rpms/selinux-policy/devel policy-20071130.patch, 1.19, 1.20 selinux-policy.spec, 1.576, 1.577
Daniel J Walsh (dwalsh)
fedora-extras-commits at redhat.com
Mon Dec 24 12:01:24 UTC 2007
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv2610
Modified Files:
policy-20071130.patch selinux-policy.spec
Log Message:
* Mon Dec 24 2007 Dan Walsh <dwalsh at redhat.com> 3.2.5-6
- Fix role transition fro unconfined_r to system_r when running rpm
policy-20071130.patch:
Index: policy-20071130.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20071130.patch,v
retrieving revision 1.19
retrieving revision 1.20
diff -u -r1.19 -r1.20
--- policy-20071130.patch 21 Dec 2007 07:58:04 -0000 1.19
+++ policy-20071130.patch 24 Dec 2007 12:01:17 -0000 1.20
@@ -925,7 +925,7 @@
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.2.5/policy/modules/admin/rpm.if
--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400
-+++ serefpolicy-3.2.5/policy/modules/admin/rpm.if 2007-12-20 08:55:42.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/admin/rpm.if 2007-12-24 06:06:53.000000000 -0500
@@ -152,6 +152,24 @@
########################################
@@ -1140,10 +1140,10 @@
+## </param>
+interface(`rpm_role_transition',`
+ gen_require(`
-+ type rpm_t;
++ type rpm_exec_t;
+ ')
+
-+ role_transition $1 rpm_t system_r;
++ role_transition $1 rpm_exec_t system_r;
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.2.5/policy/modules/admin/rpm.te
--- nsaserefpolicy/policy/modules/admin/rpm.te 2007-12-19 05:32:18.000000000 -0500
@@ -2066,7 +2066,7 @@
+/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:java_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.2.5/policy/modules/apps/java.if
--- nsaserefpolicy/policy/modules/apps/java.if 2007-10-12 08:56:02.000000000 -0400
-+++ serefpolicy-3.2.5/policy/modules/apps/java.if 2007-12-19 16:29:03.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/apps/java.if 2007-12-22 07:16:08.000000000 -0500
@@ -32,7 +32,7 @@
## </summary>
## </param>
@@ -2076,6 +2076,15 @@
gen_require(`
type java_exec_t;
')
+@@ -57,7 +57,7 @@
+ # Local policy
+ #
+
+- allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem };
++ allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem execstack };
+ allow $1_javaplugin_t self:fifo_file rw_fifo_file_perms;
+ allow $1_javaplugin_t self:tcp_socket create_socket_perms;
+ allow $1_javaplugin_t self:udp_socket create_socket_perms;
@@ -76,13 +76,10 @@
manage_sock_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t)
fs_tmpfs_filetrans($1_javaplugin_t,$1_javaplugin_tmpfs_t,{ file lnk_file sock_file fifo_file })
@@ -2428,7 +2437,7 @@
# /bin
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.2.5/policy/modules/apps/mozilla.if
--- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-10-29 07:52:48.000000000 -0400
-+++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if 2007-12-19 05:38:08.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if 2007-12-24 06:47:25.000000000 -0500
@@ -35,7 +35,10 @@
template(`mozilla_per_role_template',`
gen_require(`
@@ -2491,7 +2500,7 @@
userdom_search_user_home_dirs($1,$1_mozilla_t)
# Mozpluggerrc
-@@ -89,22 +103,44 @@
+@@ -89,22 +103,48 @@
allow $2 $1_mozilla_t:unix_stream_socket connectto;
# X access, Home files
@@ -2531,6 +2540,7 @@
+ userdom_manage_user_tmp_files($1,$1_mozilla_t)
+ userdom_manage_user_tmp_sockets($1,$1_mozilla_t)
+ userdom_tmp_filetrans_user_tmp($1,$1_mozilla_t, { file dir sock_file })
++ userdom_read_user_tmpfs_files($1,$1_mozilla_t)
+
+ ifdef(`enable_mls',`',`
+ fs_search_removable($1_mozilla_t)
@@ -2542,14 +2552,21 @@
+ userdom_manage_user_home_content_dirs($1,$1_mozilla_t)
+ userdom_manage_user_home_content_files($1,$1_mozilla_t)
+ userdom_read_user_home_content_symlinks($1,$1_mozilla_t)
++ userdom_manage_user_home_content_pipes($1,$1_mozilla_t)
++ userdom_user_home_dir_filetrans_user_home_content($1,$1_mozilla_t, { file dir })
+ ', `
+ # helper apps will try to create .files
+ userdom_dontaudit_create_user_home_content_files($1,$1_mozilla_t)
++ userdom_user_home_dir_filetrans($1,$1_mozilla_t, $1_mozilla_home_t,dir)
+ ')
# Unrestricted inheritance from the caller.
allow $2 $1_mozilla_t:process { noatsecure siginh rlimitinh };
-@@ -115,8 +151,9 @@
+@@ -112,11 +152,13 @@
+ ps_process_pattern($2,$1_mozilla_t)
+ allow $2 $1_mozilla_t:process signal_perms;
+
++ kernel_read_fs_sysctls($1_mozilla_t)
kernel_read_kernel_sysctls($1_mozilla_t)
kernel_read_network_state($1_mozilla_t)
# Access /proc, sysctl
@@ -2561,7 +2578,7 @@
# Look for plugins
corecmd_list_bin($1_mozilla_t)
-@@ -165,11 +202,23 @@
+@@ -165,10 +207,23 @@
files_read_var_files($1_mozilla_t)
files_read_var_symlinks($1_mozilla_t)
files_dontaudit_getattr_boot_dirs($1_mozilla_t)
@@ -2579,13 +2596,13 @@
+ fs_manage_dos_dirs($1_mozilla_t)
+ fs_manage_dos_files($1_mozilla_t)
fs_rw_tmpfs_files($1_mozilla_t)
-
-+ selinux_dontaudit_getattr_fs($1_mozilla_t)
++ fs_read_noxattr_fs_files($1_mozilla_t)
+
++ selinux_dontaudit_getattr_fs($1_mozilla_t)
+
term_dontaudit_getattr_pty_dirs($1_mozilla_t)
- libs_use_ld_so($1_mozilla_t)
-@@ -184,12 +233,9 @@
+@@ -184,12 +239,8 @@
sysnet_dns_name_resolve($1_mozilla_t)
sysnet_read_config($1_mozilla_t)
@@ -2597,11 +2614,10 @@
- userdom_manage_user_tmp_sockets($1,$1_mozilla_t)
+ userdom_dontaudit_read_user_tmp_files($1,$1_mozilla_t)
+ userdom_dontaudit_use_user_terminals($1,$1_mozilla_t)
-+ userdom_user_home_dir_filetrans($1,$1_mozilla_t, user_mozilla_home_t,dir)
xserver_user_client_template($1,$1_mozilla_t,$1_mozilla_tmpfs_t)
xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t)
-@@ -211,131 +257,8 @@
+@@ -211,131 +262,8 @@
fs_manage_cifs_symlinks($1_mozilla_t)
')
@@ -2735,7 +2751,7 @@
')
optional_policy(`
-@@ -350,19 +273,26 @@
+@@ -350,19 +278,27 @@
optional_policy(`
cups_read_rw_config($1_mozilla_t)
cups_dbus_chat($1_mozilla_t)
@@ -2746,6 +2762,7 @@
dbus_system_bus_client_template($1_mozilla,$1_mozilla_t)
- dbus_user_bus_client_template($1,$1_mozilla,$1_mozilla_t)
+# dbus_user_bus_client_template($1,$1_mozilla,$1_mozilla_t)
++# dbus_connectto_user_bus($1,$1_mozilla_t)
')
optional_policy(`
@@ -2764,7 +2781,7 @@
')
optional_policy(`
-@@ -382,25 +312,6 @@
+@@ -382,25 +318,6 @@
thunderbird_domtrans_user_thunderbird($1, $1_mozilla_t)
')
@@ -2790,7 +2807,7 @@
')
########################################
-@@ -430,11 +341,11 @@
+@@ -430,11 +347,11 @@
#
template(`mozilla_read_user_home_files',`
gen_require(`
@@ -2805,7 +2822,7 @@
')
########################################
-@@ -464,11 +375,11 @@
+@@ -464,11 +381,11 @@
#
template(`mozilla_write_user_home_files',`
gen_require(`
@@ -2820,7 +2837,7 @@
')
########################################
-@@ -573,3 +484,27 @@
+@@ -573,3 +490,27 @@
allow $2 $1_mozilla_t:tcp_socket rw_socket_perms;
')
@@ -4031,6 +4048,17 @@
neverallow ~{ selinux_unconfined_type can_load_policy } security_t:security load_policy;
neverallow ~{ selinux_unconfined_type can_setenforce } security_t:security setenforce;
neverallow ~{ selinux_unconfined_type can_setsecparam } security_t:security setsecparam;
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.2.5/policy/modules/kernel/storage.fc
+--- nsaserefpolicy/policy/modules/kernel/storage.fc 2007-10-29 18:02:31.000000000 -0400
++++ serefpolicy-3.2.5/policy/modules/kernel/storage.fc 2007-12-21 10:02:13.000000000 -0500
+@@ -13,6 +13,7 @@
+ /dev/cm20.* -b gen_context(system_u:object_r:removable_device_t,s0)
+ /dev/dasd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+ /dev/dm-[0-9]+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
++/dev/drbd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+ /dev/fd[^/]+ -b gen_context(system_u:object_r:removable_device_t,s0)
+ /dev/flash[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+ /dev/gscd -b gen_context(system_u:object_r:removable_device_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.2.5/policy/modules/kernel/terminal.if
--- nsaserefpolicy/policy/modules/kernel/terminal.if 2007-09-12 10:34:17.000000000 -0400
+++ serefpolicy-3.2.5/policy/modules/kernel/terminal.if 2007-12-19 05:38:09.000000000 -0500
@@ -6003,17 +6031,19 @@
-')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.2.5/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500
-+++ serefpolicy-3.2.5/policy/modules/services/dbus.if 2007-12-21 02:47:15.000000000 -0500
-@@ -91,7 +91,7 @@
++++ serefpolicy-3.2.5/policy/modules/services/dbus.if 2007-12-24 06:16:06.000000000 -0500
+@@ -91,7 +91,9 @@
# SE-DBus specific permissions
allow $1_dbusd_$1_t { $1_dbusd_t self }:dbus send_msg;
allow $2 $1_dbusd_t:dbus { send_msg acquire_svc };
- allow $1_t system_dbusd_t:dbus { send_msg acquire_svc };
++ allow $1_dbusd_t $2:dbus send_msg;
++ allow $2 $2:dbus send_msg;
+ allow $2 system_dbusd_t:dbus { send_msg acquire_svc };
allow $1_dbusd_t dbusd_etc_t:dir list_dir_perms;
read_files_pattern($1_dbusd_t,dbusd_etc_t,dbusd_etc_t)
-@@ -104,8 +104,7 @@
+@@ -104,8 +106,7 @@
domtrans_pattern($2, system_dbusd_exec_t, $1_dbusd_t)
allow $2 $1_dbusd_t:process { sigkill signal };
@@ -6023,7 +6053,7 @@
allow $1_dbusd_t $2:process sigkill;
allow $2 $1_dbusd_t:fd use;
allow $2 $1_dbusd_t:fifo_file rw_fifo_file_perms;
-@@ -161,7 +160,9 @@
+@@ -161,7 +162,9 @@
seutil_read_config($1_dbusd_t)
seutil_read_default_contexts($1_dbusd_t)
@@ -6034,7 +6064,7 @@
ifdef(`hide_broken_symptoms', `
dontaudit $2 $1_dbusd_t:netlink_selinux_socket { read write };
-@@ -214,7 +215,7 @@
+@@ -214,7 +217,7 @@
# SE-DBus specific permissions
# allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg;
@@ -6043,7 +6073,7 @@
read_files_pattern($2, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
files_search_var_lib($2)
-@@ -263,6 +264,7 @@
+@@ -263,6 +266,7 @@
# For connecting to the bus
allow $3 $1_dbusd_t:unix_stream_socket connectto;
@@ -6051,7 +6081,67 @@
')
########################################
-@@ -366,3 +368,53 @@
+@@ -292,6 +296,59 @@
+
+ ########################################
+ ## <summary>
++## connectto a message on user/application specific DBUS.
++## </summary>
++## <param name="domain_prefix">
++## <summary>
++## The prefix of the domain (e.g., user
++## is the prefix for user_t).
++## </summary>
++## </param>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++template(`dbus_connectto_user_bus',`
++ gen_require(`
++ type $1_dbusd_t;
++ ')
++
++ allow $2 $1_dbusd_t:unix_stream_socket connectto;
++')
++
++########################################
++## <summary>
++## Chat on user/application specific DBUS.
++## </summary>
++## <param name="domain_prefix">
++## <summary>
++## The prefix of the domain (e.g., user
++## is the prefix for user_t).
++## </summary>
++## </param>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++template(`dbus_chat_user_bus',`
++ gen_require(`
++ type $1_t;
++ type $1_dbusd_t;
++ class dbus send_msg;
++ ')
++
++ allow $2 $1_dbusd_t:dbus send_msg;
++ allow $1_dbusd_t $2:dbus send_msg;
++ allow $2 $1_t:dbus send_msg;
++ allow $1_t $2:dbus send_msg;
++')
++
++########################################
++## <summary>
+ ## Read dbus configuration.
+ ## </summary>
+ ## <param name="domain">
+@@ -366,3 +423,53 @@
allow $1 system_dbusd_t:dbus *;
')
@@ -14420,7 +14510,7 @@
+/root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.2.5/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2007-11-29 13:29:35.000000000 -0500
-+++ serefpolicy-3.2.5/policy/modules/system/userdomain.if 2007-12-20 14:54:51.000000000 -0500
++++ serefpolicy-3.2.5/policy/modules/system/userdomain.if 2007-12-24 06:19:27.000000000 -0500
@@ -29,8 +29,9 @@
')
@@ -15875,7 +15965,50 @@
')
########################################
-@@ -4225,11 +4268,11 @@
+@@ -3248,6 +3291,42 @@
+ ## </summary>
+ ## </param>
+ #
++template(`userdom_read_user_tmpfs_files',`
++ gen_require(`
++ type $1_tmpfs_t;
++ ')
++
++ fs_search_tmpfs($2)
++ allow $2 $1_tmpfs_t:dir list_dir_perms;
++ read_files_pattern($2,$1_tmpfs_t,$1_tmpfs_t)
++ read_lnk_files_pattern($2,$1_tmpfs_t,$1_tmpfs_t)
++')
++
++########################################
++## <summary>
++## Read/write user tmpfs files.
++## </summary>
++## <desc>
++## <p>
++## Read/write user tmpfs files.
++## </p>
++## <p>
++## This is a templated interface, and should only
++## be called from a per-userdomain template.
++## </p>
++## </desc>
++## <param name="userdomain_prefix">
++## <summary>
++## The prefix of the user domain (e.g., user
++## is the prefix for user_t).
++## </summary>
++## </param>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
+ template(`userdom_rw_user_tmpfs_files',`
+ gen_require(`
+ type $1_tmpfs_t;
+@@ -4225,11 +4304,11 @@
#
interface(`userdom_search_staff_home_dirs',`
gen_require(`
@@ -15889,7 +16022,7 @@
')
########################################
-@@ -4245,10 +4288,10 @@
+@@ -4245,10 +4324,10 @@
#
interface(`userdom_dontaudit_search_staff_home_dirs',`
gen_require(`
@@ -15902,7 +16035,7 @@
')
########################################
-@@ -4264,11 +4307,11 @@
+@@ -4264,11 +4343,11 @@
#
interface(`userdom_manage_staff_home_dirs',`
gen_require(`
@@ -15916,7 +16049,7 @@
')
########################################
-@@ -4283,16 +4326,16 @@
+@@ -4283,16 +4362,16 @@
#
interface(`userdom_relabelto_staff_home_dirs',`
gen_require(`
@@ -15936,7 +16069,7 @@
## users home directory.
## </summary>
## <param name="domain">
-@@ -4301,12 +4344,27 @@
+@@ -4301,33 +4380,48 @@
## </summary>
## </param>
#
@@ -15949,29 +16082,40 @@
- dontaudit $1 staff_home_t:file append;
+ dontaudit $1 user_home_t:file append_file_perms;
+ ')
+
+ ########################################
+ ## <summary>
+-## Read files in the staff users home directory.
++## Do not audit attempts to append to the staff
++## users home directory.
+ ## </summary>
+ ## <param name="domain">
+ ## <summary>
+-## Domain allowed access.
++## Domain to not audit.
+ ## </summary>
+ ## </param>
+ #
+-interface(`userdom_read_staff_home_content_files',`
+- gen_require(`
+- type staff_home_dir_t, staff_home_t;
++interface(`userdom_dontaudit_append_staff_home_content_files',`
++ userdom_dontaudit_append_unpriv_home_content_files($1)
+')
+
+########################################
+## <summary>
-+## Do not audit attempts to append to the staff
-+## users home directory.
++## Read files in the staff users home directory.
+## </summary>
+## <param name="domain">
+## <summary>
-+## Domain to not audit.
++## Domain allowed access.
+## </summary>
+## </param>
+#
-+interface(`userdom_dontaudit_append_staff_home_content_files',`
-+ userdom_dontaudit_append_unpriv_home_content_files($1)
- ')
-
- ########################################
-@@ -4321,13 +4379,13 @@
- #
- interface(`userdom_read_staff_home_content_files',`
- gen_require(`
-- type staff_home_dir_t, staff_home_t;
++interface(`userdom_read_staff_home_content_files',`
++ gen_require(`
+ type user_home_dir_t, user_home_t;
')
@@ -15985,7 +16129,7 @@
')
########################################
-@@ -4525,10 +4583,10 @@
+@@ -4525,10 +4619,10 @@
#
interface(`userdom_getattr_sysadm_home_dirs',`
gen_require(`
@@ -15998,7 +16142,7 @@
')
########################################
-@@ -4545,10 +4603,10 @@
+@@ -4545,10 +4639,10 @@
#
interface(`userdom_dontaudit_getattr_sysadm_home_dirs',`
gen_require(`
@@ -16011,7 +16155,7 @@
')
########################################
-@@ -4563,10 +4621,10 @@
+@@ -4563,10 +4657,10 @@
#
interface(`userdom_search_sysadm_home_dirs',`
gen_require(`
@@ -16024,7 +16168,7 @@
')
########################################
-@@ -4582,10 +4640,10 @@
+@@ -4582,10 +4676,10 @@
#
interface(`userdom_dontaudit_search_sysadm_home_dirs',`
gen_require(`
@@ -16037,7 +16181,7 @@
')
########################################
-@@ -4600,10 +4658,10 @@
+@@ -4600,10 +4694,10 @@
#
interface(`userdom_list_sysadm_home_dirs',`
gen_require(`
@@ -16050,7 +16194,7 @@
')
########################################
-@@ -4619,10 +4677,10 @@
+@@ -4619,10 +4713,10 @@
#
interface(`userdom_dontaudit_list_sysadm_home_dirs',`
gen_require(`
@@ -16063,7 +16207,7 @@
')
########################################
-@@ -4638,12 +4696,11 @@
+@@ -4638,12 +4732,11 @@
#
interface(`userdom_dontaudit_read_sysadm_home_content_files',`
gen_require(`
@@ -16079,7 +16223,7 @@
')
########################################
-@@ -4670,10 +4727,10 @@
+@@ -4670,10 +4763,10 @@
#
interface(`userdom_sysadm_home_dir_filetrans',`
gen_require(`
@@ -16092,7 +16236,7 @@
')
########################################
-@@ -4688,10 +4745,10 @@
+@@ -4688,10 +4781,10 @@
#
interface(`userdom_search_sysadm_home_content_dirs',`
gen_require(`
@@ -16105,7 +16249,7 @@
')
########################################
-@@ -4706,13 +4763,13 @@
+@@ -4706,13 +4799,13 @@
#
interface(`userdom_read_sysadm_home_content_files',`
gen_require(`
@@ -16123,101 +16267,19 @@
')
########################################
-@@ -4748,16 +4805,15 @@
+@@ -4748,11 +4841,48 @@
#
interface(`userdom_search_all_users_home_dirs',`
gen_require(`
-- attribute home_dir_type;
+ attribute user_home_dir_type;
- ')
-
- files_list_home($1)
-- allow $1 home_dir_type:dir search_dir_perms;
-+ allow $1 user_home_dir_type:dir search_dir_perms;
- ')
--
- ########################################
- ## <summary>
--## List all users home directories.
-+## Read all users home directories symlinks.
- ## </summary>
- ## <param name="domain">
- ## <summary>
-@@ -4765,18 +4821,18 @@
- ## </summary>
- ## </param>
- #
--interface(`userdom_list_all_users_home_dirs',`
-+interface(`userdom_read_all_users_home_dirs_symlinks',`
- gen_require(`
- attribute home_dir_type;
- ')
-
- files_list_home($1)
-- allow $1 home_dir_type:dir list_dir_perms;
-+ allow $1 home_dir_type:lnk_file read_lnk_file_perms;
- ')
-
- ########################################
- ## <summary>
--## Search all users home directories.
-+## Read all users home directories symlinks.
- ## </summary>
- ## <param name="domain">
- ## <summary>
-@@ -4784,33 +4840,79 @@
- ## </summary>
- ## </param>
- #
--interface(`userdom_search_all_users_home_content',`
-+interface(`userdom_read_all_users_home_content_symlinks',`
- gen_require(`
-- attribute home_dir_type, home_type;
-+ type user_home_t;
- ')
-
- files_list_home($1)
-- allow $1 { home_dir_type home_type }:dir search_dir_perms;
-+ allow $1 user_home_t:lnk_file read_lnk_file_perms;
- ')
-
- ########################################
- ## <summary>
--## Do not audit attempts to search all users home directories.
-+## List all users home directories.
- ## </summary>
- ## <param name="domain">
- ## <summary>
--## Domain to not audit.
-+## Domain allowed access.
- ## </summary>
- ## </param>
- #
--interface(`userdom_dontaudit_search_all_users_home_content',`
-+interface(`userdom_list_all_users_home_dirs',`
- gen_require(`
-- attribute home_dir_type, home_type;
-+ attribute home_dir_type;
- ')
-
-- dontaudit $1 { home_dir_type home_type }:dir search_dir_perms;
--')
--
-+ files_list_home($1)
-+ allow $1 home_dir_type:dir list_dir_perms;
-+
-+ tunable_policy(`use_nfs_home_dirs',`
-+ fs_list_nfs(crond_t)
+ ')
+
-+ tunable_policy(`use_samba_home_dirs',`
-+ fs_list_cifs(crond_t)
-+ ')
++ files_list_home($1)
++ allow $1 user_home_dir_type:dir search_dir_perms;
+')
-+
+########################################
+## <summary>
-+## Search all users home directories.
++## Read all users home directories symlinks.
+## </summary>
+## <param name="domain">
+## <summary>
@@ -16225,37 +16287,52 @@
+## </summary>
+## </param>
+#
-+interface(`userdom_search_all_users_home_content',`
++interface(`userdom_read_all_users_home_dirs_symlinks',`
+ gen_require(`
-+ attribute home_dir_type, home_type;
-+ ')
-+
-+ files_list_home($1)
-+ allow $1 { home_dir_type home_type }:dir search_dir_perms;
+ attribute home_dir_type;
+ ')
+
+ files_list_home($1)
+- allow $1 home_dir_type:dir search_dir_perms;
++ allow $1 home_dir_type:lnk_file read_lnk_file_perms;
+')
+
+########################################
+## <summary>
-+## Do not audit attempts to search all users home directories.
++## Read all users home directories symlinks.
+## </summary>
+## <param name="domain">
+## <summary>
-+## Domain to not audit.
++## Domain allowed access.
+## </summary>
+## </param>
+#
-+interface(`userdom_dontaudit_search_all_users_home_content',`
++interface(`userdom_read_all_users_home_content_symlinks',`
+ gen_require(`
-+ attribute home_dir_type, home_type;
++ type user_home_t;
+ ')
+
-+ dontaudit $1 { home_dir_type home_type }:dir search_dir_perms;
-+')
++ files_list_home($1)
++ allow $1 user_home_t:lnk_file read_lnk_file_perms;
+ ')
+
+ ########################################
+@@ -4772,6 +4902,14 @@
+
+ files_list_home($1)
+ allow $1 home_dir_type:dir list_dir_perms;
+
++ tunable_policy(`use_nfs_home_dirs',`
++ fs_list_nfs(crond_t)
++ ')
++
++ tunable_policy(`use_samba_home_dirs',`
++ fs_list_cifs(crond_t)
++ ')
+ ')
+
########################################
- ## <summary>
- ## Read all files in all users home directories.
-@@ -5109,7 +5211,7 @@
+@@ -5109,7 +5247,7 @@
#
interface(`userdom_relabelto_generic_user_home_dirs',`
gen_require(`
@@ -16264,7 +16341,7 @@
')
files_search_home($1)
-@@ -5298,6 +5400,49 @@
+@@ -5298,6 +5436,49 @@
########################################
## <summary>
@@ -16314,7 +16391,7 @@
## Create, read, write, and delete directories in
## unprivileged users home directories.
## </summary>
-@@ -5503,6 +5648,24 @@
+@@ -5503,6 +5684,24 @@
########################################
## <summary>
@@ -16339,7 +16416,7 @@
## Read and write unprivileged user ttys.
## </summary>
## <param name="domain">
-@@ -5668,6 +5831,42 @@
+@@ -5668,6 +5867,42 @@
########################################
## <summary>
@@ -16382,7 +16459,7 @@
## Send a dbus message to all user domains.
## </summary>
## <param name="domain">
-@@ -5698,3 +5897,277 @@
+@@ -5698,3 +5933,277 @@
interface(`userdom_unconfined',`
refpolicywarn(`$0($*) has been deprecated.')
')
@@ -17157,8 +17234,8 @@
+## <summary>Policy for guest user</summary>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.2.5/policy/modules/users/guest.te
--- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.2.5/policy/modules/users/guest.te 2007-12-19 16:37:00.000000000 -0500
-@@ -0,0 +1,12 @@
++++ serefpolicy-3.2.5/policy/modules/users/guest.te 2007-12-22 07:19:26.000000000 -0500
+@@ -0,0 +1,21 @@
+policy_module(guest,1.0.1)
+userdom_restricted_user_template(guest)
+
@@ -17171,6 +17248,15 @@
+')
+
+userdom_restricted_user_template(gadmin)
++
++optional_policy(`
++ gen_require(`
++ type xguest_mozilla_t;
++ ')
++
++ dbus_chat_user_bus(xguest,xguest_mozilla_t)
++ dbus_connectto_user_bus(xguest,xguest_mozilla_t)
++')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.2.5/policy/modules/users/logadm.fc
--- nsaserefpolicy/policy/modules/users/logadm.fc 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/users/logadm.fc 2007-12-19 05:38:09.000000000 -0500
@@ -17365,7 +17451,7 @@
+define(`manage_key_perms', `{ create link read search setattr view write } ')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.2.5/policy/users
--- nsaserefpolicy/policy/users 2007-10-12 08:56:09.000000000 -0400
-+++ serefpolicy-3.2.5/policy/users 2007-12-19 05:38:09.000000000 -0500
++++ serefpolicy-3.2.5/policy/users 2007-12-21 12:52:51.000000000 -0500
@@ -16,7 +16,7 @@
# and a user process should never be assigned the system user
# identity.
@@ -17399,7 +17485,7 @@
-',`
- gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
-')
-+gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)
++gen_user(root, unconfined, unconfined_r sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.2.5/Rules.modular
--- nsaserefpolicy/Rules.modular 2007-12-19 05:32:18.000000000 -0500
+++ serefpolicy-3.2.5/Rules.modular 2007-12-19 05:38:09.000000000 -0500
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.576
retrieving revision 1.577
diff -u -r1.576 -r1.577
--- selinux-policy.spec 21 Dec 2007 07:58:04 -0000 1.576
+++ selinux-policy.spec 24 Dec 2007 12:01:17 -0000 1.577
@@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.2.5
-Release: 4%{?dist}
+Release: 5%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -386,6 +386,12 @@
%endif
%changelog
+* Mon Dec 24 2007 Dan Walsh <dwalsh at redhat.com> 3.2.5-6
+- Fix role transition fro unconfined_r to system_r when running rpm
+
+* Sat Dec 21 2007 Dan Walsh <dwalsh at redhat.com> 3.2.5-5
+- Fixes for xguest
+
* Thu Dec 20 2007 Dan Walsh <dwalsh at redhat.com> 3.2.5-4
- Let all uncofined domains communicate with dbus unconfined
More information about the fedora-extras-commits
mailing list