From b636a32026462708e7039908edbd4c178b1a56c6 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: May 07 2008 19:09:31 +0000 Subject: - Dontaudit pam_t writing homedir --- diff --git a/policy-20070703.patch b/policy-20070703.patch index 567fd1c..c761aaa 100644 --- a/policy-20070703.patch +++ b/policy-20070703.patch @@ -1,58 +1,6 @@ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.8/Rules.modular ---- nsaserefpolicy/Rules.modular 2007-10-22 13:21:44.000000000 -0400 -+++ serefpolicy-3.0.8/Rules.modular 2008-04-04 16:11:04.000000000 -0400 -@@ -96,6 +96,9 @@ - @test -d $(builddir) || mkdir -p $(builddir) - $(verbose) $(SEMOD_PKG) -o $@ -m $(base_mod) -f $(base_fc) -u $(users_extra) -s $(tmpdir)/seusers - -+ifneq "$(UNK_PERMS)" "" -+$(base_mod): CHECKMODULE += -U $(UNK_PERMS) -+endif - $(base_mod): $(base_conf) - @echo "Compiling $(NAME) base module" - $(verbose) $(CHECKMODULE) $^ -o $@ -@@ -144,6 +147,7 @@ - - $(tmpdir)/rolemap.conf: M4PARAM += -D self_contained_policy - $(tmpdir)/rolemap.conf: $(rolemap) -+ $(verbose) echo "" > $@ - $(call parse-rolemap,base,$@) - - $(tmpdir)/all_te_files.conf: M4PARAM += -D self_contained_policy -diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.monolithic serefpolicy-3.0.8/Rules.monolithic ---- nsaserefpolicy/Rules.monolithic 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/Rules.monolithic 2008-04-04 16:11:04.000000000 -0400 -@@ -63,6 +63,9 @@ - # - # Build a binary policy locally - # -+ifneq "$(UNK_PERMS)" "" -+$(polver): CHECKPOLICY += -U $(UNK_PERMS) -+endif - $(polver): $(policy_conf) - @echo "Compiling $(NAME) $(polver)" - ifneq ($(pv),$(kv)) -@@ -76,6 +79,9 @@ - # - # Install a binary policy - # -+ifneq "$(UNK_PERMS)" "" -+$(loadpath): CHECKPOLICY += -U $(UNK_PERMS) -+endif - $(loadpath): $(policy_conf) - @mkdir -p $(policypath) - @echo "Compiling and installing $(NAME) $(loadpath)" -@@ -127,6 +133,7 @@ - @echo "divert" >> $@ - - $(tmpdir)/rolemap.conf: $(rolemap) -+ $(verbose) echo "" > $@ - $(call parse-rolemap,base,$@) - - $(tmpdir)/all_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf $(all_te_files) $(tmpdir)/rolemap.conf diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_contexts serefpolicy-3.0.8/config/appconfig-mcs/default_contexts --- nsaserefpolicy/config/appconfig-mcs/default_contexts 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/config/appconfig-mcs/default_contexts 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-mcs/default_contexts 2007-12-02 21:15:34.000000000 -0500 @@ -1,15 +1,9 @@ -system_r:crond_t:s0 user_r:user_crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 unconfined_r:unconfined_crond_t:s0 -system_r:local_login_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0 @@ -80,7 +28,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default +system_r:xdm_t:s0 system_r:unconfined_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default_type serefpolicy-3.0.8/config/appconfig-mcs/default_type --- nsaserefpolicy/config/appconfig-mcs/default_type 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/config/appconfig-mcs/default_type 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-mcs/default_type 2007-12-02 21:15:34.000000000 -0500 @@ -1,4 +1,4 @@ +system_r:unconfined_t sysadm_r:sysadm_t @@ -89,13 +37,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/default user_r:user_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/failsafe_context serefpolicy-3.0.8/config/appconfig-mcs/failsafe_context --- nsaserefpolicy/config/appconfig-mcs/failsafe_context 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/config/appconfig-mcs/failsafe_context 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-mcs/failsafe_context 2007-12-02 21:15:34.000000000 -0500 @@ -1 +1 @@ -sysadm_r:sysadm_t:s0 +system_r:unconfined_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/guest_u_default_contexts serefpolicy-3.0.8/config/appconfig-mcs/guest_u_default_contexts --- nsaserefpolicy/config/appconfig-mcs/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-mcs/guest_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-mcs/guest_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,4 @@ +system_r:local_login_t:s0 guest_r:guest_t:s0 +system_r:remote_login_t:s0 guest_r:guest_t:s0 @@ -103,7 +51,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/guest_u +system_r:crond_t:s0 guest_r:guest_crond_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/root_default_contexts serefpolicy-3.0.8/config/appconfig-mcs/root_default_contexts --- nsaserefpolicy/config/appconfig-mcs/root_default_contexts 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/config/appconfig-mcs/root_default_contexts 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-mcs/root_default_contexts 2007-12-02 21:15:34.000000000 -0500 @@ -1,11 +1,10 @@ -system_r:crond_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_crond_t:s0 staff_r:staff_crond_t:s0 user_r:user_crond_t:s0 -system_r:local_login_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 @@ -125,7 +73,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/root_de + diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/seusers serefpolicy-3.0.8/config/appconfig-mcs/seusers --- nsaserefpolicy/config/appconfig-mcs/seusers 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/config/appconfig-mcs/seusers 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-mcs/seusers 2007-12-02 21:15:34.000000000 -0500 @@ -1,3 +1,2 @@ -system_u:system_u:s0-mcs_systemhigh root:root:s0-mcs_systemhigh @@ -133,7 +81,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/seusers +__default__:system_u:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/staff_u_default_contexts serefpolicy-3.0.8/config/appconfig-mcs/staff_u_default_contexts --- nsaserefpolicy/config/appconfig-mcs/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-mcs/staff_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-mcs/staff_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,9 @@ +system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +system_r:remote_login_t:s0 staff_r:staff_t:s0 @@ -144,9 +92,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/staff_u +staff_r:staff_sudo_t:s0 staff_r:staff_t:s0 +sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0 +sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/userhelper_context serefpolicy-3.0.8/config/appconfig-mcs/userhelper_context +--- nsaserefpolicy/config/appconfig-mcs/userhelper_context 2007-10-22 13:21:43.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-mcs/userhelper_context 2007-12-02 21:15:34.000000000 -0500 +@@ -1 +1 @@ +-system_u:sysadm_r:sysadm_t:s0 ++system_u:system_r:unconfined_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/user_u_default_contexts serefpolicy-3.0.8/config/appconfig-mcs/user_u_default_contexts --- nsaserefpolicy/config/appconfig-mcs/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-mcs/user_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-mcs/user_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,7 @@ +system_r:local_login_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +system_r:remote_login_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 @@ -155,15 +109,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/user_u_ +system_r:xdm_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +user_r:user_su_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +user_r:user_sudo_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/userhelper_context serefpolicy-3.0.8/config/appconfig-mcs/userhelper_context ---- nsaserefpolicy/config/appconfig-mcs/userhelper_context 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/config/appconfig-mcs/userhelper_context 2008-04-04 16:11:03.000000000 -0400 -@@ -1 +1 @@ --system_u:sysadm_r:sysadm_t:s0 -+system_u:system_r:unconfined_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts serefpolicy-3.0.8/config/appconfig-mcs/xguest_u_default_contexts --- nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-mcs/xguest_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-mcs/xguest_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,5 @@ +system_r:local_login_t xguest_r:xguest_t:s0 +system_r:remote_login_t xguest_r:xguest_t:s0 @@ -172,7 +120,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/xguest_ +system_r:xdm_t xguest_r:xguest_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/default_contexts serefpolicy-3.0.8/config/appconfig-mls/default_contexts --- nsaserefpolicy/config/appconfig-mls/default_contexts 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/config/appconfig-mls/default_contexts 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-mls/default_contexts 2007-12-02 21:15:34.000000000 -0500 @@ -1,15 +1,12 @@ -system_r:crond_t:s0 user_r:user_crond_t:s0 staff_r:staff_crond_t:s0 sysadm_r:sysadm_crond_t:s0 system_r:system_crond_t:s0 unconfined_r:unconfined_crond_t:s0 -system_r:local_login_t:s0 user_r:user_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 unconfined_r:unconfined_t:s0 @@ -202,7 +150,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/default +user_r:user_sudo_t:s0 sysadm_r:sysadm_t:s0 user_r:user_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/guest_u_default_contexts serefpolicy-3.0.8/config/appconfig-mls/guest_u_default_contexts --- nsaserefpolicy/config/appconfig-mls/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-mls/guest_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-mls/guest_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,4 @@ +system_r:local_login_t:s0 guest_r:guest_t:s0 +system_r:remote_login_t:s0 guest_r:guest_t:s0 @@ -210,7 +158,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/guest_u +system_r:crond_t:s0 guest_r:guest_crond_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/root_default_contexts serefpolicy-3.0.8/config/appconfig-mls/root_default_contexts --- nsaserefpolicy/config/appconfig-mls/root_default_contexts 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/config/appconfig-mls/root_default_contexts 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-mls/root_default_contexts 2007-12-02 21:15:34.000000000 -0500 @@ -1,11 +1,9 @@ -system_r:crond_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_crond_t:s0 staff_r:staff_crond_t:s0 user_r:user_crond_t:s0 -system_r:local_login_t:s0 unconfined_r:unconfined_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 @@ -231,7 +179,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/root_de +#system_r:sshd_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/staff_u_default_contexts serefpolicy-3.0.8/config/appconfig-mls/staff_u_default_contexts --- nsaserefpolicy/config/appconfig-mls/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-mls/staff_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-mls/staff_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,9 @@ +system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +system_r:remote_login_t:s0 staff_r:staff_t:s0 @@ -244,7 +192,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/staff_u +sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/user_u_default_contexts serefpolicy-3.0.8/config/appconfig-mls/user_u_default_contexts --- nsaserefpolicy/config/appconfig-mls/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-mls/user_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-mls/user_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,7 @@ +system_r:local_login_t:s0 user_r:user_t:s0 +system_r:remote_login_t:s0 user_r:user_t:s0 @@ -255,7 +203,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mls/user_u_ +user_r:user_sudo_t:s0 user_r:user_t:s0 diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/guest_u_default_contexts serefpolicy-3.0.8/config/appconfig-standard/guest_u_default_contexts --- nsaserefpolicy/config/appconfig-standard/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-standard/guest_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-standard/guest_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,4 @@ +system_r:local_login_t guest_r:guest_t +system_r:remote_login_t guest_r:guest_t @@ -263,7 +211,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/gu +system_r:crond_t guest_r:guest_crond_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/staff_u_default_contexts serefpolicy-3.0.8/config/appconfig-standard/staff_u_default_contexts --- nsaserefpolicy/config/appconfig-standard/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-standard/staff_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-standard/staff_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,9 @@ +system_r:local_login_t staff_r:staff_t sysadm_r:sysadm_t +system_r:remote_login_t staff_r:staff_t @@ -276,7 +224,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/st +sysadm_r:sysadm_sudo_t sysadm_r:sysadm_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/user_u_default_contexts serefpolicy-3.0.8/config/appconfig-standard/user_u_default_contexts --- nsaserefpolicy/config/appconfig-standard/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-standard/user_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-standard/user_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,7 @@ +system_r:local_login_t system_r:unconfined_t user_r:user_t +system_r:remote_login_t system_r:unconfined_t user_r:user_t @@ -287,7 +235,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/us +user_r:user_sudo_t system_r:unconfined_t user_r:user_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/xguest_u_default_contexts serefpolicy-3.0.8/config/appconfig-standard/xguest_u_default_contexts --- nsaserefpolicy/config/appconfig-standard/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/config/appconfig-standard/xguest_u_default_contexts 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/config/appconfig-standard/xguest_u_default_contexts 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,5 @@ +system_r:local_login_t xguest_r:xguest_t +system_r:remote_login_t xguest_r:xguest_t @@ -296,7 +244,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-standard/xg +system_r:xdm_t xguest_r:xguest_t diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-3.0.8/man/man8/ftpd_selinux.8 --- nsaserefpolicy/man/man8/ftpd_selinux.8 2007-10-22 13:21:44.000000000 -0400 -+++ serefpolicy-3.0.8/man/man8/ftpd_selinux.8 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/man/man8/ftpd_selinux.8 2007-12-02 21:15:34.000000000 -0500 @@ -12,7 +12,7 @@ .TP chcon -R -t public_content_t /var/ftp @@ -308,7 +256,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 sere .TP diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/httpd_selinux.8 serefpolicy-3.0.8/man/man8/httpd_selinux.8 --- nsaserefpolicy/man/man8/httpd_selinux.8 2007-10-22 13:21:44.000000000 -0400 -+++ serefpolicy-3.0.8/man/man8/httpd_selinux.8 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/man/man8/httpd_selinux.8 2007-12-02 21:15:34.000000000 -0500 @@ -30,7 +30,7 @@ .EX httpd_sys_script_ro_t @@ -320,7 +268,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/httpd_selinux.8 ser .EE diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/samba_selinux.8 serefpolicy-3.0.8/man/man8/samba_selinux.8 --- nsaserefpolicy/man/man8/samba_selinux.8 2007-10-22 13:21:44.000000000 -0400 -+++ serefpolicy-3.0.8/man/man8/samba_selinux.8 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/man/man8/samba_selinux.8 2007-12-02 21:15:34.000000000 -0500 @@ -1,50 +1,83 @@ -.TH "samba_selinux" "8" "17 Jan 2005" "dwalsh@redhat.com" "Samba Selinux Policy documentation" +.TH "samba_selinux" "8" "9 Nov 2007" "dwalsh@redhat.com" "Samba Selinux Policy documentation" @@ -441,7 +389,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/samba_selinux.8 ser +selinux(8), semanage(8), samba(7), chcon(1), setsebool(8), restorecon(8), diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/ftpd_selinux.8 serefpolicy-3.0.8/man/ru/man8/ftpd_selinux.8 --- nsaserefpolicy/man/ru/man8/ftpd_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/man/ru/man8/ftpd_selinux.8 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/man/ru/man8/ftpd_selinux.8 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,57 @@ +.TH "ftpd_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "ftpd Selinux Policy documentation" +.SH "НАЗВАНИЕ" @@ -502,7 +450,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/ftpd_selinux.8 s + diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/httpd_selinux.8 serefpolicy-3.0.8/man/ru/man8/httpd_selinux.8 --- nsaserefpolicy/man/ru/man8/httpd_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/man/ru/man8/httpd_selinux.8 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/man/ru/man8/httpd_selinux.8 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,137 @@ +.TH "httpd_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "httpd Selinux Policy documentation" +.de EX @@ -643,7 +591,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/httpd_selinux.8 + diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/kerberos_selinux.8 serefpolicy-3.0.8/man/ru/man8/kerberos_selinux.8 --- nsaserefpolicy/man/ru/man8/kerberos_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/man/ru/man8/kerberos_selinux.8 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/man/ru/man8/kerberos_selinux.8 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,30 @@ +.TH "kerberos_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "kerberos Selinux Policy documentation" +.de EX @@ -677,7 +625,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/kerberos_selinux +selinux(8), kerberos(1), chcon(1), setsebool(8) diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/named_selinux.8 serefpolicy-3.0.8/man/ru/man8/named_selinux.8 --- nsaserefpolicy/man/ru/man8/named_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/man/ru/man8/named_selinux.8 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/man/ru/man8/named_selinux.8 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,31 @@ +.TH "named_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "named Selinux Policy documentation" +.de EX @@ -712,7 +660,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/named_selinux.8 + diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/nfs_selinux.8 serefpolicy-3.0.8/man/ru/man8/nfs_selinux.8 --- nsaserefpolicy/man/ru/man8/nfs_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/man/ru/man8/nfs_selinux.8 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/man/ru/man8/nfs_selinux.8 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,33 @@ +.TH "nfs_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "nfs Selinux Policy documentation" +.SH "НАЗВАНИЕ" @@ -749,7 +697,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/nfs_selinux.8 se +selinux(8), chcon(1), setsebool(8) diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/rsync_selinux.8 serefpolicy-3.0.8/man/ru/man8/rsync_selinux.8 --- nsaserefpolicy/man/ru/man8/rsync_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/man/ru/man8/rsync_selinux.8 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/man/ru/man8/rsync_selinux.8 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,50 @@ +.TH "rsync_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "rsync Selinux Policy documentation" +.de EX @@ -803,7 +751,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/rsync_selinux.8 +selinux(8), rsync(1), chcon(1), setsebool(8) diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/samba_selinux.8 serefpolicy-3.0.8/man/ru/man8/samba_selinux.8 --- nsaserefpolicy/man/ru/man8/samba_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/man/ru/man8/samba_selinux.8 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/man/ru/man8/samba_selinux.8 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,60 @@ +.TH "samba_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "Samba Selinux Policy documentation" +.SH "НАЗВАНИЕ" @@ -867,7 +815,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/samba_selinux.8 +selinux(8), samba(7), chcon(1), setsebool(8) diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/ypbind_selinux.8 serefpolicy-3.0.8/man/ru/man8/ypbind_selinux.8 --- nsaserefpolicy/man/ru/man8/ypbind_selinux.8 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/man/ru/man8/ypbind_selinux.8 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/man/ru/man8/ypbind_selinux.8 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,19 @@ +.TH "ypbind_selinux" "8" "17 Янв 2005" "dwalsh@redhat.com" "ypbind Selinux Policy documentation" +.SH "НАЗВАНИЕ" @@ -890,7 +838,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/ru/man8/ypbind_selinux.8 +selinux(8), ypbind(8), chcon(1), setsebool(8) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.0.8/policy/flask/access_vectors --- nsaserefpolicy/policy/flask/access_vectors 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/flask/access_vectors 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/flask/access_vectors 2007-12-02 21:15:34.000000000 -0500 @@ -639,6 +639,8 @@ send recv @@ -902,7 +850,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors class key diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.0.8/policy/global_tunables --- nsaserefpolicy/policy/global_tunables 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/policy/global_tunables 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/global_tunables 2007-12-02 21:15:34.000000000 -0500 @@ -133,3 +133,18 @@ ## gen_tunable(write_untrusted_content,false) @@ -924,7 +872,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-3.0.8/policy/modules/admin/alsa.fc --- nsaserefpolicy/policy/modules/admin/alsa.fc 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/alsa.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/alsa.fc 2007-12-02 21:15:34.000000000 -0500 @@ -1,4 +1,11 @@ +/etc/alsa/asound\.state -- gen_context(system_u:object_r:alsa_etc_rw_t,s0) @@ -939,7 +887,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc +/bin/alsaunmute -- gen_context(system_u:object_r:alsa_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.if serefpolicy-3.0.8/policy/modules/admin/alsa.if --- nsaserefpolicy/policy/modules/admin/alsa.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/alsa.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/alsa.if 2007-12-02 21:15:34.000000000 -0500 @@ -74,3 +74,39 @@ read_files_pattern($1,alsa_etc_rw_t,alsa_etc_rw_t) read_lnk_files_pattern($1,alsa_etc_rw_t,alsa_etc_rw_t) @@ -982,7 +930,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.0.8/policy/modules/admin/alsa.te --- nsaserefpolicy/policy/modules/admin/alsa.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/alsa.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/alsa.te 2007-12-02 21:15:34.000000000 -0500 @@ -8,31 +8,47 @@ type alsa_t; @@ -1052,7 +1000,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.if serefpolicy-3.0.8/policy/modules/admin/amanda.if --- nsaserefpolicy/policy/modules/admin/amanda.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/amanda.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/amanda.if 2007-12-02 21:15:34.000000000 -0500 @@ -71,6 +71,26 @@ ######################################## @@ -1087,7 +1035,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda.te serefpolicy-3.0.8/policy/modules/admin/amanda.te --- nsaserefpolicy/policy/modules/admin/amanda.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/amanda.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/amanda.te 2007-12-02 21:15:34.000000000 -0500 @@ -74,7 +74,6 @@ allow amanda_t self:unix_dgram_socket create_socket_perms; allow amanda_t self:tcp_socket create_stream_socket_perms; @@ -1155,7 +1103,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/amanda. -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.0.8/policy/modules/admin/anaconda.te --- nsaserefpolicy/policy/modules/admin/anaconda.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/anaconda.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/anaconda.te 2007-12-02 21:15:34.000000000 -0500 @@ -31,16 +31,13 @@ modutils_domtrans_insmod(anaconda_t) @@ -1176,7 +1124,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anacond diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-3.0.8/policy/modules/admin/bootloader.te --- nsaserefpolicy/policy/modules/admin/bootloader.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/bootloader.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/bootloader.te 2007-12-02 21:15:34.000000000 -0500 @@ -215,3 +215,7 @@ userdom_dontaudit_search_staff_home_dirs(bootloader_t) userdom_dontaudit_search_sysadm_home_dirs(bootloader_t) @@ -1187,7 +1135,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloa +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/brctl.if serefpolicy-3.0.8/policy/modules/admin/brctl.if --- nsaserefpolicy/policy/modules/admin/brctl.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/brctl.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/brctl.if 2007-12-02 21:15:34.000000000 -0500 @@ -17,3 +17,21 @@ domtrans_pattern($1,brctl_exec_t,brctl_t) @@ -1212,7 +1160,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/brctl.i +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/brctl.te serefpolicy-3.0.8/policy/modules/admin/brctl.te --- nsaserefpolicy/policy/modules/admin/brctl.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/brctl.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/brctl.te 2007-12-02 21:15:34.000000000 -0500 @@ -25,6 +25,7 @@ kernel_read_network_state(brctl_t) kernel_read_sysctl(brctl_t) @@ -1229,7 +1177,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/brctl.t ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.0.8/policy/modules/admin/consoletype.te --- nsaserefpolicy/policy/modules/admin/consoletype.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/consoletype.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/consoletype.te 2007-12-02 21:15:34.000000000 -0500 @@ -8,9 +8,11 @@ type consoletype_t; @@ -1282,7 +1230,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmidecode.te serefpolicy-3.0.8/policy/modules/admin/dmidecode.te --- nsaserefpolicy/policy/modules/admin/dmidecode.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/dmidecode.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/dmidecode.te 2007-12-02 21:15:34.000000000 -0500 @@ -20,6 +20,7 @@ # Allow dmidecode to read /dev/mem @@ -1293,7 +1241,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/dmideco diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstboot.te serefpolicy-3.0.8/policy/modules/admin/firstboot.te --- nsaserefpolicy/policy/modules/admin/firstboot.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/firstboot.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/firstboot.te 2007-12-02 21:15:34.000000000 -0500 @@ -120,6 +120,10 @@ usermanage_domtrans_admin_passwd(firstboot_t) ') @@ -1315,16 +1263,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/firstbo ') dnl end TODO diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.fc serefpolicy-3.0.8/policy/modules/admin/kismet.fc --- nsaserefpolicy/policy/modules/admin/kismet.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/admin/kismet.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/kismet.fc 2008-05-02 15:51:19.000000000 -0400 @@ -0,0 +1,5 @@ + -+/usr/bin/kismet -- gen_context(system_u:object_r:kismet_exec_t,s0) ++/usr/bin/kismet_server -- gen_context(system_u:object_r:kismet_exec_t,s0) +/var/run/kismet_server.pid -- gen_context(system_u:object_r:kismet_var_run_t,s0) +/var/lib/kismet(/.*)? gen_context(system_u:object_r:kismet_var_lib_t,s0) +/var/log/kismet(/.*)? gen_context(system_u:object_r:kismet_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.if serefpolicy-3.0.8/policy/modules/admin/kismet.if --- nsaserefpolicy/policy/modules/admin/kismet.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/admin/kismet.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/kismet.if 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,277 @@ + +## policy for kismet @@ -1561,7 +1509,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. + + kismet_domtrans($1) + role $2 types kismet_t; -+ allow kismet_t $3:chr_file rw_term_perms; ++ dontaudit kismet_t $3:chr_file rw_term_perms; +') + + @@ -1605,8 +1553,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet.te serefpolicy-3.0.8/policy/modules/admin/kismet.te --- nsaserefpolicy/policy/modules/admin/kismet.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/admin/kismet.te 2008-04-04 16:11:03.000000000 -0400 -@@ -0,0 +1,57 @@ ++++ serefpolicy-3.0.8/policy/modules/admin/kismet.te 2008-05-02 15:51:08.000000000 -0400 +@@ -0,0 +1,69 @@ ++ +policy_module(kismet,1.0.0) + +######################################## @@ -1619,7 +1568,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. +application_domain(kismet_t, kismet_exec_t) +role system_r types kismet_t; + -+ +type kismet_var_run_t; +files_pid_file(kismet_var_run_t) + @@ -1634,19 +1582,28 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. +# kismet local policy +# + -+allow kismet_t self:capability { net_admin setuid setgid }; ++allow kismet_t self:capability { net_raw net_admin setuid setgid }; ++allow kismet_t self:process { signal sigkill }; ++allow kismet_t self:fifo_file rw_file_perms; ++allow kismet_t self:tcp_socket create_stream_socket_perms; ++allow kismet_t self:unix_dgram_socket create_socket_perms; ++allow kismet_t self:unix_stream_socket create_stream_socket_perms; ++allow kismet_t self:packet_socket create_socket_perms; + +corecmd_exec_bin(kismet_t) + -+auth_use_nsswitch(kismet_t) ++corenet_all_recvfrom_unlabeled(kismet_t) ++corenet_all_recvfrom_netlabel(kismet_t) ++corenet_tcp_bind_all_nodes(kismet_t) ++corenet_tcp_sendrecv_all_ports(kismet_t) ++corenet_tcp_sendrecv_all_if(kismet_t) ++corenet_tcp_sendrecv_all_nodes(kismet_t) ++corenet_tcp_bind_rtsclient_port(kismet_t) + -+allow kismet_t self:fifo_file rw_file_perms; -+allow kismet_t self:unix_stream_socket create_stream_socket_perms; ++auth_use_nsswitch(kismet_t) + +files_read_etc_files(kismet_t) + -+kernel_load_module(kismet_t) -+ +libs_use_ld_so(kismet_t) +libs_use_shared_libs(kismet_t) + @@ -1664,9 +1621,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kismet. +allow kismet_t kismet_log_t:dir { rw_dir_perms setattr }; +logging_log_filetrans(kismet_t,kismet_log_t,{ file dir }) + ++optional_policy(` ++ dbus_system_bus_client_template(kismet,kismet_t) ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-3.0.8/policy/modules/admin/kudzu.te --- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/kudzu.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/kudzu.te 2007-12-18 13:49:54.000000000 -0500 @@ -21,8 +21,8 @@ # Local policy # @@ -1739,7 +1699,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.0.8/policy/modules/admin/logrotate.te --- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/logrotate.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/logrotate.te 2007-12-02 21:15:34.000000000 -0500 @@ -96,6 +96,7 @@ files_read_etc_files(logrotate_t) files_read_etc_runtime_files(logrotate_t) @@ -1750,7 +1710,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota files_manage_generic_spool_dirs(logrotate_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.0.8/policy/modules/admin/logwatch.te --- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/logwatch.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/logwatch.te 2007-12-02 21:15:34.000000000 -0500 @@ -48,7 +48,7 @@ corecmd_exec_shell(logwatch_t) @@ -1788,20 +1748,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc samba_read_log(logwatch_t) + samba_read_share_files(logwatch_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/mrtg.te serefpolicy-3.0.8/policy/modules/admin/mrtg.te ---- nsaserefpolicy/policy/modules/admin/mrtg.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/mrtg.te 2008-04-17 11:16:21.000000000 -0400 -@@ -78,6 +78,7 @@ - dev_read_urand(mrtg_t) - - domain_use_interactive_fds(mrtg_t) -+domain_dontaudit_search_all_domains_state(mrtg_t) - - files_read_usr_files(mrtg_t) - files_search_var(mrtg_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.0.8/policy/modules/admin/netutils.te --- nsaserefpolicy/policy/modules/admin/netutils.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/netutils.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/netutils.te 2007-12-02 21:15:34.000000000 -0500 @@ -40,7 +40,7 @@ allow netutils_t self:capability { net_admin net_raw setuid setgid }; dontaudit netutils_t self:capability sys_tty_config; @@ -1860,7 +1809,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil kernel_read_system_state(traceroute_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage.if serefpolicy-3.0.8/policy/modules/admin/portage.if --- nsaserefpolicy/policy/modules/admin/portage.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/portage.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/portage.if 2007-12-02 21:15:34.000000000 -0500 @@ -324,6 +324,7 @@ seutil_domtrans_setfiles($1) # run semodule @@ -1871,7 +1820,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/portage diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.0.8/policy/modules/admin/prelink.te --- nsaserefpolicy/policy/modules/admin/prelink.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/prelink.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/prelink.te 2007-12-02 21:15:34.000000000 -0500 @@ -26,7 +26,7 @@ # Local policy # @@ -1933,7 +1882,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.0.8/policy/modules/admin/rpm.fc --- nsaserefpolicy/policy/modules/admin/rpm.fc 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/rpm.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/rpm.fc 2007-12-02 21:15:34.000000000 -0500 @@ -11,6 +11,7 @@ /usr/sbin/system-install-packages -- gen_context(system_u:object_r:rpm_exec_t,s0) @@ -1952,17 +1901,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc ') /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) -@@ -29,6 +33,7 @@ - - /var/log/rpmpkgs.* -- gen_context(system_u:object_r:rpm_log_t,s0) - /var/log/yum\.log.* -- gen_context(system_u:object_r:rpm_log_t,s0) -+/var/run/yum.* -- gen_context(system_u:object_r:rpm_var_run_t,s0) - - # SuSE - ifdef(`distro_suse', ` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.0.8/policy/modules/admin/rpm.if --- nsaserefpolicy/policy/modules/admin/rpm.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/rpm.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/rpm.if 2008-01-08 08:11:19.000000000 -0500 @@ -152,6 +152,45 @@ ######################################## @@ -2065,7 +2006,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if ') ######################################## -@@ -289,3 +369,130 @@ +@@ -289,3 +369,112 @@ dontaudit $1 rpm_var_lib_t:file manage_file_perms; dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms; ') @@ -2178,48 +2119,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if + read_lnk_files_pattern($1,rpm_tmpfs_t,rpm_tmpfs_t) +') + -+######################################## -+## -+## Do not audit attempts to write, and delete the -+## RPM var run files -+## -+## -+## -+## Domain to not audit. -+## -+## -+# -+interface(`rpm_dontaudit_write_pid_files',` -+ gen_require(` -+ type rpm_var_run_t; -+ ') -+ -+ dontaudit $1 rpm_var_run_t:file write_file_perms; -+') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.0.8/policy/modules/admin/rpm.te --- nsaserefpolicy/policy/modules/admin/rpm.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/rpm.te 2008-04-04 16:11:03.000000000 -0400 -@@ -31,6 +31,9 @@ - files_type(rpm_var_lib_t) - typealias rpm_var_lib_t alias var_lib_rpm_t; - -+type rpm_var_run_t; -+files_pid_file(rpm_var_run_t) -+ - type rpm_script_t; - type rpm_script_exec_t; - domain_obj_id_change_exemption(rpm_script_t) -@@ -89,6 +92,9 @@ - manage_files_pattern(rpm_t,rpm_var_lib_t,rpm_var_lib_t) - files_var_lib_filetrans(rpm_t,rpm_var_lib_t,dir) - -+manage_files_pattern(rpm_t,rpm_var_run_t,rpm_var_run_t) -+files_pid_filetrans(rpm_t,rpm_var_run_t, file) -+ - kernel_read_system_state(rpm_t) - kernel_read_kernel_sysctls(rpm_t) - -@@ -139,6 +145,7 @@ ++++ serefpolicy-3.0.8/policy/modules/admin/rpm.te 2007-12-02 21:15:34.000000000 -0500 +@@ -139,6 +139,7 @@ auth_relabel_all_files_except_shadow(rpm_t) auth_manage_all_files_except_shadow(rpm_t) auth_dontaudit_read_shadow(rpm_t) @@ -2227,7 +2130,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te # transition to rpm script: rpm_domtrans_script(rpm_t) -@@ -180,11 +187,18 @@ +@@ -180,11 +181,18 @@ ') optional_policy(` @@ -2250,7 +2153,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te ') optional_policy(` -@@ -195,6 +209,7 @@ +@@ -195,6 +203,7 @@ unconfined_domain(rpm_t) # yum-updatesd requires this unconfined_dbus_chat(rpm_t) @@ -2258,7 +2161,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te ') ifdef(`TODO',` -@@ -321,6 +336,7 @@ +@@ -321,6 +330,7 @@ seutil_domtrans_loadpolicy(rpm_script_t) seutil_domtrans_setfiles(rpm_script_t) seutil_domtrans_semanage(rpm_script_t) @@ -2266,9 +2169,83 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te userdom_use_all_users_fds(rpm_script_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.0.8/policy/modules/admin/sudo.if +--- nsaserefpolicy/policy/modules/admin/sudo.if 2007-10-22 13:21:42.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/sudo.if 2007-12-02 21:15:34.000000000 -0500 +@@ -55,7 +55,7 @@ + # + + # Use capabilities. +- allow $1_sudo_t self:capability { fowner setuid setgid dac_override sys_resource }; ++ allow $1_sudo_t self:capability { fowner setuid setgid dac_override sys_nice sys_resource }; + allow $1_sudo_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; + allow $1_sudo_t self:process { setexec setrlimit }; + allow $1_sudo_t self:fd use; +@@ -68,7 +68,6 @@ + allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms; + allow $1_sudo_t self:unix_dgram_socket sendto; + allow $1_sudo_t self:unix_stream_socket connectto; +- allow $1_sudo_t self:netlink_audit_socket { create bind write nlmsg_read read }; + allow $1_sudo_t self:netlink_route_socket r_netlink_socket_perms; + + # Enter this derived domain from the user domain +@@ -76,6 +75,7 @@ + + # By default, revert to the calling domain when a shell is executed. + corecmd_shell_domtrans($1_sudo_t,$2) ++ corecmd_bin_domtrans($1_sudo_t,$2) + allow $2 $1_sudo_t:fd use; + allow $2 $1_sudo_t:fifo_file rw_file_perms; + allow $2 $1_sudo_t:process sigchld; +@@ -89,9 +89,11 @@ + fs_search_auto_mountpoints($1_sudo_t) + fs_getattr_xattr_fs($1_sudo_t) + +- auth_domtrans_chk_passwd($1_sudo_t) ++ auth_run_chk_passwd($1_sudo_t, $3, { $1_tty_device_t $1_devpts_t }) ++ auth_run_upd_passwd($1_sudo_t, $3, { $1_tty_device_t $1_devpts_t }) + # sudo stores a token in the pam_pid directory + auth_manage_pam_pid($1_sudo_t) ++ auth_search_key($1_sudo_t) + + corecmd_read_bin_symlinks($1_sudo_t) + corecmd_getattr_all_executables($1_sudo_t) +@@ -106,18 +108,21 @@ + files_getattr_usr_files($1_sudo_t) + # for some PAM modules and for cwd + files_dontaudit_search_home($1_sudo_t) ++ files_list_tmp($1_sudo_t) + + init_rw_utmp($1_sudo_t) + + libs_use_ld_so($1_sudo_t) + libs_use_shared_libs($1_sudo_t) + ++ logging_send_audit_msgs($1_sudo_t) + logging_send_syslog_msg($1_sudo_t) + + miscfiles_read_localization($1_sudo_t) + + userdom_manage_user_home_content_files($1,$1_sudo_t) + userdom_manage_user_home_content_symlinks($1,$1_sudo_t) ++ + userdom_manage_user_tmp_files($1,$1_sudo_t) + userdom_manage_user_tmp_symlinks($1,$1_sudo_t) + userdom_use_user_terminals($1,$1_sudo_t) +@@ -126,6 +131,10 @@ + userdom_dontaudit_search_all_users_home_content($1_sudo_t) + + optional_policy(` ++ locallogin_search_keys($1_sudo_t) ++ ') ++ ++ optional_policy(` + nis_use_ypbind($1_sudo_t) + ') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.0.8/policy/modules/admin/su.if --- nsaserefpolicy/policy/modules/admin/su.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/su.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/su.if 2007-12-02 21:15:34.000000000 -0500 @@ -41,12 +41,11 @@ allow $2 $1_su_t:process signal; @@ -2364,83 +2341,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s ifdef(`TODO',` allow $1_su_t $1_home_t:file manage_file_perms; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.0.8/policy/modules/admin/sudo.if ---- nsaserefpolicy/policy/modules/admin/sudo.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/sudo.if 2008-04-04 16:11:03.000000000 -0400 -@@ -55,7 +55,7 @@ - # - - # Use capabilities. -- allow $1_sudo_t self:capability { fowner setuid setgid dac_override sys_resource }; -+ allow $1_sudo_t self:capability { fowner setuid setgid dac_override sys_nice sys_resource }; - allow $1_sudo_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; - allow $1_sudo_t self:process { setexec setrlimit }; - allow $1_sudo_t self:fd use; -@@ -68,7 +68,6 @@ - allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms; - allow $1_sudo_t self:unix_dgram_socket sendto; - allow $1_sudo_t self:unix_stream_socket connectto; -- allow $1_sudo_t self:netlink_audit_socket { create bind write nlmsg_read read }; - allow $1_sudo_t self:netlink_route_socket r_netlink_socket_perms; - - # Enter this derived domain from the user domain -@@ -76,6 +75,7 @@ - - # By default, revert to the calling domain when a shell is executed. - corecmd_shell_domtrans($1_sudo_t,$2) -+ corecmd_bin_domtrans($1_sudo_t,$2) - allow $2 $1_sudo_t:fd use; - allow $2 $1_sudo_t:fifo_file rw_file_perms; - allow $2 $1_sudo_t:process sigchld; -@@ -89,9 +89,11 @@ - fs_search_auto_mountpoints($1_sudo_t) - fs_getattr_xattr_fs($1_sudo_t) - -- auth_domtrans_chk_passwd($1_sudo_t) -+ auth_run_chk_passwd($1_sudo_t, $3, { $1_tty_device_t $1_devpts_t }) -+ auth_run_upd_passwd($1_sudo_t, $3, { $1_tty_device_t $1_devpts_t }) - # sudo stores a token in the pam_pid directory - auth_manage_pam_pid($1_sudo_t) -+ auth_search_key($1_sudo_t) - - corecmd_read_bin_symlinks($1_sudo_t) - corecmd_getattr_all_executables($1_sudo_t) -@@ -106,18 +108,21 @@ - files_getattr_usr_files($1_sudo_t) - # for some PAM modules and for cwd - files_dontaudit_search_home($1_sudo_t) -+ files_list_tmp($1_sudo_t) - - init_rw_utmp($1_sudo_t) - - libs_use_ld_so($1_sudo_t) - libs_use_shared_libs($1_sudo_t) - -+ logging_send_audit_msgs($1_sudo_t) - logging_send_syslog_msg($1_sudo_t) - - miscfiles_read_localization($1_sudo_t) - - userdom_manage_user_home_content_files($1,$1_sudo_t) - userdom_manage_user_home_content_symlinks($1,$1_sudo_t) -+ - userdom_manage_user_tmp_files($1,$1_sudo_t) - userdom_manage_user_tmp_symlinks($1,$1_sudo_t) - userdom_use_user_terminals($1,$1_sudo_t) -@@ -126,6 +131,10 @@ - userdom_dontaudit_search_all_users_home_content($1_sudo_t) - - optional_policy(` -+ locallogin_search_keys($1_sudo_t) -+ ') -+ -+ optional_policy(` - nis_use_ypbind($1_sudo_t) - ') - diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.te serefpolicy-3.0.8/policy/modules/admin/tmpreaper.te --- nsaserefpolicy/policy/modules/admin/tmpreaper.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/tmpreaper.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/tmpreaper.te 2007-12-02 21:15:34.000000000 -0500 @@ -28,6 +28,7 @@ files_purge_tmp(tmpreaper_t) # why does it need setattr? @@ -2449,14 +2352,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreap mls_file_read_all_levels(tmpreaper_t) mls_file_write_all_levels(tmpreaper_t) -@@ -43,5 +44,14 @@ +@@ -43,5 +44,10 @@ cron_system_entry(tmpreaper_t,tmpreaper_exec_t) optional_policy(` -+ amavis_manage_spool_files(tmpreaper_t) -+') -+ -+optional_policy(` + kismet_manage_log(tmpreaper_t) +') + @@ -2466,7 +2365,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreap + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.0.8/policy/modules/admin/usermanage.if --- nsaserefpolicy/policy/modules/admin/usermanage.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/usermanage.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/usermanage.if 2007-12-02 21:15:34.000000000 -0500 @@ -265,6 +265,24 @@ ######################################## @@ -2494,7 +2393,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.0.8/policy/modules/admin/usermanage.te --- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/usermanage.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/usermanage.te 2007-12-17 10:55:24.000000000 -0500 @@ -92,10 +92,12 @@ dev_read_urand(chfn_t) @@ -2508,15 +2407,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman domain_use_interactive_fds(chfn_t) -@@ -238,6 +240,7 @@ - userdom_use_unpriv_users_fds(groupadd_t) - # for when /root is the cwd - userdom_dontaudit_search_sysadm_home_dirs(groupadd_t) -+userdom_dontaudit_search_all_users_home_content(groupadd_t) - - optional_policy(` - dpkg_use_fds(groupadd_t) -@@ -297,9 +300,11 @@ +@@ -297,9 +299,11 @@ term_use_all_user_ttys(passwd_t) term_use_all_user_ptys(passwd_t) @@ -2528,7 +2419,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman # allow checking if a shell is executable corecmd_check_exec_shell(passwd_t) -@@ -315,6 +320,7 @@ +@@ -315,6 +319,7 @@ # /usr/bin/passwd asks for w access to utmp, but it will operate # correctly without it. Do not audit write denials to utmp. init_dontaudit_rw_utmp(passwd_t) @@ -2536,15 +2427,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman libs_use_ld_so(passwd_t) libs_use_shared_libs(passwd_t) -@@ -511,6 +517,7 @@ - userdom_use_unpriv_users_fds(useradd_t) - # for when /root is the cwd - userdom_dontaudit_search_sysadm_home_dirs(useradd_t) -+userdom_dontaudit_search_all_users_home_content(useradd_t) - # Add/remove user home directories - userdom_home_filetrans_generic_user_home_dir(useradd_t) - userdom_manage_all_users_home_content_dirs(useradd_t) -@@ -520,6 +527,10 @@ +@@ -520,6 +525,10 @@ mta_manage_spool(useradd_t) optional_policy(` @@ -2555,7 +2438,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman dpkg_use_fds(useradd_t) dpkg_rw_pipes(useradd_t) ') -@@ -529,6 +540,12 @@ +@@ -529,6 +538,12 @@ ') optional_policy(` @@ -2570,17 +2453,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.0.8/policy/modules/admin/vbetool.te --- nsaserefpolicy/policy/modules/admin/vbetool.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/vbetool.te 2008-04-04 16:11:03.000000000 -0400 -@@ -23,6 +23,8 @@ - dev_rwx_zero(vbetool_t) - dev_read_sysfs(vbetool_t) - -+domain_mmap_low(vbetool_t) -+ - term_use_unallocated_ttys(vbetool_t) - - libs_use_ld_so(vbetool_t) -@@ -33,4 +35,5 @@ ++++ serefpolicy-3.0.8/policy/modules/admin/vbetool.te 2007-12-02 21:15:34.000000000 -0500 +@@ -33,4 +33,5 @@ optional_policy(` hal_rw_pid_files(vbetool_t) hal_write_log(vbetool_t) @@ -2588,7 +2462,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.fc serefpolicy-3.0.8/policy/modules/admin/vpn.fc --- nsaserefpolicy/policy/modules/admin/vpn.fc 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/vpn.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/vpn.fc 2007-12-02 21:15:34.000000000 -0500 @@ -7,3 +7,5 @@ # sbin # @@ -2597,7 +2471,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.fc +/var/run/vpnc(/.*)? gen_context(system_u:object_r:vpnc_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.if serefpolicy-3.0.8/policy/modules/admin/vpn.if --- nsaserefpolicy/policy/modules/admin/vpn.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/vpn.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/vpn.if 2007-12-02 21:15:34.000000000 -0500 @@ -67,3 +67,25 @@ allow $1 vpnc_t:process signal; @@ -2626,7 +2500,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.if + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te serefpolicy-3.0.8/policy/modules/admin/vpn.te --- nsaserefpolicy/policy/modules/admin/vpn.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/vpn.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/admin/vpn.te 2007-12-02 21:15:34.000000000 -0500 @@ -22,7 +22,7 @@ # Local policy # @@ -2673,7 +2547,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vpn.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if serefpolicy-3.0.8/policy/modules/apps/ada.if --- nsaserefpolicy/policy/modules/apps/ada.if 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/ada.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/ada.if 2007-12-02 21:15:34.000000000 -0500 @@ -18,3 +18,34 @@ corecmd_search_bin($1) domtrans_pattern($1, ada_exec_t, ada_t) @@ -2711,7 +2585,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if s +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats.fc serefpolicy-3.0.8/policy/modules/apps/awstats.fc --- nsaserefpolicy/policy/modules/apps/awstats.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/apps/awstats.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/awstats.fc 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,5 @@ +/usr/share/awstats/tools/.+\.pl -- gen_context(system_u:object_r:awstats_exec_t,s0) +/usr/share/awstats/wwwroot(/.*)? gen_context(system_u:object_r:httpd_awstats_content_t,s0) @@ -2720,7 +2594,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats. +/var/lib/awstats(/.*)? gen_context(system_u:object_r:awstats_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats.if serefpolicy-3.0.8/policy/modules/apps/awstats.if --- nsaserefpolicy/policy/modules/apps/awstats.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/apps/awstats.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/awstats.if 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,42 @@ +## +## AWStats is a free powerful and featureful tool that generates advanced @@ -2766,7 +2640,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats.te serefpolicy-3.0.8/policy/modules/apps/awstats.te --- nsaserefpolicy/policy/modules/apps/awstats.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/apps/awstats.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/awstats.te 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,77 @@ + +policy_module(awstats,1.0.0) @@ -2847,7 +2721,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/awstats. +files_search_var_lib(httpd_awstats_script_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.0.8/policy/modules/apps/gnome.fc --- nsaserefpolicy/policy/modules/apps/gnome.fc 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/gnome.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/gnome.fc 2007-12-02 21:15:34.000000000 -0500 @@ -1,8 +1,7 @@ +HOME_DIR/.gnome2(/.*)? gen_context(system_u:object_r:ROLE_gnome_home_t,s0) HOME_DIR/\.config/gtk-.* gen_context(system_u:object_r:ROLE_gnome_home_t,s0) @@ -2860,7 +2734,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc /usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.0.8/policy/modules/apps/gnome.if --- nsaserefpolicy/policy/modules/apps/gnome.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/gnome.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/gnome.if 2007-12-02 21:15:34.000000000 -0500 @@ -33,6 +33,51 @@ ## # @@ -3048,7 +2922,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.0.8/policy/modules/apps/gnome.te --- nsaserefpolicy/policy/modules/apps/gnome.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/gnome.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/gnome.te 2007-12-02 21:15:34.000000000 -0500 @@ -8,8 +8,5 @@ attribute gnomedomain; @@ -3058,66 +2932,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te - type gconfd_exec_t; application_executable_file(gconfd_exec_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.if serefpolicy-3.0.8/policy/modules/apps/gpg.if ---- nsaserefpolicy/policy/modules/apps/gpg.if 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/gpg.if 2008-04-04 16:11:03.000000000 -0400 -@@ -80,6 +80,10 @@ - allow $1_gpg_t self:fifo_file rw_fifo_file_perms; - allow $1_gpg_t self:tcp_socket create_stream_socket_perms; - -+ # Thunderbird leaks descriptors -+ dontaudit $1_gpg_t $2:tcp_socket rw_socket_perms; -+ dontaudit $1_gpg_t $2:udp_socket rw_socket_perms; -+ - # transition from the gpg domain to the helper domain - domtrans_pattern($1_gpg_t,gpg_helper_exec_t,$1_gpg_helper_t) - -@@ -116,6 +120,8 @@ - files_read_usr_files($1_gpg_t) - files_dontaudit_search_var($1_gpg_t) - -+ auth_use_nsswitch($1_gpg_t) -+ - libs_use_shared_libs($1_gpg_t) - libs_use_ld_so($1_gpg_t) - -@@ -123,14 +129,8 @@ - - logging_send_syslog_msg($1_gpg_t) - -- sysnet_read_config($1_gpg_t) -- - userdom_use_user_terminals($1,$1_gpg_t) - -- optional_policy(` -- nis_use_ypbind($1_gpg_t) -- ') -- - ifdef(`TODO',` - # Read content to encrypt/decrypt/sign - read_content($1_gpg_t, $1) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gpg.te serefpolicy-3.0.8/policy/modules/apps/gpg.te ---- nsaserefpolicy/policy/modules/apps/gpg.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/gpg.te 2008-04-04 16:11:03.000000000 -0400 -@@ -19,3 +19,4 @@ - # type for the pinentry executable - type pinentry_exec_t; - application_executable_file(pinentry_exec_t) -+ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc serefpolicy-3.0.8/policy/modules/apps/java.fc --- nsaserefpolicy/policy/modules/apps/java.fc 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/java.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -3,14 +3,15 @@ - # - /opt/(.*/)?bin/java[^/]* -- gen_context(system_u:object_r:java_exec_t,s0) - /opt/ibm/java2-ppc64-50/jre/(bin|javaws)(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0) --/opt/local/matlab/bin/(.*/)?MATLAB. -- gen_context(system_u:object_r:java_exec_t,s0) --/opt/matlab/bin/(.*/)?MATLAB. -- gen_context(system_u:object_r:java_exec_t,s0) -+/opt/local/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0) -+/opt/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0) - - # - # /usr ++++ serefpolicy-3.0.8/policy/modules/apps/java.fc 2007-12-02 21:15:34.000000000 -0500 +@@ -11,6 +11,7 @@ # /usr/(.*/)?bin/java.* -- gen_context(system_u:object_r:java_exec_t,s0) /usr/lib(.*/)?bin/java[^/]* -- gen_context(system_u:object_r:java_exec_t,s0) @@ -3125,21 +2943,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc /usr/bin/frysk -- gen_context(system_u:object_r:java_exec_t,s0) /usr/bin/gappletviewer -- gen_context(system_u:object_r:java_exec_t,s0) /usr/bin/gcj-dbtool -- gen_context(system_u:object_r:java_exec_t,s0) -@@ -20,5 +21,9 @@ +@@ -20,5 +21,11 @@ /usr/bin/grmic -- gen_context(system_u:object_r:java_exec_t,s0) /usr/bin/grmiregistry -- gen_context(system_u:object_r:java_exec_t,s0) /usr/bin/jv-convert -- gen_context(system_u:object_r:java_exec_t,s0) --/usr/local/matlab/bin/(.*/)?MATLAB. -- gen_context(system_u:object_r:java_exec_t,s0) --/usr/matlab/bin/(.*/)?MATLAB. -- gen_context(system_u:object_r:java_exec_t,s0) +/usr/bin/fastjar -- gen_context(system_u:object_r:java_exec_t,s0) -+/usr/local/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0) -+/usr/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0) + /usr/local/matlab/bin/(.*/)?MATLAB. -- gen_context(system_u:object_r:java_exec_t,s0) + /usr/matlab/bin/(.*/)?MATLAB. -- gen_context(system_u:object_r:java_exec_t,s0) ++ +/usr/lib/jvm/java(.*/)bin(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0) + ++/usr/lib(64)?/openoffice\.org/program/soffice\.bin -- gen_context(system_u:object_r:java_exec_t,s0) +/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:java_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.0.8/policy/modules/apps/java.if --- nsaserefpolicy/policy/modules/apps/java.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/java.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/java.if 2008-01-13 08:10:59.000000000 -0500 @@ -32,7 +32,7 @@ ## ## @@ -3166,25 +2984,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if allow $1_javaplugin_t $2:unix_stream_socket connectto; allow $1_javaplugin_t $2:unix_stream_socket { read write }; userdom_write_user_tmp_sockets($1,$1_javaplugin_t) -@@ -69,6 +72,7 @@ - manage_dirs_pattern($1_javaplugin_t,$1_javaplugin_tmp_t,$1_javaplugin_tmp_t) - manage_files_pattern($1_javaplugin_t,$1_javaplugin_tmp_t,$1_javaplugin_tmp_t) - files_tmp_filetrans($1_javaplugin_t,$1_javaplugin_tmp_t,{ file dir }) -+ allow $1_javaplugin_t $1_javaplugin_tmp_t:file execute; - - manage_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t) - manage_lnk_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t) -@@ -81,9 +85,7 @@ +@@ -81,8 +84,7 @@ can_exec($1_javaplugin_t, java_exec_t) - # The user role is authorized for this domain. - domain_auto_trans($1_t, java_exec_t, $1_javaplugin_t) -- allow $1_javaplugin_t $2:fd use; -+ domtrans_pattern($2, java_exec_t, $1_javaplugin_t) ++ domain_auto_trans($2, java_exec_t, $1_javaplugin_t) + allow $1_javaplugin_t $2:fd use; # Unrestricted inheritance from the caller. allow $2 $1_javaplugin_t:process { noatsecure siginh rlimitinh }; - allow $1_javaplugin_t $2:process signull; @@ -94,7 +96,7 @@ kernel_read_system_state($1_javaplugin_t) @@ -3207,17 +3016,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if files_read_etc_files($1_javaplugin_t) files_read_usr_files($1_javaplugin_t) -@@ -122,6 +126,9 @@ +@@ -122,6 +126,7 @@ fs_getattr_xattr_fs($1_javaplugin_t) fs_dontaudit_rw_tmpfs_files($1_javaplugin_t) + fs_getattr_tmpfs($1_javaplugin_t) -+ -+ auth_use_nsswitch($1_javaplugin_t) libs_use_ld_so($1_javaplugin_t) libs_use_shared_libs($1_javaplugin_t) -@@ -134,9 +141,13 @@ +@@ -134,6 +139,10 @@ sysnet_read_config($1_javaplugin_t) @@ -3227,21 +3034,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if + userdom_read_user_tmpfs_files($1,$1_javaplugin_t) userdom_dontaudit_use_user_terminals($1,$1_javaplugin_t) userdom_dontaudit_setattr_user_home_content_files($1,$1_javaplugin_t) -- userdom_dontaudit_exec_user_home_content_files($1,$1_javaplugin_t) -+ userdom_exec_user_home_content_files($1,$1_javaplugin_t) - userdom_manage_user_home_content_dirs($1,$1_javaplugin_t) - userdom_manage_user_home_content_files($1,$1_javaplugin_t) - userdom_manage_user_home_content_symlinks($1,$1_javaplugin_t) -@@ -147,8 +158,6 @@ - tunable_policy(`allow_java_execstack',` - allow $1_javaplugin_t self:process execstack; - -- allow $1_javaplugin_t $1_javaplugin_tmp_t:file execute; -- - libs_legacy_use_shared_libs($1_javaplugin_t) - libs_legacy_use_ld_so($1_javaplugin_t) - -@@ -166,6 +175,63 @@ + userdom_dontaudit_exec_user_home_content_files($1,$1_javaplugin_t) +@@ -166,6 +175,62 @@ optional_policy(` xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t) ') @@ -3288,7 +3082,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if + domain_interactive_fd($1_java_t) + + userdom_unpriv_usertype($1, $1_java_t) -+ userdom_exec_user_home_content_files($1,$1_java_t) + + allow $1_java_t self:process { getsched sigkill execheap execmem execstack }; + @@ -3305,7 +3098,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if ') ######################################## -@@ -219,3 +285,66 @@ +@@ -219,3 +284,66 @@ corecmd_search_bin($1) domtrans_pattern($1, java_exec_t, java_t) ') @@ -3374,7 +3167,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.0.8/policy/modules/apps/java.te --- nsaserefpolicy/policy/modules/apps/java.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/java.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/java.te 2007-12-02 21:15:34.000000000 -0500 @@ -23,11 +23,23 @@ # @@ -3404,20 +3197,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.te serefpolicy-3.0.8/policy/modules/apps/loadkeys.te --- nsaserefpolicy/policy/modules/apps/loadkeys.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/loadkeys.te 2008-04-04 16:11:03.000000000 -0400 -@@ -41,6 +41,9 @@ ++++ serefpolicy-3.0.8/policy/modules/apps/loadkeys.te 2007-12-02 21:15:34.000000000 -0500 +@@ -41,6 +41,10 @@ miscfiles_read_localization(loadkeys_t) -+userdom_dontaudit_write_unpriv_user_home_content_files(loadkeys_t) -+userdom_dontaudit_list_user_home_dirs(user, loadkeys_t) ++userdom_dontaudit_search_users_home_dirs(loadkeys_t) + optional_policy(` nscd_dontaudit_search_pid(loadkeys_t) ') ++ ++userdom_dontaudit_write_unpriv_user_home_content_files(loadkeys_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.0.8/policy/modules/apps/mono.if --- nsaserefpolicy/policy/modules/apps/mono.if 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/mono.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/mono.if 2007-12-02 21:15:34.000000000 -0500 @@ -18,3 +18,105 @@ corecmd_search_bin($1) domtrans_pattern($1, mono_exec_t, mono_t) @@ -3526,7 +3320,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.0.8/policy/modules/apps/mono.te --- nsaserefpolicy/policy/modules/apps/mono.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/mono.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/mono.te 2007-12-02 21:15:34.000000000 -0500 @@ -15,7 +15,7 @@ # Local policy # @@ -3546,7 +3340,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.0.8/policy/modules/apps/mozilla.if --- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/mozilla.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/mozilla.if 2008-01-13 07:54:35.000000000 -0500 @@ -36,6 +36,8 @@ gen_require(` type mozilla_conf_t, mozilla_exec_t; @@ -3579,12 +3373,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. allow $1_mozilla_t self:fifo_file rw_fifo_file_perms; allow $1_mozilla_t self:shm { unix_read unix_write read write destroy create }; allow $1_mozilla_t self:sem create_sem_perms; -@@ -66,11 +76,15 @@ - allow $1_mozilla_t self:unix_stream_socket { listen accept }; - # Browse the web, connect to printer - allow $1_mozilla_t self:tcp_socket create_socket_perms; -- allow $1_mozilla_t self:netlink_route_socket r_netlink_socket_perms; - +@@ -71,6 +81,11 @@ # for bash - old mozilla binary can_exec($1_mozilla_t, mozilla_exec_t) @@ -3596,7 +3385,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. # X access, Home files manage_dirs_pattern($1_mozilla_t,$1_mozilla_home_t,$1_mozilla_home_t) manage_files_pattern($1_mozilla_t,$1_mozilla_home_t,$1_mozilla_home_t) -@@ -96,15 +110,41 @@ +@@ -96,15 +111,41 @@ relabel_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t) relabel_lnk_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t) @@ -3634,7 +3423,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. + tunable_policy(`browser_write_$1_data',` + userdom_manage_user_home_content_dirs($1,$1_mozilla_t) + userdom_manage_user_home_content_files($1,$1_mozilla_t) -+ userdom_manage_user_home_content_symlinks($1,$1_mozilla_t) ++ userdom_read_user_home_content_symlinks($1,$1_mozilla_t) + userdom_manage_user_home_content_pipes($1,$1_mozilla_t) + userdom_user_home_dir_filetrans_user_home_content($1,$1_mozilla_t, { file dir }) + ', ` @@ -3645,7 +3434,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. # Unrestricted inheritance from the caller. allow $2 $1_mozilla_t:process { noatsecure siginh rlimitinh }; -@@ -112,11 +152,13 @@ +@@ -112,11 +153,13 @@ ps_process_pattern($2,$1_mozilla_t) allow $2 $1_mozilla_t:process signal_perms; @@ -3661,7 +3450,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. # Look for plugins corecmd_list_bin($1_mozilla_t) -@@ -165,13 +207,28 @@ +@@ -165,10 +208,23 @@ files_read_var_files($1_mozilla_t) files_read_var_symlinks($1_mozilla_t) files_dontaudit_getattr_boot_dirs($1_mozilla_t) @@ -3685,19 +3474,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. term_dontaudit_getattr_pty_dirs($1_mozilla_t) -+ auth_use_nsswitch($1_mozilla_t) -+ - libs_use_ld_so($1_mozilla_t) - libs_use_shared_libs($1_mozilla_t) - -@@ -180,16 +237,8 @@ - miscfiles_read_fonts($1_mozilla_t) - miscfiles_read_localization($1_mozilla_t) - -- # Browse the web, connect to printer -- sysnet_dns_name_resolve($1_mozilla_t) -- sysnet_read_config($1_mozilla_t) -- +@@ -184,12 +240,8 @@ + sysnet_dns_name_resolve($1_mozilla_t) + sysnet_read_config($1_mozilla_t) + - userdom_manage_user_home_content_dirs($1,$1_mozilla_t) - userdom_manage_user_home_content_files($1,$1_mozilla_t) - userdom_manage_user_home_content_symlinks($1,$1_mozilla_t) @@ -3709,7 +3489,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. xserver_user_client_template($1,$1_mozilla_t,$1_mozilla_tmpfs_t) xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t) -@@ -211,131 +260,8 @@ +@@ -211,131 +263,8 @@ fs_manage_cifs_symlinks($1_mozilla_t) ') @@ -3843,7 +3623,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') optional_policy(` -@@ -350,21 +276,27 @@ +@@ -350,21 +279,27 @@ optional_policy(` cups_read_rw_config($1_mozilla_t) cups_dbus_chat($1_mozilla_t) @@ -3857,14 +3637,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. - dbus_send_user_bus($1,$1_mozilla_t) +# dbus_send_user_bus(xguest,xguest_mozilla_t) +# dbus_connectto_user_bus(xguest,xguest_mozilla_t) -+ ') -+ -+ optional_policy(` -+ gnome_exec_gconf($1_mozilla_t) -+ gnome_manage_user_gnome_config($1,$1_mozilla_t) ') optional_policy(` ++ gnome_exec_gconf($1_mozilla_t) ++ gnome_manage_user_gnome_config($1,$1_mozilla_t) ++ ') ++ ++ optional_policy(` + gnome_domtrans_user_gconf($1,$1_mozilla_t) gnome_stream_connect_gconf_template($1,$1_mozilla_t) ') @@ -3875,14 +3655,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') optional_policy(` -@@ -377,32 +309,9 @@ - ') - - optional_policy(` -- nscd_socket_use($1_mozilla_t) -- ') -- -- optional_policy(` +@@ -384,25 +319,6 @@ thunderbird_domtrans_user_thunderbird($1, $1_mozilla_t) ') @@ -3908,7 +3681,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') ######################################## -@@ -575,3 +484,27 @@ +@@ -575,3 +491,27 @@ allow $2 $1_mozilla_t:tcp_socket rw_socket_perms; ') @@ -3938,7 +3711,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.0.8/policy/modules/apps/mozilla.te --- nsaserefpolicy/policy/modules/apps/mozilla.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/mozilla.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/mozilla.te 2007-12-02 21:15:34.000000000 -0500 @@ -6,13 +6,6 @@ # Declarations # @@ -3953,250 +3726,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. type mozilla_conf_t; files_config_file(mozilla_conf_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.fc serefpolicy-3.0.8/policy/modules/apps/openoffice.fc ---- nsaserefpolicy/policy/modules/apps/openoffice.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/apps/openoffice.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -0,0 +1,3 @@ -+/usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0) -+/usr/lib64/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0) -+ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.if serefpolicy-3.0.8/policy/modules/apps/openoffice.if ---- nsaserefpolicy/policy/modules/apps/openoffice.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/apps/openoffice.if 2008-04-04 16:11:03.000000000 -0400 -@@ -0,0 +1,212 @@ -+## Openoffice -+ -+####################################### -+## -+## The per role template for the openoffice module. -+## -+## -+##

-+## This template creates a derived domains which are used -+## for openoffice plugins that are executed by a browser. -+##

-+##

-+## This template is invoked automatically for each user, and -+## generally does not need to be invoked directly -+## by policy writers. -+##

-+## -+## -+## -+## The prefix of the user domain (e.g., user -+## is the prefix for user_t). -+## -+## -+## -+## -+## The type of the user domain. -+## -+## -+## -+## -+## The role associated with the user domain. -+## -+## -+# -+template(`openoffice_plugin_per_role_template',` -+ gen_require(` -+ type openoffice_exec_t; -+ ') -+ -+ ######################################## -+ # -+ # Declarations -+ # -+ -+ type $1_openofficeplugin_t; -+ application_domain($1_openofficeplugin_t,openoffice_exec_t) -+ role $3 types $1_openofficeplugin_t; -+ -+ type $1_openofficeplugin_tmp_t; -+ files_tmp_file($1_openofficeplugin_tmp_t) -+ -+ type $1_openofficeplugin_tmpfs_t; -+ files_tmpfs_file($1_openofficeplugin_tmpfs_t) -+ -+ ######################################## -+ # -+ # Local policy -+ # -+ -+ allow $1_openofficeplugin_t self:process { execmem execstack signal_perms getsched ptrace setsched }; -+ allow $1_openofficeplugin_t self:fifo_file rw_fifo_file_perms; -+ allow $1_openofficeplugin_t self:tcp_socket create_stream_socket_perms; -+ allow $1_openofficeplugin_t self:udp_socket create_socket_perms; -+ -+ allow $1_openofficeplugin_t $1_t:process signull; -+ allow $1_openofficeplugin_t $1_t:unix_stream_socket connectto; -+ allow $1_t $1_openofficeplugin_t:unix_stream_socket connectto; -+ allow $1_openofficeplugin_t $2:unix_stream_socket connectto; -+ allow $1_openofficeplugin_t $2:tcp_socket { read write }; -+ -+ manage_dirs_pattern($1_openofficeplugin_t,$1_openofficeplugin_tmp_t,$1_openofficeplugin_tmp_t) -+ manage_files_pattern($1_openofficeplugin_t,$1_openofficeplugin_tmp_t,$1_openofficeplugin_tmp_t) -+ files_tmp_filetrans($1_openofficeplugin_t,$1_openofficeplugin_tmp_t,{ file dir }) -+ allow $1_openofficeplugin_t $1_openofficeplugin_tmp_t:file execute; -+ -+ manage_files_pattern($1_openofficeplugin_t,$1_openofficeplugin_tmpfs_t,$1_openofficeplugin_tmpfs_t) -+ manage_lnk_files_pattern($1_openofficeplugin_t,$1_openofficeplugin_tmpfs_t,$1_openofficeplugin_tmpfs_t) -+ manage_fifo_files_pattern($1_openofficeplugin_t,$1_openofficeplugin_tmpfs_t,$1_openofficeplugin_tmpfs_t) -+ manage_sock_files_pattern($1_openofficeplugin_t,$1_openofficeplugin_tmpfs_t,$1_openofficeplugin_tmpfs_t) -+ fs_tmpfs_filetrans($1_openofficeplugin_t,$1_openofficeplugin_tmpfs_t,{ file lnk_file sock_file fifo_file }) -+ -+ can_exec($1_openofficeplugin_t, openoffice_exec_t) -+ -+ domtrans_pattern($2, openoffice_exec_t, $1_openofficeplugin_t) -+ # Unrestricted inheritance from the caller. -+ allow $2 $1_openofficeplugin_t:process { noatsecure siginh rlimitinh }; -+ allow $1_openofficeplugin_t $2:process signull; -+ -+ kernel_read_all_sysctls($1_openofficeplugin_t) -+ kernel_search_vm_sysctl($1_openofficeplugin_t) -+ kernel_read_network_state($1_openofficeplugin_t) -+ kernel_read_system_state($1_openofficeplugin_t) -+ -+ # Search bin directory under openofficeplugin for openofficeplugin executable -+ corecmd_exec_bin($1_openofficeplugin_t) -+ -+ corenet_all_recvfrom_unlabeled($1_openofficeplugin_t) -+ corenet_all_recvfrom_netlabel($1_openofficeplugin_t) -+ corenet_tcp_sendrecv_generic_if($1_openofficeplugin_t) -+ corenet_udp_sendrecv_generic_if($1_openofficeplugin_t) -+ corenet_tcp_sendrecv_all_nodes($1_openofficeplugin_t) -+ corenet_udp_sendrecv_all_nodes($1_openofficeplugin_t) -+ corenet_tcp_sendrecv_all_ports($1_openofficeplugin_t) -+ corenet_udp_sendrecv_all_ports($1_openofficeplugin_t) -+ corenet_tcp_connect_all_ports($1_openofficeplugin_t) -+ corenet_sendrecv_all_client_packets($1_openofficeplugin_t) -+ -+ dev_list_sysfs($1_openofficeplugin_t) -+ dev_read_sound($1_openofficeplugin_t) -+ dev_write_sound($1_openofficeplugin_t) -+ dev_read_urand($1_openofficeplugin_t) -+ dev_read_rand($1_openofficeplugin_t) -+ dev_write_rand($1_openofficeplugin_t) -+ -+ files_read_etc_files($1_openofficeplugin_t) -+ files_read_usr_files($1_openofficeplugin_t) -+ files_search_home($1_openofficeplugin_t) -+ files_search_var_lib($1_openofficeplugin_t) -+ files_read_etc_runtime_files($1_openofficeplugin_t) -+ # Read global fonts and font config -+ files_read_etc_files($1_openofficeplugin_t) -+ -+ fs_getattr_xattr_fs($1_openofficeplugin_t) -+ fs_dontaudit_rw_tmpfs_files($1_openofficeplugin_t) -+ fs_getattr_tmpfs($1_openofficeplugin_t) -+ -+ auth_use_nsswitch($1_openofficeplugin_t) -+ -+ libs_use_ld_so($1_openofficeplugin_t) -+ libs_use_shared_libs($1_openofficeplugin_t) -+ -+ logging_send_syslog_msg($1_openofficeplugin_t) -+ -+ miscfiles_read_localization($1_openofficeplugin_t) -+ # Read global fonts and font config -+ miscfiles_read_fonts($1_openofficeplugin_t) -+ -+ userdom_manage_unpriv_users_home_content_files($1_openofficeplugin_t) -+ userdom_dontaudit_use_user_terminals($1,$1_openofficeplugin_t) -+ userdom_dontaudit_setattr_user_home_content_files($1,$1_openofficeplugin_t) -+ userdom_exec_user_home_content_files($1,$1_openofficeplugin_t) -+ userdom_manage_user_tmp_dirs($1,$1_openofficeplugin_t) -+ userdom_manage_user_tmp_files($1,$1_openofficeplugin_t) -+ userdom_manage_user_tmp_sockets($1,$1_openofficeplugin_t) -+ userdom_read_user_tmpfs_files($1,$1_openofficeplugin_t) -+ userdom_manage_user_home_content_dirs($1,$1_openofficeplugin_t) -+ userdom_manage_user_home_content_files($1,$1_openofficeplugin_t) -+ userdom_manage_user_home_content_symlinks($1,$1_openofficeplugin_t) -+ userdom_manage_user_home_content_pipes($1,$1_openofficeplugin_t) -+ userdom_manage_user_home_content_sockets($1,$1_openofficeplugin_t) -+ userdom_user_home_dir_filetrans_user_home_content($1,$1_openofficeplugin_t,{ file lnk_file sock_file fifo_file }) -+ -+ optional_policy(` -+ xserver_user_x_domain_template($1,$1_openofficeplugin,$1_openofficeplugin_t,$1_openofficeplugin_tmpfs_t) -+ ') -+ -+') -+ -+####################################### -+## -+## The per role template for the openoffice module. -+## -+## -+##

-+## This template creates a derived domains which are used -+## for openoffice applications. -+##

-+## -+## -+## -+## The prefix of the user domain (e.g., user -+## is the prefix for user_t). -+## -+## -+## -+## -+## The type of the user domain. -+## -+## -+## -+## -+## The role associated with the user domain. -+## -+## -+# -+template(`openoffice_per_role_template',` -+ gen_require(` -+ type openoffice_exec_t; -+ ') -+ -+ type $1_openoffice_t; -+ domain_type($1_openoffice_t) -+ domain_entry_file($1_openoffice_t,openoffice_exec_t) -+ role $3 types $1_openoffice_t; -+ -+ domain_interactive_fd($1_openoffice_t) -+ -+ userdom_unpriv_usertype($1, $1_openoffice_t) -+ userdom_exec_user_home_content_files($1,$1_openoffice_t) -+ -+ allow $1_openoffice_t self:process { getsched sigkill execheap execmem execstack }; -+ -+ allow $2 $1_openoffice_t:process { getattr ptrace signal_perms noatsecure siginh rlimitinh }; -+ allow $1_openoffice_t $2:tcp_socket { read write }; -+ -+ domtrans_pattern($2, openoffice_exec_t, $1_openoffice_t) -+ -+ dev_read_urand($1_openoffice_t) -+ dev_read_rand($1_openoffice_t) -+ -+ fs_dontaudit_rw_tmpfs_files($1_openoffice_t) -+') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/openoffice.te serefpolicy-3.0.8/policy/modules/apps/openoffice.te ---- nsaserefpolicy/policy/modules/apps/openoffice.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/apps/openoffice.te 2008-04-04 16:11:03.000000000 -0400 -@@ -0,0 +1,14 @@ -+ -+policy_module(openoffice,1.0.0) -+ -+######################################## -+# -+# Declarations -+# -+ -+type openoffice_t; -+type openoffice_exec_t; -+application_domain(openoffice_t,openoffice_exec_t) -+ -+ -+ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.if serefpolicy-3.0.8/policy/modules/apps/slocate.if --- nsaserefpolicy/policy/modules/apps/slocate.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/slocate.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/slocate.if 2007-12-02 21:15:34.000000000 -0500 @@ -39,3 +39,4 @@ allow $1 locate_var_lib_t:dir list_dir_perms; files_search_var_lib($1) @@ -4204,7 +3736,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-3.0.8/policy/modules/apps/slocate.te --- nsaserefpolicy/policy/modules/apps/slocate.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/slocate.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/slocate.te 2008-01-03 10:02:40.000000000 -0500 @@ -39,6 +39,7 @@ files_list_all(locate_t) @@ -4213,18 +3745,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate. files_getattr_all_sockets(locate_t) files_read_etc_runtime_files(locate_t) files_read_etc_files(locate_t) -@@ -46,6 +47,8 @@ - fs_getattr_all_fs(locate_t) - fs_getattr_all_files(locate_t) - fs_list_all(locate_t) -+fs_getattr_all_pipes(locate_t) -+fs_getattr_all_symlinks(locate_t) - - # getpwnam - auth_use_nsswitch(locate_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.0.8/policy/modules/apps/userhelper.if --- nsaserefpolicy/policy/modules/apps/userhelper.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/userhelper.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/userhelper.if 2007-12-02 21:15:34.000000000 -0500 @@ -130,6 +130,7 @@ term_use_all_user_ptys($1_userhelper_t) @@ -4235,7 +3758,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp auth_search_pam_console_data($1_userhelper_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.0.8/policy/modules/apps/vmware.fc --- nsaserefpolicy/policy/modules/apps/vmware.fc 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/vmware.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/vmware.fc 2007-12-02 21:15:34.000000000 -0500 @@ -21,19 +21,25 @@ /usr/bin/vmware-nmbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) /usr/bin/vmware-ping -- gen_context(system_u:object_r:vmware_host_exec_t,s0) @@ -4269,7 +3792,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.f +/var/log/vmware.* -- gen_context(system_u:object_r:vmware_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.if serefpolicy-3.0.8/policy/modules/apps/vmware.if --- nsaserefpolicy/policy/modules/apps/vmware.if 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/vmware.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/vmware.if 2007-12-02 21:15:34.000000000 -0500 @@ -202,3 +202,22 @@ allow $1 vmware_sys_conf_t:file append; @@ -4295,7 +3818,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.i +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.0.8/policy/modules/apps/vmware.te --- nsaserefpolicy/policy/modules/apps/vmware.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/vmware.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/vmware.te 2007-12-13 10:47:36.000000000 -0500 @@ -22,17 +22,21 @@ type vmware_var_run_t; files_pid_file(vmware_var_run_t) @@ -4360,7 +3883,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.t + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.0.8/policy/modules/apps/wine.if --- nsaserefpolicy/policy/modules/apps/wine.if 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/wine.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/wine.if 2007-12-02 21:15:34.000000000 -0500 @@ -18,3 +18,84 @@ corecmd_search_bin($1) domtrans_pattern($1, wine_exec_t, wine_t) @@ -4448,7 +3971,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te serefpolicy-3.0.8/policy/modules/apps/wine.te --- nsaserefpolicy/policy/modules/apps/wine.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/wine.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/wine.te 2007-12-02 21:15:34.000000000 -0500 @@ -9,6 +9,7 @@ type wine_t; type wine_exec_t; @@ -4457,11 +3980,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te ######################################## # -@@ -17,10 +18,16 @@ - - optional_policy(` - allow wine_t self:process { execstack execmem execheap }; -+ domain_mmap_low(wine_t) +@@ -20,7 +21,12 @@ unconfined_domain_noaudit(wine_t) files_execmod_all_files(wine_t) @@ -4479,7 +3998,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.te ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.0.8/policy/modules/kernel/corecommands.fc --- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/corecommands.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/corecommands.fc 2008-01-14 14:12:06.000000000 -0500 @@ -7,6 +7,7 @@ /bin/d?ash -- gen_context(system_u:object_r:shell_exec_t,s0) /bin/bash -- gen_context(system_u:object_r:shell_exec_t,s0) @@ -4516,19 +4035,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco # # /usr # -@@ -126,10 +132,7 @@ +@@ -126,10 +132,10 @@ /usr/lib(64)?/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:bin_t,s0) /usr/lib(64)?/apt/methods.+ -- gen_context(system_u:object_r:bin_t,s0) /usr/lib(64)?/courier(/.*)? gen_context(system_u:object_r:bin_t,s0) -/usr/lib(64)?/cups/backend(/.*)? gen_context(system_u:object_r:bin_t,s0) --/usr/lib(64)?/cups/cgi-bin/.* -- gen_context(system_u:object_r:bin_t,s0) + /usr/lib(64)?/cups/cgi-bin/.* -- gen_context(system_u:object_r:bin_t,s0) -/usr/lib(64)?/cups/daemon(/.*)? gen_context(system_u:object_r:bin_t,s0) --/usr/lib(64)?/cups/filter(/.*)? gen_context(system_u:object_r:bin_t,s0) -+/usr/lib(64)?/cups(/.*)? gen_context(system_u:object_r:bin_t,s0) + /usr/lib(64)?/cups/filter(/.*)? gen_context(system_u:object_r:bin_t,s0) ++/usr/lib(64)?/cups/backend(/.*)? gen_context(system_u:object_r:bin_t,s0) ++/usr/lib(64)?/cups/daemon(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib(64)?/cyrus-imapd/.* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib(64)?/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0) -@@ -163,9 +166,16 @@ +@@ -163,9 +169,15 @@ /usr/libexec/openssh/sftp-server -- gen_context(system_u:object_r:bin_t,s0) /usr/local/lib(64)?/ipsec/.* -- gen_context(system_u:object_r:bin_t,s0) @@ -4537,7 +4057,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco +/usr/local/Brother(/.*)?/lpd(/.*)? gen_context(system_u:object_r:bin_t,s0) +/usr/local/Printer/[^/]*/cupswrapper(/.*)? gen_context(system_u:object_r:bin_t,s0) +/usr/local/Printer/[^/]*/lpd(/.*)? gen_context(system_u:object_r:bin_t,s0) -+/usr/local/linuxprinter/filters(/.*)? gen_context(system_u:object_r:bin_t,s0) +/usr/bin/scponly -- gen_context(system_u:object_r:shell_exec_t,s0) +/usr/sbin/scponlyc -- gen_context(system_u:object_r:shell_exec_t,s0) @@ -4546,7 +4065,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco /usr/share/apr-0/build/[^/]+\.sh -- gen_context(system_u:object_r:bin_t,s0) /usr/share/apr-0/build/libtool -- gen_context(system_u:object_r:bin_t,s0) -@@ -180,6 +190,7 @@ +@@ -180,6 +192,7 @@ /usr/share/turboprint/lib(/.*)? -- gen_context(system_u:object_r:bin_t,s0) /usr/X11R6/lib(64)?/X11/xkb/xkbcomp -- gen_context(system_u:object_r:bin_t,s0) @@ -4554,15 +4073,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco ifdef(`distro_gentoo', ` /usr/.*-.*-linux-gnu/gcc-bin/.*(/.*)? gen_context(system_u:object_r:bin_t,s0) -@@ -188,6 +199,7 @@ - - ifdef(`distro_redhat', ` - /usr/lib/.*/program(/.*)? gen_context(system_u:object_r:bin_t,s0) -+/usr/lib64/.*/program(/.*)? gen_context(system_u:object_r:bin_t,s0) - /usr/lib/bluetooth(/.*)? -- gen_context(system_u:object_r:bin_t,s0) - /usr/lib/vmware-tools/sbin32(/.*)? gen_context(system_u:object_r:bin_t,s0) - /usr/lib64/bluetooth(/.*)? -- gen_context(system_u:object_r:bin_t,s0) -@@ -259,3 +271,23 @@ +@@ -259,3 +272,23 @@ ifdef(`distro_suse',` /var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0) ') @@ -4588,7 +4099,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco +/usr/lib/nspluginwrapper/npconfig -- gen_context(system_u:object_r:bin_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.if.in serefpolicy-3.0.8/policy/modules/kernel/corenetwork.if.in --- nsaserefpolicy/policy/modules/kernel/corenetwork.if.in 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/corenetwork.if.in 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/corenetwork.if.in 2007-12-02 21:15:34.000000000 -0500 @@ -903,9 +903,11 @@ interface(`corenet_udp_bind_generic_port',` gen_require(` @@ -4601,35 +4112,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene ') ######################################## -@@ -1386,10 +1388,11 @@ - # - interface(`corenet_tcp_bind_all_unreserved_ports',` - gen_require(` -- attribute port_type, reserved_port_type; -+ attribute port_type; -+ type hi_reserved_port_t, reserved_port_t; - ') - -- allow $1 { port_type -reserved_port_type }:tcp_socket name_bind; -+ allow $1 { port_type -hi_reserved_port_t -reserved_port_t }:tcp_socket name_bind; - ') - - ######################################## -@@ -1404,10 +1407,11 @@ - # - interface(`corenet_udp_bind_all_unreserved_ports',` - gen_require(` -- attribute port_type, reserved_port_type; -+ attribute port_type; -+ type hi_reserved_port_t, reserved_port_t; - ') - -- allow $1 { port_type -reserved_port_type }:udp_socket name_bind; -+ allow $1 { port_type -hi_reserved_port_t -reserved_port_t }:udp_socket name_bind; - ') - - ######################################## -@@ -1449,6 +1453,43 @@ +@@ -1449,6 +1451,43 @@ ######################################## ## @@ -4675,7 +4158,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.0.8/policy/modules/kernel/corenetwork.te.in --- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/corenetwork.te.in 2008-04-22 15:54:37.341464000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/corenetwork.te.in 2008-05-06 16:00:10.000000000 -0400 @@ -55,6 +55,11 @@ type reserved_port_t, port_type, reserved_port_type; @@ -4688,18 +4171,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene # server_packet_t is the default type of IPv4 and IPv6 server packets. # type server_packet_t, packet_type, server_packet_type; -@@ -67,8 +72,10 @@ +@@ -67,6 +72,7 @@ network_port(amanda, udp,10080,s0, tcp,10080,s0, udp,10081,s0, tcp,10081,s0, tcp,10082,s0, tcp,10083,s0) network_port(amavisd_recv, tcp,10024,s0) network_port(amavisd_send, tcp,10025,s0) +network_port(aol, udp,5190,s0, tcp,5190,s0, udp,5191,s0, tcp,5191,s0, udp,5192,s0, tcp,5192,s0, udp,5193,s0, tcp,5193,s0) network_port(apcupsd, tcp,3551,s0, udp,3551,s0) network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0, udp,5060,s0) -+network_port(audit, tcp,60,s0) network_port(auth, tcp,113,s0) - network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0) - type biff_port_t, port_type, reserved_port_type; dnl network_port(biff) # no defined portcon in current strict -@@ -93,27 +100,34 @@ +@@ -93,10 +99,11 @@ network_port(http_cache, tcp,3128,s0, udp,3130,s0, tcp,8080,s0, tcp,8118,s0) # 8118 is for privoxy network_port(http, tcp,80,s0, tcp,443,s0, tcp,488,s0, tcp,8008,s0, tcp,8009,s0, tcp,8443,s0) #8443 is mod_nss default port network_port(howl, tcp,5335,s0, udp,5353,s0) @@ -4713,12 +4193,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene network_port(innd, tcp,119,s0) network_port(ipp, tcp,631,s0, udp,631,s0) network_port(ircd, tcp,6667,s0) - network_port(isakmp, udp,500,s0) - network_port(iscsi, tcp,3260,s0) -+network_port(isns, tcp,3205,s0, udp,3205,s0) - network_port(jabber_client, tcp,5222,s0, tcp,5223,s0) - network_port(jabber_interserver, tcp,5269,s0) - network_port(kerberos_admin, tcp,464,s0, udp,464,s0, tcp,749,s0) +@@ -108,12 +115,17 @@ network_port(kerberos_master, tcp,4444,s0, udp,4444,s0) network_port(kerberos, tcp,88,s0, udp,88,s0, tcp,750,s0, udp,750,s0) network_port(ktalkd, udp,517,s0, udp,518,s0) @@ -4738,7 +4213,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene network_port(nessus, tcp,1241,s0) network_port(netsupport, tcp,5405,s0, udp,5405,s0) network_port(nmbd, udp,137,s0, udp,138,s0) -@@ -122,10 +136,12 @@ +@@ -122,6 +134,7 @@ network_port(openvpn, tcp,1194,s0, udp,1194,s0) network_port(pegasus_http, tcp,5988,s0) network_port(pegasus_https, tcp,5989,s0) @@ -4746,17 +4221,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene network_port(pop, tcp,106,s0, tcp,109,s0, tcp,110,s0, tcp,143,s0, tcp,220,s0, tcp,993,s0, tcp,995,s0, tcp,1109,s0) network_port(portmap, udp,111,s0, tcp,111,s0) network_port(postgresql, tcp,5432,s0) - network_port(postgrey, tcp,60000,s0) -+network_port(prelude, tcp,4690,s0, udp,4690,s0) - network_port(printer, tcp,515,s0) - network_port(ptal, tcp,5703,s0) - network_port(pxe, udp,4011,s0) -@@ -137,16 +153,16 @@ - network_port(ricci_modcluster, tcp,16851,s0, udp,16851,s0) - network_port(rlogind, tcp,513,s0) - network_port(rndc, tcp,953,s0) --network_port(router, udp,520,s0) -+network_port(router, udp,520,s0, udp,521,s0, tcp,521,s0) +@@ -141,12 +154,12 @@ network_port(rsh, tcp,514,s0) network_port(rsync, tcp,873,s0, udp,873,s0) network_port(rwho, udp,513,s0) @@ -4771,11 +4236,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene type socks_port_t, port_type; dnl network_port(socks) # no defined portcon type stunnel_port_t, port_type; dnl network_port(stunnel) # no defined portcon in current strict network_port(squid, udp,3401,s0, tcp,3401,s0, udp,4827,s0, tcp,4827,s0) # snmp and htcp -@@ -160,13 +176,20 @@ +@@ -160,13 +173,19 @@ type utcpserver_port_t, port_type; dnl network_port(utcpserver) # no defined portcon network_port(uucpd, tcp,540,s0) network_port(vnc, tcp,5900,s0) -+network_port(whois, tcp,43,s0, udp,43,s0) +network_port(wccp, udp,2048,s0) +network_port(xdmcp, udp,177,s0, tcp,177,s0) network_port(xen, tcp,8002,s0) @@ -4795,29 +4259,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.0.8/policy/modules/kernel/devices.fc --- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/devices.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -1,8 +1,9 @@ ++++ serefpolicy-3.0.8/policy/modules/kernel/devices.fc 2007-12-31 08:18:10.000000000 -0500 +@@ -4,6 +4,7 @@ - /dev -d gen_context(system_u:object_r:device_t,s0) - /dev/.* gen_context(system_u:object_r:device_t,s0) -- -+/dev/3dfx -c gen_context(system_u:object_r:xserver_misc_device_t,s0) /dev/.*mouse.* -c gen_context(system_u:object_r:mouse_device_t,s0) -+/dev/admmidi.* -c gen_context(system_u:object_r:sound_device_t,s0) /dev/adsp.* -c gen_context(system_u:object_r:sound_device_t,s0) ++/dev/admmidi.* -c gen_context(system_u:object_r:sound_device_t,s0) /dev/(misc/)?agpgart -c gen_context(system_u:object_r:agp_device_t,s0) /dev/aload.* -c gen_context(system_u:object_r:sound_device_t,s0) -@@ -11,29 +12,45 @@ - /dev/apm_bios -c gen_context(system_u:object_r:apm_bios_t,s0) - /dev/atibm -c gen_context(system_u:object_r:mouse_device_t,s0) - /dev/audio.* -c gen_context(system_u:object_r:sound_device_t,s0) -+/dev/autofs.* -c gen_context(system_u:object_r:autofs_device_t,s0) + /dev/amidi.* -c gen_context(system_u:object_r:sound_device_t,s0) +@@ -14,22 +15,33 @@ /dev/beep -c gen_context(system_u:object_r:sound_device_t,s0) /dev/dmfm -c gen_context(system_u:object_r:sound_device_t,s0) -+/dev/dmmidi.* -c gen_context(system_u:object_r:sound_device_t,s0) /dev/dsp.* -c gen_context(system_u:object_r:sound_device_t,s0) -+/dev/gfx -c gen_context(system_u:object_r:xserver_misc_device_t,s0) -+/dev/graphics -c gen_context(system_u:object_r:xserver_misc_device_t,s0) +/dev/gtrsc.* -c gen_context(system_u:object_r:clock_device_t,s0) +/dev/pcfclock.* -c gen_context(system_u:object_r:clock_device_t,s0) /dev/efirtc -c gen_context(system_u:object_r:clock_device_t,s0) @@ -4829,8 +4283,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device +/dev/[0-9].* -c gen_context(system_u:object_r:usb_device_t,s0) /dev/fw.* -c gen_context(system_u:object_r:usb_device_t,s0) +/dev/hfmodem -c gen_context(system_u:object_r:sound_device_t,s0) - /dev/hiddev.* -c gen_context(system_u:object_r:usb_device_t,s0) +/dev/hidraw.* -c gen_context(system_u:object_r:usb_device_t,s0) + /dev/hiddev.* -c gen_context(system_u:object_r:usb_device_t,s0) /dev/hpet -c gen_context(system_u:object_r:clock_device_t,s0) /dev/hw_random -c gen_context(system_u:object_r:random_device_t,s0) /dev/hwrng -c gen_context(system_u:object_r:random_device_t,s0) @@ -4839,51 +4293,52 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device +/dev/ipmi/[0-9]+ -c gen_context(system_u:object_r:ipmi_device_t,s0) /dev/irlpt[0-9]+ -c gen_context(system_u:object_r:printer_device_t,s0) +/dev/elographics/e2201 -c gen_context(system_u:object_r:mouse_device_t,s0) -+/dev/jbm -c gen_context(system_u:object_r:mouse_device_t,s0) /dev/js.* -c gen_context(system_u:object_r:mouse_device_t,s0) /dev/kmem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) ++/dev/mergemem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) /dev/kmsg -c gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh) -+/dev/kvm -c gen_context(system_u:object_r:kvm_device_t,s0) ++/dev/kvm -c gen_context(system_u:object_r:kvm_device_t,mls_systemhigh) +/dev/lircm -c gen_context(system_u:object_r:mouse_device_t,s0) /dev/logibm -c gen_context(system_u:object_r:mouse_device_t,s0) /dev/lp.* -c gen_context(system_u:object_r:printer_device_t,s0) /dev/mcelog -c gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh) - /dev/mem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) -+/dev/mergemem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) - /dev/mice -c gen_context(system_u:object_r:mouse_device_t,s0) - /dev/microcode -c gen_context(system_u:object_r:cpu_device_t,s0) - /dev/midi.* -c gen_context(system_u:object_r:sound_device_t,s0) -@@ -44,6 +61,7 @@ +@@ -41,6 +53,11 @@ + /dev/mmetfgrab -c gen_context(system_u:object_r:scanner_device_t,s0) + /dev/mpu401.* -c gen_context(system_u:object_r:sound_device_t,s0) + /dev/null -c gen_context(system_u:object_r:null_device_t,s0) ++ ++/dev/opengl -c gen_context(system_u:object_r:xserver_misc_device_t,s0) ++/dev/gfx -c gen_context(system_u:object_r:xserver_misc_device_t,s0) ++/dev/3dfx -c gen_context(system_u:object_r:xserver_misc_device_t,s0) ++/dev/graphics -c gen_context(system_u:object_r:xserver_misc_device_t,s0) /dev/nvidia.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0) /dev/nvram -c gen_context(system_u:object_r:nvram_device_t,mls_systemhigh) /dev/oldmem -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) -+/dev/opengl -c gen_context(system_u:object_r:xserver_misc_device_t,s0) - /dev/par.* -c gen_context(system_u:object_r:printer_device_t,s0) - /dev/patmgr[01] -c gen_context(system_u:object_r:sound_device_t,s0) +@@ -49,6 +66,9 @@ /dev/pmu -c gen_context(system_u:object_r:power_device_t,s0) -@@ -65,14 +83,14 @@ + /dev/port -c gen_context(system_u:object_r:memory_device_t,mls_systemhigh) + /dev/(misc/)?psaux -c gen_context(system_u:object_r:mouse_device_t,s0) ++/dev/dmmidi.* -c gen_context(system_u:object_r:sound_device_t,s0) ++/dev/inportbm -c gen_context(system_u:object_r:mouse_device_t,s0) ++/dev/jbm -c gen_context(system_u:object_r:mouse_device_t,s0) + /dev/rmidi.* -c gen_context(system_u:object_r:sound_device_t,s0) + /dev/radeon -c gen_context(system_u:object_r:dri_device_t,s0) + /dev/radio.* -c gen_context(system_u:object_r:v4l_device_t,s0) +@@ -65,9 +85,11 @@ /dev/sonypi -c gen_context(system_u:object_r:v4l_device_t,s0) /dev/tlk[0-3] -c gen_context(system_u:object_r:v4l_device_t,s0) /dev/urandom -c gen_context(system_u:object_r:urandom_device_t,s0) --/dev/usbmon[0-9]+ -c gen_context(system_u:object_r:usb_device_t,s0) --/dev/usbdev.* -c gen_context(system_u:object_r:usb_device_t,s0) --/dev/usb[0-9]+ -c gen_context(system_u:object_r:usb_device_t,s0) +/dev/ub[a-c] -c gen_context(system_u:object_r:usb_device_t,s0) -+/dev/usb.+ -c gen_context(system_u:object_r:usb_device_t,s0) + /dev/usbmon[0-9]+ -c gen_context(system_u:object_r:usb_device_t,s0) + /dev/usbdev.* -c gen_context(system_u:object_r:usb_device_t,s0) + /dev/usb[0-9]+ -c gen_context(system_u:object_r:usb_device_t,s0) ++/dev/usb/.+ -c gen_context(system_u:object_r:usb_device_t,s0) /dev/usblp.* -c gen_context(system_u:object_r:printer_device_t,s0) ifdef(`distro_suse', ` /dev/usbscanner -c gen_context(system_u:object_r:scanner_device_t,s0) - ') - /dev/vbi.* -c gen_context(system_u:object_r:v4l_device_t,s0) -+/dev/vboxadd.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0) - /dev/vmmon -c gen_context(system_u:object_r:vmware_device_t,s0) - /dev/vmnet.* -c gen_context(system_u:object_r:vmware_device_t,s0) - /dev/video.* -c gen_context(system_u:object_r:v4l_device_t,s0) -@@ -94,12 +112,23 @@ - +@@ -95,11 +117,21 @@ /dev/dvb/.* -c gen_context(system_u:object_r:v4l_device_t,s0) -+/dev/inportbm -c gen_context(system_u:object_r:mouse_device_t,s0) /dev/input/.*mouse.* -c gen_context(system_u:object_r:mouse_device_t,s0) +/dev/input/keyboard.* -c gen_context(system_u:object_r:event_device_t,s0) /dev/input/event.* -c gen_context(system_u:object_r:event_device_t,s0) @@ -4903,26 +4358,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device /dev/pts(/.*)? <> -@@ -113,14 +142,9 @@ - /dev/xen/blktap.* -c gen_context(system_u:object_r:xen_device_t,s0) - /dev/xen/evtchn -c gen_context(system_u:object_r:xen_device_t,s0) - --/etc/udev/devices -d gen_context(system_u:object_r:device_t,s0) -- --/lib/udev/devices -d gen_context(system_u:object_r:device_t,s0) -+/etc/udev/devices -d gen_context(system_u:object_r:device_t,s0) - --ifdef(`distro_debian',` --# used by udev init script as temporary mount point --/lib/udev/devices -d gen_context(system_u:object_r:device_t,s0) --') -+/lib/udev/devices -d gen_context(system_u:object_r:device_t,s0) - - ifdef(`distro_gentoo',` - # used by init scripts to initally populate udev /dev diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.0.8/policy/modules/kernel/devices.if --- nsaserefpolicy/policy/modules/kernel/devices.if 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/devices.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/devices.if 2008-01-13 07:59:15.000000000 -0500 @@ -65,7 +65,7 @@ relabelfrom_dirs_pattern($1,device_t,device_node) @@ -5097,155 +4535,45 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device ## Get the attributes of miscellaneous devices. ## ## -@@ -3284,3 +3414,96 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-3.0.8/policy/modules/kernel/devices.te +--- nsaserefpolicy/policy/modules/kernel/devices.te 2007-10-22 13:21:42.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/devices.te 2007-12-31 08:18:33.000000000 -0500 +@@ -66,12 +66,25 @@ + dev_node(framebuf_device_t) - typeattribute $1 devices_unconfined_type; - ') -+ -+######################################## -+## -+## Get the attributes of the autofs device node. -+## -+## -+## -+## Domain allowed access. -+## -+## + # ++# Type for /dev/ipmi/0 +# -+interface(`dev_getattr_autofs_dev',` -+ gen_require(` -+ type device_t, autofs_device_t; -+ ') ++type ipmi_device_t; ++dev_node(ipmi_device_t) + -+ getattr_chr_files_pattern($1,device_t,autofs_device_t) -+') ++# + # Type for /dev/kmsg + # + type kmsg_device_t; + dev_node(kmsg_device_t) + + # ++# kvm_device_t is the type of ++# /dev/kvm ++# ++type kvm_device_t; ++dev_node(kvm_device_t) + -+######################################## -+## -+## Do not audit attempts to get the attributes of -+## the autofs device node. -+## -+## -+## -+## Domain to not audit. -+## -+## +# -+interface(`dev_dontaudit_getattr_autofs_dev',` -+ gen_require(` -+ type autofs_device_t; -+ ') -+ -+ dontaudit $1 autofs_device_t:chr_file getattr; -+') -+ -+######################################## -+## -+## Set the attributes of the autofs device node. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_setattr_autofs_dev',` -+ gen_require(` -+ type device_t, autofs_device_t; -+ ') -+ -+ setattr_chr_files_pattern($1,device_t,autofs_device_t) -+') -+ -+######################################## -+## -+## Do not audit attempts to set the attributes of -+## the autofs device node. -+## -+## -+## -+## Domain to not audit. -+## -+## -+# -+interface(`dev_dontaudit_setattr_autofs_dev',` -+ gen_require(` -+ type autofs_device_t; -+ ') -+ -+ dontaudit $1 autofs_device_t:chr_file setattr; -+') -+ -+######################################## -+## -+## Read and write the autofs device. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_rw_autofs',` -+ gen_require(` -+ type device_t, autofs_device_t; -+ ') -+ -+ rw_chr_files_pattern($1,device_t,autofs_device_t) -+') -+ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.te serefpolicy-3.0.8/policy/modules/kernel/devices.te ---- nsaserefpolicy/policy/modules/kernel/devices.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/devices.te 2008-04-04 16:11:03.000000000 -0400 -@@ -32,6 +32,12 @@ - type apm_bios_t; - dev_node(apm_bios_t) - -+# -+# Type for /dev/autofs -+# -+type autofs_device_t; -+dev_node(autofs_device_t) -+ - type cardmgr_dev_t; - dev_node(cardmgr_dev_t) - files_tmp_file(cardmgr_dev_t) -@@ -66,12 +72,25 @@ - dev_node(framebuf_device_t) - - # -+# Type for /dev/ipmi/0 -+# -+type ipmi_device_t; -+dev_node(ipmi_device_t) -+ -+# - # Type for /dev/kmsg - # - type kmsg_device_t; - dev_node(kmsg_device_t) - - # -+# kvm_device_t is the type of -+# /dev/kvm -+# -+type kvm_device_t; -+dev_node(kvm_device_t) -+ -+# - # Type for /dev/mapper/control - # - type lvm_control_t; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.0.8/policy/modules/kernel/domain.if ---- nsaserefpolicy/policy/modules/kernel/domain.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/domain.if 2008-04-04 16:11:03.000000000 -0400 -@@ -45,6 +45,11 @@ - # start with basic domain - domain_base_type($1) - -+ optional_policy(` -+ unconfined_use_fds($1) -+ unconfined_sigchld($1) + # Type for /dev/mapper/control + # + type lvm_control_t; +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.0.8/policy/modules/kernel/domain.if +--- nsaserefpolicy/policy/modules/kernel/domain.if 2007-10-22 13:21:42.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/domain.if 2007-12-02 21:15:34.000000000 -0500 +@@ -45,6 +45,11 @@ + # start with basic domain + domain_base_type($1) + ++ optional_policy(` ++ unconfined_use_fds($1) ++ unconfined_sigchld($1) + ') + # send init a sigchld and signull @@ -5282,7 +4610,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.0.8/policy/modules/kernel/domain.te --- nsaserefpolicy/policy/modules/kernel/domain.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/domain.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/domain.te 2007-12-02 21:15:34.000000000 -0500 @@ -6,6 +6,22 @@ # Declarations # @@ -5320,23 +4648,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain # Use trusted objects in /dev dev_rw_null(domain) -@@ -91,6 +111,9 @@ - - # list the root directory - files_list_root(domain) -+# Apps getattr on the current working directory when they start, this just -+# eliminates lots of bogus avc messages -+files_getattr_all_dirs(domain) - - tunable_policy(`global_ssp',` - # enable reading of urandom for all domains: -@@ -129,8 +152,46 @@ - - # For /proc/pid - allow unconfined_domain_type domain:dir r_dir_perms; --allow unconfined_domain_type domain:file r_file_perms; -+allow unconfined_domain_type domain:file rw_file_perms; - allow unconfined_domain_type domain:lnk_file r_file_perms; +@@ -134,3 +154,32 @@ # act on all domains keys allow unconfined_domain_type domain:key *; @@ -5365,22 +4677,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain +allow domain domain:fd use; +optional_policy(` + rpm_rw_pipes(domain) -+ rpm_dontaudit_use_script_fds(domain) -+ rpm_dontaudit_write_pid_files(domain) +') -+ +optional_policy(` + unconfined_dontaudit_rw_pipes(domain) -+ unconfined_sigchld(domain) +') -+ -+optional_policy(` -+ rhgb_dontaudit_use_ptys(domain) -+') -+ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.fc serefpolicy-3.0.8/policy/modules/kernel/files.fc --- nsaserefpolicy/policy/modules/kernel/files.fc 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/files.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/files.fc 2007-12-02 21:15:34.000000000 -0500 @@ -209,7 +209,8 @@ /usr/lost\+found -d gen_context(system_u:object_r:lost_found_t,mls_systemhigh) /usr/lost\+found/.* <> @@ -5393,7 +4696,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. /usr/src/kernels/.+/lib(/.*)? gen_context(system_u:object_r:usr_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.0.8/policy/modules/kernel/files.if --- nsaserefpolicy/policy/modules/kernel/files.if 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/files.if 2008-04-21 16:41:56.920656000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/files.if 2008-01-16 08:57:05.000000000 -0500 @@ -343,8 +343,7 @@ ######################################## @@ -5676,7 +4979,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ## Read all tmp files. ## ## -@@ -3323,6 +3439,60 @@ +@@ -3323,6 +3439,42 @@ ######################################## ## @@ -5698,24 +5001,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. + +######################################## +## -+## dontaudit write of /usr files -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`files_dontaudit_write_usr_files',` -+ gen_require(` -+ type usr_t; -+ ') -+ -+ dontaudit $1 usr_t:file write; -+') -+ -+######################################## -+## +## Create, read, write, and delete files in the /usr directory. +## +## @@ -5737,7 +5022,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ## Get the attributes of files in /usr. ## ## -@@ -3381,7 +3551,7 @@ +@@ -3381,7 +3533,7 @@ ######################################## ## @@ -5746,7 +5031,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ## ## ## -@@ -3389,17 +3559,17 @@ +@@ -3389,17 +3541,17 @@ ## ## # @@ -5767,7 +5052,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ## ## ## -@@ -3407,12 +3577,12 @@ +@@ -3407,12 +3559,12 @@ ## ## # @@ -5782,7 +5067,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -4043,7 +4213,7 @@ +@@ -4043,7 +4195,7 @@ type var_t, var_lock_t; ') @@ -5791,7 +5076,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -4285,6 +4455,25 @@ +@@ -4285,6 +4437,25 @@ ######################################## ## @@ -5817,7 +5102,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ## Do not audit attempts to write to daemon runtime data files. ## ## -@@ -4560,6 +4749,8 @@ +@@ -4560,6 +4731,8 @@ # Need to give access to /selinux/member selinux_compute_member($1) @@ -5826,7 +5111,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. # Need sys_admin capability for mounting allow $1 self:capability { chown fsetid sys_admin }; -@@ -4582,6 +4773,11 @@ +@@ -4582,6 +4755,11 @@ # Default type for mountpoints allow $1 poly_t:dir { create mounton }; fs_unmount_xattr_fs($1) @@ -5838,7 +5123,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. ') ######################################## -@@ -4619,3 +4815,28 @@ +@@ -4619,3 +4797,28 @@ allow $1 { file_type -security_file_type }:dir manage_dir_perms; ') @@ -5869,7 +5154,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.te serefpolicy-3.0.8/policy/modules/kernel/files.te --- nsaserefpolicy/policy/modules/kernel/files.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/files.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/files.te 2007-12-02 21:15:34.000000000 -0500 @@ -1,5 +1,5 @@ -policy_module(files,1.6.1) @@ -5897,7 +5182,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.if serefpolicy-3.0.8/policy/modules/kernel/filesystem.if --- nsaserefpolicy/policy/modules/kernel/filesystem.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/filesystem.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/filesystem.if 2008-01-13 07:57:42.000000000 -0500 @@ -271,45 +271,6 @@ ######################################## @@ -5979,114 +5264,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ## ## ## -@@ -1249,6 +1229,106 @@ - - ######################################## - ## -+## Create, read, write, and delete directories -+## on a FUSEFS filesystem. -+## -+## -+## -+## Domain allowed access. -+## -+## -+## -+# -+interface(`fs_manage_fusefs_dirs',` -+ gen_require(` -+ type fusefs_t; -+ ') -+ -+ allow $1 fusefs_t:dir manage_dir_perms; -+') -+ -+######################################## -+## -+## Do not audit attempts to create, read, -+## write, and delete directories -+## on a FUSEFS filesystem. -+## -+## -+## -+## Domain to not audit. -+## -+## -+# -+interface(`fs_dontaudit_manage_fusefs_dirs',` -+ gen_require(` -+ type fusefs_t; -+ ') -+ -+ dontaudit $1 fusefs_t:dir manage_dir_perms; -+') -+ -+######################################## -+## -+## Create, read, write, and delete files -+## on a FUSEFS filesystem. -+## -+## -+## -+## Domain allowed access. -+## -+## -+## -+# -+interface(`fs_manage_fusefs_files',` -+ gen_require(` -+ type fusefs_t; -+ ') -+ -+ manage_files_pattern($1,fusefs_t,fusefs_t) -+') -+ -+######################################## -+## -+## Read symbolic links on a FUSEFS filesystem. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`fs_read_fusefs_symlinks',` -+ gen_require(` -+ type fusefs_t; -+ ') -+ -+ allow $1 fusefs_t:dir list_dir_perms; -+ read_lnk_files_pattern($1,fusefs_t,fusefs_t) -+') -+ -+ -+######################################## -+## -+## Do not audit attempts to create, -+## read, write, and delete files -+## on a FUSEFS filesystem. -+## -+## -+## -+## Domain to not audit. -+## -+## -+# -+interface(`fs_dontaudit_manage_fusefs_files',` -+ gen_require(` -+ type fusefs_t; -+ ') -+ -+ dontaudit $1 fusefs_t:file manage_file_perms; -+') -+ -+######################################## -+## - ## Search inotifyfs filesystem. - ## - ## -@@ -2139,6 +2219,7 @@ +@@ -2139,6 +2119,7 @@ rw_files_pattern($1,nfsd_fs_t,nfsd_fs_t) ') @@ -6094,7 +5272,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ######################################## ## ## Mount a RAM filesystem. -@@ -2214,6 +2295,24 @@ +@@ -2214,6 +2195,24 @@ ######################################## ## @@ -6119,7 +5297,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ## Search directories on a ramfs ## ## -@@ -2276,7 +2375,7 @@ +@@ -2276,7 +2275,7 @@ ## Domain allowed access. ## ## @@ -6128,23 +5306,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy interface(`fs_dontaudit_read_ramfs_files',` gen_require(` type ramfs_t; -@@ -2885,6 +2984,7 @@ - type tmpfs_t; - ') - -+ dontaudit $1 tmpfs_t:dir rw_dir_perms; - dontaudit $1 tmpfs_t:file rw_file_perms; - ') - -@@ -3206,6 +3306,7 @@ - ') - - allow $1 filesystem_type:filesystem getattr; -+ files_getattr_all_file_type_fs($1) - ') - - ######################################## -@@ -3322,6 +3423,24 @@ +@@ -3322,6 +3321,24 @@ ######################################## ## @@ -6169,7 +5331,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy ## List all directories with a filesystem type. ## ## -@@ -3533,3 +3652,62 @@ +@@ -3533,3 +3550,42 @@ relabelfrom_blk_files_pattern($1,noxattrfs,noxattrfs) relabelfrom_chr_files_pattern($1,noxattrfs,noxattrfs) ') @@ -6212,29 +5374,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy + rw_files_pattern($1,anon_inodefs_t,anon_inodefs_t) +') + -+ -+######################################## -+## -+## Read and write files on hugetlbfs files -+## file systems. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`fs_rw_hugetlbfs_files',` -+ gen_require(` -+ type hugetlbfs_t; -+ -+ ') -+ -+ rw_files_pattern($1,hugetlbfs_t,hugetlbfs_t) -+') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.0.8/policy/modules/kernel/filesystem.te --- nsaserefpolicy/policy/modules/kernel/filesystem.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/filesystem.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/filesystem.te 2007-12-02 21:15:34.000000000 -0500 @@ -21,6 +21,7 @@ # Use xattrs for the following filesystem types. @@ -6251,18 +5393,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy fs_use_xattr xfs gen_context(system_u:object_r:fs_t,s0); # Use the allocating task SID to label inodes in the following filesystem -@@ -80,8 +82,10 @@ +@@ -80,6 +82,7 @@ type fusefs_t; fs_noxattr_type(fusefs_t) allow fusefs_t self:filesystem associate; +allow fusefs_t fs_t:filesystem associate; genfscon fuse / gen_context(system_u:object_r:fusefs_t,s0) genfscon fuseblk / gen_context(system_u:object_r:fusefs_t,s0) -+genfscon fusectl / gen_context(system_u:object_r:fusefs_t,s0) - type futexfs_t; - fs_type(futexfs_t) -@@ -116,6 +120,7 @@ +@@ -116,6 +119,7 @@ type ramfs_t; fs_type(ramfs_t) @@ -6270,7 +5409,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy genfscon ramfs / gen_context(system_u:object_r:ramfs_t,s0) type romfs_t; -@@ -133,6 +138,16 @@ +@@ -133,6 +137,16 @@ genfscon spufs / gen_context(system_u:object_r:spufs_t,s0) files_mountpoint(spufs_t) @@ -6287,18 +5426,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesy type vxfs_t; fs_noxattr_type(vxfs_t) files_mountpoint(vxfs_t) -@@ -222,6 +237,8 @@ - genfscon hfs / gen_context(system_u:object_r:nfs_t,s0) - genfscon hfsplus / gen_context(system_u:object_r:nfs_t,s0) - genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0) -+genfscon lustre / gen_context(system_u:object_r:nfs_t,s0) -+genfscon panfs / gen_context(system_u:object_r:nfs_t,s0) - - ######################################## - # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.8/policy/modules/kernel/kernel.if --- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/kernel.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/kernel.if 2007-12-02 21:15:34.000000000 -0500 @@ -352,6 +352,24 @@ ######################################## @@ -6404,17 +5534,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.0.8/policy/modules/kernel/kernel.te --- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/kernel.te 2008-04-04 16:11:03.000000000 -0400 -@@ -255,6 +255,8 @@ - fs_rw_tmpfs_chr_files(kernel_t) - ') - -+userdom_generic_user_home_dir_filetrans_generic_user_home_content(kernel_t, { file dir }) -+ - tunable_policy(`read_default_t',` - files_list_default(kernel_t) - files_read_default_files(kernel_t) -@@ -359,7 +361,7 @@ ++++ serefpolicy-3.0.8/policy/modules/kernel/kernel.te 2008-01-11 15:14:27.000000000 -0500 +@@ -359,7 +359,7 @@ allow kern_unconfined proc_type:{ dir file lnk_file } *; @@ -6425,7 +5546,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.0.8/policy/modules/kernel/selinux.if --- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/selinux.if 2008-04-15 13:51:50.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/selinux.if 2007-12-02 21:15:34.000000000 -0500 @@ -138,6 +138,7 @@ type security_t; ') @@ -6492,36 +5613,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu if(!secure_mode_policyload) { allow $1 security_t:security setbool; -@@ -336,6 +368,28 @@ - - ######################################## - ## -+## dontaudit caller to validate security contexts. -+## -+## -+## -+## The process type permitted to validate contexts. -+## -+## -+## -+# -+interface(`selinux_dontaudit_validate_context',` -+ gen_require(` -+ type security_t; -+ ') -+ -+ dontaudit $1 security_t:dir list_dir_perms; -+ dontaudit $1 security_t:file { getattr read write }; -+ dontaudit $1 security_t:security check_context; -+') -+ -+ -+######################################## -+## - ## Allows caller to compute an access vector. - ## - ## -@@ -463,3 +517,23 @@ +@@ -463,3 +495,23 @@ typeattribute $1 selinux_unconfined_type; ') @@ -6547,7 +5639,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.te serefpolicy-3.0.8/policy/modules/kernel/selinux.te --- nsaserefpolicy/policy/modules/kernel/selinux.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/selinux.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/selinux.te 2007-12-02 21:15:34.000000000 -0500 @@ -10,6 +10,7 @@ attribute can_setenforce; attribute can_setsecparam; @@ -6570,7 +5662,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu neverallow ~{ selinux_unconfined_type can_setsecparam } security_t:security setsecparam; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.0.8/policy/modules/kernel/storage.fc --- nsaserefpolicy/policy/modules/kernel/storage.fc 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/storage.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/storage.fc 2007-12-21 10:02:37.000000000 -0500 @@ -6,18 +6,22 @@ /dev/n?pt[0-9]+ -c gen_context(system_u:object_r:tape_device_t,s0) /dev/n?tpqic[12].* -c gen_context(system_u:object_r:tape_device_t,s0) @@ -6621,7 +5713,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag /dev/i2o/hd[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.0.8/policy/modules/kernel/storage.if --- nsaserefpolicy/policy/modules/kernel/storage.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/storage.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/storage.if 2008-01-08 06:26:29.000000000 -0500 @@ -106,6 +106,26 @@ ######################################## @@ -6713,7 +5805,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.te serefpolicy-3.0.8/policy/modules/kernel/storage.te --- nsaserefpolicy/policy/modules/kernel/storage.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/storage.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/storage.te 2007-12-02 21:15:34.000000000 -0500 @@ -23,6 +23,12 @@ neverallow ~{ fixed_disk_raw_write storage_unconfined_type } fixed_disk_device_t:{ chr_file blk_file } { append write }; @@ -6729,7 +5821,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.0.8/policy/modules/kernel/terminal.fc --- nsaserefpolicy/policy/modules/kernel/terminal.fc 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/terminal.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/terminal.fc 2007-12-02 21:15:34.000000000 -0500 @@ -2,18 +2,27 @@ /dev/.*tty[^/]* -c gen_context(system_u:object_r:tty_device_t,s0) /dev/[pt]ty[a-ep-z][0-9a-f] -c gen_context(system_u:object_r:bsdpty_device_t,s0) @@ -6761,7 +5853,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.0.8/policy/modules/kernel/terminal.if --- nsaserefpolicy/policy/modules/kernel/terminal.if 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/terminal.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/terminal.if 2007-12-10 09:32:14.000000000 -0500 @@ -525,11 +525,13 @@ interface(`term_use_generic_ptys',` gen_require(` @@ -6790,7 +5882,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-3.0.8/policy/modules/kernel/terminal.te --- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/kernel/terminal.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/kernel/terminal.te 2007-12-02 21:15:34.000000000 -0500 @@ -28,6 +28,7 @@ type devpts_t; files_mountpoint(devpts_t) @@ -6801,7 +5893,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.0.8/policy/modules/services/amavis.te --- nsaserefpolicy/policy/modules/services/amavis.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/amavis.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/amavis.te 2007-12-02 21:15:34.000000000 -0500 @@ -65,6 +65,7 @@ # Spool Files manage_dirs_pattern(amavis_t,amavis_spool_t,amavis_spool_t) @@ -6820,16 +5912,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav dev_read_rand(amavis_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.0.8/policy/modules/services/apache.fc --- nsaserefpolicy/policy/modules/services/apache.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/apache.fc 2008-04-14 16:03:57.000000000 -0400 -@@ -6,6 +6,7 @@ - /etc/httpd -d gen_context(system_u:object_r:httpd_config_t,s0) - /etc/httpd/conf.* gen_context(system_u:object_r:httpd_config_t,s0) - /etc/httpd/logs gen_context(system_u:object_r:httpd_log_t,s0) -+/var/www(/.*)?/logs(/.*)? gen_context(system_u:object_r:httpd_log_t,s0) - /etc/httpd/modules gen_context(system_u:object_r:httpd_modules_t,s0) - /etc/vhosts -- gen_context(system_u:object_r:httpd_config_t,s0) - -@@ -16,7 +17,6 @@ ++++ serefpolicy-3.0.8/policy/modules/services/apache.fc 2007-12-02 21:15:34.000000000 -0500 +@@ -16,7 +16,6 @@ /usr/lib/apache-ssl/.+ -- gen_context(system_u:object_r:httpd_exec_t,s0) /usr/lib/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) @@ -6837,23 +5921,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac /usr/lib(64)?/apache(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) /usr/lib(64)?/apache2/modules(/.*)? gen_context(system_u:object_r:httpd_modules_t,s0) /usr/lib(64)?/apache(2)?/suexec(2)? -- gen_context(system_u:object_r:httpd_suexec_exec_t,s0) -@@ -33,6 +33,7 @@ - /usr/sbin/httpd2-.* -- gen_context(system_u:object_r:httpd_exec_t,s0) - ') - -+/usr/share/drupal(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) - /usr/share/htdig(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) - /usr/share/openca/htdocs(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) - /usr/share/selinux-policy[^/]*/html(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) -@@ -48,6 +49,7 @@ - - /var/lib/cacti/rra(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) - /var/lib/dav(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0) -+/var/lib/drupal(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t,s0) - /var/lib/htdig(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) - /var/lib/httpd(/.*)? gen_context(system_u:object_r:httpd_var_lib_t,s0) - /var/lib/php/session(/.*)? gen_context(system_u:object_r:httpd_var_run_t,s0) -@@ -71,5 +73,16 @@ +@@ -71,5 +70,16 @@ /var/www(/.*)? gen_context(system_u:object_r:httpd_sys_content_t,s0) /var/www/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_sys_script_exec_t,s0) @@ -6872,7 +5940,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +/etc/rc\.d/init\.d/httpd -- gen_context(system_u:object_r:httpd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.0.8/policy/modules/services/apache.if --- nsaserefpolicy/policy/modules/services/apache.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/apache.if 2008-04-10 13:08:35.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/apache.if 2007-12-31 07:17:25.000000000 -0500 @@ -18,10 +18,6 @@ attribute httpd_script_exec_type; type httpd_t, httpd_suexec_t, httpd_log_t; @@ -6920,19 +5988,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac # Allow the web server to run scripts and serve pages tunable_policy(`httpd_builtin_scripting',` manage_dirs_pattern(httpd_t,httpd_$1_script_rw_t,httpd_$1_script_rw_t) -@@ -150,9 +142,11 @@ - - # privileged users run the script: - domtrans_pattern(httpd_exec_scripts, httpd_$1_script_exec_t, httpd_$1_script_t) -+ allow httpd_exec_scripts httpd_$1_script_exec_t:file read_file_perms; - - # apache runs the script: - domtrans_pattern(httpd_t, httpd_$1_script_exec_t, httpd_$1_script_t) -+ allow httpd_t httpd_$1_script_exec_t:file read_file_perms; - - allow httpd_t httpd_$1_script_t:process { signal sigkill sigstop }; - allow httpd_t httpd_$1_script_exec_t:dir list_dir_perms; -@@ -177,48 +171,6 @@ +@@ -177,48 +169,6 @@ miscfiles_read_localization(httpd_$1_script_t) ') @@ -6981,7 +6037,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac optional_policy(` tunable_policy(`httpd_enable_cgi && allow_ypbind',` nis_use_ypbind_uncond(httpd_$1_script_t) -@@ -265,12 +217,19 @@ +@@ -265,12 +215,19 @@ template(`apache_per_role_template', ` gen_require(` attribute httpdcontent, httpd_script_domains; @@ -7003,7 +6059,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac typeattribute httpd_$1_script_t httpd_script_domains; userdom_user_home_content($1,httpd_$1_content_t) -@@ -324,6 +283,7 @@ +@@ -324,6 +281,7 @@ userdom_search_user_home_dirs($1,httpd_t) userdom_search_user_home_dirs($1,httpd_suexec_t) userdom_search_user_home_dirs($1,httpd_$1_script_t) @@ -7011,7 +6067,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ') -@@ -345,12 +305,11 @@ +@@ -345,12 +303,11 @@ # template(`apache_read_user_scripts',` gen_require(` @@ -7028,7 +6084,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ######################################## -@@ -371,12 +330,12 @@ +@@ -371,12 +328,12 @@ # template(`apache_read_user_content',` gen_require(` @@ -7045,7 +6101,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ######################################## -@@ -754,6 +713,7 @@ +@@ -754,6 +711,7 @@ ') allow $1 httpd_modules_t:dir list_dir_perms; @@ -7053,7 +6109,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ######################################## -@@ -838,6 +798,10 @@ +@@ -838,6 +796,10 @@ type httpd_sys_script_t; ') @@ -7064,7 +6120,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_cgi && httpd_unified',` domtrans_pattern($1, httpdcontent, httpd_sys_script_t) ') -@@ -925,7 +889,7 @@ +@@ -925,7 +887,7 @@ type httpd_squirrelmail_t; ') @@ -7073,7 +6129,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ######################################## -@@ -1005,6 +969,31 @@ +@@ -1005,6 +967,31 @@ ######################################## ## @@ -7105,7 +6161,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ## Search system script state directory. ## ## -@@ -1056,3 +1045,138 @@ +@@ -1056,3 +1043,138 @@ allow httpd_t $1:process signal; ') @@ -7246,7 +6302,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.0.8/policy/modules/services/apache.te --- nsaserefpolicy/policy/modules/services/apache.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/apache.te 2008-04-04 16:12:24.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/apache.te 2008-05-07 14:23:12.000000000 -0400 @@ -1,5 +1,5 @@ -policy_module(apache,1.7.1) @@ -7419,7 +6475,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac libs_use_ld_so(httpd_t) libs_use_shared_libs(httpd_t) -@@ -344,29 +383,52 @@ +@@ -344,12 +383,8 @@ seutil_dontaudit_search_config(httpd_t) @@ -7432,8 +6488,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`allow_httpd_anon_write',` miscfiles_manage_public_files(httpd_t) ') - --ifdef(`TODO', ` +@@ -358,8 +393,16 @@ # # We need optionals to be able to be within booleans to make this work # @@ -7445,23 +6500,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +gen_tunable(allow_httpd_mod_auth_pam,false) + tunable_policy(`allow_httpd_mod_auth_pam',` -- auth_domtrans_chk_passwd(httpd_t) -+ auth_domtrans_chkpwd(httpd_t) + auth_domtrans_chk_passwd(httpd_t) ++ auth_domtrans_upd_passwd(httpd_t) ') -+ -+## -+##

-+## Allow Apache to use mod_auth_pam -+##

-+## -+gen_tunable(allow_httpd_mod_auth_ntlm_winbind,false) -+optional_policy(` -+ tunable_policy(`allow_httpd_mod_auth_pam',` -+ samba_domtrans_winbind_helper(httpd_t) -+ ') ') - tunable_policy(`httpd_can_network_connect',` +@@ -367,6 +410,16 @@ corenet_tcp_connect_all_ports(httpd_t) ') @@ -7478,7 +6522,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_can_network_connect_db',` # allow httpd to connect to mysql/posgresql corenet_tcp_connect_postgresql_port(httpd_t) -@@ -387,6 +449,10 @@ +@@ -387,6 +440,10 @@ corenet_sendrecv_http_cache_client_packets(httpd_t) ') @@ -7489,7 +6533,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',` domtrans_pattern(httpd_t, httpdcontent, httpd_sys_script_t) -@@ -404,11 +470,21 @@ +@@ -404,11 +461,21 @@ fs_read_nfs_symlinks(httpd_t) ') @@ -7511,7 +6555,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_ssi_exec',` corecmd_shell_domtrans(httpd_t,httpd_sys_script_t) allow httpd_sys_script_t httpd_t:fd use; -@@ -430,6 +506,12 @@ +@@ -430,6 +497,12 @@ ') optional_policy(` @@ -7524,7 +6568,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac calamaris_read_www_files(httpd_t) ') -@@ -442,8 +524,14 @@ +@@ -442,8 +515,14 @@ ') optional_policy(` @@ -7540,7 +6584,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') optional_policy(` -@@ -457,11 +545,11 @@ +@@ -457,11 +536,11 @@ optional_policy(` mysql_stream_connect(httpd_t) mysql_rw_db_sockets(httpd_t) @@ -7553,7 +6597,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') optional_policy(` -@@ -481,6 +569,7 @@ +@@ -481,6 +560,7 @@ ') optional_policy(` @@ -7561,7 +6605,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac snmp_dontaudit_read_snmp_var_lib_files(httpd_t) snmp_dontaudit_write_snmp_var_lib_files(httpd_t) ') -@@ -516,6 +605,13 @@ +@@ -516,6 +596,13 @@ userdom_use_sysadm_terms(httpd_helper_t) ') @@ -7575,7 +6619,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ######################################## # # Apache PHP script local policy -@@ -553,6 +649,7 @@ +@@ -553,6 +640,7 @@ optional_policy(` mysql_stream_connect(httpd_php_t) @@ -7583,7 +6627,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') optional_policy(` -@@ -567,7 +664,6 @@ +@@ -567,7 +655,6 @@ allow httpd_suexec_t self:capability { setuid setgid }; allow httpd_suexec_t self:process signal_perms; allow httpd_suexec_t self:unix_stream_socket create_stream_socket_perms; @@ -7591,7 +6635,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac domtrans_pattern(httpd_t, httpd_suexec_exec_t, httpd_suexec_t) -@@ -581,6 +677,10 @@ +@@ -581,6 +668,10 @@ manage_files_pattern(httpd_suexec_t,httpd_suexec_tmp_t,httpd_suexec_tmp_t) files_tmp_filetrans(httpd_suexec_t, httpd_suexec_tmp_t, { file dir }) @@ -7602,7 +6646,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac kernel_read_kernel_sysctls(httpd_suexec_t) kernel_list_proc(httpd_suexec_t) kernel_read_proc_symlinks(httpd_suexec_t) -@@ -590,8 +690,7 @@ +@@ -590,8 +681,7 @@ fs_search_auto_mountpoints(httpd_suexec_t) # for shell scripts @@ -7612,7 +6656,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac files_read_etc_files(httpd_suexec_t) files_read_usr_files(httpd_suexec_t) -@@ -620,8 +719,6 @@ +@@ -620,8 +710,6 @@ corenet_udp_sendrecv_all_ports(httpd_suexec_t) corenet_tcp_connect_all_ports(httpd_suexec_t) corenet_sendrecv_all_client_packets(httpd_suexec_t) @@ -7621,7 +6665,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') tunable_policy(`httpd_enable_cgi && httpd_unified',` -@@ -634,6 +731,12 @@ +@@ -634,6 +722,12 @@ fs_exec_nfs_files(httpd_suexec_t) ') @@ -7634,7 +6678,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_suexec_t) fs_read_cifs_symlinks(httpd_suexec_t) -@@ -651,18 +754,6 @@ +@@ -651,18 +745,6 @@ dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write }; ') @@ -7653,7 +6697,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ######################################## # # Apache system script local policy -@@ -672,7 +763,8 @@ +@@ -672,7 +754,8 @@ dontaudit httpd_sys_script_t httpd_config_t:dir search; @@ -7663,12 +6707,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms; read_files_pattern(httpd_sys_script_t,squirrelmail_spool_t,squirrelmail_spool_t) -@@ -686,15 +778,63 @@ +@@ -686,15 +769,62 @@ # Should we add a boolean? apache_domtrans_rotatelogs(httpd_sys_script_t) +sysnet_read_config(httpd_sys_script_t) -+sysnet_use_ldap(httpd_bugzilla_script_t) + ifdef(`distro_redhat',` allow httpd_sys_script_t httpd_log_t:file { getattr append }; @@ -7728,7 +6771,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_sys_script_t) fs_read_cifs_symlinks(httpd_sys_script_t) -@@ -707,6 +847,7 @@ +@@ -707,6 +837,7 @@ optional_policy(` mysql_stream_connect(httpd_sys_script_t) mysql_rw_db_sockets(httpd_sys_script_t) @@ -7736,7 +6779,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ######################################## -@@ -728,3 +869,46 @@ +@@ -728,3 +859,58 @@ logging_search_logs(httpd_rotatelogs_t) miscfiles_read_localization(httpd_rotatelogs_t) @@ -7783,9 +6826,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +optional_policy(` + postgresql_stream_connect(httpd_bugzilla_script_t) +') ++ ++## ++##

++## Allow Apache to use mod_auth_ntlm_winbind ++##

++## ++gen_tunable(allow_httpd_mod_auth_ntlm_winbind,false) ++optional_policy(` ++ tunable_policy(`allow_httpd_mod_auth_pam',` ++ samba_domtrans_winbind_helper(httpd_t) ++ ') ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-3.0.8/policy/modules/services/apcupsd.if --- nsaserefpolicy/policy/modules/services/apcupsd.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/apcupsd.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/apcupsd.if 2007-12-02 21:15:34.000000000 -0500 @@ -90,10 +90,29 @@ ## ## @@ -7819,7 +6874,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.0.8/policy/modules/services/apcupsd.te --- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/apcupsd.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/apcupsd.te 2007-12-02 21:15:34.000000000 -0500 @@ -86,6 +86,11 @@ miscfiles_read_localization(apcupsd_t) @@ -7832,23 +6887,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu optional_policy(` hostname_exec(apcupsd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apm.te serefpolicy-3.0.8/policy/modules/services/apm.te ---- nsaserefpolicy/policy/modules/services/apm.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/apm.te 2008-04-04 16:11:03.000000000 -0400 -@@ -190,6 +190,10 @@ - dbus_stub(apmd_t) - - optional_policy(` -+ consolekit_dbus_chat(apmd_t) -+ ') -+ -+ optional_policy(` - networkmanager_dbus_chat(apmd_t) - ') - ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/asterisk.te serefpolicy-3.0.8/policy/modules/services/asterisk.te --- nsaserefpolicy/policy/modules/services/asterisk.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/asterisk.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/asterisk.te 2007-12-02 21:15:34.000000000 -0500 @@ -98,6 +98,7 @@ # for VOIP voice channels. corenet_tcp_bind_generic_port(asterisk_t) @@ -7859,7 +6900,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/aste dev_read_sysfs(asterisk_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-3.0.8/policy/modules/services/audioentropy.te --- nsaserefpolicy/policy/modules/services/audioentropy.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/audioentropy.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/audioentropy.te 2007-12-02 21:15:34.000000000 -0500 @@ -18,7 +18,7 @@ # Local policy # @@ -7880,7 +6921,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audi fs_getattr_all_fs(entropyd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.fc serefpolicy-3.0.8/policy/modules/services/automount.fc --- nsaserefpolicy/policy/modules/services/automount.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/automount.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/automount.fc 2007-12-02 21:15:34.000000000 -0500 @@ -12,4 +12,6 @@ # /var # @@ -7891,8 +6932,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.if serefpolicy-3.0.8/policy/modules/services/automount.if --- nsaserefpolicy/policy/modules/services/automount.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/automount.if 2008-04-04 16:11:03.000000000 -0400 -@@ -74,3 +74,39 @@ ++++ serefpolicy-3.0.8/policy/modules/services/automount.if 2007-12-02 21:15:34.000000000 -0500 +@@ -74,3 +74,21 @@ dontaudit $1 automount_tmp_t:dir getattr; ') @@ -7914,27 +6955,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto + + dontaudit $1 automount_t:fd use; +') -+######################################## -+## -+## Do not audit attempts to write automount daemon unnamed pipes. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`automount_dontaudit_write_pipes',` -+ gen_require(` -+ type automount_t; -+ ') -+ -+ dontaudit $1 automount_t:fifo_file write; -+') -+ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.0.8/policy/modules/services/automount.te --- nsaserefpolicy/policy/modules/services/automount.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/automount.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/automount.te 2007-12-02 21:15:34.000000000 -0500 @@ -52,7 +52,8 @@ files_root_filetrans(automount_t,automount_tmp_t,dir) @@ -7953,17 +6976,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto fs_mount_all_fs(automount_t) fs_unmount_all_fs(automount_t) -@@ -99,7 +101,9 @@ +@@ -99,6 +101,7 @@ dev_read_sysfs(automount_t) # for SSP +dev_read_rand(automount_t) dev_read_urand(automount_t) -+dev_rw_autofs(automount_t) domain_use_interactive_fds(automount_t) - domain_dontaudit_read_all_domains_state(automount_t) -@@ -125,8 +129,12 @@ +@@ -125,6 +128,8 @@ fs_mount_autofs(automount_t) fs_manage_autofs_symlinks(automount_t) @@ -7971,12 +6992,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto + term_dontaudit_getattr_pty_dirs(automount_t) -+auth_use_nsswitch(automount_t) -+ libs_use_ld_so(automount_t) - libs_use_shared_libs(automount_t) - -@@ -147,10 +155,6 @@ +@@ -147,10 +152,6 @@ userdom_dontaudit_search_sysadm_home_dirs(automount_t) optional_policy(` @@ -7987,12 +7004,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto bind_search_cache(automount_t) ') -@@ -173,6 +177,11 @@ +@@ -173,6 +174,11 @@ ') optional_policy(` + samba_read_config(automount_t) -+ samba_manage_var_files(automount_t) ++ samba_read_var_files(automount_t) +') + +optional_policy(` @@ -8001,7 +7018,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.0.8/policy/modules/services/avahi.te --- nsaserefpolicy/policy/modules/services/avahi.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/avahi.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/avahi.te 2007-12-02 21:15:34.000000000 -0500 @@ -85,6 +85,7 @@ dbus_connect_system_bus(avahi_t) dbus_send_system_bus(avahi_t) @@ -8012,7 +7029,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.0.8/policy/modules/services/bind.fc --- nsaserefpolicy/policy/modules/services/bind.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/bind.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/bind.fc 2007-12-02 21:15:34.000000000 -0500 @@ -45,4 +45,7 @@ /var/named/chroot/var/named/slaves(/.*)? gen_context(system_u:object_r:named_cache_t,s0) /var/named/chroot/var/named/data(/.*)? gen_context(system_u:object_r:named_cache_t,s0) @@ -8023,7 +7040,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind +/var/named/chroot/var/log/named.* -- gen_context(system_u:object_r:named_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.0.8/policy/modules/services/bind.te --- nsaserefpolicy/policy/modules/services/bind.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/bind.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/bind.te 2007-12-02 21:15:34.000000000 -0500 @@ -66,7 +66,6 @@ allow named_t self:unix_dgram_socket create_socket_perms; allow named_t self:tcp_socket create_stream_socket_perms; @@ -8032,16 +7049,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind allow named_t dnssec_t:file { getattr read }; -@@ -101,6 +100,8 @@ - kernel_read_system_state(named_t) - kernel_read_network_state(named_t) +@@ -92,6 +91,8 @@ + manage_sock_files_pattern(named_t,named_var_run_t,named_var_run_t) + files_pid_filetrans(named_t,named_var_run_t,{ file sock_file }) -+corecmd_search_bin(named_t) ++auth_use_nsswitch(named_t) + - corenet_all_recvfrom_unlabeled(named_t) - corenet_all_recvfrom_netlabel(named_t) - corenet_tcp_sendrecv_all_if(named_t) -@@ -119,15 +120,11 @@ + # read zone files + allow named_t named_zone_t:dir list_dir_perms; + read_files_pattern(named_t,named_zone_t,named_zone_t) +@@ -119,6 +120,7 @@ corenet_sendrecv_dns_client_packets(named_t) corenet_sendrecv_rndc_server_packets(named_t) corenet_sendrecv_rndc_client_packets(named_t) @@ -8049,48 +7066,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind dev_read_sysfs(named_t) dev_read_rand(named_t) - --fs_getattr_all_fs(named_t) --fs_search_auto_mountpoints(named_t) -- --corecmd_search_bin(named_t) -- - dev_read_urand(named_t) - - domain_use_interactive_fds(named_t) -@@ -135,6 +132,11 @@ - files_read_etc_files(named_t) - files_read_etc_runtime_files(named_t) - -+fs_getattr_all_fs(named_t) -+fs_search_auto_mountpoints(named_t) -+ -+auth_use_nsswitch(named_t) -+ - libs_use_ld_so(named_t) - libs_use_shared_libs(named_t) - -@@ -155,19 +157,12 @@ - ') - - optional_policy(` -- gen_require(` -- class dbus send_msg; -- ') -- -- allow named_t self:dbus send_msg; -- - init_dbus_chat_script(named_t) - - sysnet_dbus_chat_dhcpc(named_t) - - dbus_system_bus_client_template(named,named_t) - dbus_connect_system_bus(named_t) -- dbus_send_system_bus(named_t) - - optional_policy(` - networkmanager_dbus_chat(named_t) -@@ -175,6 +170,10 @@ +@@ -175,6 +177,10 @@ ') optional_policy(` @@ -8101,7 +7077,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind # this seems like fds that arent being # closed. these should probably be # dontaudits instead. -@@ -184,14 +183,6 @@ +@@ -184,14 +190,6 @@ ') optional_policy(` @@ -8116,35 +7092,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind seutil_sigchld_newrole(named_t) ') -@@ -232,15 +223,16 @@ +@@ -232,6 +230,7 @@ corenet_tcp_sendrecv_all_nodes(ndc_t) corenet_tcp_sendrecv_all_ports(ndc_t) corenet_tcp_connect_rndc_port(ndc_t) +corenet_tcp_bind_all_nodes(ndc_t) corenet_sendrecv_rndc_client_packets(ndc_t) --fs_getattr_xattr_fs(ndc_t) -- - domain_use_interactive_fds(ndc_t) - - files_read_etc_files(ndc_t) - files_search_pids(ndc_t) - -+fs_getattr_xattr_fs(ndc_t) -+ - init_use_fds(ndc_t) - init_use_script_ptys(ndc_t) - + fs_getattr_xattr_fs(ndc_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitlbee.fc serefpolicy-3.0.8/policy/modules/services/bitlbee.fc --- nsaserefpolicy/policy/modules/services/bitlbee.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/bitlbee.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/bitlbee.fc 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,3 @@ +/usr/sbin/bitlbee -- gen_context(system_u:object_r:bitlbee_exec_t,s0) +/etc/bitlbee(/.*)? gen_context(system_u:object_r:bitlbee_conf_t,s0) +/var/lib/bitlbee(/.*)? gen_context(system_u:object_r:bitlbee_var_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitlbee.if serefpolicy-3.0.8/policy/modules/services/bitlbee.if --- nsaserefpolicy/policy/modules/services/bitlbee.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/bitlbee.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/bitlbee.if 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,22 @@ +## Bitlbee service + @@ -8170,8 +7135,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitl + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitlbee.te serefpolicy-3.0.8/policy/modules/services/bitlbee.te --- nsaserefpolicy/policy/modules/services/bitlbee.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/bitlbee.te 2008-04-04 16:11:03.000000000 -0400 -@@ -0,0 +1,77 @@ ++++ serefpolicy-3.0.8/policy/modules/services/bitlbee.te 2007-12-18 09:56:09.000000000 -0500 +@@ -0,0 +1,73 @@ + +policy_module(bitlbee, 1.0.0) + @@ -8227,8 +7192,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitl +# and to MSNP (MSN Messenger) servers: +corenet_tcp_connect_msnp_port(bitlbee_t) +corenet_tcp_sendrecv_msnp_port(bitlbee_t) -+corenet_tcp_connect_http_port(bitlbee_t) -+corenet_tcp_sendrecv_http_port(bitlbee_t) + +dev_read_rand(bitlbee_t) +dev_read_urand(bitlbee_t) @@ -8241,8 +7204,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitl +libs_legacy_use_shared_libs(bitlbee_t) +libs_use_ld_so(bitlbee_t) + -+miscfiles_read_localization(bitlbee_t) -+ +sysnet_dns_name_resolve(bitlbee_t) + +optional_policy(` @@ -8251,7 +7212,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bitl +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.fc serefpolicy-3.0.8/policy/modules/services/bluetooth.fc --- nsaserefpolicy/policy/modules/services/bluetooth.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/bluetooth.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/bluetooth.fc 2007-12-02 21:15:34.000000000 -0500 @@ -22,3 +22,4 @@ # /var/lib/bluetooth(/.*)? gen_context(system_u:object_r:bluetooth_var_lib_t,s0) @@ -8259,16 +7220,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue +/var/run/bluetoothd_address gen_context(system_u:object_r:bluetooth_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.0.8/policy/modules/services/bluetooth.te --- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/bluetooth.te 2008-04-04 16:11:03.000000000 -0400 -@@ -37,14 +37,14 @@ - # Bluetooth services local policy - # - --allow bluetooth_t self:capability { net_bind_service net_admin net_raw sys_tty_config ipc_lock }; -+allow bluetooth_t self:capability { dac_override net_bind_service net_admin net_raw sys_tty_config ipc_lock }; - dontaudit bluetooth_t self:capability sys_tty_config; - allow bluetooth_t self:process { getsched signal_perms }; - allow bluetooth_t self:fifo_file rw_fifo_file_perms; ++++ serefpolicy-3.0.8/policy/modules/services/bluetooth.te 2007-12-02 21:15:34.000000000 -0500 +@@ -44,7 +44,7 @@ allow bluetooth_t self:shm create_shm_perms; allow bluetooth_t self:socket create_stream_socket_perms; allow bluetooth_t self:unix_dgram_socket create_socket_perms; @@ -8277,37 +7230,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue allow bluetooth_t self:tcp_socket create_stream_socket_perms; allow bluetooth_t self:udp_socket create_socket_perms; -@@ -110,6 +110,8 @@ - files_read_etc_runtime_files(bluetooth_t) - files_read_usr_files(bluetooth_t) - -+auth_use_nsswitch(bluetooth_t) -+ - libs_use_ld_so(bluetooth_t) - libs_use_shared_libs(bluetooth_t) - -@@ -118,20 +120,20 @@ - miscfiles_read_localization(bluetooth_t) - miscfiles_read_fonts(bluetooth_t) - --sysnet_read_config(bluetooth_t) -- - userdom_dontaudit_use_unpriv_user_fds(bluetooth_t) - userdom_dontaudit_use_sysadm_ptys(bluetooth_t) - userdom_dontaudit_search_sysadm_home_dirs(bluetooth_t) - - optional_policy(` -- dbus_system_bus_client_template(bluetooth,bluetooth_t) -- dbus_connect_system_bus(bluetooth_t) -- dbus_send_system_bus(bluetooth_t) -+ cups_dbus_chat(bluetooth_t) - ') - - optional_policy(` -- nis_use_ypbind(bluetooth_t) -+ dbus_system_bus_client_template(bluetooth,bluetooth_t) -+ dbus_connect_system_bus(bluetooth_t) -+ dbus_send_system_bus(bluetooth_t) +@@ -128,6 +128,8 @@ + dbus_system_bus_client_template(bluetooth,bluetooth_t) + dbus_connect_system_bus(bluetooth_t) + dbus_send_system_bus(bluetooth_t) + allow bluetooth_t self:dbus send_msg; + dbus_system_domain(bluetooth_t,bluetooth_exec_t) ') @@ -8315,7 +7241,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.fc serefpolicy-3.0.8/policy/modules/services/clamav.fc --- nsaserefpolicy/policy/modules/services/clamav.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/clamav.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/clamav.fc 2007-12-31 09:05:48.000000000 -0500 @@ -5,16 +5,18 @@ /usr/bin/freshclam -- gen_context(system_u:object_r:freshclam_exec_t,s0) @@ -8337,63 +7263,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam +/var/log/clamd.* gen_context(system_u:object_r:clamd_var_log_t,s0) /var/spool/amavisd/clamd\.sock -s gen_context(system_u:object_r:clamd_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.if serefpolicy-3.0.8/policy/modules/services/clamav.if ---- nsaserefpolicy/policy/modules/services/clamav.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/clamav.if 2008-04-04 16:11:03.000000000 -0400 -@@ -38,6 +38,27 @@ - - ######################################## - ## -+## Allow the specified domain to append -+## to clamav log files. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`clamav_append_log',` -+ gen_require(` -+ type clamav_log_t; -+ ') -+ -+ logging_search_logs($1) -+ allow $1 clamav_log_t:dir list_dir_perms; -+ append_files_pattern($1,clamav_log_t,clamav_log_t) -+') -+ -+######################################## -+## - ## Read clamav configuration files. - ## - ## -@@ -91,3 +112,22 @@ - - domtrans_pattern($1,clamscan_exec_t,clamscan_t) - ') -+ -+######################################## -+## -+## Execute clamscan without a transition. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`clamav_exec_clamscan',` -+ gen_require(` -+ type clamscan_exec_t; -+ ') -+ -+ can_exec($1,clamscan_exec_t) -+ -+') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.0.8/policy/modules/services/clamav.te --- nsaserefpolicy/policy/modules/services/clamav.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/clamav.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/clamav.te 2007-12-02 21:15:34.000000000 -0500 @@ -1,5 +1,5 @@ -policy_module(clamav,1.4.1) @@ -8401,27 +7273,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam ######################################## # -@@ -87,6 +87,9 @@ +@@ -87,6 +87,7 @@ kernel_dontaudit_list_proc(clamd_t) kernel_read_sysctl(clamd_t) kernel_read_kernel_sysctls(clamd_t) +kernel_read_system_state(clamd_t) -+ -+corecmd_exec_shell(clamd_t) corenet_all_recvfrom_unlabeled(clamd_t) corenet_all_recvfrom_netlabel(clamd_t) -@@ -120,6 +123,9 @@ +@@ -120,6 +121,8 @@ cron_use_system_job_fds(clamd_t) cron_rw_pipes(clamd_t) +mta_read_config(clamd_t) -+mta_send_mail(clamd_t) + optional_policy(` amavis_read_lib_files(clamd_t) amavis_read_spool_files(clamd_t) -@@ -127,6 +133,10 @@ +@@ -127,6 +130,10 @@ amavis_create_pid_files(clamd_t) ') @@ -8432,7 +7301,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam ######################################## # # Freshclam local policy -@@ -233,3 +243,7 @@ +@@ -233,3 +240,7 @@ optional_policy(` apache_read_sys_content(clamscan_t) ') @@ -8442,7 +7311,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/comsat.te serefpolicy-3.0.8/policy/modules/services/comsat.te --- nsaserefpolicy/policy/modules/services/comsat.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/comsat.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/comsat.te 2007-12-02 21:15:34.000000000 -0500 @@ -60,6 +60,8 @@ init_read_utmp(comsat_t) init_dontaudit_write_utmp(comsat_t) @@ -8474,7 +7343,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/coms -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.if serefpolicy-3.0.8/policy/modules/services/consolekit.if --- nsaserefpolicy/policy/modules/services/consolekit.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/consolekit.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/consolekit.if 2007-12-02 21:15:34.000000000 -0500 @@ -38,3 +38,24 @@ allow $1 consolekit_t:dbus send_msg; allow consolekit_t $1:dbus send_msg; @@ -8502,7 +7371,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.0.8/policy/modules/services/consolekit.te --- nsaserefpolicy/policy/modules/services/consolekit.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/consolekit.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/consolekit.te 2008-01-16 16:21:21.000000000 -0500 @@ -10,7 +10,6 @@ type consolekit_exec_t; init_daemon_domain(consolekit_t, consolekit_exec_t) @@ -8566,13 +7435,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons +') + +optional_policy(` -+ userdom_read_user_tmp_files(user,consolekit_t) ++ userdom_read_user_tmp_files(consolekit_t) ') + + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.0.8/policy/modules/services/courier.te --- nsaserefpolicy/policy/modules/services/courier.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/courier.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/courier.te 2007-12-02 21:15:34.000000000 -0500 @@ -58,6 +58,7 @@ files_getattr_tmp_dirs(courier_authdaemon_t) @@ -8583,7 +7452,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cour diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cpucontrol.te serefpolicy-3.0.8/policy/modules/services/cpucontrol.te --- nsaserefpolicy/policy/modules/services/cpucontrol.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cpucontrol.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/cpucontrol.te 2007-12-02 21:15:34.000000000 -0500 @@ -63,6 +63,10 @@ ') @@ -8597,7 +7466,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cpuc diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.0.8/policy/modules/services/cron.fc --- nsaserefpolicy/policy/modules/services/cron.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cron.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/cron.fc 2007-12-02 21:15:34.000000000 -0500 @@ -17,6 +17,8 @@ /var/run/fcron\.fifo -s gen_context(system_u:object_r:crond_var_run_t,s0) /var/run/fcron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0) @@ -8614,7 +7483,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron +/var/lib/misc(/.*)? gen_context(system_u:object_r:system_crond_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.0.8/policy/modules/services/cron.if --- nsaserefpolicy/policy/modules/services/cron.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cron.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/cron.if 2007-12-02 21:15:34.000000000 -0500 @@ -35,6 +35,7 @@ # template(`cron_per_role_template',` @@ -8772,23 +7641,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.0.8/policy/modules/services/cron.te --- nsaserefpolicy/policy/modules/services/cron.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cron.te 2008-04-04 16:11:03.000000000 -0400 -@@ -12,14 +12,6 @@ - - ## - ##

--## Allow system cron jobs to relabel filesystem --## for restoring file contexts. --##

--## --gen_tunable(cron_can_relabel,false) -- --## --##

- ## Enable extra rules in the cron domain - ## to support fcron. - ##

-@@ -50,6 +42,7 @@ ++++ serefpolicy-3.0.8/policy/modules/services/cron.te 2007-12-27 07:19:45.000000000 -0500 +@@ -50,6 +50,7 @@ type crond_tmp_t; files_tmp_file(crond_tmp_t) @@ -8796,7 +7650,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron type crond_var_run_t; files_pid_file(crond_var_run_t) -@@ -71,6 +64,12 @@ +@@ -71,6 +72,12 @@ type system_crond_tmp_t; files_tmp_file(system_crond_tmp_t) @@ -8809,7 +7663,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ifdef(`enable_mcs',` init_ranged_daemon_domain(crond_t,crond_exec_t,s0 - mcs_systemhigh) ') -@@ -80,7 +79,7 @@ +@@ -80,7 +87,7 @@ # Cron Local policy # @@ -8818,7 +7672,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron dontaudit crond_t self:capability { sys_resource sys_tty_config }; allow crond_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow crond_t self:process { setexec setfscreate }; -@@ -99,18 +98,20 @@ +@@ -99,18 +106,20 @@ allow crond_t crond_var_run_t:file manage_file_perms; files_pid_filetrans(crond_t,crond_var_run_t,file) @@ -8843,7 +7697,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron dev_read_sysfs(crond_t) selinux_get_fs_mount(crond_t) -@@ -127,6 +128,8 @@ +@@ -127,6 +136,8 @@ # need auth_chkpwd to check for locked accounts. auth_domtrans_chk_passwd(crond_t) @@ -8852,7 +7706,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron corecmd_exec_shell(crond_t) corecmd_list_bin(crond_t) -@@ -142,11 +145,14 @@ +@@ -142,11 +153,14 @@ files_search_default(crond_t) init_rw_utmp(crond_t) @@ -8867,7 +7721,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron seutil_read_config(crond_t) seutil_read_default_contexts(crond_t) -@@ -160,6 +166,16 @@ +@@ -160,6 +174,16 @@ mta_send_mail(crond_t) @@ -8884,7 +7738,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ifdef(`distro_debian',` optional_policy(` # Debian logcheck has the home dir set to its cache -@@ -180,29 +196,34 @@ +@@ -180,29 +204,34 @@ locallogin_link_keys(crond_t) ') @@ -8927,7 +7781,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') optional_policy(` -@@ -239,7 +260,6 @@ +@@ -239,7 +268,6 @@ allow system_crond_t cron_var_lib_t:file manage_file_perms; files_var_lib_filetrans(system_crond_t,cron_var_lib_t,file) @@ -8935,7 +7789,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron # The entrypoint interface is not used as this is not # a regular entrypoint. Since crontab files are # not directly executed, crond must ensure that -@@ -249,6 +269,8 @@ +@@ -249,6 +277,8 @@ # for this purpose. allow system_crond_t system_cron_spool_t:file entrypoint; @@ -8944,7 +7798,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron # Permit a transition from the crond_t domain to this domain. # The transition is requested explicitly by the modified crond # via setexeccon. There is no way to set up an automatic -@@ -270,9 +292,16 @@ +@@ -270,9 +300,16 @@ filetrans_pattern(system_crond_t,crond_tmp_t,system_crond_tmp_t,{ file lnk_file }) files_tmp_filetrans(system_crond_t,system_crond_tmp_t,file) @@ -8962,7 +7816,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron kernel_read_kernel_sysctls(system_crond_t) kernel_read_system_state(system_crond_t) -@@ -326,7 +355,7 @@ +@@ -326,7 +363,7 @@ init_read_utmp(system_crond_t) init_dontaudit_rw_utmp(system_crond_t) # prelink tells init to restart it self, we either need to allow or dontaudit @@ -8971,7 +7825,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron libs_use_ld_so(system_crond_t) libs_use_shared_libs(system_crond_t) -@@ -334,6 +363,7 @@ +@@ -334,6 +371,7 @@ libs_exec_ld_so(system_crond_t) logging_read_generic_logs(system_crond_t) @@ -8979,26 +7833,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron logging_send_syslog_msg(system_crond_t) miscfiles_read_localization(system_crond_t) -@@ -349,18 +379,6 @@ - ') - ') - --tunable_policy(`cron_can_relabel',` -- seutil_domtrans_setfiles(system_crond_t) --',` -- selinux_get_fs_mount(system_crond_t) -- selinux_validate_context(system_crond_t) -- selinux_compute_access_vector(system_crond_t) -- selinux_compute_create_context(system_crond_t) -- selinux_compute_relabel_context(system_crond_t) -- selinux_compute_user_contexts(system_crond_t) -- seutil_read_file_contexts(system_crond_t) --') -- - optional_policy(` - # Needed for certwatch - apache_exec_modules(system_crond_t) -@@ -384,6 +402,14 @@ +@@ -384,6 +422,14 @@ ') optional_policy(` @@ -9013,7 +7848,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron mrtg_append_create_logs(system_crond_t) ') -@@ -424,8 +450,7 @@ +@@ -424,8 +470,7 @@ ') optional_policy(` @@ -9023,7 +7858,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') optional_policy(` -@@ -433,15 +458,12 @@ +@@ -433,15 +478,12 @@ ') optional_policy(` @@ -9047,8 +7882,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron -') dnl end TODO diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.8/policy/modules/services/cups.fc --- nsaserefpolicy/policy/modules/services/cups.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cups.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -8,24 +8,28 @@ ++++ serefpolicy-3.0.8/policy/modules/services/cups.fc 2007-12-02 21:15:34.000000000 -0500 +@@ -8,17 +8,15 @@ /etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/printers\.conf.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) @@ -9065,12 +7900,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups -/usr/lib(64)?/cups/backend/.* -- gen_context(system_u:object_r:cupsd_exec_t,s0) -/usr/lib(64)?/cups/daemon/.* -- gen_context(system_u:object_r:cupsd_exec_t,s0) --/usr/lib(64)?/cups/daemon/cups-lpd -- gen_context(system_u:object_r:cupsd_lpd_exec_t,s0) -+/usr/lib/cups/daemon/cups-lpd -- gen_context(system_u:object_r:cupsd_lpd_exec_t,s0) -+/usr/lib64/cups/daemon/cups-lpd -- gen_context(system_u:object_r:cupsd_lpd_exec_t,s0) + /usr/lib(64)?/cups/daemon/cups-lpd -- gen_context(system_u:object_r:cupsd_lpd_exec_t,s0) /usr/libexec/hal_lpadmin -- gen_context(system_u:object_r:cupsd_config_exec_t,s0) - +@@ -26,6 +24,11 @@ /usr/sbin/cupsd -- gen_context(system_u:object_r:cupsd_exec_t,s0) /usr/sbin/hal_lpadmin -- gen_context(system_u:object_r:cupsd_config_exec_t,s0) /usr/sbin/hpiod -- gen_context(system_u:object_r:hplip_exec_t,s0) @@ -9082,7 +7915,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups /usr/sbin/printconf-backend -- gen_context(system_u:object_r:cupsd_config_exec_t,s0) /usr/sbin/ptal-printd -- gen_context(system_u:object_r:ptal_exec_t,s0) /usr/sbin/ptal-mlcd -- gen_context(system_u:object_r:ptal_exec_t,s0) -@@ -33,7 +37,7 @@ +@@ -33,7 +36,7 @@ /usr/share/cups(/.*)? gen_context(system_u:object_r:cupsd_etc_t,s0) /usr/share/foomatic/db/oldprinterids -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) @@ -9091,18 +7924,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups /var/cache/alchemist/printconf.* gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /var/cache/foomatic(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) -@@ -51,4 +55,7 @@ +@@ -51,4 +54,5 @@ /var/run/ptal-printd(/.*)? gen_context(system_u:object_r:ptal_var_run_t,s0) /var/run/ptal-mlcd(/.*)? gen_context(system_u:object_r:ptal_var_run_t,s0) -/var/spool/cups(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh) +/usr/local/Brother/inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) +/usr/local/Printer/[^/]*/inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) -+ -+/usr/local/linuxprinter/ppd(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.if serefpolicy-3.0.8/policy/modules/services/cups.if --- nsaserefpolicy/policy/modules/services/cups.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cups.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/cups.if 2007-12-02 21:15:34.000000000 -0500 @@ -247,3 +247,4 @@ files_search_pids($1) stream_connect_pattern($1,ptal_var_run_t,ptal_var_run_t,ptal_t) @@ -9110,7 +7941,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.8/policy/modules/services/cups.te --- nsaserefpolicy/policy/modules/services/cups.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cups.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/cups.te 2008-01-10 16:16:09.000000000 -0500 @@ -48,9 +48,8 @@ type hplip_t; type hplip_exec_t; @@ -9297,15 +8128,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups fs_getattr_all_fs(cupsd_config_t) fs_search_auto_mountpoints(cupsd_config_t) -@@ -356,6 +383,7 @@ - logging_send_syslog_msg(cupsd_config_t) - - miscfiles_read_localization(cupsd_config_t) -+miscfiles_read_hwdata(cupsd_config_t) - - seutil_dontaudit_search_config(cupsd_config_t) - -@@ -377,6 +405,14 @@ +@@ -377,6 +404,14 @@ ') optional_policy(` @@ -9320,7 +8143,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups cron_system_entry(cupsd_config_t, cupsd_config_exec_t) ') -@@ -393,6 +429,7 @@ +@@ -393,6 +428,7 @@ optional_policy(` hal_domtrans(cupsd_config_t) hal_read_tmp_files(cupsd_config_t) @@ -9328,7 +8151,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups ') optional_policy(` -@@ -482,6 +519,8 @@ +@@ -482,6 +518,8 @@ files_read_etc_files(cupsd_lpd_t) @@ -9337,7 +8160,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups libs_use_ld_so(cupsd_lpd_t) libs_use_shared_libs(cupsd_lpd_t) -@@ -489,22 +528,12 @@ +@@ -489,22 +527,12 @@ miscfiles_read_localization(cupsd_lpd_t) @@ -9360,7 +8183,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups ######################################## # # HPLIP local policy -@@ -522,14 +551,12 @@ +@@ -522,14 +550,12 @@ allow hplip_t self:udp_socket create_socket_perms; allow hplip_t self:rawip_socket create_socket_perms; @@ -9379,7 +8202,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups manage_files_pattern(hplip_t,hplip_var_run_t,hplip_var_run_t) files_pid_filetrans(hplip_t,hplip_var_run_t,file) -@@ -560,7 +587,7 @@ +@@ -560,7 +586,7 @@ dev_read_urand(hplip_t) dev_read_rand(hplip_t) dev_rw_generic_usb_dev(hplip_t) @@ -9388,7 +8211,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups fs_getattr_all_fs(hplip_t) fs_search_auto_mountpoints(hplip_t) -@@ -587,7 +614,7 @@ +@@ -587,7 +613,7 @@ userdom_dontaudit_search_sysadm_home_dirs(hplip_t) userdom_dontaudit_search_all_users_home_content(hplip_t) @@ -9397,7 +8220,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups optional_policy(` seutil_sigchld_newrole(hplip_t) -@@ -668,3 +695,15 @@ +@@ -668,3 +694,15 @@ optional_policy(` udev_read_db(ptal_t) ') @@ -9415,7 +8238,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.0.8/policy/modules/services/cvs.te --- nsaserefpolicy/policy/modules/services/cvs.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cvs.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/cvs.te 2007-12-02 21:15:34.000000000 -0500 @@ -16,6 +16,7 @@ type cvs_t; type cvs_exec_t; @@ -9442,7 +8265,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyrus.te serefpolicy-3.0.8/policy/modules/services/cyrus.te --- nsaserefpolicy/policy/modules/services/cyrus.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cyrus.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/cyrus.te 2007-12-02 21:15:34.000000000 -0500 @@ -1,5 +1,5 @@ -policy_module(cyrus,1.4.0) @@ -9484,7 +8307,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cyru diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbskk.te serefpolicy-3.0.8/policy/modules/services/dbskk.te --- nsaserefpolicy/policy/modules/services/dbskk.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dbskk.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/dbskk.te 2007-12-02 21:15:34.000000000 -0500 @@ -63,6 +63,8 @@ files_read_etc_files(dbskkd_t) @@ -9509,7 +8332,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbsk -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.fc serefpolicy-3.0.8/policy/modules/services/dbus.fc --- nsaserefpolicy/policy/modules/services/dbus.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dbus.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/dbus.fc 2007-12-02 21:15:34.000000000 -0500 @@ -5,6 +5,8 @@ /bin/dbus-daemon -- gen_context(system_u:object_r:system_dbusd_exec_t,s0) /var/run/dbus(/.*)? gen_context(system_u:object_r:system_dbusd_var_run_t,s0) @@ -9521,7 +8344,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.8/policy/modules/services/dbus.if --- nsaserefpolicy/policy/modules/services/dbus.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dbus.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/dbus.if 2008-01-14 14:18:38.000000000 -0500 @@ -50,6 +50,12 @@ ## # @@ -9574,7 +8397,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus libs_use_ld_so($1_dbusd_t) libs_use_shared_libs($1_dbusd_t) -@@ -193,18 +214,24 @@ +@@ -193,6 +214,7 @@ gen_require(` type system_dbusd_t, system_dbusd_t; type system_dbusd_var_run_t; @@ -9582,13 +8405,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus class dbus send_msg; ') -- type $1_dbusd_system_t; -- type_change $2 system_dbusd_t:dbus $1_dbusd_system_t; -+ allow $2 { system_dbusd_t $2 }:dbus send_msg; -+ allow system_dbusd_t $2:dbus send_msg; +@@ -201,10 +223,19 @@ -- # SE-DBus specific permissions -- allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg; + # SE-DBus specific permissions + allow $1_dbusd_system_t { system_dbusd_t self }:dbus send_msg; ++ allow $2 { system_dbusd_t $2 }:dbus send_msg; ++ + read_files_pattern($2,system_dbusd_var_lib_t,system_dbusd_var_lib_t) + files_search_var_lib($2) @@ -9603,7 +8425,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus ') ####################################### -@@ -236,14 +263,16 @@ +@@ -236,14 +267,16 @@ class dbus send_msg; ') @@ -9623,7 +8445,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus ') ######################################## -@@ -271,6 +300,60 @@ +@@ -271,6 +304,60 @@ allow $2 $1_dbusd_t:dbus send_msg; ') @@ -9684,7 +8506,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus ######################################## ## ## Read dbus configuration. -@@ -286,6 +369,7 @@ +@@ -286,6 +373,7 @@ type dbusd_etc_t; ') @@ -9692,7 +8514,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus allow $1 dbusd_etc_t:file read_file_perms; ') -@@ -346,3 +430,57 @@ +@@ -346,3 +434,55 @@ allow $1 system_dbusd_t:dbus *; ') @@ -9746,13 +8568,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus + + domtrans_pattern(system_dbusd_t,$2,$1) + -+ dbus_system_bus_client_template($1,$1) -+ dbus_connect_system_bus($1) +') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.te serefpolicy-3.0.8/policy/modules/services/dbus.te --- nsaserefpolicy/policy/modules/services/dbus.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dbus.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/dbus.te 2007-12-02 21:15:34.000000000 -0500 @@ -23,6 +23,9 @@ type system_dbusd_var_run_t; files_pid_file(system_dbusd_var_run_t) @@ -9772,16 +8592,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus manage_files_pattern(system_dbusd_t,system_dbusd_var_run_t,system_dbusd_var_run_t) manage_sock_files_pattern(system_dbusd_t,system_dbusd_var_run_t,system_dbusd_var_run_t) files_pid_filetrans(system_dbusd_t,system_dbusd_var_run_t,file) -@@ -60,6 +65,8 @@ - - fs_getattr_all_fs(system_dbusd_t) - fs_search_auto_mountpoints(system_dbusd_t) -+fs_list_inotifyfs(system_dbusd_t) -+fs_dontaudit_list_nfs(system_dbusd_t) - - selinux_get_fs_mount(system_dbusd_t) - selinux_validate_context(system_dbusd_t) -@@ -116,9 +123,18 @@ +@@ -116,9 +121,18 @@ ') optional_policy(` @@ -9802,7 +8613,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.if serefpolicy-3.0.8/policy/modules/services/dcc.if --- nsaserefpolicy/policy/modules/services/dcc.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dcc.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/dcc.if 2007-12-13 15:57:40.000000000 -0500 @@ -72,6 +72,24 @@ ######################################## @@ -9830,7 +8641,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc.te serefpolicy-3.0.8/policy/modules/services/dcc.te --- nsaserefpolicy/policy/modules/services/dcc.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dcc.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/dcc.te 2008-01-04 09:46:21.000000000 -0500 @@ -124,7 +124,7 @@ # dcc procmail interface local policy # @@ -9840,15 +8651,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc. allow dcc_client_t self:unix_dgram_socket create_socket_perms; allow dcc_client_t self:udp_socket create_socket_perms; -@@ -141,6 +141,7 @@ - - corenet_all_recvfrom_unlabeled(dcc_client_t) - corenet_all_recvfrom_netlabel(dcc_client_t) -+corenet_udp_bind_all_nodes(dcc_client_t) - corenet_udp_sendrecv_generic_if(dcc_client_t) - corenet_udp_sendrecv_all_nodes(dcc_client_t) - corenet_udp_sendrecv_all_ports(dcc_client_t) -@@ -148,6 +149,10 @@ +@@ -148,6 +148,10 @@ files_read_etc_files(dcc_client_t) files_read_etc_runtime_files(dcc_client_t) @@ -9859,51 +8662,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dcc. libs_use_ld_so(dcc_client_t) libs_use_shared_libs(dcc_client_t) -@@ -155,11 +160,8 @@ - - miscfiles_read_localization(dcc_client_t) - --sysnet_read_config(dcc_client_t) --sysnet_dns_name_resolve(dcc_client_t) -- - optional_policy(` -- nscd_socket_use(dcc_client_t) -+ spamassassin_read_spamd_tmp_files(dcc_client_t) - ') - - ######################################## -@@ -335,6 +337,8 @@ - fs_getattr_all_fs(dccifd_t) - fs_search_auto_mountpoints(dccifd_t) - -+auth_use_nsswitch(dcc_client_t) -+ - libs_use_ld_so(dccifd_t) - libs_use_shared_libs(dccifd_t) - -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.0.8/policy/modules/services/dhcp.te ---- nsaserefpolicy/policy/modules/services/dhcp.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dhcp.te 2008-04-10 11:28:45.000000000 -0400 -@@ -24,7 +24,7 @@ - # Local policy - # - --allow dhcpd_t self:capability net_raw; -+allow dhcpd_t self:capability { sys_resource net_raw }; - dontaudit dhcpd_t self:capability { net_admin sys_tty_config }; - allow dhcpd_t self:process signal_perms; - allow dhcpd_t self:fifo_file { read write getattr }; -@@ -51,6 +51,7 @@ - - kernel_read_system_state(dhcpd_t) - kernel_read_kernel_sysctls(dhcpd_t) -+kernel_read_network_state(dhcpd_t) - - corenet_all_recvfrom_unlabeled(dhcpd_t) - corenet_all_recvfrom_netlabel(dhcpd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dictd.fc serefpolicy-3.0.8/policy/modules/services/dictd.fc --- nsaserefpolicy/policy/modules/services/dictd.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dictd.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/dictd.fc 2007-12-02 21:15:34.000000000 -0500 @@ -4,3 +4,4 @@ /usr/sbin/dictd -- gen_context(system_u:object_r:dictd_exec_t,s0) @@ -9911,7 +8672,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dict +/var/run/dictd\.pid -- gen_context(system_u:object_r:dictd_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dictd.te serefpolicy-3.0.8/policy/modules/services/dictd.te --- nsaserefpolicy/policy/modules/services/dictd.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dictd.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/dictd.te 2007-12-02 21:15:34.000000000 -0500 @@ -16,6 +16,9 @@ type dictd_var_lib_t alias var_lib_dictd_t; files_type(dictd_var_lib_t) @@ -9932,38 +8693,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dict kernel_read_system_state(dictd_t) kernel_read_kernel_sysctls(dictd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.fc serefpolicy-3.0.8/policy/modules/services/dnsmasq.fc ---- nsaserefpolicy/policy/modules/services/dnsmasq.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dnsmasq.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -1,4 +1,5 @@ - /usr/sbin/dnsmasq -- gen_context(system_u:object_r:dnsmasq_exec_t,s0) - - /var/lib/misc/dnsmasq\.leases -- gen_context(system_u:object_r:dnsmasq_lease_t,s0) -+/var/lib/dnsmasq(/.*)? gen_context(system_u:object_r:dnsmasq_lease_t,s0) - /var/run/dnsmasq\.pid -- gen_context(system_u:object_r:dnsmasq_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsmasq.te serefpolicy-3.0.8/policy/modules/services/dnsmasq.te --- nsaserefpolicy/policy/modules/services/dnsmasq.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dnsmasq.te 2008-04-04 16:11:03.000000000 -0400 -@@ -16,6 +16,9 @@ - type dnsmasq_var_run_t; - files_pid_file(dnsmasq_var_run_t) - -+type dnsmasq_script_exec_t; -+init_script_type(dnsmasq_script_exec_t) -+ - ######################################## - # - # Local policy -@@ -32,7 +35,7 @@ - allow dnsmasq_t self:rawip_socket create_socket_perms; - - # dhcp leases --allow dnsmasq_t dnsmasq_lease_t:file manage_file_perms; -+manage_files_pattern(dnsmasq_t, dnsmasq_lease_t, dnsmasq_lease_t) - files_var_lib_filetrans(dnsmasq_t,dnsmasq_lease_t,file) - - manage_files_pattern(dnsmasq_t,dnsmasq_var_run_t,dnsmasq_var_run_t) -@@ -94,3 +97,7 @@ ++++ serefpolicy-3.0.8/policy/modules/services/dnsmasq.te 2007-12-02 21:15:34.000000000 -0500 +@@ -94,3 +94,7 @@ optional_policy(` udev_read_db(dnsmasq_t) ') @@ -9973,7 +8706,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dnsm +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.0.8/policy/modules/services/dovecot.fc --- nsaserefpolicy/policy/modules/services/dovecot.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dovecot.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/dovecot.fc 2007-12-02 21:15:34.000000000 -0500 @@ -17,19 +17,24 @@ ifdef(`distro_debian', ` @@ -10001,7 +8734,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.0.8/policy/modules/services/dovecot.if --- nsaserefpolicy/policy/modules/services/dovecot.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dovecot.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/dovecot.if 2007-12-06 11:01:54.000000000 -0500 @@ -18,3 +18,43 @@ manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t) manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t) @@ -10048,7 +8781,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.0.8/policy/modules/services/dovecot.te --- nsaserefpolicy/policy/modules/services/dovecot.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dovecot.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/dovecot.te 2007-12-06 20:33:21.000000000 -0500 @@ -15,6 +15,12 @@ domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t) role system_r types dovecot_auth_t; @@ -10174,7 +8907,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove files_read_usr_symlinks(dovecot_auth_t) files_search_tmp(dovecot_auth_t) files_read_var_lib_files(dovecot_t) -@@ -185,12 +198,57 @@ +@@ -185,12 +198,54 @@ seutil_dontaudit_search_config(dovecot_auth_t) @@ -10197,7 +8930,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove +optional_policy(` + postfix_manage_pivate_sockets(dovecot_auth_t) + postfix_search_spool(dovecot_auth_t) -+') + ') + +# for gssapi (kerberos) +userdom_list_unpriv_users_tmp(dovecot_auth_t) @@ -10216,11 +8949,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove +kernel_read_all_sysctls(dovecot_deliver_t) +kernel_read_system_state(dovecot_deliver_t) + ++dovecot_auth_stream_connect(dovecot_deliver_t) ++ +files_read_etc_files(dovecot_deliver_t) +files_read_etc_runtime_files(dovecot_deliver_t) + -+auth_use_nsswitch(dovecot_deliver_t) -+ +libs_use_ld_so(dovecot_deliver_t) +libs_use_shared_libs(dovecot_deliver_t) + @@ -10228,16 +8961,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + +miscfiles_read_localization(dovecot_deliver_t) + -+dovecot_auth_stream_connect(dovecot_deliver_t) -+ -+userdom_priveleged_home_dir_manager(dovecot_deliver_t) -+ +optional_policy(` + mta_manage_spool(dovecot_deliver_t) - ') ++') ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.fc serefpolicy-3.0.8/policy/modules/services/exim.fc --- nsaserefpolicy/policy/modules/services/exim.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/exim.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/exim.fc 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,5 @@ + +/usr/sbin/exim -- gen_context(system_u:object_r:exim_exec_t,s0) @@ -10246,7 +8976,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim +/var/spool/exim(/.*)? gen_context(system_u:object_r:exim_spool_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.if serefpolicy-3.0.8/policy/modules/services/exim.if --- nsaserefpolicy/policy/modules/services/exim.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/exim.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/exim.if 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,177 @@ +## Exim mail transfer agent + @@ -10427,7 +9157,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim.te serefpolicy-3.0.8/policy/modules/services/exim.te --- nsaserefpolicy/policy/modules/services/exim.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/exim.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/exim.te 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,214 @@ + +policy_module(exim,1.0.0) @@ -10645,89 +9375,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.fc serefpolicy-3.0.8/policy/modules/services/fail2ban.fc --- nsaserefpolicy/policy/modules/services/fail2ban.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/fail2ban.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -1,3 +1,5 @@ - /usr/bin/fail2ban -- gen_context(system_u:object_r:fail2ban_exec_t,s0) --/var/log/fail2ban.log -- gen_context(system_u:object_r:fail2ban_log_t,s0) --/var/run/fail2ban.pid -- gen_context(system_u:object_r:fail2ban_var_run_t,s0) ++++ serefpolicy-3.0.8/policy/modules/services/fail2ban.fc 2008-01-08 13:31:58.000000000 -0500 +@@ -1,3 +1,4 @@ +/usr/bin/fail2ban-server -- gen_context(system_u:object_r:fail2ban_exec_t,s0) -+/var/log/fail2ban\.log -- gen_context(system_u:object_r:fail2ban_log_t,s0) -+/var/run/fail2ban\.pid -- gen_context(system_u:object_r:fail2ban_var_run_t,s0) -+/var/run/fail2ban\.sock -s gen_context(system_u:object_r:fail2ban_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fail2ban.te serefpolicy-3.0.8/policy/modules/services/fail2ban.te ---- nsaserefpolicy/policy/modules/services/fail2ban.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/fail2ban.te 2008-04-21 16:05:47.948344000 -0400 -@@ -1,5 +1,5 @@ - --policy_module(fail2ban,1.0.0) -+policy_module(fail2ban,1.1.0) - - ######################################## - # -@@ -25,7 +25,7 @@ - - allow fail2ban_t self:process signal; - allow fail2ban_t self:fifo_file rw_fifo_file_perms; --allow fail2ban_t self:unix_stream_socket create_stream_socket_perms; -+allow fail2ban_t self:unix_stream_socket { connectto create_stream_socket_perms }; - - # log files - allow fail2ban_t fail2ban_log_t:dir setattr; -@@ -33,8 +33,9 @@ - logging_log_filetrans(fail2ban_t,fail2ban_log_t,file) - - # pid file -+manage_sock_files_pattern(fail2ban_t,fail2ban_var_run_t,fail2ban_var_run_t) - manage_files_pattern(fail2ban_t,fail2ban_var_run_t,fail2ban_var_run_t) --files_pid_filetrans(fail2ban_t,fail2ban_var_run_t, file) -+files_pid_filetrans(fail2ban_t,fail2ban_var_run_t, { file sock_file }) - - kernel_read_system_state(fail2ban_t) - -@@ -46,15 +47,26 @@ - domain_use_interactive_fds(fail2ban_t) - - files_read_etc_files(fail2ban_t) -+files_read_etc_runtime_files(fail2ban_t) - files_read_usr_files(fail2ban_t) -+files_list_var(fail2ban_t) -+files_search_var_lib(fail2ban_t) -+ -+fs_list_inotifyfs(fail2ban_t) -+fs_getattr_all_fs(fail2ban_t) -+ -+auth_use_nsswitch(fail2ban_t) -+corenet_tcp_connect_whois_port(fail2ban_t) - - libs_use_ld_so(fail2ban_t) - libs_use_shared_libs(fail2ban_t) - --logging_read_generic_logs(fail2ban_t) -+logging_read_all_logs(fail2ban_t) - - miscfiles_read_localization(fail2ban_t) - -+mta_send_mail(fail2ban_t) -+ - optional_policy(` - apache_read_log(fail2ban_t) - ') -@@ -64,5 +76,11 @@ - ') - - optional_policy(` -+ gamin_domtrans(fail2ban_t) -+ gamin_stream_connect(fail2ban_t) -+') -+ -+optional_policy(` - iptables_domtrans(fail2ban_t) - ') -+ + /usr/bin/fail2ban -- gen_context(system_u:object_r:fail2ban_exec_t,s0) + /var/log/fail2ban.log -- gen_context(system_u:object_r:fail2ban_log_t,s0) + /var/run/fail2ban.pid -- gen_context(system_u:object_r:fail2ban_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetchmail.te serefpolicy-3.0.8/policy/modules/services/fetchmail.te --- nsaserefpolicy/policy/modules/services/fetchmail.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/fetchmail.te 2008-04-06 06:17:08.000000000 -0400 -@@ -86,6 +86,14 @@ ++++ serefpolicy-3.0.8/policy/modules/services/fetchmail.te 2007-12-02 21:15:34.000000000 -0500 +@@ -86,6 +86,10 @@ userdom_dontaudit_search_sysadm_home_dirs(fetchmail_t) optional_policy(` @@ -10735,16 +9392,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/fetc +') + +optional_policy(` -+ sendmail_manage_log(fetchmail_t) -+') -+ -+optional_policy(` seutil_sigchld_newrole(fetchmail_t) ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.if serefpolicy-3.0.8/policy/modules/services/ftp.if --- nsaserefpolicy/policy/modules/services/ftp.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ftp.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ftp.if 2007-12-02 21:15:34.000000000 -0500 @@ -28,11 +28,13 @@ type ftpd_t; ') @@ -10766,7 +9419,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.8/policy/modules/services/ftp.te --- nsaserefpolicy/policy/modules/services/ftp.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ftp.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ftp.te 2007-12-02 21:15:34.000000000 -0500 @@ -88,6 +88,7 @@ allow ftpd_t self:unix_stream_socket create_stream_socket_perms; allow ftpd_t self:tcp_socket create_stream_socket_perms; @@ -10836,129 +9489,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gamin.fc serefpolicy-3.0.8/policy/modules/services/gamin.fc ---- nsaserefpolicy/policy/modules/services/gamin.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/gamin.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -0,0 +1,2 @@ -+ -+/usr/libexec/gam_server -- gen_context(system_u:object_r:gamin_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gamin.if serefpolicy-3.0.8/policy/modules/services/gamin.if ---- nsaserefpolicy/policy/modules/services/gamin.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/gamin.if 2008-04-04 16:11:03.000000000 -0400 -@@ -0,0 +1,39 @@ -+ -+## policy for gamin -+ -+######################################## -+## -+## Execute a domain transition to run gamin. -+## -+## -+## -+## Domain allowed to transition. -+## -+## -+# -+interface(`gamin_domtrans',` -+ gen_require(` -+ type gamin_t; -+ type gamin_exec_t; -+ ') -+ -+ domtrans_pattern($1,gamin_exec_t,gamin_t) -+') -+ -+######################################## -+## -+## Connect to gamin over an unix stream socket. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`gamin_stream_connect',` -+ gen_require(` -+ type gamin_t; -+ ') -+ -+ allow $1 gamin_t:unix_stream_socket connectto; -+') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gamin.te serefpolicy-3.0.8/policy/modules/services/gamin.te ---- nsaserefpolicy/policy/modules/services/gamin.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/gamin.te 2008-04-04 16:11:03.000000000 -0400 -@@ -0,0 +1,38 @@ -+policy_module(gamin,1.0.0) -+ -+######################################## -+# -+# Declarations -+# -+ -+type gamin_t; -+type gamin_exec_t; -+init_daemon_domain(gamin_t, gamin_exec_t) -+ -+######################################## -+# -+# gamin local policy -+# -+ -+# Init script handling -+domain_use_interactive_fds(gamin_t) -+ -+# internal communication is often done using fifo and unix sockets. -+allow gamin_t self:fifo_file rw_file_perms; -+allow gamin_t self:unix_stream_socket create_stream_socket_perms; -+ -+files_read_etc_files(gamin_t) -+files_read_etc_runtime_files(gamin_t) -+files_list_all(gamin_t) -+files_getattr_all_files(gamin_t) -+ -+fs_list_inotifyfs(gamin_t) -+domain_read_all_domains_state(gamin_t) -+ -+libs_use_ld_so(gamin_t) -+libs_use_shared_libs(gamin_t) -+ -+miscfiles_read_localization(gamin_t) -+ -+role unconfined_r types gamin_t; -+ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.8/policy/modules/services/hal.fc ---- nsaserefpolicy/policy/modules/services/hal.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/hal.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -8,14 +8,18 @@ - /usr/libexec/hal-hotplug-map -- gen_context(system_u:object_r:hald_exec_t,s0) - /usr/libexec/hal-system-sonypic -- gen_context(system_u:object_r:hald_sonypic_exec_t,s0) - /usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0) -+/usr/libexec/hald-addon-macbook-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0) - - /usr/sbin/hald -- gen_context(system_u:object_r:hald_exec_t,s0) - - /var/cache/hald(/.*)? gen_context(system_u:object_r:hald_cache_t,s0) - -+/var/lib/PolicyKit(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0) - /var/lib/hal(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0) - - /var/log/pm-suspend.log gen_context(system_u:object_r:hald_log_t,s0) -+/var/log/pm(/.*)? gen_context(system_u:object_r:hald_log_t,s0) - -+/var/run/pm(/.*)? gen_context(system_u:object_r:hald_var_run_t,s0) - /var/run/haldaemon.pid -- gen_context(system_u:object_r:hald_var_run_t,s0) --/var/run/vbestate -- gen_context(system_u:object_r:hald_var_run_t,s0) -+/var/run/vbe.* -- gen_context(system_u:object_r:hald_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.8/policy/modules/services/hal.te ---- nsaserefpolicy/policy/modules/services/hal.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/hal.te 2008-04-04 16:11:03.000000000 -0400 -@@ -49,6 +49,9 @@ - type hald_var_lib_t; - files_type(hald_var_lib_t) - -+typealias hald_log_t alias pmtools_log_t; -+typealias hald_var_run_t alias pmtools_var_run_t; +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.8/policy/modules/services/hal.fc +--- nsaserefpolicy/policy/modules/services/hal.fc 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/hal.fc 2007-12-02 21:15:34.000000000 -0500 +@@ -8,14 +8,18 @@ + /usr/libexec/hal-hotplug-map -- gen_context(system_u:object_r:hald_exec_t,s0) + /usr/libexec/hal-system-sonypic -- gen_context(system_u:object_r:hald_sonypic_exec_t,s0) + /usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0) ++/usr/libexec/hald-addon-macbook-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0) + + /usr/sbin/hald -- gen_context(system_u:object_r:hald_exec_t,s0) + + /var/cache/hald(/.*)? gen_context(system_u:object_r:hald_cache_t,s0) + ++/var/lib/PolicyKit(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0) + /var/lib/hal(/.*)? gen_context(system_u:object_r:hald_var_lib_t,s0) + + /var/log/pm-suspend.log gen_context(system_u:object_r:hald_log_t,s0) ++/var/log/pm(/.*)? gen_context(system_u:object_r:hald_log_t,s0) + ++/var/run/pm(/.*)? gen_context(system_u:object_r:hald_var_run_t,s0) + /var/run/haldaemon.pid -- gen_context(system_u:object_r:hald_var_run_t,s0) +-/var/run/vbestate -- gen_context(system_u:object_r:hald_var_run_t,s0) ++/var/run/vbe.* -- gen_context(system_u:object_r:hald_var_run_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.8/policy/modules/services/hal.te +--- nsaserefpolicy/policy/modules/services/hal.te 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/hal.te 2007-12-02 21:15:34.000000000 -0500 +@@ -49,6 +49,9 @@ + type hald_var_lib_t; + files_type(hald_var_lib_t) + ++typealias hald_log_t alias pmtools_log_t; ++typealias hald_var_run_t alias pmtools_var_run_t; + ######################################## # @@ -10980,15 +9542,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. auth_read_pam_console_data(hald_t) -@@ -145,6 +149,7 @@ - fs_list_inotifyfs(hald_t) - fs_list_auto_mountpoints(hald_t) - files_getattr_all_mountpoints(hald_t) -+fstools_getattr_swap_files(hald_t) - - mls_file_read_all_levels(hald_t) - -@@ -155,6 +160,8 @@ +@@ -155,6 +159,8 @@ selinux_compute_relabel_context(hald_t) selinux_compute_user_contexts(hald_t) @@ -10997,7 +9551,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. storage_raw_read_removable_device(hald_t) storage_raw_write_removable_device(hald_t) storage_raw_read_fixed_disk(hald_t) -@@ -280,6 +287,10 @@ +@@ -280,6 +286,10 @@ ') optional_policy(` @@ -11008,7 +9562,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. updfstab_domtrans(hald_t) ') -@@ -293,6 +304,7 @@ +@@ -293,6 +303,7 @@ # allow hald_acl_t self:capability { dac_override fowner }; @@ -11016,15 +9570,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. allow hald_acl_t self:fifo_file read_fifo_file_perms; domtrans_pattern(hald_t, hald_acl_exec_t, hald_acl_t) -@@ -306,6 +318,7 @@ - corecmd_exec_bin(hald_acl_t) - - dev_getattr_all_chr_files(hald_acl_t) -+dev_setattr_all_chr_files(hald_acl_t) - dev_getattr_generic_usb_dev(hald_acl_t) - dev_getattr_video_dev(hald_acl_t) - dev_setattr_video_dev(hald_acl_t) -@@ -340,10 +353,14 @@ +@@ -340,10 +351,14 @@ manage_files_pattern(hald_mac_t,hald_var_lib_t,hald_var_lib_t) files_search_var_lib(hald_mac_t) @@ -11039,23 +9585,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. libs_use_ld_so(hald_mac_t) libs_use_shared_libs(hald_mac_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.if serefpolicy-3.0.8/policy/modules/services/inetd.if ---- nsaserefpolicy/policy/modules/services/inetd.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/inetd.if 2008-04-04 16:11:03.000000000 -0400 -@@ -115,6 +115,10 @@ - - allow $1 inetd_t:tcp_socket rw_stream_socket_perms; - allow $1 inetd_t:udp_socket rw_socket_perms; -+ -+ optional_policy(` -+ stunnel_service_domain($1,$2) -+ ') - ') - - ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.8/policy/modules/services/inetd.te --- nsaserefpolicy/policy/modules/services/inetd.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/inetd.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/inetd.te 2007-12-02 21:15:34.000000000 -0500 @@ -30,6 +30,10 @@ type inetd_child_var_run_t; files_pid_file(inetd_child_var_run_t) @@ -11173,7 +9705,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.fc serefpolicy-3.0.8/policy/modules/services/kerberos.fc --- nsaserefpolicy/policy/modules/services/kerberos.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/kerberos.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/kerberos.fc 2007-12-02 21:15:34.000000000 -0500 @@ -16,3 +16,4 @@ /var/log/krb5kdc\.log gen_context(system_u:object_r:krb5kdc_log_t,s0) @@ -11181,15 +9713,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb +/var/tmp/host_0 -- gen_context(system_u:object_r:krb5_host_rcache_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.if serefpolicy-3.0.8/policy/modules/services/kerberos.if --- nsaserefpolicy/policy/modules/services/kerberos.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/kerberos.if 2008-04-15 15:34:14.000000000 -0400 -@@ -42,11 +42,18 @@ ++++ serefpolicy-3.0.8/policy/modules/services/kerberos.if 2007-12-02 21:15:34.000000000 -0500 +@@ -42,11 +42,17 @@ dontaudit $1 krb5_conf_t:file write; dontaudit $1 krb5kdc_conf_t:dir list_dir_perms; dontaudit $1 krb5kdc_conf_t:file rw_file_perms; + + #kerberos libraries are attempting to set the correct file context + dontaudit $1 self:process setfscreate; -+ selinux_dontaudit_validate_context($1) + seutil_dontaudit_read_file_contexts($1) tunable_policy(`allow_kerberos',` @@ -11201,7 +9732,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb corenet_all_recvfrom_unlabeled($1) corenet_all_recvfrom_netlabel($1) corenet_tcp_sendrecv_all_if($1) -@@ -61,9 +68,6 @@ +@@ -61,9 +67,6 @@ corenet_tcp_connect_ocsp_port($1) corenet_sendrecv_kerberos_client_packets($1) corenet_sendrecv_ocsp_client_packets($1) @@ -11211,13 +9742,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb ') optional_policy(` -@@ -169,6 +173,53 @@ - ') +@@ -172,3 +175,51 @@ + allow $1 krb5kdc_conf_t:file read_file_perms; - files_search_etc($1) -- allow $1 krb5kdc_conf_t:file read_file_perms; -+ read_files_pattern($1, krb5kdc_conf_t, krb5kdc_conf_t) -+') + ') + +######################################## +## @@ -11245,7 +9773,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb + # creates files as system_u no matter what the selinux user + domain_obj_id_change_exemption($1) +') - ++ +######################################## +## +## Connect to krb524 service @@ -11265,10 +9793,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb + corenet_udp_sendrecv_kerberos_master_port($1) + corenet_udp_bind_all_nodes($1) + ') - ') ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.0.8/policy/modules/services/kerberos.te --- nsaserefpolicy/policy/modules/services/kerberos.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/kerberos.te 2008-04-15 15:35:49.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/kerberos.te 2007-12-02 21:15:34.000000000 -0500 @@ -54,6 +54,9 @@ type krb5kdc_var_run_t; files_pid_file(krb5kdc_var_run_t) @@ -11296,13 +9824,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb corenet_all_recvfrom_unlabeled(kadmind_t) corenet_all_recvfrom_netlabel(kadmind_t) -@@ -115,9 +119,15 @@ - fs_getattr_all_fs(kadmind_t) - fs_search_auto_mountpoints(kadmind_t) - -+selinux_validate_context(kadmind_t) -+seutil_read_file_contexts(kadmind_t) -+ +@@ -118,6 +122,9 @@ domain_use_interactive_fds(kadmind_t) files_read_etc_files(kadmind_t) @@ -11312,7 +9834,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb libs_use_ld_so(kadmind_t) libs_use_shared_libs(kadmind_t) -@@ -127,6 +137,7 @@ +@@ -127,6 +134,7 @@ miscfiles_read_localization(kadmind_t) sysnet_read_config(kadmind_t) @@ -11320,7 +9842,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb userdom_dontaudit_use_unpriv_user_fds(kadmind_t) userdom_dontaudit_search_sysadm_home_dirs(kadmind_t) -@@ -137,6 +148,7 @@ +@@ -137,6 +145,7 @@ optional_policy(` seutil_sigchld_newrole(kadmind_t) @@ -11328,7 +9850,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb ') optional_policy(` -@@ -151,7 +163,7 @@ +@@ -151,7 +160,7 @@ # Use capabilities. Surplus capabilities may be allowed. allow krb5kdc_t self:capability { setuid setgid net_admin chown fowner dac_override sys_nice }; dontaudit krb5kdc_t self:capability sys_tty_config; @@ -11337,17 +9859,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb allow krb5kdc_t self:netlink_route_socket r_netlink_socket_perms; allow krb5kdc_t self:tcp_socket create_stream_socket_perms; allow krb5kdc_t self:udp_socket create_socket_perms; -@@ -215,6 +227,9 @@ - files_read_usr_symlinks(krb5kdc_t) - files_read_var_files(krb5kdc_t) - -+selinux_validate_context(krb5kdc_t) -+seutil_read_file_contexts(krb5kdc_t) -+ - libs_use_ld_so(krb5kdc_t) - libs_use_shared_libs(krb5kdc_t) - -@@ -223,6 +238,7 @@ +@@ -223,6 +232,7 @@ miscfiles_read_localization(krb5kdc_t) sysnet_read_config(krb5kdc_t) @@ -11355,7 +9867,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb userdom_dontaudit_use_unpriv_user_fds(krb5kdc_t) userdom_dontaudit_search_sysadm_home_dirs(krb5kdc_t) -@@ -233,6 +249,7 @@ +@@ -233,6 +243,7 @@ optional_policy(` seutil_sigchld_newrole(krb5kdc_t) @@ -11365,7 +9877,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ktalk.te serefpolicy-3.0.8/policy/modules/services/ktalk.te --- nsaserefpolicy/policy/modules/services/ktalk.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ktalk.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ktalk.te 2007-12-02 21:15:34.000000000 -0500 @@ -49,6 +49,8 @@ manage_files_pattern(ktalkd_t,ktalkd_var_run_t,ktalkd_var_run_t) files_pid_filetrans(ktalkd_t,ktalkd_var_run_t,file) @@ -11391,7 +9903,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ktal +term_search_ptys(ktalkd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap.te serefpolicy-3.0.8/policy/modules/services/ldap.te --- nsaserefpolicy/policy/modules/services/ldap.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ldap.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ldap.te 2007-12-02 21:15:34.000000000 -0500 @@ -42,7 +42,6 @@ dontaudit slapd_t self:capability sys_tty_config; allow slapd_t self:process setsched; @@ -11431,25 +9943,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ldap diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.fc serefpolicy-3.0.8/policy/modules/services/lpd.fc --- nsaserefpolicy/policy/modules/services/lpd.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/lpd.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -22,6 +22,8 @@ - /usr/sbin/lpinfo -- gen_context(system_u:object_r:lpr_exec_t,s0) - /usr/sbin/lpmove -- gen_context(system_u:object_r:lpr_exec_t,s0) - -+/usr/local/linuxprinter/bin/l?lpr -- gen_context(system_u:object_r:lpr_exec_t,s0) -+ - /usr/share/printconf/.* -- gen_context(system_u:object_r:printconf_t,s0) - - # -@@ -29,3 +31,5 @@ ++++ serefpolicy-3.0.8/policy/modules/services/lpd.fc 2007-12-02 21:15:34.000000000 -0500 +@@ -29,3 +29,4 @@ # /var/spool/lpd(/.*)? gen_context(system_u:object_r:print_spool_t,s0) /var/run/lprng(/.*)? gen_context(system_u:object_r:lpd_var_run_t,s0) +/var/spool/cups(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh) -+/var/spool/cups-pdf(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-3.0.8/policy/modules/services/lpd.if --- nsaserefpolicy/policy/modules/services/lpd.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/lpd.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/lpd.if 2007-12-31 06:38:31.000000000 -0500 @@ -303,6 +303,25 @@ ######################################## @@ -11511,17 +10013,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd. + + can_exec($1,lpr_exec_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.fc serefpolicy-3.0.8/policy/modules/services/mailman.fc ---- nsaserefpolicy/policy/modules/services/mailman.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/mailman.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -31,3 +31,4 @@ - /var/lock/mailman(/.*)? gen_context(system_u:object_r:mailman_lock_t,s0) - /var/spool/mailman(/.*)? gen_context(system_u:object_r:mailman_data_t,s0) - ') -+/usr/lib/mailman/mail/mailman -- gen_context(system_u:object_r:mailman_mail_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.if serefpolicy-3.0.8/policy/modules/services/mailman.if --- nsaserefpolicy/policy/modules/services/mailman.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/mailman.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/mailman.if 2007-12-31 14:17:27.000000000 -0500 @@ -256,6 +256,25 @@ ####################################### @@ -11550,7 +10044,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.0.8/policy/modules/services/mailman.te --- nsaserefpolicy/policy/modules/services/mailman.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/mailman.te 2008-04-15 14:13:47.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/mailman.te 2007-12-02 21:15:34.000000000 -0500 @@ -55,6 +55,8 @@ apache_use_fds(mailman_cgi_t) apache_dontaudit_append_log(mailman_cgi_t) @@ -11560,25 +10054,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail optional_policy(` nscd_socket_use(mailman_cgi_t) -@@ -67,6 +69,17 @@ +@@ -67,6 +69,14 @@ # allow mailman_mail_t self:unix_dgram_socket create_socket_perms; -+allow mailman_mail_t self:process signal; +allow mailman_mail_t initrc_t:process signal; +allow mailman_mail_t self:capability { setuid setgid }; + +mta_dontaudit_rw_delivery_tcp_sockets(mailman_mail_t) -+mta_dontaudit_rw_queue(mailman_mail_t) + +auth_use_nsswitch(mailman_mail_t) + +files_search_spool(mailman_mail_t) -+fs_rw_anon_inodefs_files(mailman_mail_t) mta_dontaudit_rw_delivery_tcp_sockets(mailman_mail_t) -@@ -96,6 +109,7 @@ +@@ -96,6 +106,7 @@ kernel_read_proc_symlinks(mailman_queue_t) auth_domtrans_chk_passwd(mailman_queue_t) @@ -11588,13 +10079,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.0.8/policy/modules/services/mailscanner.fc --- nsaserefpolicy/policy/modules/services/mailscanner.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/mailscanner.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/mailscanner.fc 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,2 @@ +/var/spool/MailScanner(/.*)? gen_context(system_u:object_r:mailscanner_spool_t,s0) + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.0.8/policy/modules/services/mailscanner.if --- nsaserefpolicy/policy/modules/services/mailscanner.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/mailscanner.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/mailscanner.if 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,59 @@ +## Anti-Virus and Anti-Spam Filter + @@ -11657,27 +10148,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.0.8/policy/modules/services/mailscanner.te --- nsaserefpolicy/policy/modules/services/mailscanner.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/mailscanner.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/mailscanner.te 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,5 @@ + +policy_module(mailscanner,1.0.0) + +type mailscanner_spool_t; +files_type(mailscanner_spool_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.fc serefpolicy-3.0.8/policy/modules/services/mta.fc ---- nsaserefpolicy/policy/modules/services/mta.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/mta.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -11,6 +11,7 @@ - /usr/lib(64)?/sendmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) - - /usr/sbin/rmail -- gen_context(system_u:object_r:sendmail_exec_t,s0) -+/bin/mail -- gen_context(system_u:object_r:sendmail_exec_t,s0) - /usr/sbin/sendmail\.postfix -- gen_context(system_u:object_r:sendmail_exec_t,s0) - /usr/sbin/sendmail(\.sendmail)? -- gen_context(system_u:object_r:sendmail_exec_t,s0) - diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.0.8/policy/modules/services/mta.if --- nsaserefpolicy/policy/modules/services/mta.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/mta.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/mta.if 2008-01-11 14:43:52.000000000 -0500 @@ -87,6 +87,8 @@ # It wants to check for nscd files_dontaudit_search_pids($1_mail_t) @@ -11718,19 +10198,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. ') ####################################### -@@ -210,9 +207,9 @@ - userdom_user_home_dir_filetrans_user_home_content($1,$1_mail_t,file) - # for reading .forward - maybe we need a new type for it? - # also for delivering mail to maildir -- userdom_manage_user_home_content_dirs($1,mailserver_delivery) -- userdom_manage_user_home_content_files($1,mailserver_delivery) -- userdom_manage_user_home_content_symlinks($1,mailserver_delivery) -+ userdom_manage_all_users_home_content_dirs(mailserver_delivery) -+ userdom_manage_all_users_home_content_files(mailserver_delivery) -+ userdom_manage_all_users_home_content_symlinks(mailserver_delivery) - userdom_manage_user_home_content_pipes($1,mailserver_delivery) - userdom_manage_user_home_content_sockets($1,mailserver_delivery) - userdom_user_home_dir_filetrans_user_home_content($1,mailserver_delivery,{ dir file lnk_file fifo_file sock_file }) @@ -228,6 +225,11 @@ fs_manage_cifs_symlinks($1_mail_t) ') @@ -11887,7 +10354,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.0.8/policy/modules/services/mta.te --- nsaserefpolicy/policy/modules/services/mta.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/mta.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/mta.te 2008-01-16 06:23:56.000000000 -0500 @@ -1,11 +1,13 @@ -policy_module(mta,1.7.1) @@ -11911,12 +10378,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. mta_base_mail_template(system) role system_r types system_mail_t; -@@ -37,30 +40,45 @@ - # - - # newalias required this, not sure if it is needed in 'if' file --allow system_mail_t self:capability { dac_override }; -+allow system_mail_t self:capability { dac_override fowner }; +@@ -40,27 +43,40 @@ + allow system_mail_t self:capability { dac_override }; read_files_pattern(system_mail_t,etc_mail_t,etc_mail_t) +read_files_pattern(system_mail_t,mailcontent_type,mailcontent_type) @@ -11924,8 +10387,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. kernel_read_system_state(system_mail_t) kernel_read_network_state(system_mail_t) -+logging_append_all_logs(system_mail_t) -+ +dev_read_sysfs(system_mail_t) dev_read_rand(system_mail_t) dev_read_urand(system_mail_t) @@ -11958,7 +10419,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. ') optional_policy(` -@@ -73,6 +91,7 @@ +@@ -73,6 +89,7 @@ optional_policy(` cron_read_system_job_tmp_files(system_mail_t) @@ -11966,7 +10427,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. cron_dontaudit_write_pipes(system_mail_t) ') -@@ -81,6 +100,11 @@ +@@ -81,6 +98,11 @@ ') optional_policy(` @@ -11978,16 +10439,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. logrotate_read_tmp_files(system_mail_t) ') -@@ -136,11 +160,38 @@ +@@ -136,11 +158,33 @@ ') optional_policy(` -+ clamav_stream_connect(system_mail_t) -+ clamav_append_log(system_mail_t) -+') -+ -+optional_policy(` -+ fail2ban_append_log(system_mail_t) ++ clamav_stream_connect(sendmail_t) +') + +optional_policy(` @@ -12001,7 +10457,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. -# should break this up among sections: +init_stream_connect_script(mailserver_delivery) +init_rw_script_stream_sockets(mailserver_delivery) - ++ +tunable_policy(`use_samba_home_dirs',` + fs_manage_cifs_dirs(mailserver_delivery) + fs_manage_cifs_files(mailserver_delivery) @@ -12013,19 +10469,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. + fs_manage_nfs_files(mailserver_delivery) + fs_manage_nfs_symlinks(mailserver_delivery) +') -+ + +# should break this up among sections: optional_policy(` # why is mail delivered to a directory of type arpwatch_data_t? arpwatch_search_data(mailserver_delivery) -@@ -154,3 +205,4 @@ +@@ -154,3 +198,4 @@ cron_read_system_job_tmp_files(mta_user_agent) ') ') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.fc serefpolicy-3.0.8/policy/modules/services/munin.fc --- nsaserefpolicy/policy/modules/services/munin.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/munin.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/munin.fc 2008-01-16 16:07:35.000000000 -0500 @@ -6,6 +6,7 @@ /usr/share/munin/plugins/.* -- gen_context(system_u:object_r:munin_exec_t,s0) @@ -12038,7 +10494,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni +/var/www/html/munin/cgi(/.*)? gen_context(system_u:object_r:httpd_munin_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.if serefpolicy-3.0.8/policy/modules/services/munin.if --- nsaserefpolicy/policy/modules/services/munin.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/munin.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/munin.if 2008-01-16 16:07:44.000000000 -0500 @@ -61,3 +61,22 @@ allow $1 munin_var_lib_t:dir search_dir_perms; files_search_var_lib($1) @@ -12064,7 +10520,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/munin.te serefpolicy-3.0.8/policy/modules/services/munin.te --- nsaserefpolicy/policy/modules/services/munin.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/munin.te 2008-04-06 05:34:05.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/munin.te 2008-01-16 16:07:27.000000000 -0500 @@ -1,5 +1,5 @@ -policy_module(munin,1.3.0) @@ -12077,7 +10533,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni # -allow munin_t self:capability { setgid setuid }; -+allow munin_t self:capability { chown dac_override setgid setuid sys_rawio }; ++allow munin_t self:capability { dac_override setgid setuid }; dontaudit munin_t self:capability sys_tty_config; allow munin_t self:process { getsched setsched signal_perms }; allow munin_t self:unix_stream_socket { create_stream_socket_perms connectto }; @@ -12101,82 +10557,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni manage_dirs_pattern(munin_t,munin_tmp_t,munin_tmp_t) manage_files_pattern(munin_t,munin_tmp_t,munin_tmp_t) -@@ -61,9 +65,11 @@ - files_pid_filetrans(munin_t,munin_var_run_t,file) - - kernel_read_system_state(munin_t) --kernel_read_kernel_sysctls(munin_t) -+kernel_read_network_state(munin_t) -+kernel_read_all_sysctls(munin_t) - - corecmd_exec_bin(munin_t) -+corecmd_exec_shell(munin_t) - - corenet_all_recvfrom_unlabeled(munin_t) - corenet_all_recvfrom_netlabel(munin_t) -@@ -73,27 +79,37 @@ +@@ -73,6 +77,7 @@ corenet_udp_sendrecv_all_nodes(munin_t) corenet_tcp_sendrecv_all_ports(munin_t) corenet_udp_sendrecv_all_ports(munin_t) -+corenet_tcp_bind_munin_port(munin_t) +corenet_tcp_connect_munin_port(munin_t) -+corenet_tcp_connect_http_port(munin_t) -+corenet_tcp_bind_all_nodes(munin_t) dev_read_sysfs(munin_t) dev_read_urand(munin_t) - - domain_use_interactive_fds(munin_t) -+domain_dontaudit_read_all_domains_state(munin_t) - - files_read_etc_files(munin_t) - files_read_etc_runtime_files(munin_t) - files_read_usr_files(munin_t) -+files_list_spool(munin_t) - - fs_getattr_all_fs(munin_t) - fs_search_auto_mountpoints(munin_t) - -+auth_use_nsswitch(munin_t) -+ - libs_use_ld_so(munin_t) - libs_use_shared_libs(munin_t) +@@ -91,6 +96,7 @@ logging_send_syslog_msg(munin_t) +miscfiles_read_fonts(munin_t) miscfiles_read_localization(munin_t) --sysnet_read_config(munin_t) -+sysnet_exec_ifconfig(munin_t) -+netutils_domtrans_ping(munin_t) - - userdom_dontaudit_use_unpriv_user_fds(munin_t) - userdom_dontaudit_search_sysadm_home_dirs(munin_t) -@@ -108,7 +124,21 @@ - ') - - optional_policy(` -- nis_use_ypbind(munin_t) -+ fstools_domtrans(munin_t) -+') -+ -+optional_policy(` -+ mta_read_config(munin_t) -+ mta_send_mail(munin_t) -+') -+ -+optional_policy(` -+ mysql_read_config(munin_t) -+ mysql_stream_connect(munin_t) -+') -+ -+optional_policy(` -+ sendmail_read_log(munin_t) - ') - - optional_policy(` -@@ -118,3 +148,9 @@ + sysnet_read_config(munin_t) +@@ -118,3 +124,9 @@ optional_policy(` udev_read_db(munin_t) ') @@ -12188,7 +10585,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/muni +manage_files_pattern(munin_t, httpd_munin_content_t, httpd_munin_content_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.fc serefpolicy-3.0.8/policy/modules/services/mysql.fc --- nsaserefpolicy/policy/modules/services/mysql.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/mysql.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/mysql.fc 2007-12-02 21:15:34.000000000 -0500 @@ -22,3 +22,5 @@ /var/log/mysql.* -- gen_context(system_u:object_r:mysqld_log_t,s0) @@ -12197,7 +10594,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq +/etc/rc\.d/init\.d/mysqld -- gen_context(system_u:object_r:mysqld_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.if serefpolicy-3.0.8/policy/modules/services/mysql.if --- nsaserefpolicy/policy/modules/services/mysql.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/mysql.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/mysql.if 2007-12-02 21:15:34.000000000 -0500 @@ -157,3 +157,79 @@ logging_search_logs($1) allow $1 mysqld_log_t:file { write append setattr ioctl }; @@ -12280,7 +10677,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.0.8/policy/modules/services/mysql.te --- nsaserefpolicy/policy/modules/services/mysql.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/mysql.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/mysql.te 2007-12-31 16:46:03.000000000 -0500 @@ -25,6 +25,9 @@ type mysqld_tmp_t; files_tmp_file(mysqld_tmp_t) @@ -12301,17 +10698,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysq allow mysqld_t self:unix_stream_socket create_stream_socket_perms; allow mysqld_t self:tcp_socket create_stream_socket_perms; allow mysqld_t self:udp_socket create_socket_perms; -@@ -79,6 +83,7 @@ - - fs_getattr_all_fs(mysqld_t) - fs_search_auto_mountpoints(mysqld_t) -+fs_rw_hugetlbfs_files(mysqld_t) - - domain_use_interactive_fds(mysqld_t) - diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.fc serefpolicy-3.0.8/policy/modules/services/nagios.fc --- nsaserefpolicy/policy/modules/services/nagios.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nagios.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/nagios.fc 2007-12-02 21:15:34.000000000 -0500 @@ -4,13 +4,15 @@ /usr/bin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0) /usr/bin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0) @@ -12319,7 +10708,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi -/usr/lib(64)?/cgi-bin/netsaint/.+ -- gen_context(system_u:object_r:nagios_cgi_exec_t,s0) -/usr/lib(64)?/nagios/cgi/.+ -- gen_context(system_u:object_r:nagios_cgi_exec_t,s0) +/usr/lib(64)?/cgi-bin/netsaint(/.*)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0) -+/usr/lib(64)?/nagios/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0) ++/usr/lib(64)?/nagios/cgi(/.*)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0) /var/log/nagios(/.*)? gen_context(system_u:object_r:nagios_log_t,s0) /var/log/netsaint(/.*)? gen_context(system_u:object_r:nagios_log_t,s0) @@ -12333,7 +10722,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi +/usr/lib(64)?/cgi-bin/nagios(/.+)? gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.if serefpolicy-3.0.8/policy/modules/services/nagios.if --- nsaserefpolicy/policy/modules/services/nagios.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nagios.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/nagios.if 2007-12-02 21:15:34.000000000 -0500 @@ -44,25 +44,6 @@ ######################################## @@ -12362,7 +10751,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.0.8/policy/modules/services/nagios.te --- nsaserefpolicy/policy/modules/services/nagios.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nagios.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/nagios.te 2007-12-02 21:15:34.000000000 -0500 @@ -10,10 +10,6 @@ type nagios_exec_t; init_daemon_domain(nagios_t,nagios_exec_t) @@ -12468,7 +10857,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagi # diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.0.8/policy/modules/services/networkmanager.fc --- nsaserefpolicy/policy/modules/services/networkmanager.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/networkmanager.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/networkmanager.fc 2008-01-14 09:31:26.000000000 -0500 @@ -1,7 +1,9 @@ /usr/s?bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) /usr/s?bin/wpa_supplicant -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) @@ -12478,17 +10867,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw /var/run/NetworkManager(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/wpa_supplicant-global -s gen_context(system_u:object_r:NetworkManager_var_run_t,s0) -+/var/log/wpa_supplicant\.log.* -- gen_context(system_u:object_r:NetworkManager_log_t,s0) ++/var/log/wpa_supplicant.log.* -- gen_context(system_u:object_r:NetworkManager_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.if serefpolicy-3.0.8/policy/modules/services/networkmanager.if --- nsaserefpolicy/policy/modules/services/networkmanager.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/networkmanager.if 2008-04-04 16:11:03.000000000 -0400 -@@ -97,3 +97,21 @@ ++++ serefpolicy-3.0.8/policy/modules/services/networkmanager.if 2007-12-31 08:56:04.000000000 -0500 +@@ -97,3 +97,42 @@ allow $1 NetworkManager_t:dbus send_msg; allow NetworkManager_t $1:dbus send_msg; ') + +######################################## +## ++## dontaudit send and receive messages from ++## NetworkManager over dbus. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`networkmanager_dontaudit_dbus_chat',` ++ gen_require(` ++ type NetworkManager_t; ++ class dbus send_msg; ++ ') ++ ++ dontaudit $1 NetworkManager_t:dbus send_msg; ++ dontaudit NetworkManager_t $1:dbus send_msg; ++') ++ ++######################################## ++## +## Send a generic signal to NetworkManager +## +## @@ -12506,14 +10916,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.8/policy/modules/services/networkmanager.te --- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/networkmanager.te 2008-04-04 16:11:03.000000000 -0400 -@@ -1,5 +1,5 @@ - --policy_module(networkmanager,1.7.1) -+policy_module(networkmanager,1.9.0) - - ######################################## - # ++++ serefpolicy-3.0.8/policy/modules/services/networkmanager.te 2008-01-16 08:25:11.000000000 -0500 @@ -13,6 +13,9 @@ type NetworkManager_var_run_t; files_pid_file(NetworkManager_var_run_t) @@ -12529,11 +10932,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw # networkmanager will ptrace itself if gdb is installed # and it receives a unexpected signal (rh bug #204161) -allow NetworkManager_t self:capability { kill setgid setuid sys_nice dac_override net_admin net_raw net_bind_service ipc_lock }; -+allow NetworkManager_t self:capability { chown fsetid kill setgid setuid sys_nice dac_override net_admin net_raw ipc_lock }; ++allow NetworkManager_t self:capability { chown fsetid kill setgid setuid sys_nice dac_override net_admin net_raw net_bind_service ipc_lock }; dontaudit NetworkManager_t self:capability { sys_tty_config sys_ptrace }; allow NetworkManager_t self:process { ptrace setcap setpgid getsched signal_perms }; allow NetworkManager_t self:fifo_file rw_fifo_file_perms; -@@ -38,10 +41,14 @@ +@@ -38,6 +41,9 @@ manage_sock_files_pattern(NetworkManager_t,NetworkManager_var_run_t,NetworkManager_var_run_t) files_pid_filetrans(NetworkManager_t,NetworkManager_var_run_t, { dir file sock_file }) @@ -12543,29 +10946,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw kernel_read_system_state(NetworkManager_t) kernel_read_network_state(NetworkManager_t) kernel_read_kernel_sysctls(NetworkManager_t) - kernel_load_module(NetworkManager_t) -+kernel_read_debugfs(NetworkManager_t) - - corenet_all_recvfrom_unlabeled(NetworkManager_t) - corenet_all_recvfrom_netlabel(NetworkManager_t) -@@ -67,6 +74,7 @@ +@@ -82,6 +88,8 @@ + files_read_etc_files(NetworkManager_t) + files_read_etc_runtime_files(NetworkManager_t) + files_read_usr_files(NetworkManager_t) ++files_read_all_pids(NetworkManager_t) ++files_unlink_generic_pids(NetworkManager_t) - fs_getattr_all_fs(NetworkManager_t) - fs_search_auto_mountpoints(NetworkManager_t) -+fs_list_inotifyfs(NetworkManager_t) - - mls_file_read_all_levels(NetworkManager_t) - -@@ -86,6 +94,8 @@ init_read_utmp(NetworkManager_t) init_domtrans_script(NetworkManager_t) - -+auth_use_nsswitch(NetworkManager_t) -+ - libs_use_ld_so(NetworkManager_t) - libs_use_shared_libs(NetworkManager_t) - -@@ -129,28 +139,21 @@ +@@ -129,15 +137,13 @@ ') optional_policy(` @@ -12573,33 +10963,26 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw - class dbus send_msg; - ') - -- allow NetworkManager_t self:dbus send_msg; -- -- dbus_system_bus_client_template(NetworkManager,NetworkManager_t) -- dbus_connect_system_bus(NetworkManager_t) -- dbus_send_system_bus(NetworkManager_t) -+ dbus_system_domain(NetworkManager_t,NetworkManager_exec_t) - ') + allow NetworkManager_t self:dbus send_msg; - optional_policy(` -- howl_signal(NetworkManager_t) -+ hal_write_log(NetworkManager_t) + dbus_system_bus_client_template(NetworkManager,NetworkManager_t) + dbus_connect_system_bus(NetworkManager_t) + dbus_send_system_bus(NetworkManager_t) ++ dbus_dontaudit_rw_system_selinux_socket(NetworkManager_t) ++ dbus_system_domain(NetworkManager_t,NetworkManager_exec_t) ') optional_policy(` -- nis_use_ypbind(NetworkManager_t) -+ howl_signal(NetworkManager_t) - ') - +@@ -151,6 +157,8 @@ optional_policy(` -- nscd_socket_use(NetworkManager_t) + nscd_socket_use(NetworkManager_t) nscd_signal(NetworkManager_t) + nscd_script_domtrans(NetworkManager_t) + nscd_domtrans(NetworkManager_t) ') optional_policy(` -@@ -162,19 +165,20 @@ +@@ -162,6 +170,7 @@ ppp_domtrans(NetworkManager_t) ppp_read_pid_files(NetworkManager_t) ppp_signal(NetworkManager_t) @@ -12607,26 +10990,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw ') optional_policy(` -- seutil_sigchld_newrole(NetworkManager_t) -+ # Dispatcher starting and stoping ntp -+ ntp_script_domtrans(NetworkManager_t) +@@ -173,8 +182,10 @@ ') optional_policy(` -- udev_read_db(NetworkManager_t) -+ seutil_sigchld_newrole(NetworkManager_t) - ') - - optional_policy(` -- # Read gnome-keyring -- unconfined_read_home_content_files(NetworkManager_t) -+ udev_read_db(NetworkManager_t) ++ unconfined_rw_pipes(NetworkManager_t) + # Read gnome-keyring + unconfined_read_home_content_files(NetworkManager_t) ++ unconfined_use_terminals(NetworkManager_t) ') optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.0.8/policy/modules/services/nis.fc --- nsaserefpolicy/policy/modules/services/nis.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nis.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/nis.fc 2007-12-02 21:15:34.000000000 -0500 @@ -4,6 +4,7 @@ /sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0) @@ -12637,7 +11014,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. /usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.0.8/policy/modules/services/nis.if --- nsaserefpolicy/policy/modules/services/nis.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nis.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/nis.if 2007-12-02 21:15:34.000000000 -0500 @@ -49,8 +49,8 @@ corenet_udp_bind_all_nodes($1) corenet_tcp_bind_generic_port($1) @@ -12679,7 +11056,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.0.8/policy/modules/services/nis.te --- nsaserefpolicy/policy/modules/services/nis.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nis.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/nis.te 2007-12-02 21:15:34.000000000 -0500 @@ -113,6 +113,18 @@ userdom_dontaudit_use_unpriv_user_fds(ypbind_t) userdom_dontaudit_search_sysadm_home_dirs(ypbind_t) @@ -12738,7 +11115,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_tcp_connect_all_ports(ypxfr_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.fc serefpolicy-3.0.8/policy/modules/services/nscd.fc --- nsaserefpolicy/policy/modules/services/nscd.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nscd.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/nscd.fc 2007-12-02 21:15:34.000000000 -0500 @@ -9,3 +9,6 @@ /var/run/\.nscd_socket -s gen_context(system_u:object_r:nscd_var_run_t,s0) @@ -12748,7 +11125,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.if serefpolicy-3.0.8/policy/modules/services/nscd.if --- nsaserefpolicy/policy/modules/services/nscd.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nscd.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/nscd.if 2007-12-02 21:15:34.000000000 -0500 @@ -70,14 +70,15 @@ interface(`nscd_socket_use',` gen_require(` @@ -12792,7 +11169,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.0.8/policy/modules/services/nscd.te --- nsaserefpolicy/policy/modules/services/nscd.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nscd.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/nscd.te 2007-12-02 21:15:34.000000000 -0500 @@ -23,19 +23,22 @@ type nscd_log_t; logging_log_file(nscd_log_t) @@ -12860,7 +11237,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.fc serefpolicy-3.0.8/policy/modules/services/ntp.fc --- nsaserefpolicy/policy/modules/services/ntp.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ntp.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ntp.fc 2007-12-02 21:15:34.000000000 -0500 @@ -17,3 +17,8 @@ /var/log/xntpd.* -- gen_context(system_u:object_r:ntpd_log_t,s0) @@ -12872,7 +11249,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. +/etc/rc\.d/init\.d/ntpd -- gen_context(system_u:object_r:ntpd_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.if serefpolicy-3.0.8/policy/modules/services/ntp.if --- nsaserefpolicy/policy/modules/services/ntp.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ntp.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ntp.if 2007-12-02 21:15:34.000000000 -0500 @@ -53,3 +53,59 @@ corecmd_search_bin($1) domtrans_pattern($1,ntpdate_exec_t,ntpd_t) @@ -12935,7 +11312,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.0.8/policy/modules/services/ntp.te --- nsaserefpolicy/policy/modules/services/ntp.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ntp.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ntp.te 2007-12-02 21:15:34.000000000 -0500 @@ -25,6 +25,12 @@ type ntpdate_exec_t; init_system_domain(ntpd_t,ntpdate_exec_t) @@ -12996,123 +11373,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. logrotate_exec(ntpd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.fc serefpolicy-3.0.8/policy/modules/services/nx.fc ---- nsaserefpolicy/policy/modules/services/nx.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/nx.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -1,3 +1,5 @@ -+ -+/usr/libexec/nx/nxserver -- gen_context(system_u:object_r:nx_server_exec_t,s0) - /opt/NX/bin/nxserver -- gen_context(system_u:object_r:nx_server_exec_t,s0) - - /opt/NX/home/nx/\.ssh(/.*)? gen_context(system_u:object_r:nx_server_home_ssh_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.fc serefpolicy-3.0.8/policy/modules/services/oddjob.fc ---- nsaserefpolicy/policy/modules/services/oddjob.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/oddjob.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -1,5 +1,5 @@ --/usr/lib/oddjob/mkhomedir -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0) -+/usr/lib(64)?/oddjob/mkhomedir -- gen_context(system_u:object_r:oddjob_mkhomedir_exec_t,s0) - - /usr/sbin/oddjobd -- gen_context(system_u:object_r:oddjob_exec_t,s0) - --/var/run/oddjobd.pid gen_context(system_u:object_r:oddjob_var_run_t,s0) -+/var/run/oddjobd\.pid gen_context(system_u:object_r:oddjob_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.if serefpolicy-3.0.8/policy/modules/services/oddjob.if ---- nsaserefpolicy/policy/modules/services/oddjob.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/oddjob.if 2008-04-04 16:11:03.000000000 -0400 -@@ -44,6 +44,7 @@ - ') - - domtrans_pattern(oddjob_t, $2, $1) -+ domain_user_exemption_target($1) - ') - - ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/oddjob.te serefpolicy-3.0.8/policy/modules/services/oddjob.te ---- nsaserefpolicy/policy/modules/services/oddjob.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/oddjob.te 2008-04-04 16:11:03.000000000 -0400 -@@ -1,5 +1,5 @@ - --policy_module(oddjob,1.3.0) -+policy_module(oddjob,1.4.0) - - ######################################## - # -@@ -10,14 +10,20 @@ - type oddjob_exec_t; - domain_type(oddjob_t) - init_daemon_domain(oddjob_t, oddjob_exec_t) -+domain_obj_id_change_exemption(oddjob_t) - domain_subj_id_change_exemption(oddjob_t) - - type oddjob_mkhomedir_t; - type oddjob_mkhomedir_exec_t; - domain_type(oddjob_mkhomedir_t) --init_daemon_domain(oddjob_mkhomedir_t, oddjob_mkhomedir_exec_t) -+domain_obj_id_change_exemption(oddjob_mkhomedir_t) -+init_system_domain(oddjob_mkhomedir_t, oddjob_mkhomedir_exec_t) - oddjob_system_entry(oddjob_mkhomedir_t, oddjob_mkhomedir_exec_t) - -+ifdef(`enable_mcs',` -+ init_ranged_daemon_domain(oddjob_t,oddjob_exec_t,s0 - mcs_systemhigh) -+') -+ - # pid files - type oddjob_var_run_t; - files_pid_file(oddjob_var_run_t) -@@ -56,7 +62,6 @@ - - optional_policy(` - dbus_system_bus_client_template(oddjob,oddjob_t) -- dbus_send_system_bus(oddjob_t) - dbus_connect_system_bus(oddjob_t) - ') - -@@ -69,20 +74,38 @@ - # oddjob_mkhomedir local policy - # - -+allow oddjob_mkhomedir_t self:capability { chown fowner fsetid dac_override }; -+allow oddjob_mkhomedir_t self:process setfscreate; - allow oddjob_mkhomedir_t self:fifo_file { read write }; - allow oddjob_mkhomedir_t self:unix_stream_socket create_stream_socket_perms; - - files_read_etc_files(oddjob_mkhomedir_t) - -+kernel_read_system_state(oddjob_mkhomedir_t) -+ -+auth_use_nsswitch(oddjob_mkhomedir_t) -+ - libs_use_ld_so(oddjob_mkhomedir_t) - libs_use_shared_libs(oddjob_mkhomedir_t) - -+logging_send_syslog_msg(oddjob_mkhomedir_t) -+ - miscfiles_read_localization(oddjob_mkhomedir_t) - -+selinux_get_fs_mount(oddjob_mkhomedir_t) -+selinux_validate_context(oddjob_mkhomedir_t) -+selinux_compute_access_vector(oddjob_mkhomedir_t) -+selinux_compute_create_context(oddjob_mkhomedir_t) -+selinux_compute_relabel_context(oddjob_mkhomedir_t) -+selinux_compute_user_contexts(oddjob_mkhomedir_t) -+ -+seutil_read_config(oddjob_mkhomedir_t) -+seutil_read_file_contexts(oddjob_mkhomedir_t) -+seutil_read_default_contexts(oddjob_mkhomedir_t) -+ - # Add/remove user home directories -+userdom_manage_unpriv_users_home_content_dirs(oddjob_mkhomedir_t) - userdom_home_filetrans_generic_user_home_dir(oddjob_mkhomedir_t) --userdom_manage_generic_user_home_content_dirs(oddjob_mkhomedir_t) --userdom_manage_generic_user_home_content_files(oddjob_mkhomedir_t) --userdom_manage_generic_user_home_dirs(oddjob_mkhomedir_t) --userdom_manage_staff_home_dirs(oddjob_mkhomedir_t) -+userdom_manage_all_users_home_content_dirs(oddjob_mkhomedir_t) -+userdom_manage_all_users_home_content_files(oddjob_mkhomedir_t) - userdom_generic_user_home_dir_filetrans_generic_user_home_content(oddjob_mkhomedir_t,notdevfile_class_set) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openct.te serefpolicy-3.0.8/policy/modules/services/openct.te --- nsaserefpolicy/policy/modules/services/openct.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/openct.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/openct.te 2007-12-02 21:15:34.000000000 -0500 @@ -22,6 +22,7 @@ allow openct_t self:process signal_perms; @@ -13123,7 +11386,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open kernel_read_kernel_sysctls(openct_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.fc serefpolicy-3.0.8/policy/modules/services/openvpn.fc --- nsaserefpolicy/policy/modules/services/openvpn.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/openvpn.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/openvpn.fc 2007-12-04 11:28:30.000000000 -0500 @@ -11,5 +11,5 @@ # # /var @@ -13133,7 +11396,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open /var/run/openvpn(/.*)? gen_context(system_u:object_r:openvpn_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.0.8/policy/modules/services/openvpn.te --- nsaserefpolicy/policy/modules/services/openvpn.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/openvpn.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/openvpn.te 2008-01-08 12:10:23.000000000 -0500 @@ -35,7 +35,7 @@ # openvpn local policy # @@ -13177,7 +11440,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.te serefpolicy-3.0.8/policy/modules/services/pcscd.te --- nsaserefpolicy/policy/modules/services/pcscd.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/pcscd.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/pcscd.te 2007-12-02 21:15:34.000000000 -0500 @@ -45,6 +45,7 @@ files_read_etc_files(pcscd_t) files_read_etc_runtime_files(pcscd_t) @@ -13188,7 +11451,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcsc libs_use_ld_so(pcscd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-3.0.8/policy/modules/services/pegasus.if --- nsaserefpolicy/policy/modules/services/pegasus.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/pegasus.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/pegasus.if 2007-12-02 21:15:34.000000000 -0500 @@ -1 +1,19 @@ ## The Open Group Pegasus CIM/WBEM Server. + @@ -13211,7 +11474,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.0.8/policy/modules/services/pegasus.te --- nsaserefpolicy/policy/modules/services/pegasus.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/pegasus.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/pegasus.te 2007-12-02 21:15:34.000000000 -0500 @@ -42,6 +42,7 @@ allow pegasus_t pegasus_conf_t:file { read_file_perms link unlink }; allow pegasus_t pegasus_conf_t:lnk_file read_lnk_file_perms; @@ -13261,7 +11524,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portmap.te serefpolicy-3.0.8/policy/modules/services/portmap.te --- nsaserefpolicy/policy/modules/services/portmap.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/portmap.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/portmap.te 2007-12-02 21:15:34.000000000 -0500 @@ -63,6 +63,7 @@ # portmap binds to arbitary ports corenet_tcp_bind_generic_port(portmap_t) @@ -13272,7 +11535,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port corenet_dontaudit_tcp_bind_all_reserved_ports(portmap_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-3.0.8/policy/modules/services/portslave.te --- nsaserefpolicy/policy/modules/services/portslave.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/portslave.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/portslave.te 2007-12-02 21:15:34.000000000 -0500 @@ -85,6 +85,7 @@ auth_rw_login_records(portslave_t) @@ -13283,7 +11546,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.0.8/policy/modules/services/postfix.fc --- nsaserefpolicy/policy/modules/services/postfix.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/postfix.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/postfix.fc 2007-12-02 21:15:34.000000000 -0500 @@ -14,6 +14,7 @@ /usr/libexec/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0) /usr/libexec/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0) @@ -13302,7 +11565,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post /usr/sbin/postkick -- gen_context(system_u:object_r:postfix_master_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.0.8/policy/modules/services/postfix.if --- nsaserefpolicy/policy/modules/services/postfix.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/postfix.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/postfix.if 2007-12-06 11:05:10.000000000 -0500 @@ -41,6 +41,8 @@ allow postfix_$1_t self:unix_stream_socket connectto; @@ -13341,19 +11604,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ') ######################################## -@@ -211,9 +211,8 @@ - type postfix_etc_t; - ') - -- allow $1 postfix_etc_t:dir { getattr read search }; -- allow $1 postfix_etc_t:file { read getattr }; -- allow $1 postfix_etc_t:lnk_file { getattr read }; -+ read_files_pattern($1, postfix_etc_t, postfix_etc_t) -+ read_lnk_files_pattern($1, postfix_etc_t, postfix_etc_t) - files_search_etc($1) - ') - -@@ -269,6 +268,42 @@ +@@ -269,6 +269,42 @@ ######################################## ## @@ -13396,7 +11647,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ## Do not audit attempts to use ## postfix master process file ## file descriptors. -@@ -434,6 +469,25 @@ +@@ -434,6 +470,25 @@ ######################################## ## @@ -13422,7 +11673,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ## Execute postfix user mail programs ## in their respective domains. ## -@@ -450,3 +504,61 @@ +@@ -450,3 +505,41 @@ typeattribute $1 postfix_user_domtrans; ') @@ -13464,29 +11715,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post + allow $1 postfix_private_t:dir list_dir_perms; + manage_sock_files_pattern($1,postfix_private_t,postfix_private_t) +') -+ -+ -+######################################## -+## -+## Manage postfix mail spool files. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`postfix_manage_spool_files',` -+ gen_require(` -+ type postfix_spool_t; -+ ') -+ -+ files_search_spool($1) -+ manage_files_pattern($1,postfix_spool_t, postfix_spool_t) -+') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.0.8/policy/modules/services/postfix.te --- nsaserefpolicy/policy/modules/services/postfix.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/postfix.te 2008-04-15 13:43:34.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/postfix.te 2007-12-31 14:17:40.000000000 -0500 @@ -6,6 +6,14 @@ # Declarations # @@ -13569,18 +11800,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ') ########################################################### -@@ -238,6 +263,10 @@ - - corecmd_exec_bin(postfix_cleanup_t) - -+optional_policy(` -+ mailman_read_data_files(postfix_cleanup_t) -+') -+ - ######################################## - # - # Postfix local local policy -@@ -263,6 +292,8 @@ +@@ -263,6 +288,8 @@ files_read_etc_files(postfix_local_t) @@ -13589,13 +11809,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post mta_read_aliases(postfix_local_t) mta_delete_spool(postfix_local_t) # For reading spamassasin -@@ -270,11 +301,14 @@ - - optional_policy(` - clamav_search_lib(postfix_local_t) -+ clamav_exec_clamscan(postfix_local_t) - ') - +@@ -275,6 +302,8 @@ optional_policy(` # for postalias mailman_manage_data_files(postfix_local_t) @@ -13604,7 +11818,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ') optional_policy(` -@@ -327,6 +361,8 @@ +@@ -327,6 +356,8 @@ files_read_etc_runtime_files(postfix_map_t) files_dontaudit_search_var(postfix_map_t) @@ -13613,7 +11827,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post libs_use_ld_so(postfix_map_t) libs_use_shared_libs(postfix_map_t) -@@ -334,10 +370,6 @@ +@@ -334,10 +365,6 @@ miscfiles_read_localization(postfix_map_t) @@ -13624,7 +11838,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post tunable_policy(`read_default_t',` files_list_default(postfix_map_t) files_read_default_files(postfix_map_t) -@@ -350,10 +382,6 @@ +@@ -350,10 +377,6 @@ locallogin_dontaudit_use_fds(postfix_map_t) ') @@ -13635,7 +11849,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ######################################## # # Postfix pickup local policy -@@ -377,7 +405,7 @@ +@@ -377,7 +400,7 @@ # Postfix pipe local policy # @@ -13644,7 +11858,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post write_sock_files_pattern(postfix_pipe_t,postfix_private_t,postfix_private_t) -@@ -386,6 +414,10 @@ +@@ -386,6 +409,10 @@ rw_files_pattern(postfix_pipe_t,postfix_spool_t,postfix_spool_t) optional_policy(` @@ -13655,7 +11869,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post procmail_domtrans(postfix_pipe_t) ') -@@ -394,6 +426,10 @@ +@@ -394,6 +421,10 @@ ') optional_policy(` @@ -13666,7 +11880,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post uucp_domtrans_uux(postfix_pipe_t) ') -@@ -418,14 +454,17 @@ +@@ -418,14 +449,17 @@ term_dontaudit_use_all_user_ptys(postfix_postdrop_t) term_dontaudit_use_all_user_ttys(postfix_postdrop_t) @@ -13686,7 +11900,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post optional_policy(` ppp_use_fds(postfix_postqueue_t) ppp_sigchld(postfix_postqueue_t) -@@ -454,8 +493,6 @@ +@@ -454,8 +488,6 @@ init_sigchld_script(postfix_postqueue_t) init_use_script_fds(postfix_postqueue_t) @@ -13695,7 +11909,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ######################################## # # Postfix qmgr local policy -@@ -498,15 +535,11 @@ +@@ -498,15 +530,11 @@ term_use_all_user_ptys(postfix_showq_t) term_use_all_user_ttys(postfix_showq_t) @@ -13711,7 +11925,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post # connect to master process stream_connect_pattern(postfix_smtp_t,{ postfix_private_t postfix_public_t },{ postfix_private_t postfix_public_t },postfix_master_t) -@@ -514,6 +547,8 @@ +@@ -514,6 +542,8 @@ allow postfix_smtp_t postfix_spool_t:file rw_file_perms; @@ -13720,7 +11934,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post optional_policy(` cyrus_stream_connect(postfix_smtp_t) ') -@@ -538,9 +573,45 @@ +@@ -538,9 +568,45 @@ mta_read_aliases(postfix_smtpd_t) optional_policy(` @@ -13752,7 +11966,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +files_tmp_filetrans(postfix_virtual_t, postfix_virtual_tmp_t, { file dir }) + +# connect to master process -+stream_connect_pattern(postfix_virtual_t,{ postfix_private_t postfix_public_t },{ postfix_private_t postfix_public_t },postfix_master_t) ++stream_connect_pattern(postfix_virtual_t,postfix_public_t,postfix_public_t,postfix_master_t) + +allow postfix_virtual_t postfix_spool_t:file rw_file_perms; + @@ -13768,7 +11982,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +mta_manage_spool(postfix_virtual_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.fc serefpolicy-3.0.8/policy/modules/services/postgresql.fc --- nsaserefpolicy/policy/modules/services/postgresql.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/postgresql.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/postgresql.fc 2007-12-02 21:15:34.000000000 -0500 @@ -38,3 +38,5 @@ ') @@ -13777,7 +11991,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +/etc/rc\.d/init\.d/postgresql -- gen_context(system_u:object_r:postgresql_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.if serefpolicy-3.0.8/policy/modules/services/postgresql.if --- nsaserefpolicy/policy/modules/services/postgresql.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/postgresql.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/postgresql.if 2007-12-02 21:15:34.000000000 -0500 @@ -113,3 +113,77 @@ # Some versions of postgresql put the sock file in /tmp allow $1 postgresql_tmp_t:sock_file write; @@ -13858,7 +12072,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgresql.te serefpolicy-3.0.8/policy/modules/services/postgresql.te --- nsaserefpolicy/policy/modules/services/postgresql.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/postgresql.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/postgresql.te 2007-12-02 21:15:34.000000000 -0500 @@ -27,6 +27,9 @@ type postgresql_var_run_t; files_pid_file(postgresql_var_run_t) @@ -13877,15 +12091,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post manage_dirs_pattern(postgresql_t,postgresql_db_t,postgresql_db_t) manage_files_pattern(postgresql_t,postgresql_db_t,postgresql_db_t) -@@ -101,6 +103,7 @@ - - fs_getattr_all_fs(postgresql_t) - fs_search_auto_mountpoints(postgresql_t) -+fs_rw_hugetlbfs_files(postgresql_t) - - term_use_controlling_term(postgresql_t) - -@@ -118,6 +121,8 @@ +@@ -118,6 +120,8 @@ init_read_utmp(postgresql_t) @@ -13894,7 +12100,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post libs_use_ld_so(postgresql_t) libs_use_shared_libs(postgresql_t) -@@ -127,9 +132,6 @@ +@@ -127,9 +131,6 @@ seutil_dontaudit_search_config(postgresql_t) @@ -13904,7 +12110,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post userdom_dontaudit_search_sysadm_home_dirs(postgresql_t) userdom_dontaudit_use_sysadm_ttys(postgresql_t) userdom_dontaudit_use_unpriv_user_fds(postgresql_t) -@@ -158,10 +160,6 @@ +@@ -158,10 +159,6 @@ ') optional_policy(` @@ -13915,45 +12121,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post seutil_sigchld_newrole(postgresql_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgrey.fc serefpolicy-3.0.8/policy/modules/services/postgrey.fc ---- nsaserefpolicy/policy/modules/services/postgrey.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/postgrey.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -7,3 +7,5 @@ - - /var/run/postgrey(/.*)? gen_context(system_u:object_r:postgrey_var_run_t,s0) - /var/run/postgrey\.pid -- gen_context(system_u:object_r:postgrey_var_run_t,s0) -+ -+/var/spool/postfix/postgrey(/.*)? gen_context(system_u:object_r:postgrey_spool_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgrey.if serefpolicy-3.0.8/policy/modules/services/postgrey.if ---- nsaserefpolicy/policy/modules/services/postgrey.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/postgrey.if 2008-04-14 10:39:57.000000000 -0400 -@@ -12,10 +12,11 @@ - # - interface(`postgrey_stream_connect',` - gen_require(` -- type postgrey_var_run_t, postgrey_t; -+ type postgrey_var_run_t, postgrey_t, postgrey_spool_t; - ') - - allow $1 postgrey_t:unix_stream_socket connectto; - allow $1 postgrey_var_run_t:sock_file write; -+ allow $1 postgrey_spool_t:sock_file write; - files_search_pids($1) - ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postgrey.te serefpolicy-3.0.8/policy/modules/services/postgrey.te --- nsaserefpolicy/policy/modules/services/postgrey.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/postgrey.te 2008-04-14 10:40:08.000000000 -0400 -@@ -13,6 +13,9 @@ - type postgrey_etc_t; - files_config_file(postgrey_etc_t) - -+type postgrey_spool_t; -+files_type(postgrey_spool_t) -+ - type postgrey_var_lib_t; - files_type(postgrey_var_lib_t) - -@@ -24,15 +27,21 @@ ++++ serefpolicy-3.0.8/policy/modules/services/postgrey.te 2008-01-08 16:14:31.000000000 -0500 +@@ -24,7 +24,7 @@ # Local policy # @@ -13962,21 +12133,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post dontaudit postgrey_t self:capability sys_tty_config; allow postgrey_t self:process signal_perms; allow postgrey_t self:tcp_socket create_stream_socket_perms; -+allow postgrey_t self:fifo_file create_fifo_file_perms; - - allow postgrey_t postgrey_etc_t:dir list_dir_perms; - read_files_pattern(postgrey_t,postgrey_etc_t,postgrey_etc_t) - read_lnk_files_pattern(postgrey_t,postgrey_etc_t,postgrey_etc_t) - -+manage_dirs_pattern(postgrey_t,postgrey_spool_t,postgrey_spool_t) -+manage_files_pattern(postgrey_t,postgrey_spool_t,postgrey_spool_t) -+manage_fifo_files_pattern(postgrey_t,postgrey_spool_t,postgrey_spool_t) -+manage_sock_files_pattern(postgrey_t,postgrey_spool_t,postgrey_spool_t) -+ - manage_files_pattern(postgrey_t,postgrey_var_lib_t,postgrey_var_lib_t) - files_var_lib_filetrans(postgrey_t,postgrey_var_lib_t,file) - -@@ -68,6 +77,8 @@ +@@ -68,6 +68,8 @@ fs_getattr_all_fs(postgrey_t) fs_search_auto_mountpoints(postgrey_t) @@ -13985,7 +12142,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post libs_use_ld_so(postgrey_t) libs_use_shared_libs(postgrey_t) -@@ -75,13 +86,12 @@ +@@ -75,13 +77,12 @@ miscfiles_read_localization(postgrey_t) @@ -13997,13 +12154,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post optional_policy(` - nis_use_ypbind(postgrey_t) + postfix_read_config(postgrey_t) -+ postfix_manage_spool_files(postgrey_t) ++ postfix_read_spool_files(postgrey_t) ') optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.fc serefpolicy-3.0.8/policy/modules/services/ppp.fc --- nsaserefpolicy/policy/modules/services/ppp.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ppp.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ppp.fc 2007-12-02 21:15:34.000000000 -0500 @@ -25,7 +25,7 @@ # # /var @@ -14015,7 +12172,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp. # Fix pptp sockets diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.if serefpolicy-3.0.8/policy/modules/services/ppp.if --- nsaserefpolicy/policy/modules/services/ppp.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ppp.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ppp.if 2007-12-02 21:15:34.000000000 -0500 @@ -159,6 +159,25 @@ ######################################## @@ -14044,7 +12201,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.0.8/policy/modules/services/ppp.te --- nsaserefpolicy/policy/modules/services/ppp.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ppp.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ppp.te 2007-12-31 17:29:52.000000000 -0500 @@ -197,11 +197,7 @@ ') @@ -14058,364 +12215,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp. ') optional_policy(` -@@ -221,6 +217,7 @@ - # PPTP Local policy - # - -+allow pptp_t self:process signal; - dontaudit pptp_t self:capability sys_tty_config; - allow pptp_t self:capability net_raw; - allow pptp_t self:fifo_file { read write }; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.fc serefpolicy-3.0.8/policy/modules/services/prelude.fc ---- nsaserefpolicy/policy/modules/services/prelude.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/prelude.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -0,0 +1,13 @@ -+ -+/sbin/audisp-prelude -- gen_context(system_u:object_r:audisp_prelude_exec_t,s0) -+ -+/usr/bin/prelude-manager -- gen_context(system_u:object_r:prelude_exec_t,s0) -+ -+/etc/rc.d/init.d/prelude-manager -- gen_context(system_u:object_r:prelude_script_exec_t,s0) -+ -+/var/lib/prelude-lml(/.*)? gen_context(system_u:object_r:prelude_var_lib_t,s0) -+ -+/var/run/prelude-manager(/.*)? gen_context(system_u:object_r:prelude_var_run_t,s0) -+/var/spool/prelude-manager(/.*)? gen_context(system_u:object_r:prelude_spool_t,s0) -+/var/spool/prelude(/.*)? gen_context(system_u:object_r:prelude_spool_t,s0) -+/usr/share/prewikka/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_prewikka_script_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.if serefpolicy-3.0.8/policy/modules/services/prelude.if ---- nsaserefpolicy/policy/modules/services/prelude.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/prelude.if 2008-04-04 16:11:03.000000000 -0400 -@@ -0,0 +1,128 @@ -+ -+## policy for prelude -+ -+######################################## -+## -+## Execute a domain transition to run prelude. -+## -+## -+## -+## Domain allowed to transition. -+## -+## -+# -+interface(`prelude_domtrans',` -+ gen_require(` -+ type prelude_t; -+ type prelude_exec_t; -+ ') -+ -+ domtrans_pattern($1,prelude_exec_t,prelude_t) -+') -+ -+ -+######################################## -+## -+## Execute prelude server in the prelude domain. -+## -+## -+## -+## The type of the process performing this action. -+## -+## -+# -+interface(`prelude_script_domtrans',` -+ gen_require(` -+ type prelude_script_exec_t; -+ ') -+ -+ init_script_domtrans_spec($1,prelude_script_exec_t) -+') -+ -+######################################## -+## -+## All of the rules required to administrate -+## an prelude environment -+## -+## -+## -+## Domain allowed access. -+## -+## -+## -+## -+## The role to be allowed to manage the syslog domain. -+## -+## -+## -+## -+## The type of the user terminal. -+## -+## -+## -+# -+interface(`prelude_admin',` -+ gen_require(` -+ type prelude_t; -+ type prelude_spool_t; -+ type prelude_var_run_t; -+ type prelude_var_lib_t; -+ type prelude_script_exec_t; -+ type audisp_prelude_t; -+ type audisp_prelude_var_run_t; -+ ') -+ -+ allow $1 prelude_t:process { ptrace signal_perms getattr }; -+ read_files_pattern($1, prelude_t, prelude_t) -+ -+ allow $1 audisp_prelude_t:process { ptrace signal_perms getattr }; -+ read_files_pattern($1, audisp_prelude_t, audisp_prelude_t) -+ -+ # Allow prelude_t to restart the apache service -+ prelude_script_domtrans($1) -+ domain_system_change_exemption($1) -+ role_transition $2 prelude_script_exec_t system_r; -+ allow $2 system_r; -+ -+ manage_all_pattern($1, prelude_spool_t) -+ manage_all_pattern($1, prelude_var_lib_t) -+ manage_all_pattern($1, prelude_var_run_t) -+ manage_all_pattern($1, audisp_prelude_var_run_t) -+') -+ -+######################################## -+## -+## Execute a domain transition to run audisp_prelude. -+## -+## -+## -+## Domain allowed to transition. -+## -+## -+# -+interface(`audisp_prelude_domtrans',` -+ gen_require(` -+ type audisp_prelude_t; -+ type audisp_prelude_exec_t; -+ ') -+ -+ domtrans_pattern($1,audisp_prelude_exec_t,audisp_prelude_t) -+') -+ -+######################################## -+## -+## Signal the audisp_prelude domain. -+## -+## -+## -+## Domain allowed to transition. -+## -+## -+# -+interface(`audisp_prelude_signal',` -+ gen_require(` -+ type audisp_prelude_t; -+ ') -+ -+ allow $1 audisp_prelude_t:process signal; -+') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/prelude.te serefpolicy-3.0.8/policy/modules/services/prelude.te ---- nsaserefpolicy/policy/modules/services/prelude.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/prelude.te 2008-04-04 16:11:03.000000000 -0400 -@@ -0,0 +1,162 @@ -+policy_module(prelude,1.0.0) -+ -+######################################## -+# -+# Declarations -+# -+ -+type prelude_t; -+type prelude_exec_t; -+domain_type(prelude_t) -+init_daemon_domain(prelude_t, prelude_exec_t) -+ -+type prelude_spool_t; -+files_type(prelude_spool_t) -+ -+type prelude_var_run_t; -+files_pid_file(prelude_var_run_t) -+ -+type prelude_var_lib_t; -+files_type(prelude_var_lib_t) -+ -+type prelude_script_exec_t; -+init_script_type(prelude_script_exec_t) -+ -+type audisp_prelude_t; -+type audisp_prelude_exec_t; -+domain_type(audisp_prelude_t) -+init_daemon_domain(audisp_prelude_t, audisp_prelude_exec_t) -+ -+type audisp_prelude_var_run_t; -+files_pid_file(audisp_prelude_var_run_t) -+ -+######################################## -+# -+# prelude local policy -+# -+ -+# Init script handling -+domain_use_interactive_fds(prelude_t) -+ -+allow prelude_t self:capability sys_tty_config; -+ -+# internal communication is often done using fifo and unix sockets. -+allow prelude_t self:fifo_file rw_file_perms; -+allow prelude_t self:unix_stream_socket create_stream_socket_perms; -+ -+allow prelude_t self:netlink_route_socket r_netlink_socket_perms; -+allow prelude_t self:tcp_socket create_stream_socket_perms; -+ -+dev_read_rand(prelude_t) -+dev_read_urand(prelude_t) -+ -+manage_files_pattern(prelude_t, prelude_var_run_t, prelude_var_run_t) -+manage_sock_files_pattern(prelude_t, prelude_var_run_t, prelude_var_run_t) -+files_pid_filetrans(prelude_t, prelude_var_run_t, file) -+ -+files_read_etc_files(prelude_t) -+files_read_usr_files(prelude_t) -+ -+files_search_var_lib(prelude_t) -+manage_dirs_pattern(prelude_t,prelude_var_lib_t,prelude_var_lib_t) -+manage_files_pattern(prelude_t,prelude_var_lib_t,prelude_var_lib_t) -+ -+files_search_spool(prelude_t) -+manage_dirs_pattern(prelude_t,prelude_spool_t,prelude_spool_t) -+manage_files_pattern(prelude_t,prelude_spool_t,prelude_spool_t) -+ -+auth_use_nsswitch(prelude_t) -+ -+libs_use_ld_so(prelude_t) -+libs_use_shared_libs(prelude_t) -+ -+logging_send_audit_msgs(prelude_t) -+logging_send_syslog_msg(prelude_t) -+ -+miscfiles_read_localization(prelude_t) -+ -+corenet_all_recvfrom_unlabeled(prelude_t) -+corenet_all_recvfrom_netlabel(prelude_t) -+corenet_tcp_sendrecv_all_if(prelude_t) -+corenet_tcp_sendrecv_all_nodes(prelude_t) -+corenet_tcp_bind_all_nodes(prelude_t) -+corenet_tcp_bind_prelude_port(prelude_t) -+corenet_tcp_connect_prelude_port(prelude_t) -+ -+corecmd_search_bin(prelude_t) -+ -+optional_policy(` -+ mysql_search_db(prelude_t) -+ mysql_stream_connect(prelude_t) -+') -+ -+optional_policy(` -+ postgresql_stream_connect(prelude_t) -+') -+ -+######################################## -+# -+# audisp_prelude local policy -+# -+ -+# Init script handling -+domain_use_interactive_fds(audisp_prelude_t) -+ -+# internal communication is often done using fifo and unix sockets. -+allow audisp_prelude_t self:fifo_file rw_file_perms; -+allow audisp_prelude_t self:unix_stream_socket create_stream_socket_perms; -+allow audisp_prelude_t self:netlink_route_socket r_netlink_socket_perms; -+allow audisp_prelude_t self:tcp_socket create_socket_perms; -+ -+manage_sock_files_pattern(audisp_prelude_t, audisp_prelude_var_run_t, audisp_prelude_var_run_t) -+files_pid_filetrans(audisp_prelude_t, audisp_prelude_var_run_t, sock_file) -+ -+dev_read_rand(audisp_prelude_t) -+dev_read_urand(audisp_prelude_t) -+ -+files_read_etc_files(audisp_prelude_t) -+ -+libs_use_ld_so(audisp_prelude_t) -+libs_use_shared_libs(audisp_prelude_t) -+ -+logging_send_syslog_msg(audisp_prelude_t) -+ -+miscfiles_read_localization(audisp_prelude_t) -+ -+corecmd_search_bin(audisp_prelude_t) -+allow audisp_prelude_t self:unix_dgram_socket create_socket_perms; -+ -+logging_audisp_system_domain(audisp_prelude_t, audisp_prelude_exec_t) -+ -+files_search_spool(audisp_prelude_t) -+manage_dirs_pattern(audisp_prelude_t,prelude_spool_t,prelude_spool_t) -+manage_files_pattern(audisp_prelude_t,prelude_spool_t,prelude_spool_t) -+ -+corenet_all_recvfrom_unlabeled(audisp_prelude_t) -+corenet_all_recvfrom_netlabel(audisp_prelude_t) -+corenet_tcp_sendrecv_all_if(audisp_prelude_t) -+corenet_tcp_sendrecv_all_nodes(audisp_prelude_t) -+corenet_tcp_bind_all_nodes(audisp_prelude_t) -+corenet_tcp_connect_prelude_port(audisp_prelude_t) -+ -+allow audisp_prelude_t audisp_t:unix_stream_socket rw_socket_perms; -+ -+######################################## -+# -+# prewikka_cgi Declarations -+# -+ -+optional_policy(` -+ apache_content_template(prewikka) -+ files_read_etc_files(httpd_prewikka_script_t) -+ -+ optional_policy(` -+ mysql_search_db(httpd_prewikka_script_t) -+ mysql_stream_connect(httpd_prewikka_script_t) -+ ') -+ -+ optional_policy(` -+ postgresql_stream_connect(httpd_prewikka_script_t) -+ ') -+') -+ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/privoxy.fc serefpolicy-3.0.8/policy/modules/services/privoxy.fc ---- nsaserefpolicy/policy/modules/services/privoxy.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/privoxy.fc 2008-04-08 08:26:27.000000000 -0400 -@@ -1,6 +1,8 @@ - - /etc/privoxy/user\.action -- gen_context(system_u:object_r:privoxy_etc_rw_t,s0) - -+/etc/privoxy/default\.action -- gen_context(system_u:object_r:privoxy_etc_rw_t,s0) -+ - /usr/sbin/privoxy -- gen_context(system_u:object_r:privoxy_exec_t,s0) - - /var/log/privoxy(/.*)? gen_context(system_u:object_r:privoxy_log_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/privoxy.te serefpolicy-3.0.8/policy/modules/services/privoxy.te ---- nsaserefpolicy/policy/modules/services/privoxy.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/privoxy.te 2008-04-09 08:36:50.000000000 -0400 -@@ -51,6 +51,7 @@ - corenet_tcp_connect_http_cache_port(privoxy_t) - corenet_tcp_connect_ftp_port(privoxy_t) - corenet_tcp_connect_tor_port(privoxy_t) -+corenet_tcp_connect_pgpkeyserver_port(privoxy_t) - corenet_sendrecv_http_cache_client_packets(privoxy_t) - corenet_sendrecv_http_cache_server_packets(privoxy_t) - corenet_sendrecv_http_client_packets(privoxy_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.fc serefpolicy-3.0.8/policy/modules/services/procmail.fc ---- nsaserefpolicy/policy/modules/services/procmail.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/procmail.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -1,2 +1,4 @@ - - /usr/bin/procmail -- gen_context(system_u:object_r:procmail_exec_t,s0) -+/var/log/procmail\.log.* -- gen_context(system_u:object_r:procmail_log_t,s0) -+/var/log/procmail(/.*)? gen_context(system_u:object_r:procmail_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.if serefpolicy-3.0.8/policy/modules/services/procmail.if --- nsaserefpolicy/policy/modules/services/procmail.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/procmail.if 2008-04-04 16:11:03.000000000 -0400 -@@ -39,3 +39,41 @@ ++++ serefpolicy-3.0.8/policy/modules/services/procmail.if 2007-12-31 15:18:54.000000000 -0500 +@@ -39,3 +39,22 @@ corecmd_search_bin($1) can_exec($1,procmail_exec_t) ') @@ -14438,50 +12241,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc + files_search_tmp($1) + allow $1 procmail_tmp_t:file read_file_perms; +') -+ -+######################################## -+## -+## Read/write procmail tmp files. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`procmail_rw_tmp_files',` -+ gen_require(` -+ type procmail_tmp_t; -+ ') -+ -+ files_search_tmp($1) -+ rw_files_pattern($1, procmail_tmp_t, procmail_tmp_t) -+') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.0.8/policy/modules/services/procmail.te --- nsaserefpolicy/policy/modules/services/procmail.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/procmail.te 2008-04-04 16:11:03.000000000 -0400 -@@ -14,6 +14,10 @@ - type procmail_tmp_t; - files_tmp_file(procmail_tmp_t) - -+# log files -+type procmail_log_t; -+logging_log_file(procmail_log_t) -+ - ######################################## - # - # Local policy -@@ -27,9 +31,18 @@ - allow procmail_t self:tcp_socket create_stream_socket_perms; - allow procmail_t self:udp_socket create_socket_perms; - -+# Write log to /var/log/procmail.log or /var/log/procmail/.* -+allow procmail_t procmail_log_t:dir setattr; -+create_files_pattern(procmail_t,procmail_log_t,procmail_log_t) -+append_files_pattern(procmail_t,procmail_log_t,procmail_log_t) -+read_lnk_files_pattern(procmail_t,procmail_log_t,procmail_log_t) -+logging_log_filetrans(procmail_t,procmail_log_t, { file dir }) -+ ++++ serefpolicy-3.0.8/policy/modules/services/procmail.te 2008-01-17 08:59:43.000000000 -0500 +@@ -30,6 +30,8 @@ allow procmail_t procmail_tmp_t:file manage_file_perms; files_tmp_filetrans(procmail_t, procmail_tmp_t, file) @@ -14490,7 +12253,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc kernel_read_system_state(procmail_t) kernel_read_kernel_sysctls(procmail_t) -@@ -50,11 +63,13 @@ +@@ -50,6 +52,7 @@ fs_getattr_xattr_fs(procmail_t) fs_search_auto_mountpoints(procmail_t) @@ -14498,13 +12261,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc auth_use_nsswitch(procmail_t) - corecmd_exec_bin(procmail_t) - corecmd_exec_shell(procmail_t) -+corecmd_read_bin_symlinks(procmail_t) - - files_read_etc_files(procmail_t) - files_read_etc_runtime_files(procmail_t) -@@ -65,6 +80,9 @@ +@@ -65,6 +68,9 @@ libs_use_ld_so(procmail_t) libs_use_shared_libs(procmail_t) @@ -14514,7 +12271,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc miscfiles_read_localization(procmail_t) # only works until we define a different type for maildir -@@ -97,26 +115,31 @@ +@@ -97,21 +103,25 @@ ') optional_policy(` @@ -14542,13 +12299,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc ') optional_policy(` - mta_read_config(procmail_t) - sendmail_domtrans(procmail_t) -+ sendmail_signal(procmail_t) - sendmail_rw_tcp_sockets(procmail_t) - sendmail_rw_unix_stream_sockets(procmail_t) - ') -@@ -125,7 +148,12 @@ +@@ -125,7 +135,13 @@ corenet_udp_bind_generic_port(procmail_t) corenet_dontaudit_udp_bind_all_ports(procmail_t) @@ -14556,14 +12307,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc spamassassin_exec(procmail_t) spamassassin_exec_client(procmail_t) spamassassin_read_lib_files(procmail_t) - ') ++ ++') + +optional_policy(` + mailscanner_read_spool(procmail_t) -+') + ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.0.8/policy/modules/services/pyzor.if --- nsaserefpolicy/policy/modules/services/pyzor.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/pyzor.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/pyzor.if 2007-12-02 21:15:34.000000000 -0500 @@ -25,16 +25,16 @@ # template(`pyzor_per_role_template',` @@ -14588,7 +12340,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.0.8/policy/modules/services/pyzor.te --- nsaserefpolicy/policy/modules/services/pyzor.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/pyzor.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/pyzor.te 2007-12-31 15:18:29.000000000 -0500 @@ -68,6 +68,8 @@ miscfiles_read_localization(pyzor_t) @@ -14612,169 +12364,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/q serefpolicy-3.0.8/policy/modules/services/q ---- nsaserefpolicy/policy/modules/services/q 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/q 2008-04-04 16:11:03.000000000 -0400 -@@ -0,0 +1,156 @@ -+seinfo(1) seinfo(1) -+ -+ -+ -+NNAAMMEE -+ seinfo - SELinux policy query tool -+ -+SSYYNNOOPPSSIISS -+ sseeiinnffoo [OPTIONS] [EXPRESSION] [POLICY ...] -+ -+DDEESSCCRRIIPPTTIIOONN -+ sseeiinnffoo allows the user to query the components of a SELinux policy. -+ -+PPOOLLIICCYY -+ sseeiinnffoo supports loading a SELinux policy in one of four formats. -+ -+ source A single text file containing policy source for versions 12 -+ through 21. This file is usually named policy.conf. -+ -+ binary A single file containing a monolithic kernel binary policy for -+ versions 15 through 21. This file is usually named by version - -+ for example, policy.20. -+ -+ modular -+ A list of policy packages each containing a loadable policy mod- -+ ule. The first module listed must be a base module. -+ -+ policy list -+ A single text file containing all the information needed to load -+ a policy, usually exported by SETools graphical utilities. -+ -+ If no policy file is provided, sseeiinnffoo will search for the system -+ default policy: checking first for a source policy, next for a binary -+ policy matching the running kernel’s preferred version, and finally for -+ the highest version that can be found. If no policy can be found, -+ sseeiinnffoo will print an error message and exit. -+ -+EEXXPPRREESSSSIIOONNSS -+ One or more of the following component types can be queried. Each -+ option may only be specified once. If an option is provided multiple -+ times, the last instance will be used. Some components support the -x -+ flag to print expanded information about that component; if a particu- -+ lar component specified does not support expanded information, the flag -+ will be ignored for that component (see -x below). If no expressions -+ are provided, policy statistics will be printed (see --stats below). -+ -+ -c[NAME], --class[=NAME] -+ Print a list of object classes or, if NAME is provided, print -+ the object class NAME. With -x, print a list of permissions for -+ each displayed object class. -+ -+ --sensitivity[=NAME] -+ Print a list of sensitivities or, if NAME is provided, print the -+ sensitivity NAME. With -x, print the corresponding level state- -+ ment for each displayed sensitivity. -+ -+ --category[=NAME] -+ Print a list of categories or, if NAME is provided, print the -+ category NAME. With -x, print a list of sensitivities with -+ which each displayed category may be associated. -+ -+ -t[NAME], --type[=NAME] -+ Print a list of types (not including aliases or attributes) or, -+ if NAME is provided, print the type NAME. With -x, print a list -+ of attributes which include each displayed type. -+ -+ -a[NAME], --attribute[=NAME] -+ Print a list of type attributes or, if NAME is provided, print -+ the attribute NAME. With -x, print a list of types assigned to -+ each displayed attribute. -+ -+ -r[NAME], --role[=NAME] -+ Print a list of roles or, if NAME is provided, print the role -+ NAME. With -x, print a list of types assigned to each displayed -+ role. -+ -+ -u[NAME], --user[=NAME] -+ Print a list of users or, if NAME is provided, print the user -+ NAME. With -x, print a list of roles assigned to each displayed -+ user. -+ -+ -b[NAME], --bool[=NAME] -+ Print a list of conditional booleans or, if NAME is provided, -+ print the boolean NAME. With -x, print the default state of -+ each displayed conditional boolean. -+ -+ --initialsid[=NAME] -+ Print a list of initial SIDs or, if NAME is provided, print the -+ initial SID NAME. With -x, print the context assigned to each -+ displayed SID. -+ -+ --fs_use[=TYPE] -+ Print a list of fs_use statements or, if TYPE is provided, print -+ the statement for filesystem TYPE. There is no expanded infor- -+ mation for this component. -+ -+ --genfscon[=TYPE] -+ Print a list of genfscon statements or, if TYPE is provided, -+ print the statement for the filesystem TYPE. There is no -+ expanded information for this component. -+ -+ --netifcon[=NAME] -+ Print a list of netif contexts or, if NAME is provided, print -+ the statement for interface NAME. There is no expanded informa- -+ tion for this component. -+ -+ --nodecon[=ADDR] -+ Print a list of node contexts or, if ADDR is provided, print the -+ statement for the node with address ADDR. There is no expanded -+ information for this component. -+ -+ --portcon[=PORT] -+ Print a list of port contexts or, if PORT is provided, print the -+ statement for port PORT. There is no expanded information for -+ this component. -+ -+ --protocol=PROTO -+ Print only portcon statements for the protocol PROTO. This -+ option is ignored if portcon statements are not printed or if no -+ statement exists for the requested port. -+ -+ --all Print all components. -+ -+OOPPTTIIOONNSS -+ -x, --expand -+ Print additional details for each component matching the expres- -+ sion. These details include the types assigned to an attribute -+ or role and the permissions for an object class. This option is -+ not available for all component types; see the description of -+ each component for the details this option will provide. -+ -+ --stats -+ Print policy statistics including policy type and version infor- -+ mation and counts of all components and rules. -+ -+ -h, --help -+ Print help information and exit. -+ -+ -V, --version -+ Print version information and exit. -+ -+AAUUTTHHOORR -+ This manual page was written by Jeremy A. Mowery . -+ -+CCOOPPYYRRIIGGHHTT -+ Copyright(C) 2003-2007 Tresys Technology, LLC -+ -+BBUUGGSS -+ Please report bugs via an email to setools-bugs@tresys.com. -+ -+SSEEEE AALLSSOO -+ sesearch(1), apol(1) -+ -+ -+ -+ seinfo(1) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.fc serefpolicy-3.0.8/policy/modules/services/radius.fc --- nsaserefpolicy/policy/modules/services/radius.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/radius.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/radius.fc 2007-12-02 21:15:34.000000000 -0500 @@ -18,3 +18,4 @@ /var/run/radiusd(/.*)? gen_context(system_u:object_r:radiusd_var_run_t,s0) @@ -14782,7 +12374,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi +/var/lib/radiousd(/.*)? gen_context(system_u:object_r:radiusd_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.0.8/policy/modules/services/radius.te --- nsaserefpolicy/policy/modules/services/radius.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/radius.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/radius.te 2007-12-02 21:15:34.000000000 -0500 @@ -19,6 +19,9 @@ type radiusd_log_t; logging_log_file(radiusd_log_t) @@ -14818,20 +12410,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi corecmd_exec_bin(radiusd_t) corecmd_exec_shell(radiusd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radvd.te serefpolicy-3.0.8/policy/modules/services/radvd.te ---- nsaserefpolicy/policy/modules/services/radvd.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/radvd.te 2008-04-04 17:59:24.000000000 -0400 -@@ -27,6 +27,7 @@ - allow radvd_t self:rawip_socket create_socket_perms; - allow radvd_t self:tcp_socket create_stream_socket_perms; - allow radvd_t self:udp_socket create_socket_perms; -+allow radvd_t self:fifo_file rw_file_perms; - - allow radvd_t radvd_etc_t:file read_file_perms; - diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razor.if serefpolicy-3.0.8/policy/modules/services/razor.if --- nsaserefpolicy/policy/modules/services/razor.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/razor.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/razor.if 2007-12-02 21:15:34.000000000 -0500 @@ -218,3 +218,41 @@ domtrans_pattern($1, razor_exec_t, razor_t) @@ -14872,11 +12453,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/razo + files_search_home($2) + allow $2 $1_home_dir_t:dir search_dir_perms; + manage_files_pattern($2,$1_razor_home_t,$1_razor_home_t) -+ read_lnk_files_pattern($2,$1_razor_home_t,$1_razor_home_t) +') ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remotelogin.if serefpolicy-3.0.8/policy/modules/services/remotelogin.if --- nsaserefpolicy/policy/modules/services/remotelogin.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/remotelogin.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/remotelogin.if 2007-12-02 21:15:34.000000000 -0500 @@ -18,3 +18,20 @@ auth_domtrans_login_program($1,remote_login_t) ') @@ -14900,7 +12481,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remo +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remotelogin.te serefpolicy-3.0.8/policy/modules/services/remotelogin.te --- nsaserefpolicy/policy/modules/services/remotelogin.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/remotelogin.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/remotelogin.te 2007-12-02 21:15:34.000000000 -0500 @@ -85,6 +85,7 @@ miscfiles_read_localization(remote_login_t) @@ -14911,7 +12492,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/remo # Only permit unprivileged user domains to be entered via rlogin, diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-3.0.8/policy/modules/services/rhgb.te --- nsaserefpolicy/policy/modules/services/rhgb.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rhgb.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/rhgb.te 2007-12-02 21:15:34.000000000 -0500 @@ -59,6 +59,7 @@ corenet_sendrecv_all_client_packets(rhgb_t) @@ -14962,7 +12543,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb consoletype_exec(rhgb_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.0.8/policy/modules/services/ricci.te --- nsaserefpolicy/policy/modules/services/ricci.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ricci.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ricci.te 2007-12-02 21:15:34.000000000 -0500 @@ -138,6 +138,7 @@ files_create_boot_flag(ricci_t) @@ -15011,7 +12592,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.0.8/policy/modules/services/rlogin.te --- nsaserefpolicy/policy/modules/services/rlogin.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rlogin.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/rlogin.te 2007-12-02 21:15:34.000000000 -0500 @@ -36,6 +36,8 @@ allow rlogind_t rlogind_devpts_t:chr_file { rw_chr_file_perms setattr }; term_create_pty(rlogind_t,rlogind_devpts_t) @@ -15059,9 +12640,35 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog -allow rlogind_t userpty_type:chr_file setattr; + kerberos_manage_host_rcache(rlogind_t) ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.0.8/policy/modules/services/rpcbind.te +--- nsaserefpolicy/policy/modules/services/rpcbind.te 2007-10-22 13:21:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/rpcbind.te 2007-12-13 08:21:32.000000000 -0500 +@@ -21,11 +21,13 @@ + # rpcbind local policy + # + +-allow rpcbind_t self:capability setuid; ++allow rpcbind_t self:capability { dac_override setuid sys_tty_config }; + allow rpcbind_t self:fifo_file rw_file_perms; + allow rpcbind_t self:unix_stream_socket create_stream_socket_perms; + allow rpcbind_t self:netlink_route_socket r_netlink_socket_perms; + allow rpcbind_t self:udp_socket create_socket_perms; ++# BROKEN ... ++dontaudit rpcbind_t self:udp_socket listen; + allow rpcbind_t self:tcp_socket create_stream_socket_perms; + + manage_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t) +@@ -37,6 +39,7 @@ + manage_sock_files_pattern(rpcbind_t,rpcbind_var_lib_t,rpcbind_var_lib_t) + files_var_lib_filetrans(rpcbind_t,rpcbind_var_lib_t, { file dir sock_file }) + ++kernel_read_system_state(rpcbind_t) + kernel_read_network_state(rpcbind_t) + + corenet_all_recvfrom_unlabeled(rpcbind_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.0.8/policy/modules/services/rpc.if --- nsaserefpolicy/policy/modules/services/rpc.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rpc.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/rpc.if 2007-12-02 21:15:34.000000000 -0500 @@ -89,8 +89,11 @@ # bind to arbitary unused ports corenet_tcp_bind_generic_port($1_t) @@ -15102,7 +12709,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.8/policy/modules/services/rpc.te --- nsaserefpolicy/policy/modules/services/rpc.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rpc.te 2008-04-17 13:41:16.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/rpc.te 2008-01-08 06:23:55.000000000 -0500 @@ -59,10 +59,14 @@ manage_files_pattern(rpcd_t,rpcd_var_run_t,rpcd_var_run_t) files_pid_filetrans(rpcd_t,rpcd_var_run_t,file) @@ -15119,7 +12726,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. fs_list_rpc(rpcd_t) fs_read_rpc_files(rpcd_t) -@@ -73,12 +77,22 @@ +@@ -73,12 +77,21 @@ # cjp: this should really have its own type files_manage_mounttab(rpcd_t) @@ -15138,17 +12745,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. +# automount -> mount -> rpcd +optional_policy(` + automount_dontaudit_use_fds(rpcd_t) -+ automount_dontaudit_write_pipes(rpcd_t) ') ######################################## -@@ -91,9 +105,15 @@ +@@ -91,9 +104,15 @@ allow nfsd_t exports_t:file { getattr read }; allow nfsd_t { nfsd_rw_t nfsd_ro_t }:dir list_dir_perms; +dev_dontaudit_getattr_all_blk_files(nfsd_t) +dev_dontaudit_getattr_all_chr_files(nfsd_t) -+dev_rw_lvm_control(nfsd_t) ++dev_read_lvm_control(nfsd_t) +storage_dontaudit_raw_read_fixed_disk(nfsd_t) + # for /proc/fs/nfs/exports - should we have a new type? @@ -15158,15 +12764,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. corenet_tcp_bind_all_rpc_ports(nfsd_t) corenet_udp_bind_all_rpc_ports(nfsd_t) -@@ -102,6 +122,7 @@ - fs_search_nfsd_fs(nfsd_t) - fs_getattr_all_fs(nfsd_t) - fs_rw_nfsd_fs(nfsd_t) -+fs_search_all(nfsd_t) - - term_use_controlling_term(nfsd_t) - -@@ -123,6 +144,7 @@ +@@ -123,6 +142,7 @@ tunable_policy(`nfs_export_all_rw',` fs_read_noxattr_fs_files(nfsd_t) auth_manage_all_files_except_shadow(nfsd_t) @@ -15174,7 +12772,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. ') tunable_policy(`nfs_export_all_ro',` -@@ -143,6 +165,9 @@ +@@ -143,6 +163,9 @@ manage_files_pattern(gssd_t,gssd_tmp_t,gssd_tmp_t) files_tmp_filetrans(gssd_t, gssd_tmp_t, { file dir }) @@ -15184,7 +12782,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. kernel_read_network_state(gssd_t) kernel_read_network_state_symlinks(gssd_t) kernel_search_network_sysctl(gssd_t) -@@ -158,6 +183,9 @@ +@@ -158,6 +181,9 @@ miscfiles_read_certs(gssd_t) @@ -15194,35 +12792,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. tunable_policy(`allow_gssd_read_tmp',` userdom_list_unpriv_users_tmp(gssd_t) userdom_read_unpriv_users_tmp_files(gssd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpcbind.te serefpolicy-3.0.8/policy/modules/services/rpcbind.te ---- nsaserefpolicy/policy/modules/services/rpcbind.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rpcbind.te 2008-04-04 16:11:03.000000000 -0400 -@@ -21,11 +21,13 @@ - # rpcbind local policy - # - --allow rpcbind_t self:capability setuid; -+allow rpcbind_t self:capability { dac_override setuid sys_tty_config }; - allow rpcbind_t self:fifo_file rw_file_perms; - allow rpcbind_t self:unix_stream_socket create_stream_socket_perms; - allow rpcbind_t self:netlink_route_socket r_netlink_socket_perms; - allow rpcbind_t self:udp_socket create_socket_perms; -+# BROKEN ... -+dontaudit rpcbind_t self:udp_socket listen; - allow rpcbind_t self:tcp_socket create_stream_socket_perms; - - manage_files_pattern(rpcbind_t,rpcbind_var_run_t,rpcbind_var_run_t) -@@ -37,6 +39,7 @@ - manage_sock_files_pattern(rpcbind_t,rpcbind_var_lib_t,rpcbind_var_lib_t) - files_var_lib_filetrans(rpcbind_t,rpcbind_var_lib_t, { file dir sock_file }) - -+kernel_read_system_state(rpcbind_t) - kernel_read_network_state(rpcbind_t) - - corenet_all_recvfrom_unlabeled(rpcbind_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.0.8/policy/modules/services/rshd.te --- nsaserefpolicy/policy/modules/services/rshd.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rshd.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/rshd.te 2007-12-02 21:15:34.000000000 -0500 @@ -16,10 +16,11 @@ # # Local policy @@ -15311,7 +12883,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.fc serefpolicy-3.0.8/policy/modules/services/rsync.fc --- nsaserefpolicy/policy/modules/services/rsync.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rsync.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/rsync.fc 2007-12-02 21:15:34.000000000 -0500 @@ -1,2 +1,4 @@ /usr/bin/rsync -- gen_context(system_u:object_r:rsync_exec_t,s0) @@ -15319,7 +12891,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn +/var/log/rsync.log -- gen_context(system_u:object_r:rsync_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.0.8/policy/modules/services/rsync.te --- nsaserefpolicy/policy/modules/services/rsync.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/rsync.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/rsync.te 2007-12-02 21:15:34.000000000 -0500 @@ -8,6 +8,13 @@ ## @@ -15416,7 +12988,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.0.8/policy/modules/services/samba.fc --- nsaserefpolicy/policy/modules/services/samba.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/samba.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/samba.fc 2007-12-02 21:15:34.000000000 -0500 @@ -15,6 +15,7 @@ /usr/bin/ntlm_auth -- gen_context(system_u:object_r:winbind_helper_exec_t,s0) /usr/bin/smbmount -- gen_context(system_u:object_r:smbmount_exec_t,s0) @@ -15424,97 +12996,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +/usr/bin/smbcontrol -- gen_context(system_u:object_r:smbcontrol_exec_t,s0) /usr/sbin/swat -- gen_context(system_u:object_r:swat_exec_t,s0) - /usr/sbin/nmbd -- gen_context(system_u:object_r:nmbd_exec_t,s0) -@@ -30,6 +31,8 @@ - /var/lib/samba(/.*)? gen_context(system_u:object_r:samba_var_t,s0) - /var/lib/samba/winbindd_privileged(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0) - -+/var/lib/samba/scripts(/.*)? gen_context(system_u:object_r:samba_unconfined_script_exec_t,s0) -+ - /var/log/samba(/.*)? gen_context(system_u:object_r:samba_log_t,s0) - - /var/run/samba/brlock\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.0.8/policy/modules/services/samba.if ---- nsaserefpolicy/policy/modules/services/samba.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/samba.if 2008-04-21 13:18:16.053295000 -0400 -@@ -33,8 +33,8 @@ - ') - - tunable_policy(`samba_enable_home_dirs',` -- userdom_manage_user_home_content_dirs($1,smbd_t) -- userdom_manage_user_home_content_files($1,smbd_t) -+ userdom_manage_unpriv_users_home_content_dirs(smbd_t) -+ userdom_manage_unpriv_users_home_content_files(smbd_t) - userdom_manage_user_home_content_symlinks($1,smbd_t) - userdom_manage_user_home_content_sockets($1,smbd_t) - userdom_manage_user_home_content_pipes($1,smbd_t) -@@ -63,6 +63,25 @@ - - ######################################## - ## -+## Execute samba net in the samba_unconfined_net domain. -+## -+## -+## -+## The type of the process performing this action. -+## -+## -+# -+interface(`samba_domtrans_unconfined_net',` -+ gen_require(` -+ type samba_unconfined_net_t, samba_net_exec_t; -+ ') -+ -+ corecmd_search_bin($1) -+ domtrans_pattern($1,samba_net_exec_t,samba_unconfined_net_t) -+') -+ -+######################################## -+## - ## Execute samba net in the samba_net domain, and - ## allow the specified role the samba_net domain. - ## -@@ -93,6 +112,39 @@ - allow samba_net_t $3:chr_file rw_term_perms; - ') - -+ -+######################################## -+## -+## Execute samba net in the samba_unconfined_net domain, and -+## allow the specified role the samba_unconfined_net domain. -+## -+## -+## -+## The type of the process performing this action. -+## -+## -+## -+## -+## The role to be allowed the samba_unconfined_net domain. -+## -+## -+## -+## -+## The type of the terminal allow the samba_unconfined_net domain to use. -+## -+## -+## -+# -+interface(`samba_run_unconfined_net',` -+ gen_require(` -+ type samba_unconfined_net_t; -+ ') -+ -+ samba_domtrans_unconfined_net($1) -+ role $2 types samba_unconfined_net_t; -+ allow samba_unconfined_net_t $3:chr_file rw_term_perms; -+') + /usr/sbin/nmbd -- gen_context(system_u:object_r:nmbd_exec_t,s0) +@@ -30,6 +31,8 @@ + /var/lib/samba(/.*)? gen_context(system_u:object_r:samba_var_t,s0) + /var/lib/samba/winbindd_privileged(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0) + ++/var/lib/samba/scripts(/.*)? gen_context(system_u:object_r:samba_unconfined_script_exec_t,s0) + - ######################################## - ## - ## Execute smbmount in the smbmount domain. -@@ -332,6 +384,25 @@ + /var/log/samba(/.*)? gen_context(system_u:object_r:samba_log_t,s0) + + /var/run/samba/brlock\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.0.8/policy/modules/services/samba.if +--- nsaserefpolicy/policy/modules/services/samba.if 2007-10-22 13:21:36.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/samba.if 2008-05-07 14:20:59.000000000 -0400 +@@ -332,6 +332,25 @@ ######################################## ## @@ -15540,7 +13035,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ## Allow the specified domain to ## read and write samba /var files. ## -@@ -349,6 +420,7 @@ +@@ -349,6 +368,7 @@ files_search_var($1) files_search_var_lib($1) manage_files_pattern($1,samba_var_t,samba_var_t) @@ -15548,7 +13043,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ') ######################################## -@@ -421,6 +493,7 @@ +@@ -421,6 +441,7 @@ ') domtrans_pattern($1,winbind_helper_exec_t,winbind_helper_t) @@ -15556,7 +13051,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ') ######################################## -@@ -493,3 +566,103 @@ +@@ -493,3 +514,103 @@ allow $1 samba_var_t:dir search_dir_perms; stream_connect_pattern($1,winbind_var_run_t,winbind_var_run_t,winbind_t) ') @@ -15662,7 +13157,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.0.8/policy/modules/services/samba.te --- nsaserefpolicy/policy/modules/services/samba.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/samba.te 2008-04-06 07:25:44.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/samba.te 2008-05-07 14:17:56.000000000 -0400 @@ -137,6 +137,11 @@ type winbind_var_run_t; files_pid_file(winbind_var_run_t) @@ -15692,7 +13187,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb kernel_read_proc_symlinks(samba_net_t) corenet_all_recvfrom_unlabeled(samba_net_t) -@@ -190,19 +196,15 @@ +@@ -190,8 +196,7 @@ miscfiles_read_localization(samba_net_t) @@ -15701,9 +13196,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +samba_read_var_files(samba_net_t) userdom_dontaudit_search_sysadm_home_dirs(samba_net_t) -+userdom_list_all_users_home_dirs(samba_net_t) - optional_policy(` +@@ -199,10 +204,6 @@ kerberos_use(samba_net_t) ') @@ -15714,7 +13208,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ######################################## # # smbd Local policy -@@ -217,19 +219,16 @@ +@@ -217,19 +218,16 @@ allow smbd_t self:msgq create_msgq_perms; allow smbd_t self:sem create_sem_perms; allow smbd_t self:shm create_shm_perms; @@ -15737,7 +13231,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow smbd_t samba_net_tmp_t:file getattr; -@@ -239,6 +238,7 @@ +@@ -239,6 +237,7 @@ manage_dirs_pattern(smbd_t,samba_share_t,samba_share_t) manage_files_pattern(smbd_t,samba_share_t,samba_share_t) manage_lnk_files_pattern(smbd_t,samba_share_t,samba_share_t) @@ -15745,7 +13239,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb manage_dirs_pattern(smbd_t,samba_var_t,samba_var_t) manage_files_pattern(smbd_t,samba_var_t,samba_var_t) -@@ -256,7 +256,7 @@ +@@ -256,7 +255,7 @@ manage_sock_files_pattern(smbd_t,smbd_var_run_t,smbd_var_run_t) files_pid_filetrans(smbd_t,smbd_var_run_t,file) @@ -15754,7 +13248,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb kernel_getattr_core_if(smbd_t) kernel_getattr_message_if(smbd_t) -@@ -292,12 +292,13 @@ +@@ -292,12 +291,13 @@ fs_getattr_all_fs(smbd_t) fs_get_xattr_fs_quotas(smbd_t) @@ -15770,7 +13264,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb domain_use_interactive_fds(smbd_t) domain_dontaudit_list_all_domains_state(smbd_t) -@@ -321,12 +322,12 @@ +@@ -321,8 +321,6 @@ miscfiles_read_localization(smbd_t) miscfiles_read_public_files(smbd_t) @@ -15779,13 +13273,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb userdom_dontaudit_search_sysadm_home_dirs(smbd_t) userdom_dontaudit_use_unpriv_user_fds(smbd_t) userdom_use_unpriv_users_fds(smbd_t) - -+term_use_ptmx(smbd_t) -+ - ifdef(`hide_broken_symptoms', ` - files_dontaudit_getattr_default_dirs(smbd_t) - files_dontaudit_getattr_boot_dirs(smbd_t) -@@ -347,6 +348,17 @@ +@@ -347,6 +345,17 @@ tunable_policy(`samba_share_nfs',` fs_manage_nfs_dirs(smbd_t) fs_manage_nfs_files(smbd_t) @@ -15803,7 +13291,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ') optional_policy(` -@@ -398,7 +410,7 @@ +@@ -398,7 +407,7 @@ allow nmbd_t self:msgq create_msgq_perms; allow nmbd_t self:sem create_sem_perms; allow nmbd_t self:shm create_shm_perms; @@ -15812,7 +13300,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow nmbd_t self:tcp_socket create_stream_socket_perms; allow nmbd_t self:udp_socket create_socket_perms; allow nmbd_t self:unix_dgram_socket { create_socket_perms sendto }; -@@ -410,8 +422,7 @@ +@@ -410,8 +419,7 @@ read_files_pattern(nmbd_t,samba_etc_t,samba_etc_t) manage_dirs_pattern(nmbd_t,samba_log_t,samba_log_t) @@ -15822,7 +13310,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb read_files_pattern(nmbd_t,samba_log_t,samba_log_t) create_files_pattern(nmbd_t,samba_log_t,samba_log_t) -@@ -421,6 +432,8 @@ +@@ -421,6 +429,8 @@ allow nmbd_t smbd_var_run_t:dir rw_dir_perms; @@ -15831,7 +13319,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb kernel_getattr_core_if(nmbd_t) kernel_getattr_message_if(nmbd_t) kernel_read_kernel_sysctls(nmbd_t) -@@ -446,6 +459,7 @@ +@@ -446,6 +456,7 @@ dev_getattr_mtrr_dev(nmbd_t) fs_getattr_all_fs(nmbd_t) @@ -15839,7 +13327,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb fs_search_auto_mountpoints(nmbd_t) domain_use_interactive_fds(nmbd_t) -@@ -462,17 +476,11 @@ +@@ -462,17 +473,11 @@ miscfiles_read_localization(nmbd_t) @@ -15857,7 +13345,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb seutil_sigchld_newrole(nmbd_t) ') -@@ -506,6 +514,8 @@ +@@ -506,6 +511,8 @@ manage_lnk_files_pattern(smbmount_t,samba_var_t,samba_var_t) files_list_var_lib(smbmount_t) @@ -15866,7 +13354,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb kernel_read_system_state(smbmount_t) corenet_all_recvfrom_unlabeled(smbmount_t) -@@ -533,6 +543,7 @@ +@@ -533,6 +540,7 @@ storage_raw_write_fixed_disk(smbmount_t) term_list_ptys(smbmount_t) @@ -15874,7 +13362,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb corecmd_list_bin(smbmount_t) -@@ -553,16 +564,11 @@ +@@ -553,16 +561,11 @@ logging_search_logs(smbmount_t) @@ -15893,7 +13381,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ') ######################################## -@@ -570,24 +576,28 @@ +@@ -570,24 +573,28 @@ # SWAT Local policy # @@ -15930,7 +13418,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow swat_t smbd_var_run_t:file read; manage_dirs_pattern(swat_t,swat_tmp_t,swat_tmp_t) -@@ -597,7 +607,11 @@ +@@ -597,7 +604,11 @@ manage_files_pattern(swat_t,swat_var_run_t,swat_var_run_t) files_pid_filetrans(swat_t,swat_var_run_t,file) @@ -15943,7 +13431,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb kernel_read_kernel_sysctls(swat_t) kernel_read_system_state(swat_t) -@@ -622,23 +636,24 @@ +@@ -622,23 +633,24 @@ dev_read_urand(swat_t) @@ -15970,7 +13458,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb optional_policy(` cups_read_rw_config(swat_t) cups_stream_connect(swat_t) -@@ -652,13 +667,16 @@ +@@ -652,13 +664,16 @@ kerberos_use(swat_t) ') @@ -15993,7 +13481,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ######################################## # -@@ -672,7 +690,6 @@ +@@ -672,7 +687,6 @@ allow winbind_t self:fifo_file { read write }; allow winbind_t self:unix_dgram_socket create_socket_perms; allow winbind_t self:unix_stream_socket create_stream_socket_perms; @@ -16001,7 +13489,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb allow winbind_t self:tcp_socket create_stream_socket_perms; allow winbind_t self:udp_socket create_socket_perms; -@@ -709,6 +726,8 @@ +@@ -709,6 +723,8 @@ manage_sock_files_pattern(winbind_t,winbind_var_run_t,winbind_var_run_t) files_pid_filetrans(winbind_t,winbind_var_run_t,file) @@ -16010,7 +13498,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb kernel_read_kernel_sysctls(winbind_t) kernel_list_proc(winbind_t) kernel_read_proc_symlinks(winbind_t) -@@ -733,7 +752,9 @@ +@@ -733,7 +749,9 @@ fs_getattr_all_fs(winbind_t) fs_search_auto_mountpoints(winbind_t) @@ -16020,7 +13508,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb domain_use_interactive_fds(winbind_t) -@@ -746,9 +767,6 @@ +@@ -746,9 +764,6 @@ miscfiles_read_localization(winbind_t) @@ -16030,7 +13518,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb userdom_dontaudit_use_unpriv_user_fds(winbind_t) userdom_dontaudit_search_sysadm_home_dirs(winbind_t) userdom_priveleged_home_dir_manager(winbind_t) -@@ -758,10 +776,6 @@ +@@ -758,10 +773,6 @@ ') optional_policy(` @@ -16041,7 +13529,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb seutil_sigchld_newrole(winbind_t) ') -@@ -784,6 +798,8 @@ +@@ -784,6 +795,8 @@ allow winbind_helper_t samba_var_t:dir search; files_list_var_lib(winbind_helper_t) @@ -16050,7 +13538,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb stream_connect_pattern(winbind_helper_t,winbind_var_run_t,winbind_var_run_t,winbind_t) term_list_ptys(winbind_helper_t) -@@ -798,12 +814,13 @@ +@@ -798,12 +811,13 @@ miscfiles_read_localization(winbind_helper_t) optional_policy(` @@ -16065,21 +13553,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb ') ######################################## -@@ -812,6 +829,13 @@ - # - - optional_policy(` -+ type samba_unconfined_net_t; -+ domain_type(samba_unconfined_net_t) -+ unconfined_domain(samba_unconfined_net_t) -+ role system_r types samba_unconfined_net_t; -+ manage_files_pattern(samba_unconfined_net_t,samba_etc_t,samba_secrets_t) -+ filetrans_pattern(samba_unconfined_net_t,samba_etc_t,samba_secrets_t,file) -+ - type samba_unconfined_script_t; - type samba_unconfined_script_exec_t; - domain_type(samba_unconfined_script_t) -@@ -828,3 +852,37 @@ +@@ -828,3 +842,38 @@ domtrans_pattern(smbd_t, samba_unconfined_script_exec_t, samba_unconfined_script_t) ') ') @@ -16117,9 +13591,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb +allow winbind_t smbcontrol_t:process signal; + +allow smbcontrol_t nmbd_var_run_t:file { read lock }; ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.0.8/policy/modules/services/sasl.te --- nsaserefpolicy/policy/modules/services/sasl.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/sasl.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/sasl.te 2007-12-02 21:15:34.000000000 -0500 @@ -1,5 +1,5 @@ -policy_module(sasl,1.6.0) @@ -16148,7 +13623,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.0.8/policy/modules/services/sendmail.if --- nsaserefpolicy/policy/modules/services/sendmail.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/sendmail.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/sendmail.if 2007-12-02 21:15:34.000000000 -0500 @@ -149,3 +149,85 @@ logging_log_filetrans($1,sendmail_log_t,file) @@ -16237,7 +13712,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.te serefpolicy-3.0.8/policy/modules/services/sendmail.te --- nsaserefpolicy/policy/modules/services/sendmail.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/sendmail.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/sendmail.te 2008-01-14 11:54:37.000000000 -0500 @@ -20,19 +20,22 @@ mta_mailserver_delivery(sendmail_t) mta_mailserver_sender(sendmail_t) @@ -16254,7 +13729,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send -allow sendmail_t self:capability { setuid setgid net_bind_service sys_nice chown sys_tty_config }; -allow sendmail_t self:process signal; +allow sendmail_t self:capability { dac_override setuid setgid net_bind_service sys_nice chown sys_tty_config }; -+allow sendmail_t self:process { setrlimit signal signull }; ++allow sendmail_t self:process { signal signull }; allow sendmail_t self:fifo_file rw_fifo_file_perms; allow sendmail_t self:unix_stream_socket create_stream_socket_perms; allow sendmail_t self:unix_dgram_socket create_socket_perms; @@ -16274,7 +13749,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send corenet_all_recvfrom_unlabeled(sendmail_t) corenet_all_recvfrom_netlabel(sendmail_t) -@@ -66,14 +72,18 @@ +@@ -66,10 +72,13 @@ fs_getattr_all_fs(sendmail_t) fs_search_auto_mountpoints(sendmail_t) @@ -16288,25 +13763,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send domain_use_interactive_fds(sendmail_t) - files_read_etc_files(sendmail_t) -+files_read_usr_files(sendmail_t) - files_search_spool(sendmail_t) - # for piping mail to a command - files_read_etc_runtime_files(sendmail_t) -@@ -83,6 +93,7 @@ - # sendmail wants to read /var/run/utmp if the controlling tty is /dev/console - init_read_utmp(sendmail_t) - init_dontaudit_write_utmp(sendmail_t) -+init_rw_script_tmp_files(sendmail_t) - - libs_use_ld_so(sendmail_t) - libs_use_shared_libs(sendmail_t) -@@ -90,34 +101,39 @@ - libs_read_lib_files(sendmail_t) - - logging_send_syslog_msg(sendmail_t) -+logging_dontaudit_write_generic_logs(sendmail_t) - +@@ -94,30 +103,34 @@ miscfiles_read_certs(sendmail_t) miscfiles_read_localization(sendmail_t) @@ -16347,19 +13804,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send ') optional_policy(` -@@ -128,6 +144,11 @@ +@@ -131,28 +144,33 @@ + ') optional_policy(` - procmail_domtrans(sendmail_t) -+ procmail_rw_tmp_files(sendmail_t) ++ rhgb_use_ptys(sendmail_t) +') + +optional_policy(` -+ rhgb_use_ptys(sendmail_t) - ') - - optional_policy(` -@@ -135,24 +156,25 @@ + seutil_sigchld_newrole(sendmail_t) ') optional_policy(` @@ -16403,23 +13856,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send -') dnl end TODO diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.8/policy/modules/services/setroubleshoot.te --- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/setroubleshoot.te 2008-04-04 16:11:03.000000000 -0400 -@@ -1,5 +1,5 @@ - --policy_module(setroubleshoot,1.4.1) -+policy_module(setroubleshoot,1.6.0) - - ######################################## - # -@@ -22,13 +22,16 @@ - type setroubleshoot_var_run_t; - files_pid_file(setroubleshoot_var_run_t) - -+type setroubleshoot_script_exec_t; -+init_script_type(setroubleshoot_script_exec_t) -+ - ######################################## - # ++++ serefpolicy-3.0.8/policy/modules/services/setroubleshoot.te 2008-01-08 06:17:14.000000000 -0500 +@@ -27,8 +27,8 @@ # setroubleshootd local policy # @@ -16430,17 +13868,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr allow setroubleshootd_t self:fifo_file rw_fifo_file_perms; allow setroubleshootd_t self:tcp_socket create_stream_socket_perms; allow setroubleshootd_t self:unix_stream_socket { create_stream_socket_perms connectto }; -@@ -52,7 +55,9 @@ - +@@ -53,6 +53,8 @@ kernel_read_kernel_sysctls(setroubleshootd_t) kernel_read_system_state(setroubleshootd_t) -+kernel_read_net_sysctls(setroubleshootd_t) kernel_read_network_state(setroubleshootd_t) ++kernel_read_net_sysctls(setroubleshootd_t) +kernel_dontaudit_list_all_proc(setroubleshootd_t) corecmd_exec_bin(setroubleshootd_t) corecmd_exec_shell(setroubleshootd_t) -@@ -67,16 +72,24 @@ +@@ -67,13 +69,18 @@ corenet_sendrecv_smtp_client_packets(setroubleshootd_t) dev_read_urand(setroubleshootd_t) @@ -16460,53 +13897,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr fs_getattr_all_dirs(setroubleshootd_t) fs_getattr_all_files(setroubleshootd_t) -+fs_read_fusefs_symlinks(setroubleshootd_t) -+fs_dontaudit_read_nfs_files(setroubleshootd_t) -+fs_dontaudit_read_cifs_files(setroubleshootd_t) - - selinux_get_enforce_mode(setroubleshootd_t) - selinux_validate_context(setroubleshootd_t) -@@ -96,17 +109,23 @@ - - locallogin_dontaudit_use_fds(setroubleshootd_t) - -+logging_send_audit_msgs(setroubleshootd_t) - logging_send_syslog_msg(setroubleshootd_t) --logging_stream_connect_auditd(setroubleshootd_t) -+logging_stream_connect_audisp(setroubleshootd_t) - - seutil_read_config(setroubleshootd_t) - seutil_read_file_contexts(setroubleshootd_t) -- --sysnet_read_config(setroubleshootd_t) -+seutil_read_bin_policy(setroubleshootd_t) - - userdom_dontaudit_read_sysadm_home_content_files(setroubleshootd_t) - - optional_policy(` +@@ -111,3 +118,11 @@ + rpm_dontaudit_manage_db(setroubleshootd_t) + rpm_use_script_fds(setroubleshootd_t) + ') ++ ++optional_policy(` + dbus_system_bus_client_template(setroubleshootd, setroubleshootd_t) ++ dbus_send_system_bus(setroubleshootd_t) + dbus_connect_system_bus(setroubleshootd_t) + dbus_system_domain(setroubleshootd_t,setroubleshootd_exec_t) +') + -+optional_policy(` - rpm_read_db(setroubleshootd_t) - rpm_dontaudit_manage_db(setroubleshootd_t) - rpm_use_script_fds(setroubleshootd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.0.8/policy/modules/services/smartmon.te ---- nsaserefpolicy/policy/modules/services/smartmon.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/smartmon.te 2008-04-04 16:11:03.000000000 -0400 -@@ -49,6 +49,7 @@ - corenet_udp_sendrecv_all_ports(fsdaemon_t) - - dev_read_sysfs(fsdaemon_t) -+dev_read_urand(fsdaemon_t) - - domain_use_interactive_fds(fsdaemon_t) - diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.0.8/policy/modules/services/snmp.te --- nsaserefpolicy/policy/modules/services/snmp.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/snmp.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/snmp.te 2007-12-02 21:15:34.000000000 -0500 @@ -81,8 +81,7 @@ files_read_usr_files(snmpd_t) files_read_etc_runtime_files(snmpd_t) @@ -16519,7 +13924,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp fs_getattr_all_fs(snmpd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.fc serefpolicy-3.0.8/policy/modules/services/soundserver.fc --- nsaserefpolicy/policy/modules/services/soundserver.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/soundserver.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/soundserver.fc 2007-12-02 21:15:34.000000000 -0500 @@ -1,10 +1,16 @@ -/etc/nas(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0) -/etc/yiff(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0) @@ -16545,7 +13950,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun +/usr/bin/nasd -- gen_context(system_u:object_r:soundd_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.if serefpolicy-3.0.8/policy/modules/services/soundserver.if --- nsaserefpolicy/policy/modules/services/soundserver.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/soundserver.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/soundserver.if 2007-12-02 21:15:34.000000000 -0500 @@ -13,3 +13,64 @@ interface(`soundserver_tcp_connect',` refpolicywarn(`$0($*) has been deprecated.') @@ -16613,7 +14018,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soundserver.te serefpolicy-3.0.8/policy/modules/services/soundserver.te --- nsaserefpolicy/policy/modules/services/soundserver.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/soundserver.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/soundserver.te 2007-12-02 21:15:34.000000000 -0500 @@ -10,9 +10,6 @@ type soundd_exec_t; init_daemon_domain(soundd_t,soundd_exec_t) @@ -16679,7 +14084,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/soun diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.0.8/policy/modules/services/spamassassin.fc --- nsaserefpolicy/policy/modules/services/spamassassin.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/spamassassin.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/spamassassin.fc 2008-01-14 11:58:07.000000000 -0500 @@ -11,6 +11,7 @@ /var/run/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) @@ -16690,7 +14095,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam /var/spool/spamd(/.*)? gen_context(system_u:object_r:spamd_spool_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.if serefpolicy-3.0.8/policy/modules/services/spamassassin.if --- nsaserefpolicy/policy/modules/services/spamassassin.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/spamassassin.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/spamassassin.if 2008-01-04 09:49:16.000000000 -0500 @@ -286,6 +286,12 @@ userdom_manage_user_home_content_symlinks($1,spamd_t) ') @@ -16712,7 +14117,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam read_files_pattern($1,spamd_var_lib_t,spamd_var_lib_t) ') -@@ -531,3 +538,90 @@ +@@ -531,3 +538,89 @@ dontaudit $1 spamd_tmp_t:sock_file getattr; ') @@ -16800,21 +14205,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam + ') + + manage_files_pattern($1, user_spamassassin_home_t, user_spamassassin_home_t) -+ razor_manage_user_home_files(user,$1) +') + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.0.8/policy/modules/services/spamassassin.te --- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/spamassassin.te 2008-04-04 16:11:03.000000000 -0400 -@@ -53,7 +53,7 @@ - # setuids to the user running spamc. Comment this if you are not - # using this ability. - --allow spamd_t self:capability { setuid setgid dac_override sys_tty_config }; -+allow spamd_t self:capability { kill setuid setgid dac_override sys_tty_config }; - dontaudit spamd_t self:capability sys_tty_config; - allow spamd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; - allow spamd_t self:fd use; ++++ serefpolicy-3.0.8/policy/modules/services/spamassassin.te 2007-12-27 11:47:32.000000000 -0500 @@ -81,11 +81,12 @@ # var/lib files for spamd @@ -16884,7 +14279,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.0.8/policy/modules/services/squid.fc --- nsaserefpolicy/policy/modules/services/squid.fc 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/squid.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/squid.fc 2007-12-02 21:15:34.000000000 -0500 @@ -12,3 +12,5 @@ /var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0) @@ -16893,7 +14288,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi +/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.if serefpolicy-3.0.8/policy/modules/services/squid.if --- nsaserefpolicy/policy/modules/services/squid.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/squid.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/squid.if 2007-12-02 21:15:34.000000000 -0500 @@ -131,3 +131,22 @@ interface(`squid_use',` refpolicywarn(`$0($*) has been deprecated.') @@ -16919,7 +14314,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.0.8/policy/modules/services/squid.te --- nsaserefpolicy/policy/modules/services/squid.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/squid.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/squid.te 2007-12-13 08:37:13.000000000 -0500 @@ -36,7 +36,7 @@ # Local policy # @@ -16929,25 +14324,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi dontaudit squid_t self:capability sys_tty_config; allow squid_t self:process ~{ ptrace setcurrent setexec setfscreate execmem execstack execheap }; allow squid_t self:fifo_file rw_fifo_file_perms; -@@ -53,6 +53,9 @@ +@@ -53,6 +53,8 @@ allow squid_t self:tcp_socket create_stream_socket_perms; allow squid_t self:udp_socket create_socket_perms; +auth_use_nsswitch(squid_t) -+auth_domtrans_chkpwd(squid_t) + # Grant permissions to create, access, and delete cache files. manage_dirs_pattern(squid_t,squid_cache_t,squid_cache_t) manage_files_pattern(squid_t,squid_cache_t,squid_cache_t) -@@ -85,6 +88,7 @@ - corenet_udp_sendrecv_all_ports(squid_t) - corenet_tcp_bind_all_nodes(squid_t) - corenet_udp_bind_all_nodes(squid_t) -+corenet_tcp_bind_http_port(squid_t) - corenet_tcp_bind_http_cache_port(squid_t) - corenet_udp_bind_http_cache_port(squid_t) - corenet_tcp_bind_ftp_port(squid_t) -@@ -92,10 +96,12 @@ +@@ -92,10 +94,12 @@ corenet_udp_bind_gopher_port(squid_t) corenet_tcp_bind_squid_port(squid_t) corenet_udp_bind_squid_port(squid_t) @@ -16960,7 +14346,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi corenet_sendrecv_http_client_packets(squid_t) corenet_sendrecv_ftp_client_packets(squid_t) corenet_sendrecv_gopher_client_packets(squid_t) -@@ -109,6 +115,8 @@ +@@ -109,6 +113,8 @@ fs_getattr_all_fs(squid_t) fs_search_auto_mountpoints(squid_t) @@ -16969,7 +14355,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi selinux_dontaudit_getattr_dir(squid_t) -@@ -137,9 +145,6 @@ +@@ -137,9 +143,6 @@ miscfiles_read_certs(squid_t) miscfiles_read_localization(squid_t) @@ -16979,7 +14365,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi userdom_use_unpriv_users_fds(squid_t) userdom_dontaudit_use_unpriv_user_fds(squid_t) userdom_dontaudit_search_sysadm_home_dirs(squid_t) -@@ -149,19 +154,7 @@ +@@ -149,19 +152,7 @@ ') optional_policy(` @@ -17000,7 +14386,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi ') optional_policy(` -@@ -176,7 +169,12 @@ +@@ -176,7 +167,12 @@ udev_read_db(squid_t) ') @@ -17013,13 +14399,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi + corenet_tcp_connect_http_cache_port(httpd_squid_script_t) + squid_read_config(httpd_squid_script_t) + allow httpd_squid_script_t self:tcp_socket create_socket_perms; -+ sysnet_dns_name_resolve(httpd_squid_script_t) ++ sysnet_read_config(httpd_squid_script_t) + corenet_all_recvfrom_unlabeled(httpd_squid_script_t) + corenet_all_recvfrom_netlabel(httpd_squid_script_t) +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.0.8/policy/modules/services/ssh.if --- nsaserefpolicy/policy/modules/services/ssh.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ssh.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ssh.if 2007-12-02 21:15:34.000000000 -0500 @@ -202,6 +202,7 @@ # template(`ssh_per_role_template',` @@ -17170,7 +14556,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.0.8/policy/modules/services/ssh.te --- nsaserefpolicy/policy/modules/services/ssh.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ssh.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ssh.te 2007-12-12 16:38:01.000000000 -0500 @@ -24,7 +24,7 @@ # Type for the ssh-agent executable. @@ -17180,20 +14566,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. # ssh client executable. type ssh_exec_t; -@@ -80,6 +80,12 @@ +@@ -80,6 +80,10 @@ corenet_tcp_bind_xserver_port(sshd_t) corenet_sendrecv_xserver_server_packets(sshd_t) +userdom_read_all_users_home_dirs_symlinks(sshd_t) +userdom_read_all_users_home_content_files(sshd_t) +userdom_read_all_users_home_dirs_symlinks(sshd_t) -+userdom_read_unpriv_users_home_content_files(sshd_t) -+ + tunable_policy(`ssh_sysadm_login',` # Relabel and access ptys created by sshd # ioctl is necessary for logout() processing for utmp entry and for w to -@@ -100,6 +106,11 @@ +@@ -100,6 +104,11 @@ userdom_use_unpriv_users_ptys(sshd_t) ') @@ -17205,7 +14589,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. optional_policy(` daemontools_service_domain(sshd_t, sshd_exec_t) ') -@@ -119,7 +130,13 @@ +@@ -119,7 +128,13 @@ ') optional_policy(` @@ -17220,7 +14604,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. ') ifdef(`TODO',` -@@ -231,9 +248,15 @@ +@@ -231,9 +246,15 @@ ') optional_policy(` @@ -17236,38 +14620,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. ') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stunnel.if serefpolicy-3.0.8/policy/modules/services/stunnel.if ---- nsaserefpolicy/policy/modules/services/stunnel.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/stunnel.if 2008-04-04 16:11:03.000000000 -0400 -@@ -1 +1,25 @@ - ## SSL Tunneling Proxy -+ -+######################################## -+## -+## Define the specified domain as a stunnel inetd service. -+## -+## -+## -+## The type associated with the stunnel inetd service process. -+## -+## -+## -+## -+## The type associated with the process program. -+## -+## -+# -+interface(`stunnel_service_domain',` -+ gen_require(` -+ type stunnel_t; -+ ') -+ -+ domtrans_pattern(stunnel_t,$2,$1) -+ allow $1 stunnel_t:tcp_socket rw_socket_perms; -+') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stunnel.te serefpolicy-3.0.8/policy/modules/services/stunnel.te --- nsaserefpolicy/policy/modules/services/stunnel.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/stunnel.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/stunnel.te 2007-12-02 21:15:34.000000000 -0500 @@ -38,7 +38,6 @@ allow stunnel_t self:fifo_file rw_fifo_file_perms; allow stunnel_t self:tcp_socket create_stream_socket_perms; @@ -17311,7 +14666,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/stun # hack since this port has no interfaces since it doesnt diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tcpd.if serefpolicy-3.0.8/policy/modules/services/tcpd.if --- nsaserefpolicy/policy/modules/services/tcpd.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/tcpd.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/tcpd.if 2007-12-02 21:15:34.000000000 -0500 @@ -15,5 +15,31 @@ type tcpd_t, tcpd_exec_t; ') @@ -17347,7 +14702,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tcpd ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/telnet.te serefpolicy-3.0.8/policy/modules/services/telnet.te --- nsaserefpolicy/policy/modules/services/telnet.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/telnet.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/telnet.te 2007-12-02 21:15:34.000000000 -0500 @@ -32,12 +32,13 @@ allow telnetd_t self:udp_socket create_socket_perms; # for identd; cjp: this should probably only be inetd_child rules? @@ -17416,7 +14771,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/teln -') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.fc serefpolicy-3.0.8/policy/modules/services/tftp.fc --- nsaserefpolicy/policy/modules/services/tftp.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/tftp.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/tftp.fc 2008-01-14 12:49:42.000000000 -0500 @@ -4,3 +4,4 @@ /tftpboot -d gen_context(system_u:object_r:tftpdir_t,s0) @@ -17424,7 +14779,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp +/var/lib/tftpboot(/.*)? gen_context(system_u:object_r:tftpdir_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp.te serefpolicy-3.0.8/policy/modules/services/tftp.te --- nsaserefpolicy/policy/modules/services/tftp.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/tftp.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/tftp.te 2007-12-02 21:15:34.000000000 -0500 @@ -16,6 +16,17 @@ type tftpdir_t; files_type(tftpdir_t) @@ -17443,7 +14798,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp ######################################## # # Local policy -@@ -32,6 +43,10 @@ +@@ -26,12 +37,17 @@ + allow tftpd_t self:udp_socket create_socket_perms; + allow tftpd_t self:unix_dgram_socket create_socket_perms; + allow tftpd_t self:unix_stream_socket create_stream_socket_perms; ++allow tftpd_t self:netlink_route_socket r_netlink_socket_perms; + dontaudit tftpd_t self:capability sys_tty_config; + + allow tftpd_t tftpdir_t:dir { getattr read search }; allow tftpd_t tftpdir_t:file { read getattr }; allow tftpd_t tftpdir_t:lnk_file { getattr read }; @@ -17454,45 +14816,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/tftp manage_files_pattern(tftpd_t,tftpd_var_run_t,tftpd_var_run_t) files_pid_filetrans(tftpd_t,tftpd_var_run_t,file) -@@ -64,6 +79,8 @@ - files_read_var_symlinks(tftpd_t) - files_search_var(tftpd_t) - -+auth_use_nsswitch(tftpd_t) -+ - libs_use_ld_so(tftpd_t) - libs_use_shared_libs(tftpd_t) - -@@ -72,8 +89,9 @@ +@@ -72,6 +88,10 @@ miscfiles_read_localization(tftpd_t) miscfiles_read_public_files(tftpd_t) --sysnet_read_config(tftpd_t) --sysnet_use_ldap(tftpd_t) +tunable_policy(`allow_tftp_anon_write',` + miscfiles_manage_public_files(tftpd_t) +') - - userdom_dontaudit_use_unpriv_user_fds(tftpd_t) - userdom_dontaudit_use_sysadm_ttys(tftpd_t) -@@ -84,14 +102,6 @@ - ') - - optional_policy(` -- nis_use_ypbind(tftpd_t) --') -- --optional_policy(` -- nscd_socket_use(tftpd_t) --') -- --optional_policy(` - seutil_sigchld_newrole(tftpd_t) - ') ++ + sysnet_read_config(tftpd_t) + sysnet_use_ldap(tftpd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ucspitcp.if serefpolicy-3.0.8/policy/modules/services/ucspitcp.if --- nsaserefpolicy/policy/modules/services/ucspitcp.if 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ucspitcp.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ucspitcp.if 2007-12-02 21:15:34.000000000 -0500 @@ -20,7 +20,7 @@ ## ## @@ -17504,7 +14841,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ucsp role system_r; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ucspitcp.te serefpolicy-3.0.8/policy/modules/services/ucspitcp.te --- nsaserefpolicy/policy/modules/services/ucspitcp.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ucspitcp.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ucspitcp.te 2007-12-02 21:15:34.000000000 -0500 @@ -35,6 +35,7 @@ corenet_udp_sendrecv_all_ports(rblsmtpd_t) corenet_tcp_bind_all_nodes(rblsmtpd_t) @@ -17523,7 +14860,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ucsp corenet_sendrecv_ftp_server_packets(ucspitcp_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uucp.te serefpolicy-3.0.8/policy/modules/services/uucp.te --- nsaserefpolicy/policy/modules/services/uucp.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/uucp.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/uucp.te 2007-12-02 21:15:34.000000000 -0500 @@ -88,6 +88,8 @@ files_search_home(uucpd_t) files_search_spool(uucpd_t) @@ -17554,18 +14891,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uucp ######################################## # # UUX Local policy -@@ -124,6 +116,8 @@ - - files_read_etc_files(uux_t) - -+fs_rw_anon_inodefs_files(uux_t) -+ - libs_use_ld_so(uux_t) - libs_use_shared_libs(uux_t) - diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.0.8/policy/modules/services/uwimap.te --- nsaserefpolicy/policy/modules/services/uwimap.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/uwimap.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/uwimap.te 2007-12-02 21:15:34.000000000 -0500 @@ -64,6 +64,7 @@ fs_search_auto_mountpoints(imapd_t) @@ -17576,18 +14904,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwim libs_use_shared_libs(imapd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.0.8/policy/modules/services/w3c.fc --- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/w3c.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/w3c.fc 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,2 @@ +/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0) +/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.0.8/policy/modules/services/w3c.if --- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/w3c.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/w3c.if 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1 @@ +## W3C diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.0.8/policy/modules/services/w3c.te --- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/services/w3c.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/w3c.te 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,14 @@ +policy_module(w3c,1.2.1) + @@ -17605,7 +14933,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c. +miscfiles_read_certs(httpd_w3c_validator_script_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xfs.te serefpolicy-3.0.8/policy/modules/services/xfs.te --- nsaserefpolicy/policy/modules/services/xfs.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/xfs.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/xfs.te 2007-12-02 21:15:34.000000000 -0500 @@ -26,6 +26,7 @@ allow xfs_t self:process { signal_perms setpgid }; allow xfs_t self:unix_stream_socket create_stream_socket_perms; @@ -17632,7 +14960,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xfs. dev_read_sysfs(xfs_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.0.8/policy/modules/services/xserver.fc --- nsaserefpolicy/policy/modules/services/xserver.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/xserver.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/xserver.fc 2007-12-02 21:15:34.000000000 -0500 @@ -32,11 +32,6 @@ /etc/X11/wdm/Xstartup.* -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/Xsession[^/]* -- gen_context(system_u:object_r:xsession_exec_t,s0) @@ -17668,7 +14996,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser /var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.8/policy/modules/services/xserver.if --- nsaserefpolicy/policy/modules/services/xserver.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/xserver.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/xserver.if 2007-12-31 07:34:12.000000000 -0500 @@ -116,16 +116,19 @@ dev_rw_agp($1_xserver_t) dev_rw_framebuffer($1_xserver_t) @@ -18105,7 +15433,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.0.8/policy/modules/services/xserver.te --- nsaserefpolicy/policy/modules/services/xserver.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/xserver.te 2008-04-14 14:44:39.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/xserver.te 2007-12-12 16:40:57.000000000 -0500 @@ -16,6 +16,13 @@ ## @@ -18140,13 +15468,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser # Type for the executable used to start the X server, e.g. Xwrapper. type xserver_exec_t; corecmd_executable_file(xserver_exec_t) -@@ -95,8 +108,8 @@ - # XDM Local policy +@@ -96,7 +109,7 @@ # --allow xdm_t self:capability { setgid setuid sys_resource kill sys_tty_config mknod chown dac_override dac_read_search fowner fsetid ipc_owner sys_nice sys_rawio net_bind_service }; + allow xdm_t self:capability { setgid setuid sys_resource kill sys_tty_config mknod chown dac_override dac_read_search fowner fsetid ipc_owner sys_nice sys_rawio net_bind_service }; -allow xdm_t self:process { setexec setpgid getsched setsched setrlimit signal_perms setkeycreate }; -+allow xdm_t self:capability { setgid setuid sys_ptrace sys_resource kill sys_tty_config mknod chown dac_override dac_read_search fowner fsetid ipc_owner sys_nice sys_rawio net_bind_service }; +allow xdm_t self:process { setexec setpgid getsched ptrace setsched setrlimit signal_perms setkeycreate }; allow xdm_t self:fifo_file rw_fifo_file_perms; allow xdm_t self:shm create_shm_perms; @@ -18170,8 +15496,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser manage_dirs_pattern(xdm_t,xdm_var_lib_t,xdm_var_lib_t) manage_files_pattern(xdm_t,xdm_var_lib_t,xdm_var_lib_t) --files_var_lib_filetrans(xdm_t,xdm_var_lib_t,file) -+files_var_lib_filetrans(xdm_t,xdm_var_lib_t,{ file dir }) + files_var_lib_filetrans(xdm_t,xdm_var_lib_t,file) +# Read machine-id +files_read_var_lib_files(xdm_t) @@ -18390,22 +15715,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser -# -allow pam_t xdm_t:fifo_file { getattr ioctl write }; -') dnl end TODO -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/zebra.te serefpolicy-3.0.8/policy/modules/services/zebra.te ---- nsaserefpolicy/policy/modules/services/zebra.te 2007-10-22 13:21:36.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/zebra.te 2008-04-04 16:11:03.000000000 -0400 -@@ -115,8 +115,7 @@ - userdom_dontaudit_search_sysadm_home_dirs(zebra_t) - - tunable_policy(`allow_zebra_write_config',` -- allow zebra_t zebra_conf_t:dir write; -- allow zebra_t zebra_conf_t:file write; -+ manage_files_pattern(zebra_t, zebra_conf_t, zebra_conf_t) - ') - - optional_policy(` diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.0.8/policy/modules/system/application.if --- nsaserefpolicy/policy/modules/system/application.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/application.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/application.if 2007-12-02 21:15:34.000000000 -0500 @@ -63,6 +63,26 @@ ######################################## @@ -18435,22 +15747,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.0.8/policy/modules/system/authlogin.fc --- nsaserefpolicy/policy/modules/system/authlogin.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/authlogin.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -13,7 +13,9 @@ - /sbin/pam_console_apply -- gen_context(system_u:object_r:pam_console_exec_t,s0) ++++ serefpolicy-3.0.8/policy/modules/system/authlogin.fc 2007-12-02 21:15:34.000000000 -0500 +@@ -14,6 +14,7 @@ /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0) /sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) -+/usr/sbin/validate -- gen_context(system_u:object_r:chkpwd_exec_t,s0) /sbin/unix_verify -- gen_context(system_u:object_r:chkpwd_exec_t,s0) +/sbin/unix_update -- gen_context(system_u:object_r:updpwd_exec_t,s0) ifdef(`distro_suse', ` /sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) ') -@@ -38,5 +40,9 @@ - /var/log/wtmp.* -- gen_context(system_u:object_r:wtmp_t,s0) - +@@ -40,3 +41,6 @@ /var/run/console(/.*)? gen_context(system_u:object_r:pam_var_console_t,s0) -+/var/run/pam_mount(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0) /var/run/sudo(/.*)? gen_context(system_u:object_r:pam_var_run_t,s0) +/var/run/pam_ssh(/.*)? gen_context(system_u:object_r:var_auth_t,s0) @@ -18458,7 +15765,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.8/policy/modules/system/authlogin.if --- nsaserefpolicy/policy/modules/system/authlogin.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/authlogin.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/authlogin.if 2008-01-15 13:51:25.000000000 -0500 @@ -26,7 +26,8 @@ type $1_chkpwd_t, can_read_shadow_passwords; application_domain($1_chkpwd_t,chkpwd_exec_t) @@ -18541,7 +15848,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo selinux_get_fs_mount($1) selinux_validate_context($1) selinux_compute_access_vector($1) -@@ -196,20 +223,58 @@ +@@ -196,20 +223,48 @@ mls_fd_share_all_levels($1) auth_domtrans_chk_passwd($1) @@ -18572,16 +15879,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + userdom_unpriv_users_stream_connect($1) + + optional_policy(` -+ dbus_system_bus_client_template(notused, $1) -+ optional_policy(` -+ oddjob_dbus_chat($1) -+ oddjob_domtrans_mkhomedir($1) -+ ') -+ ') -+ -+ optional_policy(` -+ corecmd_exec_bin($1) -+ storage_getattr_fixed_disk_dev($1) + mount_domtrans($1) + ') + @@ -18601,7 +15898,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo tunable_policy(`allow_polyinstantiation',` files_polyinstantiate_all($1) ') -@@ -309,9 +374,6 @@ +@@ -309,9 +364,6 @@ type system_chkpwd_t, chkpwd_exec_t, shadow_t; ') @@ -18611,7 +15908,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo corecmd_search_bin($1) domtrans_pattern($1,chkpwd_exec_t,system_chkpwd_t) -@@ -329,6 +391,8 @@ +@@ -329,6 +381,8 @@ optional_policy(` kerberos_use($1) @@ -18620,31 +15917,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') optional_policy(` -@@ -347,6 +411,58 @@ +@@ -347,6 +401,37 @@ ######################################## ## -+## Run unix_chkpwd to check a password. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`auth_domtrans_chkpwd',` -+ gen_require(` -+ type system_chkpwd_t, chkpwd_exec_t, shadow_t; -+ ') -+ -+ corecmd_search_bin($1) -+ domtrans_pattern($1,chkpwd_exec_t,system_chkpwd_t) -+ dontaudit $1 shadow_t:file { getattr read }; -+ auth_domtrans_upd_passwd($1) -+') -+ -+######################################## -+## +## Execute chkpwd programs in the chkpwd domain. +## +## @@ -18679,7 +15955,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ## Get the attributes of the shadow passwords file. ## ## -@@ -695,6 +811,24 @@ +@@ -695,6 +780,24 @@ ######################################## ## @@ -18704,7 +15980,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ## Execute pam programs in the PAM domain. ## ## -@@ -1318,16 +1452,14 @@ +@@ -1318,16 +1421,14 @@ ## # interface(`auth_use_nsswitch',` @@ -18724,7 +16000,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo miscfiles_read_certs($1) sysnet_dns_name_resolve($1) -@@ -1347,6 +1479,8 @@ +@@ -1347,6 +1448,8 @@ optional_policy(` samba_stream_connect_winbind($1) @@ -18733,7 +16009,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') ') -@@ -1381,3 +1515,181 @@ +@@ -1381,3 +1484,181 @@ typeattribute $1 can_write_shadow_passwords; typeattribute $1 can_relabelto_shadow_passwords; ') @@ -18917,7 +16193,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.0.8/policy/modules/system/authlogin.te --- nsaserefpolicy/policy/modules/system/authlogin.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/authlogin.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/authlogin.te 2008-05-07 14:03:16.000000000 -0400 @@ -9,6 +9,13 @@ attribute can_read_shadow_passwords; attribute can_write_shadow_passwords; @@ -18953,7 +16229,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ######################################## # # PAM local policy -@@ -94,36 +108,37 @@ +@@ -94,10 +108,14 @@ allow pam_t pam_tmp_t:file manage_file_perms; files_tmp_filetrans(pam_t, pam_tmp_t, { file dir }) @@ -18968,23 +16244,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo term_use_all_user_ttys(pam_t) term_use_all_user_ptys(pam_t) --init_dontaudit_rw_utmp(pam_t) -+init_read_utmp(pam_t) -+init_dontaudit_write_utmp(pam_t) - - files_read_etc_files(pam_t) -- - libs_use_ld_so(pam_t) - libs_use_shared_libs(pam_t) - +@@ -111,19 +129,16 @@ logging_send_syslog_msg(pam_t) userdom_use_unpriv_users_fds(pam_t) +userdom_write_unpriv_users_tmp_files(pam_t) -+userdom_unlink_unpriv_users_tmp_files(pam_t) +userdom_dontaudit_read_unpriv_users_home_content_files(pam_t) -+userdom_dontaudit_write_user_home_content_files(user, pam_t) ++userdom_unlink_unpriv_users_tmp_files(pam_t) +userdom_append_unpriv_users_home_content_files(pam_t) ++userdom_dontaudit_write_unpriv_user_home_content_files(pam_t) optional_policy(` locallogin_use_fds(pam_t) @@ -19044,7 +16312,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ######################################## # -@@ -302,3 +323,31 @@ +@@ -302,3 +323,28 @@ xserver_use_xdm_fds(utempter_t) xserver_rw_xdm_pipes(utempter_t) ') @@ -19068,17 +16336,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +auth_use_nsswitch(updpwd_t) + +term_dontaudit_use_console(updpwd_t) -+term_dontaudit_use_all_user_ptys(updpwd_t) -+term_dontaudit_use_all_user_ttys(updpwd_t) +term_dontaudit_use_unallocated_ttys(updpwd_t) -+term_dontaudit_use_generic_ptys(updpwd_t) + +files_manage_etc_files(updpwd_t) +kernel_read_system_state(updpwd_t) +logging_send_syslog_msg(updpwd_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.0.8/policy/modules/system/fstools.fc --- nsaserefpolicy/policy/modules/system/fstools.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/fstools.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/fstools.fc 2007-12-02 21:15:34.000000000 -0500 @@ -20,7 +20,6 @@ /sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0) @@ -19089,7 +16354,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.0.8/policy/modules/system/fstools.te --- nsaserefpolicy/policy/modules/system/fstools.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/fstools.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/fstools.te 2007-12-20 16:21:38.000000000 -0500 @@ -109,8 +109,7 @@ term_use_console(fsadm_t) @@ -19124,7 +16389,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-3.0.8/policy/modules/system/fusermount.fc --- nsaserefpolicy/policy/modules/system/fusermount.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/system/fusermount.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/fusermount.fc 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,7 @@ +# fusermount executable will have: +# label: system_u:object_r:fusermount_exec_t @@ -19135,7 +16400,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm +/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-3.0.8/policy/modules/system/fusermount.if --- nsaserefpolicy/policy/modules/system/fusermount.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/system/fusermount.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/fusermount.if 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,41 @@ +## policy for fusermount + @@ -19181,7 +16446,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm \ No newline at end of file diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-3.0.8/policy/modules/system/fusermount.te --- nsaserefpolicy/policy/modules/system/fusermount.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/system/fusermount.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/fusermount.te 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,45 @@ +policy_module(fusermount,1.0.0) + @@ -19230,7 +16495,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.0.8/policy/modules/system/getty.te --- nsaserefpolicy/policy/modules/system/getty.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/getty.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/getty.te 2007-12-02 21:15:34.000000000 -0500 @@ -33,7 +33,8 @@ # @@ -19243,7 +16508,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty. allow getty_t self:fifo_file rw_fifo_file_perms; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.0.8/policy/modules/system/hostname.te --- nsaserefpolicy/policy/modules/system/hostname.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/hostname.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/hostname.te 2007-12-02 21:15:34.000000000 -0500 @@ -8,7 +8,9 @@ type hostname_t; @@ -19269,7 +16534,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplug.te serefpolicy-3.0.8/policy/modules/system/hotplug.te --- nsaserefpolicy/policy/modules/system/hotplug.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/hotplug.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/hotplug.te 2007-12-02 21:15:34.000000000 -0500 @@ -179,6 +179,7 @@ sysnet_read_dhcpc_pid(hotplug_t) sysnet_rw_dhcp_config(hotplug_t) @@ -19291,7 +16556,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hotplu diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.8/policy/modules/system/init.if --- nsaserefpolicy/policy/modules/system/init.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/init.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/init.if 2007-12-27 07:18:07.000000000 -0500 @@ -211,6 +211,21 @@ kernel_dontaudit_use_fds($1) ') @@ -19529,7 +16794,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.8/policy/modules/system/init.te --- nsaserefpolicy/policy/modules/system/init.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/init.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/init.te 2008-01-15 09:56:24.000000000 -0500 @@ -10,6 +10,20 @@ # Declarations # @@ -19759,15 +17024,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -@@ -738,6 +792,7 @@ - - optional_policy(` - unconfined_domain(initrc_t) -+ unconfined_domain(init_t) - - ifdef(`distro_redhat',` - # system-config-services causes avc messages that should be dontaudited -@@ -749,6 +804,12 @@ +@@ -749,6 +803,12 @@ ') ') @@ -19782,7 +17039,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t vmware_append_system_config(initrc_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.fc serefpolicy-3.0.8/policy/modules/system/ipsec.fc --- nsaserefpolicy/policy/modules/system/ipsec.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/ipsec.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/ipsec.fc 2007-12-05 08:56:38.000000000 -0500 @@ -32,3 +32,4 @@ /var/racoon(/.*)? gen_context(system_u:object_r:ipsec_var_run_t,s0) @@ -19790,7 +17047,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. +/var/run/racoon.pid -- gen_context(system_u:object_r:ipsec_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.8/policy/modules/system/ipsec.te --- nsaserefpolicy/policy/modules/system/ipsec.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/ipsec.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/ipsec.te 2007-12-06 09:02:10.000000000 -0500 @@ -55,11 +55,11 @@ allow ipsec_t self:capability { net_admin dac_override dac_read_search }; @@ -19901,7 +17158,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.8/policy/modules/system/iptables.te --- nsaserefpolicy/policy/modules/system/iptables.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/iptables.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/iptables.te 2007-12-02 21:15:34.000000000 -0500 @@ -64,6 +64,7 @@ init_use_script_ptys(iptables_t) # to allow rules to be saved on reboot: @@ -19923,25 +17180,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi.te serefpolicy-3.0.8/policy/modules/system/iscsi.te --- nsaserefpolicy/policy/modules/system/iscsi.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/iscsi.te 2008-04-04 16:11:03.000000000 -0400 -@@ -29,7 +29,7 @@ - # - - allow iscsid_t self:capability { dac_override ipc_lock net_admin sys_nice sys_resource }; --allow iscsid_t self:process setsched; -+allow iscsid_t self:process { setrlimit setsched }; - allow iscsid_t self:fifo_file { read write }; - allow iscsid_t self:unix_stream_socket { create_stream_socket_perms connectto }; - allow iscsid_t self:unix_dgram_socket create_socket_perms; -@@ -61,6 +61,7 @@ - corenet_tcp_sendrecv_all_ports(iscsid_t) - corenet_tcp_connect_http_port(iscsid_t) - corenet_tcp_connect_iscsi_port(iscsid_t) -+corenet_tcp_connect_isns_port(iscsid_t) - - dev_rw_sysfs(iscsid_t) - -@@ -68,6 +69,8 @@ ++++ serefpolicy-3.0.8/policy/modules/system/iscsi.te 2007-12-02 21:15:34.000000000 -0500 +@@ -68,6 +68,8 @@ files_read_etc_files(iscsid_t) @@ -19952,7 +17192,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.8/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/libraries.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/libraries.fc 2008-01-16 15:53:47.000000000 -0500 @@ -65,11 +65,15 @@ /opt/(.*/)?java/.+\.jar -- gen_context(system_u:object_r:lib_t,s0) /opt/(.*/)?jre.*/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -20030,7 +17270,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar /usr/lib(64)?/python2.4/site-packages/M2Crypto/__m2crypto.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) # vmware -@@ -284,3 +299,18 @@ +@@ -284,3 +299,15 @@ /var/spool/postfix/lib(64)?(/.*)? gen_context(system_u:object_r:lib_t,s0) /var/spool/postfix/usr(/.*)? gen_context(system_u:object_r:lib_t,s0) /var/spool/postfix/lib(64)?/ld.*\.so.* -- gen_context(system_u:object_r:ld_so_t,s0) @@ -20046,12 +17286,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar +/usr/lib/libswscale\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib64/libswscale\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib(64)?/libavdevice\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -+/usr/lib(64)?/libmythavcodec-[^/]+\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -+/usr/lib/.*/program(/.*)?\.so gen_context(system_u:object_r:lib_t,s0) -+/usr/lib64/.*/program(/.*)?\.so gen_context(system_u:object_r:lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.0.8/policy/modules/system/libraries.te --- nsaserefpolicy/policy/modules/system/libraries.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/libraries.te 2008-04-04 17:42:00.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/libraries.te 2007-12-10 16:27:26.000000000 -0500 @@ -23,6 +23,9 @@ init_system_domain(ldconfig_t,ldconfig_exec_t) role system_r types ldconfig_t; @@ -20096,23 +17333,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar ifdef(`hide_broken_symptoms',` optional_policy(` -@@ -96,4 +105,13 @@ +@@ -96,4 +105,12 @@ # and executes ldconfig on it. If you dont allow this kernel installs # blow up. rpm_manage_script_tmp_files(ldconfig_t) + # smart package manager needs the following for the same reason + rpm_rw_tmp_files(ldconfig_t) - ') ++') + +optional_policy(` + # run mkinitrd as unconfined user + unconfined_manage_tmp_files(ldconfig_t) + unconfined_domain(ldconfig_t) -+') -+ + ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.0.8/policy/modules/system/locallogin.te --- nsaserefpolicy/policy/modules/system/locallogin.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/locallogin.te 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/locallogin.te 2007-12-02 21:15:34.000000000 -0500 @@ -97,6 +97,12 @@ term_setattr_all_user_ttys(local_login_t) term_setattr_unallocated_ttys(local_login_t) @@ -20172,8 +17408,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall # Sulogin local policy diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.0.8/policy/modules/system/logging.fc --- nsaserefpolicy/policy/modules/system/logging.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/logging.fc 2008-04-17 11:18:18.000000000 -0400 -@@ -1,12 +1,17 @@ ++++ serefpolicy-3.0.8/policy/modules/system/logging.fc 2008-05-07 14:09:23.000000000 -0400 +@@ -1,12 +1,15 @@ - /dev/log -s gen_context(system_u:object_r:devlog_t,s0) @@ -20181,54 +17417,39 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin +/etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) /etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh) -+/sbin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0) -+/sbin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0) /sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0) /sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0) ++/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0) /sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0) /sbin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) -+/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0) +/sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) /sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) /sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0) -@@ -26,12 +31,22 @@ - - /var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh) - /var/log/.* gen_context(system_u:object_r:var_log_t,s0) -+/var/log/messages[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh) -+/var/log/secure[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh) -+/var/log/cron[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh) -+/var/log/maillog[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh) -+/var/log/spooler[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh) - /var/log/audit(/.*)? gen_context(system_u:object_r:auditd_log_t,mls_systemhigh) -+/var/log/syslog-ng(/.*)? -- gen_context(system_u:object_r:syslogd_var_run_t,s0) - - ifndef(`distro_gentoo',` +@@ -32,7 +35,10 @@ /var/log/audit\.log -- gen_context(system_u:object_r:auditd_log_t,mls_systemhigh) ') -+ifdef(`distro_redhat',` +/var/named/chroot/var/log -d gen_context(system_u:object_r:var_log_t,s0) -+') + /var/run/audit_events -s gen_context(system_u:object_r:auditd_var_run_t,s0) ++/var/run/audispd_events -s gen_context(system_u:object_r:auditd_var_run_t,s0) /var/run/auditd\.pid -- gen_context(system_u:object_r:auditd_var_run_t,s0) /var/run/auditd_sock -s gen_context(system_u:object_r:auditd_var_run_t,s0) -@@ -43,3 +58,10 @@ + /var/run/klogd\.pid -- gen_context(system_u:object_r:klogd_var_run_t,s0) +@@ -43,3 +49,9 @@ /var/spool/postfix/pid -d gen_context(system_u:object_r:var_run_t,s0) /var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0) + ++/var/log/syslog-ng(/.*)? -- gen_context(system_u:object_r:syslogd_var_run_t,s0) ++/var/lib/syslog-ng(/.*)? -- gen_context(system_u:object_r:syslogd_var_lib_t,s0) ++ +/etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_script_exec_t,s0) +/etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_script_exec_t,s0) -+ -+ -+/var/run/audispd_events -s gen_context(system_u:object_r:audisp_var_run_t,s0) -+/var/cfengine/outputs(/.*)? gen_context(system_u:object_r:var_log_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.0.8/policy/modules/system/logging.if --- nsaserefpolicy/policy/modules/system/logging.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/logging.if 2008-04-10 10:49:01.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/logging.if 2008-01-17 08:59:06.000000000 -0500 @@ -34,6 +34,51 @@ # interface(`logging_send_audit_msgs',` @@ -20281,21 +17502,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin allow $1 self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay }; ') -@@ -168,12 +213,7 @@ - ## - # - interface(`logging_stream_connect_auditd',` -- gen_require(` -- type auditd_t, auditd_var_run_t; -- ') -- -- files_search_pids($1) -- stream_connect_pattern($1,auditd_var_run_t,auditd_var_run_t,auditd_t) -+ logging_stream_connect_audisp($1) - ') - - ######################################## -@@ -219,6 +259,25 @@ +@@ -219,6 +264,25 @@ ######################################## ## @@ -20321,7 +17528,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin ## Execute syslogd in the syslog domain. ## ## -@@ -465,12 +524,11 @@ +@@ -465,12 +529,11 @@ interface(`logging_read_all_logs',` gen_require(` attribute logfile; @@ -20336,7 +17543,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin ') ######################################## -@@ -514,6 +572,8 @@ +@@ -514,6 +577,8 @@ files_search_var($1) manage_files_pattern($1,logfile,logfile) read_lnk_files_pattern($1,logfile,logfile) @@ -20345,34 +17552,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin ') ######################################## -@@ -539,6 +599,26 @@ - - ######################################## - ## -+## Dontaudit Write generic log files. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`logging_dontaudit_write_generic_logs',` -+ gen_require(` -+ type var_log_t; -+ ') -+ -+ files_search_var($1) -+ dontaudit $1 var_log_t:file write; -+') -+ -+ -+######################################## -+## - ## Write generic log files. - ## - ## -@@ -597,3 +677,273 @@ +@@ -597,3 +662,183 @@ files_search_var($1) manage_files_pattern($1,var_log_t,var_log_t) ') @@ -20501,158 +17681,68 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin +## +## +## Domain allowed access. -+## -+## -+## -+## -+## The role to be allowed to manage the syslog domain. -+## -+## -+## -+## -+## The type of the user terminal. -+## -+## -+## -+# -+interface(`logging_admin',` -+ logging_admin_audit($1, $2, $3) -+ logging_admin_syslog($1, $2, $3) -+') -+ -+######################################## -+## -+## Execute syslog server in the syslogd domain. -+## -+## -+## -+## The type of the process performing this action. -+## -+## -+# -+interface(`logging_syslog_script_domtrans',` -+ gen_require(` -+ type syslogd_script_exec_t; -+ ') -+ -+ init_script_domtrans_spec($1,syslogd_script_exec_t) -+') -+ -+######################################## -+## -+## Execute audit server in the auditd domain. -+## -+## -+## -+## The type of the process performing this action. -+## -+## -+# -+interface(`logging_audit_script_domtrans',` -+ gen_require(` -+ type auditd_script_exec_t; -+ ') -+ -+ init_script_domtrans_spec($1,auditd_script_exec_t) -+') -+ -+######################################## -+## -+## Execute a domain transition to run audisp. -+## -+## -+## -+## Domain allowed to transition. -+## -+## -+# -+interface(`logging_domtrans_audisp',` -+ gen_require(` -+ type audisp_t; -+ type audisp_exec_t; -+ ') -+ -+ domtrans_pattern($1,audisp_exec_t,audisp_t) -+') -+ -+######################################## -+## -+## Signal the audisp domain. -+## -+## -+## -+## Domain allowed to transition. -+## ++## ++## ++## ++## ++## The role to be allowed to manage the syslog domain. ++## ++## ++## ++## ++## The type of the user terminal. ++## +## ++## +# -+interface(`logging_audisp_signal',` -+ gen_require(` -+ type audisp_t; -+ ') -+ -+ allow $1 audisp_t:process signal; ++interface(`logging_admin',` ++ logging_admin_audit($1, $2, $3) ++ logging_admin_syslog($1, $2, $3) +') + +######################################## +## -+## Create a domain for processes -+## which can be started by the system audisp ++## Execute syslog server in the syslogd domain. +## +## +## -+## Type to be used as a domain. -+## -+## -+## -+## -+## Type of the program to be used as an entry point to this domain. ++## The type of the process performing this action. +## +## +# -+interface(`logging_audisp_system_domain',` ++interface(`logging_syslog_script_domtrans',` + gen_require(` -+ type audisp_t; -+ role system_r; ++ type syslogd_script_exec_t; + ') + -+ domain_type($1) -+ domain_entry_file($1,$2) -+ -+ role system_r types $1; -+ -+ domtrans_pattern(audisp_t,$2,$1) -+ -+ allow audisp_t $2:file getattr; -+ allow $1 audisp_t:unix_stream_socket rw_socket_perms; ++ init_script_domtrans_spec($1,syslogd_script_exec_t) +') + +######################################## +## -+## Connect to auditdstored over an unix stream socket. ++## Execute audit server in the auditd domain. +## +## +## -+## Domain allowed access. ++## The type of the process performing this action. +## +## +# -+interface(`logging_stream_connect_audisp',` ++interface(`logging_audit_script_domtrans',` + gen_require(` -+ type audisp_t, audisp_var_run_t; -+ type auditd_t, auditd_var_run_t; ++ type auditd_script_exec_t; + ') + -+ files_search_pids($1) -+ stream_connect_pattern($1,audisp_var_run_t,audisp_var_run_t,audisp_t) -+ stream_connect_pattern($1,auditd_var_run_t,auditd_var_run_t,auditd_t) ++ init_script_domtrans_spec($1,auditd_script_exec_t) +') ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.0.8/policy/modules/system/logging.te --- nsaserefpolicy/policy/modules/system/logging.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/logging.te 2008-04-17 11:18:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/logging.te 2007-12-25 07:00:48.000000000 -0500 @@ -1,5 +1,5 @@ -policy_module(logging,1.7.3) -+policy_module(logging,1.9.0) ++policy_module(logging,1.8.2) ######################################## # @@ -20676,7 +17766,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin type syslogd_var_run_t; files_pid_file(syslogd_var_run_t) -@@ -55,23 +61,42 @@ +@@ -55,23 +61,30 @@ logging_log_file(var_log_t) files_mountpoint(var_log_t) @@ -20690,18 +17780,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin init_ranged_daemon_domain(auditd_t,auditd_exec_t,mls_systemhigh) ') -+type audisp_t; -+type audisp_exec_t; -+init_system_domain(audisp_t, audisp_exec_t) -+ -+type audisp_var_run_t; -+files_pid_file(audisp_var_run_t) -+ -+type audisp_remote_t; -+type audisp_remote_exec_t; -+domain_type(audisp_remote_t) -+domain_entry_file(audisp_remote_t, audisp_remote_exec_t) -+ ######################################## # -# Auditd local policy @@ -20722,7 +17800,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin files_read_etc_files(auditctl_t) kernel_read_kernel_sysctls(auditctl_t) -@@ -91,6 +116,7 @@ +@@ -91,6 +104,7 @@ locallogin_dontaudit_use_fds(auditctl_t) @@ -20730,7 +17808,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin logging_send_syslog_msg(auditctl_t) ######################################## -@@ -98,16 +124,15 @@ +@@ -98,16 +112,15 @@ # Auditd local policy # @@ -20749,7 +17827,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin manage_files_pattern(auditd_t,auditd_log_t,auditd_log_t) manage_lnk_files_pattern(auditd_t,auditd_log_t,auditd_log_t) -@@ -141,6 +166,7 @@ +@@ -141,6 +154,7 @@ init_telinit(auditd_t) @@ -20757,29 +17835,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin logging_send_syslog_msg(auditd_t) libs_use_ld_so(auditd_t) -@@ -153,9 +179,21 @@ - - seutil_dontaudit_read_config(auditd_t) - -+sysnet_dns_name_resolve(auditd_t) -+ - userdom_dontaudit_use_unpriv_user_fds(auditd_t) +@@ -157,6 +171,10 @@ userdom_dontaudit_search_sysadm_home_dirs(auditd_t) -+ifdef(`distro_ubuntu',` -+ optional_policy(` -+ unconfined_domain(auditd_t) -+ ') -+') -+ -+optional_policy(` + optional_policy(` + mta_send_mail(auditd_t) +') + - optional_policy(` ++optional_policy(` seutil_sigchld_newrole(auditd_t) ') -@@ -194,6 +232,7 @@ + +@@ -194,6 +212,7 @@ fs_getattr_all_fs(klogd_t) fs_search_auto_mountpoints(klogd_t) @@ -20787,20 +17854,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin domain_use_interactive_fds(klogd_t) -@@ -212,6 +251,12 @@ - - userdom_dontaudit_search_sysadm_home_dirs(klogd_t) - -+ifdef(`distro_ubuntu',` -+ optional_policy(` -+ unconfined_domain(klogd_t) -+ ') -+') -+ - optional_policy(` - udev_read_db(klogd_t) - ') -@@ -241,12 +286,16 @@ +@@ -241,12 +260,16 @@ allow syslogd_t self:udp_socket create_socket_perms; allow syslogd_t self:tcp_socket create_stream_socket_perms; @@ -20817,7 +17871,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin # Allow access for syslog-ng allow syslogd_t var_log_t:dir { create setattr }; -@@ -255,6 +304,9 @@ +@@ -255,6 +278,9 @@ manage_files_pattern(syslogd_t,syslogd_tmp_t,syslogd_tmp_t) files_tmp_filetrans(syslogd_t,syslogd_tmp_t,{ dir file }) @@ -20827,109 +17881,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin allow syslogd_t syslogd_var_run_t:file manage_file_perms; files_pid_filetrans(syslogd_t,syslogd_var_run_t,file) -@@ -300,6 +352,7 @@ - # Allow users to define additional syslog ports to connect to - corenet_tcp_bind_syslogd_port(syslogd_t) - corenet_tcp_connect_syslogd_port(syslogd_t) -+corenet_tcp_connect_mysqld_port(syslogd_t) - - # syslog-ng can send or receive logs - corenet_sendrecv_syslogd_client_packets(syslogd_t) -@@ -312,6 +365,8 @@ +@@ -312,6 +338,7 @@ domain_use_interactive_fds(syslogd_t) files_read_etc_files(syslogd_t) -+files_read_usr_files(syslogd_t) +files_read_var_files(syslogd_t) files_read_etc_runtime_files(syslogd_t) # /initrd is not umounted before minilog starts files_dontaudit_search_isid_type_dirs(syslogd_t) -@@ -341,6 +396,12 @@ - files_var_lib_filetrans(syslogd_t,devlog_t,sock_file) - ') - -+ifdef(`distro_ubuntu',` -+ optional_policy(` -+ unconfined_domain(syslogd_t) -+ ') -+') -+ - optional_policy(` - inn_manage_log(syslogd_t) - ') -@@ -365,3 +426,69 @@ - # log to the xconsole - xserver_rw_console(syslogd_t) - ') -+ -+######################################## -+# -+# audisp local policy -+# -+ -+# Init script handling -+domain_use_interactive_fds(audisp_t) -+ -+## internal communication is often done using fifo and unix sockets. -+allow audisp_t self:fifo_file rw_file_perms; -+allow audisp_t self:unix_stream_socket create_stream_socket_perms; -+allow audisp_t self:unix_dgram_socket create_socket_perms; -+allow audisp_t auditd_t:unix_stream_socket rw_file_perms; -+ -+manage_sock_files_pattern(audisp_t, audisp_var_run_t, audisp_var_run_t) -+files_pid_filetrans(audisp_t, audisp_var_run_t, sock_file) -+ -+files_read_etc_files(audisp_t) -+ -+libs_use_ld_so(audisp_t) -+libs_use_shared_libs(audisp_t) -+ -+logging_send_syslog_msg(audisp_t) -+ -+miscfiles_read_localization(audisp_t) -+ -+corecmd_search_bin(audisp_t) -+ -+sysnet_dns_name_resolve(audisp_t) -+ -+logging_domtrans_audisp(auditd_t) -+logging_audisp_signal(auditd_t) -+ -+#gen_require(` -+# type zos_remote_exec_t, zos_remote_t; -+#') -+ -+#logging_audisp_system_domain(zos_remote_t, zos_remote_exec_t) -+ -+######################################## -+# -+# audisp_remote local policy -+# -+ -+logging_audisp_system_domain(audisp_remote_t, audisp_remote_exec_t) -+ -+allow audisp_remote_t self:tcp_socket create_socket_perms; -+ -+corenet_all_recvfrom_unlabeled(audisp_remote_t) -+corenet_all_recvfrom_netlabel(audisp_remote_t) -+corenet_tcp_sendrecv_all_if(audisp_remote_t) -+corenet_tcp_sendrecv_all_nodes(audisp_remote_t) -+corenet_tcp_connect_audit_port(audisp_remote_t) -+ -+files_read_etc_files(audisp_remote_t) -+ -+libs_use_ld_so(audisp_remote_t) -+libs_use_shared_libs(audisp_remote_t) -+ -+logging_send_syslog_msg(audisp_remote_t) -+logging_audisp_system_domain(audisp_remote_t, audisp_remote_exec_t) -+ -+miscfiles_read_localization(audisp_remote_t) -+ -+sysnet_dns_name_resolve(audisp_remote_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.0.8/policy/modules/system/lvm.fc --- nsaserefpolicy/policy/modules/system/lvm.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/lvm.fc 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/lvm.fc 2007-12-02 21:15:34.000000000 -0500 @@ -15,6 +15,7 @@ # /etc/lvm(/.*)? gen_context(system_u:object_r:lvm_etc_t,s0) @@ -20938,14 +17900,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc /etc/lvm/archive(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0) /etc/lvm/backup(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0) /etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0) -@@ -96,3 +97,4 @@ - /var/lock/lvm(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0) - /var/run/multipathd.sock -s gen_context(system_u:object_r:lvm_var_run_t,s0) - /var/lib/multipath(/.*)? gen_context(system_u:object_r:lvm_var_lib_t,s0) -+/var/run/dmevent.* gen_context(system_u:object_r:lvm_var_run_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.8/policy/modules/system/lvm.te --- nsaserefpolicy/policy/modules/system/lvm.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/lvm.te 2008-04-08 14:25:54.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/lvm.te 2007-12-02 21:15:34.000000000 -0500 @@ -44,9 +44,9 @@ # Cluster LVM daemon local policy # @@ -21015,23 +17972,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te userdom_dontaudit_use_unpriv_user_fds(clvmd_t) userdom_dontaudit_search_sysadm_home_dirs(clvmd_t) -@@ -131,12 +144,12 @@ +@@ -131,10 +144,6 @@ ') optional_policy(` - nis_use_ypbind(clvmd_t) -+ ricci_dontaudit_rw_modcluster_pipes(clvmd_t) -+ ricci_dontaudit_use_modcluster_fds(clvmd_t) - ') - - optional_policy(` -- ricci_dontaudit_rw_modcluster_pipes(clvmd_t) -- ricci_dontaudit_use_modcluster_fds(clvmd_t) -+ unconfined_domain(clvmd_t) +-') +- +-optional_policy(` + ricci_dontaudit_rw_modcluster_pipes(clvmd_t) + ricci_dontaudit_use_modcluster_fds(clvmd_t) ') - - optional_policy(` -@@ -150,17 +163,19 @@ +@@ -150,7 +159,8 @@ # DAC overrides and mknod for modifying /dev entries (vgmknodes) # rawio needed for dmraid @@ -21041,10 +17993,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te dontaudit lvm_t self:capability sys_tty_config; allow lvm_t self:process { sigchld sigkill sigstop signull signal }; # LVM will complain a lot if it cannot set its priority. - allow lvm_t self:process setsched; - allow lvm_t self:file rw_file_perms; --allow lvm_t self:fifo_file rw_file_perms; -+allow lvm_t self:fifo_file manage_fifo_file_perms; +@@ -160,7 +170,8 @@ allow lvm_t self:unix_dgram_socket create_socket_perms; allow lvm_t self:netlink_kobject_uevent_socket create_socket_perms; @@ -21054,7 +18003,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te manage_dirs_pattern(lvm_t,lvm_tmp_t,lvm_tmp_t) manage_files_pattern(lvm_t,lvm_tmp_t,lvm_tmp_t) -@@ -208,7 +223,6 @@ +@@ -208,7 +219,6 @@ selinux_compute_user_contexts(lvm_t) dev_create_generic_chr_files(lvm_t) @@ -21062,7 +18011,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te dev_read_rand(lvm_t) dev_read_urand(lvm_t) dev_rw_lvm_control(lvm_t) -@@ -228,6 +242,8 @@ +@@ -228,6 +238,8 @@ dev_dontaudit_getattr_generic_blk_files(lvm_t) dev_dontaudit_getattr_generic_pipes(lvm_t) dev_create_generic_dirs(lvm_t) @@ -21071,7 +18020,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te fs_getattr_xattr_fs(lvm_t) fs_search_auto_mountpoints(lvm_t) -@@ -246,6 +262,7 @@ +@@ -246,6 +258,7 @@ storage_dev_filetrans_fixed_disk(lvm_t) # Access raw devices and old /dev/lvm (c 109,0). Is this needed? storage_manage_fixed_disk(lvm_t) @@ -21079,7 +18028,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te term_getattr_all_user_ttys(lvm_t) term_list_ptys(lvm_t) -@@ -254,10 +271,12 @@ +@@ -254,10 +267,12 @@ domain_use_interactive_fds(lvm_t) @@ -21092,7 +18041,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te init_use_fds(lvm_t) init_dontaudit_getattr_initctl(lvm_t) -@@ -275,6 +294,8 @@ +@@ -275,6 +290,8 @@ seutil_search_default_contexts(lvm_t) seutil_sigchld_newrole(lvm_t) @@ -21101,7 +18050,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te ifdef(`distro_redhat',` # this is from the initrd: files_rw_isid_type_dirs(lvm_t) -@@ -293,5 +314,18 @@ +@@ -293,5 +310,18 @@ ') optional_policy(` @@ -21120,19 +18069,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te + xen_append_log(lvm_t) + xen_dontaudit_rw_unix_stream_sockets(lvm_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.0.8/policy/modules/system/miscfiles.fc ---- nsaserefpolicy/policy/modules/system/miscfiles.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/miscfiles.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -80,3 +80,6 @@ - /var/empty/sshd/etc/localtime -- gen_context(system_u:object_r:locale_t,s0) - /var/spool/postfix/etc/localtime -- gen_context(system_u:object_r:locale_t,s0) - ') -+ -+/usr/games(/.*)?/fonts(/.*)? gen_context(system_u:object_r:fonts_t,s0) -+ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.if serefpolicy-3.0.8/policy/modules/system/miscfiles.if --- nsaserefpolicy/policy/modules/system/miscfiles.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/miscfiles.if 2008-04-21 16:59:26.254295000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/miscfiles.if 2007-12-02 21:15:34.000000000 -0500 @@ -57,6 +57,26 @@ ## ## @@ -21169,33 +18108,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfi delete_dirs_pattern($1,man_t,man_t) delete_files_pattern($1,man_t,man_t) delete_lnk_files_pattern($1,man_t,man_t) -@@ -467,3 +489,23 @@ - manage_lnk_files_pattern($1,locale_t,locale_t) - ') - -+######################################## -+## -+## dontaudit_attempts to write locale files -+## -+## -+## -+## Domain allowed access. -+## -+## -+## -+# -+interface(`miscfiles_dontaudit_write_locale',` -+ gen_require(` -+ type locale_t; -+ ') -+ -+ dontaudit $1 locale_t:dir write; -+ dontaudit $1 locale_t:file write; -+') -+ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.if serefpolicy-3.0.8/policy/modules/system/modutils.if --- nsaserefpolicy/policy/modules/system/modutils.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/modutils.if 2008-04-04 16:11:03.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/modutils.if 2007-12-02 21:15:34.000000000 -0500 @@ -66,6 +66,25 @@ ######################################## @@ -21224,7 +18139,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti ## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.0.8/policy/modules/system/modutils.te --- nsaserefpolicy/policy/modules/system/modutils.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/modutils.te 2008-04-08 14:23:01.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/modutils.te 2008-01-03 10:41:36.000000000 -0500 @@ -42,7 +42,7 @@ # insmod local policy # @@ -21340,17 +18255,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti ################################# diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.0.8/policy/modules/system/mount.fc --- nsaserefpolicy/policy/modules/system/mount.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/mount.fc 2008-04-04 16:11:03.000000000 -0400 -@@ -1,4 +1,4 @@ ++++ serefpolicy-3.0.8/policy/modules/system/mount.fc 2007-12-02 21:15:34.000000000 -0500 +@@ -1,4 +1,2 @@ /bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) - -/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) -+/sbin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) -+/sbin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.0.8/policy/modules/system/mount.te --- nsaserefpolicy/policy/modules/system/mount.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/mount.te 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/mount.te 2008-01-16 10:54:29.000000000 -0500 @@ -8,6 +8,13 @@ ## @@ -21424,15 +18337,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. fs_getattr_xattr_fs(mount_t) fs_getattr_cifs(mount_t) -@@ -71,6 +83,7 @@ - fs_remount_all_fs(mount_t) - fs_relabelfrom_all_fs(mount_t) - fs_list_auto_mountpoints(mount_t) -+fs_manage_tmpfs_dirs(mount_t) - fs_rw_tmpfs_chr_files(mount_t) - fs_read_tmpfs_symlinks(mount_t) - -@@ -101,6 +114,8 @@ +@@ -101,6 +113,8 @@ init_use_fds(mount_t) init_use_script_ptys(mount_t) init_dontaudit_getattr_initctl(mount_t) @@ -21441,7 +18346,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. libs_use_ld_so(mount_t) libs_use_shared_libs(mount_t) -@@ -118,6 +133,7 @@ +@@ -118,6 +132,7 @@ seutil_read_config(mount_t) userdom_use_all_users_fds(mount_t) @@ -21449,7 +18354,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. ifdef(`distro_redhat',` optional_policy(` -@@ -127,10 +143,15 @@ +@@ -127,10 +142,15 @@ ') ') @@ -21466,7 +18371,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. ') optional_policy(` -@@ -159,13 +180,9 @@ +@@ -159,13 +179,9 @@ fs_search_rpc(mount_t) @@ -21481,7 +18386,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. ') optional_policy(` -@@ -180,17 +197,18 @@ +@@ -180,17 +196,18 @@ ') ') @@ -21504,7 +18409,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. ') ######################################## -@@ -201,4 +219,29 @@ +@@ -201,4 +218,29 @@ optional_policy(` files_etc_filetrans_etc_runtime(unconfined_mount_t,file) unconfined_domain(unconfined_mount_t) @@ -21536,7 +18441,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.0.8/policy/modules/system/raid.te --- nsaserefpolicy/policy/modules/system/raid.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/raid.te 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/raid.te 2007-12-02 21:15:34.000000000 -0500 @@ -19,7 +19,7 @@ # Local policy # @@ -21567,7 +18472,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.0.8/policy/modules/system/selinuxutil.fc --- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.fc 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.fc 2007-12-02 21:15:34.000000000 -0500 @@ -38,7 +38,7 @@ /usr/sbin/restorecond -- gen_context(system_u:object_r:restorecond_exec_t,s0) /usr/sbin/run_init -- gen_context(system_u:object_r:run_init_exec_t,s0) @@ -21579,7 +18484,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.0.8/policy/modules/system/selinuxutil.if --- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.if 2008-04-04 17:18:58.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.if 2007-12-02 21:15:34.000000000 -0500 @@ -585,7 +585,7 @@ type selinux_config_t; ') @@ -21788,7 +18693,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu + type semanage_tmp_t; + type policy_config_t; + ') -+ allow $1 self:capability { dac_override audit_write sys_resource }; ++ allow $1 self:capability { dac_override audit_write }; + allow $1 self:process signal; + allow $1 self:unix_stream_socket create_stream_socket_perms; + allow $1 self:unix_dgram_socket create_socket_perms; @@ -21855,7 +18760,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.0.8/policy/modules/system/selinuxutil.te --- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.te 2008-04-04 17:16:27.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/selinuxutil.te 2008-05-02 14:54:27.000000000 -0400 @@ -76,7 +76,6 @@ type restorecond_exec_t; init_daemon_domain(restorecond_t,restorecond_exec_t) @@ -22025,17 +18930,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu -kernel_read_kernel_sysctls(semanage_t) - -corecmd_exec_bin(semanage_t) -- --dev_read_urand(semanage_t) +init_dontaudit_use_fds(setsebool_t) --domain_use_interactive_fds(semanage_t) +-dev_read_urand(semanage_t) +# Bug in semanage +seutil_domtrans_setfiles(setsebool_t) +seutil_manage_file_contexts(setsebool_t) +seutil_manage_default_contexts(setsebool_t) +seutil_manage_selinux_config(setsebool_t) +-domain_use_interactive_fds(semanage_t) +- -files_read_etc_files(semanage_t) -files_read_etc_runtime_files(semanage_t) -files_read_usr_files(semanage_t) @@ -22101,7 +19006,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu # cjp: need a more general way to handle this: ifdef(`enable_mls',` # read secadm tmp files -@@ -516,11 +499,20 @@ +@@ -516,11 +499,19 @@ allow setfiles_t self:capability { dac_override dac_read_search fowner }; dontaudit setfiles_t self:capability sys_tty_config; allow setfiles_t self:fifo_file rw_file_perms; @@ -22117,12 +19022,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu + +files_list_isid_type_dirs(setfiles_t) +files_read_isid_type_files(setfiles_t) -+files_dontaudit_read_all_symlinks(setfiles_t) + kernel_read_system_state(setfiles_t) kernel_relabelfrom_unlabeled_dirs(setfiles_t) kernel_relabelfrom_unlabeled_files(setfiles_t) -@@ -537,6 +529,7 @@ +@@ -537,6 +528,7 @@ fs_getattr_xattr_fs(setfiles_t) fs_list_all(setfiles_t) @@ -22130,15 +19034,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu fs_search_auto_mountpoints(setfiles_t) fs_relabelfrom_noxattr_fs(setfiles_t) -@@ -590,8 +583,20 @@ +@@ -552,9 +544,7 @@ + selinux_compute_relabel_context(setfiles_t) + selinux_compute_user_contexts(setfiles_t) + +-term_use_all_user_ttys(setfiles_t) +-term_use_all_user_ptys(setfiles_t) +-term_use_unallocated_ttys(setfiles_t) ++term_use_all_terms(setfiles_t) + + # this is to satisfy the assertion: + auth_relabelto_shadow(setfiles_t) +@@ -590,8 +580,16 @@ fs_relabel_tmpfs_chr_file(setfiles_t) ') +optional_policy(` -+ cron_system_entry(setfiles_t, setfiles_exec_t) -+') -+ -+optional_policy(` + rpm_dontaudit_rw_pipes(setfiles_t) +') + @@ -22153,7 +19064,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.fc serefpolicy-3.0.8/policy/modules/system/sysnetwork.fc --- nsaserefpolicy/policy/modules/system/sysnetwork.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.fc 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.fc 2007-12-02 21:15:34.000000000 -0500 @@ -52,8 +52,7 @@ /var/lib/dhcpcd(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0) /var/lib/dhclient(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0) @@ -22166,7 +19077,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet /var/lib/dhcpc(/.*)? gen_context(system_u:object_r:dhcpc_state_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.0.8/policy/modules/system/sysnetwork.if --- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.if 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.if 2008-01-16 08:56:54.000000000 -0500 @@ -145,6 +145,25 @@ ######################################## @@ -22239,7 +19150,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.8/policy/modules/system/sysnetwork.te --- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.te 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.te 2007-12-02 21:15:34.000000000 -0500 @@ -45,7 +45,7 @@ dontaudit dhcpc_t self:capability sys_tty_config; # for access("/etc/bashrc", X_OK) on Red Hat @@ -22333,18 +19244,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet # Create UDP sockets, necessary when called from dhcpc allow ifconfig_t self:udp_socket create_socket_perms; -@@ -269,7 +282,10 @@ - kernel_read_system_state(ifconfig_t) +@@ -270,6 +283,8 @@ kernel_read_network_state(ifconfig_t) kernel_search_network_sysctl(ifconfig_t) -+kernel_search_debugfs(ifconfig_t) kernel_rw_net_sysctls(ifconfig_t) +# This should be put inside a boolean, but can not because of attributes +kernel_load_module(ifconfig_t) corenet_rw_tun_tap_dev(ifconfig_t) -@@ -280,8 +296,11 @@ +@@ -280,8 +295,11 @@ fs_getattr_xattr_fs(ifconfig_t) fs_search_auto_mountpoints(ifconfig_t) @@ -22356,7 +19265,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet domain_use_interactive_fds(ifconfig_t) -@@ -327,6 +346,14 @@ +@@ -327,6 +345,14 @@ ') optional_policy(` @@ -22373,7 +19282,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet xen_append_log(ifconfig_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.0.8/policy/modules/system/udev.te --- nsaserefpolicy/policy/modules/system/udev.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/udev.te 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/udev.te 2007-12-02 21:15:34.000000000 -0500 @@ -132,6 +132,7 @@ init_read_utmp(udev_t) @@ -22418,21 +19327,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.0.8/policy/modules/system/unconfined.fc --- nsaserefpolicy/policy/modules/system/unconfined.fc 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/unconfined.fc 2008-04-04 16:11:04.000000000 -0400 -@@ -7,6 +7,8 @@ - /usr/bin/vncserver -- gen_context(system_u:object_r:unconfined_exec_t,s0) ++++ serefpolicy-3.0.8/policy/modules/system/unconfined.fc 2007-12-10 14:53:06.000000000 -0500 +@@ -10,3 +10,7 @@ + /usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) - /usr/lib/ia32el/ia32x_loader -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) --/usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) -- /usr/local/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) +/usr/bin/rhythmbox -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) +/usr/bin/sbcl -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) -+/usr/sbin/mock -- gen_context(system_u:object_r:unconfined_notrans_exec_t,s0) ++/usr/bin/mock -- gen_context(system_u:object_r:unconfined_notrans_exec_t,s0) +/usr/sbin/sysreport -- gen_context(system_u:object_r:unconfined_notrans_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.8/policy/modules/system/unconfined.if --- nsaserefpolicy/policy/modules/system/unconfined.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/unconfined.if 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/unconfined.if 2008-01-16 16:20:55.000000000 -0500 @@ -12,14 +12,13 @@ # interface(`unconfined_domain_noaudit',` @@ -22748,7 +19654,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.8/policy/modules/system/unconfined.te --- nsaserefpolicy/policy/modules/system/unconfined.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/unconfined.te 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/unconfined.te 2007-12-10 14:39:10.000000000 -0500 @@ -5,36 +5,57 @@ # # Declarations @@ -22898,14 +19804,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf optional_policy(` - modutils_run_update_mods(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) --') -- --optional_policy(` -- mono_domtrans(unconfined_t) + mono_run(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) ') - optional_policy(` +- mono_domtrans(unconfined_t) +-') +- +-optional_policy(` - mta_per_role_template(unconfined,unconfined_t,unconfined_r) + modutils_run_update_mods(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) ') @@ -22938,8 +19844,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf optional_policy(` samba_per_role_template(unconfined) -- samba_run_net(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) -+ samba_run_unconfined_net(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) + samba_run_net(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) samba_run_winbind_helper(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) + samba_run_smbcontrol(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) ') @@ -22956,10 +19861,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf optional_policy(` - wine_domtrans(unconfined_t) + wine_run(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) - ') - - optional_policy(` -- xserver_domtrans_xdm_xserver(unconfined_t) ++') ++ ++optional_policy(` + mozilla_per_role_template(unconfined, unconfined_t, unconfined_r) + unconfined_domain(unconfined_mozilla_t) + allow unconfined_mozilla_t self:process { execstack execmem }; @@ -22967,48 +19871,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf + +optional_policy(` + kismet_run(unconfined_t, unconfined_r, { unconfined_tty_device_t unconfined_devpts_t }) -+') -+ -+optional_policy(` + ') + + optional_policy(` +- xserver_domtrans_xdm_xserver(unconfined_t) + xserver_run_xdm_xserver(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) + xserver_xdm_rw_shm(unconfined_t) ') ######################################## -@@ -219,14 +236,42 @@ +@@ -219,14 +236,38 @@ allow unconfined_execmem_t self:process { execstack execmem }; unconfined_domain_noaudit(unconfined_execmem_t) +allow unconfined_execmem_t unconfined_t:process transition; optional_policy(` -- dbus_stub(unconfined_execmem_t) -+ gen_require(` -+ type unconfined_dbusd_t; -+ ') -+ unconfined_domain(unconfined_dbusd_t) -+') + dbus_stub(unconfined_execmem_t) -+optional_policy(` init_dbus_chat_script(unconfined_execmem_t) -+ dbus_system_bus_client_template(unconfined_execmem, unconfined_execmem_t) unconfined_dbus_chat(unconfined_execmem_t) ++ dbus_connect_system_bus(unconfined_execmem_t) + unconfined_dbus_connect(unconfined_execmem_t) -+') ++ ++ optional_policy(` ++ avahi_dbus_chat(unconfined_execmem_t) ++ ') -- optional_policy(` -- hal_dbus_chat(unconfined_execmem_t) -- ') -+optional_policy(` -+ avahi_dbus_chat(unconfined_execmem_t) -+') + optional_policy(` + hal_dbus_chat(unconfined_execmem_t) + ') + -+optional_policy(` -+ hal_dbus_chat(unconfined_execmem_t) -+') ++ optional_policy(` ++ xserver_xdm_rw_shm(unconfined_execmem_t) + -+optional_policy(` -+ xserver_xdm_rw_shm(unconfined_execmem_t) ++ ') ') + +corecmd_exec_all_executables(unconfined_t) @@ -23024,7 +19921,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.fc serefpolicy-3.0.8/policy/modules/system/userdomain.fc --- nsaserefpolicy/policy/modules/system/userdomain.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/userdomain.fc 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/userdomain.fc 2007-12-02 21:15:34.000000000 -0500 @@ -1,4 +1,4 @@ HOME_DIR -d gen_context(system_u:object_r:ROLE_home_dir_t,s0-mls_systemhigh) +HOME_DIR -l gen_context(system_u:object_r:ROLE_home_dir_t,s0-mls_systemhigh) @@ -23033,7 +19930,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo /tmp/gconfd-USER -d gen_context(system_u:object_r:ROLE_tmp_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.8/policy/modules/system/userdomain.if --- nsaserefpolicy/policy/modules/system/userdomain.if 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/userdomain.if 2008-04-04 16:30:14.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/userdomain.if 2008-05-07 14:03:04.000000000 -0400 @@ -29,8 +29,9 @@ ') @@ -24039,18 +20936,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo read_files_pattern($2,{ $1_home_dir_t $1_home_t },$1_home_t) ') -@@ -2034,6 +2161,10 @@ - ') - - dontaudit $2 $1_home_t:file write; -+ fs_dontaudit_list_nfs($2) -+ fs_dontaudit_rw_nfs_files($2) -+ fs_dontaudit_list_cifs($2) -+ fs_dontaudit_rw_cifs_files($2) - ') - - ######################################## -@@ -2066,7 +2197,7 @@ +@@ -2066,7 +2193,7 @@ type $1_home_dir_t, $1_home_t; ') @@ -24059,7 +20945,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo read_lnk_files_pattern($2,{ $1_home_dir_t $1_home_t },$1_home_t) ') -@@ -2100,7 +2231,7 @@ +@@ -2100,7 +2227,7 @@ type $1_home_dir_t, $1_home_t; ') @@ -24068,7 +20954,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo exec_files_pattern($2,{ $1_home_dir_t $1_home_t },$1_home_t) ') -@@ -2169,7 +2300,7 @@ +@@ -2169,7 +2296,7 @@ type $1_home_dir_t, $1_home_t; ') @@ -24077,7 +20963,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $2 $1_home_dir_t:dir search_dir_perms; manage_files_pattern($2,$1_home_t,$1_home_t) ') -@@ -2241,7 +2372,7 @@ +@@ -2241,7 +2368,7 @@ type $1_home_dir_t, $1_home_t; ') @@ -24086,7 +20972,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $2 $1_home_dir_t:dir search_dir_perms; manage_lnk_files_pattern($2,$1_home_t,$1_home_t) ') -@@ -2278,7 +2409,7 @@ +@@ -2278,7 +2405,7 @@ type $1_home_dir_t, $1_home_t; ') @@ -24095,7 +20981,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $2 $1_home_dir_t:dir search_dir_perms; manage_fifo_files_pattern($2,$1_home_t,$1_home_t) ') -@@ -2315,7 +2446,7 @@ +@@ -2315,7 +2442,7 @@ type $1_home_dir_t, $1_home_t; ') @@ -24104,7 +20990,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $2 $1_home_dir_t:dir search_dir_perms; manage_sock_files_pattern($2,$1_home_t,$1_home_t) ') -@@ -2365,7 +2496,7 @@ +@@ -2365,7 +2492,7 @@ type $1_home_dir_t; ') @@ -24113,7 +20999,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo filetrans_pattern($2,$1_home_dir_t,$3,$4) ') -@@ -2414,7 +2545,7 @@ +@@ -2414,7 +2541,7 @@ type $1_home_t; ') @@ -24122,7 +21008,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo filetrans_pattern($2,$1_home_t,$3,$4) ') -@@ -2458,7 +2589,7 @@ +@@ -2458,7 +2585,7 @@ type $1_home_dir_t, $1_home_t; ') @@ -24131,7 +21017,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo filetrans_pattern($2,$1_home_dir_t,$1_home_t,$3) ') -@@ -2994,6 +3125,25 @@ +@@ -2994,6 +3121,25 @@ ######################################## ## @@ -24157,7 +21043,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ## Create objects in a user temporary directory ## with an automatic type transition to ## a specified private type. -@@ -3078,7 +3228,7 @@ +@@ -3078,7 +3224,7 @@ # template(`userdom_tmp_filetrans_user_tmp',` gen_require(` @@ -24166,7 +21052,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') files_tmp_filetrans($2,$1_tmp_t,$3) -@@ -3086,11 +3236,11 @@ +@@ -3086,11 +3232,11 @@ ######################################## ## @@ -24180,7 +21066,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ##

##

## This is a templated interface, and should only -@@ -3122,6 +3272,42 @@ +@@ -3122,6 +3268,42 @@ ######################################## ##

@@ -24223,7 +21109,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ## List users untrusted directories. ## ## -@@ -4089,7 +4275,7 @@ +@@ -4089,7 +4271,7 @@ type staff_home_dir_t; ') @@ -24232,7 +21118,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 staff_home_dir_t:dir search_dir_perms; ') -@@ -4128,7 +4314,7 @@ +@@ -4128,7 +4310,7 @@ type staff_home_dir_t; ') @@ -24241,7 +21127,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 staff_home_dir_t:dir manage_dir_perms; ') -@@ -4147,7 +4333,7 @@ +@@ -4147,7 +4329,7 @@ type staff_home_dir_t; ') @@ -24250,7 +21136,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 staff_home_dir_t:dir relabelto; ') -@@ -4185,7 +4371,7 @@ +@@ -4185,7 +4367,7 @@ type staff_home_dir_t, staff_home_t; ') @@ -24259,7 +21145,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 { staff_home_dir_t staff_home_t }:dir list_dir_perms; read_files_pattern($1,{ staff_home_dir_t staff_home_t },staff_home_t) read_lnk_files_pattern($1,{ staff_home_dir_t staff_home_t },staff_home_t) -@@ -4410,6 +4596,7 @@ +@@ -4410,6 +4592,7 @@ ') dontaudit $1 sysadm_home_dir_t:dir getattr; @@ -24267,7 +21153,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -4444,9 +4631,11 @@ +@@ -4444,9 +4627,11 @@ interface(`userdom_dontaudit_search_sysadm_home_dirs',` gen_require(` type sysadm_home_dir_t; @@ -24279,7 +21165,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -4570,10 +4759,11 @@ +@@ -4570,10 +4755,11 @@ type sysadm_home_dir_t, sysadm_home_t; ') @@ -24292,7 +21178,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -4609,11 +4799,29 @@ +@@ -4609,11 +4795,29 @@ # interface(`userdom_search_all_users_home_dirs',` gen_require(` @@ -24323,7 +21209,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -4633,6 +4841,14 @@ +@@ -4633,6 +4837,14 @@ files_list_home($1) allow $1 home_dir_type:dir list_dir_perms; @@ -24338,7 +21224,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -4895,7 +5111,7 @@ +@@ -4895,7 +5107,7 @@ type user_home_dir_t, user_home_t; ') @@ -24347,7 +21233,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo filetrans_pattern($1,user_home_dir_t,user_home_t,$2) ') -@@ -4933,7 +5149,7 @@ +@@ -4933,7 +5145,7 @@ type user_home_dir_t; ') @@ -24356,7 +21242,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 user_home_dir_t:dir manage_dir_perms; ') -@@ -4954,7 +5170,7 @@ +@@ -4954,7 +5166,7 @@ type user_home_t; ') @@ -24365,7 +21251,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo manage_dirs_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') -@@ -4973,7 +5189,7 @@ +@@ -4973,7 +5185,7 @@ type staff_home_dir_t; ') @@ -24374,7 +21260,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 user_home_dir_t:dir relabelto; ') -@@ -4992,7 +5208,7 @@ +@@ -4992,7 +5204,7 @@ type user_home_t, user_home_dir_t; ') @@ -24383,7 +21269,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 user_home_t:dir list_dir_perms; read_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') -@@ -5013,7 +5229,7 @@ +@@ -5013,7 +5225,7 @@ type user_home_t; ') @@ -24392,7 +21278,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 user_home_t:file execute; ') -@@ -5033,7 +5249,7 @@ +@@ -5033,7 +5245,7 @@ type user_home_dir_t, user_home_t; ') @@ -24401,7 +21287,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo manage_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') -@@ -5072,7 +5288,7 @@ +@@ -5072,7 +5284,7 @@ type user_home_t; ') @@ -24410,7 +21296,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo manage_lnk_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') -@@ -5092,7 +5308,7 @@ +@@ -5092,7 +5304,7 @@ type user_home_t; ') @@ -24419,7 +21305,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo manage_fifo_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') -@@ -5112,7 +5328,7 @@ +@@ -5112,7 +5324,7 @@ type user_home_t; ') @@ -24428,7 +21314,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo manage_sock_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') -@@ -5131,7 +5347,7 @@ +@@ -5131,7 +5343,7 @@ attribute user_home_dir_type; ') @@ -24437,7 +21323,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 user_home_dir_type:dir search_dir_perms; ') -@@ -5151,7 +5367,7 @@ +@@ -5151,7 +5363,7 @@ attribute user_home_dir_type, user_home_type; ') @@ -24446,7 +21332,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo allow $1 user_home_type:dir list_dir_perms; read_files_pattern($1,{ user_home_dir_type user_home_type },user_home_type) read_lnk_files_pattern($1,{ user_home_dir_type user_home_type },user_home_type) -@@ -5173,7 +5389,7 @@ +@@ -5173,7 +5385,7 @@ attribute user_home_dir_type, user_home_type; ') @@ -24455,7 +21341,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo manage_dirs_pattern($1,{ user_home_dir_type user_home_type },user_home_type) ') -@@ -5193,7 +5409,7 @@ +@@ -5193,7 +5405,7 @@ attribute user_home_dir_type, user_home_type; ') @@ -24464,7 +21350,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo manage_files_pattern($1,{ user_home_dir_type user_home_type },user_home_type) ') -@@ -5323,7 +5539,7 @@ +@@ -5323,7 +5535,7 @@ attribute user_tmpfile; ') @@ -24473,7 +21359,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5346,6 +5562,25 @@ +@@ -5346,6 +5558,25 @@ ######################################## ## @@ -24499,7 +21385,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ## Write all unprivileged users files in /tmp ## ## -@@ -5529,6 +5764,24 @@ +@@ -5529,6 +5760,24 @@ ######################################## ## @@ -24524,7 +21410,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ## Send a dbus message to all user domains. ## ## -@@ -5559,3 +5812,420 @@ +@@ -5559,3 +5808,419 @@ interface(`userdom_unconfined',` refpolicywarn(`$0($*) has been deprecated.') ') @@ -24944,10 +21830,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + typeattribute $2 userdomain; +') + -+ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.8/policy/modules/system/userdomain.te --- nsaserefpolicy/policy/modules/system/userdomain.te 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/userdomain.te 2008-04-04 16:30:31.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/userdomain.te 2007-12-02 21:15:34.000000000 -0500 @@ -24,13 +24,6 @@ ## @@ -25067,7 +21952,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ', ` userdom_security_admin_template(sysadm_t,sysadm_r,admin_terminal) ') -@@ -494,3 +497,30 @@ +@@ -494,3 +497,15 @@ optional_policy(` yam_run(sysadm_t,sysadm_r,admin_terminal) ') @@ -25083,29 +21968,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + netutils_run_traceroute_cond(staff_t,staff_r,{ staff_tty_device_t staff_devpts_t }) +') + -+tunable_policy(`use_nfs_home_dirs',` -+ manage_dirs_pattern(privhome, nfs_t, nfs_t) -+ manage_files_pattern(privhome, nfs_t, nfs_t) -+ manage_lnk_files_pattern(privhome, nfs_t, nfs_t) -+ manage_sock_files_pattern(privhome, nfs_t, nfs_t) -+ manage_fifo_files_pattern(privhome, nfs_t, nfs_t) -+') -+ -+tunable_policy(`use_samba_home_dirs',` -+ manage_dirs_pattern(privhome, cifs_t, cifs_t) -+ manage_files_pattern(privhome, cifs_t, cifs_t) -+ manage_lnk_files_pattern(privhome, cifs_t, cifs_t) -+ manage_sock_files_pattern(privhome, cifs_t, cifs_t) -+ manage_fifo_files_pattern(privhome, cifs_t, cifs_t) -+') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.fc serefpolicy-3.0.8/policy/modules/system/virt.fc --- nsaserefpolicy/policy/modules/system/virt.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/system/virt.fc 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/virt.fc 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1 @@ +/var/lib/libvirt(/.*)? gen_context(system_u:object_r:virt_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.if serefpolicy-3.0.8/policy/modules/system/virt.if --- nsaserefpolicy/policy/modules/system/virt.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/system/virt.if 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/virt.if 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,78 @@ +## Virtualization + @@ -25187,14 +22057,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.i +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virt.te serefpolicy-3.0.8/policy/modules/system/virt.te --- nsaserefpolicy/policy/modules/system/virt.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/system/virt.te 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/virt.te 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,3 @@ +# var/lib files +type virt_var_lib_t; +files_type(virt_var_lib_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.0.8/policy/modules/system/xen.if --- nsaserefpolicy/policy/modules/system/xen.if 2007-10-22 13:21:39.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/xen.if 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/xen.if 2007-12-02 21:15:34.000000000 -0500 @@ -191,3 +191,24 @@ domtrans_pattern($1,xm_exec_t,xm_t) @@ -25222,7 +22092,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.0.8/policy/modules/system/xen.te --- nsaserefpolicy/policy/modules/system/xen.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/xen.te 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/xen.te 2007-12-02 21:15:34.000000000 -0500 @@ -45,9 +45,7 @@ type xenstored_t; @@ -25398,17 +22268,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.0.8/policy/modules/users/guest.fc --- nsaserefpolicy/policy/modules/users/guest.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/guest.fc 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/users/guest.fc 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1 @@ +# No guest file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.0.8/policy/modules/users/guest.if --- nsaserefpolicy/policy/modules/users/guest.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/guest.if 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/users/guest.if 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1 @@ +## Policy for guest user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.0.8/policy/modules/users/guest.te --- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/guest.te 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/users/guest.te 2007-12-22 07:19:20.000000000 -0500 @@ -0,0 +1,12 @@ +policy_module(guest,1.0.1) +userdom_restricted_user_template(guest) @@ -25424,17 +22294,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.t +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.0.8/policy/modules/users/logadm.fc --- nsaserefpolicy/policy/modules/users/logadm.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/logadm.fc 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/users/logadm.fc 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1 @@ +# No logadm file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.0.8/policy/modules/users/logadm.if --- nsaserefpolicy/policy/modules/users/logadm.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/logadm.if 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/users/logadm.if 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1 @@ +## Policy for logadm user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.0.8/policy/modules/users/logadm.te --- nsaserefpolicy/policy/modules/users/logadm.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/logadm.te 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/users/logadm.te 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1,11 @@ +policy_module(logadm,1.0.0) + @@ -25449,22 +22319,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm. +logging_admin(logadm_t, logadm_r, { logadm_tty_device_t logadm_devpts_t }) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.0.8/policy/modules/users/metadata.xml --- nsaserefpolicy/policy/modules/users/metadata.xml 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/metadata.xml 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/users/metadata.xml 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1 @@ +Policy modules for users diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.0.8/policy/modules/users/webadm.fc --- nsaserefpolicy/policy/modules/users/webadm.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/webadm.fc 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/users/webadm.fc 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1 @@ +# No webadm file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.0.8/policy/modules/users/webadm.if --- nsaserefpolicy/policy/modules/users/webadm.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/webadm.if 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/users/webadm.if 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1 @@ +## Policy for webadm user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.8/policy/modules/users/webadm.te --- nsaserefpolicy/policy/modules/users/webadm.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/webadm.te 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/users/webadm.te 2007-12-07 15:47:51.000000000 -0500 @@ -0,0 +1,42 @@ +policy_module(webadm,1.0.0) + @@ -25510,18 +22380,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm. +allow webadm_t gadmin_t:dir getattr; diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.fc serefpolicy-3.0.8/policy/modules/users/xguest.fc --- nsaserefpolicy/policy/modules/users/xguest.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/xguest.fc 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/users/xguest.fc 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1 @@ +# No xguest file contexts. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.if serefpolicy-3.0.8/policy/modules/users/xguest.if --- nsaserefpolicy/policy/modules/users/xguest.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/xguest.if 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/users/xguest.if 2007-12-02 21:15:34.000000000 -0500 @@ -0,0 +1 @@ +## Policy for xguest user diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.te serefpolicy-3.0.8/policy/modules/users/xguest.te --- nsaserefpolicy/policy/modules/users/xguest.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.8/policy/modules/users/xguest.te 2008-04-04 16:11:04.000000000 -0400 -@@ -0,0 +1,62 @@ ++++ serefpolicy-3.0.8/policy/modules/users/xguest.te 2008-01-13 08:40:30.000000000 -0500 +@@ -0,0 +1,57 @@ +policy_module(xguest,1.0.1) + +## @@ -25551,11 +22421,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest. + mozilla_per_role_template(xguest, xguest_t, xguest_r) +') + -+optional_policy(` -+ openoffice_per_role_template(xguest, xguest_usertype, xguest_r) -+') -+ -+ +# Allow mounting of file systems +optional_policy(` + tunable_policy(`xguest_mount_media',` @@ -25586,7 +22451,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest. + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.0.8/policy/support/obj_perm_sets.spt --- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/policy/support/obj_perm_sets.spt 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/support/obj_perm_sets.spt 2007-12-02 21:15:34.000000000 -0500 @@ -216,7 +216,7 @@ define(`getattr_file_perms',`{ getattr }') define(`setattr_file_perms',`{ setattr }') @@ -25615,7 +22480,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0.8/policy/users --- nsaserefpolicy/policy/users 2007-10-22 13:21:43.000000000 -0400 -+++ serefpolicy-3.0.8/policy/users 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/policy/users 2007-12-02 21:15:34.000000000 -0500 @@ -16,7 +16,7 @@ # and a user process should never be assigned the system user # identity. @@ -25650,9 +22515,61 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0 - gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats) -') +gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.8/Rules.modular +--- nsaserefpolicy/Rules.modular 2007-10-22 13:21:44.000000000 -0400 ++++ serefpolicy-3.0.8/Rules.modular 2007-12-02 21:15:34.000000000 -0500 +@@ -96,6 +96,9 @@ + @test -d $(builddir) || mkdir -p $(builddir) + $(verbose) $(SEMOD_PKG) -o $@ -m $(base_mod) -f $(base_fc) -u $(users_extra) -s $(tmpdir)/seusers + ++ifneq "$(UNK_PERMS)" "" ++$(base_mod): CHECKMODULE += -U $(UNK_PERMS) ++endif + $(base_mod): $(base_conf) + @echo "Compiling $(NAME) base module" + $(verbose) $(CHECKMODULE) $^ -o $@ +@@ -144,6 +147,7 @@ + + $(tmpdir)/rolemap.conf: M4PARAM += -D self_contained_policy + $(tmpdir)/rolemap.conf: $(rolemap) ++ $(verbose) echo "" > $@ + $(call parse-rolemap,base,$@) + + $(tmpdir)/all_te_files.conf: M4PARAM += -D self_contained_policy +diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.monolithic serefpolicy-3.0.8/Rules.monolithic +--- nsaserefpolicy/Rules.monolithic 2007-10-22 13:21:43.000000000 -0400 ++++ serefpolicy-3.0.8/Rules.monolithic 2007-12-02 21:15:34.000000000 -0500 +@@ -63,6 +63,9 @@ + # + # Build a binary policy locally + # ++ifneq "$(UNK_PERMS)" "" ++$(polver): CHECKPOLICY += -U $(UNK_PERMS) ++endif + $(polver): $(policy_conf) + @echo "Compiling $(NAME) $(polver)" + ifneq ($(pv),$(kv)) +@@ -76,6 +79,9 @@ + # + # Install a binary policy + # ++ifneq "$(UNK_PERMS)" "" ++$(loadpath): CHECKPOLICY += -U $(UNK_PERMS) ++endif + $(loadpath): $(policy_conf) + @mkdir -p $(policypath) + @echo "Compiling and installing $(NAME) $(loadpath)" +@@ -127,6 +133,7 @@ + @echo "divert" >> $@ + + $(tmpdir)/rolemap.conf: $(rolemap) ++ $(verbose) echo "" > $@ + $(call parse-rolemap,base,$@) + + $(tmpdir)/all_te_files.conf: $(m4support) $(tmpdir)/generated_definitions.conf $(tmpdir)/all_interfaces.conf $(all_te_files) $(tmpdir)/rolemap.conf diff --exclude-from=exclude -N -u -r nsaserefpolicy/support/Makefile.devel serefpolicy-3.0.8/support/Makefile.devel --- nsaserefpolicy/support/Makefile.devel 2007-10-22 13:21:44.000000000 -0400 -+++ serefpolicy-3.0.8/support/Makefile.devel 2008-04-04 16:11:04.000000000 -0400 ++++ serefpolicy-3.0.8/support/Makefile.devel 2007-12-02 21:15:34.000000000 -0500 @@ -31,10 +31,10 @@ genxml := $(PYTHON) $(HEADERDIR)/support/segenxml.py diff --git a/selinux-policy.spec b/selinux-policy.spec index 334b847..121956f 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -17,7 +17,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.0.8 -Release: 101%{?dist} +Release: 102%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -381,6 +381,9 @@ exit 0 %endif %changelog +* Wed May 7 2008 Dan Walsh 3.0.8-102 +- Dontaudit pam_t writing homedir + * Thu Apr 17 2008 Dan Walsh 3.0.8-101 - Allow nfs to look at all filesystem directories