rpms/selinux-policy/devel modules-targeted.conf, 1.85, 1.86 policy-20071130.patch, 1.133, 1.134 selinux-policy.spec, 1.659, 1.660
Daniel J Walsh (dwalsh)
fedora-extras-commits at redhat.com
Tue May 6 17:02:18 UTC 2008
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv21541
Modified Files:
modules-targeted.conf policy-20071130.patch
selinux-policy.spec
Log Message:
* Wed Apr 30 2008 Dan Walsh <dwalsh at redhat.com> 3.3.1-45
- Remove dmesg boolean
- Allow user domains to read/write game data
Index: modules-targeted.conf
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/modules-targeted.conf,v
retrieving revision 1.85
retrieving revision 1.86
diff -u -r1.85 -r1.86
--- modules-targeted.conf 14 Mar 2008 00:24:59 -0000 1.85
+++ modules-targeted.conf 6 May 2008 17:01:42 -0000 1.86
@@ -1648,3 +1648,10 @@
#
openoffice = base
+# Layer: services
+# Module: podsleuth
+#
+# Podsleuth probes, identifies, and exposes properties and metadata bound to iPods.
+#
+podsleuth = module
+
policy-20071130.patch:
Index: policy-20071130.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20071130.patch,v
retrieving revision 1.133
retrieving revision 1.134
diff -u -r1.133 -r1.134
--- policy-20071130.patch 29 Apr 2008 16:05:10 -0000 1.133
+++ policy-20071130.patch 6 May 2008 17:01:42 -0000 1.134
@@ -3117,7 +3117,7 @@
nscd_socket_use($1_evolution_webcal_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.if serefpolicy-3.3.1/policy/modules/apps/games.if
--- nsaserefpolicy/policy/modules/apps/games.if 2007-10-12 08:56:02.000000000 -0400
-+++ serefpolicy-3.3.1/policy/modules/apps/games.if 2008-04-21 11:02:48.000000000 -0400
++++ serefpolicy-3.3.1/policy/modules/apps/games.if 2008-04-30 13:16:27.000000000 -0400
@@ -146,7 +146,7 @@
')
@@ -3127,6 +3127,30 @@
xserver_create_xdm_tmp_sockets($1_games_t)
xserver_read_xdm_lib_files($1_games_t)
')
+@@ -165,3 +165,23 @@
+ ')
+ ')
+ ')
++
++########################################
++## <summary>
++## Allow the specified domain to read/write
++## games data.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`games_rw_data',`
++ gen_require(`
++ type games_data_t;
++ ')
++
++ rw_files_pattern($1,games_data_t, games_data_t)
++')
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gift.fc serefpolicy-3.3.1/policy/modules/apps/gift.fc
--- nsaserefpolicy/policy/modules/apps/gift.fc 2007-10-12 08:56:02.000000000 -0400
+++ serefpolicy-3.3.1/policy/modules/apps/gift.fc 2008-04-21 11:02:48.000000000 -0400
@@ -3239,7 +3263,7 @@
/usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.3.1/policy/modules/apps/gnome.if
--- nsaserefpolicy/policy/modules/apps/gnome.if 2007-07-23 10:20:12.000000000 -0400
-+++ serefpolicy-3.3.1/policy/modules/apps/gnome.if 2008-04-29 09:37:23.004992000 -0400
++++ serefpolicy-3.3.1/policy/modules/apps/gnome.if 2008-04-29 09:37:23.000000000 -0400
@@ -33,9 +33,60 @@
## </param>
#
@@ -4522,8 +4546,8 @@
+userdom_dontaudit_list_sysadm_home_dirs(loadkeys_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.3.1/policy/modules/apps/mono.if
--- nsaserefpolicy/policy/modules/apps/mono.if 2007-01-02 12:57:22.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/apps/mono.if 2008-04-29 11:57:14.653875000 -0400
-@@ -18,3 +18,102 @@
++++ serefpolicy-3.3.1/policy/modules/apps/mono.if 2008-05-06 11:03:56.500459000 -0400
+@@ -18,3 +18,122 @@
corecmd_search_bin($1)
domtrans_pattern($1, mono_exec_t, mono_t)
')
@@ -4626,6 +4650,26 @@
+ fs_dontaudit_rw_tmpfs_files($1_mono_t)
+ corecmd_bin_domtrans($1_mono_t, $1_t)
+')
++
++########################################
++## <summary>
++## Execute the mono program in the mono domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`mono_exec',`
++ gen_require(`
++ type mono_exec_t;
++ ')
++
++ corecmd_search_bin($1)
++ can_exec($1, mono_exec_t)
++')
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.3.1/policy/modules/apps/mono.te
--- nsaserefpolicy/policy/modules/apps/mono.te 2007-12-19 05:32:09.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/apps/mono.te 2008-04-21 11:02:48.000000000 -0400
@@ -8881,7 +8925,7 @@
+/etc/rc\.d/init\.d/httpd -- gen_context(system_u:object_r:httpd_script_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.3.1/policy/modules/services/apache.if
--- nsaserefpolicy/policy/modules/services/apache.if 2007-10-23 17:17:42.000000000 -0400
-+++ serefpolicy-3.3.1/policy/modules/services/apache.if 2008-04-21 11:02:48.000000000 -0400
++++ serefpolicy-3.3.1/policy/modules/services/apache.if 2008-04-30 13:15:30.000000000 -0400
@@ -13,21 +13,16 @@
#
template(`apache_content_template',`
@@ -13212,7 +13256,7 @@
/var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.3.1/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2007-12-04 11:02:50.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/services/dbus.if 2008-04-29 10:45:04.731105000 -0400
++++ serefpolicy-3.3.1/policy/modules/services/dbus.if 2008-04-29 10:45:04.000000000 -0400
@@ -53,6 +53,7 @@
gen_require(`
type system_dbusd_exec_t, system_dbusd_t, dbusd_etc_t;
@@ -18871,6 +18915,120 @@
rpm_exec(pegasus_t)
')
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/podsleuth.fc serefpolicy-3.3.1/policy/modules/services/podsleuth.fc
+--- nsaserefpolicy/policy/modules/services/podsleuth.fc 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.3.1/policy/modules/services/podsleuth.fc 2008-05-06 10:38:33.000000000 -0400
+@@ -0,0 +1,2 @@
++
++/usr/bin/podsleuth -- gen_context(system_u:object_r:podsleuth_exec_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/podsleuth.if serefpolicy-3.3.1/policy/modules/services/podsleuth.if
+--- nsaserefpolicy/policy/modules/services/podsleuth.if 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.3.1/policy/modules/services/podsleuth.if 2008-05-06 10:38:33.000000000 -0400
+@@ -0,0 +1,54 @@
++
++## <summary>policy for podsleuth</summary>
++
++########################################
++## <summary>
++## Execute a domain transition to run podsleuth.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`podsleuth_domtrans',`
++ gen_require(`
++ type podsleuth_t;
++ type podsleuth_exec_t;
++ ')
++
++ domtrans_pattern($1,podsleuth_exec_t,podsleuth_t)
++')
++
++
++########################################
++## <summary>
++## Execute podsleuth in the podsleuth domain, and
++## allow the specified role the podsleuth domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access
++## </summary>
++## </param>
++## <param name="role">
++## <summary>
++## The role to be allowed the podsleuth domain.
++## </summary>
++## </param>
++## <param name="terminal">
++## <summary>
++## The type of the role's terminal.
++## </summary>
++## </param>
++#
++interface(`podsleuth_run',`
++ gen_require(`
++ type podsleuth_t;
++ ')
++
++ podsleuth_domtrans($1)
++ role $2 types podsleuth_t;
++ dontaudit podsleuth_t $3:chr_file rw_term_perms;
++')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/podsleuth.te serefpolicy-3.3.1/policy/modules/services/podsleuth.te
+--- nsaserefpolicy/policy/modules/services/podsleuth.te 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.3.1/policy/modules/services/podsleuth.te 2008-05-06 10:48:34.000000000 -0400
+@@ -0,0 +1,46 @@
++policy_module(podsleuth,1.0.0)
++
++########################################
++#
++# Declarations
++#
++
++type podsleuth_t;
++type podsleuth_exec_t;
++application_domain(podsleuth_t, podsleuth_exec_t)
++role system_r types podsleuth_t;
++
++########################################
++#
++# podsleuth local policy
++#
++allow podsleuth_t self:process { ptrace signal getsched execheap execmem };
++
++## internal communication is often done using fifo and unix sockets.
++allow podsleuth_t self:fifo_file rw_file_perms;
++allow podsleuth_t self:unix_stream_socket create_stream_socket_perms;
++
++dev_read_urand(podsleuth_t)
++
++kernel_read_system_state(podsleuth_t)
++
++files_read_etc_files(podsleuth_t)
++
++libs_use_ld_so(podsleuth_t)
++libs_use_shared_libs(podsleuth_t)
++
++miscfiles_read_localization(podsleuth_t)
++
++mono_exec(podsleuth_t)
++hal_dbus_chat(podsleuth_t)
++
++optional_policy(`
++ dbus_system_bus_client_template(podsleuth,podsleuth_t)
++')
++
++gen_require(`
++ type hald_t;
++')
++
++podsleuth_domtrans(hald_t)
++
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.fc serefpolicy-3.3.1/policy/modules/services/polkit.fc
--- nsaserefpolicy/policy/modules/services/polkit.fc 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/services/polkit.fc 2008-04-28 15:14:56.000000000 -0400
@@ -25256,7 +25414,7 @@
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.3.1/policy/modules/services/xserver.if
--- nsaserefpolicy/policy/modules/services/xserver.if 2007-12-04 11:02:50.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/services/xserver.if 2008-04-29 09:37:38.934561000 -0400
++++ serefpolicy-3.3.1/policy/modules/services/xserver.if 2008-04-29 09:37:38.000000000 -0400
@@ -12,9 +12,15 @@
## </summary>
## </param>
@@ -26632,7 +26790,7 @@
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.3.1/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/services/xserver.te 2008-04-29 11:09:45.700467000 -0400
++++ serefpolicy-3.3.1/policy/modules/services/xserver.te 2008-04-29 11:09:45.000000000 -0400
@@ -8,6 +8,14 @@
## <desc>
@@ -27516,7 +27674,7 @@
+/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.3.1/policy/modules/system/authlogin.if
--- nsaserefpolicy/policy/modules/system/authlogin.if 2008-02-01 09:12:53.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/system/authlogin.if 2008-04-29 10:58:08.742336000 -0400
++++ serefpolicy-3.3.1/policy/modules/system/authlogin.if 2008-04-29 10:58:08.000000000 -0400
@@ -99,7 +99,7 @@
template(`authlogin_per_role_template',`
@@ -27735,7 +27893,7 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.3.1/policy/modules/system/authlogin.te
--- nsaserefpolicy/policy/modules/system/authlogin.te 2008-02-19 17:24:26.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/system/authlogin.te 2008-04-21 11:02:50.000000000 -0400
++++ serefpolicy-3.3.1/policy/modules/system/authlogin.te 2008-05-05 13:39:12.000000000 -0400
@@ -59,6 +59,9 @@
type utempter_exec_t;
application_domain(utempter_t,utempter_exec_t)
@@ -27779,7 +27937,27 @@
ifdef(`distro_ubuntu',`
optional_policy(`
unconfined_domain(pam_t)
-@@ -282,6 +295,11 @@
+@@ -155,6 +168,8 @@
+ dev_read_sysfs(pam_console_t)
+ dev_getattr_apm_bios_dev(pam_console_t)
+ dev_setattr_apm_bios_dev(pam_console_t)
++dev_getattr_cpu_dev(pam_console_t)
++dev_setattr_cpu_dev(pam_console_t)
+ dev_getattr_dri_dev(pam_console_t)
+ dev_setattr_dri_dev(pam_console_t)
+ dev_getattr_input_dev(pam_console_t)
+@@ -179,6 +194,10 @@
+ dev_setattr_video_dev(pam_console_t)
+ dev_getattr_xserver_misc_dev(pam_console_t)
+ dev_setattr_xserver_misc_dev(pam_console_t)
++
++dev_getattr_all_chr_files(pam_console_t)
++dev_setattr_all_chr_files(pam_console_t)
++
+ dev_read_urand(pam_console_t)
+
+ mls_file_read_all_levels(pam_console_t)
+@@ -282,6 +301,11 @@
')
')
@@ -27791,7 +27969,7 @@
########################################
#
# updpwd local policy
-@@ -297,8 +315,10 @@
+@@ -297,8 +321,10 @@
files_manage_etc_files(updpwd_t)
term_dontaudit_use_console(updpwd_t)
@@ -27803,7 +27981,7 @@
auth_manage_shadow(updpwd_t)
auth_use_nsswitch(updpwd_t)
-@@ -359,11 +379,6 @@
+@@ -359,11 +385,6 @@
')
optional_policy(`
@@ -28850,7 +29028,7 @@
+/var/cfengine/outputs(/.*)? gen_context(system_u:object_r:var_log_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.3.1/policy/modules/system/logging.if
--- nsaserefpolicy/policy/modules/system/logging.if 2007-12-12 11:35:28.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/system/logging.if 2008-04-29 08:53:40.798973000 -0400
++++ serefpolicy-3.3.1/policy/modules/system/logging.if 2008-04-29 08:53:40.000000000 -0400
@@ -213,12 +213,7 @@
## </param>
#
@@ -29316,7 +29494,7 @@
+/var/run/dmevent.* gen_context(system_u:object_r:lvm_var_run_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.3.1/policy/modules/system/lvm.te
--- nsaserefpolicy/policy/modules/system/lvm.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/system/lvm.te 2008-04-29 08:38:10.482745000 -0400
++++ serefpolicy-3.3.1/policy/modules/system/lvm.te 2008-04-29 08:38:10.000000000 -0400
@@ -22,7 +22,7 @@
role system_r types lvm_t;
@@ -29627,7 +29805,7 @@
## <param name="domain">
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.3.1/policy/modules/system/modutils.te
--- nsaserefpolicy/policy/modules/system/modutils.te 2008-02-06 10:33:22.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/system/modutils.te 2008-04-29 08:36:55.595920000 -0400
++++ serefpolicy-3.3.1/policy/modules/system/modutils.te 2008-04-29 08:36:55.000000000 -0400
@@ -22,6 +22,8 @@
type insmod_exec_t;
application_domain(insmod_t,insmod_exec_t)
@@ -29951,8 +30129,8 @@
+/usr/bin/qemu-kvm -- gen_context(system_u:object_r:qemu_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/qemu.if serefpolicy-3.3.1/policy/modules/system/qemu.if
--- nsaserefpolicy/policy/modules/system/qemu.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/system/qemu.if 2008-04-21 11:02:50.000000000 -0400
-@@ -0,0 +1,303 @@
++++ serefpolicy-3.3.1/policy/modules/system/qemu.if 2008-05-06 13:00:22.930868000 -0400
+@@ -0,0 +1,304 @@
+
+## <summary>policy for qemu</summary>
+
@@ -30252,13 +30430,14 @@
+ optional_policy(`
+ xserver_stream_connect_xdm_xserver($1_t)
+ xserver_read_xdm_tmp_files($1_t)
++ xserver_read_xdm_pid($1_t)
+ xserver_xdm_rw_shm($1_t)
+ ')
+')
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/qemu.te serefpolicy-3.3.1/policy/modules/system/qemu.te
--- nsaserefpolicy/policy/modules/system/qemu.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/system/qemu.te 2008-04-28 16:14:23.000000000 -0400
++++ serefpolicy-3.3.1/policy/modules/system/qemu.te 2008-05-06 12:59:56.894791000 -0400
@@ -0,0 +1,49 @@
+policy_module(qemu,1.0.0)
+
@@ -30311,7 +30490,7 @@
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.3.1/policy/modules/system/raid.te
--- nsaserefpolicy/policy/modules/system/raid.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/system/raid.te 2008-04-29 08:35:21.523317000 -0400
++++ serefpolicy-3.3.1/policy/modules/system/raid.te 2008-04-29 08:35:21.000000000 -0400
@@ -19,7 +19,7 @@
# Local policy
#
@@ -31177,7 +31356,7 @@
xen_append_log(ifconfig_t)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.if serefpolicy-3.3.1/policy/modules/system/udev.if
--- nsaserefpolicy/policy/modules/system/udev.if 2007-01-02 12:57:49.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/system/udev.if 2008-04-29 08:34:43.098742000 -0400
++++ serefpolicy-3.3.1/policy/modules/system/udev.if 2008-04-29 08:34:43.000000000 -0400
@@ -96,6 +96,24 @@
########################################
@@ -31291,8 +31470,8 @@
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.3.1/policy/modules/system/unconfined.fc
--- nsaserefpolicy/policy/modules/system/unconfined.fc 2007-12-12 11:35:28.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/system/unconfined.fc 2008-04-21 11:02:50.000000000 -0400
-@@ -2,15 +2,16 @@
++++ serefpolicy-3.3.1/policy/modules/system/unconfined.fc 2008-05-06 11:32:14.189425000 -0400
+@@ -2,15 +2,18 @@
# e.g.:
# /usr/local/bin/appsrv -- gen_context(system_u:object_r:unconfined_exec_t,s0)
# For the time being until someone writes a sane policy, we need initrc to transition to unconfined_t
@@ -31313,6 +31492,8 @@
+/usr/sbin/mock -- gen_context(system_u:object_r:unconfined_notrans_exec_t,s0)
+/usr/bin/livecd-creator -- gen_context(system_u:object_r:unconfined_notrans_exec_t,s0)
+/usr/sbin/sysreport -- gen_context(system_u:object_r:unconfined_notrans_exec_t,s0)
++/usr/lib64/erlang/erts-[^/]+/bin/beam.smp -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
++/usr/lib/erlang/erts-[^/]+/bin/beam.smp -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.3.1/policy/modules/system/unconfined.if
--- nsaserefpolicy/policy/modules/system/unconfined.if 2007-11-16 15:30:49.000000000 -0500
+++ serefpolicy-3.3.1/policy/modules/system/unconfined.if 2008-04-25 13:52:57.000000000 -0400
@@ -31660,7 +31841,7 @@
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.3.1/policy/modules/system/unconfined.te
--- nsaserefpolicy/policy/modules/system/unconfined.te 2008-02-13 16:26:06.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/system/unconfined.te 2008-04-29 12:04:03.912060000 -0400
++++ serefpolicy-3.3.1/policy/modules/system/unconfined.te 2008-04-29 12:04:03.000000000 -0400
@@ -6,35 +6,74 @@
# Declarations
#
@@ -32003,7 +32184,7 @@
+/root(/.*)? gen_context(system_u:object_r:admin_home_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.3.1/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2008-02-15 09:52:56.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/system/userdomain.if 2008-04-29 10:58:27.618425000 -0400
++++ serefpolicy-3.3.1/policy/modules/system/userdomain.if 2008-04-30 13:19:45.000000000 -0400
@@ -29,9 +29,14 @@
')
@@ -33117,7 +33298,18 @@
# cjp: why?
files_read_kernel_symbol_table($1_t)
-@@ -1193,12 +1204,11 @@
+@@ -1182,23 +1193,16 @@
+ ')
+ ')
+
+- tunable_policy(`user_dmesg',`
+- kernel_read_ring_buffer($1_t)
+- ',`
+- kernel_dontaudit_read_ring_buffer($1_t)
+- ')
+-
+ # Allow users to run TCP servers (bind to ports and accept connection from
+ # the same domain and outside users) disabling this forces FTP passive mode
# and may change other protocols
tunable_policy(`user_tcp_server',`
corenet_tcp_bind_all_nodes($1_t)
@@ -33128,15 +33320,19 @@
optional_policy(`
- netutils_run_ping_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
- netutils_run_traceroute_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
-+ hal_dbus_chat($1_t)
++ hal_dbus_chat($1_usertype)
')
# Run pppd in pppd_t by default for user
-@@ -1207,7 +1217,27 @@
+@@ -1207,7 +1211,31 @@
')
optional_policy(`
- setroubleshoot_stream_connect($1_t)
++ games_rw_data($1_usertype)
++ ')
++
++ optional_policy(`
+ mount_run($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
+ ')
+
@@ -33161,7 +33357,7 @@
')
')
-@@ -1284,8 +1314,6 @@
+@@ -1284,8 +1312,6 @@
# Manipulate other users crontab.
allow $1_t self:passwd crontab;
@@ -33170,7 +33366,7 @@
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
kernel_getattr_message_if($1_t)
-@@ -1307,8 +1335,6 @@
+@@ -1307,8 +1333,6 @@
dev_getattr_generic_blk_files($1_t)
dev_getattr_generic_chr_files($1_t)
@@ -33179,7 +33375,7 @@
# Allow MAKEDEV to work
dev_create_all_blk_files($1_t)
dev_create_all_chr_files($1_t)
-@@ -1363,13 +1389,6 @@
+@@ -1363,13 +1387,6 @@
# But presently necessary for installing the file_contexts file.
seutil_manage_bin_policy($1_t)
@@ -33193,7 +33389,7 @@
optional_policy(`
userhelper_exec($1_t)
')
-@@ -1422,6 +1441,7 @@
+@@ -1422,6 +1439,7 @@
dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1)
@@ -33201,7 +33397,7 @@
# Necessary for managing /boot/efi
fs_manage_dos_files($1)
-@@ -1787,10 +1807,14 @@
+@@ -1787,10 +1805,14 @@
template(`userdom_user_home_content',`
gen_require(`
attribute $1_file_type;
@@ -33217,7 +33413,7 @@
')
########################################
-@@ -1886,11 +1910,11 @@
+@@ -1886,11 +1908,11 @@
#
template(`userdom_search_user_home_dirs',`
gen_require(`
@@ -33231,7 +33427,7 @@
')
########################################
-@@ -1920,11 +1944,11 @@
+@@ -1920,11 +1942,11 @@
#
template(`userdom_list_user_home_dirs',`
gen_require(`
@@ -33245,7 +33441,7 @@
')
########################################
-@@ -1968,12 +1992,12 @@
+@@ -1968,12 +1990,12 @@
#
template(`userdom_user_home_domtrans',`
gen_require(`
@@ -33261,7 +33457,7 @@
')
########################################
-@@ -2003,10 +2027,11 @@
+@@ -2003,10 +2025,11 @@
#
template(`userdom_dontaudit_list_user_home_dirs',`
gen_require(`
@@ -33275,7 +33471,7 @@
')
########################################
-@@ -2038,11 +2063,47 @@
+@@ -2038,11 +2061,47 @@
#
template(`userdom_manage_user_home_content_dirs',`
gen_require(`
@@ -33325,7 +33521,7 @@
')
########################################
-@@ -2074,10 +2135,10 @@
+@@ -2074,10 +2133,10 @@
#
template(`userdom_dontaudit_setattr_user_home_content_files',`
gen_require(`
@@ -33338,7 +33534,7 @@
')
########################################
-@@ -2107,11 +2168,11 @@
+@@ -2107,11 +2166,11 @@
#
template(`userdom_read_user_home_content_files',`
gen_require(`
@@ -33352,7 +33548,7 @@
')
########################################
-@@ -2141,11 +2202,11 @@
+@@ -2141,11 +2200,11 @@
#
template(`userdom_dontaudit_read_user_home_content_files',`
gen_require(`
@@ -33367,7 +33563,7 @@
')
########################################
-@@ -2175,10 +2236,14 @@
+@@ -2175,10 +2234,14 @@
#
template(`userdom_dontaudit_write_user_home_content_files',`
gen_require(`
@@ -33384,7 +33580,7 @@
')
########################################
-@@ -2208,11 +2273,11 @@
+@@ -2208,11 +2271,11 @@
#
template(`userdom_read_user_home_content_symlinks',`
gen_require(`
@@ -33398,7 +33594,7 @@
')
########################################
-@@ -2242,11 +2307,11 @@
+@@ -2242,11 +2305,11 @@
#
template(`userdom_exec_user_home_content_files',`
gen_require(`
@@ -33412,7 +33608,7 @@
')
########################################
-@@ -2276,10 +2341,10 @@
+@@ -2276,10 +2339,10 @@
#
template(`userdom_dontaudit_exec_user_home_content_files',`
gen_require(`
@@ -33425,7 +33621,7 @@
')
########################################
-@@ -2311,12 +2376,12 @@
+@@ -2311,12 +2374,12 @@
#
template(`userdom_manage_user_home_content_files',`
gen_require(`
@@ -33441,7 +33637,7 @@
')
########################################
-@@ -2348,10 +2413,10 @@
+@@ -2348,10 +2411,10 @@
#
template(`userdom_dontaudit_manage_user_home_content_dirs',`
gen_require(`
@@ -33454,7 +33650,7 @@
')
########################################
-@@ -2383,12 +2448,12 @@
+@@ -2383,12 +2446,12 @@
#
template(`userdom_manage_user_home_content_symlinks',`
gen_require(`
@@ -33470,7 +33666,7 @@
')
########################################
-@@ -2420,12 +2485,12 @@
+@@ -2420,12 +2483,12 @@
#
template(`userdom_manage_user_home_content_pipes',`
gen_require(`
@@ -33486,7 +33682,7 @@
')
########################################
-@@ -2457,12 +2522,12 @@
+@@ -2457,12 +2520,12 @@
#
template(`userdom_manage_user_home_content_sockets',`
gen_require(`
@@ -33502,7 +33698,7 @@
')
########################################
-@@ -2507,11 +2572,11 @@
+@@ -2507,11 +2570,11 @@
#
template(`userdom_user_home_dir_filetrans',`
gen_require(`
@@ -33516,7 +33712,7 @@
')
########################################
-@@ -2556,11 +2621,11 @@
+@@ -2556,11 +2619,11 @@
#
template(`userdom_user_home_content_filetrans',`
gen_require(`
@@ -33530,7 +33726,7 @@
')
########################################
-@@ -2600,11 +2665,11 @@
+@@ -2600,11 +2663,11 @@
#
template(`userdom_user_home_dir_filetrans_user_home_content',`
gen_require(`
@@ -33544,7 +33740,7 @@
')
########################################
-@@ -2634,11 +2699,11 @@
+@@ -2634,11 +2697,11 @@
#
template(`userdom_write_user_tmp_sockets',`
gen_require(`
@@ -33558,7 +33754,7 @@
')
########################################
-@@ -2668,11 +2733,11 @@
+@@ -2668,11 +2731,11 @@
#
template(`userdom_list_user_tmp',`
gen_require(`
@@ -33572,7 +33768,7 @@
')
########################################
-@@ -2704,10 +2769,10 @@
+@@ -2704,10 +2767,10 @@
#
template(`userdom_dontaudit_list_user_tmp',`
gen_require(`
@@ -33585,7 +33781,7 @@
')
########################################
-@@ -2739,10 +2804,10 @@
+@@ -2739,10 +2802,10 @@
#
template(`userdom_dontaudit_manage_user_tmp_dirs',`
gen_require(`
@@ -33598,7 +33794,7 @@
')
########################################
-@@ -2772,12 +2837,12 @@
+@@ -2772,12 +2835,12 @@
#
template(`userdom_read_user_tmp_files',`
gen_require(`
@@ -33614,7 +33810,7 @@
')
########################################
-@@ -2809,10 +2874,10 @@
+@@ -2809,10 +2872,10 @@
#
template(`userdom_dontaudit_read_user_tmp_files',`
gen_require(`
@@ -33627,7 +33823,7 @@
')
########################################
-@@ -2844,10 +2909,48 @@
+@@ -2844,10 +2907,48 @@
#
template(`userdom_dontaudit_append_user_tmp_files',`
gen_require(`
@@ -33678,7 +33874,7 @@
')
########################################
-@@ -2877,12 +2980,12 @@
+@@ -2877,12 +2978,12 @@
#
template(`userdom_rw_user_tmp_files',`
gen_require(`
@@ -33694,7 +33890,7 @@
')
########################################
-@@ -2914,10 +3017,10 @@
+@@ -2914,10 +3015,10 @@
#
template(`userdom_dontaudit_manage_user_tmp_files',`
gen_require(`
@@ -33707,7 +33903,7 @@
')
########################################
-@@ -2949,12 +3052,12 @@
+@@ -2949,12 +3050,12 @@
#
template(`userdom_read_user_tmp_symlinks',`
gen_require(`
@@ -33723,7 +33919,7 @@
')
########################################
-@@ -2986,11 +3089,11 @@
+@@ -2986,11 +3087,11 @@
#
template(`userdom_manage_user_tmp_dirs',`
gen_require(`
@@ -33737,7 +33933,7 @@
')
########################################
-@@ -3022,11 +3125,11 @@
+@@ -3022,11 +3123,11 @@
#
template(`userdom_manage_user_tmp_files',`
gen_require(`
@@ -33751,7 +33947,7 @@
')
########################################
-@@ -3058,11 +3161,11 @@
+@@ -3058,11 +3159,11 @@
#
template(`userdom_manage_user_tmp_symlinks',`
gen_require(`
@@ -33765,7 +33961,7 @@
')
########################################
-@@ -3094,11 +3197,11 @@
+@@ -3094,11 +3195,11 @@
#
template(`userdom_manage_user_tmp_pipes',`
gen_require(`
@@ -33779,7 +33975,7 @@
')
########################################
-@@ -3130,11 +3233,11 @@
+@@ -3130,11 +3231,11 @@
#
template(`userdom_manage_user_tmp_sockets',`
gen_require(`
@@ -33793,7 +33989,7 @@
')
########################################
-@@ -3179,10 +3282,10 @@
+@@ -3179,10 +3280,10 @@
#
template(`userdom_user_tmp_filetrans',`
gen_require(`
@@ -33806,7 +34002,7 @@
files_search_tmp($2)
')
-@@ -3223,10 +3326,10 @@
+@@ -3223,10 +3324,10 @@
#
template(`userdom_tmp_filetrans_user_tmp',`
gen_require(`
@@ -33819,7 +34015,7 @@
')
########################################
-@@ -3254,24 +3357,24 @@
+@@ -3254,24 +3355,24 @@
## </summary>
## </param>
#
@@ -33848,7 +34044,7 @@
## </p>
## <p>
## This is a templated interface, and should only
-@@ -3290,23 +3393,24 @@
+@@ -3290,23 +3391,24 @@
## </summary>
## </param>
#
@@ -33880,25 +34076,20 @@
## </p>
## <p>
## This is a templated interface, and should only
-@@ -3321,18 +3425,89 @@
+@@ -3321,7 +3423,78 @@
## </param>
## <param name="domain">
## <summary>
-## Domain to not audit.
+## Domain allowed access.
- ## </summary>
- ## </param>
- #
--template(`userdom_dontaudit_list_user_untrusted_content',`
++## </summary>
++## </param>
++#
+template(`userdom_delete_user_tmpfs_files',`
- gen_require(`
-- type $1_untrusted_content_t;
++ gen_require(`
+ type $1_tmpfs_t;
- ')
-
-- dontaudit $2 $1_untrusted_content_t:dir list_dir_perms;
--')
--
++ ')
++
+ fs_search_tmpfs($2)
+ allow $2 $1_tmpfs_t:dir list_dir_perms;
+ delete_files_pattern($2,$1_tmpfs_t,$1_tmpfs_t)
@@ -33962,21 +34153,10 @@
+## <param name="domain">
+## <summary>
+## Domain to not audit.
-+## </summary>
-+## </param>
-+#
-+template(`userdom_dontaudit_list_user_untrusted_content',`
-+ gen_require(`
-+ type $1_untrusted_content_t;
-+ ')
-+
-+ dontaudit $2 $1_untrusted_content_t:dir list_dir_perms;
-+')
-+
- ########################################
- ## <summary>
- ## Read user untrusted files.
-@@ -4231,11 +4406,11 @@
+ ## </summary>
+ ## </param>
+ #
+@@ -4231,11 +4404,11 @@
#
interface(`userdom_search_staff_home_dirs',`
gen_require(`
@@ -33990,7 +34170,7 @@
')
########################################
-@@ -4251,10 +4426,10 @@
+@@ -4251,10 +4424,10 @@
#
interface(`userdom_dontaudit_search_staff_home_dirs',`
gen_require(`
@@ -34003,7 +34183,7 @@
')
########################################
-@@ -4270,11 +4445,11 @@
+@@ -4270,11 +4443,11 @@
#
interface(`userdom_manage_staff_home_dirs',`
gen_require(`
@@ -34017,7 +34197,7 @@
')
########################################
-@@ -4289,16 +4464,16 @@
+@@ -4289,16 +4462,16 @@
#
interface(`userdom_relabelto_staff_home_dirs',`
gen_require(`
@@ -34037,7 +34217,7 @@
## users home directory.
## </summary>
## <param name="domain">
-@@ -4307,12 +4482,35 @@
+@@ -4307,12 +4480,35 @@
## </summary>
## </param>
#
@@ -34076,7 +34256,7 @@
')
########################################
-@@ -4327,13 +4525,13 @@
+@@ -4327,13 +4523,13 @@
#
interface(`userdom_read_staff_home_content_files',`
gen_require(`
@@ -34094,7 +34274,7 @@
')
########################################
-@@ -4531,10 +4729,10 @@
+@@ -4531,10 +4727,10 @@
#
interface(`userdom_getattr_sysadm_home_dirs',`
gen_require(`
@@ -34107,7 +34287,7 @@
')
########################################
-@@ -4551,10 +4749,10 @@
+@@ -4551,10 +4747,10 @@
#
interface(`userdom_dontaudit_getattr_sysadm_home_dirs',`
gen_require(`
@@ -34120,7 +34300,7 @@
')
########################################
-@@ -4569,10 +4767,10 @@
+@@ -4569,10 +4765,10 @@
#
interface(`userdom_search_sysadm_home_dirs',`
gen_require(`
@@ -34133,7 +34313,7 @@
')
########################################
-@@ -4588,10 +4786,10 @@
+@@ -4588,10 +4784,10 @@
#
interface(`userdom_dontaudit_search_sysadm_home_dirs',`
gen_require(`
@@ -34146,7 +34326,7 @@
')
########################################
-@@ -4606,10 +4804,10 @@
+@@ -4606,10 +4802,10 @@
#
interface(`userdom_list_sysadm_home_dirs',`
gen_require(`
@@ -34159,7 +34339,7 @@
')
########################################
-@@ -4625,10 +4823,10 @@
+@@ -4625,10 +4821,10 @@
#
interface(`userdom_dontaudit_list_sysadm_home_dirs',`
gen_require(`
@@ -34172,7 +34352,7 @@
')
########################################
-@@ -4644,12 +4842,11 @@
+@@ -4644,12 +4840,11 @@
#
interface(`userdom_dontaudit_read_sysadm_home_content_files',`
gen_require(`
@@ -34188,7 +34368,7 @@
')
########################################
-@@ -4676,10 +4873,10 @@
+@@ -4676,10 +4871,10 @@
#
interface(`userdom_sysadm_home_dir_filetrans',`
gen_require(`
@@ -34201,7 +34381,7 @@
')
########################################
-@@ -4694,10 +4891,10 @@
+@@ -4694,10 +4889,10 @@
#
interface(`userdom_search_sysadm_home_content_dirs',`
gen_require(`
@@ -34214,7 +34394,7 @@
')
########################################
-@@ -4712,13 +4909,13 @@
+@@ -4712,13 +4907,13 @@
#
interface(`userdom_read_sysadm_home_content_files',`
gen_require(`
@@ -34232,7 +34412,7 @@
')
########################################
-@@ -4754,11 +4951,49 @@
+@@ -4754,11 +4949,49 @@
#
interface(`userdom_search_all_users_home_dirs',`
gen_require(`
@@ -34283,7 +34463,7 @@
')
########################################
-@@ -4778,6 +5013,14 @@
+@@ -4778,6 +5011,14 @@
files_list_home($1)
allow $1 home_dir_type:dir list_dir_perms;
@@ -34298,7 +34478,7 @@
')
########################################
-@@ -4839,6 +5082,26 @@
+@@ -4839,6 +5080,26 @@
########################################
## <summary>
@@ -34325,7 +34505,7 @@
## Create, read, write, and delete all directories
## in all users home directories.
## </summary>
-@@ -4859,6 +5122,25 @@
+@@ -4859,6 +5120,25 @@
########################################
## <summary>
@@ -34351,7 +34531,7 @@
## Create, read, write, and delete all files
## in all users home directories.
## </summary>
-@@ -4879,6 +5161,26 @@
+@@ -4879,6 +5159,26 @@
########################################
## <summary>
@@ -34378,7 +34558,7 @@
## Create, read, write, and delete all symlinks
## in all users home directories.
## </summary>
-@@ -5115,7 +5417,7 @@
+@@ -5115,7 +5415,7 @@
#
interface(`userdom_relabelto_generic_user_home_dirs',`
gen_require(`
@@ -34387,7 +34567,7 @@
')
files_search_home($1)
-@@ -5304,6 +5606,63 @@
+@@ -5304,6 +5604,63 @@
########################################
## <summary>
@@ -34451,7 +34631,7 @@
## Create, read, write, and delete directories in
## unprivileged users home directories.
## </summary>
-@@ -5509,7 +5868,7 @@
+@@ -5509,7 +5866,7 @@
########################################
## <summary>
@@ -34460,7 +34640,7 @@
## </summary>
## <param name="domain">
## <summary>
-@@ -5517,18 +5876,17 @@
+@@ -5517,18 +5874,17 @@
## </summary>
## </param>
#
@@ -34483,7 +34663,7 @@
## </summary>
## <param name="domain">
## <summary>
-@@ -5536,17 +5894,17 @@
+@@ -5536,17 +5892,17 @@
## </summary>
## </param>
#
@@ -34505,7 +34685,7 @@
## </summary>
## <param name="domain">
## <summary>
-@@ -5554,12 +5912,49 @@
+@@ -5554,19 +5910,56 @@
## </summary>
## </param>
#
@@ -34517,11 +34697,14 @@
')
- read_files_pattern($1,userdomain,userdomain)
+- kernel_search_proc($1)
+ allow $1 user_ttynode:chr_file rw_term_perms;
-+')
-+
-+########################################
-+## <summary>
+ ')
+
+ ########################################
+ ## <summary>
+-## Get the attributes of all user domains.
+-## </summary>
+## Do not audit attempts to use unprivileged
+## user ttys.
+## </summary>
@@ -34555,10 +34738,17 @@
+ ')
+
+ ps_process_pattern($1,userdomain)
- kernel_search_proc($1)
- ')
-
-@@ -5674,6 +6069,42 @@
++ kernel_search_proc($1)
++')
++
++########################################
++## <summary>
++## Get the attributes of all user domains.
++## </summary>
+ ## <param name="domain">
+ ## <summary>
+ ## Domain allowed access.
+@@ -5674,6 +6067,42 @@
########################################
## <summary>
@@ -34601,7 +34791,7 @@
## Send a dbus message to all user domains.
## </summary>
## <param name="domain">
-@@ -5704,3 +6135,408 @@
+@@ -5704,3 +6133,408 @@
interface(`userdom_unconfined',`
refpolicywarn(`$0($*) has been deprecated.')
')
@@ -35012,7 +35202,7 @@
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.3.1/policy/modules/system/userdomain.te
--- nsaserefpolicy/policy/modules/system/userdomain.te 2007-12-19 05:32:17.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/system/userdomain.te 2008-04-21 11:02:50.000000000 -0400
++++ serefpolicy-3.3.1/policy/modules/system/userdomain.te 2008-04-30 13:23:52.000000000 -0400
@@ -2,12 +2,7 @@
policy_module(userdomain,2.5.0)
@@ -35049,7 +35239,21 @@
## Allow users to connect to PostgreSQL
## </p>
## </desc>
-@@ -74,6 +62,9 @@
+@@ -45,13 +33,6 @@
+
+ ## <desc>
+ ## <p>
+-## Allow users to read system messages.
+-## </p>
+-## </desc>
+-gen_tunable(user_dmesg,false)
+-
+-## <desc>
+-## <p>
+ ## Allow user to r/w files on filesystems
+ ## that do not have extended attributes (FAT, CDROM, FLOPPY)
+ ## </p>
+@@ -74,6 +55,9 @@
# users home directory contents
attribute home_type;
@@ -35059,7 +35263,7 @@
# The privhome attribute identifies every domain that can create files under
# regular user home directories in the regular context (IE act on behalf of
# a user in writing regular files)
-@@ -97,44 +88,54 @@
+@@ -97,44 +81,54 @@
# unprivileged user domains
attribute unpriv_userdomain;
@@ -35076,11 +35280,6 @@
-userdom_admin_user_template(sysadm)
-userdom_unpriv_user_template(staff)
-userdom_unpriv_user_template(user)
--
--# user role change rules:
--# sysadm_r can change to user roles
--userdom_role_change_template(sysadm, user)
--userdom_role_change_template(sysadm, staff)
+type admin_home_t, home_type;
+files_type(admin_home_t)
+files_associate_tmp(admin_home_t)
@@ -35105,12 +35304,17 @@
+files_poly_member(user_home_dir_t)
+files_poly_parent(user_home_dir_t)
--# only staff_r can change to sysadm_r
--userdom_role_change_template(staff, sysadm)
--dontaudit staff_t admin_terminal:chr_file { read write };
+-# user role change rules:
+-# sysadm_r can change to user roles
+-userdom_role_change_template(sysadm, user)
+-userdom_role_change_template(sysadm, staff)
+type user_tmp_t, user_file_type, user_tmpfile;
+files_tmp_file(user_tmp_t)
+-# only staff_r can change to sysadm_r
+-userdom_role_change_template(staff, sysadm)
+-dontaudit staff_t admin_terminal:chr_file { read write };
+-
-ifdef(`enable_mls',`
- userdom_unpriv_user_template(secadm)
- userdom_unpriv_user_template(auditadm)
@@ -35142,7 +35346,7 @@
########################################
#
-@@ -153,6 +154,12 @@
+@@ -153,6 +147,12 @@
mls_process_read_up(sysadm_t)
init_exec(sysadm_t)
@@ -35155,7 +35359,7 @@
# Following for sending reboot and wall messages
userdom_use_unpriv_users_ptys(sysadm_t)
-@@ -170,46 +177,7 @@
+@@ -170,46 +170,7 @@
')
')
@@ -35203,7 +35407,7 @@
logging_manage_audit_log(sysadm_t)
logging_manage_audit_config(sysadm_t)
logging_run_auditctl(sysadm_t, sysadm_r, admin_terminal)
-@@ -224,6 +192,10 @@
+@@ -224,6 +185,10 @@
')
optional_policy(`
@@ -35214,7 +35418,7 @@
apache_run_helper(sysadm_t, sysadm_r, admin_terminal)
#apache_run_all_scripts(sysadm_t, sysadm_r)
#apache_domtrans_sys_script(sysadm_t)
-@@ -279,14 +251,6 @@
+@@ -279,14 +244,6 @@
')
optional_policy(`
@@ -35229,7 +35433,7 @@
cron_admin_template(sysadm, sysadm_t, sysadm_r)
')
-@@ -302,12 +266,9 @@
+@@ -302,12 +259,9 @@
optional_policy(`
dmesg_exec(sysadm_t)
@@ -35243,7 +35447,7 @@
optional_policy(`
dmidecode_run(sysadm_t, sysadm_r, admin_terminal)
')
-@@ -352,6 +313,10 @@
+@@ -352,6 +306,10 @@
')
optional_policy(`
@@ -35254,7 +35458,7 @@
lvm_run(sysadm_t, sysadm_r, admin_terminal)
')
-@@ -387,6 +352,10 @@
+@@ -387,6 +345,10 @@
')
optional_policy(`
@@ -35265,7 +35469,7 @@
netutils_run(sysadm_t, sysadm_r, admin_terminal)
netutils_run_ping(sysadm_t, sysadm_r, admin_terminal)
netutils_run_traceroute(sysadm_t, sysadm_r, admin_terminal)
-@@ -436,15 +405,19 @@
+@@ -436,15 +398,19 @@
optional_policy(`
samba_run_net(sysadm_t, sysadm_r, admin_terminal)
@@ -35286,7 +35490,7 @@
', `
userdom_security_admin_template(sysadm_t, sysadm_r, admin_terminal)
')
-@@ -487,3 +460,31 @@
+@@ -487,3 +453,31 @@
optional_policy(`
yam_run(sysadm_t, sysadm_r, admin_terminal)
')
@@ -36267,8 +36471,8 @@
+## <summary>Policy for staff user</summary>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/staff.te serefpolicy-3.3.1/policy/modules/users/staff.te
--- nsaserefpolicy/policy/modules/users/staff.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.3.1/policy/modules/users/staff.te 2008-04-24 15:09:37.000000000 -0400
-@@ -0,0 +1,23 @@
++++ serefpolicy-3.3.1/policy/modules/users/staff.te 2008-04-30 13:20:29.000000000 -0400
+@@ -0,0 +1,25 @@
+policy_module(staff,1.0.1)
+userdom_admin_login_user_template(staff)
+
@@ -36276,6 +36480,8 @@
+userdom_role_change_template(staff, sysadm)
+userdom_dontaudit_use_sysadm_terms(staff_t)
+
++kernel_read_ring_buffer(staff_t)
++
+auth_domtrans_pam_console(staff_t)
+
+optional_policy(`
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.659
retrieving revision 1.660
diff -u -r1.659 -r1.660
--- selinux-policy.spec 29 Apr 2008 16:05:11 -0000 1.659
+++ selinux-policy.spec 6 May 2008 17:01:42 -0000 1.660
@@ -17,7 +17,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.3.1
-Release: 44%{?dist}
+Release: 45%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -385,6 +385,10 @@
%endif
%changelog
+* Wed Apr 30 2008 Dan Walsh <dwalsh at redhat.com> 3.3.1-45
+- Remove dmesg boolean
+- Allow user domains to read/write game data
+
* Mon Apr 28 2008 Dan Walsh <dwalsh at redhat.com> 3.3.1-44
- Change unconfined_t to transition to unconfined_mono_t when running mono
- Change XXX_mono_t to transition to XXX_t when executing bin_t files, so gnome-do will work
More information about the fedora-extras-commits
mailing list