rpms/selinux-policy/F-12 booleans-minimum.conf, 1.8, 1.9 modules-minimum.conf, 1.44, 1.45 modules-mls.conf, 1.62, 1.63 modules-targeted.conf, 1.153, 1.154 policy-F12.patch, 1.151, 1.152 selinux-policy.spec, 1.979, 1.980
Daniel J Walsh
dwalsh at fedoraproject.org
Wed Dec 9 19:53:39 UTC 2009
Author: dwalsh
Update of /cvs/extras/rpms/selinux-policy/F-12
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv31690
Modified Files:
booleans-minimum.conf modules-minimum.conf modules-mls.conf
modules-targeted.conf policy-F12.patch selinux-policy.spec
Log Message:
* Wed Dec 9 2009 Dan Walsh <dwalsh at redhat.com> 3.6.32-57
- Allow unconfined_t to send dbus messages to setroubleshoot
Index: booleans-minimum.conf
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-12/booleans-minimum.conf,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -p -r1.8 -r1.9
--- booleans-minimum.conf 15 Oct 2009 20:42:08 -0000 1.8
+++ booleans-minimum.conf 9 Dec 2009 19:53:38 -0000 1.9
@@ -1,4 +1,4 @@
-# Allow making anonymous memory executable, e.g.for runtime-code generation or executable stack.
+ # Allow making anonymous memory executable, e.g.for runtime-code generation or executable stack.
#
allow_execmem = false
Index: modules-minimum.conf
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-12/modules-minimum.conf,v
retrieving revision 1.44
retrieving revision 1.45
diff -u -p -r1.44 -r1.45
--- modules-minimum.conf 7 Dec 2009 22:37:54 -0000 1.44
+++ modules-minimum.conf 9 Dec 2009 19:53:38 -0000 1.45
@@ -757,6 +757,13 @@ kdump = module
kdumpgui = module
# Layer: services
+# Module: ksmtuned
+#
+# Kernel Samepage Merging (KSM) Tuning Daemon
+#
+ksmtuned = module
+
+# Layer: services
# Module: kerberos
#
# MIT Kerberos admin and KDC
@@ -1548,6 +1555,13 @@ sysstat = module
#
tcpd = module
+# Layer: services
+# Module: tgtd
+#
+# Linux Target Framework Daemon.
+#
+tgtd = module
+
# Layer: system
# Module: udev
#
@@ -1583,7 +1597,6 @@ ulogd = module
#
vhostmd = module
-
# Layer: apps
# Module: wine
#
Index: modules-mls.conf
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-12/modules-mls.conf,v
retrieving revision 1.62
retrieving revision 1.63
diff -u -p -r1.62 -r1.63
--- modules-mls.conf 27 Oct 2009 21:53:28 -0000 1.62
+++ modules-mls.conf 9 Dec 2009 19:53:38 -0000 1.63
@@ -1372,6 +1372,13 @@ sysstat = module
#
tcpd = module
+# Layer: services
+# Module: tgtd
+#
+# Linux Target Framework Daemon.
+#
+tgtd = module
+
# Layer: system
# Module: udev
#
Index: modules-targeted.conf
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-12/modules-targeted.conf,v
retrieving revision 1.153
retrieving revision 1.154
diff -u -p -r1.153 -r1.154
--- modules-targeted.conf 7 Dec 2009 22:37:54 -0000 1.153
+++ modules-targeted.conf 9 Dec 2009 19:53:38 -0000 1.154
@@ -757,6 +757,13 @@ kdump = module
kdumpgui = module
# Layer: services
+# Module: ksmtuned
+#
+# Kernel Samepage Merging (KSM) Tuning Daemon
+#
+ksmtuned = module
+
+# Layer: services
# Module: kerberos
#
# MIT Kerberos admin and KDC
@@ -1548,6 +1555,13 @@ sysstat = module
#
tcpd = module
+# Layer: services
+# Module: tgtd
+#
+# Linux Target Framework Daemon.
+#
+tgtd = module
+
# Layer: system
# Module: udev
#
@@ -1583,7 +1597,6 @@ ulogd = module
#
vhostmd = module
-
# Layer: apps
# Module: wine
#
policy-F12.patch:
Makefile | 2
policy/flask/access_vectors | 1
policy/global_tunables | 24
policy/mcs | 10
policy/modules/admin/alsa.te | 2
policy/modules/admin/anaconda.te | 3
policy/modules/admin/brctl.te | 2
policy/modules/admin/certwatch.te | 2
policy/modules/admin/consoletype.te | 3
policy/modules/admin/dmesg.fc | 2
policy/modules/admin/dmesg.te | 10
policy/modules/admin/firstboot.te | 6
policy/modules/admin/kismet.fc | 2
policy/modules/admin/kismet.te | 13
policy/modules/admin/logrotate.te | 27
policy/modules/admin/logwatch.te | 8
policy/modules/admin/mrtg.te | 1
policy/modules/admin/netutils.te | 2
policy/modules/admin/ntop.fc | 5
policy/modules/admin/ntop.if | 158 ++
policy/modules/admin/ntop.te | 40
policy/modules/admin/portage.te | 2
policy/modules/admin/prelink.fc | 1
policy/modules/admin/prelink.if | 4
policy/modules/admin/prelink.te | 77 +
policy/modules/admin/readahead.te | 1
policy/modules/admin/rpm.fc | 21
policy/modules/admin/rpm.if | 344 ++++++
policy/modules/admin/rpm.te | 98 +
policy/modules/admin/shorewall.fc | 6
policy/modules/admin/shorewall.if | 40
policy/modules/admin/shorewall.te | 9
policy/modules/admin/smoltclient.fc | 4
policy/modules/admin/smoltclient.if | 1
policy/modules/admin/smoltclient.te | 66 +
policy/modules/admin/sudo.if | 13
policy/modules/admin/tmpreaper.te | 10
policy/modules/admin/tzdata.te | 2
policy/modules/admin/usermanage.if | 11
policy/modules/admin/usermanage.te | 35
policy/modules/admin/vbetool.te | 14
policy/modules/admin/vpn.te | 4
policy/modules/apps/calamaris.te | 7
policy/modules/apps/chrome.fc | 2
policy/modules/apps/chrome.if | 86 +
policy/modules/apps/chrome.te | 78 +
policy/modules/apps/cpufreqselector.te | 2
policy/modules/apps/execmem.fc | 42
policy/modules/apps/execmem.if | 80 +
policy/modules/apps/execmem.te | 11
policy/modules/apps/firewallgui.fc | 3
policy/modules/apps/firewallgui.if | 23
policy/modules/apps/firewallgui.te | 64 +
policy/modules/apps/gitosis.if | 45
policy/modules/apps/gnome.fc | 12
policy/modules/apps/gnome.if | 170 +++
policy/modules/apps/gnome.te | 99 +
policy/modules/apps/gpg.te | 20
policy/modules/apps/java.fc | 24
policy/modules/apps/java.if | 114 +-
policy/modules/apps/java.te | 19
policy/modules/apps/kdumpgui.fc | 2
policy/modules/apps/kdumpgui.if | 2
policy/modules/apps/kdumpgui.te | 67 +
policy/modules/apps/livecd.fc | 2
policy/modules/apps/livecd.if | 52
policy/modules/apps/livecd.te | 27
policy/modules/apps/loadkeys.te | 6
policy/modules/apps/mono.fc | 2
policy/modules/apps/mono.if | 101 +
policy/modules/apps/mono.te | 9
policy/modules/apps/mozilla.fc | 1
policy/modules/apps/mozilla.if | 68 +
policy/modules/apps/mozilla.te | 23
policy/modules/apps/nsplugin.fc | 11
policy/modules/apps/nsplugin.if | 323 +++++
policy/modules/apps/nsplugin.te | 295 +++++
policy/modules/apps/openoffice.fc | 3
policy/modules/apps/openoffice.if | 93 +
policy/modules/apps/openoffice.te | 11
policy/modules/apps/podsleuth.te | 4
policy/modules/apps/ptchown.if | 25
policy/modules/apps/pulseaudio.if | 2
policy/modules/apps/pulseaudio.te | 13
policy/modules/apps/qemu.fc | 4
policy/modules/apps/qemu.if | 189 +++
policy/modules/apps/qemu.te | 85 +
policy/modules/apps/sambagui.fc | 1
policy/modules/apps/sambagui.if | 2
policy/modules/apps/sambagui.te | 60 +
policy/modules/apps/sandbox.fc | 1
policy/modules/apps/sandbox.if | 188 +++
policy/modules/apps/sandbox.te | 331 +++++
policy/modules/apps/screen.if | 8
policy/modules/apps/sectoolm.fc | 6
policy/modules/apps/sectoolm.if | 3
policy/modules/apps/sectoolm.te | 120 ++
policy/modules/apps/seunshare.fc | 2
policy/modules/apps/seunshare.if | 81 +
policy/modules/apps/seunshare.te | 43
policy/modules/apps/vmware.te | 1
policy/modules/apps/wine.fc | 24
policy/modules/apps/wine.if | 115 ++
policy/modules/apps/wine.te | 34
policy/modules/kernel/corecommands.fc | 45
policy/modules/kernel/corecommands.if | 21
policy/modules/kernel/corenetwork.te.in | 46
policy/modules/kernel/devices.fc | 13
policy/modules/kernel/devices.if | 309 +++++
policy/modules/kernel/devices.te | 25
policy/modules/kernel/domain.if | 170 ++-
policy/modules/kernel/domain.te | 89 +
policy/modules/kernel/files.fc | 5
policy/modules/kernel/files.if | 417 +++++++
policy/modules/kernel/files.te | 6
policy/modules/kernel/filesystem.fc | 2
policy/modules/kernel/filesystem.if | 256 ++++
policy/modules/kernel/filesystem.te | 16
policy/modules/kernel/kernel.if | 98 +
policy/modules/kernel/kernel.te | 32
policy/modules/kernel/selinux.if | 25
policy/modules/kernel/storage.fc | 2
policy/modules/kernel/storage.if | 3
policy/modules/kernel/terminal.fc | 1
policy/modules/kernel/terminal.if | 65 +
policy/modules/kernel/terminal.te | 1
policy/modules/roles/guest.te | 8
policy/modules/roles/staff.te | 124 --
policy/modules/roles/sysadm.te | 127 --
policy/modules/roles/unconfineduser.fc | 8
policy/modules/roles/unconfineduser.if | 667 +++++++++++
policy/modules/roles/unconfineduser.te | 449 +++++++
policy/modules/roles/unprivuser.te | 127 --
policy/modules/roles/xguest.te | 74 +
policy/modules/services/abrt.fc | 6
policy/modules/services/abrt.if | 102 +
policy/modules/services/abrt.te | 110 +
policy/modules/services/afs.fc | 1
policy/modules/services/afs.te | 3
policy/modules/services/aisexec.fc | 12
policy/modules/services/aisexec.if | 106 +
policy/modules/services/aisexec.te | 112 +
policy/modules/services/amavis.te | 2
policy/modules/services/apache.fc | 57 -
policy/modules/services/apache.if | 410 ++++---
policy/modules/services/apache.te | 453 ++++++--
policy/modules/services/apm.te | 6
policy/modules/services/arpwatch.te | 2
policy/modules/services/asterisk.if | 39
policy/modules/services/asterisk.te | 25
policy/modules/services/automount.te | 2
policy/modules/services/avahi.te | 10
policy/modules/services/bind.if | 40
policy/modules/services/bitlbee.te | 2
policy/modules/services/bluetooth.if | 21
policy/modules/services/bluetooth.te | 11
policy/modules/services/ccs.fc | 8
policy/modules/services/ccs.te | 33
policy/modules/services/certmaster.fc | 3
policy/modules/services/certmaster.te | 2
policy/modules/services/chronyd.fc | 11
policy/modules/services/chronyd.if | 105 +
policy/modules/services/chronyd.te | 67 +
policy/modules/services/clamav.te | 18
policy/modules/services/clogd.fc | 4
policy/modules/services/clogd.if | 98 +
policy/modules/services/clogd.te | 62 +
policy/modules/services/cobbler.fc | 2
policy/modules/services/cobbler.if | 44
policy/modules/services/cobbler.te | 5
policy/modules/services/consolekit.fc | 3
policy/modules/services/consolekit.if | 39
policy/modules/services/consolekit.te | 24
policy/modules/services/corosync.fc | 13
policy/modules/services/corosync.if | 108 +
policy/modules/services/corosync.te | 109 +
policy/modules/services/courier.if | 18
policy/modules/services/courier.te | 1
policy/modules/services/cron.fc | 6
policy/modules/services/cron.if | 74 +
policy/modules/services/cron.te | 84 +
policy/modules/services/cups.fc | 13
policy/modules/services/cups.te | 51
policy/modules/services/cvs.te | 1
policy/modules/services/cyrus.te | 1
policy/modules/services/dbus.if | 54
policy/modules/services/dbus.te | 25
policy/modules/services/dcc.te | 8
policy/modules/services/ddclient.if | 25
policy/modules/services/devicekit.fc | 2
policy/modules/services/devicekit.if | 22
policy/modules/services/devicekit.te | 60 -
policy/modules/services/dnsmasq.te | 12
policy/modules/services/dovecot.te | 28
policy/modules/services/exim.te | 5
policy/modules/services/fail2ban.if | 21
policy/modules/services/fail2ban.te | 2
policy/modules/services/fetchmail.te | 3
policy/modules/services/fprintd.te | 4
policy/modules/services/ftp.te | 60 -
policy/modules/services/git.fc | 8
policy/modules/services/git.if | 286 +++++
policy/modules/services/git.te | 166 ++
policy/modules/services/gpm.te | 3
policy/modules/services/gpsd.fc | 5
policy/modules/services/gpsd.if | 27
policy/modules/services/gpsd.te | 14
policy/modules/services/hal.fc | 1
policy/modules/services/hal.if | 18
policy/modules/services/hal.te | 49
policy/modules/services/howl.te | 2
policy/modules/services/inetd.fc | 2
policy/modules/services/inetd.te | 4
policy/modules/services/irqbalance.te | 4
policy/modules/services/kerberos.if | 6
policy/modules/services/kerberos.te | 16
policy/modules/services/kerneloops.te | 2
policy/modules/services/ksmtuned.fc | 5
policy/modules/services/ksmtuned.if | 76 +
policy/modules/services/ksmtuned.te | 46
policy/modules/services/ktalk.te | 1
policy/modules/services/lircd.fc | 2
policy/modules/services/lircd.if | 9
policy/modules/services/lircd.te | 24
policy/modules/services/mailman.te | 4
policy/modules/services/memcached.te | 2
policy/modules/services/milter.if | 2
policy/modules/services/modemmanager.te | 5
policy/modules/services/mta.fc | 2
policy/modules/services/mta.if | 32
policy/modules/services/mta.te | 36
policy/modules/services/munin.fc | 3
policy/modules/services/munin.te | 3
policy/modules/services/mysql.te | 9
policy/modules/services/nagios.fc | 20
policy/modules/services/nagios.if | 89 +
policy/modules/services/nagios.te | 106 +
policy/modules/services/networkmanager.fc | 15
policy/modules/services/networkmanager.if | 65 +
policy/modules/services/networkmanager.te | 117 +-
policy/modules/services/nis.fc | 5
policy/modules/services/nis.if | 87 +
policy/modules/services/nis.te | 13
policy/modules/services/nscd.if | 18
policy/modules/services/nscd.te | 21
policy/modules/services/nslcd.if | 8
policy/modules/services/ntop.te | 14
policy/modules/services/ntp.if | 46
policy/modules/services/ntp.te | 8
policy/modules/services/nut.fc | 16
policy/modules/services/nut.if | 58 +
policy/modules/services/nut.te | 188 +++
policy/modules/services/nx.fc | 7
policy/modules/services/nx.if | 67 +
policy/modules/services/nx.te | 13
policy/modules/services/oddjob.if | 1
policy/modules/services/oddjob.te | 5
policy/modules/services/openvpn.te | 2
policy/modules/services/pcscd.if | 41
policy/modules/services/pcscd.te | 4
policy/modules/services/pegasus.te | 28
policy/modules/services/plymouth.fc | 5
policy/modules/services/plymouth.if | 286 +++++
policy/modules/services/plymouth.te | 101 +
policy/modules/services/policykit.fc | 5
policy/modules/services/policykit.if | 48
policy/modules/services/policykit.te | 65 -
policy/modules/services/portreserve.te | 1
policy/modules/services/postfix.fc | 2
policy/modules/services/postfix.if | 150 ++
policy/modules/services/postfix.te | 142 ++
policy/modules/services/postgresql.fc | 16
policy/modules/services/postgresql.if | 43
policy/modules/services/postgresql.te | 9
policy/modules/services/ppp.if | 6
policy/modules/services/ppp.te | 16
policy/modules/services/prelude.te | 3
policy/modules/services/privoxy.fc | 3
policy/modules/services/privoxy.te | 3
policy/modules/services/procmail.te | 12
policy/modules/services/pyzor.fc | 4
policy/modules/services/pyzor.if | 47
policy/modules/services/pyzor.te | 37
policy/modules/services/radvd.te | 1
policy/modules/services/razor.fc | 1
policy/modules/services/razor.if | 42
policy/modules/services/razor.te | 32
policy/modules/services/rgmanager.fc | 8
policy/modules/services/rgmanager.if | 59 +
policy/modules/services/rgmanager.te | 83 +
policy/modules/services/rhcs.fc | 22
policy/modules/services/rhcs.if | 348 ++++++
policy/modules/services/rhcs.te | 394 +++++++
policy/modules/services/ricci.te | 30
policy/modules/services/rpc.if | 7
policy/modules/services/rpc.te | 19
policy/modules/services/rpcbind.if | 20
policy/modules/services/rpcbind.te | 1
policy/modules/services/rsync.te | 23
policy/modules/services/rtkit.if | 20
policy/modules/services/rtkit.te | 4
policy/modules/services/samba.fc | 4
policy/modules/services/samba.if | 104 +
policy/modules/services/samba.te | 89 +
policy/modules/services/sasl.te | 15
policy/modules/services/sendmail.if | 137 ++
policy/modules/services/sendmail.te | 87 +
policy/modules/services/setroubleshoot.fc | 2
policy/modules/services/setroubleshoot.if | 124 ++
policy/modules/services/setroubleshoot.te | 83 +
policy/modules/services/smartmon.te | 15
policy/modules/services/snmp.if | 38
policy/modules/services/snmp.te | 4
policy/modules/services/snort.te | 1
policy/modules/services/spamassassin.fc | 15
policy/modules/services/spamassassin.if | 89 +
policy/modules/services/spamassassin.te | 139 ++
policy/modules/services/squid.te | 9
policy/modules/services/ssh.fc | 2
policy/modules/services/ssh.if | 207 +++
policy/modules/services/ssh.te | 155 ++
policy/modules/services/sssd.fc | 5
policy/modules/services/sssd.if | 62 +
policy/modules/services/sssd.te | 15
policy/modules/services/sysstat.te | 5
policy/modules/services/tftp.fc | 2
policy/modules/services/tgtd.fc | 3
policy/modules/services/tgtd.if | 28
policy/modules/services/tgtd.te | 69 +
policy/modules/services/tor.te | 13
policy/modules/services/tuned.fc | 6
policy/modules/services/tuned.if | 140 ++
policy/modules/services/tuned.te | 58 +
policy/modules/services/uucp.te | 10
policy/modules/services/vhostmd.fc | 6
policy/modules/services/vhostmd.if | 228 ++++
policy/modules/services/vhostmd.te | 87 +
policy/modules/services/virt.fc | 14
policy/modules/services/virt.if | 210 +++
policy/modules/services/virt.te | 276 ++++
policy/modules/services/w3c.te | 7
policy/modules/services/xserver.fc | 45
policy/modules/services/xserver.if | 635 ++++++++++-
policy/modules/services/xserver.te | 367 +++++-
policy/modules/services/zebra.if | 20
policy/modules/system/application.if | 20
policy/modules/system/application.te | 12
policy/modules/system/authlogin.fc | 9
policy/modules/system/authlogin.if | 210 +++
policy/modules/system/authlogin.te | 10
policy/modules/system/fstools.fc | 3
policy/modules/system/fstools.te | 7
policy/modules/system/init.fc | 7
policy/modules/system/init.if | 163 ++
policy/modules/system/init.te | 290 +++--
policy/modules/system/ipsec.fc | 7
policy/modules/system/ipsec.if | 45
policy/modules/system/ipsec.te | 66 +
policy/modules/system/iptables.fc | 17
policy/modules/system/iptables.if | 97 +
policy/modules/system/iptables.te | 22
policy/modules/system/iscsi.if | 40
policy/modules/system/iscsi.te | 8
policy/modules/system/kdump.te | 5
policy/modules/system/libraries.fc | 184 ++-
policy/modules/system/libraries.if | 5
policy/modules/system/libraries.te | 18
policy/modules/system/locallogin.te | 30
policy/modules/system/logging.fc | 12
policy/modules/system/logging.if | 20
policy/modules/system/logging.te | 38
policy/modules/system/lvm.if | 39
policy/modules/system/lvm.te | 31
policy/modules/system/miscfiles.fc | 1
policy/modules/system/miscfiles.if | 60 +
policy/modules/system/miscfiles.te | 2
policy/modules/system/modutils.fc | 1
policy/modules/system/modutils.if | 46
policy/modules/system/modutils.te | 56
policy/modules/system/mount.fc | 7
policy/modules/system/mount.if | 82 +
policy/modules/system/mount.te | 86 +
policy/modules/system/raid.fc | 2
policy/modules/system/raid.te | 8
policy/modules/system/selinuxutil.fc | 17
policy/modules/system/selinuxutil.if | 309 +++++
policy/modules/system/selinuxutil.te | 229 +---
policy/modules/system/setrans.if | 20
policy/modules/system/sysnetwork.fc | 10
policy/modules/system/sysnetwork.if | 114 +-
policy/modules/system/sysnetwork.te | 79 +
policy/modules/system/udev.fc | 3
policy/modules/system/udev.if | 39
policy/modules/system/udev.te | 39
policy/modules/system/unconfined.fc | 15
policy/modules/system/unconfined.if | 443 -------
policy/modules/system/unconfined.te | 224 ---
policy/modules/system/userdomain.fc | 7
policy/modules/system/userdomain.if | 1685 +++++++++++++++++++++++-------
policy/modules/system/userdomain.te | 51
policy/modules/system/xen.fc | 6
policy/modules/system/xen.if | 47
policy/modules/system/xen.te | 144 ++
policy/support/obj_perm_sets.spt | 31
policy/users | 13
405 files changed, 20690 insertions(+), 2813 deletions(-)
Index: policy-F12.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-12/policy-F12.patch,v
retrieving revision 1.151
retrieving revision 1.152
diff -u -p -r1.151 -r1.152
--- policy-F12.patch 7 Dec 2009 22:37:54 -0000 1.151
+++ policy-F12.patch 9 Dec 2009 19:53:38 -0000 1.152
@@ -5539,7 +5539,7 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/screen.if serefpolicy-3.6.32/policy/modules/apps/screen.if
--- nsaserefpolicy/policy/modules/apps/screen.if 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/apps/screen.if 2009-12-03 13:45:10.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/apps/screen.if 2009-12-07 17:38:21.000000000 -0500
@@ -45,6 +45,7 @@
allow $1_screen_t self:capability { setuid setgid fsetid };
@@ -5568,6 +5568,14 @@ diff -b -B --ignore-all-space --exclude-
auth_use_nsswitch($1_screen_t)
auth_dontaudit_read_shadow($1_screen_t)
auth_dontaudit_exec_utempter($1_screen_t)
+@@ -134,6 +141,7 @@
+ userdom_create_user_pty($1_screen_t)
+ userdom_user_home_domtrans($1_screen_t, $3)
+ userdom_setattr_user_ptys($1_screen_t)
++ userdom_setattr_user_ttys($1_screen_t)
+
+ tunable_policy(`use_samba_home_dirs',`
+ fs_cifs_domtrans($1_screen_t, $3)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sectoolm.fc serefpolicy-3.6.32/policy/modules/apps/sectoolm.fc
--- nsaserefpolicy/policy/modules/apps/sectoolm.fc 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.6.32/policy/modules/apps/sectoolm.fc 2009-12-03 13:45:10.000000000 -0500
@@ -6011,7 +6019,7 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.6.32/policy/modules/apps/wine.te
--- nsaserefpolicy/policy/modules/apps/wine.te 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/apps/wine.te 2009-12-03 13:45:10.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/apps/wine.te 2009-12-09 14:46:30.000000000 -0500
@@ -9,20 +9,46 @@
type wine_t;
type wine_exec_t;
@@ -6054,7 +6062,7 @@ diff -b -B --ignore-all-space --exclude-
')
+
+optional_policy(`
-+ unconfined_domain_noaudit(wine_t)
++ unconfined_domain(wine_t)
+')
+
+optional_policy(`
@@ -6225,7 +6233,7 @@ diff -b -B --ignore-all-space --exclude-
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.6.32/policy/modules/kernel/corenetwork.te.in
--- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/kernel/corenetwork.te.in 2009-12-03 13:45:10.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/kernel/corenetwork.te.in 2009-12-09 09:43:30.000000000 -0500
@@ -65,6 +65,7 @@
type server_packet_t, packet_type, server_packet_type;
@@ -6253,7 +6261,7 @@ diff -b -B --ignore-all-space --exclude-
network_port(dccm, tcp,5679,s0, udp,5679,s0)
-network_port(dhcpc, udp,68,s0)
-network_port(dhcpd, udp,67,s0, tcp,647,s0, udp,647,s0, tcp,847,s0, udp,847,s0, tcp,7911,s0)
-+network_port(dhcpc, udp,68,s0, tcp,68,s0, udp,547,s0, tcp, 547,s0)
++network_port(dhcpc, udp,68,s0, tcp,68,s0, udp,546,s0, tcp, 546,s0, udp,547,s0, tcp, 547,s0)
+network_port(dhcpd, udp,67,s0, udp,548,s0, tcp, 548,s0, tcp,647,s0, udp,647,s0, tcp,847,s0, udp,847,s0, tcp,7911,s0)
network_port(dict, tcp,2628,s0)
network_port(distccd, tcp,3632,s0)
@@ -8973,7 +8981,7 @@ diff -b -B --ignore-all-space --exclude-
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/sysadm.te serefpolicy-3.6.32/policy/modules/roles/sysadm.te
--- nsaserefpolicy/policy/modules/roles/sysadm.te 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/roles/sysadm.te 2009-12-06 09:58:03.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/roles/sysadm.te 2009-12-09 08:30:14.000000000 -0500
@@ -15,7 +15,7 @@
role sysadm_r;
@@ -9089,16 +9097,17 @@ diff -b -B --ignore-all-space --exclude-
hostname_run(sysadm_t, sysadm_r)
')
-@@ -205,6 +171,8 @@
+@@ -205,6 +171,9 @@
ipsec_stream_connect(sysadm_t)
# for lsof
ipsec_getattr_key_sockets(sysadm_t)
+ ipsec_run_setkey(sysadm_t, sysadm_r)
+ ipsec_run_racoon(sysadm_t, sysadm_r)
++ ipsec_stream_connect_racoon(sysadm_t)
')
optional_policy(`
-@@ -212,11 +180,7 @@
+@@ -212,11 +181,7 @@
')
optional_policy(`
@@ -9111,7 +9120,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -228,10 +192,6 @@
+@@ -228,10 +193,6 @@
')
optional_policy(`
@@ -9122,7 +9131,7 @@ diff -b -B --ignore-all-space --exclude-
logrotate_run(sysadm_t, sysadm_r)
')
-@@ -255,14 +215,6 @@
+@@ -255,14 +216,6 @@
')
optional_policy(`
@@ -9137,7 +9146,7 @@ diff -b -B --ignore-all-space --exclude-
mta_role(sysadm_r, sysadm_t)
')
-@@ -290,11 +242,6 @@
+@@ -290,11 +243,6 @@
')
optional_policy(`
@@ -9149,7 +9158,7 @@ diff -b -B --ignore-all-space --exclude-
pcmcia_run_cardctl(sysadm_t, sysadm_r)
')
-@@ -308,7 +255,7 @@
+@@ -308,7 +256,7 @@
')
optional_policy(`
@@ -9158,7 +9167,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -320,10 +267,6 @@
+@@ -320,10 +268,6 @@
')
optional_policy(`
@@ -9169,7 +9178,7 @@ diff -b -B --ignore-all-space --exclude-
rpc_domtrans_nfsd(sysadm_t)
')
-@@ -332,10 +275,6 @@
+@@ -332,10 +276,6 @@
')
optional_policy(`
@@ -9180,7 +9189,7 @@ diff -b -B --ignore-all-space --exclude-
rsync_exec(sysadm_t)
')
-@@ -345,10 +284,6 @@
+@@ -345,10 +285,6 @@
')
optional_policy(`
@@ -9191,7 +9200,7 @@ diff -b -B --ignore-all-space --exclude-
secadm_role_change(sysadm_r)
')
-@@ -358,35 +293,15 @@
+@@ -358,35 +294,15 @@
')
optional_policy(`
@@ -9227,7 +9236,7 @@ diff -b -B --ignore-all-space --exclude-
tripwire_run_siggen(sysadm_t, sysadm_r)
tripwire_run_tripwire(sysadm_t, sysadm_r)
tripwire_run_twadmin(sysadm_t, sysadm_r)
-@@ -394,18 +309,10 @@
+@@ -394,18 +310,10 @@
')
optional_policy(`
@@ -9246,7 +9255,7 @@ diff -b -B --ignore-all-space --exclude-
unconfined_domtrans(sysadm_t)
')
-@@ -418,17 +325,13 @@
+@@ -418,17 +326,13 @@
')
optional_policy(`
@@ -9265,7 +9274,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -440,13 +343,16 @@
+@@ -440,13 +344,16 @@
')
optional_policy(`
@@ -9299,7 +9308,7 @@ diff -b -B --ignore-all-space --exclude-
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.if serefpolicy-3.6.32/policy/modules/roles/unconfineduser.if
--- nsaserefpolicy/policy/modules/roles/unconfineduser.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.32/policy/modules/roles/unconfineduser.if 2009-12-03 13:45:10.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/roles/unconfineduser.if 2009-12-08 16:42:21.000000000 -0500
@@ -0,0 +1,667 @@
+## <summary>Unconfiend user role</summary>
+
@@ -9970,8 +9979,8 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.te serefpolicy-3.6.32/policy/modules/roles/unconfineduser.te
--- nsaserefpolicy/policy/modules/roles/unconfineduser.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.32/policy/modules/roles/unconfineduser.te 2009-12-06 10:20:50.000000000 -0500
-@@ -0,0 +1,444 @@
++++ serefpolicy-3.6.32/policy/modules/roles/unconfineduser.te 2009-12-09 10:12:44.000000000 -0500
+@@ -0,0 +1,449 @@
+policy_module(unconfineduser, 1.0.0)
+
+########################################
@@ -10136,11 +10145,17 @@ diff -b -B --ignore-all-space --exclude-
+
+ optional_policy(`
+ setroubleshoot_dbus_chat(unconfined_usertype)
++ setroubleshoot_dbus_chat_fixit(unconfined_t)
+ ')
+
+ optional_policy(`
+ sandbox_transition(unconfined_usertype, unconfined_r)
+ ')
++
++ optional_policy(`
++ xserver_rw_shm(unconfined_usertype)
++ xserver_run_xauth(unconfined_usertype, unconfined_r)
++ ')
+')
+
+ifdef(`distro_gentoo',`
@@ -10340,8 +10355,6 @@ diff -b -B --ignore-all-space --exclude-
+
+optional_policy(`
+ xserver_run(unconfined_t, unconfined_r)
-+ xserver_rw_shm(unconfined_t)
-+ xserver_run_xauth(unconfined_t, unconfined_r)
+')
+
+########################################
@@ -10399,6 +10412,7 @@ diff -b -B --ignore-all-space --exclude-
+
+allow unconfined_notrans_t self:process { execstack execmem };
+unconfined_domain_noaudit(unconfined_notrans_t)
++userdom_unpriv_usertype(unconfined, unconfined_notrans_t)
+domtrans_pattern(unconfined_t, unconfined_notrans_exec_t, unconfined_notrans_t)
+# Allow SELinux aware applications to request rpm_script execution
+rpm_transition_script(unconfined_notrans_t)
@@ -11288,7 +11302,7 @@ diff -b -B --ignore-all-space --exclude-
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.6.32/policy/modules/services/apache.fc
--- nsaserefpolicy/policy/modules/services/apache.fc 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/apache.fc 2009-12-04 08:24:12.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/apache.fc 2009-12-09 09:34:01.000000000 -0500
@@ -1,12 +1,16 @@
-HOME_DIR/((www)|(web)|(public_html))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0)
+HOME_DIR/((www)|(web)|(public_html)|(public_git))(/.+)? gen_context(system_u:object_r:httpd_user_content_t,s0)
@@ -11323,12 +11337,13 @@ diff -b -B --ignore-all-space --exclude-
/usr/sbin/rotatelogs -- gen_context(system_u:object_r:httpd_rotatelogs_exec_t,s0)
/usr/sbin/suexec -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0)
-@@ -32,12 +39,22 @@
+@@ -32,21 +39,36 @@
/usr/sbin/httpd2-.* -- gen_context(system_u:object_r:httpd_exec_t,s0)
')
+/usr/share/drupal(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
/usr/share/htdig(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
++/usr/share/mythweb(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
+/usr/share/mythweb/mythweb\.pl gen_context(system_u:object_r:httpd_sys_script_exec_t,s0)
+/usr/share/mythtv/mythweather/scripts(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0)
+/usr/share/mythtv/data(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
@@ -11342,11 +11357,15 @@ diff -b -B --ignore-all-space --exclude-
/var/cache/httpd(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0)
+/var/cache/lighttpd(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0)
/var/cache/mason(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0)
+-/var/cache/mod_proxy(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0)
+/var/cache/mediawiki(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0)
- /var/cache/mod_proxy(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0)
++/var/cache/mod_.* gen_context(system_u:object_r:httpd_cache_t,s0)
++/var/cache/mod_gnutls(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0)
/var/cache/mod_ssl(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0)
++/var/cache/php-.* gen_context(system_u:object_r:httpd_cache_t,s0)
/var/cache/php-eaccelerator(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0)
-@@ -46,7 +63,9 @@
+ /var/cache/php-mmcache(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0)
+ /var/cache/rt3(/.*)? gen_context(system_u:object_r:httpd_cache_t,s0)
/var/cache/ssl.*\.sem -- gen_context(system_u:object_r:httpd_cache_t,s0)
/var/lib/cacti/rra(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
@@ -11356,7 +11375,7 @@ diff -b -B --ignore-all-space --exclude-
/var/lib/htdig(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
/var/lib/httpd(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0)
/var/lib/php/session(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0)
-@@ -50,13 +69,17 @@
+@@ -50,13 +72,17 @@
/var/lib/htdig(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0)
/var/lib/httpd(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0)
/var/lib/php/session(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0)
@@ -11374,7 +11393,7 @@ diff -b -B --ignore-all-space --exclude-
ifdef(`distro_debian', `
/var/log/horde2(/.*)? gen_context(system_u:object_r:httpd_log_t,s0)
')
-@@ -64,11 +87,32 @@
+@@ -64,11 +90,32 @@
/var/run/apache.* gen_context(system_u:object_r:httpd_var_run_t,s0)
/var/run/gcache_port -s gen_context(system_u:object_r:httpd_var_run_t,s0)
/var/run/httpd.* gen_context(system_u:object_r:httpd_var_run_t,s0)
@@ -12016,7 +12035,7 @@ diff -b -B --ignore-all-space --exclude-
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.6.32/policy/modules/services/apache.te
--- nsaserefpolicy/policy/modules/services/apache.te 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/apache.te 2009-12-07 16:00:19.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/apache.te 2009-12-09 08:13:29.000000000 -0500
@@ -19,6 +19,8 @@
# Declarations
#
@@ -12926,7 +12945,7 @@ diff -b -B --ignore-all-space --exclude-
## All of the rules required to administrate
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.te serefpolicy-3.6.32/policy/modules/services/asterisk.te
--- nsaserefpolicy/policy/modules/services/asterisk.te 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/asterisk.te 2009-12-07 15:03:47.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/asterisk.te 2009-12-09 08:14:01.000000000 -0500
@@ -34,6 +34,8 @@
type asterisk_var_run_t;
files_pid_file(asterisk_var_run_t)
@@ -12941,7 +12960,7 @@ diff -b -B --ignore-all-space --exclude-
allow asterisk_t self:capability { dac_override setgid setuid sys_nice };
dontaudit asterisk_t self:capability sys_tty_config;
-allow asterisk_t self:process { setsched signal_perms };
-+allow asterisk_t self:process { setsched signal_perms getcap setcap };
++allow asterisk_t self:process { getsched setsched signal_perms getcap setcap };
allow asterisk_t self:fifo_file rw_fifo_file_perms;
allow asterisk_t self:sem create_sem_perms;
allow asterisk_t self:shm create_shm_perms;
@@ -12964,7 +12983,7 @@ diff -b -B --ignore-all-space --exclude-
corenet_all_recvfrom_unlabeled(asterisk_t)
corenet_all_recvfrom_netlabel(asterisk_t)
-@@ -97,6 +103,7 @@
+@@ -97,16 +103,19 @@
corenet_udp_bind_generic_node(asterisk_t)
corenet_tcp_bind_asterisk_port(asterisk_t)
corenet_udp_bind_asterisk_port(asterisk_t)
@@ -12972,7 +12991,11 @@ diff -b -B --ignore-all-space --exclude-
corenet_sendrecv_asterisk_server_packets(asterisk_t)
# for VOIP voice channels.
corenet_tcp_bind_generic_port(asterisk_t)
-@@ -107,6 +114,7 @@
+ corenet_udp_bind_generic_port(asterisk_t)
+ corenet_dontaudit_udp_bind_all_ports(asterisk_t)
+ corenet_sendrecv_generic_server_packets(asterisk_t)
++corenet_tcp_connect_postgresql_port(asterisk_t)
+
dev_read_sysfs(asterisk_t)
dev_read_sound(asterisk_t)
dev_write_sound(asterisk_t)
@@ -12980,7 +13003,7 @@ diff -b -B --ignore-all-space --exclude-
domain_use_interactive_fds(asterisk_t)
-@@ -119,17 +127,17 @@
+@@ -119,17 +128,17 @@
fs_getattr_all_fs(asterisk_t)
fs_search_auto_mountpoints(asterisk_t)
@@ -13001,14 +13024,21 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -140,7 +148,3 @@
- udev_read_db(asterisk_t)
+@@ -137,10 +146,10 @@
+ ')
+
+ optional_policy(`
+- udev_read_db(asterisk_t)
++ postgresql_stream_connect(asterisk_t)
')
-ifdef(`TODO',`
-allow initrc_t asterisk_var_run_t:fifo_file unlink;
-allow sysadm_t asterisk_t:unix_stream_socket { connectto rw_stream_socket_perms };
--')
++optional_policy(`
++ udev_read_db(asterisk_t)
+ ')
++
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.6.32/policy/modules/services/automount.te
--- nsaserefpolicy/policy/modules/services/automount.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/automount.te 2009-12-03 13:45:11.000000000 -0500
@@ -13327,6 +13357,18 @@ diff -b -B --ignore-all-space --exclude-
ifdef(`hide_broken_symptoms', `
corecmd_dontaudit_write_bin_dirs(ccs_t)
files_manage_isid_type_files(ccs_t)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmaster.fc serefpolicy-3.6.32/policy/modules/services/certmaster.fc
+--- nsaserefpolicy/policy/modules/services/certmaster.fc 2009-09-16 10:01:19.000000000 -0400
++++ serefpolicy-3.6.32/policy/modules/services/certmaster.fc 2009-12-09 09:13:51.000000000 -0500
+@@ -3,5 +3,8 @@
+
+ /usr/bin/certmaster -- gen_context(system_u:object_r:certmaster_exec_t,s0)
+
++/var/lib/certmaster(/.*)? gen_context(system_u:object_r:certmaster_var_lib_t,s0)
++
+ /var/log/certmaster(/.*)? gen_context(system_u:object_r:certmaster_var_log_t,s0)
++
+ /var/run/certmaster.* gen_context(system_u:object_r:certmaster_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/certmaster.te serefpolicy-3.6.32/policy/modules/services/certmaster.te
--- nsaserefpolicy/policy/modules/services/certmaster.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/certmaster.te 2009-12-03 13:45:11.000000000 -0500
@@ -14926,7 +14968,7 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.6.32/policy/modules/services/dbus.if
--- nsaserefpolicy/policy/modules/services/dbus.if 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/dbus.if 2009-12-03 14:49:31.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/dbus.if 2009-12-09 09:03:35.000000000 -0500
@@ -42,8 +42,10 @@
gen_require(`
class dbus { send_msg acquire_svc };
@@ -15009,18 +15051,7 @@ diff -b -B --ignore-all-space --exclude-
read_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
files_search_var_lib($1)
-@@ -190,6 +201,10 @@
- files_search_pids($1)
- stream_connect_pattern($1, system_dbusd_var_run_t, system_dbusd_var_run_t, system_dbusd_t)
- dbus_read_config($1)
-+
-+ optional_policy(`
-+ rpm_script_dbus_chat($1)
-+ ')
- ')
-
- #######################################
-@@ -256,7 +271,7 @@
+@@ -256,7 +267,7 @@
########################################
## <summary>
@@ -15029,16 +15060,24 @@ diff -b -B --ignore-all-space --exclude-
## for service (acquire_svc).
## </summary>
## <param name="domain">
-@@ -364,6 +379,8 @@
+@@ -364,6 +375,16 @@
dbus_system_bus_client($1)
dbus_connect_system_bus($1)
+ userdom_dontaudit_search_admin_dir($1)
+
++ optional_policy(`
++ rpm_script_dbus_chat($1)
++ ')
++
++ optional_policy(`
++ unconfined_dbus_send($1)
++ ')
++
ifdef(`hide_broken_symptoms', `
dontaudit $1 system_dbusd_t:netlink_selinux_socket { read write };
')
-@@ -405,3 +422,24 @@
+@@ -405,3 +426,24 @@
typeattribute $1 dbusd_unconfined;
')
@@ -16684,6 +16723,145 @@ diff -b -B --ignore-all-space --exclude-
allow kerneloops_t self:fifo_file rw_file_perms;
manage_files_pattern(kerneloops_t, kerneloops_tmp_t, kerneloops_tmp_t)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmtuned.fc serefpolicy-3.6.32/policy/modules/services/ksmtuned.fc
+--- nsaserefpolicy/policy/modules/services/ksmtuned.fc 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/ksmtuned.fc 2009-12-09 12:13:54.000000000 -0500
+@@ -0,0 +1,5 @@
++/etc/rc\.d/init\.d/ksmtuned -- gen_context(system_u:object_r:ksmtuned_initrc_exec_t,s0)
++
++/usr/sbin/ksmtuned -- gen_context(system_u:object_r:ksmtuned_exec_t,s0)
++
++/var/run/ksmtune\.pid -- gen_context(system_u:object_r:ntpd_var_run_t,s0)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmtuned.if serefpolicy-3.6.32/policy/modules/services/ksmtuned.if
+--- nsaserefpolicy/policy/modules/services/ksmtuned.if 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/ksmtuned.if 2009-12-09 12:16:41.000000000 -0500
+@@ -0,0 +1,76 @@
++
++## <summary>policy for Kernel Samepage Merging (KSM) Tuning Daemon</summary>
++
++########################################
++## <summary>
++## Execute a domain transition to run ksmtuned.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`ksmtuned_domtrans',`
++ gen_require(`
++ type ksmtuned_t, ksmtuned_exec_t;
++ ')
++
++ domtrans_pattern($1, ksmtuned_exec_t, ksmtuned_t)
++')
++
++
++########################################
++## <summary>
++## Execute ksmtuned server in the ksmtuned domain.
++## </summary>
++## <param name="domain">
++## <summary>
++## The type of the process performing this action.
++## </summary>
++## </param>
++#
++interface(`ksmtuned_initrc_domtrans',`
++ gen_require(`
++ type ksmtuned_initrc_exec_t;
++ ')
++
++ init_labeled_script_domtrans($1, ksmtuned_initrc_exec_t)
++')
++
++########################################
++## <summary>
++## All of the rules required to administrate
++## an ksmtuned environment
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++## <param name="role">
++## <summary>
++## Role allowed access.
++## </summary>
++## </param>
++## <rolecap/>
++#
++interface(`ksmtuned_admin',`
++ gen_require(`
++ type ksmtuned_t, ksmtuned_var_run_t;
++ type ksmtuned_initrc_exec_t;
++ ')
++
++ allow $1 ksmtuned_t:process { ptrace signal_perms getattr };
++ read_files_pattern($1, ksmtuned_t, ksmtuned_t)
++
++ files_list_pids($1)
++ admin_pattern($1, ksmtuned_var_run_t)
++
++ # Allow ksmtuned_t to restart the apache service
++ ksmtuned_initrc_domtrans($1)
++ domain_system_change_exemption($1)
++ role_transition $2 ksmtuned_initrc_exec_t system_r;
++ allow $2 system_r;
++
++')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ksmtuned.te serefpolicy-3.6.32/policy/modules/services/ksmtuned.te
+--- nsaserefpolicy/policy/modules/services/ksmtuned.te 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/ksmtuned.te 2009-12-09 12:17:04.000000000 -0500
+@@ -0,0 +1,46 @@
++policy_module(ksmtuned,1.0.0)
++
++########################################
++#
++# Declarations
++#
++
++type ksmtuned_t;
++type ksmtuned_exec_t;
++init_daemon_domain(ksmtuned_t, ksmtuned_exec_t)
++
++permissive ksmtuned_t;
++
++type ksmtuned_initrc_exec_t;
++init_script_file(ksmtuned_initrc_exec_t)
++
++type ksmtuned_var_run_t;
++files_pid_file(ksmtuned_var_run_t)
++
++########################################
++#
++# ksmtuned local policy
++#
++allow ksmtuned_t self:capability sys_ptrace;
++
++# Init script handling
++domain_use_interactive_fds(ksmtuned_t)
++
++# internal communication is often done using fifo and unix sockets.
++allow ksmtuned_t self:fifo_file rw_file_perms;
++allow ksmtuned_t self:unix_stream_socket create_stream_socket_perms;
++
++manage_files_pattern(ksmtuned_t, ksmtuned_var_run_t, ksmtuned_var_run_t)
++files_pid_filetrans(ksmtuned_t, ksmtuned_var_run_t, file)
++
++kernel_read_system_state(ksmtuned_t)
++
++dev_rw_sysfs(ksmtuned_t)
++
++domain_read_all_domains_state(ksmtuned_t)
++
++corecmd_exec_bin(ksmtuned_t)
++
++files_read_etc_files(ksmtuned_t)
++
++miscfiles_read_localization(ksmtuned_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ktalk.te serefpolicy-3.6.32/policy/modules/services/ktalk.te
--- nsaserefpolicy/policy/modules/services/ktalk.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/ktalk.te 2009-12-03 13:45:11.000000000 -0500
@@ -18704,9 +18882,12 @@ diff -b -B --ignore-all-space --exclude-
########################################
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-3.6.32/policy/modules/services/oddjob.te
--- nsaserefpolicy/policy/modules/services/oddjob.te 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/oddjob.te 2009-12-03 13:45:11.000000000 -0500
-@@ -101,7 +101,5 @@
++++ serefpolicy-3.6.32/policy/modules/services/oddjob.te 2009-12-09 09:46:22.000000000 -0500
+@@ -99,9 +99,8 @@
+ seutil_read_default_contexts(oddjob_mkhomedir_t)
+
# Add/remove user home directories
++userdom_manage_user_home_dirs(oddjob_mkhomedir_t)
userdom_home_filetrans_user_home_dir(oddjob_mkhomedir_t)
userdom_manage_user_home_content_dirs(oddjob_mkhomedir_t)
-userdom_manage_user_home_content_files(oddjob_mkhomedir_t)
@@ -19377,7 +19558,7 @@ diff -b -B --ignore-all-space --exclude-
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.6.32/policy/modules/services/policykit.te
--- nsaserefpolicy/policy/modules/services/policykit.te 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/policykit.te 2009-12-06 09:57:32.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/policykit.te 2009-12-09 09:05:31.000000000 -0500
@@ -36,11 +36,12 @@
# policykit local policy
#
@@ -22893,7 +23074,7 @@ diff -b -B --ignore-all-space --exclude-
+/usr/share/setroubleshoot/SetroubleshootFixit\.py* -- gen_context(system_u:object_r:setroubleshoot_fixit_exec_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.6.32/policy/modules/services/setroubleshoot.if
--- nsaserefpolicy/policy/modules/services/setroubleshoot.if 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/setroubleshoot.if 2009-12-03 13:52:03.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/setroubleshoot.if 2009-12-08 16:40:01.000000000 -0500
@@ -16,8 +16,8 @@
')
@@ -23033,7 +23214,7 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.6.32/policy/modules/services/setroubleshoot.te
--- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/setroubleshoot.te 2009-12-03 13:45:11.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/setroubleshoot.te 2009-12-09 09:06:40.000000000 -0500
@@ -22,13 +22,19 @@
type setroubleshoot_var_run_t;
files_pid_file(setroubleshoot_var_run_t)
@@ -23095,7 +23276,7 @@ diff -b -B --ignore-all-space --exclude-
selinux_get_enforce_mode(setroubleshootd_t)
selinux_validate_context(setroubleshootd_t)
-@@ -94,23 +113,76 @@
+@@ -94,23 +113,77 @@
locallogin_dontaudit_use_fds(setroubleshootd_t)
@@ -23173,6 +23354,7 @@ diff -b -B --ignore-all-space --exclude-
+
+optional_policy(`
+ policykit_dbus_chat(setroubleshoot_fixit_t)
++ userdom_read_all_users_state(setroubleshoot_fixit_t)
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.6.32/policy/modules/services/smartmon.te
--- nsaserefpolicy/policy/modules/services/smartmon.te 2009-09-16 10:01:19.000000000 -0400
@@ -24642,6 +24824,118 @@ diff -b -B --ignore-all-space --exclude-
-/var/lib/tftpboot(/.*)? gen_context(system_u:object_r:tftpdir_t,s0)
+/var/lib/tftpboot(/.*)? gen_context(system_u:object_r:tftpdir_rw_t,s0)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tgtd.fc serefpolicy-3.6.32/policy/modules/services/tgtd.fc
+--- nsaserefpolicy/policy/modules/services/tgtd.fc 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/tgtd.fc 2009-12-09 11:49:22.000000000 -0500
+@@ -0,0 +1,3 @@
++/etc/rc\.d/init\.d/tgtd -- gen_context(system_u:object_r:tgtd_initrc_exec_t,s0)
++/usr/sbin/tgtd -- gen_context(system_u:object_r:tgtd_exec_t,s0)
++/var/lib/tgtd(/.*)? gen_context(system_u:object_r:tgtd_var_lib_t,s0)
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tgtd.if serefpolicy-3.6.32/policy/modules/services/tgtd.if
+--- nsaserefpolicy/policy/modules/services/tgtd.if 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/tgtd.if 2009-12-09 11:49:22.000000000 -0500
+@@ -0,0 +1,28 @@
++## <summary>Linux Target Framework Daemon.</summary>
++## <desc>
++## <p>
++## Linux target framework (tgt) aims to simplify various
++## SCSI target driver (iSCSI, Fibre Channel, SRP, etc) creation
++## and maintenance. Our key goals are the clean integration into
++## the scsi-mid layer and implementing a great portion of tgt
++## in user space.
++## </p>
++## </desc>
++
++#####################################
++## <summary>
++## Allow read and write access to tgtd semaphores.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`tgtd_rw_semaphores',`
++ gen_require(`
++ type tgtd_t;
++ ')
++
++ allow $1 tgtd_t:sem { rw_sem_perms };
++')
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tgtd.te serefpolicy-3.6.32/policy/modules/services/tgtd.te
+--- nsaserefpolicy/policy/modules/services/tgtd.te 1969-12-31 19:00:00.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/tgtd.te 2009-12-09 11:50:43.000000000 -0500
+@@ -0,0 +1,69 @@
++
++policy_module(tgtd, 1.0.0)
++
++########################################
++#
++# TGTD personal declarations.
++#
++
++type tgtd_t;
++type tgtd_exec_t;
++init_daemon_domain(tgtd_t, tgtd_exec_t)
++
++permissive tgtd_t;
++
++type tgtd_initrc_exec_t;
++init_script_file(tgtd_initrc_exec_t)
++
++type tgtd_tmp_t;
++files_tmp_file(tgtd_tmp_t)
++
++type tgtd_tmpfs_t;
++files_tmpfs_file(tgtd_tmpfs_t)
++
++type tgtd_var_lib_t;
++files_type(tgtd_var_lib_t)
++
++########################################
++#
++# TGTD personal policy.
++#
++
++allow tgtd_t self:capability sys_resource;
++allow tgtd_t self:process { setrlimit signal };
++allow tgtd_t self:fifo_file rw_fifo_file_perms;
++allow tgtd_t self:netlink_route_socket { create_socket_perms nlmsg_read };
++allow tgtd_t self:shm create_shm_perms;
++allow tgtd_t self:sem create_sem_perms;
++allow tgtd_t self:tcp_socket create_stream_socket_perms;
++allow tgtd_t self:udp_socket create_socket_perms;
++allow tgtd_t self:unix_dgram_socket create_socket_perms;
++
++manage_sock_files_pattern(tgtd_t, tgtd_tmp_t, tgtd_tmp_t)
++files_tmp_filetrans(tgtd_t, tgtd_tmp_t, { sock_file })
++
++manage_files_pattern(tgtd_t, tgtd_tmpfs_t, tgtd_tmpfs_t)
++fs_tmpfs_filetrans(tgtd_t, tgtd_tmpfs_t, file)
++
++manage_dirs_pattern(tgtd_t, tgtd_var_lib_t, tgtd_var_lib_t)
++manage_files_pattern(tgtd_t, tgtd_var_lib_t, tgtd_var_lib_t)
++files_var_lib_filetrans(tgtd_t, tgtd_var_lib_t, { dir file })
++
++kernel_read_fs_sysctls(tgtd_t)
++
++corenet_all_recvfrom_netlabel(tgtd_t)
++corenet_all_recvfrom_unlabeled(tgtd_t)
++corenet_tcp_sendrecv_generic_if(tgtd_t)
++corenet_tcp_sendrecv_generic_node(tgtd_t)
++corenet_tcp_sendrecv_iscsi_port(tgtd_t)
++corenet_tcp_bind_generic_node(tgtd_t)
++corenet_tcp_bind_iscsi_port(tgtd_t)
++corenet_sendrecv_iscsi_server_packets(tgtd_t)
++
++files_read_etc_files(tgtd_t)
++
++storage_getattr_fixed_disk_dev(tgtd_t)
++
++logging_send_syslog_msg(tgtd_t)
++
++miscfiles_read_localization(tgtd_t)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tor.te serefpolicy-3.6.32/policy/modules/services/tor.te
--- nsaserefpolicy/policy/modules/services/tor.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/services/tor.te 2009-12-06 11:07:48.000000000 -0500
@@ -24942,8 +25236,8 @@ diff -b -B --ignore-all-space --exclude-
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/vhostmd.if serefpolicy-3.6.32/policy/modules/services/vhostmd.if
--- nsaserefpolicy/policy/modules/services/vhostmd.if 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.32/policy/modules/services/vhostmd.if 2009-12-06 11:17:52.000000000 -0500
-@@ -0,0 +1,191 @@
++++ serefpolicy-3.6.32/policy/modules/services/vhostmd.if 2009-12-09 12:30:31.000000000 -0500
+@@ -0,0 +1,228 @@
+
+## <summary>policy for vhostmd</summary>
+
@@ -25099,6 +25393,43 @@ diff -b -B --ignore-all-space --exclude-
+ manage_lnk_files_pattern($1, vhostmd_var_run_t, vhostmd_var_run_t)
+')
+
++########################################
++## <summary>
++## Connect to vhostmd over an unix domain stream socket.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`vhostmd_stream_connect',`
++ gen_require(`
++ type vhostmd_t, vhostmd_var_run_t;
++ ')
++
++ files_search_pids($1)
++ stream_connect_pattern($1, vhostmd_var_run_t, vhostmd_var_run_t, vhostmd_t)
++')
++
++#######################################
++## <summary>
++## Dontaudit read and write to vhostmd
++## over an unix domain stream socket.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`vhostmd_dontaudit_rw_stream_connect',`
++ gen_require(`
++ type vhostmd_t;
++ ')
++
++ dontaudit $1 vhostmd_t:unix_stream_socket { read write };
++')
+
+########################################
+## <summary>
@@ -25137,8 +25468,8 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/vhostmd.te serefpolicy-3.6.32/policy/modules/services/vhostmd.te
--- nsaserefpolicy/policy/modules/services/vhostmd.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.32/policy/modules/services/vhostmd.te 2009-12-06 11:17:52.000000000 -0500
-@@ -0,0 +1,79 @@
++++ serefpolicy-3.6.32/policy/modules/services/vhostmd.te 2009-12-09 13:28:25.000000000 -0500
+@@ -0,0 +1,87 @@
+
+policy_module(vhostmd,1.0.0)
+
@@ -25167,12 +25498,12 @@ diff -b -B --ignore-all-space --exclude-
+# vhostmd local policy
+#
+
-+allow vhostmd_t self:capability { setuid setgid };
++allow vhostmd_t self:capability { dac_override ipc_lock setuid setgid };
+allow vhostmd_t self:process { setsched getsched };
+
+# internal communication is often done using fifo and unix sockets.
+allow vhostmd_t self:fifo_file rw_file_perms;
-+allow vhostmd_t self:unix_stream_socket create_stream_socket_perms;
++allow vhostmd_t self:unix_stream_socket { create_stream_socket_perms connectto};
+
+manage_dirs_pattern(vhostmd_t, vhostmd_tmpfs_t, vhostmd_tmpfs_t)
+manage_files_pattern(vhostmd_t, vhostmd_tmpfs_t, vhostmd_tmpfs_t)
@@ -25187,6 +25518,9 @@ diff -b -B --ignore-all-space --exclude-
+
+kernel_read_system_state(vhostmd_t)
+kernel_read_network_state(vhostmd_t)
++kernel_write_xen_state(vhostmd_t)
++
++corenet_tcp_connect_soundd_port(vhostmd_t)
+
+files_read_etc_files(vhostmd_t)
+files_read_usr_files(vhostmd_t)
@@ -25198,6 +25532,9 @@ diff -b -B --ignore-all-space --exclude-
+
+logging_send_syslog_msg(vhostmd_t)
+
++libs_use_ld_so(vhostmd_t)
++libs_use_shared_libs(vhostmd_t)
++
+miscfiles_read_localization(vhostmd_t)
+
+optional_policy(`
@@ -25216,6 +25553,8 @@ diff -b -B --ignore-all-space --exclude-
+optional_policy(`
+ xen_domtrans_xm(vhostmd_t)
+ xen_stream_connect(vhostmd_t)
++ xen_stream_connect_xenstore(vhostmd_t)
++ xen_stream_connect_xm(vhostmd_t)
+')
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.fc serefpolicy-3.6.32/policy/modules/services/virt.fc
@@ -26901,7 +27240,7 @@ diff -b -B --ignore-all-space --exclude-
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.32/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/services/xserver.te 2009-12-03 13:53:23.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/services/xserver.te 2009-12-09 11:40:19.000000000 -0500
@@ -34,6 +34,13 @@
## <desc>
@@ -27040,7 +27379,15 @@ diff -b -B --ignore-all-space --exclude-
files_tmpfs_file(xserver_tmpfs_t)
ubac_constrained(xserver_tmpfs_t)
-@@ -250,25 +269,33 @@
+@@ -236,6 +255,7 @@
+ fs_search_auto_mountpoints(iceauth_t)
+
+ userdom_use_user_terminals(iceauth_t)
++userdom_read_user_tmp_files(iceauth_t)
+
+ tunable_policy(`use_nfs_home_dirs',`
+ fs_manage_nfs_files(iceauth_t)
+@@ -250,25 +270,33 @@
# Xauth local policy
#
@@ -27078,7 +27425,7 @@ diff -b -B --ignore-all-space --exclude-
fs_search_auto_mountpoints(xauth_t)
# cjp: why?
-@@ -278,6 +305,12 @@
+@@ -278,6 +306,12 @@
userdom_use_user_terminals(xauth_t)
userdom_read_user_tmp_files(xauth_t)
@@ -27091,7 +27438,7 @@ diff -b -B --ignore-all-space --exclude-
xserver_rw_xdm_tmp_files(xauth_t)
-@@ -289,6 +322,16 @@
+@@ -289,6 +323,16 @@
fs_manage_cifs_files(xauth_t)
')
@@ -27108,7 +27455,7 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
ssh_sigchld(xauth_t)
ssh_read_pipes(xauth_t)
-@@ -300,20 +343,31 @@
+@@ -300,20 +344,31 @@
# XDM Local policy
#
@@ -27143,7 +27490,7 @@ diff -b -B --ignore-all-space --exclude-
# Allow gdm to run gdm-binary
can_exec(xdm_t, xdm_exec_t)
-@@ -325,26 +379,43 @@
+@@ -325,26 +380,43 @@
# this is ugly, daemons should not create files under /etc!
manage_files_pattern(xdm_t, xdm_rw_etc_t, xdm_rw_etc_t)
@@ -27194,7 +27541,7 @@ diff -b -B --ignore-all-space --exclude-
allow xdm_t xserver_t:process signal;
allow xdm_t xserver_t:unix_stream_socket connectto;
-@@ -358,6 +429,7 @@
+@@ -358,6 +430,7 @@
allow xdm_t xserver_t:process { noatsecure siginh rlimitinh signal sigkill };
allow xdm_t xserver_t:shm rw_shm_perms;
@@ -27202,7 +27549,7 @@ diff -b -B --ignore-all-space --exclude-
# connect to xdm xserver over stream socket
stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t)
-@@ -366,10 +438,14 @@
+@@ -366,10 +439,14 @@
delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)
delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)
@@ -27218,7 +27565,7 @@ diff -b -B --ignore-all-space --exclude-
kernel_read_system_state(xdm_t)
kernel_read_kernel_sysctls(xdm_t)
-@@ -389,11 +465,13 @@
+@@ -389,11 +466,13 @@
corenet_udp_sendrecv_all_ports(xdm_t)
corenet_tcp_bind_generic_node(xdm_t)
corenet_udp_bind_generic_node(xdm_t)
@@ -27232,7 +27579,7 @@ diff -b -B --ignore-all-space --exclude-
dev_read_rand(xdm_t)
dev_read_sysfs(xdm_t)
dev_getattr_framebuffer_dev(xdm_t)
-@@ -401,6 +479,7 @@
+@@ -401,6 +480,7 @@
dev_getattr_mouse_dev(xdm_t)
dev_setattr_mouse_dev(xdm_t)
dev_rw_apm_bios(xdm_t)
@@ -27240,7 +27587,7 @@ diff -b -B --ignore-all-space --exclude-
dev_setattr_apm_bios_dev(xdm_t)
dev_rw_dri(xdm_t)
dev_rw_agp(xdm_t)
-@@ -413,14 +492,17 @@
+@@ -413,14 +493,17 @@
dev_setattr_video_dev(xdm_t)
dev_getattr_scanner_dev(xdm_t)
dev_setattr_scanner_dev(xdm_t)
@@ -27260,12 +27607,14 @@ diff -b -B --ignore-all-space --exclude-
files_read_etc_files(xdm_t)
files_read_var_files(xdm_t)
-@@ -431,9 +513,13 @@
+@@ -431,9 +514,15 @@
files_read_usr_files(xdm_t)
# Poweroff wants to create the /poweroff file when run from xdm
files_create_boot_flag(xdm_t)
+files_dontaudit_getattr_boot_dirs(xdm_t)
+files_dontaudit_write_usr_files(xdm_t)
++files_dontaudit_getattr_all_dirs(xdm_t)
++files_dontaudit_getattr_all_symlinks(xdm_t)
fs_getattr_all_fs(xdm_t)
fs_search_auto_mountpoints(xdm_t)
@@ -27274,7 +27623,7 @@ diff -b -B --ignore-all-space --exclude-
storage_dontaudit_read_fixed_disk(xdm_t)
storage_dontaudit_write_fixed_disk(xdm_t)
-@@ -442,6 +528,7 @@
+@@ -442,6 +531,7 @@
storage_dontaudit_raw_write_removable_device(xdm_t)
storage_dontaudit_setattr_removable_dev(xdm_t)
storage_dontaudit_rw_scsi_generic(xdm_t)
@@ -27282,7 +27631,7 @@ diff -b -B --ignore-all-space --exclude-
term_setattr_console(xdm_t)
term_use_unallocated_ttys(xdm_t)
-@@ -450,6 +537,7 @@
+@@ -450,6 +540,7 @@
auth_domtrans_pam_console(xdm_t)
auth_manage_pam_pid(xdm_t)
auth_manage_pam_console_data(xdm_t)
@@ -27290,7 +27639,7 @@ diff -b -B --ignore-all-space --exclude-
auth_rw_faillog(xdm_t)
auth_write_login_records(xdm_t)
-@@ -460,10 +548,12 @@
+@@ -460,10 +551,12 @@
logging_read_generic_logs(xdm_t)
@@ -27305,7 +27654,7 @@ diff -b -B --ignore-all-space --exclude-
userdom_dontaudit_use_unpriv_user_fds(xdm_t)
userdom_create_all_users_keys(xdm_t)
-@@ -472,6 +562,10 @@
+@@ -472,6 +565,10 @@
# Search /proc for any user domain processes.
userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t)
@@ -27316,7 +27665,7 @@ diff -b -B --ignore-all-space --exclude-
xserver_rw_session(xdm_t, xdm_tmpfs_t)
xserver_unconfined(xdm_t)
-@@ -504,10 +598,12 @@
+@@ -504,10 +601,12 @@
optional_policy(`
alsa_domtrans(xdm_t)
@@ -27329,7 +27678,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -515,12 +611,47 @@
+@@ -515,12 +614,47 @@
')
optional_policy(`
@@ -27377,7 +27726,7 @@ diff -b -B --ignore-all-space --exclude-
hostname_exec(xdm_t)
')
-@@ -535,6 +666,7 @@
+@@ -535,6 +669,7 @@
optional_policy(`
# Do not audit attempts to check whether user root has email
mta_dontaudit_getattr_spool_files(xdm_t)
@@ -27385,7 +27734,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -542,6 +674,38 @@
+@@ -542,6 +677,38 @@
')
optional_policy(`
@@ -27424,7 +27773,7 @@ diff -b -B --ignore-all-space --exclude-
seutil_sigchld_newrole(xdm_t)
')
-@@ -550,8 +714,9 @@
+@@ -550,8 +717,9 @@
')
optional_policy(`
@@ -27436,7 +27785,7 @@ diff -b -B --ignore-all-space --exclude-
ifndef(`distro_redhat',`
allow xdm_t self:process { execheap execmem };
-@@ -560,7 +725,6 @@
+@@ -560,7 +728,6 @@
ifdef(`distro_rhel4',`
allow xdm_t self:process { execheap execmem };
')
@@ -27444,7 +27793,7 @@ diff -b -B --ignore-all-space --exclude-
optional_policy(`
userhelper_dontaudit_search_config(xdm_t)
-@@ -571,6 +735,10 @@
+@@ -571,6 +738,10 @@
')
optional_policy(`
@@ -27455,7 +27804,7 @@ diff -b -B --ignore-all-space --exclude-
xfs_stream_connect(xdm_t)
')
-@@ -587,10 +755,9 @@
+@@ -587,10 +758,9 @@
# execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack
@@ -27467,7 +27816,7 @@ diff -b -B --ignore-all-space --exclude-
allow xserver_t self:fd use;
allow xserver_t self:fifo_file rw_fifo_file_perms;
allow xserver_t self:sock_file read_sock_file_perms;
-@@ -602,9 +769,12 @@
+@@ -602,9 +772,12 @@
allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow xserver_t self:tcp_socket create_stream_socket_perms;
allow xserver_t self:udp_socket create_socket_perms;
@@ -27480,7 +27829,7 @@ diff -b -B --ignore-all-space --exclude-
allow xserver_t { input_xevent_t input_xevent_type }:x_event send;
-@@ -616,13 +786,14 @@
+@@ -616,13 +789,14 @@
type_transition xserver_t xserver_t:{ x_drawable x_colormap } rootwindow_t;
allow xserver_t { rootwindow_t x_domain }:x_drawable send;
@@ -27496,7 +27845,7 @@ diff -b -B --ignore-all-space --exclude-
manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
-@@ -635,9 +806,19 @@
+@@ -635,9 +809,19 @@
manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
files_search_var_lib(xserver_t)
@@ -27516,7 +27865,7 @@ diff -b -B --ignore-all-space --exclude-
kernel_read_system_state(xserver_t)
kernel_read_device_sysctls(xserver_t)
-@@ -671,7 +852,6 @@
+@@ -671,7 +855,6 @@
dev_rw_agp(xserver_t)
dev_rw_framebuffer(xserver_t)
dev_manage_dri_dev(xserver_t)
@@ -27524,7 +27873,7 @@ diff -b -B --ignore-all-space --exclude-
dev_create_generic_dirs(xserver_t)
dev_setattr_generic_dirs(xserver_t)
# raw memory access is needed if not using the frame buffer
-@@ -681,9 +861,12 @@
+@@ -681,9 +864,12 @@
dev_rw_xserver_misc(xserver_t)
# read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev(xserver_t)
@@ -27538,7 +27887,7 @@ diff -b -B --ignore-all-space --exclude-
files_read_etc_files(xserver_t)
files_read_etc_runtime_files(xserver_t)
-@@ -698,8 +881,12 @@
+@@ -698,8 +884,12 @@
fs_search_nfs(xserver_t)
fs_search_auto_mountpoints(xserver_t)
fs_search_ramfs(xserver_t)
@@ -27551,7 +27900,7 @@ diff -b -B --ignore-all-space --exclude-
selinux_validate_context(xserver_t)
selinux_compute_access_vector(xserver_t)
-@@ -721,6 +908,7 @@
+@@ -721,6 +911,7 @@
miscfiles_read_localization(xserver_t)
miscfiles_read_fonts(xserver_t)
@@ -27559,7 +27908,7 @@ diff -b -B --ignore-all-space --exclude-
modutils_domtrans_insmod(xserver_t)
-@@ -743,7 +931,7 @@
+@@ -743,7 +934,7 @@
')
ifdef(`enable_mls',`
@@ -27568,7 +27917,7 @@ diff -b -B --ignore-all-space --exclude-
range_transition xserver_t xserver_t:x_drawable s0 - mls_systemhigh;
')
-@@ -775,12 +963,20 @@
+@@ -775,12 +966,20 @@
')
optional_policy(`
@@ -27590,7 +27939,7 @@ diff -b -B --ignore-all-space --exclude-
unconfined_domtrans(xserver_t)
')
-@@ -807,12 +1003,12 @@
+@@ -807,12 +1006,12 @@
allow xserver_t xdm_var_lib_t:file { getattr read };
dontaudit xserver_t xdm_var_lib_t:dir search;
@@ -27607,7 +27956,7 @@ diff -b -B --ignore-all-space --exclude-
# Run xkbcomp.
allow xserver_t xkb_var_lib_t:lnk_file read;
-@@ -828,9 +1024,14 @@
+@@ -828,9 +1027,14 @@
# to read ROLE_home_t - examine this in more detail
# (xauth?)
userdom_read_user_home_content_files(xserver_t)
@@ -27622,7 +27971,7 @@ diff -b -B --ignore-all-space --exclude-
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(xserver_t)
fs_manage_nfs_files(xserver_t)
-@@ -845,11 +1046,14 @@
+@@ -845,11 +1049,14 @@
optional_policy(`
dbus_system_bus_client(xserver_t)
@@ -27638,7 +27987,7 @@ diff -b -B --ignore-all-space --exclude-
')
optional_policy(`
-@@ -882,6 +1086,8 @@
+@@ -882,6 +1089,8 @@
# X Server
# can read server-owned resources
allow x_domain xserver_t:x_resource read;
@@ -27647,7 +27996,7 @@ diff -b -B --ignore-all-space --exclude-
# can mess with own clients
allow x_domain self:x_client { manage destroy };
-@@ -906,6 +1112,8 @@
+@@ -906,6 +1115,8 @@
# operations allowed on my windows
allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
@@ -27656,7 +28005,7 @@ diff -b -B --ignore-all-space --exclude-
# X Colormaps
# can use the default colormap
allow x_domain rootwindow_t:x_colormap { read use add_color };
-@@ -973,17 +1181,49 @@
+@@ -973,17 +1184,49 @@
allow xserver_unconfined_type { x_domain xserver_t }:x_resource *;
allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *;
@@ -29129,8 +29478,35 @@ diff -b -B --ignore-all-space --exclude-
-/var/run/racoon.pid -- gen_context(system_u:object_r:ipsec_var_run_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.6.32/policy/modules/system/ipsec.if
--- nsaserefpolicy/policy/modules/system/ipsec.if 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/system/ipsec.if 2009-12-03 13:45:11.000000000 -0500
-@@ -229,3 +229,28 @@
++++ serefpolicy-3.6.32/policy/modules/system/ipsec.if 2009-12-09 08:32:17.000000000 -0500
+@@ -39,6 +39,26 @@
+
+ ########################################
+ ## <summary>
++## Connect to racoon using a unix domain stream socket.
++## </summary>
++## <param name="domain">
++## <summary>
++## The type of the process performing this action.
++## </summary>
++## </param>
++#
++interface(`ipsec_stream_connect_racoon',`
++ gen_require(`
++ type racoon_t, ipsec_var_run_t;
++ ')
++
++ files_search_pids($1)
++ stream_connect_pattern($1, ipsec_var_run_t, ipsec_var_run_t, racoon_t)
++')
++
++
++########################################
++## <summary>
+ ## Get the attributes of an IPSEC key socket.
+ ## </summary>
+ ## <param name="domain">
+@@ -229,3 +249,28 @@
ipsec_domtrans_setkey($1)
role $2 types setkey_t;
')
@@ -29614,7 +29990,7 @@ diff -b -B --ignore-all-space --exclude-
+
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.6.32/policy/modules/system/iscsi.te
--- nsaserefpolicy/policy/modules/system/iscsi.te 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/system/iscsi.te 2009-12-03 13:45:11.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/system/iscsi.te 2009-12-09 11:50:12.000000000 -0500
@@ -55,6 +55,7 @@
files_pid_filetrans(iscsid_t, iscsi_var_run_t, file)
@@ -29623,7 +29999,7 @@ diff -b -B --ignore-all-space --exclude-
corenet_all_recvfrom_unlabeled(iscsid_t)
corenet_all_recvfrom_netlabel(iscsid_t)
-@@ -68,11 +69,12 @@
+@@ -68,11 +69,16 @@
dev_rw_sysfs(iscsid_t)
domain_use_interactive_fds(iscsid_t)
@@ -29633,11 +30009,14 @@ diff -b -B --ignore-all-space --exclude-
logging_send_syslog_msg(iscsid_t)
--miscfiles_read_localization(iscsid_t)
+auth_use_nsswitch(iscsid_t)
++
+ miscfiles_read_localization(iscsid_t)
-sysnet_dns_name_resolve(iscsid_t)
-+miscfiles_read_localization(iscsid_t)
++optional_policy(`
++ tgtd_rw_semaphores(iscsid_t)
++')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/kdump.te serefpolicy-3.6.32/policy/modules/system/kdump.te
--- nsaserefpolicy/policy/modules/system/kdump.te 2009-09-16 10:01:19.000000000 -0400
+++ serefpolicy-3.6.32/policy/modules/system/kdump.te 2009-12-03 13:45:11.000000000 -0500
@@ -33459,7 +33838,7 @@ diff -b -B --ignore-all-space --exclude-
+HOME_DIR/\.gvfs(/.*)? <<none>>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.32/policy/modules/system/userdomain.if
--- nsaserefpolicy/policy/modules/system/userdomain.if 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/system/userdomain.if 2009-12-03 17:55:00.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/system/userdomain.if 2009-12-09 09:27:20.000000000 -0500
@@ -30,8 +30,9 @@
')
@@ -35939,7 +36318,7 @@ diff -b -B --ignore-all-space --exclude-
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.6.32/policy/modules/system/xen.if
--- nsaserefpolicy/policy/modules/system/xen.if 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/system/xen.if 2009-12-03 13:45:11.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/system/xen.if 2009-12-09 13:27:42.000000000 -0500
@@ -71,6 +71,8 @@
')
@@ -35949,7 +36328,7 @@ diff -b -B --ignore-all-space --exclude-
read_files_pattern($1,{ xend_var_lib_t xen_image_t },xen_image_t)
')
-@@ -167,11 +169,14 @@
+@@ -167,11 +169,33 @@
#
interface(`xen_stream_connect',`
gen_require(`
@@ -35962,10 +36341,29 @@ diff -b -B --ignore-all-space --exclude-
+
+ files_search_var_lib($1)
+ stream_connect_pattern($1, xend_var_lib_t, xend_var_lib_t, xend_t)
++')
++
++########################################
++## <summary>
++## Connect to xm over an unix stream socket.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`xen_stream_connect_xm',`
++ gen_require(`
++ type xm_t;
++ ')
++
++ files_search_pids($1)
++ stream_connect_pattern($1, xenstored_var_run_t, xenstored_var_run_t, xm_t)
')
########################################
-@@ -191,3 +196,24 @@
+@@ -191,3 +215,24 @@
domtrans_pattern($1, xm_exec_t, xm_t)
')
@@ -35992,7 +36390,7 @@ diff -b -B --ignore-all-space --exclude-
+')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.6.32/policy/modules/system/xen.te
--- nsaserefpolicy/policy/modules/system/xen.te 2009-09-16 10:01:19.000000000 -0400
-+++ serefpolicy-3.6.32/policy/modules/system/xen.te 2009-12-06 11:17:52.000000000 -0500
++++ serefpolicy-3.6.32/policy/modules/system/xen.te 2009-12-09 12:33:06.000000000 -0500
@@ -6,6 +6,13 @@
# Declarations
#
@@ -36219,7 +36617,7 @@ diff -b -B --ignore-all-space --exclude-
files_read_etc_runtime_files(xm_t)
files_read_usr_files(xm_t)
-@@ -339,15 +392,74 @@
+@@ -339,15 +392,76 @@
storage_raw_read_fixed_disk(xm_t)
@@ -36243,7 +36641,9 @@ diff -b -B --ignore-all-space --exclude-
xen_stream_connect_xenstore(xm_t)
+
+optional_policy(`
-+ vhostmd_rw_tmpfs_files(xm_t)
++ vhostmd_rw_tmpfs_files(xm_t)
++ vhostmd_stream_connect(xm_t)
++ vhostmd_dontaudit_rw_stream_connect(xm_t)
+')
+
+optional_policy(`
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/F-12/selinux-policy.spec,v
retrieving revision 1.979
retrieving revision 1.980
diff -u -p -r1.979 -r1.980
--- selinux-policy.spec 7 Dec 2009 22:37:55 -0000 1.979
+++ selinux-policy.spec 9 Dec 2009 19:53:39 -0000 1.980
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.6.32
-Release: 56%{?dist}
+Release: 57%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -449,6 +449,9 @@ exit 0
%endif
%changelog
+* Wed Dec 9 2009 Dan Walsh <dwalsh at redhat.com> 3.6.32-57
+- Allow unconfined_t to send dbus messages to setroubleshoot
+
* Mon Dec 7 2009 Dan Walsh <dwalsh at redhat.com> 3.6.32-56
- Dontaudit exec of fusermount from xguest
- Allow licrd to use mouse_device
More information about the fedora-extras-commits
mailing list