From e3dd4912ce01ab209ad2f0cb947171979a2aaf64 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Aug 20 2009 17:48:51 +0000 Subject: - Fix system-config-services policy --- diff --git a/.cvsignore b/.cvsignore index ab0b3cd..f73ae96 100644 --- a/.cvsignore +++ b/.cvsignore @@ -184,3 +184,4 @@ serefpolicy-3.6.25.tgz serefpolicy-3.6.26.tgz serefpolicy-3.6.27.tgz serefpolicy-3.6.28.tgz +setroubleshoot-2.2.21.tar.gz diff --git a/policy-F12.patch b/policy-F12.patch index cc7c045..f4af2ba 100644 --- a/policy-F12.patch +++ b/policy-F12.patch @@ -440,7 +440,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol (( h1 dom h2 ) or ( t1 == mcssetcats )); diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.6.28/policy/modules/admin/anaconda.te --- nsaserefpolicy/policy/modules/admin/anaconda.te 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/admin/anaconda.te 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/admin/anaconda.te 2009-08-20 08:51:33.000000000 -0400 @@ -31,6 +31,7 @@ modutils_domtrans_insmod(anaconda_t) @@ -449,6 +449,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol userdom_user_home_dir_filetrans_user_home_content(anaconda_t, { dir file lnk_file fifo_file sock_file }) +@@ -52,7 +53,7 @@ + ') + + optional_policy(` +- unconfined_domain(anaconda_t) ++ unconfined_domain_noaudit(anaconda_t) + ') + + optional_policy(` diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/certwatch.te serefpolicy-3.6.28/policy/modules/admin/certwatch.te --- nsaserefpolicy/policy/modules/admin/certwatch.te 2009-08-14 16:14:31.000000000 -0400 +++ serefpolicy-3.6.28/policy/modules/admin/certwatch.te 2009-08-18 13:23:29.000000000 -0400 @@ -4730,8 +4739,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.6.28/policy/modules/kernel/corecommands.fc --- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2009-07-30 13:09:10.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/kernel/corecommands.fc 2009-08-18 13:23:29.000000000 -0400 -@@ -125,6 +125,7 @@ ++++ serefpolicy-3.6.28/policy/modules/kernel/corecommands.fc 2009-08-20 08:44:10.000000000 -0400 +@@ -54,6 +54,7 @@ + /etc/cron.weekly/.* -- gen_context(system_u:object_r:bin_t,s0) + /etc/cron.monthly/.* -- gen_context(system_u:object_r:bin_t,s0) + ++/etc/dhcp/dhclient\.d(/.*)? gen_context(system_u:object_r:bin_t,s0) + /etc/hotplug/.*agent -- gen_context(system_u:object_r:bin_t,s0) + /etc/hotplug/.*rc -- gen_context(system_u:object_r:bin_t,s0) + /etc/hotplug/hotplug\.functions -- gen_context(system_u:object_r:bin_t,s0) +@@ -125,6 +126,7 @@ /sbin/.* gen_context(system_u:object_r:bin_t,s0) /sbin/mkfs\.cramfs -- gen_context(system_u:object_r:bin_t,s0) /sbin/insmod_ksymoops_clean -- gen_context(system_u:object_r:bin_t,s0) @@ -4739,7 +4756,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # # /opt -@@ -142,6 +143,9 @@ +@@ -142,6 +144,9 @@ /opt/vmware/workstation/lib/lib/wrapper-gtk24\.sh -- gen_context(system_u:object_r:bin_t,s0) ') @@ -4749,7 +4766,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # # /usr # -@@ -315,3 +319,21 @@ +@@ -315,3 +320,21 @@ ifdef(`distro_suse',` /var/lib/samba/bin/.+ gen_context(system_u:object_r:bin_t,s0) ') @@ -4925,7 +4942,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol /dev/usb/mdc800.* -c gen_context(system_u:object_r:scanner_device_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.6.28/policy/modules/kernel/devices.if --- nsaserefpolicy/policy/modules/kernel/devices.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/kernel/devices.if 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/kernel/devices.if 2009-08-20 09:16:58.000000000 -0400 @@ -1655,6 +1655,78 @@ ######################################## @@ -5514,7 +5531,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol /var/lib/nfs/rpc_pipefs(/.*)? <> diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.6.28/policy/modules/kernel/files.if --- nsaserefpolicy/policy/modules/kernel/files.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/kernel/files.if 2009-08-18 13:38:01.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/kernel/files.if 2009-08-20 09:41:17.000000000 -0400 @@ -110,6 +110,11 @@ ## # @@ -5687,7 +5704,32 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -4955,7 +5047,7 @@ +@@ -4188,6 +4280,24 @@ + + ######################################## + ## ++## Set the attributes of the /var/run directory. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`files_setattr_pid_dirs',` ++ gen_require(` ++ type var_run_t; ++ ') ++ ++ allow $1 var_run_t:dir setattr; ++') ++ ++######################################## ++## + ## Search the /var/lib directory. + ## + ## +@@ -4955,7 +5065,7 @@ selinux_compute_member($1) # Need sys_admin capability for mounting @@ -5696,7 +5738,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # Need to give access to the directories to be polyinstantiated allow $1 polydir:dir { create open getattr search write add_name setattr mounton rmdir }; -@@ -4977,12 +5069,15 @@ +@@ -4977,12 +5087,15 @@ allow $1 poly_t:dir { create mounton }; fs_unmount_xattr_fs($1) @@ -5713,7 +5755,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ') -@@ -5003,3 +5098,173 @@ +@@ -5003,3 +5116,173 @@ typeattribute $1 files_unconfined_type; ') @@ -7632,8 +7674,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/roles/unconfineduser.te serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te --- nsaserefpolicy/policy/modules/roles/unconfineduser.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te 2009-08-18 13:23:29.000000000 -0400 -@@ -0,0 +1,395 @@ ++++ serefpolicy-3.6.28/policy/modules/roles/unconfineduser.te 2009-08-20 09:01:03.000000000 -0400 +@@ -0,0 +1,391 @@ +policy_module(unconfineduser, 1.0.0) + +######################################## @@ -7940,10 +7982,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') + +optional_policy(` -+ vbetool_run(unconfined_t, unconfined_r) -+') -+ -+optional_policy(` + vpn_run(unconfined_t, unconfined_r) +') + @@ -9620,8 +9658,43 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.if serefpolicy-3.6.28/policy/modules/services/bind.if --- nsaserefpolicy/policy/modules/services/bind.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/services/bind.if 2009-08-18 13:23:29.000000000 -0400 -@@ -287,6 +287,25 @@ ++++ serefpolicy-3.6.28/policy/modules/services/bind.if 2009-08-20 08:12:55.000000000 -0400 +@@ -235,7 +235,7 @@ + + ######################################## + ## +-## Do not audit attempts to set the attributes ++## Allow domain to set the attributes + ## of the BIND pid directory. + ## + ## +@@ -254,6 +254,25 @@ + + ######################################## + ## ++## Allow domain to set attributes ++## of the BIND zone directory. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`bind_setattr_zone_dirs',` ++ gen_require(` ++ type named_zone_t; ++ ') ++ ++ allow $1 named_zone_t:dir setattr; ++') ++ ++######################################## ++## + ## Read BIND zone files. + ## + ## +@@ -287,6 +306,25 @@ ######################################## ## @@ -11024,7 +11097,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow $1 devicekit_t:process { ptrace signal_perms getattr }; diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.6.28/policy/modules/services/devicekit.te --- nsaserefpolicy/policy/modules/services/devicekit.te 2009-07-29 15:15:33.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/services/devicekit.te 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/services/devicekit.te 2009-08-20 09:17:41.000000000 -0400 @@ -36,12 +36,15 @@ manage_dirs_pattern(devicekit_t, devicekit_var_run_t, devicekit_var_run_t) manage_files_pattern(devicekit_t, devicekit_var_run_t, devicekit_var_run_t) @@ -11144,7 +11217,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol dev_rw_generic_usb_dev(devicekit_power_t) dev_rw_netcontrol(devicekit_power_t) dev_rw_sysfs(devicekit_power_t) -@@ -167,12 +195,16 @@ +@@ -167,12 +195,17 @@ files_read_etc_files(devicekit_power_t) files_read_usr_files(devicekit_power_t) @@ -11156,12 +11229,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol miscfiles_read_localization(devicekit_power_t) ++sysnet_read_config(devicekit_power_t) +sysnet_read_dhcp_config(devicekit_power_t) + userdom_read_all_users_state(devicekit_power_t) optional_policy(` -@@ -180,8 +212,11 @@ +@@ -180,8 +213,11 @@ ') optional_policy(` @@ -11174,7 +11248,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow devicekit_power_t devicekit_t:dbus send_msg; optional_policy(` -@@ -203,17 +238,23 @@ +@@ -203,17 +239,23 @@ optional_policy(` hal_domtrans_mac(devicekit_power_t) @@ -11587,8 +11661,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/gpsd.te serefpolicy-3.6.28/policy/modules/services/gpsd.te --- nsaserefpolicy/policy/modules/services/gpsd.te 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/services/gpsd.te 2009-08-18 13:23:29.000000000 -0400 -@@ -11,9 +11,15 @@ ++++ serefpolicy-3.6.28/policy/modules/services/gpsd.te 2009-08-20 08:28:36.000000000 -0400 +@@ -11,15 +11,21 @@ application_domain(gpsd_t, gpsd_exec_t) init_daemon_domain(gpsd_t, gpsd_exec_t) @@ -11604,6 +11678,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ######################################## # # gpsd local policy + # + +-allow gpsd_t self:capability { setuid sys_nice setgid fowner }; ++allow gpsd_t self:capability { fsetid setuid sys_nice setgid fowner }; + allow gpsd_t self:process setsched; + allow gpsd_t self:shm create_shm_perms; + allow gpsd_t self:unix_dgram_socket { create_socket_perms sendto }; @@ -29,6 +35,10 @@ manage_files_pattern(gpsd_t, gpsd_tmpfs_t, gpsd_tmpfs_t) fs_tmpfs_filetrans(gpsd_t, gpsd_tmpfs_t, { dir file }) @@ -13459,9 +13540,45 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.fc serefpolicy-3.6.28/policy/modules/services/nx.fc +--- nsaserefpolicy/policy/modules/services/nx.fc 2009-07-14 14:19:57.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/services/nx.fc 2009-08-20 08:55:05.000000000 -0400 +@@ -1,6 +1,7 @@ + /opt/NX/bin/nxserver -- gen_context(system_u:object_r:nx_server_exec_t,s0) + + /opt/NX/home/nx/\.ssh(/.*)? gen_context(system_u:object_r:nx_server_home_ssh_t,s0) ++/var/lib/nxserver/home/.ssh(/.*)? gen_context(system_u:object_r:nx_server_home_ssh_t,s0) + + /opt/NX/var(/.*)? gen_context(system_u:object_r:nx_server_var_run_t,s0) + +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.if serefpolicy-3.6.28/policy/modules/services/nx.if +--- nsaserefpolicy/policy/modules/services/nx.if 2009-07-14 14:19:57.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/services/nx.if 2009-08-20 09:23:37.000000000 -0400 +@@ -17,3 +17,21 @@ + + spec_domtrans_pattern($1, nx_server_exec_t, nx_server_t) + ') ++ ++######################################## ++## ++## Read nx home directory content ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`nx_read_home_files',` ++ gen_require(` ++ type nx_server_home_ssh_t; ++ ') ++ ++ read_files_pattern($1, nx_server_home_ssh_t, nx_server_home_ssh_t) ++') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nx.te serefpolicy-3.6.28/policy/modules/services/nx.te --- nsaserefpolicy/policy/modules/services/nx.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/services/nx.te 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/services/nx.te 2009-08-20 12:45:07.000000000 -0400 @@ -25,6 +25,9 @@ type nx_server_var_run_t; files_pid_file(nx_server_var_run_t) @@ -14608,7 +14725,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.if serefpolicy-3.6.28/policy/modules/services/ppp.if --- nsaserefpolicy/policy/modules/services/ppp.if 2009-07-23 14:11:04.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/services/ppp.if 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/services/ppp.if 2009-08-20 08:37:53.000000000 -0400 @@ -177,10 +177,16 @@ interface(`ppp_run',` gen_require(` @@ -14628,7 +14745,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ######################################## diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ppp.te serefpolicy-3.6.28/policy/modules/services/ppp.te --- nsaserefpolicy/policy/modules/services/ppp.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/services/ppp.te 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/services/ppp.te 2009-08-20 08:34:18.000000000 -0400 @@ -193,6 +193,8 @@ optional_policy(` @@ -17076,7 +17193,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +/root/\.ssh(/.*)? gen_context(system_u:object_r:home_ssh_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.6.28/policy/modules/services/ssh.if --- nsaserefpolicy/policy/modules/services/ssh.if 2009-07-23 14:11:04.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/services/ssh.if 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/services/ssh.if 2009-08-20 12:45:06.000000000 -0400 @@ -36,6 +36,7 @@ gen_require(` attribute ssh_server; @@ -17379,7 +17496,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.6.28/policy/modules/services/ssh.te --- nsaserefpolicy/policy/modules/services/ssh.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/services/ssh.te 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/services/ssh.te 2009-08-20 09:24:08.000000000 -0400 @@ -41,6 +41,9 @@ files_tmp_file(sshd_tmp_t) files_poly_parent(sshd_tmp_t) @@ -17520,7 +17637,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -341,7 +355,11 @@ +@@ -331,6 +345,10 @@ + ') + + optional_policy(` ++ nx_read_home_files(sshd_t) ++') ++ ++optional_policy(` + rpm_use_script_fds(sshd_t) + ') + +@@ -341,7 +359,11 @@ ') optional_policy(` @@ -17533,7 +17661,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol unconfined_shell_domtrans(sshd_t) ') -@@ -400,15 +418,13 @@ +@@ -400,15 +422,13 @@ init_use_fds(ssh_keygen_t) init_use_script_ptys(ssh_keygen_t) @@ -19034,7 +19162,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.28/policy/modules/services/xserver.te --- nsaserefpolicy/policy/modules/services/xserver.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/services/xserver.te 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/services/xserver.te 2009-08-20 07:54:04.000000000 -0400 @@ -34,6 +34,13 @@ ## @@ -20287,7 +20415,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.6.28/policy/modules/system/fstools.te --- nsaserefpolicy/policy/modules/system/fstools.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/system/fstools.te 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/system/fstools.te 2009-08-20 08:58:51.000000000 -0400 @@ -65,13 +65,7 @@ kernel_rw_unlabeled_dirs(fsadm_t) kernel_rw_unlabeled_blk_files(fsadm_t) @@ -20377,7 +20505,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol init_use_fds(fsadm_t) init_use_script_ptys(fsadm_t) init_dontaudit_getattr_initctl(fsadm_t) -@@ -147,8 +154,7 @@ +@@ -144,11 +151,11 @@ + miscfiles_read_localization(fsadm_t) + + modutils_read_module_config(fsadm_t) ++modutils_read_module_deps(fsadm_t) seutil_read_config(fsadm_t) @@ -20387,7 +20519,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ifdef(`distro_redhat',` optional_policy(` -@@ -177,4 +183,6 @@ +@@ -177,4 +184,6 @@ optional_policy(` xen_append_log(fsadm_t) @@ -20508,7 +20640,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.6.28/policy/modules/system/init.if --- nsaserefpolicy/policy/modules/system/init.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/system/init.if 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/system/init.if 2009-08-20 08:05:39.000000000 -0400 @@ -174,6 +174,7 @@ role system_r types $1; @@ -20748,7 +20880,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.6.28/policy/modules/system/init.te --- nsaserefpolicy/policy/modules/system/init.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/system/init.te 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/system/init.te 2009-08-20 09:41:30.000000000 -0400 @@ -17,6 +17,20 @@ ## gen_tunable(init_upstart, false) @@ -20873,22 +21005,25 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol files_tmp_filetrans(initrc_t, initrc_tmp_t, { file dir }) init_write_initctl(initrc_t) -@@ -249,10 +287,12 @@ +@@ -249,10 +287,15 @@ kernel_rw_all_sysctls(initrc_t) # for lsof which is used by alsa shutdown: kernel_dontaudit_getattr_message_if(initrc_t) +kernel_stream_connect(initrc_t) +files_read_kernel_modules(initrc_t) +files_read_config_files(initrc_t) ++files_read_var_lib_symlinks(initrc_t) ++files_setattr_pid_dirs(initrc_t) files_read_kernel_symbol_table(initrc_t) - -corecmd_exec_all_executables(initrc_t) +files_exec_etc_files(initrc_t) ++files_manage_etc_symlinks(initrc_t) corenet_all_recvfrom_unlabeled(initrc_t) corenet_all_recvfrom_netlabel(initrc_t) -@@ -272,16 +312,62 @@ +@@ -272,16 +315,62 @@ dev_rw_sysfs(initrc_t) dev_list_usbfs(initrc_t) dev_read_framebuffer(initrc_t) @@ -20952,7 +21087,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol domain_kill_all_domains(initrc_t) domain_signal_all_domains(initrc_t) -@@ -291,7 +377,7 @@ +@@ -291,7 +380,7 @@ domain_sigchld_all_domains(initrc_t) domain_read_all_domains_state(initrc_t) domain_getattr_all_domains(initrc_t) @@ -20961,7 +21096,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol domain_getsession_all_domains(initrc_t) domain_use_interactive_fds(initrc_t) # for lsof which is used by alsa shutdown: -@@ -306,14 +392,15 @@ +@@ -306,14 +395,15 @@ files_getattr_all_pipes(initrc_t) files_getattr_all_sockets(initrc_t) files_purge_tmp(initrc_t) @@ -20979,7 +21114,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol files_exec_etc_files(initrc_t) files_read_usr_files(initrc_t) files_manage_urandom_seed(initrc_t) -@@ -325,47 +412,13 @@ +@@ -325,47 +415,13 @@ files_list_default(initrc_t) files_mounton_default(initrc_t) @@ -21029,7 +21164,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol logging_send_syslog_msg(initrc_t) logging_manage_generic_logs(initrc_t) logging_read_all_logs(initrc_t) -@@ -422,8 +475,6 @@ +@@ -422,8 +478,6 @@ # init scripts touch this clock_dontaudit_write_adjtime(initrc_t) @@ -21038,7 +21173,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # for integrated run_init to read run_init_type. # happens during boot (/sbin/rc execs init scripts) seutil_read_default_contexts(initrc_t) -@@ -450,11 +501,9 @@ +@@ -450,11 +504,9 @@ # Red Hat systems seem to have a stray # fd open from the initrd @@ -21051,7 +21186,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # These seem to be from the initrd # during device initialization: dev_create_generic_dirs(initrc_t) -@@ -464,6 +513,7 @@ +@@ -464,6 +516,7 @@ storage_raw_read_fixed_disk(initrc_t) storage_raw_write_fixed_disk(initrc_t) @@ -21059,7 +21194,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol files_create_boot_flag(initrc_t) files_rw_boot_symlinks(initrc_t) # wants to read /.fonts directory -@@ -497,6 +547,7 @@ +@@ -492,11 +545,13 @@ + optional_policy(` + bind_manage_config_dirs(initrc_t) + bind_write_config(initrc_t) ++ bind_setattr_zone_dirs(initrc_t) + ') + optional_policy(` #for /etc/rc.d/init.d/nfs to create /etc/exports rpc_write_exports(initrc_t) @@ -21067,7 +21208,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -515,6 +566,33 @@ +@@ -515,6 +570,33 @@ ') ') @@ -21101,7 +21242,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` amavis_search_lib(initrc_t) amavis_setattr_pid_files(initrc_t) -@@ -569,6 +647,10 @@ +@@ -569,8 +651,16 @@ dbus_read_config(initrc_t) optional_policy(` @@ -21111,8 +21252,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + optional_policy(` networkmanager_dbus_chat(initrc_t) ') ++ ++ optional_policy(` ++ policykit_dbus_chat(initrc_t) ++ ') ') -@@ -590,6 +672,10 @@ + + optional_policy(` +@@ -590,6 +680,10 @@ ') optional_policy(` @@ -21123,7 +21270,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol dev_read_usbfs(initrc_t) # init scripts run /etc/hotplug/usb.rc -@@ -646,20 +732,20 @@ +@@ -646,20 +740,20 @@ ') optional_policy(` @@ -21150,7 +21297,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` ifdef(`distro_redhat',` -@@ -668,6 +754,7 @@ +@@ -668,6 +762,7 @@ mysql_stream_connect(initrc_t) mysql_write_log(initrc_t) @@ -21158,7 +21305,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -696,7 +783,6 @@ +@@ -696,7 +791,6 @@ ') optional_policy(` @@ -21166,7 +21313,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol fs_write_ramfs_sockets(initrc_t) fs_search_ramfs(initrc_t) -@@ -718,8 +804,6 @@ +@@ -718,8 +812,6 @@ # bash tries ioctl for some reason files_dontaudit_ioctl_all_pids(initrc_t) @@ -21175,7 +21322,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -732,10 +816,12 @@ +@@ -732,10 +824,12 @@ squid_manage_logs(initrc_t) ') @@ -21188,7 +21335,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` ssh_dontaudit_read_server_keys(initrc_t) -@@ -754,6 +840,15 @@ +@@ -754,6 +848,15 @@ ') optional_policy(` @@ -21204,7 +21351,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol unconfined_domain(initrc_t) ifdef(`distro_redhat',` -@@ -764,6 +859,13 @@ +@@ -764,6 +867,13 @@ optional_policy(` mono_domtrans(initrc_t) ') @@ -21218,7 +21365,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -789,3 +891,31 @@ +@@ -789,3 +899,31 @@ optional_policy(` zebra_read_config(initrc_t) ') @@ -21293,7 +21440,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.6.28/policy/modules/system/ipsec.te --- nsaserefpolicy/policy/modules/system/ipsec.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/system/ipsec.te 2009-08-19 20:01:37.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/system/ipsec.te 2009-08-20 12:45:08.000000000 -0400 @@ -6,6 +6,13 @@ # Declarations # @@ -21525,12 +21672,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol locallogin_use_fds(racoon_t) logging_send_syslog_msg(racoon_t) -@@ -328,6 +362,13 @@ +@@ -328,6 +362,14 @@ miscfiles_read_localization(racoon_t) +auth_use_pam(racoon_t) + ++ +auth_can_read_shadow_passwords(racoon_t) +tunable_policy(`racoon_read_shadow',` + auth_tunable_read_shadow(racoon_t) @@ -21539,7 +21687,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ######################################## # # Setkey local policy -@@ -347,6 +388,7 @@ +@@ -347,6 +389,7 @@ files_read_etc_files(setkey_t) init_dontaudit_use_fds(setkey_t) @@ -24037,7 +24185,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +/etc/firestarter/firestarter\.sh gen_context(system_u:object_r:dhcpc_helper_exec_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.6.28/policy/modules/system/sysnetwork.if --- nsaserefpolicy/policy/modules/system/sysnetwork.if 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/system/sysnetwork.if 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/system/sysnetwork.if 2009-08-20 12:45:07.000000000 -0400 @@ -43,6 +43,39 @@ sysnet_domtrans_dhcpc($1) @@ -25362,7 +25510,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.28/policy/modules/system/userdomain.if --- nsaserefpolicy/policy/modules/system/userdomain.if 2009-07-28 13:28:33.000000000 -0400 -+++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-18 13:23:29.000000000 -0400 ++++ serefpolicy-3.6.28/policy/modules/system/userdomain.if 2009-08-20 09:09:55.000000000 -0400 @@ -30,8 +30,9 @@ ') @@ -25727,7 +25875,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ####################################### -@@ -420,34 +424,41 @@ +@@ -420,34 +424,43 @@ ## is the prefix for user_t). ## ## @@ -25761,6 +25909,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol - dev_rw_usbfs($1_t) + dev_rw_usbfs($1) + dev_rw_generic_usb_dev($1) ++ dev_read_video_dev($1) ++ dev_write_video_dev($1) - xserver_user_client($1_t, user_tmpfs_t) - xserver_xsession_entry_type($1_t) @@ -25787,7 +25937,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ####################################### -@@ -497,11 +508,7 @@ +@@ -497,11 +510,7 @@ attribute unpriv_userdomain; ') @@ -25800,7 +25950,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ############################## # -@@ -511,182 +518,195 @@ +@@ -511,182 +520,195 @@ # evolution and gnome-session try to create a netlink socket dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown }; dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write }; @@ -26072,7 +26222,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ####################################### -@@ -714,13 +734,26 @@ +@@ -714,13 +736,26 @@ userdom_base_user_template($1) @@ -26104,7 +26254,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol userdom_change_password_template($1) -@@ -738,70 +771,71 @@ +@@ -738,70 +773,71 @@ allow $1_t self:context contains; @@ -26209,7 +26359,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ') -@@ -838,6 +872,28 @@ +@@ -838,6 +874,28 @@ # Local policy # @@ -26238,7 +26388,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` loadkeys_run($1_t,$1_r) ') -@@ -868,7 +924,10 @@ +@@ -868,7 +926,10 @@ userdom_restricted_user_template($1) @@ -26250,7 +26400,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ############################## # -@@ -876,14 +935,19 @@ +@@ -876,14 +937,19 @@ # auth_role($1_r, $1_t) @@ -26275,7 +26425,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol logging_dontaudit_send_audit_msgs($1_t) # Need to to this just so screensaver will work. Should be moved to screensaver domain -@@ -891,28 +955,47 @@ +@@ -891,28 +957,47 @@ selinux_get_enforce_mode($1_t) optional_policy(` @@ -26330,7 +26480,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ') -@@ -946,8 +1029,8 @@ +@@ -946,8 +1031,8 @@ # Declarations # @@ -26340,7 +26490,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol userdom_common_user_template($1) ############################## -@@ -956,11 +1039,12 @@ +@@ -956,11 +1041,12 @@ # # port access is audited even if dac would not have allowed it, so dontaudit it here @@ -26355,7 +26505,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # cjp: why? files_read_kernel_symbol_table($1_t) -@@ -978,36 +1062,53 @@ +@@ -978,36 +1064,53 @@ ') ') @@ -26423,7 +26573,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ') -@@ -1042,7 +1143,7 @@ +@@ -1042,7 +1145,7 @@ # template(`userdom_admin_user_template',` gen_require(` @@ -26432,7 +26582,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ############################## -@@ -1051,8 +1152,7 @@ +@@ -1051,8 +1154,7 @@ # # Inherit rules for ordinary users. @@ -26442,7 +26592,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol domain_obj_id_change_exemption($1_t) role system_r types $1_t; -@@ -1075,7 +1175,8 @@ +@@ -1075,7 +1177,8 @@ # Skip authentication when pam_rootok is specified. allow $1_t self:passwd rootok; @@ -26452,7 +26602,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol kernel_read_software_raid_state($1_t) kernel_getattr_core_if($1_t) -@@ -1091,6 +1192,7 @@ +@@ -1091,6 +1194,7 @@ kernel_sigstop_unlabeled($1_t) kernel_signull_unlabeled($1_t) kernel_sigchld_unlabeled($1_t) @@ -26460,7 +26610,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol corenet_tcp_bind_generic_port($1_t) # allow setting up tunnels -@@ -1098,8 +1200,6 @@ +@@ -1098,8 +1202,6 @@ dev_getattr_generic_blk_files($1_t) dev_getattr_generic_chr_files($1_t) @@ -26469,7 +26619,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # Allow MAKEDEV to work dev_create_all_blk_files($1_t) dev_create_all_chr_files($1_t) -@@ -1154,20 +1254,6 @@ +@@ -1154,20 +1256,6 @@ # But presently necessary for installing the file_contexts file. seutil_manage_bin_policy($1_t) @@ -26490,7 +26640,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` postgresql_unconfined($1_t) ') -@@ -1213,6 +1299,7 @@ +@@ -1213,6 +1301,7 @@ dev_relabel_all_dev_nodes($1) files_create_boot_flag($1) @@ -26498,7 +26648,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # Necessary for managing /boot/efi fs_manage_dos_files($1) -@@ -1278,11 +1365,15 @@ +@@ -1278,11 +1367,15 @@ interface(`userdom_user_home_content',` gen_require(` type user_home_t; @@ -26514,7 +26664,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1374,12 +1465,13 @@ +@@ -1374,12 +1467,13 @@ ') allow $1 user_home_dir_t:dir search_dir_perms; @@ -26529,7 +26679,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## ## ## -@@ -1412,6 +1504,14 @@ +@@ -1412,6 +1506,14 @@ allow $1 user_home_dir_t:dir list_dir_perms; files_search_home($1) @@ -26544,7 +26694,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1427,9 +1527,11 @@ +@@ -1427,9 +1529,11 @@ interface(`userdom_dontaudit_list_user_home_dirs',` gen_require(` type user_home_dir_t; @@ -26556,7 +26706,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1486,6 +1588,25 @@ +@@ -1486,6 +1590,25 @@ allow $1 user_home_dir_t:dir relabelto; ') @@ -26582,7 +26732,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ######################################## ## ## Create directories in the home dir root with -@@ -1560,6 +1681,8 @@ +@@ -1560,6 +1683,8 @@ ') dontaudit $1 user_home_t:dir search_dir_perms; @@ -26591,7 +26741,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1653,6 +1776,7 @@ +@@ -1653,6 +1778,7 @@ type user_home_dir_t, user_home_t; ') @@ -26599,7 +26749,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t) files_search_home($1) ') -@@ -1780,19 +1904,32 @@ +@@ -1780,19 +1906,32 @@ # interface(`userdom_exec_user_home_content_files',` gen_require(` @@ -26639,7 +26789,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1827,6 +1964,7 @@ +@@ -1827,6 +1966,7 @@ interface(`userdom_manage_user_home_content_files',` gen_require(` type user_home_dir_t, user_home_t; @@ -26647,7 +26797,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') manage_files_pattern($1, user_home_t, user_home_t) -@@ -2374,7 +2512,7 @@ +@@ -2374,7 +2514,7 @@ ######################################## ## @@ -26656,7 +26806,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## ## ## -@@ -2728,11 +2866,32 @@ +@@ -2728,11 +2868,32 @@ # interface(`userdom_search_user_home_content',` gen_require(` @@ -26691,7 +26841,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2860,7 +3019,25 @@ +@@ -2860,7 +3021,25 @@ type user_tmp_t; ') @@ -26718,7 +26868,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2897,6 +3074,7 @@ +@@ -2897,6 +3076,7 @@ ') read_files_pattern($1, userdomain, userdomain) @@ -26726,7 +26876,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol kernel_search_proc($1) ') -@@ -3027,3 +3205,501 @@ +@@ -3027,3 +3207,501 @@ allow $1 userdomain:dbus send_msg; ') diff --git a/selinux-policy.spec b/selinux-policy.spec index 7088426..5d11155 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -20,7 +20,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.6.28 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -475,6 +475,9 @@ exit 0 %endif %changelog +* Thu Aug 20 2009 Dan Walsh 3.6.28-3 +- Fix system-config-services policy + * Wed Aug 19 2009 Dan Walsh 3.6.28-2 - Allow libvirt to change user componant of virt_domain