rpms/selinux-policy/devel policy-20090105.patch, 1.18, 1.19 selinux-policy.spec, 1.774, 1.775

Daniel J Walsh dwalsh at fedoraproject.org
Fri Jan 23 20:36:16 UTC 2009 

Author: dwalsh

Update of /cvs/extras/rpms/selinux-policy/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv28575

Modified Files:
	policy-20090105.patch selinux-policy.spec 
Log Message:
* Fri Jan 23 2009 Dan Walsh <dwalsh at redhat.com> 3.6.3-8
- Add policy to make dbus/nm-applet work


policy-20090105.patch:

Index: policy-20090105.patch
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/policy-20090105.patch,v
retrieving revision 1.18
retrieving revision 1.19
diff -u -r1.18 -r1.19
--- policy-20090105.patch	21 Jan 2009 22:49:23 -0000	1.18
+++ policy-20090105.patch	23 Jan 2009 20:35:45 -0000	1.19
@@ -1401,7 +1401,7 @@
 +')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.if serefpolicy-3.6.3/policy/modules/admin/vbetool.if
 --- nsaserefpolicy/policy/modules/admin/vbetool.if	2008-08-07 11:15:13.000000000 -0400
-+++ serefpolicy-3.6.3/policy/modules/admin/vbetool.if	2009-01-19 13:10:02.000000000 -0500
++++ serefpolicy-3.6.3/policy/modules/admin/vbetool.if	2009-01-23 14:46:57.000000000 -0500
 @@ -18,3 +18,28 @@
  	corecmd_search_bin($1)
  	domtrans_pattern($1, vbetool_exec_t, vbetool_t)
@@ -4058,7 +4058,7 @@
 +corecmd_executable_file(wm_exec_t)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.6.3/policy/modules/kernel/corecommands.fc
 --- nsaserefpolicy/policy/modules/kernel/corecommands.fc	2009-01-05 15:39:38.000000000 -0500
-+++ serefpolicy-3.6.3/policy/modules/kernel/corecommands.fc	2009-01-20 14:46:23.000000000 -0500
++++ serefpolicy-3.6.3/policy/modules/kernel/corecommands.fc	2009-01-23 15:08:37.000000000 -0500
 @@ -58,6 +58,8 @@
  
  /etc/init\.d/functions		--	gen_context(system_u:object_r:bin_t,s0)
@@ -4103,7 +4103,7 @@
  /usr/share/fedora-usermgmt/wrapper --	gen_context(system_u:object_r:bin_t,s0)
  /usr/share/hplip/[^/]*		--	gen_context(system_u:object_r:bin_t,s0)
  /usr/share/hwbrowser/hwbrowser --	gen_context(system_u:object_r:bin_t,s0)
-@@ -293,3 +299,8 @@
+@@ -293,3 +299,10 @@
  ifdef(`distro_suse',`
  /var/lib/samba/bin/.+			gen_context(system_u:object_r:bin_t,s0)
  ')
@@ -4112,6 +4112,8 @@
 +/lib64/security/pam_krb5/pam_krb5_storetmp -- gen_context(system_u:object_r:bin_t,s0)
 +
 +/usr/lib/oracle/xe/apps(/.*)?  gen_context(system_u:object_r:bin_t,s0)
++
++/usr/lib(64)?/pm-utils/sleep.d(/.*)?  gen_context(system_u:object_r:bin_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.if serefpolicy-3.6.3/policy/modules/kernel/corecommands.if
 --- nsaserefpolicy/policy/modules/kernel/corecommands.if	2009-01-05 15:39:38.000000000 -0500
 +++ serefpolicy-3.6.3/policy/modules/kernel/corecommands.if	2009-01-19 13:10:02.000000000 -0500
@@ -6183,7 +6185,7 @@
 +')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.6.3/policy/modules/kernel/storage.fc
 --- nsaserefpolicy/policy/modules/kernel/storage.fc	2008-10-08 19:00:23.000000000 -0400
-+++ serefpolicy-3.6.3/policy/modules/kernel/storage.fc	2009-01-19 13:53:59.000000000 -0500
++++ serefpolicy-3.6.3/policy/modules/kernel/storage.fc	2009-01-23 09:24:07.000000000 -0500
 @@ -36,7 +36,7 @@
  /dev/pg[0-3]		-c	gen_context(system_u:object_r:removable_device_t,s0)
  /dev/ps3d.*		-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
@@ -6193,6 +6195,15 @@
  /dev/rd.*		-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
  ifdef(`distro_redhat', `
  /dev/root		-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+@@ -57,7 +57,7 @@
+ 
+ /dev/cciss/[^/]*	-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+ 
+-/dev/fuse		-c	gen_context(system_u:object_r:fuse_device_t,mls_systemhigh)
++/dev/fuse		-c	gen_context(system_u:object_r:fuse_device_t,s0)
+ /dev/floppy/[^/]*	-b	gen_context(system_u:object_r:removable_device_t,s0)
+ 
+ /dev/i2o/hd[^/]*	-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
 @@ -67,6 +67,8 @@
  /dev/md/.*		-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
  /dev/mapper/.*		-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
@@ -8502,7 +8513,7 @@
 +')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.6.3/policy/modules/services/apache.te
 --- nsaserefpolicy/policy/modules/services/apache.te	2009-01-19 11:06:49.000000000 -0500
-+++ serefpolicy-3.6.3/policy/modules/services/apache.te	2009-01-21 11:01:33.000000000 -0500
++++ serefpolicy-3.6.3/policy/modules/services/apache.te	2009-01-23 15:14:19.000000000 -0500
 @@ -19,6 +19,8 @@
  # Declarations
  #
@@ -10134,8 +10145,13 @@
  
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.6.3/policy/modules/services/cron.fc
 --- nsaserefpolicy/policy/modules/services/cron.fc	2008-11-11 16:13:46.000000000 -0500
-+++ serefpolicy-3.6.3/policy/modules/services/cron.fc	2009-01-19 13:10:02.000000000 -0500
-@@ -17,9 +17,9 @@
++++ serefpolicy-3.6.3/policy/modules/services/cron.fc	2009-01-23 15:16:30.000000000 -0500
+@@ -1,3 +1,4 @@
++/etc/rc\.d/init\.d/atd		--	gen_context(system_u:object_r:crond_initrc_exec_t,s0)
+ 
+ /etc/cron\.d(/.*)?			gen_context(system_u:object_r:system_cron_spool_t,s0)
+ /etc/crontab			--	gen_context(system_u:object_r:system_cron_spool_t,s0)
+@@ -17,9 +18,9 @@
  /var/run/fcron\.fifo		-s	gen_context(system_u:object_r:crond_var_run_t,s0)
  /var/run/fcron\.pid		--	gen_context(system_u:object_r:crond_var_run_t,s0)
  
@@ -10148,7 +10164,7 @@
  
  /var/spool/cron			-d	gen_context(system_u:object_r:cron_spool_t,s0)
  #/var/spool/cron/root		--	gen_context(system_u:object_r:sysadm_cron_spool_t,s0)
-@@ -41,7 +41,11 @@
+@@ -41,7 +42,11 @@
  #/var/spool/cron/crontabs/root	--	gen_context(system_u:object_r:sysadm_cron_spool_t,s0)
  
  /var/spool/fcron		-d	gen_context(system_u:object_r:cron_spool_t,s0)
@@ -10163,7 +10179,7 @@
 +/var/log/rpmpkgs.*		--	gen_context(system_u:object_r:cron_log_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.6.3/policy/modules/services/cron.if
 --- nsaserefpolicy/policy/modules/services/cron.if	2008-11-11 16:13:47.000000000 -0500
-+++ serefpolicy-3.6.3/policy/modules/services/cron.if	2009-01-21 15:20:50.000000000 -0500
++++ serefpolicy-3.6.3/policy/modules/services/cron.if	2009-01-23 15:15:40.000000000 -0500
 @@ -12,6 +12,10 @@
  ## </param>
  #
@@ -10259,7 +10275,50 @@
  	gen_require(`
  		type crond_t;
  	')
-@@ -481,11 +515,14 @@
+@@ -416,6 +450,42 @@
+ 
+ ########################################
+ ## <summary>
++##	Execute cron in the cron system domain.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`cron_domtrans',`
++	gen_require(`
++		type system_cronjob_t, crond_exec_t;
++	')
++
++	domtrans_pattern($1,crond_exec_t,system_cronjob_t)
++')
++
++########################################
++## <summary>
++##	Execute crond_exec_t 
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`cron_exec',`
++	gen_require(`
++		type crond_exec_t;
++	')
++
++	can_exec($1,crond_exec_t)
++')
++
++########################################
++## <summary>
+ ##	Inherit and use a file descriptor
+ ##	from system cron jobs.
+ ## </summary>
+@@ -481,11 +551,14 @@
  #
  interface(`cron_read_system_job_tmp_files',`
  	gen_require(`
@@ -10275,7 +10334,7 @@
  ')
  
  ########################################
-@@ -506,3 +543,82 @@
+@@ -506,3 +579,101 @@
  
  	dontaudit $1 system_cronjob_tmp_t:file append;
  ')
@@ -10358,9 +10417,28 @@
 +
 +	manage_files_pattern($1, crond_var_run_t,  crond_var_run_t)
 +')
++
++########################################
++## <summary>
++##	Execute crond server in the nscd domain.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	The type of the process performing this action.
++##	</summary>
++## </param>
++#
++interface(`cron_initrc_domtrans',`
++	gen_require(`
++		type crond_initrc_exec_t;
++')
++
++	init_labeled_script_domtrans($1, crond_initrc_exec_t)
++')
++
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.6.3/policy/modules/services/cron.te
 --- nsaserefpolicy/policy/modules/services/cron.te	2009-01-19 11:06:49.000000000 -0500
-+++ serefpolicy-3.6.3/policy/modules/services/cron.te	2009-01-21 15:19:17.000000000 -0500
++++ serefpolicy-3.6.3/policy/modules/services/cron.te	2009-01-23 15:14:37.000000000 -0500
 @@ -38,6 +38,10 @@
  type cron_var_lib_t;
  files_type(cron_var_lib_t)
@@ -10372,8 +10450,13 @@
  # var/log files
  type cron_log_t;
  logging_log_file(cron_log_t)
-@@ -58,6 +62,8 @@
+@@ -56,8 +60,13 @@
+ domain_interactive_fd(crond_t)
+ domain_cron_exemption_source(crond_t)
  
++type crond_initrc_exec_t;
++init_script_file(crond_initrc_exec_t)
++
  type crond_tmp_t;
  files_tmp_file(crond_tmp_t)
 +files_poly_parent(crond_tmp_t)
@@ -10381,7 +10464,7 @@
  
  type crond_var_run_t;
  files_pid_file(crond_var_run_t)
-@@ -70,10 +76,11 @@
+@@ -70,10 +79,11 @@
  typealias admin_crontab_tmp_t alias sysadm_crontab_tmp_t;
  
  cron_common_crontab_template(crontab)
@@ -10394,7 +10477,7 @@
  
  type system_cron_spool_t, cron_spool_type;
  files_type(system_cron_spool_t)
-@@ -103,6 +110,13 @@
+@@ -103,6 +113,13 @@
  files_type(user_cron_spool_t)
  ubac_constrained(user_cron_spool_t)
  
@@ -10408,7 +10491,7 @@
  ########################################
  #
  # Admin crontab local policy
-@@ -130,7 +144,7 @@
+@@ -130,7 +147,7 @@
  # Cron daemon local policy
  #
  
@@ -10417,7 +10500,7 @@
  dontaudit crond_t self:capability { sys_resource sys_tty_config };
  allow crond_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
  allow crond_t self:process { setexec setfscreate };
-@@ -149,19 +163,19 @@
+@@ -149,19 +166,19 @@
  allow crond_t crond_var_run_t:file manage_file_perms;
  files_pid_filetrans(crond_t,crond_var_run_t,file)
  
@@ -10441,7 +10524,7 @@
  dev_read_sysfs(crond_t)
  selinux_get_fs_mount(crond_t)
  selinux_validate_context(crond_t)
-@@ -183,6 +197,8 @@
+@@ -183,6 +200,8 @@
  corecmd_read_bin_symlinks(crond_t)
  
  domain_use_interactive_fds(crond_t)
@@ -10450,7 +10533,7 @@
  
  files_read_etc_files(crond_t)
  files_read_generic_spool(crond_t)
-@@ -192,10 +208,13 @@
+@@ -192,10 +211,13 @@
  files_search_default(crond_t)
  
  init_rw_utmp(crond_t)
@@ -10464,7 +10547,7 @@
  
  seutil_read_config(crond_t)
  seutil_read_default_contexts(crond_t)
-@@ -208,6 +227,7 @@
+@@ -208,6 +230,7 @@
  userdom_list_user_home_dirs(crond_t)
  
  mta_send_mail(crond_t)
@@ -10472,7 +10555,7 @@
  
  ifdef(`distro_debian',`
  	# pam_limits is used
-@@ -227,21 +247,45 @@
+@@ -227,21 +250,45 @@
  	')
  ')
  
@@ -10519,7 +10602,7 @@
  ')
  
  optional_policy(`
-@@ -283,7 +327,14 @@
+@@ -283,7 +330,14 @@
  allow system_cronjob_t cron_var_lib_t:file manage_file_perms;
  files_var_lib_filetrans(system_cronjob_t, cron_var_lib_t, file)
  
@@ -10534,7 +10617,7 @@
  # The entrypoint interface is not used as this is not
  # a regular entrypoint.  Since crontab files are
  # not directly executed, crond must ensure that
-@@ -314,9 +365,13 @@
+@@ -314,9 +368,13 @@
  filetrans_pattern(system_cronjob_t, crond_tmp_t, system_cronjob_tmp_t, { file lnk_file })
  files_tmp_filetrans(system_cronjob_t, system_cronjob_tmp_t, file)
  
@@ -10549,7 +10632,7 @@
  
  kernel_read_kernel_sysctls(system_cronjob_t)
  kernel_read_system_state(system_cronjob_t)
-@@ -370,7 +425,8 @@
+@@ -370,7 +428,8 @@
  init_read_utmp(system_cronjob_t)
  init_dontaudit_rw_utmp(system_cronjob_t)
  # prelink tells init to restart it self, we either need to allow or dontaudit
@@ -10559,7 +10642,7 @@
  
  auth_use_nsswitch(system_cronjob_t)
  
-@@ -378,6 +434,7 @@
+@@ -378,6 +437,7 @@
  libs_exec_ld_so(system_cronjob_t)
  
  logging_read_generic_logs(system_cronjob_t)
@@ -10567,7 +10650,7 @@
  logging_send_syslog_msg(system_cronjob_t)
  
  miscfiles_read_localization(system_cronjob_t)
-@@ -428,11 +485,20 @@
+@@ -428,11 +488,20 @@
  ')
  
  optional_policy(`
@@ -10588,7 +10671,7 @@
  ')
  
  optional_policy(`
-@@ -460,8 +526,7 @@
+@@ -460,8 +529,7 @@
  ')
  
  optional_policy(`
@@ -10598,7 +10681,7 @@
  ')
  
  optional_policy(`
-@@ -469,24 +534,17 @@
+@@ -469,24 +537,17 @@
  ')
  
  optional_policy(`
@@ -10607,16 +10690,16 @@
 +	unconfined_domain(crond_t)
  	unconfined_domain(system_cronjob_t)
 -	userdom_user_home_dir_filetrans_user_home_content(system_cronjob_t, { dir file lnk_file fifo_file sock_file })
- ')
- 
+-')
+-
 -ifdef(`TODO',`
 -ifdef(`mta.te', `
 -allow system_cronjob_t mail_spool_t:lnk_file read;
 -allow mta_user_agent system_cronjob_t:fd use;
 -r_dir_file(system_mail_t, crond_tmp_t)
--')
+ ')
 -') dnl end TODO
--
+ 
  ########################################
  #
  # User cronjobs local policy
@@ -10626,7 +10709,7 @@
  allow cronjob_t self:process { signal_perms setsched };
  allow cronjob_t self:fifo_file rw_fifo_file_perms;
  allow cronjob_t self:unix_stream_socket create_stream_socket_perms;
-@@ -570,6 +628,9 @@
+@@ -570,6 +631,9 @@
  userdom_manage_user_home_content_sockets(cronjob_t)
  #userdom_user_home_dir_filetrans_user_home_content(cronjob_t, notdevfile_class_set)
  
@@ -11606,8 +11689,8 @@
 +/var/run/devkit(/.*)?			gen_context(system_u:object_r:devicekit_var_run_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.if serefpolicy-3.6.3/policy/modules/services/devicekit.if
 --- nsaserefpolicy/policy/modules/services/devicekit.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.3/policy/modules/services/devicekit.if	2009-01-20 17:22:44.000000000 -0500
-@@ -0,0 +1,157 @@
++++ serefpolicy-3.6.3/policy/modules/services/devicekit.if	2009-01-23 09:25:48.000000000 -0500
+@@ -0,0 +1,177 @@
 +
 +## <summary>policy for devicekit</summary>
 +
@@ -11765,10 +11848,30 @@
 +	devicekit_manage_var_run($1)
 +
 +')
++
++########################################
++## <summary>
++##	Send to devicekit over a unix domain
++##	datagram socket.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`devicekit_dgram_send',`
++	gen_require(`
++		type devicekit_t;
++	')
++
++	allow $1 devicekit_t:unix_dgram_socket sendto;
++')
++
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.6.3/policy/modules/services/devicekit.te
 --- nsaserefpolicy/policy/modules/services/devicekit.te	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.3/policy/modules/services/devicekit.te	2009-01-20 17:10:23.000000000 -0500
-@@ -0,0 +1,71 @@
++++ serefpolicy-3.6.3/policy/modules/services/devicekit.te	2009-01-23 15:17:57.000000000 -0500
+@@ -0,0 +1,114 @@
 +policy_module(devicekit,1.0.0)
 +
 +########################################
@@ -11816,19 +11919,45 @@
 +#
 +# DeviceKit-Power local policy
 +#
++allow devicekit_power_t self:capability { sys_tty_config dac_override };
++allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
 +allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
 +
++corecmd_exec_bin(devicekit_power_t)
++corecmd_exec_shell(devicekit_power_t)
++
++consoletype_exec(devicekit_power_t)
++
 +dev_rw_generic_usb_dev(devicekit_power_t)
 +dev_rw_netcontrol(devicekit_power_t)
-+dev_read_sysfs(devicekit_power_t)
++dev_rw_sysfs(devicekit_power_t)
 +
 +files_read_etc_files(devicekit_power_t)
++files_read_usr_files(devicekit_t)
 +
 +fs_list_inotifyfs(devicekit_power_t)
 +
++auth_use_nsswitch(devicekit_power_t)
++
 +miscfiles_read_localization(devicekit_power_t)
 +
++userdom_read_all_users_state(devicekit_power_t)
++
++optional_policy(`
++	hal_domtrans_mac(devicekit_power_t)
++	hal_write_log(devicekit_power_t)
++	hal_manage_pid_dirs(devicekit_power_t)
++	hal_manage_pid_files(devicekit_power_t)
++	hal_dbus_chat(devicekit_power_t)
++')
++
++optional_policy(`
++	cron_initrc_domtrans(devicekit_power_t)
++')
++
 +optional_policy(`
++	polkit_domtrans_auth(devicekit_power_t)
++	polkit_read_lib(devicekit_power_t)
 +	polkit_read_reload(devicekit_power_t)
 +')
 +
@@ -11836,9 +11965,26 @@
 +	dbus_system_bus_client(devicekit_power_t)
 +	allow devicekit_power_t devicekit_t:dbus send_msg;
 +	allow devicekit_t devicekit_power_t:dbus send_msg;
++
 +	optional_policy(`
 +		consolekit_dbus_chat(devicekit_power_t)
 +	')
++
++	optional_policy(`
++		networkmanager_dbus_chat(devicekit_power_t)
++	')
++
++	optional_policy(`
++		rpm_dbus_chat(devicekit_power_t)
++	')
++')
++
++optional_policy(`
++	bootloader_domtrans(devicekit_power_t)
++')
++
++optional_policy(`
++	vbetool_domtrans(devicekit_power_t)
 +')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.if serefpolicy-3.6.3/policy/modules/services/dhcp.if
 --- nsaserefpolicy/policy/modules/services/dhcp.if	2008-11-18 18:57:20.000000000 -0500
@@ -12735,8 +12881,33 @@
  /usr/libexec/hald-addon-macbookpro-backlight --	gen_context(system_u:object_r:hald_mac_exec_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.6.3/policy/modules/services/hal.if
 --- nsaserefpolicy/policy/modules/services/hal.if	2008-11-19 11:51:44.000000000 -0500
-+++ serefpolicy-3.6.3/policy/modules/services/hal.if	2009-01-20 15:29:07.000000000 -0500
-@@ -51,10 +51,7 @@
++++ serefpolicy-3.6.3/policy/modules/services/hal.if	2009-01-23 14:59:53.000000000 -0500
+@@ -20,6 +20,24 @@
+ 
+ ########################################
+ ## <summary>
++##	Execute hal mac in the hal mac domain.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`hal_domtrans_mac',`
++	gen_require(`
++		type hald_mac_t, hald_mac_exec_t;
++	')
++
++	domtrans_pattern($1, hald_mac_exec_t, hald_mac_t)
++')
++
++########################################
++## <summary>
+ ##	Get the attributes of a hal process.
+ ## </summary>
+ ## <param name="domain">
+@@ -51,10 +69,7 @@
  		type hald_t;
  	')
  
@@ -12748,6 +12919,67 @@
  ')
  
  ########################################
+@@ -340,3 +355,60 @@
+ 	files_search_pids($1)
+ 	allow $1 hald_var_run_t:file rw_file_perms;
+ ')
++
++########################################
++## <summary>
++##	Read/Write hald PID files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`hal_rw_pid_files',`
++	gen_require(`
++		type hald_var_run_t;
++	')
++
++	files_search_pids($1)
++	allow $1 hald_var_run_t:file rw_file_perms;
++')
++
++########################################
++## <summary>
++##	Manage hald PID files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`hal_manage_pid_files',`
++	gen_require(`
++		type hald_var_run_t;
++	')
++
++	files_search_pids($1)
++	manage_files_pattern($1, hald_var_run_t, hald_var_run_t)
++')
++
++########################################
++## <summary>
++##	Manage hald PID dirs.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`hal_manage_pid_dirs',`
++	gen_require(`
++		type hald_var_run_t;
++	')
++
++	files_search_pids($1)
++	manage_dirs_pattern($1, hald_var_run_t, hald_var_run_t)
++')
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.6.3/policy/modules/services/hal.te
 --- nsaserefpolicy/policy/modules/services/hal.te	2009-01-19 11:06:49.000000000 -0500
 +++ serefpolicy-3.6.3/policy/modules/services/hal.te	2009-01-20 11:41:48.000000000 -0500
@@ -14776,7 +15008,7 @@
  
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.if serefpolicy-3.6.3/policy/modules/services/nscd.if
 --- nsaserefpolicy/policy/modules/services/nscd.if	2009-01-05 15:39:43.000000000 -0500
-+++ serefpolicy-3.6.3/policy/modules/services/nscd.if	2009-01-19 13:10:02.000000000 -0500
++++ serefpolicy-3.6.3/policy/modules/services/nscd.if	2009-01-23 15:15:06.000000000 -0500
 @@ -58,6 +58,42 @@
  
  ########################################
@@ -16474,7 +16706,7 @@
 +/var/lib/misc/PolicyKit.reload			gen_context(system_u:object_r:polkit_reload_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/polkit.if serefpolicy-3.6.3/policy/modules/services/polkit.if
 --- nsaserefpolicy/policy/modules/services/polkit.if	1969-12-31 19:00:00.000000000 -0500
-+++ serefpolicy-3.6.3/policy/modules/services/polkit.if	2009-01-19 14:47:07.000000000 -0500
++++ serefpolicy-3.6.3/policy/modules/services/polkit.if	2009-01-23 14:44:09.000000000 -0500
 @@ -0,0 +1,241 @@
 +
 +## <summary>policy for polkit_auth</summary>
@@ -22605,7 +22837,7 @@
 +
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.3/policy/modules/services/xserver.te
 --- nsaserefpolicy/policy/modules/services/xserver.te	2009-01-19 11:06:49.000000000 -0500
-+++ serefpolicy-3.6.3/policy/modules/services/xserver.te	2009-01-21 16:14:47.000000000 -0500
++++ serefpolicy-3.6.3/policy/modules/services/xserver.te	2009-01-23 10:14:45.000000000 -0500
 @@ -34,6 +34,13 @@
  
  ## <desc>
@@ -23043,6 +23275,15 @@
  
  # Device rules
  allow x_domain xserver_t:x_device { read getattr use setattr setfocus grab bell };
+@@ -622,7 +728,7 @@
+ manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
+ files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })
+ 
+-filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t,sock_file)
++#filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t,sock_file)
+ 
+ manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
+ manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)
 @@ -635,6 +741,15 @@
  manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
  files_search_var_lib(xserver_t)
@@ -27411,7 +27652,7 @@
 +/dev/shm/mono.*		gen_context(system_u:object_r:user_tmpfs_t,s0)
 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.3/policy/modules/system/userdomain.if
 --- nsaserefpolicy/policy/modules/system/userdomain.if	2009-01-19 11:07:34.000000000 -0500
-+++ serefpolicy-3.6.3/policy/modules/system/userdomain.if	2009-01-21 16:19:30.000000000 -0500
++++ serefpolicy-3.6.3/policy/modules/system/userdomain.if	2009-01-23 15:07:13.000000000 -0500
 @@ -30,8 +30,9 @@
  	')
  


Index: selinux-policy.spec
===================================================================
RCS file: /cvs/extras/rpms/selinux-policy/devel/selinux-policy.spec,v
retrieving revision 1.774
retrieving revision 1.775
diff -u -r1.774 -r1.775
--- selinux-policy.spec	22 Jan 2009 20:10:48 -0000	1.774
+++ selinux-policy.spec	23 Jan 2009 20:35:45 -0000	1.775
@@ -20,7 +20,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.6.3
-Release: 7%{?dist}
+Release: 8%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -444,6 +444,9 @@
 %endif
 
 %changelog
+* Fri Jan 23 2009 Dan Walsh <dwalsh at redhat.com> 3.6.3-8
+- Add policy to make dbus/nm-applet work
+
 * Thu Jan 22 2009 Dan Walsh <dwalsh at redhat.com> 3.6.3-7
 - Remove polgen-ifgen from post and add trigger to policycoreutils-python

More information about the fedora-extras-commits mailing list