From 0c2a484f6440a5e9f8ae9e9c0bcd1baef4e6f191 Mon Sep 17 00:00:00 2001
From: Daniel J Walsh <dwalsh@fedoraproject.org>
Date: Dec 22 2007 12:18:57 +0000
Subject: - Fixes to make confined mozilla work better


---

diff --git a/policy-20070703.patch b/policy-20070703.patch
index ee238c6..f7850cd 100644
--- a/policy-20070703.patch
+++ b/policy-20070703.patch
@@ -2925,7 +2925,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc 
 +/usr/bin/octave-[^/]*  	--	gen_context(system_u:object_r:java_exec_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.0.8/policy/modules/apps/java.if
 --- nsaserefpolicy/policy/modules/apps/java.if	2007-10-22 13:21:40.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/apps/java.if	2007-12-02 21:15:34.000000000 -0500
++++ serefpolicy-3.0.8/policy/modules/apps/java.if	2007-12-22 07:13:05.000000000 -0500
 @@ -32,7 +32,7 @@
  ##	</summary>
  ## </param>
@@ -2935,6 +2935,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if 
  	gen_require(`
  		type java_exec_t;
  	')
+@@ -57,7 +57,7 @@
+ 	# Local policy
+ 	#
+ 
+-	allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem };
++	allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem execstack };
+ 	allow $1_javaplugin_t self:fifo_file rw_fifo_file_perms;
+ 	allow $1_javaplugin_t self:tcp_socket create_socket_perms;
+ 	allow $1_javaplugin_t self:udp_socket create_socket_perms;
 @@ -81,8 +81,7 @@
  
  	can_exec($1_javaplugin_t, java_exec_t)
@@ -3250,7 +3259,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te 
 +')
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.0.8/policy/modules/apps/mozilla.if
 --- nsaserefpolicy/policy/modules/apps/mozilla.if	2007-10-22 13:21:40.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/apps/mozilla.if	2007-12-21 16:45:12.000000000 -0500
++++ serefpolicy-3.0.8/policy/modules/apps/mozilla.if	2007-12-22 07:11:43.000000000 -0500
 @@ -36,6 +36,8 @@
  	gen_require(`
  		type mozilla_conf_t, mozilla_exec_t;
@@ -3295,7 +3304,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
  	# X access, Home files
  	manage_dirs_pattern($1_mozilla_t,$1_mozilla_home_t,$1_mozilla_home_t)
  	manage_files_pattern($1_mozilla_t,$1_mozilla_home_t,$1_mozilla_home_t)
-@@ -96,15 +111,39 @@
+@@ -96,15 +111,41 @@
  	relabel_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
  	relabel_lnk_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t)
  
@@ -3314,6 +3323,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
 +		can_exec($2, mozilla_exec_t)
 +	')
 +
++	userdom_read_user_tmpfs_files($1,$1_mozilla_t)
 +	userdom_read_user_home_content_files($1,$1_mozilla_t)
 +	userdom_read_user_home_content_symlinks($1,$1_mozilla_t)
 +	userdom_read_user_tmp_files($1,$1_mozilla_t)
@@ -3333,6 +3343,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
 +		userdom_manage_user_home_content_dirs($1,$1_mozilla_t)
 +		userdom_manage_user_home_content_files($1,$1_mozilla_t)
 +		userdom_read_user_home_content_symlinks($1,$1_mozilla_t)
++		userdom_manage_user_home_content_pipes($1,$1_mozilla_t)
 +		userdom_user_home_dir_filetrans_user_home_content($1,$1_mozilla_t, { file dir })
 +		', `
 +		# helper apps will try to create .files
@@ -3342,7 +3353,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
  	# Unrestricted inheritance from the caller.
  	allow $2 $1_mozilla_t:process { noatsecure siginh rlimitinh };
  
-@@ -113,10 +152,12 @@
+@@ -113,10 +154,12 @@
  	allow $2 $1_mozilla_t:process signal_perms;
  	
  	kernel_read_kernel_sysctls($1_mozilla_t)
@@ -3357,7 +3368,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
  
  	# Look for plugins 
  	corecmd_list_bin($1_mozilla_t)
-@@ -165,10 +206,23 @@
+@@ -165,10 +208,23 @@
  	files_read_var_files($1_mozilla_t)
  	files_read_var_symlinks($1_mozilla_t)
   	files_dontaudit_getattr_boot_dirs($1_mozilla_t)
@@ -3381,7 +3392,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
  
  	term_dontaudit_getattr_pty_dirs($1_mozilla_t)
  	
-@@ -184,16 +238,13 @@
+@@ -184,16 +240,13 @@
  	sysnet_dns_name_resolve($1_mozilla_t)
  	sysnet_read_config($1_mozilla_t)
  	
@@ -3401,7 +3412,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
  
  	tunable_policy(`allow_execmem',`
  		allow $1_mozilla_t self:process { execmem execstack };
-@@ -211,131 +262,8 @@
+@@ -211,131 +264,8 @@
  		fs_manage_cifs_symlinks($1_mozilla_t)
  	')
  
@@ -3535,7 +3546,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
  	')
  
  	optional_policy(`
-@@ -350,21 +278,27 @@
+@@ -350,21 +280,27 @@
  	optional_policy(`
  		cups_read_rw_config($1_mozilla_t)
  		cups_dbus_chat($1_mozilla_t)
@@ -3567,7 +3578,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
  	')
  
  	optional_policy(`
-@@ -384,25 +318,6 @@
+@@ -384,25 +320,6 @@
  		thunderbird_domtrans_user_thunderbird($1, $1_mozilla_t)
  	')
  
@@ -3593,7 +3604,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
  ')
  
  ########################################
-@@ -575,3 +490,27 @@
+@@ -575,3 +492,27 @@
  
  	allow $2 $1_mozilla_t:tcp_socket rw_socket_perms;
  ')
@@ -19137,7 +19148,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
  /tmp/gconfd-USER -d	gen_context(system_u:object_r:ROLE_tmp_t,s0)
 diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.8/policy/modules/system/userdomain.if
 --- nsaserefpolicy/policy/modules/system/userdomain.if	2007-10-22 13:21:40.000000000 -0400
-+++ serefpolicy-3.0.8/policy/modules/system/userdomain.if	2007-12-12 16:38:48.000000000 -0500
++++ serefpolicy-3.0.8/policy/modules/system/userdomain.if	2007-12-22 07:12:33.000000000 -0500
 @@ -29,8 +29,9 @@
  	')
  
@@ -20141,7 +20152,64 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
  	')
  
  	files_tmp_filetrans($2,$1_tmp_t,$3)
-@@ -4410,6 +4556,7 @@
+@@ -3086,11 +3232,11 @@
+ 
+ ########################################
+ ## <summary>
+-##	Read user tmpfs files.
++##	Read/write user tmpfs files.
+ ## </summary>
+ ## <desc>
+ ##	<p>
+-##	Read user tmpfs files.
++##	Read/Write user tmpfs files.
+ ##	</p>
+ ##	<p>
+ ##	This is a templated interface, and should only
+@@ -3122,6 +3268,42 @@
+ 
+ ########################################
+ ## <summary>
++##	Read user tmpfs files.
++## </summary>
++## <desc>
++##	<p>
++##	Read user tmpfs files.
++##	</p>
++##	<p>
++##	This is a templated interface, and should only
++##	be called from a per-userdomain template.
++##	</p>
++## </desc>
++## <param name="userdomain_prefix">
++##	<summary>
++##	The prefix of the user domain (e.g., user
++##	is the prefix for user_t).
++##	</summary>
++## </param>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++template(`userdom_read_user_tmpfs_files',`
++	gen_require(`
++		type $1_tmpfs_t;
++	')
++
++	fs_search_tmpfs($2)
++	allow $2 $1_tmpfs_t:dir list_dir_perms;
++	read_files_pattern($2,$1_tmpfs_t,$1_tmpfs_t)
++	read_lnk_files_pattern($2,$1_tmpfs_t,$1_tmpfs_t)
++')
++
++########################################
++## <summary>
+ ##	List users untrusted directories.
+ ## </summary>
+ ## <desc>
+@@ -4410,6 +4592,7 @@
  	')
  
  	dontaudit $1 sysadm_home_dir_t:dir getattr;
@@ -20149,7 +20217,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
  ')
  
  ########################################
-@@ -4574,6 +4721,7 @@
+@@ -4574,6 +4757,7 @@
  	allow $1 { sysadm_home_dir_t sysadm_home_t }:dir list_dir_perms;
  	read_files_pattern($1,{ sysadm_home_dir_t sysadm_home_t },sysadm_home_t)
  	read_lnk_files_pattern($1,{ sysadm_home_dir_t sysadm_home_t },sysadm_home_t)
@@ -20157,7 +20225,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
  ')
  
  ########################################
-@@ -4609,11 +4757,29 @@
+@@ -4609,11 +4793,29 @@
  #
  interface(`userdom_search_all_users_home_dirs',`
  	gen_require(`
@@ -20188,7 +20256,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
  ')
  
  ########################################
-@@ -4633,6 +4799,14 @@
+@@ -4633,6 +4835,14 @@
  
  	files_list_home($1)
  	allow $1 home_dir_type:dir list_dir_perms;
@@ -20203,7 +20271,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
  ')
  
  ########################################
-@@ -5323,7 +5497,7 @@
+@@ -5323,7 +5533,7 @@
  		attribute user_tmpfile;
  	')
  
@@ -20212,7 +20280,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
  ')
  
  ########################################
-@@ -5346,6 +5520,25 @@
+@@ -5346,6 +5556,25 @@
  
  ########################################
  ## <summary>
@@ -20238,7 +20306,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
  ##	Write all unprivileged users files in /tmp
  ## </summary>
  ## <param name="domain">
-@@ -5529,6 +5722,24 @@
+@@ -5529,6 +5758,24 @@
  
  ########################################
  ## <summary>
@@ -20263,7 +20331,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
  ##	Send a dbus message to all user domains.
  ## </summary>
  ## <param name="domain">
-@@ -5559,3 +5770,419 @@
+@@ -5559,3 +5806,419 @@
  interface(`userdom_unconfined',`
  	refpolicywarn(`$0($*) has been deprecated.')
  ')
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 6b8364d..e4391cd 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -17,7 +17,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.0.8
-Release: 71%{?dist}
+Release: 72%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz