From 7f5d8f30d0f7a6a4da85a728d02d4f2286b28232 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Jul 27 2010 17:28:04 +0000 Subject: - Update boinc policy - Fix sysstat policy to allow sys_admin - Change failsafe_context to unconfined_r:unconfined_t:s0 --- diff --git a/config.tgz b/config.tgz index 32fecce..2619187 100644 Binary files a/config.tgz and b/config.tgz differ diff --git a/policy-F14.patch b/policy-F14.patch index 65dad37..c703b07 100644 --- a/policy-F14.patch +++ b/policy-F14.patch @@ -7898,7 +7898,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.8.8/policy/modules/kernel/kernel.if --- nsaserefpolicy/policy/modules/kernel/kernel.if 2010-06-08 10:35:48.000000000 -0400 -+++ serefpolicy-3.8.8/policy/modules/kernel/kernel.if 2010-07-20 10:46:10.000000000 -0400 ++++ serefpolicy-3.8.8/policy/modules/kernel/kernel.if 2010-07-27 11:47:12.000000000 -0400 @@ -1977,7 +1977,7 @@ ') @@ -11831,14 +11831,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.fc serefpolicy-3.8.8/policy/modules/services/boinc.fc --- nsaserefpolicy/policy/modules/services/boinc.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.8/policy/modules/services/boinc.fc 2010-07-20 10:46:10.000000000 -0400 -@@ -0,0 +1,6 @@ ++++ serefpolicy-3.8.8/policy/modules/services/boinc.fc 2010-07-27 09:18:03.000000000 -0400 +@@ -0,0 +1,8 @@ + -+/etc/rc\.d/init\.d/boinc_client -- gen_context(system_u:object_r:boinc_initrc_exec_t,s0) ++/etc/rc\.d/init\.d/boinc_client -- gen_context(system_u:object_r:boinc_initrc_exec_t,s0) + -+/usr/bin/boinc_client -- gen_context(system_u:object_r:boinc_exec_t,s0) ++/usr/bin/boinc_client -- gen_context(system_u:object_r:boinc_exec_t,s0) + -+/var/lib/boinc(/.*)? gen_context(system_u:object_r:boinc_var_lib_t,s0) ++/var/lib/boinc(/.*)? gen_context(system_u:object_r:boinc_var_lib_t,s0) ++/var/lib/boinc/projects(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0) ++/var/lib/boinc/slots(/.*)? gen_context(system_u:object_r:boinc_project_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.if serefpolicy-3.8.8/policy/modules/services/boinc.if --- nsaserefpolicy/policy/modules/services/boinc.if 1969-12-31 19:00:00.000000000 -0500 +++ serefpolicy-3.8.8/policy/modules/services/boinc.if 2010-07-20 10:46:10.000000000 -0400 @@ -11996,8 +11998,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boinc.te serefpolicy-3.8.8/policy/modules/services/boinc.te --- nsaserefpolicy/policy/modules/services/boinc.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.8.8/policy/modules/services/boinc.te 2010-07-20 10:46:10.000000000 -0400 -@@ -0,0 +1,96 @@ ++++ serefpolicy-3.8.8/policy/modules/services/boinc.te 2010-07-27 09:18:03.000000000 -0400 +@@ -0,0 +1,143 @@ +policy_module(boinc,1.0.0) + +######################################## @@ -12021,13 +12023,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin +type boinc_var_lib_t; +files_type(boinc_var_lib_t) + ++type boinc_project_t; ++domain_type(boinc_project_t) ++role system_r types boinc_project_t; ++ ++permissive boinc_project_t; ++ ++type boinc_project_var_lib_t; ++files_type(boinc_project_var_lib_t) ++ +######################################## +# +# boinc local policy +# + +allow boinc_t self:capability { kill }; -+allow boinc_t self:process { execmem ptrace setsched signal signull sigstop sigkill }; ++allow boinc_t self:process { setsched }; + +allow boinc_t self:fifo_file rw_fifo_file_perms; +allow boinc_t self:unix_stream_socket create_stream_socket_perms; @@ -12047,10 +12058,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin +manage_files_pattern(boinc_t, boinc_var_lib_t, boinc_var_lib_t) +files_var_lib_filetrans(boinc_t, boinc_var_lib_t, { file dir } ) + ++manage_dirs_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t) ++manage_files_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_var_lib_t) ++ +kernel_read_system_state(boinc_t) -+kernel_read_network_state(boinc_t) -+kernel_read_kernel_sysctls(boinc_t) -+kernel_search_vm_sysctl(boinc_t) ++ ++files_getattr_all_dirs(boinc_t) ++files_getattr_all_files(boinc_t) + +corecmd_exec_bin(boinc_t) +corecmd_exec_shell(boinc_t) @@ -12094,6 +12108,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/boin +sysnet_dns_name_resolve(boinc_t) + +mta_send_mail(boinc_t) ++ ++######################################## ++# ++# boinc-projects local policy ++# ++ ++domtrans_pattern(boinc_t, boinc_project_var_lib_t, boinc_project_t) ++ ++allow boinc_project_t self:process { ptrace setsched signal signull sigkill sigstop }; ++allow boinc_project_t self:process { execmem execstack }; ++ ++allow boinc_project_t boinc_project_var_lib_t:file entrypoint; ++exec_files_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t) ++manage_dirs_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t) ++manage_files_pattern(boinc_project_t, boinc_project_var_lib_t, boinc_project_var_lib_t) ++files_var_lib_filetrans(boinc_project_t, boinc_project_var_lib_t, { file dir }) ++ ++allow boinc_project_t boinc_project_var_lib_t:file execmod; ++ ++allow boinc_project_t boinc_t:shm rw_shm_perms; ++allow boinc_project_t boinc_tmpfs_t:file { read write }; ++ ++rw_files_pattern(boinc_project_t, boinc_var_lib_t, boinc_var_lib_t) ++ ++kernel_read_system_state(boinc_project_t) ++kernel_read_kernel_sysctls(boinc_project_t) ++kernel_search_vm_sysctl(boinc_project_t) ++kernel_read_network_state(boinc_project_t) ++ ++corenet_tcp_connect_boinc_port(boinc_project_t) ++ ++dev_rw_xserver_misc(boinc_project_t) ++ ++miscfiles_read_localization(boinc_project_t) ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bugzilla.fc serefpolicy-3.8.8/policy/modules/services/bugzilla.fc --- nsaserefpolicy/policy/modules/services/bugzilla.fc 1969-12-31 19:00:00.000000000 -0500 +++ serefpolicy-3.8.8/policy/modules/services/bugzilla.fc 2010-07-20 10:46:10.000000000 -0400 @@ -13716,7 +13765,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron +/var/log/mcelog.* -- gen_context(system_u:object_r:cron_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.8.8/policy/modules/services/cron.if --- nsaserefpolicy/policy/modules/services/cron.if 2009-09-16 09:09:20.000000000 -0400 -+++ serefpolicy-3.8.8/policy/modules/services/cron.if 2010-07-23 08:29:53.000000000 -0400 ++++ serefpolicy-3.8.8/policy/modules/services/cron.if 2010-07-27 11:02:51.000000000 -0400 @@ -12,6 +12,10 @@ ## # @@ -13768,11 +13817,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') role $1 types { cronjob_t crontab_t }; -@@ -116,6 +128,12 @@ +@@ -116,6 +128,13 @@ # Transition from the user domain to the derived domain. domtrans_pattern($2, crontab_exec_t, crontab_t) + allow crond_t $2:process transition; ++ dontaudit crond_t $2:process { noatsecure siginh rlimitinh }; + allow $2 crond_t:process sigchld; + + # needs to be authorized SELinux context for cron @@ -13781,7 +13831,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron # crontab shows up in user ps ps_process_pattern($2, crontab_t) allow $2 crontab_t:process signal; -@@ -154,27 +172,14 @@ +@@ -154,27 +173,14 @@ # interface(`cron_unconfined_role',` gen_require(` @@ -13811,7 +13861,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron optional_policy(` gen_require(` class dbus send_msg; -@@ -408,7 +413,43 @@ +@@ -408,7 +414,43 @@ type crond_t; ') @@ -13856,7 +13906,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') ######################################## -@@ -554,7 +595,7 @@ +@@ -554,7 +596,7 @@ type system_cronjob_t; ') @@ -13865,7 +13915,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') ######################################## -@@ -587,11 +628,14 @@ +@@ -587,11 +629,14 @@ # interface(`cron_read_system_job_tmp_files',` gen_require(` @@ -13881,7 +13931,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') ######################################## -@@ -627,7 +671,48 @@ +@@ -627,7 +672,48 @@ interface(`cron_dontaudit_write_system_job_tmp_files',` gen_require(` type system_cronjob_tmp_t; @@ -23045,8 +23095,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stun kernel_read_system_state(stunnel_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.8.8/policy/modules/services/sysstat.te --- nsaserefpolicy/policy/modules/services/sysstat.te 2010-06-18 13:07:19.000000000 -0400 -+++ serefpolicy-3.8.8/policy/modules/services/sysstat.te 2010-07-20 10:46:11.000000000 -0400 -@@ -68,3 +68,8 @@ ++++ serefpolicy-3.8.8/policy/modules/services/sysstat.te 2010-07-27 09:40:49.000000000 -0400 +@@ -18,8 +18,7 @@ + # Local policy + # + +-allow sysstat_t self:capability { dac_override sys_resource sys_tty_config }; +-dontaudit sysstat_t self:capability sys_admin; ++allow sysstat_t self:capability { dac_override sys_admin sys_resource sys_tty_config }; + allow sysstat_t self:fifo_file rw_fifo_file_perms; + + can_exec(sysstat_t, sysstat_exec_t) +@@ -68,3 +67,8 @@ optional_policy(` logging_send_syslog_msg(sysstat_t) ') @@ -27720,6 +27780,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi. domain_use_interactive_fds(iscsid_t) domain_dontaudit_read_all_domains_state(iscsid_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/kdump.te serefpolicy-3.8.8/policy/modules/system/kdump.te +--- nsaserefpolicy/policy/modules/system/kdump.te 2010-06-18 13:07:19.000000000 -0400 ++++ serefpolicy-3.8.8/policy/modules/system/kdump.te 2010-07-27 11:47:26.000000000 -0400 +@@ -29,6 +29,7 @@ + + kernel_read_system_state(kdump_t) + kernel_read_core_if(kdump_t) ++kernel_read_debugfs(kdump_t) + + dev_read_framebuffer(kdump_t) + dev_read_sysfs(kdump_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.8.8/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2010-03-23 11:19:40.000000000 -0400 +++ serefpolicy-3.8.8/policy/modules/system/libraries.fc 2010-07-22 10:09:46.000000000 -0400 diff --git a/selinux-policy.spec b/selinux-policy.spec index 8ef795b..4467fc6 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -20,7 +20,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.8.8 -Release: 6%{?dist} +Release: 7%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -469,6 +469,11 @@ exit 0 %endif %changelog +* Tue Jul 27 2010 Dan Walsh 3.8.8-7 +- Update boinc policy +- Fix sysstat policy to allow sys_admin +- Change failsafe_context to unconfined_r:unconfined_t:s0 + * Mon Jul 26 2010 Dan Walsh 3.8.8-6 - New paths for upstart diff --git a/sources b/sources index dd0fbd8..581c4ed 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -4c7d323036f1662a06a7a4f2a7da57a5 config.tgz 1f8151f0184945098f3cc3ca0b53e861 serefpolicy-3.8.8.tgz