[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

rpms/selinux-policy/devel booleans-targeted.conf, 1.16, 1.17 policy-20060802.patch, 1.8, 1.9 selinux-policy.spec, 1.250, 1.251



Author: dwalsh

Update of /cvs/dist/rpms/selinux-policy/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv5637

Modified Files:
	booleans-targeted.conf policy-20060802.patch 
	selinux-policy.spec 
Log Message:
* Fri Aug 10 2006 Dan Walsh <dwalsh redhat com> 2.3.6-4
- Change allow_execstack to default to on, for RHEL5 Beta.  
  This is required because of a Java compiler problem.
  Hope to turn off for next beta



Index: booleans-targeted.conf
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy/devel/booleans-targeted.conf,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -r1.16 -r1.17
--- booleans-targeted.conf	19 Jul 2006 20:06:35 -0000	1.16
+++ booleans-targeted.conf	11 Aug 2006 15:39:50 -0000	1.17
@@ -8,7 +8,7 @@
 
 # Allow making the stack executable via mprotect.Also requires allow_execmem.
 # 
-allow_execstack = false
+allow_execstack = true
 
 # Allow ftpd to read cifs directories.
 # 

policy-20060802.patch:
 mls                                |    9 -
 modules/admin/anaconda.te          |   20 ++-
 modules/admin/bootloader.te        |    4 
 modules/admin/consoletype.te       |   11 +
 modules/admin/firstboot.te         |    2 
 modules/admin/prelink.te           |    3 
 modules/admin/rpm.fc               |    2 
 modules/admin/rpm.if               |   13 +-
 modules/admin/usermanage.te        |    4 
 modules/apps/java.fc               |    1 
 modules/apps/mozilla.if            |    2 
 modules/kernel/corecommands.fc     |    1 
 modules/kernel/corenetwork.te.in   |    4 
 modules/kernel/devices.fc          |    2 
 modules/kernel/devices.if          |   37 +++++
 modules/kernel/devices.te          |    8 +
 modules/kernel/files.if            |   18 ++
 modules/kernel/filesystem.te       |    2 
 modules/kernel/kernel.if           |   75 +++++++++++
 modules/kernel/terminal.if         |   19 ++
 modules/services/amavis.te         |    7 +
 modules/services/apache.te         |    1 
 modules/services/avahi.te          |    1 
 modules/services/bind.te           |    1 
 modules/services/bluetooth.te      |    5 
 modules/services/clamav.if         |    1 
 modules/services/cron.if           |   16 ++
 modules/services/cron.te           |    1 
 modules/services/cups.te           |   18 ++
 modules/services/cyrus.te          |    1 
 modules/services/dbus.if           |    6 
 modules/services/ldap.te           |    2 
 modules/services/mta.fc            |    2 
 modules/services/nis.te            |    2 
 modules/services/ntp.te            |    2 
 modules/services/openvpn.te        |    2 
 modules/services/pegasus.if        |   31 ++++
 modules/services/pegasus.te        |    5 
 modules/services/postfix.te        |    7 +
 modules/services/procmail.te       |    1 
 modules/services/samba.te          |    6 
 modules/services/setroubleshoot.fc |    9 +
 modules/services/setroubleshoot.if |    3 
 modules/services/setroubleshoot.te |  109 +++++++++++++++++
 modules/services/spamassassin.te   |    4 
 modules/services/squid.te          |    4 
 modules/services/ssh.if            |   26 +++-
 modules/services/ssh.te            |    1 
 modules/services/stunnel.te        |    4 
 modules/services/xserver.if        |   69 ++++++++++
 modules/services/xserver.te        |   19 ++
 modules/system/authlogin.te        |    1 
 modules/system/fstools.te          |    1 
 modules/system/hostname.te         |   10 +
 modules/system/init.if             |    7 -
 modules/system/init.te             |    2 
 modules/system/libraries.fc        |    4 
 modules/system/locallogin.te       |    4 
 modules/system/logging.fc          |    3 
 modules/system/logging.if          |   21 +++
 modules/system/logging.te          |    3 
 modules/system/miscfiles.fc        |    1 
 modules/system/miscfiles.if        |   18 ++
 modules/system/modutils.te         |    1 
 modules/system/mount.te            |    3 
 modules/system/selinuxutil.te      |   15 ++
 modules/system/udev.fc             |    1 
 modules/system/udev.te             |    1 
 modules/system/unconfined.if       |    2 
 modules/system/unconfined.te       |    5 
 modules/system/userdomain.if       |  236 +++++++++++++++++++++++++------------
 modules/system/userdomain.te       |   48 +++----
 modules/system/xen.if              |   38 +++++
 modules/system/xen.te              |   26 +++-
 74 files changed, 875 insertions(+), 179 deletions(-)

Index: policy-20060802.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy/devel/policy-20060802.patch,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- policy-20060802.patch	11 Aug 2006 04:09:21 -0000	1.8
+++ policy-20060802.patch	11 Aug 2006 15:39:50 -0000	1.9
@@ -272,7 +272,7 @@
  /dev/pmu		-c	gen_context(system_u:object_r:power_device_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-2.3.6/policy/modules/kernel/devices.if
 --- nsaserefpolicy/policy/modules/kernel/devices.if	2006-08-02 10:34:05.000000000 -0400
-+++ serefpolicy-2.3.6/policy/modules/kernel/devices.if	2006-08-10 14:25:22.000000000 -0400
++++ serefpolicy-2.3.6/policy/modules/kernel/devices.if	2006-08-10 23:43:22.000000000 -0400
 @@ -2992,3 +2992,40 @@
  
  	typeattribute $1 devices_unconfined_type;
@@ -477,7 +477,7 @@
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-2.3.6/policy/modules/kernel/terminal.if
 --- nsaserefpolicy/policy/modules/kernel/terminal.if	2006-08-02 10:34:05.000000000 -0400
-+++ serefpolicy-2.3.6/policy/modules/kernel/terminal.if	2006-08-08 16:15:43.000000000 -0400
++++ serefpolicy-2.3.6/policy/modules/kernel/terminal.if	2006-08-11 11:29:01.000000000 -0400
 @@ -308,6 +308,7 @@
  		type devpts_t;
  	')
@@ -961,8 +961,8 @@
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-2.3.6/policy/modules/services/setroubleshoot.te
 --- nsaserefpolicy/policy/modules/services/setroubleshoot.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-2.3.6/policy/modules/services/setroubleshoot.te	2006-08-08 16:15:43.000000000 -0400
-@@ -0,0 +1,105 @@
++++ serefpolicy-2.3.6/policy/modules/services/setroubleshoot.te	2006-08-11 11:30:54.000000000 -0400
+@@ -0,0 +1,109 @@
 +policy_module(setroubleshoot,1.0.0)
 +
 +########################################
@@ -1011,6 +1011,8 @@
 +logging_send_syslog_msg(setroubleshootd_t)
 +logging_audit_stream_connect(setroubleshootd_t)
 +
++locallogin_dontaudit_use_fds(setroubleshootd_t)
++
 +# pid file
 +files_search_pids(setroubleshootd_t)
 +allow setroubleshootd_t setroubleshoot_var_run_t:file manage_file_perms;
@@ -1060,6 +1062,8 @@
 +
 +term_dontaudit_use_console(setroubleshootd_t)
 +term_dontaudit_use_generic_ptys(setroubleshootd_t)
++term_dontaudit_use_all_user_ptys(setroubleshootd_t)
++term_dontaudit_use_all_user_ttys(setroubleshootd_t)
 +
 +optional_policy(`
 +	rpm_read_db(setroubleshootd_t)
@@ -1139,6 +1143,17 @@
 +	allow ssh_keygen_t $1:fifo_file rw_file_perms;
 +	allow ssh_keygen_t $1:process sigchld;
 +')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-2.3.6/policy/modules/services/ssh.te
+--- nsaserefpolicy/policy/modules/services/ssh.te	2006-08-02 10:34:07.000000000 -0400
++++ serefpolicy-2.3.6/policy/modules/services/ssh.te	2006-08-10 23:58:18.000000000 -0400
+@@ -61,6 +61,7 @@
+ 
+ 	type sshd_tmp_t;
+ 	files_tmp_file(sshd_tmp_t)
++
+ ')
+ 
+ #################################
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stunnel.te serefpolicy-2.3.6/policy/modules/services/stunnel.te
 --- nsaserefpolicy/policy/modules/services/stunnel.te	2006-08-02 10:34:07.000000000 -0400
 +++ serefpolicy-2.3.6/policy/modules/services/stunnel.te	2006-08-08 16:15:43.000000000 -0400
@@ -1574,7 +1589,7 @@
  ifdef(`distro_redhat',`
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-2.3.6/policy/modules/system/selinuxutil.te
 --- nsaserefpolicy/policy/modules/system/selinuxutil.te	2006-08-02 10:34:09.000000000 -0400
-+++ serefpolicy-2.3.6/policy/modules/system/selinuxutil.te	2006-08-09 11:02:28.000000000 -0400
++++ serefpolicy-2.3.6/policy/modules/system/selinuxutil.te	2006-08-11 09:47:12.000000000 -0400
 @@ -355,6 +355,8 @@
  kernel_relabelfrom_unlabeled_symlinks(restorecon_t)
  kernel_relabelfrom_unlabeled_pipes(restorecon_t)
@@ -1584,7 +1599,18 @@
  
  dev_relabel_all_dev_nodes(restorecon_t)
  # cjp: why is this needed?
-@@ -593,6 +595,9 @@
+@@ -463,6 +465,10 @@
+ miscfiles_read_localization(restorecond_t)
+ 
+ optional_policy(`
++	rpm_use_script_fds(restorecond_t)
++')
++
++optional_policy(`
+ 	# restorecond watches for users logging in, 
+ 	# so it getspwnam when a user logs in to find his homedir
+ 	nis_use_ypbind(restorecond_t)
+@@ -593,6 +599,9 @@
  
  miscfiles_read_localization(semanage_t)
  
@@ -1594,7 +1620,7 @@
  seutil_search_default_contexts(semanage_t)
  seutil_manage_file_contexts(semanage_t)
  seutil_manage_selinux_config(semanage_t)
-@@ -611,6 +616,12 @@
+@@ -611,6 +620,12 @@
  	# Handle pp files created in homedir and /tmp
  	files_read_generic_tmp_files(semanage_t)
  	userdom_read_generic_user_home_content_files(semanage_t)


Index: selinux-policy.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.250
retrieving revision 1.251
diff -u -r1.250 -r1.251
--- selinux-policy.spec	11 Aug 2006 03:16:13 -0000	1.250
+++ selinux-policy.spec	11 Aug 2006 15:39:50 -0000	1.251
@@ -16,7 +16,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 2.3.6
-Release: 3
+Release: 4
 License: GPL
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -347,6 +347,11 @@
 %endif
 
 %changelog
+* Fri Aug 10 2006 Dan Walsh <dwalsh redhat com> 2.3.6-4
+- Change allow_execstack to default to on, for RHEL5 Beta.  
+  This is required because of a Java compiler problem.
+  Hope to turn off for next beta
+
 * Thu Aug 10 2006 Dan Walsh <dwalsh redhat com> 2.3.6-3
 - Misc fixes
 


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]