rpms/selinux-policy-targeted/FC-4 booleans, 1.11, 1.12 policy-20050916.patch, 1.21, 1.22 selinux-policy-targeted.spec, 1.354, 1.355
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Wed Jan 18 16:30:01 UTC 2006
- Previous message (by thread): rpms/selinux-policy-strict/FC-4 policy-20050916.patch, 1.18, 1.19 selinux-policy-strict.spec, 1.335, 1.336
- Next message (by thread): rpms/gstreamer-plugins-good/devel .cvsignore, 1.2, 1.3 gstreamer-plugins-good.spec, 1.2, 1.3 sources, 1.2, 1.3
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: dwalsh
Update of /cvs/dist/rpms/selinux-policy-targeted/FC-4
In directory cvs.devel.redhat.com:/tmp/cvs-serv11775
Modified Files:
booleans policy-20050916.patch selinux-policy-targeted.spec
Log Message:
* Wed Jan 18 2006 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.19
- Add support for labeled networking in upcoming kernel
- Fix man page and booleans file
Index: booleans
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/FC-4/booleans,v
retrieving revision 1.11
retrieving revision 1.12
diff -u -r1.11 -r1.12
--- booleans 4 Apr 2005 15:41:47 -0000 1.11
+++ booleans 18 Jan 2006 16:29:57 -0000 1.12
@@ -1,4 +1,4 @@
-# This file should not not be modified.
+# This file should not be modified.
# If you want to customize your booleans, make changes to booleans.local
# or use "setsebool -P"
# This file will be replaced with the next rpm upgrade.
policy-20050916.patch:
Makefile | 26 +-
attrib.te | 100 +++++++++-
domains/admin.te | 2
domains/misc/kernel.te | 2
domains/program/crond.te | 2
domains/program/fsadm.te | 9
domains/program/getty.te | 2
domains/program/hostname.te | 2
domains/program/ifconfig.te | 10 -
domains/program/init.te | 2
domains/program/initrc.te | 26 ++
domains/program/ldconfig.te | 3
domains/program/load_policy.te | 11 -
domains/program/login.te | 23 +-
domains/program/logrotate.te | 2
domains/program/modutil.te | 27 +-
domains/program/mount.te | 6
domains/program/netutils.te | 3
domains/program/newrole.te | 4
domains/program/passwd.te | 2
domains/program/restorecon.te | 6
domains/program/setfiles.te | 4
domains/program/ssh.te | 6
domains/program/su.te | 12 +
domains/program/syslogd.te | 7
domains/program/tmpreaper.te | 2
domains/program/unused/NetworkManager.te | 13 +
domains/program/unused/alsa.te | 2
domains/program/unused/amanda.te | 74 +------
domains/program/unused/anaconda.te | 5
domains/program/unused/apache.te | 25 +-
domains/program/unused/apmd.te | 25 ++
domains/program/unused/auditd.te | 9
domains/program/unused/automount.te | 4
domains/program/unused/avahi.te | 31 +++
domains/program/unused/bluetooth.te | 72 +++++++
domains/program/unused/cups.te | 24 +-
domains/program/unused/cvs.te | 2
domains/program/unused/cyrus.te | 10 -
domains/program/unused/dbusd.te | 4
domains/program/unused/dcc.te | 5
domains/program/unused/dhcpc.te | 6
domains/program/unused/dhcpd.te | 4
domains/program/unused/dovecot.te | 6
domains/program/unused/exim.te | 309 +++++++++++++++++++++++++++++++
domains/program/unused/ftpd.te | 6
domains/program/unused/hald.te | 5
domains/program/unused/hotplug.te | 10 -
domains/program/unused/hwclock.te | 1
domains/program/unused/ipsec.te | 2
domains/program/unused/kudzu.te | 5
domains/program/unused/mta.te | 7
domains/program/unused/mysqld.te | 10 -
domains/program/unused/named.te | 27 ++
domains/program/unused/nscd.te | 1
domains/program/unused/ntpd.te | 10 -
domains/program/unused/openct.te | 16 +
domains/program/unused/pamconsole.te | 4
domains/program/unused/pegasus.te | 36 +++
domains/program/unused/ping.te | 2
domains/program/unused/postfix.te | 63 ++++--
domains/program/unused/postgresql.te | 11 -
domains/program/unused/pppd.te | 23 +-
domains/program/unused/privoxy.te | 2
domains/program/unused/procmail.te | 16 +
domains/program/unused/radius.te | 3
domains/program/unused/readahead.te | 21 ++
domains/program/unused/rlogind.te | 4
domains/program/unused/roundup.te | 29 ++
domains/program/unused/rpcd.te | 18 +
domains/program/unused/rpm.te | 4
domains/program/unused/rsync.te | 3
domains/program/unused/samba.te | 15 +
domains/program/unused/saslauthd.te | 1
domains/program/unused/sendmail.te | 3
domains/program/unused/slapd.te | 28 ++
domains/program/unused/snmpd.te | 6
domains/program/unused/spamd.te | 28 --
domains/program/unused/squid.te | 4
domains/program/unused/udev.te | 10 -
domains/program/unused/utempter.te | 2
domains/program/unused/webalizer.te | 3
domains/program/unused/winbind.te | 1
domains/program/unused/xdm.te | 3
domains/program/unused/yppasswdd.te | 40 ++++
domains/program/unused/ypserv.te | 9
domains/program/unused/zebra.te | 2
domains/program/useradd.te | 5
file_contexts/distros.fc | 2
file_contexts/program/apache.fc | 3
file_contexts/program/bluetooth.fc | 3
file_contexts/program/compat.fc | 4
file_contexts/program/dhcpc.fc | 2
file_contexts/program/dhcpd.fc | 5
file_contexts/program/ftpd.fc | 5
file_contexts/program/games.fc | 11 -
file_contexts/program/innd.fc | 15 -
file_contexts/program/ipsec.fc | 1
file_contexts/program/openct.fc | 2
file_contexts/program/pegasus.fc | 9
file_contexts/program/pppd.fc | 2
file_contexts/program/privoxy.fc | 1
file_contexts/program/readahead.fc | 1
file_contexts/program/roundup.fc | 2
file_contexts/program/rpm.fc | 4
file_contexts/program/rshd.fc | 1
file_contexts/program/rsync.fc | 2
file_contexts/program/slapd.fc | 12 +
file_contexts/program/squid.fc | 3
file_contexts/program/xdm.fc | 2
file_contexts/program/yppasswdd.fc | 2
file_contexts/program/ypserv.fc | 1
file_contexts/types.fc | 6
genfs_contexts | 3
macros/base_user_macros.te | 7
macros/core_macros.te | 9
macros/global_macros.te | 35 ++-
macros/home_macros.te | 9
macros/network_macros.te | 19 +
macros/program/apache_macros.te | 13 +
macros/program/bonobo_macros.te | 2
macros/program/cdrecord_macros.te | 6
macros/program/chkpwd_macros.te | 8
macros/program/crontab_macros.te | 2
macros/program/dbusd_macros.te | 7
macros/program/gconf_macros.te | 2
macros/program/gift_macros.te | 2
macros/program/gpg_macros.te | 2
macros/program/i18n_input_macros.te | 21 ++
macros/program/lpr_macros.te | 2
macros/program/mta_macros.te | 4
macros/program/newrole_macros.te | 2
macros/program/pyzor_macros.te | 2
macros/program/razor_macros.te | 2
macros/program/su_macros.te | 4
macros/program/uml_macros.te | 2
macros/program/xdm_macros.te | 2
macros/program/ypbind_macros.te | 1
macros/user_macros.te | 7
man/man8/ftpd_selinux.8 | 19 +
man/man8/httpd_selinux.8 | 9
man/man8/rsync_selinux.8 | 12 -
man/man8/samba_selinux.8 | 9
mcs | 210 ++++++++-------------
mls | 270 ++++++++++-----------------
net_contexts | 13 +
targeted/appconfig/root_default_contexts | 4
targeted/assert.te | 2
targeted/domains/program/compat.te | 1
targeted/domains/program/sendmail.te | 1
targeted/domains/program/ssh.te | 3
targeted/domains/program/xdm.te | 4
targeted/domains/unconfined.te | 15 +
tunables/distro.tun | 2
tunables/tunable.tun | 4
types/device.te | 4
types/devpts.te | 4
types/file.te | 48 +---
types/network.te | 13 -
types/nfs.te | 1
types/security.te | 6
161 files changed, 1672 insertions(+), 688 deletions(-)
Index: policy-20050916.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/FC-4/policy-20050916.patch,v
retrieving revision 1.21
retrieving revision 1.22
diff -u -r1.21 -r1.22
--- policy-20050916.patch 2 Jan 2006 19:05:01 -0000 1.21
+++ policy-20050916.patch 18 Jan 2006 16:29:57 -0000 1.22
@@ -3571,7 +3571,7 @@
')
diff --exclude-from=exclude -N -u -r nsapolicy/macros/global_macros.te policy-1.27.1/macros/global_macros.te
--- nsapolicy/macros/global_macros.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/macros/global_macros.te 2005-11-30 16:42:28.000000000 -0500
++++ policy-1.27.1/macros/global_macros.te 2006-01-18 11:23:58.000000000 -0500
@@ -157,6 +157,11 @@
r_dir_file($1, locale_t)
')
@@ -3655,7 +3655,16 @@
# Mount/unmount any filesystem.
allow $1 fs_type:filesystem *;
-@@ -653,7 +666,7 @@
+@@ -636,6 +649,8 @@
+ # pseudo filesystem types that are applied to both the filesystem
+ # and its files.
+ allow $1 { unlabeled_t fs_type }:dir_file_class_set *;
++allow $1 unlabeled_t:association { sendto recvfrom };
++
+ allow $1 proc_fs:{ dir file } *;
+
+ # For /proc/pid
+@@ -653,7 +668,7 @@
allow $1 port_type:tcp_socket name_connect;
# Bind to any network address.
@@ -3664,7 +3673,7 @@
allow $1 node_type:{ tcp_socket udp_socket rawip_socket } node_bind;
allow $1 file_type:{ unix_stream_socket unix_dgram_socket } name_bind;
-@@ -695,8 +708,10 @@
+@@ -695,8 +710,10 @@
allow $1 domain:msg { send receive };
# Access the security API.
@@ -3675,7 +3684,7 @@
# Perform certain system operations that lacked individual capabilities.
allow $1 kernel_t:system *;
-@@ -750,4 +765,8 @@
+@@ -750,4 +767,8 @@
allow $1 { random_device_t urandom_device_t }:chr_file { getattr read };
allow $1 self:capability { audit_write audit_control };
dontaudit $1 shadow_t:file { getattr read };
@@ -3714,8 +3723,17 @@
####################################################################
diff --exclude-from=exclude -N -u -r nsapolicy/macros/network_macros.te policy-1.27.1/macros/network_macros.te
--- nsapolicy/macros/network_macros.te 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/macros/network_macros.te 2005-11-30 16:42:28.000000000 -0500
-@@ -153,7 +153,8 @@
++++ policy-1.27.1/macros/network_macros.te 2006-01-18 11:23:25.000000000 -0500
+@@ -12,6 +12,8 @@
+ # Other kinds of sockets must be separately authorized for use.
+ allow $1 self:$2_socket connected_socket_perms;
+
++allow $1 unlabeled_t:association { sendto recvfrom };
++
+ #
+ # Allow the domain to send or receive using any network interface.
+ # netif_type is a type attribute for all network interface types.
+@@ -153,7 +155,8 @@
')dnl end can_network definition
define(`can_resolve',`
@@ -3725,7 +3743,7 @@
')
define(`can_portmap',`
-@@ -173,3 +174,17 @@
+@@ -173,3 +176,17 @@
allow $1 winbind_var_run_t:sock_file { getattr read write };
')
')
@@ -4198,7 +4216,7 @@
@mv Makefile.new Makefile
diff --exclude-from=exclude -N -u -r nsapolicy/man/man8/ftpd_selinux.8 policy-1.27.1/man/man8/ftpd_selinux.8
--- nsapolicy/man/man8/ftpd_selinux.8 2005-09-16 11:17:27.000000000 -0400
-+++ policy-1.27.1/man/man8/ftpd_selinux.8 2005-11-30 16:42:28.000000000 -0500
++++ policy-1.27.1/man/man8/ftpd_selinux.8 2006-01-14 00:36:07.000000000 -0500
@@ -8,23 +8,24 @@
.SH FILE_CONTEXTS
SELinux requires files to have an extended attribute to define the file type.
@@ -4218,9 +4236,9 @@
-
+chcon -t public_content_rw_t /var/ftp/incoming
+.TP
-+You must also turn on the boolean allow_ftp_anon_write.
++You must also turn on the boolean allow_ftpd_anon_write.
+.TP
-+setsebool -P allow_ftp_anon_write=1
++setsebool -P allow_ftpd_anon_write=1
.TP
If you want to make this permanant, i.e. survive a relabel, you must add an entry to the file_contexts.local file.
.TP
Index: selinux-policy-targeted.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy-targeted/FC-4/selinux-policy-targeted.spec,v
retrieving revision 1.354
retrieving revision 1.355
diff -u -r1.354 -r1.355
--- selinux-policy-targeted.spec 2 Jan 2006 19:05:12 -0000 1.354
+++ selinux-policy-targeted.spec 18 Jan 2006 16:29:57 -0000 1.355
@@ -9,7 +9,7 @@
Summary: SELinux %{type} policy configuration
Name: selinux-policy-%{type}
Version: 1.27.1
-Release: 2.18
+Release: 2.19
License: GPL
Group: System Environment/Base
Source: http://www.nsa.gov/selinux/archives/policy-%{version}.tgz
@@ -234,6 +234,10 @@
exit 0
%changelog
+* Wed Jan 18 2006 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.19
+- Add support for labeled networking in upcoming kernel
+- Fix man page and booleans file
+
* Mon Jan 2 2006 Dan Walsh <dwalsh at redhat.com> 1.27.1-2.18
- Allow pam_module to work with apache
- Previous message (by thread): rpms/selinux-policy-strict/FC-4 policy-20050916.patch, 1.18, 1.19 selinux-policy-strict.spec, 1.335, 1.336
- Next message (by thread): rpms/gstreamer-plugins-good/devel .cvsignore, 1.2, 1.3 gstreamer-plugins-good.spec, 1.2, 1.3 sources, 1.2, 1.3
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the fedora-cvs-commits
mailing list