rpms/selinux-policy/F-8 policy-20070703.patch, 1.219, 1.220 selinux-policy.spec, 1.639, 1.640
Daniel J Walsh (dwalsh)
fedora-extras-commits at redhat.com
Tue Aug 5 13:12:28 UTC 2008
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/F-8
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv21502
Modified Files:
policy-20070703.patch selinux-policy.spec
Log Message:
* Tue Aug 5 2008 Dan Walsh <dwalsh at redhat.com> 3.0.8-113
- dontaudit semanage config_tty
- Allow samba to share fusefs
policy-20070703.patch:
Index: policy-20070703.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-8/policy-20070703.patch,v
retrieving revision 1.219
retrieving revision 1.220
diff -u -r1.219 -r1.220
--- policy-20070703.patch 1 Aug 2008 16:18:19 -0000 1.219
+++ policy-20070703.patch 5 Aug 2008 13:11:58 -0000 1.220
@@ -16022,8 +16022,22 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.0.8/policy/modules/services/samba.te
--- nsaserefpolicy/policy/modules/services/samba.te 2008-06-12 23:37:57.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/samba.te 2008-07-29 15:52:14.000000000 -0400
-@@ -137,6 +137,11 @@
++++ serefpolicy-3.0.8/policy/modules/services/samba.te 2008-08-04 14:39:08.000000000 -0400
+@@ -57,6 +57,13 @@
+ ## </desc>
+ gen_tunable(samba_share_nfs,false)
+
++## <desc>
++## <p>
++## Allow samba to export ntfs/fusefs volumes.
++## </p>
++## </desc>
++gen_tunable(samba_share_fusefs,false)
++
+ type nmbd_t;
+ type nmbd_exec_t;
+ init_daemon_domain(nmbd_t,nmbd_exec_t)
+@@ -137,6 +144,11 @@
type winbind_var_run_t;
files_pid_file(winbind_var_run_t)
@@ -16035,7 +16049,7 @@
########################################
#
# Samba net local policy
-@@ -146,7 +151,6 @@
+@@ -146,7 +158,6 @@
allow samba_net_t self:unix_stream_socket create_stream_socket_perms;
allow samba_net_t self:udp_socket create_socket_perms;
allow samba_net_t self:tcp_socket create_socket_perms;
@@ -16043,16 +16057,16 @@
allow samba_net_t samba_etc_t:file read_file_perms;
-@@ -161,6 +165,8 @@
- manage_files_pattern(samba_net_t,samba_var_t,samba_var_t)
- manage_lnk_files_pattern(samba_net_t,samba_var_t,samba_var_t)
+@@ -183,6 +194,8 @@
+
+ files_read_etc_files(samba_net_t)
+auth_use_nsswitch(samba_net_t)
+
- kernel_read_proc_symlinks(samba_net_t)
+ libs_use_ld_so(samba_net_t)
+ libs_use_shared_libs(samba_net_t)
- corenet_all_recvfrom_unlabeled(samba_net_t)
-@@ -190,24 +196,20 @@
+@@ -190,24 +203,20 @@
miscfiles_read_localization(samba_net_t)
@@ -16080,7 +16094,7 @@
dontaudit smbd_t self:capability sys_tty_config;
allow smbd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow smbd_t self:process setrlimit;
-@@ -217,19 +219,16 @@
+@@ -217,19 +226,16 @@
allow smbd_t self:msgq create_msgq_perms;
allow smbd_t self:sem create_sem_perms;
allow smbd_t self:shm create_shm_perms;
@@ -16103,7 +16117,7 @@
allow smbd_t samba_net_tmp_t:file getattr;
-@@ -239,6 +238,7 @@
+@@ -239,6 +245,7 @@
manage_dirs_pattern(smbd_t,samba_share_t,samba_share_t)
manage_files_pattern(smbd_t,samba_share_t,samba_share_t)
manage_lnk_files_pattern(smbd_t,samba_share_t,samba_share_t)
@@ -16111,7 +16125,7 @@
manage_dirs_pattern(smbd_t,samba_var_t,samba_var_t)
manage_files_pattern(smbd_t,samba_var_t,samba_var_t)
-@@ -256,7 +256,7 @@
+@@ -256,7 +263,7 @@
manage_sock_files_pattern(smbd_t,smbd_var_run_t,smbd_var_run_t)
files_pid_filetrans(smbd_t,smbd_var_run_t,file)
@@ -16120,7 +16134,7 @@
kernel_getattr_core_if(smbd_t)
kernel_getattr_message_if(smbd_t)
-@@ -292,12 +292,13 @@
+@@ -292,12 +299,13 @@
fs_getattr_all_fs(smbd_t)
fs_get_xattr_fs_quotas(smbd_t)
@@ -16136,7 +16150,7 @@
domain_use_interactive_fds(smbd_t)
domain_dontaudit_list_all_domains_state(smbd_t)
-@@ -321,12 +322,12 @@
+@@ -321,12 +329,12 @@
miscfiles_read_localization(smbd_t)
miscfiles_read_public_files(smbd_t)
@@ -16151,7 +16165,7 @@
ifdef(`hide_broken_symptoms', `
files_dontaudit_getattr_default_dirs(smbd_t)
files_dontaudit_getattr_boot_dirs(smbd_t)
-@@ -347,6 +348,17 @@
+@@ -347,6 +355,25 @@
tunable_policy(`samba_share_nfs',`
fs_manage_nfs_dirs(smbd_t)
fs_manage_nfs_files(smbd_t)
@@ -16160,6 +16174,14 @@
+ fs_manage_nfs_named_sockets(smbd_t)
+')
+
++# Support Samba sharing of ntfs/fusefs mount points
++tunable_policy(`samba_share_fusefs',`
++ fs_manage_fusefs_dirs(smbd_t)
++ fs_manage_fusefs_files(smbd_t)
++', `
++ fs_search_fusefs_dirs(smbd_t)
++')
++
+optional_policy(`
+ kerberos_read_keytab(smbd_t)
+')
@@ -16169,7 +16191,7 @@
')
optional_policy(`
-@@ -398,7 +410,7 @@
+@@ -398,7 +425,7 @@
allow nmbd_t self:msgq create_msgq_perms;
allow nmbd_t self:sem create_sem_perms;
allow nmbd_t self:shm create_shm_perms;
@@ -16178,7 +16200,7 @@
allow nmbd_t self:tcp_socket create_stream_socket_perms;
allow nmbd_t self:udp_socket create_socket_perms;
allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto };
-@@ -410,8 +422,7 @@
+@@ -410,8 +437,7 @@
read_files_pattern(nmbd_t,samba_etc_t,samba_etc_t)
manage_dirs_pattern(nmbd_t,samba_log_t,samba_log_t)
@@ -16188,7 +16210,7 @@
read_files_pattern(nmbd_t,samba_log_t,samba_log_t)
create_files_pattern(nmbd_t,samba_log_t,samba_log_t)
-@@ -421,6 +432,8 @@
+@@ -421,6 +447,8 @@
allow nmbd_t smbd_var_run_t:dir rw_dir_perms;
@@ -16197,7 +16219,7 @@
kernel_getattr_core_if(nmbd_t)
kernel_getattr_message_if(nmbd_t)
kernel_read_kernel_sysctls(nmbd_t)
-@@ -446,6 +459,7 @@
+@@ -446,6 +474,7 @@
dev_getattr_mtrr_dev(nmbd_t)
fs_getattr_all_fs(nmbd_t)
@@ -16205,7 +16227,7 @@
fs_search_auto_mountpoints(nmbd_t)
domain_use_interactive_fds(nmbd_t)
-@@ -462,17 +476,11 @@
+@@ -462,17 +491,11 @@
miscfiles_read_localization(nmbd_t)
@@ -16223,7 +16245,7 @@
seutil_sigchld_newrole(nmbd_t)
')
-@@ -506,6 +514,8 @@
+@@ -506,6 +529,8 @@
manage_lnk_files_pattern(smbmount_t,samba_var_t,samba_var_t)
files_list_var_lib(smbmount_t)
@@ -16232,7 +16254,7 @@
kernel_read_system_state(smbmount_t)
corenet_all_recvfrom_unlabeled(smbmount_t)
-@@ -533,6 +543,7 @@
+@@ -533,6 +558,7 @@
storage_raw_write_fixed_disk(smbmount_t)
term_list_ptys(smbmount_t)
@@ -16240,7 +16262,7 @@
corecmd_list_bin(smbmount_t)
-@@ -553,16 +564,11 @@
+@@ -553,16 +579,11 @@
logging_search_logs(smbmount_t)
@@ -16259,7 +16281,7 @@
')
########################################
-@@ -570,24 +576,28 @@
+@@ -570,24 +591,28 @@
# SWAT Local policy
#
@@ -16296,7 +16318,7 @@
allow swat_t smbd_var_run_t:file read;
manage_dirs_pattern(swat_t,swat_tmp_t,swat_tmp_t)
-@@ -597,7 +607,11 @@
+@@ -597,7 +622,11 @@
manage_files_pattern(swat_t,swat_var_run_t,swat_var_run_t)
files_pid_filetrans(swat_t,swat_var_run_t,file)
@@ -16309,7 +16331,7 @@
kernel_read_kernel_sysctls(swat_t)
kernel_read_system_state(swat_t)
-@@ -622,23 +636,24 @@
+@@ -622,23 +651,25 @@
dev_read_urand(swat_t)
@@ -16318,6 +16340,7 @@
files_search_home(swat_t)
files_read_usr_files(swat_t)
fs_getattr_xattr_fs(swat_t)
++fs_list_inotifyfs(swat_t)
auth_domtrans_chk_passwd(swat_t)
+auth_domtrans_upd_passwd(swat_t)
@@ -16336,7 +16359,7 @@
optional_policy(`
cups_read_rw_config(swat_t)
cups_stream_connect(swat_t)
-@@ -652,13 +667,16 @@
+@@ -652,13 +683,16 @@
kerberos_use(swat_t)
')
@@ -16359,7 +16382,7 @@
########################################
#
-@@ -672,7 +690,6 @@
+@@ -672,7 +706,6 @@
allow winbind_t self:fifo_file { read write };
allow winbind_t self:unix_dgram_socket create_socket_perms;
allow winbind_t self:unix_stream_socket create_stream_socket_perms;
@@ -16367,7 +16390,7 @@
allow winbind_t self:tcp_socket create_stream_socket_perms;
allow winbind_t self:udp_socket create_socket_perms;
-@@ -709,6 +726,8 @@
+@@ -709,6 +742,8 @@
manage_sock_files_pattern(winbind_t,winbind_var_run_t,winbind_var_run_t)
files_pid_filetrans(winbind_t,winbind_var_run_t,file)
@@ -16376,7 +16399,7 @@
kernel_read_kernel_sysctls(winbind_t)
kernel_list_proc(winbind_t)
kernel_read_proc_symlinks(winbind_t)
-@@ -733,7 +752,9 @@
+@@ -733,7 +768,9 @@
fs_getattr_all_fs(winbind_t)
fs_search_auto_mountpoints(winbind_t)
@@ -16386,7 +16409,7 @@
domain_use_interactive_fds(winbind_t)
-@@ -746,9 +767,6 @@
+@@ -746,9 +783,6 @@
miscfiles_read_localization(winbind_t)
@@ -16396,7 +16419,7 @@
userdom_dontaudit_use_unpriv_user_fds(winbind_t)
userdom_dontaudit_search_sysadm_home_dirs(winbind_t)
userdom_priveleged_home_dir_manager(winbind_t)
-@@ -758,10 +776,6 @@
+@@ -758,10 +792,6 @@
')
optional_policy(`
@@ -16407,7 +16430,7 @@
seutil_sigchld_newrole(winbind_t)
')
-@@ -784,6 +798,8 @@
+@@ -784,6 +814,8 @@
allow winbind_helper_t samba_var_t:dir search;
files_list_var_lib(winbind_helper_t)
@@ -16416,7 +16439,7 @@
stream_connect_pattern(winbind_helper_t,winbind_var_run_t,winbind_var_run_t,winbind_t)
term_list_ptys(winbind_helper_t)
-@@ -798,12 +814,13 @@
+@@ -798,12 +830,13 @@
miscfiles_read_localization(winbind_helper_t)
optional_policy(`
@@ -16431,7 +16454,7 @@
')
########################################
-@@ -812,6 +829,13 @@
+@@ -812,6 +845,13 @@
#
optional_policy(`
@@ -16445,7 +16468,7 @@
type samba_unconfined_script_t;
type samba_unconfined_script_exec_t;
domain_type(samba_unconfined_script_t)
-@@ -828,3 +852,37 @@
+@@ -828,3 +868,37 @@
domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t)
')
')
@@ -22000,7 +22023,7 @@
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.0.8/policy/modules/system/selinuxutil.if
--- nsaserefpolicy/policy/modules/system/selinuxutil.if 2008-06-12 23:37:57.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.if 2008-06-12 23:37:59.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.if 2008-08-05 09:08:00.000000000 -0400
@@ -585,7 +585,7 @@
type selinux_config_t;
')
@@ -22132,7 +22155,7 @@
## Full management of the semanage
## module store.
## </summary>
-@@ -1058,3 +1134,141 @@
+@@ -1058,3 +1134,142 @@
files_search_etc($1)
rw_files_pattern($1,selinux_config_t,semanage_trans_lock_t)
')
@@ -22210,6 +22233,7 @@
+ type policy_config_t;
+ ')
+ allow $1 self:capability { dac_override audit_write sys_resource };
++ dontaudit $1 self:capability sys_tty_config;
+ allow $1 self:process signal;
+ allow $1 self:unix_stream_socket create_stream_socket_perms;
+ allow $1 self:unix_dgram_socket create_socket_perms;
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-8/selinux-policy.spec,v
retrieving revision 1.639
retrieving revision 1.640
diff -u -r1.639 -r1.640
--- selinux-policy.spec 1 Aug 2008 16:18:19 -0000 1.639
+++ selinux-policy.spec 5 Aug 2008 13:11:58 -0000 1.640
@@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.0.8
-Release: 112%{?dist}
+Release: 113%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -381,6 +381,10 @@
%endif
%changelog
+* Tue Aug 5 2008 Dan Walsh <dwalsh at redhat.com> 3.0.8-113
+- dontaudit semanage config_tty
+- Allow samba to share fusefs
+
* Thu Jul 24 2008 Dan Walsh <dwalsh at redhat.com> 3.0.8-112
- Change dhclient to be able to red networkmanager_var_run
More information about the fedora-extras-commits
mailing list