rpms/selinux-policy/devel policy-20061106.patch, 1.21, 1.22 selinux-policy.spec, 1.349, 1.350

fedora-cvs-commits at redhat.com fedora-cvs-commits at redhat.com
Mon Nov 20 23:01:11 UTC 2006


Author: dwalsh

Update of /cvs/dist/rpms/selinux-policy/devel
In directory cvs.devel.redhat.com:/tmp/cvs-serv24339

Modified Files:
	policy-20061106.patch selinux-policy.spec 
Log Message:
* Mon Nov 20 2006 Dan Walsh <dwalsh at redhat.com> 2.4.5-2
- Fixes for hwclock, clamav, ftp


policy-20061106.patch:
 Rules.modular                           |   10 +
 policy/flask/access_vectors             |    2 
 policy/global_tunables                  |   36 ++++
 policy/mls                              |    3 
 policy/modules/admin/acct.te            |    1 
 policy/modules/admin/amanda.te          |    1 
 policy/modules/admin/consoletype.te     |   10 -
 policy/modules/admin/dmesg.te           |    1 
 policy/modules/admin/firstboot.if       |    6 
 policy/modules/admin/logwatch.te        |    1 
 policy/modules/admin/netutils.te        |    2 
 policy/modules/admin/prelink.te         |    5 
 policy/modules/admin/quota.te           |    1 
 policy/modules/admin/rpm.fc             |    3 
 policy/modules/admin/rpm.if             |   24 ++
 policy/modules/admin/rpm.te             |   37 +---
 policy/modules/apps/java.fc             |    2 
 policy/modules/kernel/corecommands.if   |   17 +-
 policy/modules/kernel/corenetwork.if.in |   12 +
 policy/modules/kernel/corenetwork.te.in |   15 +
 policy/modules/kernel/corenetwork.te.m4 |    4 
 policy/modules/kernel/devices.fc        |    5 
 policy/modules/kernel/devices.te        |    6 
 policy/modules/kernel/domain.te         |    7 
 policy/modules/kernel/files.if          |   88 ++++++++++
 policy/modules/kernel/filesystem.te     |    6 
 policy/modules/kernel/terminal.fc       |    1 
 policy/modules/kernel/terminal.te       |    1 
 policy/modules/services/apache.fc       |   10 +
 policy/modules/services/apache.te       |   16 +
 policy/modules/services/automount.te    |    1 
 policy/modules/services/clamav.te       |    2 
 policy/modules/services/cron.if         |   26 ---
 policy/modules/services/cron.te         |    5 
 policy/modules/services/cups.fc         |    2 
 policy/modules/services/cups.te         |    4 
 policy/modules/services/cvs.te          |    1 
 policy/modules/services/dbus.fc         |    1 
 policy/modules/services/dbus.if         |    1 
 policy/modules/services/ftp.te          |    1 
 policy/modules/services/hal.fc          |    4 
 policy/modules/services/hal.te          |    8 
 policy/modules/services/kerberos.if     |    1 
 policy/modules/services/kerberos.te     |   11 +
 policy/modules/services/lpd.if          |   52 +++---
 policy/modules/services/mta.if          |    1 
 policy/modules/services/mta.te          |    1 
 policy/modules/services/nscd.if         |   20 ++
 policy/modules/services/nscd.te         |    3 
 policy/modules/services/oddjob.te       |    3 
 policy/modules/services/pegasus.if      |   31 +++
 policy/modules/services/pegasus.te      |    5 
 policy/modules/services/postfix.te      |   13 +
 policy/modules/services/procmail.te     |   16 +
 policy/modules/services/rsync.te        |    1 
 policy/modules/services/samba.if        |    2 
 policy/modules/services/samba.te        |    8 
 policy/modules/services/sasl.te         |    2 
 policy/modules/services/snmp.te         |    4 
 policy/modules/services/spamassassin.te |    4 
 policy/modules/services/ssh.te          |    3 
 policy/modules/services/telnet.te       |    1 
 policy/modules/services/tftp.te         |    2 
 policy/modules/services/uucp.fc         |    1 
 policy/modules/services/uucp.if         |   67 ++++++++
 policy/modules/services/uucp.te         |   44 +++++
 policy/modules/services/xserver.if      |   40 ++++
 policy/modules/system/authlogin.if      |    5 
 policy/modules/system/authlogin.te      |    2 
 policy/modules/system/clock.te          |    5 
 policy/modules/system/fstools.fc        |    1 
 policy/modules/system/fstools.te        |    2 
 policy/modules/system/getty.te          |    3 
 policy/modules/system/hostname.te       |    6 
 policy/modules/system/init.fc           |    3 
 policy/modules/system/init.te           |   14 +
 policy/modules/system/iptables.te       |    6 
 policy/modules/system/libraries.fc      |   16 +
 policy/modules/system/libraries.te      |    6 
 policy/modules/system/locallogin.if     |   37 ++++
 policy/modules/system/logging.te        |    1 
 policy/modules/system/lvm.fc            |    1 
 policy/modules/system/lvm.te            |   48 +++++
 policy/modules/system/miscfiles.fc      |    1 
 policy/modules/system/modutils.te       |    5 
 policy/modules/system/mount.te          |   19 +-
 policy/modules/system/raid.te           |    7 
 policy/modules/system/selinuxutil.if    |    4 
 policy/modules/system/selinuxutil.te    |   37 ++--
 policy/modules/system/unconfined.fc     |    4 
 policy/modules/system/unconfined.if     |   19 ++
 policy/modules/system/unconfined.te     |   11 +
 policy/modules/system/userdomain.if     |  262 +++++++++++++++++++++++++++-----
 policy/modules/system/userdomain.te     |   10 +
 policy/modules/system/xen.fc            |    1 
 policy/modules/system/xen.te            |   30 +++
 96 files changed, 1091 insertions(+), 200 deletions(-)

Index: policy-20061106.patch
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy/devel/policy-20061106.patch,v
retrieving revision 1.21
retrieving revision 1.22
diff -u -r1.21 -r1.22
--- policy-20061106.patch	17 Nov 2006 19:20:09 -0000	1.21
+++ policy-20061106.patch	20 Nov 2006 23:01:06 -0000	1.22
@@ -874,6 +874,18 @@
  
  fs_mount_all_fs(automount_t)
  fs_unmount_all_fs(automount_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-2.4.5/policy/modules/services/clamav.te
+--- nsaserefpolicy/policy/modules/services/clamav.te	2006-11-16 17:15:20.000000000 -0500
++++ serefpolicy-2.4.5/policy/modules/services/clamav.te	2006-11-20 14:07:14.000000000 -0500
+@@ -86,6 +86,8 @@
+ 
+ kernel_dontaudit_list_proc(clamd_t)
+ 
++kernel_read_sysctl(clamd_t)
++
+ corenet_non_ipsec_sendrecv(clamd_t)
+ corenet_tcp_sendrecv_all_if(clamd_t)
+ corenet_tcp_sendrecv_all_nodes(clamd_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-2.4.5/policy/modules/services/cron.if
 --- nsaserefpolicy/policy/modules/services/cron.if	2006-11-16 17:15:21.000000000 -0500
 +++ serefpolicy-2.4.5/policy/modules/services/cron.if	2006-11-17 09:19:51.000000000 -0500
@@ -1028,6 +1040,17 @@
  	corecmd_list_bin($1_dbusd_t)
  	corecmd_read_bin_symlinks($1_dbusd_t)
  	corecmd_read_bin_files($1_dbusd_t)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-2.4.5/policy/modules/services/ftp.te
+--- nsaserefpolicy/policy/modules/services/ftp.te	2006-11-16 17:15:20.000000000 -0500
++++ serefpolicy-2.4.5/policy/modules/services/ftp.te	2006-11-20 15:17:48.000000000 -0500
+@@ -127,6 +127,7 @@
+ 
+ init_use_fds(ftpd_t)
+ init_use_script_ptys(ftpd_t)
++init_rw_utmp(ftpd_t)
+ 
+ libs_use_ld_so(ftpd_t)
+ libs_use_shared_libs(ftpd_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-2.4.5/policy/modules/services/hal.fc
 --- nsaserefpolicy/policy/modules/services/hal.fc	2006-11-16 17:15:20.000000000 -0500
 +++ serefpolicy-2.4.5/policy/modules/services/hal.fc	2006-11-17 09:19:51.000000000 -0500
@@ -1305,7 +1328,7 @@
  hostname_exec(pegasus_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-2.4.5/policy/modules/services/postfix.te
 --- nsaserefpolicy/policy/modules/services/postfix.te	2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.4.5/policy/modules/services/postfix.te	2006-11-17 09:19:51.000000000 -0500
++++ serefpolicy-2.4.5/policy/modules/services/postfix.te	2006-11-20 15:02:42.000000000 -0500
 @@ -382,6 +382,10 @@
  	locallogin_dontaudit_use_fds(postfix_map_t)
  ')
@@ -1317,7 +1340,18 @@
  # a "run" interface needs to be
  # added, and have sysadm_t use it
  # in a optional_policy block.
-@@ -574,9 +578,14 @@
+@@ -431,6 +435,10 @@
+ 	mailman_domtrans_queue(postfix_pipe_t)
+ ')
+ 
++optional_policy(`
++	uucp_domtrans_uux(postfix_pipe_t)
++')
++
+ ########################################
+ #
+ # Postfix postdrop local policy
+@@ -574,9 +582,14 @@
  allow postfix_smtp_t postfix_master_t:unix_stream_socket connectto;
  allow postfix_smtp_t { postfix_private_t postfix_public_t }:dir search;
  allow postfix_smtp_t { postfix_private_t postfix_public_t }:sock_file write;
@@ -1397,7 +1431,16 @@
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-2.4.5/policy/modules/services/samba.te
 --- nsaserefpolicy/policy/modules/services/samba.te	2006-11-16 17:15:21.000000000 -0500
-+++ serefpolicy-2.4.5/policy/modules/services/samba.te	2006-11-17 09:19:51.000000000 -0500
++++ serefpolicy-2.4.5/policy/modules/services/samba.te	2006-11-20 15:05:17.000000000 -0500
+@@ -349,7 +349,7 @@
+ allow nmbd_t samba_etc_t:file { getattr read };
+ 
+ allow nmbd_t samba_log_t:dir { create ra_dir_perms setattr };
+-allow nmbd_t samba_log_t:file { create ra_file_perms };
++allow nmbd_t samba_log_t:file { create ra_file_perms unlink };
+ 
+ allow nmbd_t samba_var_t:dir rw_dir_perms;
+ allow nmbd_t samba_var_t:file { lock unlink create write setattr read getattr rename };
 @@ -525,7 +525,8 @@
  allow swat_t self:netlink_audit_socket create;
  allow swat_t self:tcp_socket create_stream_socket_perms;
@@ -1439,15 +1482,27 @@
  auth_domtrans_chk_passwd(saslauthd_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-2.4.5/policy/modules/services/snmp.te
 --- nsaserefpolicy/policy/modules/services/snmp.te	2006-11-16 17:15:20.000000000 -0500
-+++ serefpolicy-2.4.5/policy/modules/services/snmp.te	2006-11-17 09:19:51.000000000 -0500
-@@ -87,6 +87,7 @@
++++ serefpolicy-2.4.5/policy/modules/services/snmp.te	2006-11-20 15:22:36.000000000 -0500
+@@ -77,6 +77,7 @@
+ dev_read_sysfs(snmpd_t)
+ dev_read_urand(snmpd_t)
+ dev_read_rand(snmpd_t)
++dev_getattr_usbfs_dirs(snmpd_t)
+ 
+ domain_use_interactive_fds(snmpd_t)
+ domain_signull_all_domains(snmpd_t)
+@@ -87,9 +88,10 @@
  files_read_etc_runtime_files(snmpd_t)
  files_search_home(snmpd_t)
  files_getattr_boot_dirs(snmpd_t)
 +files_dontaudit_getattr_home_dir(snmpd_t)
  
++fs_getattr_all_dirs(snmpd_t)
  fs_getattr_all_fs(snmpd_t)
- fs_getattr_rpc_dirs(snmpd_t)
+-fs_getattr_rpc_dirs(snmpd_t)
+ fs_search_auto_mountpoints(snmpd_t)
+ 
+ storage_dontaudit_read_fixed_disk(snmpd_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-2.4.5/policy/modules/services/spamassassin.te
 --- nsaserefpolicy/policy/modules/services/spamassassin.te	2006-11-16 17:15:21.000000000 -0500
 +++ serefpolicy-2.4.5/policy/modules/services/spamassassin.te	2006-11-17 09:19:51.000000000 -0500
@@ -1509,6 +1564,153 @@
  fs_getattr_all_fs(tftpd_t)
  fs_search_auto_mountpoints(tftpd_t)
  
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uucp.fc serefpolicy-2.4.5/policy/modules/services/uucp.fc
+--- nsaserefpolicy/policy/modules/services/uucp.fc	2006-11-16 17:15:21.000000000 -0500
++++ serefpolicy-2.4.5/policy/modules/services/uucp.fc	2006-11-20 14:24:29.000000000 -0500
+@@ -1,5 +1,6 @@
+ 
+ /usr/sbin/uucico	--	gen_context(system_u:object_r:uucpd_exec_t,s0)
++/usr/bin/uux 		--	gen_context(system_u:object_r:uux_exec_t,s0)
+ 
+ /var/spool/uucp(/.*)?		gen_context(system_u:object_r:uucpd_spool_t,s0)
+ /var/spool/uucppublic(/.*)?	gen_context(system_u:object_r:uucpd_spool_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uucp.if serefpolicy-2.4.5/policy/modules/services/uucp.if
+--- nsaserefpolicy/policy/modules/services/uucp.if	2006-11-16 17:15:21.000000000 -0500
++++ serefpolicy-2.4.5/policy/modules/services/uucp.if	2006-11-20 15:00:02.000000000 -0500
+@@ -1 +1,68 @@
+ ## <summary>Unix to Unix Copy</summary>
++
++########################################
++## <summary>
++##	Execute the master uux program in the
++##	uux_t domain.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`uucp_domtrans_uux',`
++	gen_require(`
++		type uux_t, uux_exec_t;
++	')
++
++	domain_auto_trans($1,uux_exec_t,uux_t)
++
++	allow $1 uux_t:fd use;
++	allow uux_t $1:fd use;
++	allow uux_t $1:fifo_file rw_file_perms;
++	allow uux_t $1:process sigchld;
++')
++
++########################################
++## <summary>
++##	Create, read, write, and delete uucp spool files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`uucp_manage_spool',`
++	gen_require(`
++		type uucpd_spool_t;
++	')
++
++	files_search_spool($1)
++	allow $1 uucpd_spool_t:dir manage_dir_perms;
++	allow $1 uucpd_spool_t:lnk_file create_lnk_perms;
++	allow $1 uucpd_spool_t:file manage_file_perms;
++')
++
++########################################
++## <summary>
++##	Allow the specified domain to append
++##	to uucp log files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`uucp_append_log',`
++	gen_require(`
++		type uucpd_log_t;
++	')
++
++	logging_search_logs($1)
++	allow $1 uucpd_log_t:dir r_dir_perms;
++	allow $1 uucpd_log_t:file { append getattr }
++;
++')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uucp.te serefpolicy-2.4.5/policy/modules/services/uucp.te
+--- nsaserefpolicy/policy/modules/services/uucp.te	2006-11-16 17:15:21.000000000 -0500
++++ serefpolicy-2.4.5/policy/modules/services/uucp.te	2006-11-20 15:01:32.000000000 -0500
+@@ -10,6 +10,12 @@
+ inetd_tcp_service_domain(uucpd_t,uucpd_exec_t)
+ role system_r types uucpd_t;
+ 
++type uux_t;
++type uux_exec_t;
++domain_type(uux_t)
++domain_entry_file(uux_t,uux_exec_t)
++role system_r types uux_t;
++
+ type uucpd_tmp_t;
+ files_tmp_file(uucpd_tmp_t)
+ 
+@@ -51,9 +57,7 @@
+ allow uucpd_t uucpd_rw_t:file create_file_perms;
+ allow uucpd_t uucpd_rw_t:lnk_file create_lnk_perms;
+ 
+-allow uucpd_t uucpd_spool_t:dir create_dir_perms;
+-allow uucpd_t uucpd_spool_t:file create_file_perms;
+-allow uucpd_t uucpd_spool_t:lnk_file create_lnk_perms;
++uucp_manage_spool(uucpd_t)
+ 
+ allow uucpd_t uucpd_tmp_t:dir create_dir_perms;
+ allow uucpd_t uucpd_tmp_t:file create_file_perms;
+@@ -105,3 +109,37 @@
+ optional_policy(`
+ 	nscd_socket_use(uucpd_t)
+ ')
++
++########################################
++#
++# Local policy
++#
++
++allow uux_t self:capability { setuid setgid };
++allow uux_t self:fifo_file { getattr write };
++
++uucp_append_log(uux_t)
++
++uucp_manage_spool(uux_t)
++
++libs_use_ld_so(uux_t)
++libs_use_shared_libs(uux_t)
++
++miscfiles_read_localization(uux_t)
++
++logging_send_syslog_msg(uux_t)
++
++ifdef(`targeted_policy',`
++	term_use_unallocated_ttys(uux_t)
++	term_use_generic_ptys(uux_t)
++')
++
++mta_send_mail(uux_t)
++files_read_etc_files(uux_t)
++
++nscd_socket_use(uux_t)
++corecmd_exec_sbin(uux_t)
++
++corenet_non_ipsec_sendrecv(uux_t)
++
++logging_search_logs(uux_t)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-2.4.5/policy/modules/services/xserver.if
 --- nsaserefpolicy/policy/modules/services/xserver.if	2006-11-16 17:15:21.000000000 -0500
 +++ serefpolicy-2.4.5/policy/modules/services/xserver.if	2006-11-17 09:19:51.000000000 -0500
@@ -1610,12 +1812,23 @@
  #
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/clock.te serefpolicy-2.4.5/policy/modules/system/clock.te
 --- nsaserefpolicy/policy/modules/system/clock.te	2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.4.5/policy/modules/system/clock.te	2006-11-17 09:19:51.000000000 -0500
-@@ -35,6 +35,7 @@
++++ serefpolicy-2.4.5/policy/modules/system/clock.te	2006-11-20 17:59:06.000000000 -0500
+@@ -25,7 +25,7 @@
+ dontaudit hwclock_t self:capability sys_tty_config;
+ allow hwclock_t self:process signal_perms;
+ allow hwclock_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
+-allow hwclock_t self:fifo_file { getattr read };
++allow hwclock_t self:fifo_file { getattr read write };
+ 
+ # Allow hwclock to store & retrieve correction factors.
+ allow hwclock_t adjtime_t:file { rw_file_perms setattr };
+@@ -34,7 +34,8 @@
+ kernel_list_proc(hwclock_t)
  kernel_read_proc_symlinks(hwclock_t)
  
- corecmd_search_bin(hwclock_t)
-+corecmd_read_bin_symlinks(hwclock_t)
+-corecmd_search_bin(hwclock_t)
++corecmd_exec_bin(hwclock_t)
++corecmd_exec_shell(hwclock_t)
  
  dev_read_sysfs(hwclock_t)
  dev_rw_realtime_clock(hwclock_t)
@@ -1742,7 +1955,7 @@
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-2.4.5/policy/modules/system/libraries.fc
 --- nsaserefpolicy/policy/modules/system/libraries.fc	2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.4.5/policy/modules/system/libraries.fc	2006-11-17 09:19:51.000000000 -0500
++++ serefpolicy-2.4.5/policy/modules/system/libraries.fc	2006-11-20 13:26:20.000000000 -0500
 @@ -131,6 +131,7 @@
  /usr/lib/win32/.*			--	gen_context(system_u:object_r:shlib_t,s0)
  
@@ -1777,7 +1990,17 @@
  /usr/lib(64)?/libstdc\+\+\.so\.2\.7\.2\.8 --	gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib(64)?/libg\+\+\.so\.2\.7\.2\.8	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
  /usr/lib(64)?/libglide3\.so.* 		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -258,10 +262,9 @@
+@@ -246,6 +250,9 @@
+ HOME_DIR/.*/plugins/libflashplayer\.so.* --	gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/lib(64)?/.*/libflashplayer\.so.*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
+ /usr/local/(.*/)?libflashplayer\.so.*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
++HOME_DIR/.*/plugins/nprhapengine\.so.* --	gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib(64)?/.*/nprhapengine\.so.*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/local/(.*/)?nprhapengine\.so.*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
+ 
+ # Jai, Sun Microsystems (Jpackage SPRM)
+ /usr/lib(64)?/libmlib_jai\.so		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
+@@ -258,10 +265,9 @@
  /usr/lib(64)?/vmware/(.*/)?VmPerl\.so	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
  
  # Java, Sun Microsystems (JPackage SRPM)
@@ -2343,7 +2566,7 @@
  
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-2.4.5/policy/modules/system/userdomain.if
 --- nsaserefpolicy/policy/modules/system/userdomain.if	2006-11-16 17:15:24.000000000 -0500
-+++ serefpolicy-2.4.5/policy/modules/system/userdomain.if	2006-11-17 09:19:51.000000000 -0500
++++ serefpolicy-2.4.5/policy/modules/system/userdomain.if	2006-11-17 14:07:04.000000000 -0500
 @@ -22,9 +22,9 @@
  ## <rolebase/>
  #
@@ -2462,7 +2685,7 @@
  ')
  
  ########################################
-@@ -5488,3 +5478,182 @@
+@@ -5488,3 +5478,207 @@
  	allow $1 user_home_dir_t:dir create_dir_perms;
  	files_home_filetrans($1,user_home_dir_t,dir)
  ')
@@ -2645,6 +2868,31 @@
 +	allow $1 user_home_t:file execute;
 +')
 +
++
++
++########################################
++## <summary>
++##	Create, read, write, and delete staff
++##	home directories.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`userdom_relabel_staff_home_dirs',`
++	ifdef(`targeted_policy',`
++		userdom_manage_generic_user_home_dirs($1)
++	',`
++		gen_require(`
++			type staff_home_dir_t;
++		')
++
++		files_search_home($1)
++		allow $1 staff_home_dir_t:dir manage_dir_perms;
++	')
++')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-2.4.5/policy/modules/system/userdomain.te
 --- nsaserefpolicy/policy/modules/system/userdomain.te	2006-11-16 17:15:24.000000000 -0500
 +++ serefpolicy-2.4.5/policy/modules/system/userdomain.te	2006-11-17 09:19:51.000000000 -0500


Index: selinux-policy.spec
===================================================================
RCS file: /cvs/dist/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.349
retrieving revision 1.350
diff -u -r1.349 -r1.350
--- selinux-policy.spec	17 Nov 2006 19:20:09 -0000	1.349
+++ selinux-policy.spec	20 Nov 2006 23:01:06 -0000	1.350
@@ -17,7 +17,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 2.4.5
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPL
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -351,6 +351,9 @@
 %endif
 
 %changelog
+* Mon Nov 20 2006 Dan Walsh <dwalsh at redhat.com> 2.4.5-2
+- Fixes for hwclock, clamav, ftp
+
 * Wed Nov 15 2006 Dan Walsh <dwalsh at redhat.com> 2.4.5-1
 - Move to upstream version which accepted my patches
 




More information about the fedora-cvs-commits mailing list