From d976a83a177a53e7e665259e35e0c814c2733dc7 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Sep 30 2009 17:37:44 +0000 Subject: - Allow cupsd_config to read user tmp - Allow snmpd_t to signal itself - Allow sysstat_t to makedir in sysstat_log_t --- diff --git a/modules-minimum.conf b/modules-minimum.conf index 5abc55c..36a02ad 100644 --- a/modules-minimum.conf +++ b/modules-minimum.conf @@ -1760,6 +1760,13 @@ aide = module w3c = module # Layer: services +# Module: plymouth +# +# Plymouth +# +plymouth = module + +# Layer: services # Module: portreserve # # reserve ports to prevent portmap mapping them diff --git a/modules-mls.conf b/modules-mls.conf index c6ca21b..7e20376 100644 --- a/modules-mls.conf +++ b/modules-mls.conf @@ -543,6 +543,13 @@ gnomeclock = module hal = module # Layer: services +# Module: plymouth +# +# Plymouth +# +plymouth = module + +# Layer: services # Module: policykit # # Hardware abstraction layer diff --git a/modules-targeted.conf b/modules-targeted.conf index 5abc55c..36a02ad 100644 --- a/modules-targeted.conf +++ b/modules-targeted.conf @@ -1760,6 +1760,13 @@ aide = module w3c = module # Layer: services +# Module: plymouth +# +# Plymouth +# +plymouth = module + +# Layer: services # Module: portreserve # # reserve ports to prevent portmap mapping them diff --git a/policy-F12.patch b/policy-F12.patch index e4704c8..257543d 100644 --- a/policy-F12.patch +++ b/policy-F12.patch @@ -4887,7 +4887,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol /var/named/chroot/dev/zero -c gen_context(system_u:object_r:zero_device_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.6.32/policy/modules/kernel/devices.if --- nsaserefpolicy/policy/modules/kernel/devices.if 2009-08-28 14:58:20.000000000 -0400 -+++ serefpolicy-3.6.32/policy/modules/kernel/devices.if 2009-09-21 08:39:30.000000000 -0400 ++++ serefpolicy-3.6.32/policy/modules/kernel/devices.if 2009-09-30 13:17:45.000000000 -0400 @@ -1692,6 +1692,78 @@ ######################################## @@ -11496,7 +11496,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +/usr/local/linuxprinter/ppd(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.6.32/policy/modules/services/cups.te --- nsaserefpolicy/policy/modules/services/cups.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.32/policy/modules/services/cups.te 2009-09-28 09:49:20.000000000 -0400 ++++ serefpolicy-3.6.32/policy/modules/services/cups.te 2009-09-30 10:20:40.000000000 -0400 @@ -23,6 +23,9 @@ type cupsd_initrc_exec_t; init_script_file(cupsd_initrc_exec_t) @@ -11559,7 +11559,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow cupsd_config_t self:fifo_file rw_fifo_file_perms; allow cupsd_config_t self:unix_stream_socket create_socket_perms; allow cupsd_config_t self:unix_dgram_socket create_socket_perms; -@@ -419,12 +430,15 @@ +@@ -407,6 +418,7 @@ + + userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t) + userdom_dontaudit_search_user_home_dirs(cupsd_config_t) ++userdom_read_user_tmp_files(cupsd_config_t) + + cups_stream_connect(cupsd_config_t) + +@@ -419,12 +431,15 @@ ') optional_policy(` @@ -11577,7 +11585,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` hal_dbus_chat(cupsd_config_t) -@@ -446,6 +460,10 @@ +@@ -446,6 +461,10 @@ ') optional_policy(` @@ -11588,7 +11596,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol rpm_read_db(cupsd_config_t) ') -@@ -542,6 +560,8 @@ +@@ -542,6 +561,8 @@ manage_dirs_pattern(cups_pdf_t, cups_pdf_tmp_t, cups_pdf_tmp_t) files_tmp_filetrans(cups_pdf_t, cups_pdf_tmp_t, { file dir }) @@ -11597,7 +11605,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol kernel_read_system_state(cups_pdf_t) files_read_etc_files(cups_pdf_t) -@@ -601,6 +621,9 @@ +@@ -601,6 +622,9 @@ read_lnk_files_pattern(hplip_t, hplip_etc_t, hplip_etc_t) files_search_etc(hplip_t) @@ -14100,6 +14108,395 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + xen_stream_connect(pegasus_t) + xen_stream_connect_xenstore(pegasus_t) +') +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plymouth.fc serefpolicy-3.6.32/policy/modules/services/plymouth.fc +--- nsaserefpolicy/policy/modules/services/plymouth.fc 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.6.32/policy/modules/services/plymouth.fc 2009-09-30 13:21:52.000000000 -0400 +@@ -0,0 +1,5 @@ ++/sbin/plymouthd -- gen_context(system_u:object_r:plymouthd_exec_t, s0) ++/bin/plymouth -- gen_context(system_u:object_r:plymouth_exec_t, s0) ++/var/spool/plymouth(/.*)? gen_context(system_u:object_r:plymouthd_spool_t, s0) ++/var/lib/plymouth(/.*)? gen_context(system_u:object_r:plymouthd_var_lib_t, s0) ++/var/run/plymouth(/.*)? gen_context(system_u:object_r:plymouthd_var_run_t, s0) +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plymouth.if serefpolicy-3.6.32/policy/modules/services/plymouth.if +--- nsaserefpolicy/policy/modules/services/plymouth.if 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.6.32/policy/modules/services/plymouth.if 2009-09-30 13:20:45.000000000 -0400 +@@ -0,0 +1,286 @@ ++## policy for plymouthd ++ ++######################################## ++## ++## Execute a domain transition to run plymouthd. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`plymouth_domtrans', ` ++ gen_require(` ++ type plymouthd_t, plymouthd_exec_t; ++ ') ++ ++ domtrans_pattern($1, plymouthd_exec_t, plymouthd_t) ++') ++ ++######################################## ++## ++## Execute a domain transition to run plymouthd. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`plymouth_domtrans_plymouth', ` ++ gen_require(` ++ type plymouth_t, plymouth_exec_t; ++ ') ++ ++ domtrans_pattern($1, plymouth_exec_t, plymouth_t) ++') ++ ++ ++######################################## ++## ++## Read plymouthd PID files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`plymouth_read_pid_files', ` ++ gen_require(` ++ type plymouthd_var_run_t; ++ ') ++ ++ files_search_pids($1) ++ allow $1 plymouthd_var_run_t:file read_file_perms; ++') ++ ++######################################## ++## ++## Manage plymouthd var_run files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`plymouth_manage_var_run', ` ++ gen_require(` ++ type plymouthd_var_run_t; ++ ') ++ ++ manage_dirs_pattern($1, plymouthd_var_run_t, plymouthd_var_run_t) ++ manage_files_pattern($1, plymouthd_var_run_t, plymouthd_var_run_t) ++ manage_lnk_files_pattern($1, plymouthd_var_run_t, plymouthd_var_run_t) ++') ++ ++ ++######################################## ++## ++## Search plymouthd lib directories. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`plymouth_search_lib', ` ++ gen_require(` ++ type plymouthd_var_lib_t; ++ ') ++ ++ allow $1 plymouthd_var_lib_t:dir search_dir_perms; ++ files_search_var_lib($1) ++') ++ ++######################################## ++## ++## Read plymouthd lib files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`plymouth_read_lib_files', ` ++ gen_require(` ++ type plymouthd_var_lib_t; ++ ') ++ ++ files_search_var_lib($1) ++ read_files_pattern($1, plymouthd_var_lib_t, plymouthd_var_lib_t) ++') ++ ++######################################## ++## ++## Create, read, write, and delete ++## plymouthd lib files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`plymouth_manage_lib_files', ` ++ gen_require(` ++ type plymouthd_var_lib_t; ++ ') ++ ++ files_search_var_lib($1) ++ manage_files_pattern($1, plymouthd_var_lib_t, plymouthd_var_lib_t) ++') ++ ++######################################## ++## ++## Manage plymouthd var_lib files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`plymouth_manage_var_lib', ` ++ gen_require(` ++ type plymouthd_var_lib_t; ++ ') ++ ++ manage_dirs_pattern($1, plymouthd_var_lib_t, plymouthd_var_lib_t) ++ manage_files_pattern($1, plymouthd_var_lib_t, plymouthd_var_lib_t) ++ manage_lnk_files_pattern($1, plymouthd_var_lib_t, plymouthd_var_lib_t) ++') ++ ++ ++######################################## ++## ++## Search plymouthd spool directories. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`plymouth_search_spool', ` ++ gen_require(` ++ type plymouthd_spool_t; ++ ') ++ ++ allow $1 plymouthd_spool_t:dir search_dir_perms; ++ files_search_spool($1) ++') ++ ++######################################## ++## ++## Read plymouthd spool files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`plymouth_read_spool_files', ` ++ gen_require(` ++ type plymouthd_spool_t; ++ ') ++ ++ files_search_spool($1) ++ read_files_pattern($1, plymouthd_spool_t, plymouthd_spool_t) ++') ++ ++######################################## ++## ++## Create, read, write, and delete ++## plymouthd spool files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`plymouth_manage_spool_files', ` ++ gen_require(` ++ type plymouthd_spool_t; ++ ') ++ ++ files_search_spool($1) ++ manage_files_pattern($1, plymouthd_spool_t, plymouthd_spool_t) ++') ++ ++######################################## ++## ++## Allow domain to manage plymouthd spool files ++## ++## ++## ++## Domain allowed access ++## ++## ++# ++interface(`plymouth_manage_spool', ` ++ gen_require(` ++ type plymouthd_spool_t; ++ ') ++ ++ manage_dirs_pattern($1, plymouthd_spool_t, plymouthd_spool_t) ++ manage_files_pattern($1, plymouthd_spool_t, plymouthd_spool_t) ++ manage_lnk_files_pattern($1, plymouthd_spool_t, plymouthd_spool_t) ++') ++ ++######################################## ++## ++## All of the rules required to administrate ++## an plymouthd environment ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++## ++## Role allowed access. ++## ++## ++## ++# ++interface(`plymouth_admin', ` ++ gen_require(` ++ type plymouthd_t; ++ ') ++ ++ allow $1 plymouthd_t:process { ptrace signal_perms getattr }; ++ read_files_pattern($1, plymouthd_t, plymouthd_t) ++ ++ plymouthd_manage_var_run($1) ++ ++ plymouthd_manage_var_lib($1) ++ ++ plymouthd_manage_spool($1) ++') ++ ++######################################## ++## ++## Allow domain to Stream socket connect ++## to Plymouth daemon. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`plymouth_stream_connect', ` ++ gen_require(` ++ type plymouthd_t; ++ ') ++ ++ allow $1 plymouthd_t:unix_stream_socket connectto; ++') +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/plymouth.te serefpolicy-3.6.32/policy/modules/services/plymouth.te +--- nsaserefpolicy/policy/modules/services/plymouth.te 1969-12-31 19:00:00.000000000 -0500 ++++ serefpolicy-3.6.32/policy/modules/services/plymouth.te 2009-09-30 13:18:14.000000000 -0400 +@@ -0,0 +1,86 @@ ++policy_module(plymouthd, 1.0.0) ++ ++######################################## ++# ++# Plymouthd private declarations ++# ++ ++type plymouthd_t; ++type plymouthd_exec_t; ++init_daemon_domain(plymouthd_t, plymouthd_exec_t) ++ ++permissive plymouthd_t; ++ ++type plymouthd_var_run_t; ++files_pid_file(plymouthd_var_run_t) ++ ++type plymouthd_var_lib_t; ++files_type(plymouthd_var_lib_t) ++ ++type plymouthd_spool_t; ++files_type(plymouthd_spool_t) ++ ++######################################## ++# ++# Plymouth private declarations ++# ++ ++type plymouth_t; ++type plymouth_exec_t; ++init_daemon_domain(plymouth_t, plymouth_exec_t) ++ ++permissive plymouth_t; ++ ++######################################## ++# ++# Plymouthd private policy ++# ++ ++allow plymouthd_t self:capability { sys_admin sys_tty_config }; ++allow plymouthd_t self:process { signal }; ++allow plymouthd_t self:fifo_file rw_fifo_file_perms; ++allow plymouthd_t self:unix_stream_socket create_stream_socket_perms; ++ ++kernel_read_system_state(plymouthd_t) ++ ++dev_rw_dri(plymouthd_t) ++dev_read_sysfs(plymouthd_t) ++ ++domain_use_interactive_fds(plymouthd_t) ++ ++files_read_etc_files(plymouthd_t) ++files_read_usr_files(plymouthd_t) ++ ++miscfiles_read_localization(plymouthd_t) ++ ++manage_dirs_pattern(plymouthd_t, plymouthd_var_run_t, plymouthd_var_run_t) ++manage_files_pattern(plymouthd_t, plymouthd_var_run_t, plymouthd_var_run_t) ++files_pid_filetrans(plymouthd_t,plymouthd_var_run_t, { file dir }) ++ ++manage_dirs_pattern(plymouthd_t, plymouthd_var_lib_t, plymouthd_var_lib_t) ++manage_files_pattern(plymouthd_t, plymouthd_var_lib_t, plymouthd_var_lib_t) ++files_var_lib_filetrans(plymouthd_t, plymouthd_var_lib_t, { file dir }) ++ ++manage_dirs_pattern(plymouthd_t, plymouthd_spool_t, plymouthd_spool_t) ++manage_files_pattern(plymouthd_t, plymouthd_spool_t, plymouthd_spool_t) ++manage_sock_files_pattern(plymouthd_t, plymouthd_spool_t, plymouthd_spool_t) ++files_spool_filetrans(plymouthd_t,plymouthd_spool_t, { file dir sock_file }) ++ ++######################################## ++# ++# Plymouth private policy ++# ++ ++allow plymouth_t self:process { signal }; ++allow plymouth_t self:fifo_file rw_file_perms; ++allow plymouth_t self:unix_stream_socket create_stream_socket_perms; ++ ++kernel_stream_connect(plymouth_t) ++ ++domain_use_interactive_fds(plymouth_t) ++ ++files_read_etc_files(plymouth_t) ++ ++miscfiles_read_localization(plymouth_t) ++ ++plymouth_stream_connect(plymouth_t) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/policykit.fc serefpolicy-3.6.32/policy/modules/services/policykit.fc --- nsaserefpolicy/policy/modules/services/policykit.fc 2009-08-18 11:41:14.000000000 -0400 +++ serefpolicy-3.6.32/policy/modules/services/policykit.fc 2009-09-16 10:03:09.000000000 -0400 @@ -14601,7 +14998,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.6.32/policy/modules/services/postfix.te --- nsaserefpolicy/policy/modules/services/postfix.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.32/policy/modules/services/postfix.te 2009-09-29 07:47:01.000000000 -0400 ++++ serefpolicy-3.6.32/policy/modules/services/postfix.te 2009-09-29 17:17:09.000000000 -0400 @@ -6,6 +6,15 @@ # Declarations # @@ -17074,7 +17471,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.6.32/policy/modules/services/sendmail.if --- nsaserefpolicy/policy/modules/services/sendmail.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.6.32/policy/modules/services/sendmail.if 2009-09-16 10:03:09.000000000 -0400 ++++ serefpolicy-3.6.32/policy/modules/services/sendmail.if 2009-09-29 17:16:32.000000000 -0400 @@ -59,20 +59,20 @@ ######################################## @@ -17811,7 +18208,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## All of the rules required to administrate diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.te serefpolicy-3.6.32/policy/modules/services/snmp.te --- nsaserefpolicy/policy/modules/services/snmp.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.32/policy/modules/services/snmp.te 2009-09-16 10:03:09.000000000 -0400 ++++ serefpolicy-3.6.32/policy/modules/services/snmp.te 2009-09-29 17:04:42.000000000 -0400 +@@ -27,7 +27,7 @@ + # + allow snmpd_t self:capability { dac_override kill ipc_lock sys_ptrace net_admin sys_nice sys_tty_config }; + dontaudit snmpd_t self:capability { sys_module sys_tty_config }; +-allow snmpd_t self:process { getsched setsched }; ++allow snmpd_t self:process { signal_perms getsched setsched }; + allow snmpd_t self:fifo_file rw_fifo_file_perms; + allow snmpd_t self:unix_dgram_socket create_socket_perms; + allow snmpd_t self:unix_stream_socket create_stream_socket_perms; @@ -72,6 +72,8 @@ corenet_udp_bind_snmp_port(snmpd_t) corenet_sendrecv_snmp_server_packets(snmpd_t) @@ -18930,8 +19336,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol dbus_connect_system_bus(sssd_t) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sysstat.te serefpolicy-3.6.32/policy/modules/services/sysstat.te --- nsaserefpolicy/policy/modules/services/sysstat.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.32/policy/modules/services/sysstat.te 2009-09-16 10:03:09.000000000 -0400 -@@ -19,7 +19,7 @@ ++++ serefpolicy-3.6.32/policy/modules/services/sysstat.te 2009-09-29 17:13:34.000000000 -0400 +@@ -19,14 +19,15 @@ # Local policy # @@ -18940,6 +19346,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol dontaudit sysstat_t self:capability sys_admin; allow sysstat_t self:fifo_file rw_fifo_file_perms; + can_exec(sysstat_t, sysstat_exec_t) + ++manage_dirs_pattern(sysstat_t,sysstat_log_t,sysstat_log_t) + manage_files_pattern(sysstat_t, sysstat_log_t, sysstat_log_t) +-read_lnk_files_pattern(sysstat_t, sysstat_log_t, sysstat_log_t) ++manage_lnk_files_pattern(sysstat_t,sysstat_log_t,sysstat_log_t) + logging_log_filetrans(sysstat_t, sysstat_log_t, { file dir }) + + # get info from /proc diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uucp.te serefpolicy-3.6.32/policy/modules/services/uucp.te --- nsaserefpolicy/policy/modules/services/uucp.te 2009-08-14 16:14:31.000000000 -0400 +++ serefpolicy-3.6.32/policy/modules/services/uucp.te 2009-09-16 10:03:09.000000000 -0400 @@ -20337,7 +20752,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.32/policy/modules/services/xserver.te --- nsaserefpolicy/policy/modules/services/xserver.te 2009-08-28 14:58:20.000000000 -0400 -+++ serefpolicy-3.6.32/policy/modules/services/xserver.te 2009-09-29 15:34:33.000000000 -0400 ++++ serefpolicy-3.6.32/policy/modules/services/xserver.te 2009-09-30 13:28:34.000000000 -0400 @@ -34,6 +34,13 @@ ## @@ -20753,7 +21168,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol hostname_exec(xdm_t) ') -@@ -542,6 +652,34 @@ +@@ -542,6 +652,38 @@ ') optional_policy(` @@ -20769,6 +21184,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') + +optional_policy(` ++ plymouth_search_spool(xdm_t) ++') ++ ++optional_policy(` + pulseaudio_exec(xdm_t) + pulseaudio_dbus_chat(xdm_t) +') @@ -20788,7 +21207,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol seutil_sigchld_newrole(xdm_t) ') -@@ -550,8 +688,9 @@ +@@ -550,8 +692,9 @@ ') optional_policy(` @@ -20800,7 +21219,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ifndef(`distro_redhat',` allow xdm_t self:process { execheap execmem }; -@@ -560,7 +699,6 @@ +@@ -560,7 +703,6 @@ ifdef(`distro_rhel4',` allow xdm_t self:process { execheap execmem }; ') @@ -20808,7 +21227,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` userhelper_dontaudit_search_config(xdm_t) -@@ -571,6 +709,10 @@ +@@ -571,6 +713,10 @@ ') optional_policy(` @@ -20819,7 +21238,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol xfs_stream_connect(xdm_t) ') -@@ -587,10 +729,9 @@ +@@ -587,10 +733,9 @@ # execheap needed until the X module loader is fixed. # NVIDIA Needs execstack @@ -20831,7 +21250,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow xserver_t self:fd use; allow xserver_t self:fifo_file rw_fifo_file_perms; allow xserver_t self:sock_file read_sock_file_perms; -@@ -602,9 +743,12 @@ +@@ -602,9 +747,12 @@ allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:udp_socket create_socket_perms; @@ -20844,7 +21263,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow xserver_t { input_xevent_t input_xevent_type }:x_event send; -@@ -616,13 +760,14 @@ +@@ -616,13 +764,14 @@ type_transition xserver_t xserver_t:{ x_drawable x_colormap } rootwindow_t; allow xserver_t { rootwindow_t x_domain }:x_drawable send; @@ -20860,7 +21279,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t) -@@ -635,9 +780,19 @@ +@@ -635,9 +784,19 @@ manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) files_search_var_lib(xserver_t) @@ -20880,7 +21299,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol kernel_read_system_state(xserver_t) kernel_read_device_sysctls(xserver_t) -@@ -671,7 +826,6 @@ +@@ -671,7 +830,6 @@ dev_rw_agp(xserver_t) dev_rw_framebuffer(xserver_t) dev_manage_dri_dev(xserver_t) @@ -20888,7 +21307,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol dev_create_generic_dirs(xserver_t) dev_setattr_generic_dirs(xserver_t) # raw memory access is needed if not using the frame buffer -@@ -681,9 +835,12 @@ +@@ -681,9 +839,12 @@ dev_rw_xserver_misc(xserver_t) # read events - the synaptics touchpad driver reads raw events dev_rw_input_dev(xserver_t) @@ -20902,7 +21321,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol files_read_etc_files(xserver_t) files_read_etc_runtime_files(xserver_t) -@@ -698,8 +855,12 @@ +@@ -698,8 +859,12 @@ fs_search_nfs(xserver_t) fs_search_auto_mountpoints(xserver_t) fs_search_ramfs(xserver_t) @@ -20915,7 +21334,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol selinux_validate_context(xserver_t) selinux_compute_access_vector(xserver_t) -@@ -721,6 +882,7 @@ +@@ -721,6 +886,7 @@ miscfiles_read_localization(xserver_t) miscfiles_read_fonts(xserver_t) @@ -20923,7 +21342,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol modutils_domtrans_insmod(xserver_t) -@@ -743,7 +905,7 @@ +@@ -743,7 +909,7 @@ ') ifdef(`enable_mls',` @@ -20932,7 +21351,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol range_transition xserver_t xserver_t:x_drawable s0 - mls_systemhigh; ') -@@ -775,12 +937,20 @@ +@@ -775,12 +941,20 @@ ') optional_policy(` @@ -20954,7 +21373,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol unconfined_domtrans(xserver_t) ') -@@ -807,7 +977,7 @@ +@@ -807,7 +981,7 @@ allow xserver_t xdm_var_lib_t:file { getattr read }; dontaudit xserver_t xdm_var_lib_t:dir search; @@ -20963,7 +21382,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # Label pid and temporary files with derived types. manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) -@@ -828,9 +998,14 @@ +@@ -828,9 +1002,14 @@ # to read ROLE_home_t - examine this in more detail # (xauth?) userdom_read_user_home_content_files(xserver_t) @@ -20978,7 +21397,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs(xserver_t) fs_manage_nfs_files(xserver_t) -@@ -845,11 +1020,14 @@ +@@ -845,11 +1024,14 @@ optional_policy(` dbus_system_bus_client(xserver_t) @@ -20994,7 +21413,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -882,6 +1060,8 @@ +@@ -882,6 +1064,8 @@ # X Server # can read server-owned resources allow x_domain xserver_t:x_resource read; @@ -21003,7 +21422,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # can mess with own clients allow x_domain self:x_client { manage destroy }; -@@ -906,6 +1086,8 @@ +@@ -906,6 +1090,8 @@ # operations allowed on my windows allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive }; @@ -21012,7 +21431,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # X Colormaps # can use the default colormap allow x_domain rootwindow_t:x_colormap { read use add_color }; -@@ -973,17 +1155,49 @@ +@@ -973,17 +1159,49 @@ allow xserver_unconfined_type { x_domain xserver_t }:x_resource *; allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *; diff --git a/selinux-policy.spec b/selinux-policy.spec index 90d38eb..e397d68 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -20,7 +20,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.6.32 -Release: 12%{?dist} +Release: 13%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -448,6 +448,11 @@ exit 0 %endif %changelog +* Tue Sep 30 2009 Dan Walsh 3.6.32-13 +- Allow cupsd_config to read user tmp +- Allow snmpd_t to signal itself +- Allow sysstat_t to makedir in sysstat_log_t + * Fri Sep 25 2009 Dan Walsh 3.6.32-12 - Update rhcs policy