rpms/selinux-policy/F-8 modules-targeted.conf, 1.77, 1.78 policy-20070703.patch, 1.225, 1.226 selinux-policy.spec, 1.645, 1.646

Daniel J Walsh dwalsh at fedoraproject.org
Wed Oct 8 23:02:00 UTC 2008 

Author: dwalsh

Update of /cvs/extras/rpms/selinux-policy/F-8
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv28059

Modified Files:
	modules-targeted.conf policy-20070703.patch 
	selinux-policy.spec 
Log Message:
* Wed Oct 8 2008 Dan Walsh <dwalsh at redhat.com> 3.0.8-118
- Add policykit policy



Index: modules-targeted.conf
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-8/modules-targeted.conf,v
retrieving revision 1.77
retrieving revision 1.78
diff -u -r1.77 -r1.78
--- modules-targeted.conf	20 May 2008 19:47:31 -0000	1.77
+++ modules-targeted.conf	8 Oct 2008 23:01:30 -0000	1.78
@@ -479,6 +479,13 @@
 # 
 hal = module
 
+# Layer: services
+# Module: polkit
+#
+# Hardware abstraction layer
+# 
+polkit = module
+
 # Layer: system
 # Module: hostname
 #

policy-20070703.patch:

Index: policy-20070703.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-8/policy-20070703.patch,v
retrieving revision 1.225
retrieving revision 1.226
diff -u -r1.225 -r1.226
--- policy-20070703.patch	26 Sep 2008 14:02:49 -0000	1.225
+++ policy-20070703.patch	8 Oct 2008 23:01:30 -0000	1.226
@@ -11202,36 +11202,45 @@
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.8/policy/modules/services/hal.fc
 --- nsaserefpolicy/policy/modules/services/hal.fc	2008-06-12 23:37:57.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/hal.fc	2008-06-12 23:37:59.000000000 -0400
-@@ -8,14 +8,18 @@
++++ serefpolicy-3.0.8/policy/modules/services/hal.fc	2008-10-08 18:03:32.000000000 -0400
+@@ -8,6 +8,8 @@
  /usr/libexec/hal-hotplug-map 		--	gen_context(system_u:object_r:hald_exec_t,s0)
  /usr/libexec/hal-system-sonypic	 	--	gen_context(system_u:object_r:hald_sonypic_exec_t,s0)
  /usr/libexec/hald-addon-macbookpro-backlight --	gen_context(system_u:object_r:hald_mac_exec_t,s0)
 +/usr/libexec/hald-addon-macbook-backlight --	gen_context(system_u:object_r:hald_mac_exec_t,s0)
++/usr/sbin/radeontool			  --	gen_context(system_u:object_r:hald_mac_exec_t,s0)
  
  /usr/sbin/hald		--			gen_context(system_u:object_r:hald_exec_t,s0)
  
- /var/cache/hald(/.*)?				gen_context(system_u:object_r:hald_cache_t,s0)
+@@ -15,7 +17,14 @@
  
-+/var/lib/PolicyKit(/.*)?				gen_context(system_u:object_r:hald_var_lib_t,s0)
  /var/lib/hal(/.*)?				gen_context(system_u:object_r:hald_var_lib_t,s0)
  
- /var/log/pm-suspend.log				gen_context(system_u:object_r:hald_log_t,s0)
+-/var/log/pm-suspend.log				gen_context(system_u:object_r:hald_log_t,s0)
++/var/log/pm-suspend\.log			gen_context(system_u:object_r:hald_log_t,s0)
 +/var/log/pm(/.*)?				gen_context(system_u:object_r:hald_log_t,s0)
  
-+/var/run/pm(/.*)?				gen_context(system_u:object_r:hald_var_run_t,s0)
- /var/run/haldaemon.pid	--	 		gen_context(system_u:object_r:hald_var_run_t,s0)
+-/var/run/haldaemon.pid	--	 		gen_context(system_u:object_r:hald_var_run_t,s0)
 -/var/run/vbestate 	--			gen_context(system_u:object_r:hald_var_run_t,s0)
-+/var/run/vbe.*		--			gen_context(system_u:object_r:hald_var_run_t,s0)
++/var/run/pm(/.*)?				gen_context(system_u:object_r:hald_var_run_t,s0)
++/var/run/pm-utils(/.*)?				gen_context(system_u:object_r:hald_var_run_t,s0)
++/var/run/hald(/.*)?				gen_context(system_u:object_r:hald_var_run_t,s0)
++/var/run/haldaemon\.pid	--	 		gen_context(system_u:object_r:hald_var_run_t,s0)
++/var/run/vbe.*	 	--			gen_context(system_u:object_r:hald_var_run_t,s0)
++ifdef(`distro_gentoo',`
++/var/lib/cache/hald(/.*)?			gen_context(system_u:object_r:hald_cache_t,s0)
++')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.0.8/policy/modules/services/hal.if
 --- nsaserefpolicy/policy/modules/services/hal.if	2008-06-12 23:37:57.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/hal.if	2008-06-12 23:37:58.000000000 -0400
-@@ -247,6 +247,24 @@
- 
- ########################################
- ## <summary>
-+##	Do not audit attempts to list
-+##	HAL libraries dirs
++++ serefpolicy-3.0.8/policy/modules/services/hal.if	2008-10-08 18:03:35.000000000 -0400
+@@ -302,3 +302,42 @@
+ 	files_search_pids($1)
+ 	allow $1 hald_var_run_t:file rw_file_perms;
+ ')
++
++########################################
++## <summary>
++##	Send a SIGCHLD signal to hal.
 +## </summary>
 +## <param name="domain">
 +##	<summary>
@@ -11239,21 +11248,44 @@
 +##	</summary>
 +## </param>
 +#
-+interface(`hal_dontaudit_list_lib_dirs',`
++interface(`hal_getattr',`
 +	gen_require(`
-+		type hald_var_lib_t;
++		type hald_t;
 +	')
 +
-+	dontaudit $1 hald_var_lib_t:dir list_dir_perms;
++	allow $1 hald_t:process getattr;
 +')
++
 +########################################
 +## <summary>
- ##	Do not audit attempts to read or write
- ##	HAL libraries files
- ## </summary>
++##f	Read hal system state
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain to not audit.
++##	</summary>
++## </param>
++#
++interface(`hal_read_state',`
++	gen_require(`
++		type hald_t;
++	')
++	kernel_search_proc($1)
++	allow $1 hald_t:dir list_dir_perms;
++	read_files_pattern($1,hald_t,hald_t)
++	read_lnk_files_pattern($1,hald_t,hald_t)
++	dontaudit $1 hald_t:process ptrace;
++')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.8/policy/modules/services/hal.te
 --- nsaserefpolicy/policy/modules/services/hal.te	2008-06-12 23:37:57.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/hal.te	2008-06-12 23:37:59.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/hal.te	2008-10-08 18:11:12.000000000 -0400
+@@ -1,5 +1,5 @@
+ 
+-policy_module(hal,1.7.1)
++policy_module(hal,1.9.0)
+ 
+ ########################################
+ #
 @@ -49,6 +49,9 @@
  type hald_var_lib_t;
  files_type(hald_var_lib_t)
@@ -11264,6 +11296,15 @@
  ########################################
  #
  # Local policy
+@@ -57,7 +60,7 @@
+ # execute openvt which needs setuid
+ allow hald_t self:capability { chown setuid setgid kill net_admin sys_admin sys_nice dac_override dac_read_search mknod sys_rawio sys_tty_config };
+ dontaudit hald_t self:capability {sys_ptrace sys_tty_config };
+-allow hald_t self:process signal_perms;
++allow hald_t self:process { getattr signal_perms };
+ allow hald_t self:fifo_file rw_fifo_file_perms;
+ allow hald_t self:unix_stream_socket { create_stream_socket_perms connectto };
+ allow hald_t self:unix_dgram_socket create_socket_perms;
 @@ -70,7 +73,7 @@
  manage_files_pattern(hald_t,hald_cache_t,hald_cache_t)
  
@@ -11273,7 +11314,18 @@
  logging_log_filetrans(hald_t,hald_log_t,file)
  
  manage_dirs_pattern(hald_t,hald_tmp_t,hald_tmp_t)
-@@ -93,6 +96,7 @@
+@@ -82,8 +85,9 @@
+ manage_files_pattern(hald_t,hald_var_lib_t,hald_var_lib_t)
+ manage_sock_files_pattern(hald_t,hald_var_lib_t,hald_var_lib_t)
+ 
++manage_dirs_pattern(hald_t,hald_var_run_t,hald_var_run_t)
+ manage_files_pattern(hald_t,hald_var_run_t,hald_var_run_t)
+-files_pid_filetrans(hald_t,hald_var_run_t,file)
++files_pid_filetrans(hald_t,hald_var_run_t,{ dir file })
+ 
+ kernel_read_system_state(hald_t)
+ kernel_read_network_state(hald_t)
+@@ -93,6 +97,7 @@
  kernel_rw_irq_sysctls(hald_t)
  kernel_rw_vm_sysctls(hald_t)
  kernel_write_proc_files(hald_t)
@@ -11281,15 +11333,15 @@
  
  auth_read_pam_console_data(hald_t)
  
-@@ -145,6 +149,7 @@
- fs_list_inotifyfs(hald_t)
- fs_list_auto_mountpoints(hald_t)
- files_getattr_all_mountpoints(hald_t)
-+fstools_getattr_swap_files(hald_t)
- 
- mls_file_read_all_levels(hald_t)
- 
-@@ -155,6 +160,8 @@
+@@ -121,6 +126,7 @@
+ dev_rw_power_management(hald_t)
+ # hal is now execing pm-suspend
+ dev_rw_sysfs(hald_t)
++dev_read_video_dev(hald_t)
+ 
+ domain_use_interactive_fds(hald_t)
+ domain_read_all_domains_state(hald_t)
+@@ -155,6 +161,8 @@
  selinux_compute_relabel_context(hald_t)
  selinux_compute_user_contexts(hald_t)
  
@@ -11298,7 +11350,50 @@
  storage_raw_read_removable_device(hald_t)
  storage_raw_write_removable_device(hald_t)
  storage_raw_read_fixed_disk(hald_t)
-@@ -280,6 +287,10 @@
+@@ -172,6 +180,8 @@
+ init_rw_utmp(hald_t)
+ init_telinit(hald_t)
+ 
++fstools_getattr_swap_files(hald_t)
++
+ libs_use_ld_so(hald_t)
+ libs_use_shared_libs(hald_t)
+ libs_exec_ld_so(hald_t)
+@@ -229,9 +239,7 @@
+ 
+ optional_policy(`
+ 	dbus_system_bus_client_template(hald,hald_t)
+-	dbus_send_system_bus(hald_t)
+ 	dbus_connect_system_bus(hald_t)
+-	allow hald_t self:dbus send_msg;
+ 
+ 	init_dbus_chat_script(hald_t)
+ 
+@@ -246,6 +254,10 @@
+ ')
+ 
+ optional_policy(`
++	gpm_dontaudit_getattr_gpmctl(hald_t)
++')
++
++optional_policy(`
+ 	hotplug_read_config(hald_t)
+ ')
+ 
+@@ -267,6 +279,12 @@
+ ')
+ 
+ optional_policy(`
++	polkit_domtrans_auth(hald_t)
++	polkit_domtrans_resolve(hald_t)
++	polkit_read_lib(hald_t)
++')
++
++optional_policy(`
+ 	rpc_search_nfs_state_data(hald_t)
+ ')
+ 
+@@ -284,16 +302,25 @@
  ')
  
  optional_policy(`
@@ -11306,20 +11401,33 @@
 +')
 +
 +optional_policy(`
- 	updfstab_domtrans(hald_t)
+ 	vbetool_domtrans(hald_t)
  ')
  
-@@ -293,7 +304,9 @@
++optional_policy(`
++	virt_manage_image(hald_t)
++')
++
+ ########################################
+ #
+ # Hal acl local policy
  #
  
  allow hald_acl_t self:capability { dac_override fowner };
-+allow hald_acl_t self:process signal;
- allow hald_acl_t self:fifo_file read_fifo_file_perms;
-+allow hald_acl_t self:unix_dgram_socket create_socket_perms;
+-allow hald_acl_t self:fifo_file read_fifo_file_perms;
++allow hald_acl_t self:process { getattr signal };
++allow hald_acl_t self:fifo_file rw_fifo_file_perms;
  
  domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t)
  allow hald_t hald_acl_t:process signal;
-@@ -306,6 +319,7 @@
+@@ -303,9 +330,14 @@
+ manage_files_pattern(hald_acl_t,hald_var_lib_t,hald_var_lib_t)
+ files_search_var_lib(hald_acl_t)
+ 
++manage_dirs_pattern(hald_acl_t,hald_var_run_t,hald_var_run_t)
++manage_files_pattern(hald_acl_t,hald_var_run_t,hald_var_run_t)
++files_pid_filetrans(hald_acl_t,hald_var_run_t,{ dir file })
++
  corecmd_exec_bin(hald_acl_t)
  
  dev_getattr_all_chr_files(hald_acl_t)
@@ -11327,7 +11435,7 @@
  dev_getattr_generic_usb_dev(hald_acl_t)
  dev_getattr_video_dev(hald_acl_t)
  dev_setattr_video_dev(hald_acl_t)
-@@ -325,6 +339,8 @@
+@@ -325,13 +357,22 @@
  libs_use_ld_so(hald_acl_t)
  libs_use_shared_libs(hald_acl_t)
  
@@ -11335,22 +11443,67 @@
 +
  miscfiles_read_localization(hald_acl_t)
  
++optional_policy(`
++	polkit_domtrans_auth(hald_acl_t)
++	polkit_read_lib(hald_acl_t)
++')
++
  ########################################
-@@ -340,10 +356,14 @@
+ #
+ # Local hald mac policy
+ #
+ 
++allow hald_mac_t self:capability { setgid setuid };
++
+ domtrans_pattern(hald_t, hald_mac_exec_t, hald_mac_t)
+ allow hald_t hald_mac_t:process signal;
+ allow hald_mac_t hald_t:unix_stream_socket connectto;
+@@ -340,9 +381,18 @@
  manage_files_pattern(hald_mac_t,hald_var_lib_t,hald_var_lib_t)
  files_search_var_lib(hald_mac_t)
  
++write_files_pattern(hald_mac_t, hald_log_t, hald_log_t)
++
 +dev_read_raw_memory(hald_mac_t)
  dev_write_raw_memory(hald_mac_t)
 +dev_read_sysfs(hald_mac_t)
  
  files_read_usr_files(hald_mac_t)
- 
++files_read_etc_files(hald_mac_t)
++
 +kernel_read_system_state(hald_mac_t)
 +
++auth_use_nsswitch(hald_mac_t)
+ 
  libs_use_ld_so(hald_mac_t)
  libs_use_shared_libs(hald_mac_t)
+@@ -365,6 +415,8 @@
+ manage_files_pattern(hald_sonypic_t,hald_var_lib_t,hald_var_lib_t)
+ files_search_var_lib(hald_sonypic_t)
+ 
++write_files_pattern(hald_sonypic_t, hald_log_t, hald_log_t)
++
+ files_read_usr_files(hald_sonypic_t)
+ 
+ libs_use_ld_so(hald_sonypic_t)
+@@ -385,6 +437,8 @@
+ manage_files_pattern(hald_keymap_t,hald_var_lib_t,hald_var_lib_t)
+ files_search_var_lib(hald_keymap_t)
  
++write_files_pattern(hald_keymap_t, hald_log_t, hald_log_t)
++
+ dev_rw_input_dev(hald_keymap_t)
+ 
+ files_read_usr_files(hald_keymap_t)
+@@ -393,3 +447,8 @@
+ libs_use_shared_libs(hald_keymap_t)
+ 
+ miscfiles_read_localization(hald_keymap_t)
++
++# This is caused by a bug in hald and PolicyKit.  
++# Should be removed when this is fixed
++cron_read_system_job_lib_files(hald_t)
++
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.if serefpolicy-3.0.8/policy/modules/services/inetd.if
 --- nsaserefpolicy/policy/modules/services/inetd.if	2008-06-12 23:37:57.000000000 -0400
 +++ serefpolicy-3.0.8/policy/modules/services/inetd.if	2008-06-12 23:37:58.000000000 -0400
@@ -12905,7 +13058,7 @@
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.8/policy/modules/services/networkmanager.te
 --- nsaserefpolicy/policy/modules/services/networkmanager.te	2008-06-12 23:37:57.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/networkmanager.te	2008-09-25 15:15:35.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/services/networkmanager.te	2008-10-08 18:10:53.000000000 -0400
 @@ -1,5 +1,5 @@
  
 -policy_module(networkmanager,1.7.1)
@@ -13054,11 +13207,16 @@
  ')
  
  optional_policy(`
-@@ -159,22 +185,25 @@
+@@ -159,22 +185,30 @@
  ')
  
  optional_policy(`
 -	ppp_domtrans(NetworkManager_t)
++	polkit_domtrans_auth(NetworkManager_t)
++	polkit_read_lib(NetworkManager_t)
++')
++
++optional_policy(`
 +	ppp_script_domtrans(NetworkManager_t)
  	ppp_read_pid_files(NetworkManager_t)
  	ppp_signal(NetworkManager_t)
@@ -13720,6 +13878,460 @@
  	rpm_exec(pegasus_t)
  ')
  
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.fc serefpolicy-3.0.8/policy/modules/services/polkit.fc
+--- nsaserefpolicy/policy/modules/services/polkit.fc	1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.0.8/policy/modules/services/polkit.fc	2008-10-08 18:02:52.000000000 -0400
+@@ -0,0 +1,9 @@
++
++/usr/libexec/polkit-read-auth-helper	--	gen_context(system_u:object_r:polkit_auth_exec_t,s0)
++/usr/libexec/polkit-grant-helper.*	--	gen_context(system_u:object_r:polkit_grant_exec_t,s0)
++/usr/libexec/polkit-resolve-exe-helper.* --	gen_context(system_u:object_r:polkit_resolve_exec_t,s0)
++/usr/libexec/polkitd			--	gen_context(system_u:object_r:polkit_exec_t,s0)
++
++/var/lib/PolicyKit(/.*)?			gen_context(system_u:object_r:polkit_var_lib_t,s0)
++/var/run/PolicyKit(/.*)?			gen_context(system_u:object_r:polkit_var_run_t,s0)
++/var/lib/PolicyKit-public(/.*)?			gen_context(system_u:object_r:polkit_var_lib_t,s0)
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.if serefpolicy-3.0.8/policy/modules/services/polkit.if
+--- nsaserefpolicy/policy/modules/services/polkit.if	1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.0.8/policy/modules/services/polkit.if	2008-10-08 18:02:52.000000000 -0400
+@@ -0,0 +1,213 @@
++
++## <summary>policy for polkit_auth</summary>
++
++########################################
++## <summary>
++##	Execute a domain transition to run polkit_auth.
++## </summary>
++## <param name="domain">
++## <summary>
++##	Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`polkit_domtrans_auth',`
++	gen_require(`
++		type polkit_auth_t;
++                type polkit_auth_exec_t;
++	')
++
++	domtrans_pattern($1,polkit_auth_exec_t,polkit_auth_t)
++')
++
++########################################
++## <summary>
++##	Search polkit lib directories.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`polkit_search_lib',`
++	gen_require(`
++		type polkit_var_lib_t;
++	')
++
++	allow $1 polkit_var_lib_t:dir search_dir_perms;
++	files_search_var_lib($1)
++')
++
++########################################
++## <summary>
++##	read polkit lib files
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`polkit_read_lib',`
++	gen_require(`
++		type polkit_var_lib_t;
++	')
++
++	files_search_var_lib($1)
++	read_files_pattern($1, polkit_var_lib_t,  polkit_var_lib_t)
++
++	# Broken placement
++	cron_read_system_job_lib_files($1)
++')
++
++########################################
++## <summary>
++##	Execute a domain transition to run polkit_grant.
++## </summary>
++## <param name="domain">
++## <summary>
++##	Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`polkit_domtrans_grant',`
++	gen_require(`
++		type polkit_grant_t;
++                type polkit_grant_exec_t;
++	')
++
++	domtrans_pattern($1,polkit_grant_exec_t,polkit_grant_t)
++')
++
++########################################
++## <summary>
++##	Execute a domain transition to run polkit_resolve.
++## </summary>
++## <param name="domain">
++## <summary>
++##	Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`polkit_domtrans_resolve',`
++	gen_require(`
++		type polkit_resolve_t;
++                type polkit_resolve_exec_t;
++	')
++
++	domtrans_pattern($1,polkit_resolve_exec_t,polkit_resolve_t)
++
++	allow polkit_resolve_t $1:dir list_dir_perms;
++	read_files_pattern(polkit_resolve_t, $1, $1)
++	read_lnk_files_pattern(polkit_resolve_t, $1, $1)
++	allow polkit_resolve_t $1:process getattr;
++')
++
++########################################
++## <summary>
++##	Execute a policy_grant in the policy_grant domain, and
++##	allow the specified role the policy_grant domain,
++##	and use the caller's terminal.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++## <param name="role">
++##	<summary>
++##	The role to be allowed the load_policy domain.
++##	</summary>
++## </param>
++## <param name="terminal">
++##	<summary>
++##	The type of the terminal allow the load_policy domain to use.
++##	</summary>
++## </param>
++## <rolecap/>
++#
++interface(`polkit_run_grant',`
++	gen_require(`
++		type polkit_grant_t;
++	')
++
++	polkit_domtrans_grant($1)
++	role $2 types polkit_grant_t;
++	allow polkit_grant_t $3:chr_file rw_term_perms;
++	allow $1 polkit_grant_t:process signal;
++	read_files_pattern(polkit_grant_t, $1, $1)
++	allow polkit_grant_t $1:process getattr;
++')
++
++########################################
++## <summary>
++##	Execute a policy_auth in the policy_auth domain, and
++##	allow the specified role the policy_auth domain,
++##	and use the caller's terminal.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++## <param name="role">
++##	<summary>
++##	The role to be allowed the load_policy domain.
++##	</summary>
++## </param>
++## <param name="terminal">
++##	<summary>
++##	The type of the terminal allow the load_policy domain to use.
++##	</summary>
++## </param>
++#
++interface(`polkit_run_auth',`
++	gen_require(`
++		type polkit_auth_t;
++	')
++
++	polkit_domtrans_auth($1)
++	role $2 types polkit_auth_t;
++	allow polkit_auth_t $3:chr_file rw_term_perms;
++')
++
++#######################################
++## <summary>
++##	The per role template for the nsplugin module.
++## </summary>
++## <desc>
++##	<p>
++##	This template creates a derived domains which are used
++##	for nsplugin web browser.
++##	</p>
++##	<p>
++##	This template is invoked automatically for each user, and
++##	generally does not need to be invoked directly
++##	by policy writers.
++##	</p>
++## </desc>
++## <param name="userdomain_prefix">
++##	<summary>
++##	The prefix of the user domain (e.g., user
++##	is the prefix for user_t).
++##	</summary>
++## </param>
++## <param name="user_domain">
++##	<summary>
++##	The type of the user domain.
++##	</summary>
++## </param>
++## <param name="user_role">
++##	<summary>
++##	The role associated with the user domain.
++##	</summary>
++## </param>
++## <rolecap/>
++#
++template(`polkit_per_role_template',`
++	polkit_run_auth($2, $3, { $1_devpts_t $1_tty_device_t })
++	polkit_run_grant($2, $3, { $1_devpts_t $1_tty_device_t })
++	polkit_read_lib($2)
++')
++
+diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.te serefpolicy-3.0.8/policy/modules/services/polkit.te
+--- nsaserefpolicy/policy/modules/services/polkit.te	1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.0.8/policy/modules/services/polkit.te	2008-10-08 18:02:52.000000000 -0400
+@@ -0,0 +1,220 @@
++policy_module(polkit_auth,1.0.0)
++
++########################################
++#
++# Declarations
++#
++
++type polkit_t;
++type polkit_exec_t;
++init_daemon_domain(polkit_t, polkit_exec_t)
++
++type polkit_grant_t;
++type polkit_grant_exec_t;
++init_system_domain(polkit_grant_t, polkit_grant_exec_t)
++
++type polkit_resolve_t;
++type polkit_resolve_exec_t;
++init_system_domain(polkit_resolve_t, polkit_resolve_exec_t)
++
++type polkit_auth_t;
++type polkit_auth_exec_t;
++init_daemon_domain(polkit_auth_t, polkit_auth_exec_t)
++
++type polkit_var_lib_t;
++files_type(polkit_var_lib_t)
++
++type polkit_var_run_t;
++files_pid_file(polkit_var_run_t)
++
++########################################
++#
++# polkit local policy
++#
++
++allow polkit_t self:capability setgid;
++allow polkit_t self:process getattr;
++
++allow polkit_t self:unix_dgram_socket create_socket_perms;
++allow polkit_t self:fifo_file rw_file_perms;
++allow polkit_t self:unix_stream_socket create_stream_socket_perms;
++
++can_exec(polkit_t, polkit_exec_t)
++corecmd_exec_bin(polkit_t)
++
++domain_use_interactive_fds(polkit_t)
++
++files_read_etc_files(polkit_t)
++files_read_usr_files(polkit_t)
++
++fs_list_inotifyfs(polkit_t)
++
++kernel_read_kernel_sysctls(polkit_t)
++
++auth_use_nsswitch(polkit_t)
++
++libs_use_ld_so(polkit_t)
++libs_use_shared_libs(polkit_t)
++
++miscfiles_read_localization(polkit_t)
++
++logging_send_syslog_msg(polkit_t)
++
++manage_files_pattern(polkit_t, polkit_var_lib_t, polkit_var_lib_t)
++
++# pid file
++manage_dirs_pattern(polkit_t,polkit_var_run_t,polkit_var_run_t)
++manage_files_pattern(polkit_t,polkit_var_run_t,polkit_var_run_t)
++files_pid_filetrans(polkit_t,polkit_var_run_t, { file dir })
++
++optional_policy(`
++	dbus_system_domain(polkit_t, polkit_exec_t)
++	optional_policy(`
++		consolekit_dbus_chat(polkit_t)
++	')
++')
++
++########################################
++#
++# polkit_auth local policy
++#
++
++allow polkit_auth_t self:capability setgid;
++allow polkit_auth_t self:process { getattr };
++
++allow polkit_auth_t self:unix_dgram_socket create_socket_perms;
++allow polkit_auth_t self:fifo_file rw_file_perms;
++allow polkit_auth_t self:unix_stream_socket create_stream_socket_perms;
++
++can_exec(polkit_auth_t, polkit_auth_exec_t)
++corecmd_search_bin(polkit_auth_t)
++
++domain_use_interactive_fds(polkit_auth_t)
++
++files_read_etc_files(polkit_auth_t)
++files_read_usr_files(polkit_auth_t)
++
++auth_use_nsswitch(polkit_auth_t)
++
++libs_use_ld_so(polkit_auth_t)
++libs_use_shared_libs(polkit_auth_t)
++
++miscfiles_read_localization(polkit_auth_t)
++
++logging_send_syslog_msg(polkit_auth_t)
++
++manage_files_pattern(polkit_auth_t, polkit_var_lib_t, polkit_var_lib_t)
++
++# pid file
++manage_dirs_pattern(polkit_auth_t,polkit_var_run_t,polkit_var_run_t)
++manage_files_pattern(polkit_auth_t,polkit_var_run_t,polkit_var_run_t)
++files_pid_filetrans(polkit_auth_t,polkit_var_run_t, { file dir })
++
++userdom_append_unpriv_users_home_content_files(polkit_auth_t)
++userdom_dontaudit_read_unpriv_users_home_content_files(polkit_auth_t)
++
++optional_policy(`
++	dbus_system_bus_client_template(polkit_auth, polkit_auth_t)
++	consolekit_dbus_chat(polkit_auth_t)
++	dbus_system_domain(polkit_exec_t, polkit_t)
++')
++
++optional_policy(`
++	hal_getattr(polkit_auth_t)
++	hal_read_state(polkit_auth_t)
++')
++
++########################################
++#
++# polkit_grant local policy
++#
++
++allow polkit_grant_t self:capability setuid;
++allow polkit_grant_t self:process getattr;
++
++allow polkit_grant_t self:unix_dgram_socket create_socket_perms;
++allow polkit_grant_t self:fifo_file rw_file_perms;
++allow polkit_grant_t self:unix_stream_socket create_stream_socket_perms;
++
++can_exec(polkit_grant_t, polkit_grant_exec_t)
++corecmd_search_bin(polkit_grant_t)
++
++files_read_etc_files(polkit_grant_t)
++files_read_usr_files(polkit_grant_t)
++
++auth_use_nsswitch(polkit_grant_t)
++auth_domtrans_chk_passwd(polkit_grant_t)
++
++libs_use_ld_so(polkit_grant_t)
++libs_use_shared_libs(polkit_grant_t)
++
++miscfiles_read_localization(polkit_grant_t)
++
++logging_send_syslog_msg(polkit_grant_t)
++
++polkit_domtrans_auth(polkit_grant_t)
++
++manage_files_pattern(polkit_grant_t,polkit_var_run_t,polkit_var_run_t)
++
++manage_files_pattern(polkit_grant_t, polkit_var_lib_t, polkit_var_lib_t)
++userdom_read_all_users_state(polkit_grant_t)
++
++optional_policy(`
++	dbus_system_bus_client_template(polkit_grant, polkit_grant_t)
++	consolekit_dbus_chat(polkit_grant_t)
++')
++
++gen_require(`
++	type system_crond_var_lib_t;
++')
++manage_files_pattern(polkit_grant_t, system_crond_var_lib_t,  system_crond_var_lib_t)
++
++########################################
++#
++# polkit_resolve local policy
++#
++
++allow polkit_resolve_t self:capability { setuid sys_nice sys_ptrace };
++allow polkit_resolve_t self:process getattr;
++
++allow polkit_resolve_t self:unix_dgram_socket create_socket_perms;
++allow polkit_resolve_t self:fifo_file rw_file_perms;
++allow polkit_resolve_t self:unix_stream_socket create_stream_socket_perms;
++
++read_files_pattern(polkit_resolve_t, polkit_var_lib_t, polkit_var_lib_t)
++
++can_exec(polkit_resolve_t, polkit_resolve_exec_t)
++corecmd_search_bin(polkit_resolve_t)
++
++polkit_domtrans_auth(polkit_resolve_t)
++
++files_read_etc_files(polkit_resolve_t)
++files_read_usr_files(polkit_resolve_t)
++
++auth_use_nsswitch(polkit_resolve_t)
++
++libs_use_ld_so(polkit_resolve_t)
++libs_use_shared_libs(polkit_resolve_t)
++
++miscfiles_read_localization(polkit_resolve_t)
++
++logging_send_syslog_msg(polkit_resolve_t)
++userdom_read_all_users_state(polkit_resolve_t)
++userdom_ptrace_all_users(polkit_resolve_t)
++mcs_ptrace_all(polkit_resolve_t)
++
++optional_policy(`
++	dbus_system_bus_client_template(polkit_resolve, polkit_resolve_t)
++	optional_policy(`
++		consolekit_dbus_chat(polkit_resolve_t)
++	')
++')
++
++optional_policy(`
++	hal_getattr(polkit_resolve_t)
++	hal_read_state(polkit_resolve_t)
++')
++
++optional_policy(`
++	unconfined_ptrace(polkit_resolve_t)
++')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portmap.te serefpolicy-3.0.8/policy/modules/services/portmap.te
 --- nsaserefpolicy/policy/modules/services/portmap.te	2008-06-12 23:37:57.000000000 -0400
 +++ serefpolicy-3.0.8/policy/modules/services/portmap.te	2008-06-12 23:37:58.000000000 -0400
@@ -15937,57 +16549,70 @@
 -')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.fc serefpolicy-3.0.8/policy/modules/services/rsync.fc
 --- nsaserefpolicy/policy/modules/services/rsync.fc	2008-06-12 23:37:57.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/rsync.fc	2008-06-12 23:37:58.000000000 -0400
-@@ -1,2 +1,4 @@
++++ serefpolicy-3.0.8/policy/modules/services/rsync.fc	2008-10-06 08:55:48.000000000 -0400
+@@ -1,2 +1,6 @@
  
  /usr/bin/rsync		--	gen_context(system_u:object_r:rsync_exec_t,s0)
 +
-+/var/log/rsync.log      --	gen_context(system_u:object_r:rsync_log_t,s0)
++/var/log/rsync\.log      --	gen_context(system_u:object_r:rsync_log_t,s0)
++
++/var/run/rsyncd\.lock      --	gen_context(system_u:object_r:rsync_var_run_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.0.8/policy/modules/services/rsync.te
 --- nsaserefpolicy/policy/modules/services/rsync.te	2008-06-12 23:37:57.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/services/rsync.te	2008-06-12 23:37:58.000000000 -0400
-@@ -8,6 +8,13 @@
++++ serefpolicy-3.0.8/policy/modules/services/rsync.te	2008-10-06 08:28:18.000000000 -0400
+@@ -1,5 +1,5 @@
+ 
+-policy_module(rsync,1.5.0)
++policy_module(rsync, 1.6.1)
+ 
+ ########################################
+ #
+@@ -8,20 +8,32 @@
  
  ## <desc>
  ## <p>
-+## Allow rsync export files read only
++## Allow rsync to export any files/directories read only.
 +## </p>
 +## </desc>
-+gen_tunable(rsync_export_all_ro,false)
++gen_tunable(rsync_export_all_ro, false)
 +
 +## <desc>
 +## <p>
  ## Allow rsync to modify public files
- ## used for public file transfer services.
+-## used for public file transfer services.
++## used for public file transfer services.  Files/Directories must be
++## labeled public_content_rw_t.
  ## </p>
-@@ -17,6 +24,7 @@
+ ## </desc>
+-gen_tunable(allow_rsync_anon_write,false)
++gen_tunable(allow_rsync_anon_write, false)
+ 
  type rsync_t;
  type rsync_exec_t;
- init_daemon_domain(rsync_t,rsync_exec_t)
+-init_daemon_domain(rsync_t,rsync_exec_t)
++init_daemon_domain(rsync_t, rsync_exec_t)
 +application_executable_file(rsync_exec_t)
  role system_r types rsync_t;
  
  type rsync_data_t;
-@@ -25,6 +33,9 @@
- type rsync_tmp_t;
- files_tmp_file(rsync_tmp_t)
+ files_type(rsync_data_t)
  
 +type rsync_log_t;
 +logging_log_file(rsync_log_t)
 +
- type rsync_var_run_t;
- files_pid_file(rsync_var_run_t)
+ type rsync_tmp_t;
+ files_tmp_file(rsync_tmp_t)
  
-@@ -33,7 +44,7 @@
+@@ -33,7 +45,7 @@
  # Local policy
  #
  
 -allow rsync_t self:capability sys_chroot;
-+allow rsync_t self:capability { dac_read_search dac_override setuid setgid sys_chroot };
++allow rsync_t self:capability { chown dac_read_search dac_override setuid setgid sys_chroot };
  allow rsync_t self:process signal_perms;
  allow rsync_t self:fifo_file rw_fifo_file_perms;
  allow rsync_t self:tcp_socket create_stream_socket_perms;
-@@ -43,7 +54,6 @@
+@@ -43,19 +55,21 @@
  # cjp: this should probably only be inetd_child_t rules?
  # search home and kerberos also.
  allow rsync_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
@@ -15995,16 +16620,28 @@
  #end for identd
  
  allow rsync_t rsync_data_t:dir list_dir_perms;
-@@ -57,6 +67,8 @@
- manage_files_pattern(rsync_t,rsync_var_run_t,rsync_var_run_t)
- files_pid_filetrans(rsync_t,rsync_var_run_t,file)
+-read_files_pattern(rsync_t,rsync_data_t,rsync_data_t)
+-read_lnk_files_pattern(rsync_t,rsync_data_t,rsync_data_t)
++read_files_pattern(rsync_t, rsync_data_t, rsync_data_t)
++read_lnk_files_pattern(rsync_t, rsync_data_t, rsync_data_t)
++
++manage_files_pattern(rsync_t, rsync_log_t, rsync_log_t)
++logging_log_filetrans(rsync_t, rsync_log_t, file)
+ 
+-manage_dirs_pattern(rsync_t,rsync_tmp_t,rsync_tmp_t)
+-manage_files_pattern(rsync_t,rsync_tmp_t,rsync_tmp_t)
++manage_dirs_pattern(rsync_t, rsync_tmp_t, rsync_tmp_t)
++manage_files_pattern(rsync_t, rsync_tmp_t, rsync_tmp_t)
+ files_tmp_filetrans(rsync_t, rsync_tmp_t, { file dir })
+ 
+-manage_files_pattern(rsync_t,rsync_var_run_t,rsync_var_run_t)
+-files_pid_filetrans(rsync_t,rsync_var_run_t,file)
++manage_files_pattern(rsync_t, rsync_var_run_t, rsync_var_run_t)
++files_pid_filetrans(rsync_t, rsync_var_run_t, file)
  
-+auth_use_nsswitch(rsync_t)
-+
  kernel_read_kernel_sysctls(rsync_t)
  kernel_read_system_state(rsync_t)
- kernel_read_network_state(rsync_t)
-@@ -80,17 +92,18 @@
+@@ -80,17 +94,16 @@
  files_read_etc_files(rsync_t)
  files_search_home(rsync_t)
  
@@ -16015,8 +16652,6 @@
  
  logging_send_syslog_msg(rsync_t)
 -logging_dontaudit_search_logs(rsync_t)
-+manage_files_pattern(rsync_t,rsync_log_t,rsync_log_t)
-+logging_log_filetrans(rsync_t,rsync_log_t,file)
  
  miscfiles_read_localization(rsync_t)
  miscfiles_read_public_files(rsync_t)
@@ -16026,15 +16661,19 @@
  tunable_policy(`allow_rsync_anon_write',`
  	miscfiles_manage_public_files(rsync_t)
  ')
-@@ -107,10 +120,7 @@
- 	inetd_service_domain(rsync_t,rsync_exec_t)
+@@ -104,13 +117,10 @@
  ')
  
--optional_policy(`
--	nis_use_ypbind(rsync_t)
+ optional_policy(`
+-	inetd_service_domain(rsync_t,rsync_exec_t)
 -')
 -
 -optional_policy(`
+-	nis_use_ypbind(rsync_t)
++	inetd_service_domain(rsync_t, rsync_exec_t)
+ ')
+ 
+-optional_policy(`
 -	nscd_socket_use(rsync_t)
 +tunable_policy(`rsync_export_all_ro',`
 +	fs_read_noxattr_fs_files(rsync_t) 
@@ -21918,7 +22557,7 @@
 +
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.0.8/policy/modules/system/miscfiles.if
 --- nsaserefpolicy/policy/modules/system/miscfiles.if	2008-06-12 23:37:57.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/miscfiles.if	2008-06-12 23:37:59.000000000 -0400
++++ serefpolicy-3.0.8/policy/modules/system/miscfiles.if	2008-10-01 08:07:37.000000000 -0400
 @@ -57,6 +57,26 @@
  ## </param>
  ## <rolecap/>


Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-8/selinux-policy.spec,v
retrieving revision 1.645
retrieving revision 1.646
diff -u -r1.645 -r1.646
--- selinux-policy.spec	26 Sep 2008 14:02:50 -0000	1.645
+++ selinux-policy.spec	8 Oct 2008 23:01:30 -0000	1.646
@@ -17,7 +17,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.0.8
-Release: 117%{?dist}
+Release: 118%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -381,6 +381,9 @@
 %endif
 
 %changelog
+* Wed Oct 8 2008 Dan Walsh <dwalsh at redhat.com> 3.0.8-118
+- Add policykit policy
+
 * Thu Sep 25 2008 Dan Walsh <dwalsh at redhat.com> 3.0.8-117
 - Update networkmanager to latest upstream version

More information about the fedora-extras-commits mailing list