rpms/selinux-policy/devel policy-F13.patch, 1.23, 1.24 selinux-policy.spec, 1.948, 1.949
Daniel J Walsh
dwalsh at fedoraproject.org
Wed Dec 23 18:37:23 UTC 2009
Author: dwalsh
Update of /cvs/pkgs/rpms/selinux-policy/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv1307
Modified Files:
policy-F13.patch selinux-policy.spec
Log Message:
* Wed Dec 23 2009 Dan Walsh <dwalsh at redhat.com> 3.7.5-4
- Cleanups from dgrift
policy-F13.patch:
Makefile | 2
policy/global_tunables | 24
policy/modules/admin/alsa.te | 2
policy/modules/admin/anaconda.te | 3
policy/modules/admin/brctl.te | 2
policy/modules/admin/certwatch.te | 2
policy/modules/admin/consoletype.te | 2
policy/modules/admin/dmesg.fc | 2
policy/modules/admin/dmesg.te | 10
policy/modules/admin/firstboot.te | 6
policy/modules/admin/kismet.te | 5
policy/modules/admin/logrotate.te | 27
policy/modules/admin/logwatch.te | 8
policy/modules/admin/mrtg.te | 1
policy/modules/admin/netutils.te | 2
policy/modules/admin/portage.te | 2
policy/modules/admin/prelink.fc | 1
policy/modules/admin/prelink.if | 23
policy/modules/admin/prelink.te | 78 +
policy/modules/admin/readahead.te | 1
policy/modules/admin/rpm.fc | 21
policy/modules/admin/rpm.if | 344 ++++++
policy/modules/admin/rpm.te | 98 +
policy/modules/admin/shorewall.fc | 5
policy/modules/admin/shorewall.if | 40
policy/modules/admin/shorewall.te | 9
policy/modules/admin/smoltclient.fc | 4
policy/modules/admin/smoltclient.if | 1
policy/modules/admin/smoltclient.te | 66 +
policy/modules/admin/sudo.if | 13
policy/modules/admin/tmpreaper.te | 12
policy/modules/admin/usermanage.if | 11
policy/modules/admin/usermanage.te | 35
policy/modules/admin/vbetool.te | 14
policy/modules/admin/vpn.te | 4
policy/modules/apps/chrome.fc | 2
policy/modules/apps/chrome.if | 86 +
policy/modules/apps/chrome.te | 83 +
policy/modules/apps/cpufreqselector.te | 2
policy/modules/apps/execmem.fc | 42
policy/modules/apps/execmem.if | 103 +
policy/modules/apps/execmem.te | 11
policy/modules/apps/firewallgui.fc | 3
policy/modules/apps/firewallgui.if | 23
policy/modules/apps/firewallgui.te | 64 +
policy/modules/apps/gitosis.if | 45
policy/modules/apps/gnome.fc | 13
policy/modules/apps/gnome.if | 197 +++
policy/modules/apps/gnome.te | 113 +-
policy/modules/apps/java.fc | 23
policy/modules/apps/java.if | 113 +-
policy/modules/apps/java.te | 18
policy/modules/apps/kdumpgui.fc | 2
policy/modules/apps/kdumpgui.if | 2
policy/modules/apps/kdumpgui.te | 67 +
policy/modules/apps/livecd.fc | 2
policy/modules/apps/livecd.if | 52
policy/modules/apps/livecd.te | 27
policy/modules/apps/loadkeys.te | 6
policy/modules/apps/mono.fc | 2
policy/modules/apps/mono.if | 101 +
policy/modules/apps/mono.te | 9
policy/modules/apps/mozilla.fc | 1
policy/modules/apps/mozilla.if | 27
policy/modules/apps/mozilla.te | 22
policy/modules/apps/nsplugin.fc | 11
policy/modules/apps/nsplugin.if | 321 +++++
policy/modules/apps/nsplugin.te | 296 +++++
policy/modules/apps/openoffice.fc | 3
policy/modules/apps/openoffice.if | 92 +
policy/modules/apps/openoffice.te | 11
policy/modules/apps/podsleuth.te | 2
policy/modules/apps/ptchown.if | 24
policy/modules/apps/pulseaudio.fc | 3
policy/modules/apps/pulseaudio.if | 42
policy/modules/apps/pulseaudio.te | 19
policy/modules/apps/qemu.fc | 4
policy/modules/apps/qemu.if | 189 +++
policy/modules/apps/qemu.te | 83 +
policy/modules/apps/sambagui.fc | 1
policy/modules/apps/sambagui.if | 2
policy/modules/apps/sambagui.te | 61 +
policy/modules/apps/sandbox.fc | 1
policy/modules/apps/sandbox.if | 222 +++
policy/modules/apps/sandbox.te | 342 ++++++
policy/modules/apps/screen.if | 1
policy/modules/apps/sectoolm.fc | 6
policy/modules/apps/sectoolm.if | 3
policy/modules/apps/sectoolm.te | 120 ++
policy/modules/apps/seunshare.if | 2
policy/modules/apps/seunshare.te | 3
policy/modules/apps/slocate.te | 1
policy/modules/apps/wine.fc | 24
policy/modules/apps/wine.if | 114 ++
policy/modules/apps/wine.te | 32
policy/modules/kernel/corecommands.fc | 32
policy/modules/kernel/corecommands.if | 21
policy/modules/kernel/corenetwork.te.in | 44
policy/modules/kernel/devices.fc | 3
policy/modules/kernel/devices.if | 54
policy/modules/kernel/domain.if | 174 ++-
policy/modules/kernel/domain.te | 91 +
policy/modules/kernel/files.fc | 5
policy/modules/kernel/files.if | 370 ++++++
policy/modules/kernel/files.te | 3
policy/modules/kernel/filesystem.if | 213 +++
policy/modules/kernel/filesystem.te | 8
policy/modules/kernel/kernel.if | 58 +
policy/modules/kernel/kernel.te | 27
policy/modules/kernel/selinux.if | 25
policy/modules/kernel/storage.fc | 1
policy/modules/kernel/storage.if | 1
policy/modules/kernel/terminal.if | 27
policy/modules/roles/guest.te | 8
policy/modules/roles/staff.te | 124 --
policy/modules/roles/sysadm.te | 125 --
policy/modules/roles/unconfineduser.fc | 8
policy/modules/roles/unconfineduser.if | 667 +++++++++++
policy/modules/roles/unconfineduser.te | 443 +++++++
policy/modules/roles/unprivuser.te | 127 --
policy/modules/roles/xguest.te | 69 +
policy/modules/services/abrt.fc | 8
policy/modules/services/abrt.if | 139 ++
policy/modules/services/abrt.te | 122 ++
policy/modules/services/afs.fc | 2
policy/modules/services/afs.te | 2
policy/modules/services/aisexec.fc | 12
policy/modules/services/aisexec.if | 106 +
policy/modules/services/aisexec.te | 112 ++
policy/modules/services/apache.fc | 55
policy/modules/services/apache.if | 466 +++++---
policy/modules/services/apache.te | 457 ++++++--
policy/modules/services/apm.te | 4
policy/modules/services/arpwatch.te | 2
policy/modules/services/asterisk.if | 41
policy/modules/services/asterisk.te | 35
policy/modules/services/automount.te | 2
policy/modules/services/avahi.te | 13
policy/modules/services/bind.if | 40
policy/modules/services/bluetooth.if | 21
policy/modules/services/bluetooth.te | 12
policy/modules/services/ccs.fc | 8
policy/modules/services/ccs.te | 33
policy/modules/services/certmaster.fc | 1
policy/modules/services/certmonger.fc | 6
policy/modules/services/certmonger.if | 217 +++
policy/modules/services/certmonger.te | 74 +
policy/modules/services/cgroup.fc | 7
policy/modules/services/cgroup.if | 35
policy/modules/services/cgroup.te | 88 +
policy/modules/services/chronyd.fc | 11
policy/modules/services/chronyd.if | 105 +
policy/modules/services/chronyd.te | 67 +
policy/modules/services/clamav.te | 19
policy/modules/services/clogd.fc | 4
policy/modules/services/clogd.if | 98 +
policy/modules/services/clogd.te | 62 +
policy/modules/services/cobbler.fc | 2
policy/modules/services/cobbler.if | 44
policy/modules/services/cobbler.te | 5
policy/modules/services/consolekit.fc | 3
policy/modules/services/consolekit.if | 39
policy/modules/services/consolekit.te | 22
policy/modules/services/corosync.fc | 13
policy/modules/services/corosync.if | 108 +
policy/modules/services/corosync.te | 110 +
policy/modules/services/courier.if | 18
policy/modules/services/courier.te | 1
policy/modules/services/cron.fc | 6
policy/modules/services/cron.if | 74 +
policy/modules/services/cron.te | 84 +
policy/modules/services/cups.fc | 14
policy/modules/services/cups.te | 52
policy/modules/services/cvs.te | 1
policy/modules/services/cyrus.te | 3
policy/modules/services/dbus.if | 53
policy/modules/services/dbus.te | 31
policy/modules/services/dcc.te | 8
policy/modules/services/ddclient.if | 25
policy/modules/services/denyhosts.fc | 7
policy/modules/services/denyhosts.if | 90 +
policy/modules/services/denyhosts.te | 72 +
policy/modules/services/devicekit.fc | 3
policy/modules/services/devicekit.if | 20
policy/modules/services/devicekit.te | 25
policy/modules/services/dnsmasq.te | 12
policy/modules/services/dovecot.fc | 1
policy/modules/services/dovecot.te | 48
policy/modules/services/exim.te | 5
policy/modules/services/fail2ban.if | 40
policy/modules/services/fetchmail.te | 3
policy/modules/services/fprintd.te | 5
policy/modules/services/ftp.te | 64 +
policy/modules/services/git.fc | 8
policy/modules/services/git.if | 286 +++++
policy/modules/services/git.te | 166 ++
policy/modules/services/gpsd.fc | 5
policy/modules/services/gpsd.if | 27
policy/modules/services/gpsd.te | 14
policy/modules/services/hal.fc | 1
policy/modules/services/hal.if | 18
policy/modules/services/hal.te | 50
policy/modules/services/howl.te | 2
policy/modules/services/inetd.fc | 2
policy/modules/services/inetd.te | 4
policy/modules/services/kerberos.if | 6
policy/modules/services/kerberos.te | 3
policy/modules/services/ksmtuned.fc | 5
policy/modules/services/ksmtuned.if | 76 +
policy/modules/services/ksmtuned.te | 46
policy/modules/services/ktalk.te | 1
policy/modules/services/ldap.fc | 2
policy/modules/services/ldap.if | 38
policy/modules/services/lircd.fc | 2
policy/modules/services/lircd.if | 9
policy/modules/services/lircd.te | 24
policy/modules/services/mailman.te | 4
policy/modules/services/memcached.te | 2
policy/modules/services/modemmanager.te | 5
policy/modules/services/mta.fc | 2
policy/modules/services/mta.if | 31
policy/modules/services/mta.te | 36
policy/modules/services/munin.fc | 3
policy/modules/services/munin.te | 6
policy/modules/services/mysql.if | 38
policy/modules/services/mysql.te | 20
policy/modules/services/nagios.fc | 46
policy/modules/services/nagios.if | 126 ++
policy/modules/services/nagios.te | 192 ++-
policy/modules/services/networkmanager.fc | 16
policy/modules/services/networkmanager.if | 65 +
policy/modules/services/networkmanager.te | 118 +-
policy/modules/services/nis.fc | 5
policy/modules/services/nis.if | 87 +
policy/modules/services/nis.te | 13
policy/modules/services/nscd.if | 20
policy/modules/services/nscd.te | 23
policy/modules/services/ntop.fc | 1
policy/modules/services/ntop.te | 34
policy/modules/services/ntp.if | 46
policy/modules/services/ntp.te | 8
policy/modules/services/nut.fc | 16
policy/modules/services/nut.if | 58 +
policy/modules/services/nut.te | 188 +++
policy/modules/services/nx.fc | 10
policy/modules/services/nx.if | 67 +
policy/modules/services/nx.te | 13
policy/modules/services/oddjob.if | 1
policy/modules/services/oddjob.te | 5
policy/modules/services/openvpn.te | 6
policy/modules/services/pcscd.if | 38
policy/modules/services/pegasus.te | 28
policy/modules/services/plymouth.fc | 5
policy/modules/services/plymouth.if | 322 +++++
policy/modules/services/plymouth.te | 102 +
policy/modules/services/policykit.fc | 5
policy/modules/services/policykit.if | 71 +
policy/modules/services/policykit.te | 67 -
policy/modules/services/portreserve.te | 3
policy/modules/services/postfix.fc | 2
policy/modules/services/postfix.if | 150 ++
policy/modules/services/postfix.te | 142 ++
policy/modules/services/postgresql.fc | 16
policy/modules/services/postgresql.if | 60 +
policy/modules/services/postgresql.te | 9
policy/modules/services/ppp.if | 6
policy/modules/services/ppp.te | 16
policy/modules/services/procmail.te | 12
policy/modules/services/pyzor.fc | 4
policy/modules/services/pyzor.if | 47
policy/modules/services/pyzor.te | 37
policy/modules/services/razor.fc | 1
policy/modules/services/razor.if | 42
policy/modules/services/razor.te | 32
policy/modules/services/rdisc.if | 19
policy/modules/services/rgmanager.fc | 8
policy/modules/services/rgmanager.if | 59 +
policy/modules/services/rgmanager.te | 187 +++
policy/modules/services/rhcs.fc | 22
policy/modules/services/rhcs.if | 367 ++++++
policy/modules/services/rhcs.te | 410 +++++++
policy/modules/services/ricci.te | 31
policy/modules/services/rpc.fc | 4
policy/modules/services/rpc.if | 45
policy/modules/services/rpc.te | 27
policy/modules/services/rsync.te | 23
policy/modules/services/rtkit.if | 20
policy/modules/services/rtkit.te | 4
policy/modules/services/samba.fc | 4
policy/modules/services/samba.if | 138 ++
policy/modules/services/samba.te | 91 +
policy/modules/services/sasl.te | 15
policy/modules/services/sendmail.if | 137 ++
policy/modules/services/sendmail.te | 87 +
policy/modules/services/setroubleshoot.fc | 2
policy/modules/services/setroubleshoot.if | 124 ++
policy/modules/services/setroubleshoot.te | 83 +
policy/modules/services/snmp.if | 38
policy/modules/services/snmp.te | 4
policy/modules/services/snort.te | 1
policy/modules/services/spamassassin.fc | 15
policy/modules/services/spamassassin.if | 89 +
policy/modules/services/spamassassin.te | 139 ++
policy/modules/services/squid.te | 9
policy/modules/services/ssh.fc | 2
policy/modules/services/ssh.if | 207 +++
policy/modules/services/ssh.te | 154 ++
policy/modules/services/sssd.fc | 5
policy/modules/services/sssd.if | 80 +
policy/modules/services/sssd.te | 17
policy/modules/services/sysstat.te | 5
policy/modules/services/tftp.fc | 2
policy/modules/services/tgtd.if | 17
policy/modules/services/tor.te | 13
policy/modules/services/tuned.te | 1
policy/modules/services/uucp.te | 10
policy/modules/services/vhostmd.fc | 6
policy/modules/services/vhostmd.if | 228 ++++
policy/modules/services/vhostmd.te | 86 +
policy/modules/services/virt.fc | 13
policy/modules/services/virt.if | 210 +++
policy/modules/services/virt.te | 284 ++++-
policy/modules/services/w3c.te | 7
policy/modules/services/xserver.fc | 40
policy/modules/services/xserver.if | 353 ++++++
policy/modules/services/xserver.te | 364 +++++-
policy/modules/services/zebra.if | 20
policy/modules/system/application.te | 7
policy/modules/system/authlogin.fc | 9
policy/modules/system/authlogin.if | 210 +++
policy/modules/system/authlogin.te | 11
policy/modules/system/fstools.fc | 2
policy/modules/system/fstools.te | 5
policy/modules/system/init.fc | 7
policy/modules/system/init.if | 163 ++
policy/modules/system/init.te | 299 ++++-
policy/modules/system/ipsec.fc | 4
policy/modules/system/ipsec.if | 65 -
policy/modules/system/ipsec.te | 27
policy/modules/system/iptables.fc | 8
policy/modules/system/iptables.te | 8
policy/modules/system/iscsi.te | 7
policy/modules/system/kdump.te | 2
policy/modules/system/libraries.fc | 198 ++-
policy/modules/system/libraries.if | 5
policy/modules/system/libraries.te | 18
policy/modules/system/locallogin.te | 30
policy/modules/system/logging.fc | 12
policy/modules/system/logging.if | 20
policy/modules/system/logging.te | 38
policy/modules/system/lvm.te | 10
policy/modules/system/miscfiles.fc | 3
policy/modules/system/miscfiles.if | 33
policy/modules/system/miscfiles.te | 3
policy/modules/system/modutils.te | 20
policy/modules/system/mount.fc | 7
policy/modules/system/mount.if | 57 +
policy/modules/system/mount.te | 87 +
policy/modules/system/raid.te | 2
policy/modules/system/selinuxutil.fc | 17
policy/modules/system/selinuxutil.if | 309 +++++
policy/modules/system/selinuxutil.te | 229 +---
policy/modules/system/sysnetwork.fc | 12
policy/modules/system/sysnetwork.if | 114 +-
policy/modules/system/sysnetwork.te | 79 +
policy/modules/system/udev.if | 1
policy/modules/system/udev.te | 12
policy/modules/system/unconfined.fc | 15
policy/modules/system/unconfined.if | 443 -------
policy/modules/system/unconfined.te | 224 ----
policy/modules/system/userdomain.fc | 7
policy/modules/system/userdomain.if | 1677 +++++++++++++++++++++++-------
policy/modules/system/userdomain.te | 51
policy/modules/system/xen.if | 19
policy/modules/system/xen.te | 12
policy/support/obj_perm_sets.spt | 20
policy/users | 15
377 files changed, 20020 insertions(+), 2763 deletions(-)
Index: policy-F13.patch
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/devel/policy-F13.patch,v
retrieving revision 1.23
retrieving revision 1.24
diff -u -p -r1.23 -r1.24
--- policy-F13.patch 23 Dec 2009 13:02:27 -0000 1.23
+++ policy-F13.patch 23 Dec 2009 18:37:22 -0000 1.24
@@ -4657,8 +4657,8 @@ diff --exclude-from=exclude -N -u -r nsa
+
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sambagui.te serefpolicy-3.7.5/policy/modules/apps/sambagui.te
--- nsaserefpolicy/policy/modules/apps/sambagui.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.7.5/policy/modules/apps/sambagui.te 2009-12-21 13:07:09.000000000 -0500
-@@ -0,0 +1,60 @@
++++ serefpolicy-3.7.5/policy/modules/apps/sambagui.te 2009-12-23 12:39:59.000000000 -0500
+@@ -0,0 +1,61 @@
+policy_module(sambagui,1.0.0)
+
+########################################
@@ -4675,6 +4675,7 @@ diff --exclude-from=exclude -N -u -r nsa
+# system-config-samba local policy
+#
+
++allow sambagui_t self:capability dac_override;
+allow sambagui_t self:fifo_file rw_fifo_file_perms;
+allow sambagui_t self:unix_dgram_socket create_socket_perms;
+
@@ -4952,8 +4953,8 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.te serefpolicy-3.7.5/policy/modules/apps/sandbox.te
--- nsaserefpolicy/policy/modules/apps/sandbox.te 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.7.5/policy/modules/apps/sandbox.te 2009-12-21 14:43:49.000000000 -0500
-@@ -0,0 +1,340 @@
++++ serefpolicy-3.7.5/policy/modules/apps/sandbox.te 2009-12-23 12:55:41.000000000 -0500
+@@ -0,0 +1,342 @@
+policy_module(sandbox,1.0.0)
+dbus_stub()
+attribute sandbox_domain;
@@ -5196,6 +5197,8 @@ diff --exclude-from=exclude -N -u -r nsa
+allow sandbox_web_client_t self:dbus { acquire_svc send_msg };
+allow sandbox_web_client_t self:netlink_selinux_socket create_socket_perms;
+
++kernel_dontaudit_search_kernel_sysctl(sandbox_web_client_t)
++
+dev_read_rand(sandbox_web_client_t)
+
+# Browse the web, connect to printer
@@ -6455,7 +6458,7 @@ diff --exclude-from=exclude -N -u -r nsa
/var/lib/nfs/rpc_pipefs(/.*)? <<none>>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.7.5/policy/modules/kernel/files.if
--- nsaserefpolicy/policy/modules/kernel/files.if 2009-11-25 11:47:19.000000000 -0500
-+++ serefpolicy-3.7.5/policy/modules/kernel/files.if 2009-12-21 13:07:09.000000000 -0500
++++ serefpolicy-3.7.5/policy/modules/kernel/files.if 2009-12-23 12:48:27.000000000 -0500
@@ -932,10 +932,8 @@
relabel_lnk_files_pattern($1, { file_type $2 }, { file_type $2 })
relabel_fifo_files_pattern($1, { file_type $2 }, { file_type $2 })
@@ -6969,7 +6972,7 @@ diff --exclude-from=exclude -N -u -r nsa
#
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.7.5/policy/modules/kernel/filesystem.if
--- nsaserefpolicy/policy/modules/kernel/filesystem.if 2009-11-25 11:47:19.000000000 -0500
-+++ serefpolicy-3.7.5/policy/modules/kernel/filesystem.if 2009-12-23 07:46:46.000000000 -0500
++++ serefpolicy-3.7.5/policy/modules/kernel/filesystem.if 2009-12-23 08:58:51.000000000 -0500
@@ -906,7 +906,7 @@
type cifs_t;
')
@@ -7014,7 +7017,32 @@ diff --exclude-from=exclude -N -u -r nsa
#########################################
## <summary>
## Read named sockets on a NFS filesystem.
-@@ -4181,3 +4200,175 @@
+@@ -3684,6 +3703,24 @@
+
+ ########################################
+ ## <summary>
++## Search the XENFS filesystem.
++## </summary>
++## <param name="domain">
++## <summary>
++## Domain allowed access.
++## </summary>
++## </param>
++#
++interface(`fs_search_xenfs',`
++ gen_require(`
++ type xenfs_t;
++ ')
++
++ allow $1 xenfs_t:dir search_dir_perms;
++')
++
++########################################
++## <summary>
+ ## Mount a XENFS filesystem.
+ ## </summary>
+ ## <param name="domain">
+@@ -4181,3 +4218,175 @@
relabelfrom_blk_files_pattern($1, noxattrfs, noxattrfs)
relabelfrom_chr_files_pattern($1, noxattrfs, noxattrfs)
')
@@ -12576,7 +12604,7 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cgroup.fc serefpolicy-3.7.5/policy/modules/services/cgroup.fc
--- nsaserefpolicy/policy/modules/services/cgroup.fc 1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.7.5/policy/modules/services/cgroup.fc 2009-12-22 11:06:28.000000000 -0500
++++ serefpolicy-3.7.5/policy/modules/services/cgroup.fc 2009-12-23 13:32:50.000000000 -0500
@@ -0,0 +1,7 @@
+/etc/rc\.d/init\.d/cgconfig -- gen_context(system_u:object_r:cgconfig_initrc_exec_t, s0)
+/etc/rc\.d/init\.d/cgred -- gen_context(system_u:object_r:cgred_initrc_exec_t, s0)
@@ -14100,7 +14128,7 @@ diff --exclude-from=exclude -N -u -r nsa
+/usr/local/linuxprinter/ppd(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.7.5/policy/modules/services/cups.te
--- nsaserefpolicy/policy/modules/services/cups.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.5/policy/modules/services/cups.te 2009-12-21 13:07:09.000000000 -0500
++++ serefpolicy-3.7.5/policy/modules/services/cups.te 2009-12-23 12:11:21.000000000 -0500
@@ -23,6 +23,9 @@
type cupsd_initrc_exec_t;
init_script_file(cupsd_initrc_exec_t)
@@ -14162,7 +14190,15 @@ diff --exclude-from=exclude -N -u -r nsa
corenet_tcp_bind_reserved_port(cupsd_t)
corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t)
corenet_tcp_bind_all_rpc_ports(cupsd_t)
-@@ -250,6 +262,7 @@
+@@ -191,6 +203,7 @@
+
+ fs_getattr_all_fs(cupsd_t)
+ fs_search_auto_mountpoints(cupsd_t)
++fs_search_fusefs(cupsd_t)
+ fs_read_anon_inodefs_files(cupsd_t)
+
+ mls_file_downgrade(cupsd_t)
+@@ -250,6 +263,7 @@
miscfiles_read_localization(cupsd_t)
# invoking ghostscript needs to read fonts
miscfiles_read_fonts(cupsd_t)
@@ -14170,7 +14206,7 @@ diff --exclude-from=exclude -N -u -r nsa
seutil_read_config(cupsd_t)
sysnet_exec_ifconfig(cupsd_t)
-@@ -317,6 +330,10 @@
+@@ -317,6 +331,10 @@
')
optional_policy(`
@@ -14181,7 +14217,7 @@ diff --exclude-from=exclude -N -u -r nsa
udev_read_db(cupsd_t)
')
-@@ -327,7 +344,7 @@
+@@ -327,7 +345,7 @@
allow cupsd_config_t self:capability { chown dac_override sys_tty_config };
dontaudit cupsd_config_t self:capability sys_tty_config;
@@ -14190,7 +14226,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow cupsd_config_t self:fifo_file rw_fifo_file_perms;
allow cupsd_config_t self:unix_stream_socket create_socket_perms;
allow cupsd_config_t self:unix_dgram_socket create_socket_perms;
-@@ -378,6 +395,8 @@
+@@ -378,6 +396,8 @@
dev_read_rand(cupsd_config_t)
dev_rw_generic_usb_dev(cupsd_config_t)
@@ -14199,7 +14235,7 @@ diff --exclude-from=exclude -N -u -r nsa
fs_getattr_all_fs(cupsd_config_t)
fs_search_auto_mountpoints(cupsd_config_t)
-@@ -407,6 +426,7 @@
+@@ -407,6 +427,7 @@
userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t)
userdom_dontaudit_search_user_home_dirs(cupsd_config_t)
@@ -14207,7 +14243,7 @@ diff --exclude-from=exclude -N -u -r nsa
cups_stream_connect(cupsd_config_t)
-@@ -419,12 +439,15 @@
+@@ -419,12 +440,15 @@
')
optional_policy(`
@@ -14225,7 +14261,7 @@ diff --exclude-from=exclude -N -u -r nsa
optional_policy(`
hal_dbus_chat(cupsd_config_t)
-@@ -446,6 +469,10 @@
+@@ -446,6 +470,10 @@
')
optional_policy(`
@@ -14236,7 +14272,7 @@ diff --exclude-from=exclude -N -u -r nsa
rpm_read_db(cupsd_config_t)
')
-@@ -457,6 +484,10 @@
+@@ -457,6 +485,10 @@
udev_read_db(cupsd_config_t)
')
@@ -14247,7 +14283,7 @@ diff --exclude-from=exclude -N -u -r nsa
########################################
#
# Cups lpd support
-@@ -542,6 +573,8 @@
+@@ -542,6 +574,8 @@
manage_dirs_pattern(cups_pdf_t, cups_pdf_tmp_t, cups_pdf_tmp_t)
files_tmp_filetrans(cups_pdf_t, cups_pdf_tmp_t, { file dir })
@@ -14256,7 +14292,7 @@ diff --exclude-from=exclude -N -u -r nsa
kernel_read_system_state(cups_pdf_t)
files_read_etc_files(cups_pdf_t)
-@@ -556,11 +589,15 @@
+@@ -556,11 +590,15 @@
miscfiles_read_fonts(cups_pdf_t)
userdom_home_filetrans_user_home_dir(cups_pdf_t)
@@ -14272,7 +14308,7 @@ diff --exclude-from=exclude -N -u -r nsa
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(cups_pdf_t)
-@@ -601,6 +638,9 @@
+@@ -601,6 +639,9 @@
read_lnk_files_pattern(hplip_t, hplip_etc_t, hplip_etc_t)
files_search_etc(hplip_t)
@@ -14282,7 +14318,7 @@ diff --exclude-from=exclude -N -u -r nsa
manage_fifo_files_pattern(hplip_t, hplip_tmp_t, hplip_tmp_t)
files_tmp_filetrans(hplip_t, hplip_tmp_t, fifo_file )
-@@ -627,6 +667,7 @@
+@@ -627,6 +668,7 @@
corenet_tcp_connect_ipp_port(hplip_t)
corenet_sendrecv_hplip_client_packets(hplip_t)
corenet_receive_hplip_server_packets(hplip_t)
@@ -14954,7 +14990,7 @@ diff --exclude-from=exclude -N -u -r nsa
/var/spool/dovecot(/.*)? gen_context(system_u:object_r:dovecot_spool_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.7.5/policy/modules/services/dovecot.te
--- nsaserefpolicy/policy/modules/services/dovecot.te 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.5/policy/modules/services/dovecot.te 2009-12-22 15:39:45.000000000 -0500
++++ serefpolicy-3.7.5/policy/modules/services/dovecot.te 2009-12-23 12:49:57.000000000 -0500
@@ -56,7 +56,7 @@
allow dovecot_t self:capability { dac_override dac_read_search chown net_bind_service setgid setuid sys_chroot };
@@ -14964,10 +15000,15 @@ diff --exclude-from=exclude -N -u -r nsa
allow dovecot_t self:fifo_file rw_fifo_file_perms;
allow dovecot_t self:tcp_socket create_stream_socket_perms;
allow dovecot_t self:unix_dgram_socket create_socket_perms;
-@@ -73,8 +73,9 @@
+@@ -73,8 +73,14 @@
can_exec(dovecot_t, dovecot_exec_t)
++# Allow dovecot to create and read SSL parameters file
++manage_files_pattern(dovecot_t, dovecot_var_lib_t, dovecot_var_lib_t)
++files_search_var_lib(dovecot_t)
++files_read_var_symlinks(dovecot_t)
++
+manage_dirs_pattern(dovecot_t, dovecot_var_log_t, dovecot_var_log_t)
manage_files_pattern(dovecot_t, dovecot_var_log_t, dovecot_var_log_t)
-logging_log_filetrans(dovecot_t, dovecot_var_log_t, file)
@@ -14975,7 +15016,7 @@ diff --exclude-from=exclude -N -u -r nsa
manage_dirs_pattern(dovecot_t, dovecot_spool_t, dovecot_spool_t)
manage_files_pattern(dovecot_t, dovecot_spool_t, dovecot_spool_t)
-@@ -103,6 +104,7 @@
+@@ -103,6 +109,7 @@
dev_read_urand(dovecot_t)
fs_getattr_all_fs(dovecot_t)
@@ -14983,7 +15024,7 @@ diff --exclude-from=exclude -N -u -r nsa
fs_search_auto_mountpoints(dovecot_t)
fs_list_inotifyfs(dovecot_t)
-@@ -142,6 +144,10 @@
+@@ -142,6 +149,10 @@
')
optional_policy(`
@@ -14994,7 +15035,7 @@ diff --exclude-from=exclude -N -u -r nsa
seutil_sigchld_newrole(dovecot_t)
')
-@@ -159,7 +165,7 @@
+@@ -159,7 +170,7 @@
#
allow dovecot_auth_t self:capability { chown dac_override setgid setuid };
@@ -15003,6 +15044,30 @@ diff --exclude-from=exclude -N -u -r nsa
allow dovecot_auth_t self:fifo_file rw_fifo_file_perms;
allow dovecot_auth_t self:unix_dgram_socket create_socket_perms;
allow dovecot_auth_t self:unix_stream_socket create_stream_socket_perms;
+@@ -172,11 +183,6 @@
+ manage_files_pattern(dovecot_auth_t, dovecot_auth_tmp_t, dovecot_auth_tmp_t)
+ files_tmp_filetrans(dovecot_auth_t, dovecot_auth_tmp_t, { file dir })
+
+-# Allow dovecot to create and read SSL parameters file
+-manage_files_pattern(dovecot_t, dovecot_var_lib_t, dovecot_var_lib_t)
+-files_search_var_lib(dovecot_t)
+-files_read_var_symlinks(dovecot_t)
+-
+ allow dovecot_auth_t dovecot_var_run_t:dir list_dir_perms;
+ manage_sock_files_pattern(dovecot_auth_t, dovecot_var_run_t, dovecot_var_run_t)
+ dovecot_stream_connect_auth(dovecot_auth_t)
+@@ -197,9 +203,9 @@
+ files_search_pids(dovecot_auth_t)
+ files_read_usr_files(dovecot_auth_t)
+ files_read_usr_symlinks(dovecot_auth_t)
++files_read_var_lib_files(dovecot_auth_t)
+ files_search_tmp(dovecot_auth_t)
+-files_read_var_lib_files(dovecot_t)
+-
++files_search_var_log(dovecot_auth_t)
+ init_rw_utmp(dovecot_auth_t)
+
+ miscfiles_read_localization(dovecot_auth_t)
@@ -220,15 +226,23 @@
')
@@ -16761,7 +16826,7 @@ diff --exclude-from=exclude -N -u -r nsa
## Send a generic signal to MySQL.
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.7.5/policy/modules/services/mysql.te
--- nsaserefpolicy/policy/modules/services/mysql.te 2009-12-18 11:38:25.000000000 -0500
-+++ serefpolicy-3.7.5/policy/modules/services/mysql.te 2009-12-21 13:07:09.000000000 -0500
++++ serefpolicy-3.7.5/policy/modules/services/mysql.te 2009-12-23 12:06:39.000000000 -0500
@@ -1,6 +1,13 @@
policy_module(mysql, 1.11.1)
@@ -16788,7 +16853,7 @@ diff --exclude-from=exclude -N -u -r nsa
ifdef(`distro_redhat',`
# because Fedora has the sock_file in the database directory
type_transition mysqld_t mysqld_db_t:sock_file mysqld_var_run_t;
-@@ -131,20 +143,22 @@
+@@ -131,20 +143,24 @@
# Local mysqld_safe policy
#
@@ -16806,6 +16871,8 @@ diff --exclude-from=exclude -N -u -r nsa
domain_read_all_domains_state(mysqld_safe_t)
++files_dontaudit_search_all_mountpoints(mysqld_safe_t)
++
logging_log_filetrans(mysqld_safe_t, mysqld_log_t, file)
kernel_read_system_state(mysqld_safe_t)
@@ -19336,7 +19403,7 @@ diff --exclude-from=exclude -N -u -r nsa
')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.te serefpolicy-3.7.5/policy/modules/services/policykit.te
--- nsaserefpolicy/policy/modules/services/policykit.te 2009-11-17 10:54:26.000000000 -0500
-+++ serefpolicy-3.7.5/policy/modules/services/policykit.te 2009-12-21 13:07:09.000000000 -0500
++++ serefpolicy-3.7.5/policy/modules/services/policykit.te 2009-12-23 12:07:18.000000000 -0500
@@ -36,11 +36,12 @@
# policykit local policy
#
@@ -19354,7 +19421,7 @@ diff --exclude-from=exclude -N -u -r nsa
policykit_domtrans_auth(policykit_t)
-@@ -57,32 +58,52 @@
+@@ -57,10 +58,14 @@
manage_files_pattern(policykit_t, policykit_var_run_t, policykit_var_run_t)
files_pid_filetrans(policykit_t, policykit_var_run_t, { file dir })
@@ -19363,12 +19430,13 @@ diff --exclude-from=exclude -N -u -r nsa
files_read_etc_files(policykit_t)
files_read_usr_files(policykit_t)
-
-+fs_list_inotifyfs(policykit_t)
++files_dontaudit_search_all_mountpoints(policykit_t)
+
++fs_list_inotifyfs(policykit_t)
+
auth_use_nsswitch(policykit_t)
- logging_send_syslog_msg(policykit_t)
+@@ -68,21 +73,38 @@
miscfiles_read_localization(policykit_t)
@@ -19411,7 +19479,7 @@ diff --exclude-from=exclude -N -u -r nsa
rw_files_pattern(policykit_auth_t, policykit_reload_t, policykit_reload_t)
-@@ -92,21 +113,25 @@
+@@ -92,21 +114,25 @@
manage_files_pattern(policykit_auth_t, policykit_var_run_t, policykit_var_run_t)
files_pid_filetrans(policykit_auth_t, policykit_var_run_t, { file dir })
@@ -19440,7 +19508,7 @@ diff --exclude-from=exclude -N -u -r nsa
dbus_session_bus_client(policykit_auth_t)
optional_policy(`
-@@ -119,6 +144,14 @@
+@@ -119,6 +145,14 @@
hal_read_state(policykit_auth_t)
')
@@ -19455,7 +19523,7 @@ diff --exclude-from=exclude -N -u -r nsa
########################################
#
# polkit_grant local policy
-@@ -126,7 +159,8 @@
+@@ -126,7 +160,8 @@
allow policykit_grant_t self:capability setuid;
allow policykit_grant_t self:process getattr;
@@ -19465,7 +19533,7 @@ diff --exclude-from=exclude -N -u -r nsa
allow policykit_grant_t self:unix_dgram_socket create_socket_perms;
allow policykit_grant_t self:unix_stream_socket create_stream_socket_perms;
-@@ -156,9 +190,12 @@
+@@ -156,9 +191,12 @@
userdom_read_all_users_state(policykit_grant_t)
optional_policy(`
@@ -19479,7 +19547,7 @@ diff --exclude-from=exclude -N -u -r nsa
consolekit_dbus_chat(policykit_grant_t)
')
')
-@@ -170,7 +207,8 @@
+@@ -170,7 +208,8 @@
allow policykit_resolve_t self:capability { setuid sys_nice sys_ptrace };
allow policykit_resolve_t self:process getattr;
@@ -26477,7 +26545,7 @@ diff --exclude-from=exclude -N -u -r nsa
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.7.5/policy/modules/services/xserver.te
--- nsaserefpolicy/policy/modules/services/xserver.te 2009-12-04 09:43:33.000000000 -0500
-+++ serefpolicy-3.7.5/policy/modules/services/xserver.te 2009-12-22 09:44:04.000000000 -0500
++++ serefpolicy-3.7.5/policy/modules/services/xserver.te 2009-12-23 09:07:52.000000000 -0500
@@ -36,6 +36,13 @@
## <desc>
@@ -26903,12 +26971,12 @@ diff --exclude-from=exclude -N -u -r nsa
logging_read_generic_logs(xdm_t)
-+miscfiles_manage_fonts_cache(xserver_t)
+miscfiles_search_man_pages(xdm_t)
miscfiles_read_localization(xdm_t)
miscfiles_read_fonts(xdm_t)
-
-sysnet_read_config(xdm_t)
++miscfiles_manage_fonts_cache(xdm_t)
+miscfiles_manage_localization(xdm_t)
+miscfiles_read_hwdata(xdm_t)
@@ -28945,7 +29013,7 @@ diff --exclude-from=exclude -N -u -r nsa
+permissive kdump_t;
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.7.5/policy/modules/system/libraries.fc
--- nsaserefpolicy/policy/modules/system/libraries.fc 2009-08-14 16:14:31.000000000 -0400
-+++ serefpolicy-3.7.5/policy/modules/system/libraries.fc 2009-12-23 07:33:05.000000000 -0500
++++ serefpolicy-3.7.5/policy/modules/system/libraries.fc 2009-12-23 12:43:23.000000000 -0500
@@ -60,12 +60,15 @@
#
# /opt
@@ -29161,7 +29229,7 @@ diff --exclude-from=exclude -N -u -r nsa
') dnl end distro_redhat
#
-@@ -307,10 +316,114 @@
+@@ -307,10 +316,115 @@
/var/mailman/pythonlib(/.*)?/.+\.so(\..*)? -- gen_context(system_u:object_r:lib_t,s0)
@@ -29276,6 +29344,7 @@ diff --exclude-from=exclude -N -u -r nsa
+/usr/local/zend/lib/apache2/libphp5\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
+
+/usr/lib(64)?/python.*/site-packages/pymedia/muxer\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
++/usr/local/games/darwinia/lib/libSDL.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.if serefpolicy-3.7.5/policy/modules/system/libraries.if
--- nsaserefpolicy/policy/modules/system/libraries.if 2009-07-14 14:19:57.000000000 -0400
+++ serefpolicy-3.7.5/policy/modules/system/libraries.if 2009-12-21 13:07:09.000000000 -0500
@@ -34735,7 +34804,7 @@ diff --exclude-from=exclude -N -u -r nsa
## <param name="domain">
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.7.5/policy/modules/system/xen.te
--- nsaserefpolicy/policy/modules/system/xen.te 2009-11-25 11:47:19.000000000 -0500
-+++ serefpolicy-3.7.5/policy/modules/system/xen.te 2009-12-21 13:07:09.000000000 -0500
++++ serefpolicy-3.7.5/policy/modules/system/xen.te 2009-12-23 08:58:19.000000000 -0500
@@ -85,6 +85,7 @@
type xenconsoled_t;
type xenconsoled_exec_t;
@@ -34752,7 +34821,16 @@ diff --exclude-from=exclude -N -u -r nsa
storage_raw_read_fixed_disk(xend_t)
storage_raw_write_fixed_disk(xend_t)
-@@ -421,6 +423,12 @@
+@@ -340,6 +342,8 @@
+
+ files_read_usr_files(xenstored_t)
+
++fs_search_xenfs(xenstored_t)
++
+ storage_raw_read_fixed_disk(xenstored_t)
+ storage_raw_write_fixed_disk(xenstored_t)
+ storage_raw_read_removable_device(xenstored_t)
+@@ -421,6 +425,12 @@
xen_stream_connect_xenstore(xm_t)
optional_policy(`
@@ -34765,7 +34843,7 @@ diff --exclude-from=exclude -N -u -r nsa
virt_manage_images(xm_t)
virt_stream_connect(xm_t)
')
-@@ -438,6 +446,8 @@
+@@ -438,6 +448,8 @@
fs_manage_xenfs_dirs(xm_ssh_t)
fs_manage_xenfs_files(xm_ssh_t)
Index: selinux-policy.spec
===================================================================
RCS file: /cvs/pkgs/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.948
retrieving revision 1.949
diff -u -p -r1.948 -r1.949
--- selinux-policy.spec 23 Dec 2009 13:02:27 -0000 1.948
+++ selinux-policy.spec 23 Dec 2009 18:37:23 -0000 1.949
@@ -1,4 +1,4 @@
-%define distro redhat
+t%define distro redhat
%define polyinstatiate n
%define monolithic n
%if %{?BUILD_TARGETED:0}%{!?BUILD_TARGETED:1}
@@ -20,7 +20,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.7.5
-Release: 4%{?dist}
+Release: 5%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
More information about the fedora-extras-commits
mailing list