From 650fa6fcd19dd72d3686215f401440350465d1e7 Mon Sep 17 00:00:00 2001 From: Miroslav Grepl Date: Jul 17 2009 08:22:01 +0000 Subject: - Fixes for hald_dccm --- diff --git a/policy-20090521.patch b/policy-20090521.patch index cb86a7b..0a6dc14 100644 --- a/policy-20090521.patch +++ b/policy-20090521.patch @@ -2310,7 +2310,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.6.12/policy/modules/services/hal.te --- nsaserefpolicy/policy/modules/services/hal.te 2009-06-25 10:19:44.000000000 +0200 -+++ serefpolicy-3.6.12/policy/modules/services/hal.te 2009-07-17 08:46:05.000000000 +0200 ++++ serefpolicy-3.6.12/policy/modules/services/hal.te 2009-07-17 09:56:19.000000000 +0200 @@ -103,6 +103,7 @@ kernel_rw_irq_sysctls(hald_t) kernel_rw_vm_sysctls(hald_t) @@ -2335,6 +2335,41 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol polkit_domtrans_auth(hald_t) polkit_domtrans_resolve(hald_t) polkit_read_lib(hald_t) +@@ -381,6 +384,7 @@ + miscfiles_read_localization(hald_acl_t) + + optional_policy(` ++ polkit_dbus_chat(hald_acl_t) + polkit_domtrans_auth(hald_acl_t) + polkit_read_lib(hald_acl_t) + polkit_read_reload(hald_acl_t) +@@ -470,6 +474,8 @@ + # + # Local hald dccm policy + # ++ ++allow hald_dccm_t self:fifo_file rw_fifo_file_perms; + allow hald_dccm_t self:capability { net_bind_service }; + allow hald_dccm_t self:process getsched; + allow hald_dccm_t self:tcp_socket create_stream_socket_perms; +@@ -480,6 +486,8 @@ + allow hald_t hald_dccm_t:process signal; + allow hald_dccm_t hald_t:unix_stream_socket connectto; + ++hal_rw_dgram_sockets(hald_dccm_t) ++ + corenet_all_recvfrom_unlabeled(hald_dccm_t) + corenet_all_recvfrom_netlabel(hald_dccm_t) + corenet_tcp_sendrecv_generic_if(hald_dccm_t) +@@ -508,4 +516,8 @@ + + miscfiles_read_localization(hald_dccm_t) + ++optional_policy(` ++ dbus_system_bus_client(hald_dccm_t) ++') ++ + permissive hald_dccm_t; diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-3.6.12/policy/modules/services/kerberos.if --- nsaserefpolicy/policy/modules/services/kerberos.if 2009-06-25 10:19:44.000000000 +0200 +++ serefpolicy-3.6.12/policy/modules/services/kerberos.if 2009-06-25 10:21:01.000000000 +0200 @@ -4133,16 +4168,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow sulogin_t self:capability sys_tty_config; diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.6.12/policy/modules/system/sysnetwork.te --- nsaserefpolicy/policy/modules/system/sysnetwork.te 2009-06-25 10:19:44.000000000 +0200 -+++ serefpolicy-3.6.12/policy/modules/system/sysnetwork.te 2009-07-13 11:39:27.000000000 +0200 -@@ -18,6 +18,7 @@ - type dhcpc_t; - type dhcpc_exec_t; - init_daemon_domain(dhcpc_t,dhcpc_exec_t) -+domain_obj_id_change_exemption(dhcpc_t) - role system_r types dhcpc_t; - - type dhcpc_helper_exec_t; -@@ -45,7 +46,7 @@ ++++ serefpolicy-3.6.12/policy/modules/system/sysnetwork.te 2009-07-17 09:43:41.000000000 +0200 +@@ -45,7 +45,7 @@ # DHCP client local policy # allow dhcpc_t self:capability { dac_override fsetid net_admin net_raw net_bind_service sys_nice sys_resource sys_tty_config }; @@ -4151,7 +4178,24 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # for access("/etc/bashrc", X_OK) on Red Hat dontaudit dhcpc_t self:capability { dac_read_search sys_module }; allow dhcpc_t self:process { setfscreate ptrace signal_perms }; -@@ -125,6 +126,7 @@ +@@ -69,8 +69,9 @@ + + # Allow read/write to /etc/resolv.conf and /etc/ntp.conf. Note that any files + # in /etc created by dhcpcd will be labelled net_conf_t. +-sysnet_manage_config(dhcpc_t) ++allow dhcpc_t net_conf_t:file manage_file_perms; + allow dhcpc_t net_conf_t:file relabel_file_perms; ++sysnet_manage_config(dhcpc_t) + files_etc_filetrans(dhcpc_t,net_conf_t,file) + + # create temp files +@@ -120,11 +121,13 @@ + corecmd_exec_bin(dhcpc_t) + corecmd_exec_shell(dhcpc_t) + ++domain_obj_id_change_exemption(dhcpc_t) + domain_use_interactive_fds(dhcpc_t) + domain_dontaudit_read_all_domains_state(dhcpc_t) files_read_etc_files(dhcpc_t) files_read_etc_runtime_files(dhcpc_t) @@ -4159,6 +4203,27 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol files_search_home(dhcpc_t) files_search_var_lib(dhcpc_t) files_dontaudit_search_locks(dhcpc_t) +@@ -270,8 +273,8 @@ + + read_files_pattern(ifconfig_t, dhcpc_state_t, dhcpc_state_t) + +-files_read_etc_files(ifconfig_t); +-files_read_etc_runtime_files(ifconfig_t); ++files_read_etc_files(ifconfig_t) ++files_read_etc_runtime_files(ifconfig_t) + + kernel_use_fds(ifconfig_t) + kernel_read_system_state(ifconfig_t) +@@ -367,3 +370,9 @@ + xen_append_log(ifconfig_t) + xen_dontaudit_rw_unix_stream_sockets(ifconfig_t) + ') ++ ++optional_policy(` ++ hal_rw_dgram_sockets(dhcpc_t) ++ hal_dontaudit_rw_pipes(ifconfig_t) ++') ++ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.6.12/policy/modules/system/udev.te --- nsaserefpolicy/policy/modules/system/udev.te 2009-06-25 10:19:44.000000000 +0200 +++ serefpolicy-3.6.12/policy/modules/system/udev.te 2009-06-25 10:21:01.000000000 +0200 diff --git a/selinux-policy.spec b/selinux-policy.spec index e3adc74..a895cb1 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -20,7 +20,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.6.12 -Release: 67%{?dist} +Release: 68%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -475,6 +475,9 @@ exit 0 %endif %changelog +* Fri Jul 17 2009 Miroslav Grepl 3.6.12-68 +- Fixes for hald_dccm + * Fri Jul 17 2009 Miroslav Grepl 3.6.12-67 - Allow hal to dbus chat with polkit