_r:tty_device_t
+ /dev/.*tty[^/]* -c system_u:object_r:tty_device_t
+ /dev/[pt]ty[abcdepqrstuvwxyz][0-9a-f] -c system_u:object_r:bsdpty_device_t
+@@ -485,6 +486,7 @@
+ # Turboprint
+ #
+ /usr/share/turboprint/lib(/.*)? -- system_u:object_r:bin_t
++/usr/share/hwdata(/.*)? system_u:object_r:hwdata_t
+
+ #
+ # initrd mount point, only used during boot
+diff --exclude-from=exclude -N -u -r nsapolicy/genfs_contexts policy-1.27.1/genfs_contexts
+--- nsapolicy/genfs_contexts 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/genfs_contexts 2005-09-27 09:30:49.000000000 -0400
@@ -94,7 +94,7 @@
genfscon debugfs / system_u:object_r:debugfs_t
genfscon inotifyfs / system_u:object_r:inotifyfs_t
@@ -1364,8 +1925,9 @@
# needs more work
genfscon eventpollfs / system_u:object_r:eventpollfs_t
---- nsapolicy/macros/core_macros.te 2005-09-12 16:40:27.000000000 -0400
-+++ policy-1.27.1/macros/core_macros.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/core_macros.te policy-1.27.1/macros/core_macros.te
+--- nsapolicy/macros/core_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/core_macros.te 2005-09-27 09:30:49.000000000 -0400
@@ -620,6 +620,9 @@
# Label pty files with a derived type.
type_transition $1_t devpts_t:chr_file $1_devpts_t;
@@ -1376,8 +1938,9 @@
# Read and write my pty files.
allow $1_t $1_devpts_t:chr_file { setattr rw_file_perms };
')
---- nsapolicy/macros/global_macros.te 2005-09-16 11:17:11.000000000 -0400
-+++ policy-1.27.1/macros/global_macros.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/global_macros.te policy-1.27.1/macros/global_macros.te
+--- nsapolicy/macros/global_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/global_macros.te 2005-09-27 09:38:52.000000000 -0400
@@ -157,6 +157,11 @@
r_dir_file($1, locale_t)
')
@@ -1400,8 +1963,40 @@
')
#
---- nsapolicy/macros/network_macros.te 2005-09-16 11:17:11.000000000 -0400
-+++ policy-1.27.1/macros/network_macros.te 2005-09-16 11:35:39.000000000 -0400
+@@ -514,6 +518,9 @@
+ type $1_t, domain, privlog $2;
+ type $1_exec_t, file_type, sysadmfile, exec_type;
+ role sysadm_r types $1_t;
++ifdef(`targeted_policy', `
++role system_r types $1_t;
++')
+ domain_auto_trans(sysadm_t, $1_exec_t, $1_t)
+ uses_shlib($1_t)
+ ')
+@@ -600,10 +607,10 @@
+ # Also define boolean to allow anonymous writing
+ #
+ define(`anonymous_domain', `
+-r_dir_file($1_t, ftpd_anon_t)
++r_dir_file($1_t, public_content_t)
+ bool allow_$1_anon_write false;
+ if (allow_$1_anon_write) {
+-create_dir_file($1_t,ftpd_anon_rw_t)
++create_dir_file($1_t,public_content_rw_t)
+ }
+ ')
+ #
+@@ -618,6 +625,7 @@
+ define(`unconfined_domain', `
+
+ typeattribute $1 unrestricted;
++typeattribute $1 privuser;
+
+ # Mount/unmount any filesystem.
+ allow $1 fs_type:filesystem *;
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/network_macros.te policy-1.27.1/macros/network_macros.te
+--- nsapolicy/macros/network_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/network_macros.te 2005-09-27 09:30:49.000000000 -0400
@@ -153,7 +153,8 @@
')dnl end can_network definition
@@ -1430,8 +2025,9 @@
+can_ldap($1)
+can_winbind($1)
+')
---- nsapolicy/macros/program/apache_macros.te 2005-09-16 11:17:11.000000000 -0400
-+++ policy-1.27.1/macros/program/apache_macros.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/apache_macros.te policy-1.27.1/macros/program/apache_macros.te
+--- nsapolicy/macros/program/apache_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/program/apache_macros.te 2005-09-27 09:30:49.000000000 -0400
@@ -38,7 +38,7 @@
allow httpd_$1_script_t etc_runtime_t:file { getattr read };
read_locale(httpd_$1_script_t)
@@ -1472,8 +2068,9 @@
+
+
')
---- nsapolicy/macros/program/cdrecord_macros.te 2005-09-16 11:17:11.000000000 -0400
-+++ policy-1.27.1/macros/program/cdrecord_macros.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/cdrecord_macros.te policy-1.27.1/macros/program/cdrecord_macros.te
+--- nsapolicy/macros/program/cdrecord_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/program/cdrecord_macros.te 2005-09-27 09:30:49.000000000 -0400
@@ -41,7 +41,7 @@
allow $1_cdrecord_t self:capability { ipc_lock sys_nice setuid dac_override sys_rawio };
@@ -1483,8 +2080,9 @@
allow $1_cdrecord_t $1_home_t:dir search;
allow $1_cdrecord_t $1_home_dir_t:dir r_dir_perms;
allow $1_cdrecord_t $1_home_t:file r_file_perms;
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/i18n_input_macros.te policy-1.27.1/macros/program/i18n_input_macros.te
--- nsapolicy/macros/program/i18n_input_macros.te 1969-12-31 19:00:00.000000000 -0500
-+++ policy-1.27.1/macros/program/i18n_input_macros.te 2005-09-16 11:35:39.000000000 -0400
++++ policy-1.27.1/macros/program/i18n_input_macros.te 2005-09-27 09:30:49.000000000 -0400
@@ -0,0 +1,21 @@
+#
+# Macros for i18n_input
@@ -1507,8 +2105,9 @@
+')
+
+
---- nsapolicy/macros/program/mta_macros.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/macros/program/mta_macros.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/mta_macros.te policy-1.27.1/macros/program/mta_macros.te
+--- nsapolicy/macros/program/mta_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/program/mta_macros.te 2005-09-27 09:30:49.000000000 -0400
@@ -34,7 +34,7 @@
uses_shlib($1_mail_t)
@@ -1527,8 +2126,9 @@
', `
# For when the user wants to send mail via port 25 localhost
---- nsapolicy/macros/program/newrole_macros.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/macros/program/newrole_macros.te 2005-09-19 09:29:47.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/newrole_macros.te policy-1.27.1/macros/program/newrole_macros.te
+--- nsapolicy/macros/program/newrole_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/program/newrole_macros.te 2005-09-27 09:30:49.000000000 -0400
@@ -20,6 +20,8 @@
read_locale($1_t)
read_sysctl($1_t)
@@ -1538,8 +2138,9 @@
# for when the user types "exec newrole" at the command line
allow $1_t privfd:process sigchld;
---- nsapolicy/macros/program/pyzor_macros.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/macros/program/pyzor_macros.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/pyzor_macros.te policy-1.27.1/macros/program/pyzor_macros.te
+--- nsapolicy/macros/program/pyzor_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/program/pyzor_macros.te 2005-09-27 09:30:49.000000000 -0400
@@ -64,6 +64,6 @@
# Allow pyzor to be run by hand. Needed by any action other than
@@ -1548,8 +2149,9 @@
+can_access_pty($1_pyzor_t, $1)
allow $1_pyzor_t sshd_t:fd use;
')
---- nsapolicy/macros/program/razor_macros.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/macros/program/razor_macros.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/razor_macros.te policy-1.27.1/macros/program/razor_macros.te
+--- nsapolicy/macros/program/razor_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/program/razor_macros.te 2005-09-27 09:30:49.000000000 -0400
@@ -70,6 +70,6 @@
# Allow razor to be run by hand. Needed by any action other than
@@ -1558,8 +2160,9 @@
+can_access_pty($1_razor_t, $1)
allow $1_razor_t sshd_t:fd use;
')
---- nsapolicy/macros/program/su_macros.te 2005-09-16 11:17:12.000000000 -0400
-+++ policy-1.27.1/macros/program/su_macros.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/su_macros.te policy-1.27.1/macros/program/su_macros.te
+--- nsapolicy/macros/program/su_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/program/su_macros.te 2005-09-27 09:30:49.000000000 -0400
@@ -54,7 +54,7 @@
allow $1_su_t self:process { setsched setrlimit };
allow $1_su_t device_t:dir search;
@@ -1569,8 +2172,9 @@
r_dir_file($1_su_t, selinux_config_t)
dontaudit $1_su_t shadow_t:file { getattr read };
---- nsapolicy/macros/program/uml_macros.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/macros/program/uml_macros.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/uml_macros.te policy-1.27.1/macros/program/uml_macros.te
+--- nsapolicy/macros/program/uml_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/program/uml_macros.te 2005-09-27 09:30:49.000000000 -0400
@@ -81,7 +81,7 @@
allow uml_net_t $1_uml_t:unix_stream_socket { read write };
allow uml_net_t $1_uml_t:unix_dgram_socket { read write };
@@ -1580,8 +2184,9 @@
dontaudit uml_net_t $1_uml_rw_t:dir { getattr search };
')dnl end ifdef uml_net.te
---- nsapolicy/macros/user_macros.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/macros/user_macros.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/macros/user_macros.te policy-1.27.1/macros/user_macros.te
+--- nsapolicy/macros/user_macros.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/macros/user_macros.te 2005-09-27 09:30:49.000000000 -0400
@@ -121,6 +121,7 @@
# user domains.
ifelse($1, sysadm, `',`
@@ -1590,8 +2195,9 @@
')
ifdef(`slocate.te', `locate_domain($1)')
ifdef(`lockdev.te', `lockdev_domain($1)')
---- nsapolicy/Makefile 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/Makefile 2005-09-16 11:36:31.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/Makefile policy-1.27.1/Makefile
+--- nsapolicy/Makefile 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/Makefile 2005-09-27 09:30:49.000000000 -0400
@@ -29,15 +29,10 @@
VERS := $(shell $(CHECKPOLICY) $(POLICYCOMPAT) -V |cut -f 1 -d ' ')
PREVERS := 19
@@ -1599,13 +2205,14 @@
+MLSENABLED := $(shell cat /selinux/mls)
POLICYVER := policy.$(VERS)
TOPDIR = $(DESTDIR)/etc/selinux
- TYPE=strict
+-TYPE=strict
-ifeq ($(MLS),y)
-TYPE=mls
-endif
-ifeq ($(MCS),y)
-TYPE=mcs
-endif
++TYPE=targeted
INSTALLDIR = $(TOPDIR)/$(TYPE)
POLICYPATH = $(INSTALLDIR)/policy
@@ -1656,8 +2263,64 @@
@echo "Enabling MCS in the Makefile"
@sed "s/MCS=y/MCS=y/" Makefile > Makefile.new
@mv Makefile.new Makefile
---- nsapolicy/mcs 2005-09-15 16:13:03.000000000 -0400
-+++ policy-1.27.1/mcs 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/man/man8/ftpd_selinux.8 policy-1.27.1/man/man8/ftpd_selinux.8
+--- nsapolicy/man/man8/ftpd_selinux.8 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/man/man8/ftpd_selinux.8 2005-09-27 09:39:35.000000000 -0400
+@@ -8,23 +8,23 @@
+ .SH FILE_CONTEXTS
+ SELinux requires files to have an extended attribute to define the file type.
+ Policy governs the access daemons have to these files.
+-If you want to share files anonymously, you must label the files and directories ftpd_anon_t. So if you created a special directory /var/ftp, you
++If you want to share files anonymously, you must label the files and directories public_content_t. So if you created a special directory /var/ftp, you
+ would need to label the directory with the chcon tool.
+ .TP
+-chcon -R -t ftpd_anon_t /var/ftp
++chcon -R -t public_content_t /var/ftp
+ .TP
+ If you want to setup a directory where you can upload files to you must label the files and directories ftpd_anon_rw_t. So if you created a special directory /var/ftp/incoming, you
+ would need to label the directory with the chcon tool.
+ .TP
+-chcon -t ftpd_anon_rw_t /var/ftp/incoming
++chcon -t public_content_rw_t /var/ftp/incoming
+
+ .TP
+ If you want to make this permanant, i.e. survive a relabel, you must add an entry to the file_contexts.local file.
+ .TP
+ /etc/selinux/POLICYTYPE/contexts/files/file_contexts.local
+ .br
+-/var/ftp(/.*)? system_u:object_r:ftpd_anon_t
+-/var/ftp/incoming(/.*)? system_u:object_r:ftpd_anon_rw_t
++/var/ftp(/.*)? system_u:object_r:public_content_t
++/var/ftp/incoming(/.*)? system_u:object_r:public_content_rw_t
+
+ .SH BOOLEANS
+ SELinux ftp daemon policy is customizable based on least access required. So by
+diff --exclude-from=exclude -N -u -r nsapolicy/man/man8/rsync_selinux.8 policy-1.27.1/man/man8/rsync_selinux.8
+--- nsapolicy/man/man8/rsync_selinux.8 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/man/man8/rsync_selinux.8 2005-09-27 09:39:35.000000000 -0400
+@@ -8,16 +8,16 @@
+ .SH FILE_CONTEXTS
+ SELinux requires files to have an extended attribute to define the file type.
+ Policy governs the access daemons have to these files.
+-If you want to share files using the rsync daemon, you must label the files and directories ftpd_anon_t. So if you created a special directory /var/rsync, you
++If you want to share files using the rsync daemon, you must label the files and directories public_content_t. So if you created a special directory /var/rsync, you
+ would need to label the directory with the chcon tool.
+ .TP
+-chcon -t ftpd_anon_t /var/rsync
++chcon -t public_content_t /var/rsync
+ .TP
+ If you want to make this permanant, i.e. survive a relabel, you must add an entry to the file_contexts.local file.
+ .TP
+ /etc/selinux/POLICYTYPE/contexts/files/file_contexts.local
+ .br
+-/var/rsync(/.*)? system_u:object_r:ftpd_anon_t
++/var/rsync(/.*)? system_u:object_r:public_content_t
+
+ .SH BOOLEANS
+ .TP
+diff --exclude-from=exclude -N -u -r nsapolicy/mcs policy-1.27.1/mcs
+--- nsapolicy/mcs 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/mcs 2005-09-27 09:30:49.000000000 -0400
@@ -200,9 +200,23 @@
#
# Only files are constrained by MCS at this stage.
@@ -1683,8 +2346,9 @@
# XXX
#
---- nsapolicy/net_contexts 2005-09-16 11:17:08.000000000 -0400
-+++ policy-1.27.1/net_contexts 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/net_contexts policy-1.27.1/net_contexts
+--- nsapolicy/net_contexts 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/net_contexts 2005-09-27 09:30:49.000000000 -0400
@@ -50,6 +50,10 @@
portcon tcp 53 system_u:object_r:dns_port_t
@@ -1705,8 +2369,9 @@
portcon tcp 6000 system_u:object_r:xserver_port_t
portcon tcp 6001 system_u:object_r:xserver_port_t
portcon tcp 6002 system_u:object_r:xserver_port_t
---- nsapolicy/targeted/appconfig/root_default_contexts 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/targeted/appconfig/root_default_contexts 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/targeted/appconfig/root_default_contexts policy-1.27.1/targeted/appconfig/root_default_contexts
+--- nsapolicy/targeted/appconfig/root_default_contexts 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/targeted/appconfig/root_default_contexts 2005-09-27 09:30:49.000000000 -0400
@@ -1,2 +1,6 @@
system_r:unconfined_t system_r:unconfined_t
system_r:initrc_t system_r:unconfined_t
@@ -1714,8 +2379,9 @@
+system_r:remote_login_t system_r:unconfined_t
+system_r:rshd_t system_r:unconfined_t
+system_r:crond_t system_r:unconfined_t
---- nsapolicy/targeted/domains/program/ssh.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/targeted/domains/program/ssh.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/targeted/domains/program/ssh.te policy-1.27.1/targeted/domains/program/ssh.te
+--- nsapolicy/targeted/domains/program/ssh.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/targeted/domains/program/ssh.te 2005-09-27 09:30:49.000000000 -0400
@@ -17,3 +17,6 @@
type sshd_key_t, file_type, sysadmfile;
type sshd_var_run_t, file_type, sysadmfile;
@@ -1723,8 +2389,9 @@
+ifdef(`use_mcs', `
+range_transition initrc_t sshd_exec_t s0 - s0:c0.c127;
+')
---- nsapolicy/targeted/domains/program/xdm.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/targeted/domains/program/xdm.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/targeted/domains/program/xdm.te policy-1.27.1/targeted/domains/program/xdm.te
+--- nsapolicy/targeted/domains/program/xdm.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/targeted/domains/program/xdm.te 2005-09-27 09:30:49.000000000 -0400
@@ -20,3 +20,7 @@
type xdm_tmp_t, file_type, sysadmfile;
domain_auto_trans(initrc_t, xdm_exec_t, xdm_t)
@@ -1733,25 +2400,9 @@
+range_transition init_t xdm_exec_t s0 - s0:c0.c127;
+range_transition initrc_t xdm_exec_t s0 - s0:c0.c127;
+')
---- nsapolicy/targeted/domains/unconfined.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/targeted/domains/unconfined.te 2005-09-19 10:30:53.000000000 -0400
-@@ -7,15 +7,15 @@
- type unconfined_t, domain, privuser, privhome, privrole, privowner, admin, auth_write, fs_domain, privmem;
- role system_r types unconfined_t;
- role user_r types unconfined_t;
--role sysadm_r types unconfined_t;
- unconfined_domain(unconfined_t)
- allow domain unconfined_t:fd use;
- allow domain unconfined_t:process sigchld;
-
- # Define some type aliases to help with compatibility with
- # macros and domains from the "strict" policy.
- typealias bin_t alias su_exec_t;
- typealias unconfined_t alias { logrotate_t sendmail_t sshd_t secadm_t sysadm_t rpm_t rpm_script_t xdm_t };
-+
- typeattribute tty_device_t admin_tty_type;
- typeattribute devpts_t admin_tty_type;
-
+diff --exclude-from=exclude -N -u -r nsapolicy/targeted/domains/unconfined.te policy-1.27.1/targeted/domains/unconfined.te
+--- nsapolicy/targeted/domains/unconfined.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/targeted/domains/unconfined.te 2005-09-27 09:30:49.000000000 -0400
@@ -63,6 +63,7 @@
bool use_samba_home_dirs false;
@@ -1778,8 +2429,9 @@
+role system_r types sysadm_su_t;
+')
+
---- nsapolicy/tunables/distro.tun 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/tunables/distro.tun 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/tunables/distro.tun policy-1.27.1/tunables/distro.tun
+--- nsapolicy/tunables/distro.tun 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/tunables/distro.tun 2005-09-27 09:30:49.000000000 -0400
@@ -5,7 +5,7 @@
# appropriate ifdefs.
@@ -1789,8 +2441,9 @@
dnl define(`distro_suse')
---- nsapolicy/tunables/tunable.tun 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/tunables/tunable.tun 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/tunables/tunable.tun policy-1.27.1/tunables/tunable.tun
+--- nsapolicy/tunables/tunable.tun 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/tunables/tunable.tun 2005-09-27 09:30:49.000000000 -0400
@@ -1,5 +1,5 @@
# Allow rpm to run unconfined.
-dnl define(`unlimitedRPM')
@@ -1807,8 +2460,20 @@
# Allow user_r to reach sysadm_r via su, sudo, or userhelper.
# Otherwise, only staff_r can do so.
---- nsapolicy/types/file.te 2005-09-16 11:17:12.000000000 -0400
-+++ policy-1.27.1/types/file.te 2005-09-16 11:35:39.000000000 -0400
+diff --exclude-from=exclude -N -u -r nsapolicy/types/devpts.te policy-1.27.1/types/devpts.te
+--- nsapolicy/types/devpts.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/types/devpts.te 2005-09-27 09:40:46.000000000 -0400
+@@ -18,4 +18,6 @@
+ #
+ type devpts_t, mount_point, fs_type;
+
+-
++ifdef(`targeted_policy', `
++typeattribute devpts_t ttyfile;
++')
+diff --exclude-from=exclude -N -u -r nsapolicy/types/file.te policy-1.27.1/types/file.te
+--- nsapolicy/types/file.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/types/file.te 2005-09-27 09:41:05.000000000 -0400
@@ -307,8 +307,7 @@
type hugetlbfs_t, mount_point, fs_type, sysadmfile;
allow hugetlbfs_t self:filesystem associate;
@@ -1829,20 +2494,82 @@
# removable_t is the default type of all removable media
type removable_t, file_type, sysadmfile, usercanread;
allow removable_t self:filesystem associate;
---- nsapolicy/types/network.te 2005-09-16 11:17:12.000000000 -0400
-+++ policy-1.27.1/types/network.te 2005-09-16 11:35:39.000000000 -0400
-@@ -120,6 +120,8 @@
+@@ -332,11 +334,16 @@
+ allow file_type noexattrfile:filesystem associate;
+
+ # Type for anonymous FTP data, used by ftp and rsync
+-type ftpd_anon_t, file_type, sysadmfile, customizable;
+-type ftpd_anon_rw_t, file_type, sysadmfile, customizable;
++type public_content_t, file_type, sysadmfile, customizable;
++type public_content_rw_t, file_type, sysadmfile, customizable;
++typealias public_content_t alias ftpd_anon_t;
++typealias public_content_rw_t alias ftpd_anon_rw_t;
+
+ allow customizable self:filesystem associate;
+
+ # type for /tmp/.ICE-unix
+ type ice_tmp_t, file_type, sysadmfile, tmpfile;
+
++# type for /usr/share/hwdata
++type hwdata_t, file_type, sysadmfile;
++
+diff --exclude-from=exclude -N -u -r nsapolicy/types/network.te policy-1.27.1/types/network.te
+--- nsapolicy/types/network.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/types/network.te 2005-09-27 09:42:49.000000000 -0400
+@@ -18,7 +18,7 @@
+ type dhcpd_port_t, port_type, reserved_port_type;
+ type smbd_port_t, port_type, reserved_port_type;
+ type nmbd_port_t, port_type, reserved_port_type;
+-type http_cache_port_t, port_type, reserved_port_type;
++type http_cache_port_t, port_type;
+ type http_port_t, port_type, reserved_port_type;
+ type ipp_port_t, port_type, reserved_port_type;
+ type gopher_port_t, port_type, reserved_port_type;
+@@ -105,7 +105,7 @@
+ type printer_port_t, port_type, reserved_port_type;
+ type mysqld_port_t, port_type;
+ type postgresql_port_t, port_type;
+-type ptal_port_t, port_type, reserved_port_type;
++type ptal_port_t, port_type;
+ type howl_port_t, port_type;
+ type dict_port_t, port_type;
+ type syslogd_port_t, port_type, reserved_port_type;
+@@ -120,11 +120,13 @@
type zebra_port_t, port_type;
type i18n_input_port_t, port_type;
type vnc_port_t, port_type;
+type pegasus_http_port_t, port_type;
+type pegasus_https_port_t, port_type;
type openvpn_port_t, port_type;
- type clamd_port_t, port_type, reserved_port_type;
+-type clamd_port_t, port_type, reserved_port_type;
++type clamd_port_t, port_type;
type transproxy_port_t, port_type;
---- nsapolicy/types/security.te 2005-09-12 16:40:26.000000000 -0400
-+++ policy-1.27.1/types/security.te 2005-09-16 11:35:39.000000000 -0400
-@@ -19,6 +19,10 @@
+ type clockspeed_port_t, port_type;
+-type pyzor_port_t, port_type, reserved_port_type;
++type pyzor_port_t, port_type;
+ type postgrey_port_t, port_type;
+ type asterisk_port_t, port_type;
+ type utcpserver_port_t, port_type;
+@@ -157,7 +159,7 @@
+ type telnetd_port_t, port_type, reserved_port_type;
+ type comsat_port_t, port_type, reserved_port_type;
+ type cvs_port_t, port_type;
+-type dbskkd_port_t, port_type, reserved_port_type;
++type dbskkd_port_t, port_type;
+ type inetd_child_port_t, port_type, reserved_port_type;
+ type ktalkd_port_t, port_type, reserved_port_type;
+ type rsync_port_t, port_type, reserved_port_type;
+diff --exclude-from=exclude -N -u -r nsapolicy/types/security.te policy-1.27.1/types/security.te
+--- nsapolicy/types/security.te 2005-09-16 11:17:27.000000000 -0400
++++ policy-1.27.1/types/security.te 2005-09-27 09:41:48.000000000 -0400
+@@ -13,12 +13,17 @@
+ # applied to selinuxfs inodes.
+ #
+ type security_t, mount_point, fs_type, mlstrustedobject;
++dontaudit domain security_t:dir search;
+
+ #
+ # policy_config_t is the type of /etc/security/selinux/*
# the security server policy configuration.
#
type policy_config_t, file_type, secadmfile;
Index: selinux-policy-strict.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-strict/FC-4/selinux-policy-strict.spec,v
retrieving revision 1.319
retrieving revision 1.320
diff -u -r1.319 -r1.320
--- selinux-policy-strict.spec 19 Sep 2005 18:53:32 -0000 1.319
+++ selinux-policy-strict.spec 27 Sep 2005 13:45:02 -0000 1.320
@@ -11,7 +11,7 @@
Summary: SELinux %{type} policy configuration
Name: selinux-policy-%{type}
Version: 1.27.1
-Release: 2.1
+Release: 2.3
License: GPL
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -229,6 +229,10 @@
exit 0
%changelog
+* Tue Sep 27 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.3
+- Fixes for postfix, amanda, bluetooth
+- Merge in changes from Rawhide.
+
* Mon Sep 19 2005 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.1
- Update to match rawhide
More information about the fedora-cvs-commits
mailing list