rpms/selinux-policy/devel policy-20070703.patch, 1.71, 1.72 selinux-policy.spec, 1.532, 1.533
Daniel J Walsh (dwalsh)
fedora-extras-commits at redhat.com
Mon Sep 24 20:26:14 UTC 2007
- Previous message (by thread): rpms/opengl-games-utils/devel opengl-game-functions.sh, NONE, 1.1 opengl-game-wrapper.sh, 1.1, 1.2 opengl-games-utils.spec, 1.1, 1.2
- Next message (by thread): rpms/opengl-games-utils/F-7 opengl-game-functions.sh, NONE, 1.1 opengl-game-wrapper.sh, 1.1, 1.2 opengl-games-utils.spec, 1.1, 1.2
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv22928
Modified Files:
policy-20070703.patch selinux-policy.spec
Log Message:
* Mon Sep 24 2007 Dan Walsh <dwalsh at redhat.com> 3.0.8-11
- Fix maxima
policy-20070703.patch:
Index: policy-20070703.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20070703.patch,v
retrieving revision 1.71
retrieving revision 1.72
diff -u -r1.71 -r1.72
--- policy-20070703.patch 24 Sep 2007 14:18:57 -0000 1.71
+++ policy-20070703.patch 24 Sep 2007 20:26:11 -0000 1.72
@@ -5080,20 +5080,29 @@
/var/spool/cups(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh)
+/usr/local/Brother/inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.if serefpolicy-3.0.8/policy/modules/services/cups.if
+--- nsaserefpolicy/policy/modules/services/cups.if 2007-05-29 14:10:57.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/cups.if 2007-09-24 15:01:39.000000000 -0400
+@@ -247,3 +247,4 @@
+ files_search_pids($1)
+ stream_connect_pattern($1,ptal_var_run_t,ptal_var_run_t,ptal_t)
+ ')
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.8/policy/modules/services/cups.te
--- nsaserefpolicy/policy/modules/services/cups.te 2007-09-12 10:34:50.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/cups.te 2007-09-21 09:12:45.000000000 -0400
-@@ -49,9 +49,6 @@
++++ serefpolicy-3.0.8/policy/modules/services/cups.te 2007-09-24 14:34:13.000000000 -0400
+@@ -48,9 +48,7 @@
+ type hplip_t;
type hplip_exec_t;
init_daemon_domain(hplip_t,hplip_exec_t)
-
+-
-type hplip_etc_t;
-files_config_file(hplip_etc_t)
--
++domtrans_pattern(cupsd_t,hplip_exec_t, hplip_t)
+
type hplip_var_run_t;
files_pid_file(hplip_var_run_t)
-
-@@ -81,12 +78,11 @@
+@@ -81,12 +79,11 @@
# /usr/lib/cups/backend/serial needs sys_admin(?!)
allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_resource sys_tty_config };
dontaudit cupsd_t self:capability { sys_tty_config net_admin };
@@ -5107,7 +5116,7 @@
allow cupsd_t self:tcp_socket create_stream_socket_perms;
allow cupsd_t self:udp_socket create_socket_perms;
allow cupsd_t self:appletalk_socket create_socket_perms;
-@@ -105,7 +101,7 @@
+@@ -105,7 +102,7 @@
# allow cups to execute its backend scripts
can_exec(cupsd_t, cupsd_exec_t)
@@ -5116,7 +5125,7 @@
allow cupsd_t cupsd_exec_t:lnk_file read;
manage_files_pattern(cupsd_t,cupsd_log_t,cupsd_log_t)
-@@ -122,13 +118,13 @@
+@@ -122,13 +119,13 @@
manage_sock_files_pattern(cupsd_t,cupsd_var_run_t,cupsd_var_run_t)
files_pid_filetrans(cupsd_t,cupsd_var_run_t,file)
@@ -5132,7 +5141,7 @@
kernel_read_system_state(cupsd_t)
kernel_read_network_state(cupsd_t)
kernel_read_all_sysctls(cupsd_t)
-@@ -150,21 +146,26 @@
+@@ -150,21 +147,26 @@
corenet_tcp_bind_reserved_port(cupsd_t)
corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t)
corenet_tcp_connect_all_ports(cupsd_t)
@@ -5160,7 +5169,7 @@
mls_file_downgrade(cupsd_t)
mls_file_write_all_levels(cupsd_t)
mls_file_read_all_levels(cupsd_t)
-@@ -174,6 +175,7 @@
+@@ -174,6 +176,7 @@
term_search_ptys(cupsd_t)
auth_domtrans_chk_passwd(cupsd_t)
@@ -5168,7 +5177,7 @@
auth_dontaudit_read_pam_pid(cupsd_t)
# Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp
-@@ -187,7 +189,7 @@
+@@ -187,7 +190,7 @@
# read python modules
files_read_usr_files(cupsd_t)
# for /var/lib/defoma
@@ -5177,7 +5186,7 @@
files_list_world_readable(cupsd_t)
files_read_world_readable_files(cupsd_t)
files_read_world_readable_symlinks(cupsd_t)
-@@ -202,6 +204,7 @@
+@@ -202,6 +205,7 @@
files_dontaudit_getattr_all_tmp_files(cupsd_t)
selinux_compute_access_vector(cupsd_t)
@@ -5185,7 +5194,7 @@
init_exec_script_files(cupsd_t)
-@@ -221,17 +224,37 @@
+@@ -221,17 +225,37 @@
sysnet_read_config(cupsd_t)
@@ -5223,7 +5232,7 @@
apm_domtrans_client(cupsd_t)
')
-@@ -263,16 +286,16 @@
+@@ -263,16 +287,16 @@
')
optional_policy(`
@@ -5244,7 +5253,7 @@
seutil_sigchld_newrole(cupsd_t)
')
-@@ -331,6 +354,7 @@
+@@ -331,6 +355,7 @@
dev_read_sysfs(cupsd_config_t)
dev_read_urand(cupsd_config_t)
dev_read_rand(cupsd_config_t)
@@ -5252,7 +5261,7 @@
fs_getattr_all_fs(cupsd_config_t)
fs_search_auto_mountpoints(cupsd_config_t)
-@@ -377,6 +401,14 @@
+@@ -377,6 +402,14 @@
')
optional_policy(`
@@ -5267,7 +5276,7 @@
cron_system_entry(cupsd_config_t, cupsd_config_exec_t)
')
-@@ -526,11 +558,6 @@
+@@ -526,11 +559,6 @@
cups_stream_connect(hplip_t)
@@ -5279,7 +5288,7 @@
manage_files_pattern(hplip_t,hplip_var_run_t,hplip_var_run_t)
files_pid_filetrans(hplip_t,hplip_var_run_t,file)
-@@ -560,7 +587,7 @@
+@@ -560,7 +588,7 @@
dev_read_urand(hplip_t)
dev_read_rand(hplip_t)
dev_rw_generic_usb_dev(hplip_t)
@@ -5288,7 +5297,7 @@
fs_getattr_all_fs(hplip_t)
fs_search_auto_mountpoints(hplip_t)
-@@ -587,8 +614,6 @@
+@@ -587,8 +615,6 @@
userdom_dontaudit_search_sysadm_home_dirs(hplip_t)
userdom_dontaudit_search_all_users_home_content(hplip_t)
@@ -5338,7 +5347,7 @@
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.8/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/dbus.if 2007-09-21 06:44:48.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/dbus.if 2007-09-24 11:08:39.000000000 -0400
@@ -50,6 +50,12 @@
## </param>
#
@@ -6217,9 +6226,31 @@
+ userdom_write_unpriv_users_tmp_files(exim_t)
+}
+
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.if serefpolicy-3.0.8/policy/modules/services/ftp.if
+--- nsaserefpolicy/policy/modules/services/ftp.if 2007-05-29 14:10:57.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/ftp.if 2007-09-24 15:42:55.000000000 -0400
+@@ -28,11 +28,13 @@
+ type ftpd_t;
+ ')
+
+- userdom_manage_user_home_content_files($1,ftpd_t)
+- userdom_manage_user_home_content_symlinks($1,ftpd_t)
+- userdom_manage_user_home_content_sockets($1,ftpd_t)
+- userdom_manage_user_home_content_pipes($1,ftpd_t)
+- userdom_user_home_dir_filetrans_user_home_content($1,ftpd_t,{ dir file lnk_file sock_file fifo_file })
++ tunable_policy(`ftp_home_dir',`
++ userdom_manage_user_home_content_files($1,ftpd_t)
++ userdom_manage_user_home_content_symlinks($1,ftpd_t)
++ userdom_manage_user_home_content_sockets($1,ftpd_t)
++ userdom_manage_user_home_content_pipes($1,ftpd_t)
++ userdom_user_home_dir_filetrans_user_home_content($1,ftpd_t,{ dir file lnk_file sock_file fifo_file })
++ ')
+ ')
+
+ ########################################
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.8/policy/modules/services/ftp.te
--- nsaserefpolicy/policy/modules/services/ftp.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/ftp.te 2007-09-17 16:39:01.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/ftp.te 2007-09-24 15:47:19.000000000 -0400
@@ -88,6 +88,7 @@
allow ftpd_t self:unix_stream_socket create_stream_socket_perms;
allow ftpd_t self:tcp_socket create_stream_socket_perms;
@@ -7133,7 +7164,7 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.8/policy/modules/services/networkmanager.te
--- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-09-12 10:34:50.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/networkmanager.te 2007-09-22 07:14:54.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/networkmanager.te 2007-09-24 11:09:11.000000000 -0400
@@ -13,6 +13,9 @@
type NetworkManager_var_run_t;
files_pid_file(NetworkManager_var_run_t)
@@ -7163,17 +7194,18 @@
kernel_read_system_state(NetworkManager_t)
kernel_read_network_state(NetworkManager_t)
kernel_read_kernel_sysctls(NetworkManager_t)
-@@ -138,6 +144,9 @@
+@@ -138,6 +144,10 @@
dbus_system_bus_client_template(NetworkManager,NetworkManager_t)
dbus_connect_system_bus(NetworkManager_t)
dbus_send_system_bus(NetworkManager_t)
++ dbus_dontaudit_rw_system_selinux_socket(NetworkManager_t)
+ optional_policy(`
+ rpm_dbus_chat(NetworkManager_t)
+ ')
')
optional_policy(`
-@@ -173,8 +182,10 @@
+@@ -173,8 +183,10 @@
')
optional_policy(`
@@ -9795,7 +9827,7 @@
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.8/policy/modules/services/xserver.if
--- nsaserefpolicy/policy/modules/services/xserver.if 2007-07-03 07:06:27.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/xserver.if 2007-09-20 15:27:25.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/xserver.if 2007-09-24 16:08:36.000000000 -0400
@@ -126,6 +126,8 @@
# read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev($1_xserver_t)
@@ -9818,6 +9850,15 @@
term_setattr_unallocated_ttys($1_xserver_t)
term_use_unallocated_ttys($1_xserver_t)
+@@ -251,7 +254,7 @@
+ userdom_user_home_content($1,$1_fonts_cache_t)
+
+ type $1_fonts_config_t, fonts_config_type;
+- userdom_user_home_content($1,$1_fonts_cache_t)
++ userdom_user_home_content($1,$1_fonts_config_t)
+
+ type $1_iceauth_t;
+ domain_type($1_iceauth_t)
@@ -282,6 +285,7 @@
domtrans_pattern($1_xserver_t, xauth_exec_t, $1_xauth_t)
@@ -10387,7 +10428,7 @@
+/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.8/policy/modules/system/authlogin.if
--- nsaserefpolicy/policy/modules/system/authlogin.if 2007-08-22 07:14:13.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/authlogin.if 2007-09-21 19:32:00.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/authlogin.if 2007-09-24 10:44:04.000000000 -0400
@@ -26,7 +26,8 @@
type $1_chkpwd_t, can_read_shadow_passwords;
application_domain($1_chkpwd_t,chkpwd_exec_t)
@@ -10408,17 +10449,18 @@
dontaudit $2 shadow_t:file { getattr read };
# Transition from the user domain to this domain.
-@@ -169,6 +167,9 @@
+@@ -169,6 +167,10 @@
## </param>
#
interface(`auth_login_pgm_domain',`
+ gen_require(`
+ attribute keyring_type;
++ type auth_cache_t;
+ ')
domain_type($1)
domain_subj_id_change_exemption($1)
-@@ -176,11 +177,28 @@
+@@ -176,11 +178,28 @@
domain_obj_id_change_exemption($1)
role system_r types $1;
@@ -10447,7 +10489,7 @@
selinux_get_fs_mount($1)
selinux_validate_context($1)
selinux_compute_access_vector($1)
-@@ -196,22 +214,33 @@
+@@ -196,22 +215,33 @@
mls_fd_share_all_levels($1)
auth_domtrans_chk_passwd($1)
@@ -10482,7 +10524,7 @@
')
')
-@@ -309,9 +338,6 @@
+@@ -309,9 +339,6 @@
type system_chkpwd_t, chkpwd_exec_t, shadow_t;
')
@@ -10492,7 +10534,7 @@
corecmd_search_bin($1)
domtrans_pattern($1,chkpwd_exec_t,system_chkpwd_t)
-@@ -329,6 +355,7 @@
+@@ -329,6 +356,7 @@
optional_policy(`
kerberos_use($1)
@@ -10500,7 +10542,7 @@
')
optional_policy(`
-@@ -347,6 +374,37 @@
+@@ -347,6 +375,37 @@
########################################
## <summary>
@@ -10538,7 +10580,7 @@
## Get the attributes of the shadow passwords file.
## </summary>
## <param name="domain">
-@@ -695,6 +753,24 @@
+@@ -695,6 +754,24 @@
########################################
## <summary>
@@ -10563,7 +10605,7 @@
## Execute pam programs in the PAM domain.
## </summary>
## <param name="domain">
-@@ -1318,14 +1394,9 @@
+@@ -1318,14 +1395,9 @@
## </param>
#
interface(`auth_use_nsswitch',`
@@ -10578,7 +10620,7 @@
files_list_var_lib($1)
miscfiles_read_certs($1)
-@@ -1381,3 +1452,163 @@
+@@ -1381,3 +1453,163 @@
typeattribute $1 can_write_shadow_passwords;
typeattribute $1 can_relabelto_shadow_passwords;
')
@@ -10744,7 +10786,7 @@
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.0.8/policy/modules/system/authlogin.te
--- nsaserefpolicy/policy/modules/system/authlogin.te 2007-08-22 07:14:12.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/authlogin.te 2007-09-22 08:12:19.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/authlogin.te 2007-09-24 12:02:34.000000000 -0400
@@ -9,6 +9,13 @@
attribute can_read_shadow_passwords;
attribute can_write_shadow_passwords;
@@ -10798,7 +10840,15 @@
dev_getattr_scanner_dev(pam_console_t)
dev_setattr_scanner_dev(pam_console_t)
dev_getattr_sound_dev(pam_console_t)
-@@ -236,7 +254,7 @@
+@@ -200,6 +218,7 @@
+
+ fs_list_auto_mountpoints(pam_console_t)
+ fs_list_noxattr_fs(pam_console_t)
++fs_getattr_all_fs(pam_console_t)
+
+ init_use_fds(pam_console_t)
+ init_use_script_ptys(pam_console_t)
+@@ -236,7 +255,7 @@
optional_policy(`
xserver_read_xdm_pid(pam_console_t)
@@ -10807,7 +10857,7 @@
')
########################################
-@@ -302,3 +320,28 @@
+@@ -302,3 +321,28 @@
xserver_use_xdm_fds(utempter_t)
xserver_rw_xdm_pipes(utempter_t)
')
@@ -11017,8 +11067,8 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.8/policy/modules/system/init.if
--- nsaserefpolicy/policy/modules/system/init.if 2007-08-22 07:14:12.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/init.if 2007-09-24 09:49:24.000000000 -0400
-@@ -211,6 +211,20 @@
++++ serefpolicy-3.0.8/policy/modules/system/init.if 2007-09-24 10:08:01.000000000 -0400
+@@ -211,6 +211,21 @@
kernel_dontaudit_use_fds($1)
')
')
@@ -11029,6 +11079,7 @@
+ term_dontaudit_use_all_user_ttys($1)
+ term_dontaudit_use_all_user_ptys($1)
+ ')
++
+ optional_policy(`
+ tunable_policy(`allow_daemons_use_tty',`
+ unconfined_use_terminals($1)
@@ -11039,7 +11090,7 @@
')
########################################
-@@ -540,18 +554,19 @@
+@@ -540,18 +555,19 @@
#
interface(`init_spec_domtrans_script',`
gen_require(`
@@ -11063,7 +11114,7 @@
')
')
-@@ -567,18 +582,46 @@
+@@ -567,18 +583,46 @@
#
interface(`init_domtrans_script',`
gen_require(`
@@ -11114,7 +11165,7 @@
')
')
-@@ -609,11 +652,11 @@
+@@ -609,11 +653,11 @@
# cjp: added for gentoo integrated run_init
interface(`init_script_file_domtrans',`
gen_require(`
@@ -11128,7 +11179,7 @@
')
########################################
-@@ -684,11 +727,11 @@
+@@ -684,11 +728,11 @@
#
interface(`init_getattr_script_files',`
gen_require(`
@@ -11142,7 +11193,7 @@
')
########################################
-@@ -703,11 +746,11 @@
+@@ -703,11 +747,11 @@
#
interface(`init_exec_script_files',`
gen_require(`
@@ -11156,7 +11207,7 @@
')
########################################
-@@ -931,6 +974,7 @@
+@@ -931,6 +975,7 @@
dontaudit $1 initrc_t:unix_stream_socket connectto;
')
@@ -11164,7 +11215,7 @@
########################################
## <summary>
## Send messages to init scripts over dbus.
-@@ -1030,11 +1074,11 @@
+@@ -1030,11 +1075,11 @@
#
interface(`init_read_script_files',`
gen_require(`
@@ -11178,7 +11229,7 @@
')
########################################
-@@ -1252,7 +1296,7 @@
+@@ -1252,7 +1297,7 @@
type initrc_var_run_t;
')
@@ -11187,7 +11238,7 @@
')
########################################
-@@ -1273,3 +1317,64 @@
+@@ -1273,3 +1318,64 @@
files_search_pids($1)
allow $1 initrc_var_run_t:file manage_file_perms;
')
@@ -11433,8 +11484,47 @@
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.8/policy/modules/system/ipsec.te
--- nsaserefpolicy/policy/modules/system/ipsec.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/ipsec.te 2007-09-17 16:20:18.000000000 -0400
-@@ -283,6 +283,7 @@
++++ serefpolicy-3.0.8/policy/modules/system/ipsec.te 2007-09-24 10:16:55.000000000 -0400
+@@ -56,7 +56,6 @@
+ allow ipsec_t self:capability { net_admin dac_override dac_read_search };
+ dontaudit ipsec_t self:capability sys_tty_config;
+ allow ipsec_t self:process signal;
+-allow ipsec_t self:netlink_route_socket r_netlink_socket_perms;
+ allow ipsec_t self:tcp_socket create_stream_socket_perms;
+ allow ipsec_t self:key_socket { create write read setopt };
+ allow ipsec_t self:fifo_file { read getattr };
+@@ -84,6 +83,8 @@
+ allow ipsec_mgmt_t ipsec_t:fifo_file rw_file_perms;
+ allow ipsec_mgmt_t ipsec_t:process sigchld;
+
++auth_use_nsswitch(ipsec_t)
++
+ kernel_read_kernel_sysctls(ipsec_t)
+ kernel_list_proc(ipsec_t)
+ kernel_read_proc_symlinks(ipsec_t)
+@@ -134,16 +135,10 @@
+
+ miscfiles_read_localization(ipsec_t)
+
+-sysnet_read_config(ipsec_t)
+-
+ userdom_dontaudit_use_unpriv_user_fds(ipsec_t)
+ userdom_dontaudit_search_sysadm_home_dirs(ipsec_t)
+
+ optional_policy(`
+- nis_use_ypbind(ipsec_t)
+-')
+-
+-optional_policy(`
+ seutil_sigchld_newrole(ipsec_t)
+ ')
+
+@@ -278,11 +273,11 @@
+ #
+
+ allow racoon_t self:capability { net_admin net_bind_service };
+-allow racoon_t self:netlink_route_socket create_netlink_socket_perms;
+ allow racoon_t self:unix_dgram_socket { connect create ioctl write };
allow racoon_t self:netlink_selinux_socket { bind create read };
allow racoon_t self:udp_socket create_socket_perms;
allow racoon_t self:key_socket { create read setopt write };
@@ -11442,6 +11532,15 @@
# manage pid file
manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t)
+@@ -299,6 +294,8 @@
+
+ allow racoon_t ipsec_spd_t:association setcontext;
+
++auth_use_nsswitch(racoon_t)
++
+ kernel_read_network_state(racoon_t)
+
+ corenet_all_recvfrom_unlabeled(racoon_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.8/policy/modules/system/iptables.te
--- nsaserefpolicy/policy/modules/system/iptables.te 2007-09-12 10:34:51.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/system/iptables.te 2007-09-17 16:20:18.000000000 -0400
@@ -11478,7 +11577,7 @@
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.8/policy/modules/system/libraries.fc
--- nsaserefpolicy/policy/modules/system/libraries.fc 2007-08-02 08:17:28.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/libraries.fc 2007-09-18 10:51:20.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/libraries.fc 2007-09-24 15:26:50.000000000 -0400
@@ -65,11 +65,12 @@
/opt/(.*/)?java/.+\.jar -- gen_context(system_u:object_r:lib_t,s0)
/opt/(.*/)?jre.*/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
@@ -11511,7 +11610,7 @@
/usr/lib(64)?/python2.4/site-packages/M2Crypto/__m2crypto.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
# vmware
-@@ -284,3 +289,8 @@
+@@ -284,3 +289,9 @@
/var/spool/postfix/lib(64)?(/.*)? gen_context(system_u:object_r:lib_t,s0)
/var/spool/postfix/usr(/.*)? gen_context(system_u:object_r:lib_t,s0)
/var/spool/postfix/lib(64)?/ld.*\.so.* -- gen_context(system_u:object_r:ld_so_t,s0)
@@ -11520,6 +11619,7 @@
+
+/var/cache/ldconfig(/.*)? gen_context(system_u:object_r:ldconfig_cache_t,s0)
+/usr/lib/libFLAC\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/lib/maxima/[^/]+/binary-gcl/maxima -- gen_context(system_u:object_r:textrel_shlib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.0.8/policy/modules/system/libraries.te
--- nsaserefpolicy/policy/modules/system/libraries.te 2007-08-02 08:17:28.000000000 -0400
+++ serefpolicy-3.0.8/policy/modules/system/libraries.te 2007-09-19 13:33:20.000000000 -0400
@@ -12208,7 +12308,7 @@
/etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.8/policy/modules/system/lvm.te
--- nsaserefpolicy/policy/modules/system/lvm.te 2007-07-25 10:37:42.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/lvm.te 2007-09-21 15:33:57.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/lvm.te 2007-09-24 15:55:39.000000000 -0400
@@ -44,9 +44,9 @@
# Cluster LVM daemon local policy
#
@@ -12221,7 +12321,23 @@
dontaudit clvmd_t self:process ptrace;
allow clvmd_t self:socket create_socket_perms;
allow clvmd_t self:fifo_file rw_fifo_file_perms;
-@@ -85,6 +85,9 @@
+@@ -54,11 +54,15 @@
+ allow clvmd_t self:tcp_socket create_stream_socket_perms;
+ allow clvmd_t self:udp_socket create_socket_perms;
+
++init_dontaudit_getattr_initctl(clvmd_t)
++
+ manage_files_pattern(clvmd_t,clvmd_var_run_t,clvmd_var_run_t)
+ files_pid_filetrans(clvmd_t,clvmd_var_run_t,file)
+
+ read_files_pattern(clvmd_t,lvm_metadata_t,lvm_metadata_t)
+
++auth_use_nsswitch(clvmd_t)
++
+ kernel_read_kernel_sysctls(clvmd_t)
+ kernel_read_system_state(clvmd_t)
+ kernel_list_proc(clvmd_t)
+@@ -85,10 +89,15 @@
corenet_sendrecv_generic_server_packets(clvmd_t)
dev_read_sysfs(clvmd_t)
@@ -12231,7 +12347,18 @@
dev_manage_generic_chr_files(clvmd_t)
dev_rw_lvm_control(clvmd_t)
dev_dontaudit_getattr_all_blk_files(clvmd_t)
-@@ -102,6 +105,7 @@
+ dev_dontaudit_getattr_all_chr_files(clvmd_t)
++dev_create_generic_dirs(clvmd_t)
++dev_delete_generic_dirs(clvmd_t)
+
+ files_read_etc_files(clvmd_t)
+ files_list_usr(clvmd_t)
+@@ -99,9 +108,12 @@
+ fs_dontaudit_read_removable_files(clvmd_t)
+
+ storage_dontaudit_getattr_removable_dev(clvmd_t)
++storage_dev_filetrans_fixed_disk(clvmd_t)
++storage_manage_fixed_disk(clvmd_t)
domain_use_interactive_fds(clvmd_t)
@@ -12239,17 +12366,30 @@
storage_raw_read_fixed_disk(clvmd_t)
libs_use_ld_so(clvmd_t)
-@@ -113,6 +117,9 @@
+@@ -113,8 +125,9 @@
seutil_dontaudit_search_config(clvmd_t)
seutil_sigchld_newrole(clvmd_t)
+-
+-sysnet_read_config(clvmd_t)
+seutil_read_config(clvmd_t)
+seutil_read_file_contexts(clvmd_t)
+seutil_search_default_contexts(clvmd_t)
- sysnet_read_config(clvmd_t)
+ userdom_dontaudit_use_unpriv_user_fds(clvmd_t)
+ userdom_dontaudit_search_sysadm_home_dirs(clvmd_t)
+@@ -131,10 +144,6 @@
+ ')
-@@ -150,7 +157,8 @@
+ optional_policy(`
+- nis_use_ypbind(clvmd_t)
+-')
+-
+-optional_policy(`
+ ricci_dontaudit_rw_modcluster_pipes(clvmd_t)
+ ricci_dontaudit_use_modcluster_fds(clvmd_t)
+ ')
+@@ -150,7 +159,8 @@
# DAC overrides and mknod for modifying /dev entries (vgmknodes)
# rawio needed for dmraid
@@ -12259,7 +12399,7 @@
dontaudit lvm_t self:capability sys_tty_config;
allow lvm_t self:process { sigchld sigkill sigstop signull signal };
# LVM will complain a lot if it cannot set its priority.
-@@ -208,7 +216,6 @@
+@@ -208,7 +218,6 @@
selinux_compute_user_contexts(lvm_t)
dev_create_generic_chr_files(lvm_t)
@@ -12267,7 +12407,7 @@
dev_read_rand(lvm_t)
dev_read_urand(lvm_t)
dev_rw_lvm_control(lvm_t)
-@@ -228,6 +235,8 @@
+@@ -228,6 +237,8 @@
dev_dontaudit_getattr_generic_blk_files(lvm_t)
dev_dontaudit_getattr_generic_pipes(lvm_t)
dev_create_generic_dirs(lvm_t)
@@ -12276,7 +12416,7 @@
fs_getattr_xattr_fs(lvm_t)
fs_search_auto_mountpoints(lvm_t)
-@@ -246,6 +255,7 @@
+@@ -246,6 +257,7 @@
storage_dev_filetrans_fixed_disk(lvm_t)
# Access raw devices and old /dev/lvm (c 109,0). Is this needed?
storage_manage_fixed_disk(lvm_t)
@@ -12284,7 +12424,15 @@
term_getattr_all_user_ttys(lvm_t)
term_list_ptys(lvm_t)
-@@ -275,6 +285,8 @@
+@@ -254,6 +266,7 @@
+
+ domain_use_interactive_fds(lvm_t)
+
++files_read_usr_files(lvm_t)
+ files_read_etc_files(lvm_t)
+ files_read_etc_runtime_files(lvm_t)
+ # for when /usr is not mounted:
+@@ -275,6 +288,8 @@
seutil_search_default_contexts(lvm_t)
seutil_sigchld_newrole(lvm_t)
@@ -12293,7 +12441,7 @@
ifdef(`distro_redhat',`
# this is from the initrd:
files_rw_isid_type_dirs(lvm_t)
-@@ -293,5 +305,14 @@
+@@ -293,5 +308,14 @@
')
optional_policy(`
@@ -13254,15 +13402,16 @@
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.0.8/policy/modules/system/unconfined.fc
--- nsaserefpolicy/policy/modules/system/unconfined.fc 2007-05-29 14:10:58.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/unconfined.fc 2007-09-21 06:46:14.000000000 -0400
-@@ -10,3 +10,4 @@
++++ serefpolicy-3.0.8/policy/modules/system/unconfined.fc 2007-09-24 15:27:43.000000000 -0400
+@@ -10,3 +10,5 @@
/usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
/usr/local/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
+/usr/bin/rhythmbox -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
++/usr/bin/sbcl -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.8/policy/modules/system/unconfined.if
--- nsaserefpolicy/policy/modules/system/unconfined.if 2007-06-15 14:54:34.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/unconfined.if 2007-09-21 19:31:25.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/unconfined.if 2007-09-24 15:31:00.000000000 -0400
@@ -12,14 +12,13 @@
#
interface(`unconfined_domain_noaudit',`
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.532
retrieving revision 1.533
diff -u -r1.532 -r1.533
--- selinux-policy.spec 24 Sep 2007 14:18:57 -0000 1.532
+++ selinux-policy.spec 24 Sep 2007 20:26:12 -0000 1.533
@@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.0.8
-Release: 10%{?dist}
+Release: 11%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -362,6 +362,9 @@
%endif
%changelog
+* Mon Sep 24 2007 Dan Walsh <dwalsh at redhat.com> 3.0.8-11
+- Fix maxima
+
* Mon Sep 24 2007 Dan Walsh <dwalsh at redhat.com> 3.0.8-10
- Eliminate rpm_t:fifo_file avcs
- Fix dbus path for helper app
- Previous message (by thread): rpms/opengl-games-utils/devel opengl-game-functions.sh, NONE, 1.1 opengl-game-wrapper.sh, 1.1, 1.2 opengl-games-utils.spec, 1.1, 1.2
- Next message (by thread): rpms/opengl-games-utils/F-7 opengl-game-functions.sh, NONE, 1.1 opengl-game-wrapper.sh, 1.1, 1.2 opengl-games-utils.spec, 1.1, 1.2
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the fedora-extras-commits
mailing list