diff --git a/modules-targeted.conf b/modules-targeted.conf index 729db8c..9547e64 100644 --- a/modules-targeted.conf +++ b/modules-targeted.conf @@ -1522,3 +1522,10 @@ exim = module # kismet = module +# Layer: services +# Module: munin +# +# Munin +# +munin = module + diff --git a/policy-20070703.patch b/policy-20070703.patch index 5595cb3..1d0b1fe 100644 --- a/policy-20070703.patch +++ b/policy-20070703.patch @@ -1554,8 +1554,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.0.8/policy/modules/admin/netutils.te --- nsaserefpolicy/policy/modules/admin/netutils.te 2007-10-22 13:21:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/admin/netutils.te 2007-10-22 13:22:31.000000000 -0400 -@@ -94,9 +94,18 @@ ++++ serefpolicy-3.0.8/policy/modules/admin/netutils.te 2007-10-23 07:36:14.000000000 -0400 +@@ -94,9 +94,22 @@ ') optional_policy(` @@ -1567,6 +1567,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil +') + +optional_policy(` ++ vmware_append_log(netutils_t) ++') ++ ++optional_policy(` xen_append_log(netutils_t) ') @@ -1574,7 +1578,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil ######################################## # # Ping local policy -@@ -113,6 +122,7 @@ +@@ -113,6 +126,7 @@ corenet_tcp_sendrecv_all_if(ping_t) corenet_raw_sendrecv_all_if(ping_t) corenet_raw_sendrecv_all_nodes(ping_t) @@ -3214,7 +3218,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp auth_search_pam_console_data($1_userhelper_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.0.8/policy/modules/apps/vmware.fc --- nsaserefpolicy/policy/modules/apps/vmware.fc 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/vmware.fc 2007-10-22 13:22:31.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/vmware.fc 2007-10-23 07:34:52.000000000 -0400 @@ -21,19 +21,25 @@ /usr/bin/vmware-nmbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) /usr/bin/vmware-ping -- gen_context(system_u:object_r:vmware_host_exec_t,s0) @@ -3241,10 +3245,51 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.f ifdef(`distro_gentoo',` /opt/vmware/workstation/bin/vmnet-bridge -- gen_context(system_u:object_r:vmware_host_exec_t,s0) +@@ -49,3 +55,4 @@ + /opt/vmware/workstation/bin/vmware-wizard -- gen_context(system_u:object_r:vmware_exec_t,s0) + /opt/vmware/workstation/bin/vmware -- gen_context(system_u:object_r:vmware_exec_t,s0) + ') ++/var/log/vmware.* -- gen_context(system_u:object_r:vmware_log_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.if serefpolicy-3.0.8/policy/modules/apps/vmware.if +--- nsaserefpolicy/policy/modules/apps/vmware.if 2007-10-22 13:21:41.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/apps/vmware.if 2007-10-23 07:34:47.000000000 -0400 +@@ -202,3 +202,22 @@ + + allow $1 vmware_sys_conf_t:file append; + ') ++ ++######################################## ++## ++## Append to VMWare log files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`vmware_append_log',` ++ gen_require(` ++ type vmware_log_t; ++ ') ++ ++ logging_search_logs($1) ++ append_files_pattern($1,vmware_log_t,vmware_log_t) ++') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.0.8/policy/modules/apps/vmware.te --- nsaserefpolicy/policy/modules/apps/vmware.te 2007-10-22 13:21:41.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/apps/vmware.te 2007-10-22 13:22:31.000000000 -0400 -@@ -29,7 +29,7 @@ ++++ serefpolicy-3.0.8/policy/modules/apps/vmware.te 2007-10-23 07:34:35.000000000 -0400 +@@ -22,6 +22,9 @@ + type vmware_var_run_t; + files_pid_file(vmware_var_run_t) + ++type vmware_log_t; ++logging_log_file(vmware_log_t) ++ + ######################################## + # + # VMWare host local policy +@@ -29,7 +32,7 @@ allow vmware_host_t self:capability { setuid net_raw }; dontaudit vmware_host_t self:capability sys_tty_config; @@ -3253,6 +3298,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.t allow vmware_host_t self:fifo_file rw_fifo_file_perms; allow vmware_host_t self:unix_stream_socket create_stream_socket_perms; allow vmware_host_t self:rawip_socket create_socket_perms; +@@ -41,6 +44,9 @@ + manage_sock_files_pattern(vmware_host_t,vmware_var_run_t,vmware_var_run_t) + files_pid_filetrans(vmware_host_t,vmware_var_run_t,{ file sock_file }) + ++manage_files_pattern(vmware_host_t,vmware_log_t,vmware_log_t) ++logging_log_filetrans(vmware_host_t,vmware_log_t,{ file dir }) ++ + kernel_read_kernel_sysctls(vmware_host_t) + kernel_list_proc(vmware_host_t) + kernel_read_proc_symlinks(vmware_host_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.0.8/policy/modules/apps/wine.if --- nsaserefpolicy/policy/modules/apps/wine.if 2007-10-22 13:21:41.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/apps/wine.if 2007-10-22 13:22:31.000000000 -0400 @@ -13680,7 +13735,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.8/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/libraries.fc 2007-10-22 13:22:31.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/libraries.fc 2007-10-23 11:51:10.000000000 -0400 @@ -65,11 +65,12 @@ /opt/(.*/)?java/.+\.jar -- gen_context(system_u:object_r:lib_t,s0) /opt/(.*/)?jre.*/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -13695,7 +13750,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar ifdef(`distro_gentoo',` # despite the extensions, they are actually libs -@@ -135,6 +136,8 @@ +@@ -112,6 +113,7 @@ + /usr/lib/vlc/codec/libdmo_plugin.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) + /usr/lib/vlc/codec/librealaudio_plugin.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) + ++/usr/lib(64)?/codecs/drv[1-9c]\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) + /usr/(.*/)?lib(64)?(/.*)?/nvidia/.+\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0) + /usr/lib(64)?(/.*)?/nvidia/.+\.so(\..*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0) + /usr/lib(64)?/libsipphoneapi\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +@@ -135,6 +137,8 @@ /usr/(local/)?lib(64)?/(sse2/)?libfame-.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/NX/lib/libXcomp\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/NX/lib/libjpeg\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -13704,7 +13767,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar /usr/X11R6/lib/libGL\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/X11R6/lib/libXvMCNVIDIA\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -@@ -236,6 +239,8 @@ +@@ -236,6 +240,8 @@ /usr/lib(64)?/libdivxdecore\.so\.0 -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/libdivxencore\.so\.0 -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -13713,7 +13776,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar /usr/lib(64)?/python2.4/site-packages/M2Crypto/__m2crypto.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) # vmware -@@ -284,3 +289,9 @@ +@@ -284,3 +290,9 @@ /var/spool/postfix/lib(64)?(/.*)? gen_context(system_u:object_r:lib_t,s0) /var/spool/postfix/usr(/.*)? gen_context(system_u:object_r:lib_t,s0) /var/spool/postfix/lib(64)?/ld.*\.so.* -- gen_context(system_u:object_r:ld_so_t,s0) @@ -15571,7 +15634,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.8/policy/modules/system/sysnetwork.te --- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-10-22 13:21:40.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.te 2007-10-22 13:22:31.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/sysnetwork.te 2007-10-23 07:35:30.000000000 -0400 @@ -45,7 +45,7 @@ dontaudit dhcpc_t self:capability sys_tty_config; # for access("/etc/bashrc", X_OK) on Red Hat @@ -15627,7 +15690,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet ') optional_policy(` -@@ -254,6 +259,7 @@ +@@ -227,6 +232,10 @@ + ') + + optional_policy(` ++ vmware_append_log(dhcpc_t) ++') ++ ++optional_policy(` + kernel_read_xen_state(dhcpc_t) + kernel_write_xen_state(dhcpc_t) + xen_append_log(dhcpc_t) +@@ -254,6 +263,7 @@ allow ifconfig_t self:sem create_sem_perms; allow ifconfig_t self:msgq create_msgq_perms; allow ifconfig_t self:msg { send receive }; @@ -15635,7 +15709,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet # Create UDP sockets, necessary when called from dhcpc allow ifconfig_t self:udp_socket create_socket_perms; -@@ -280,8 +286,11 @@ +@@ -280,8 +290,11 @@ fs_getattr_xattr_fs(ifconfig_t) fs_search_auto_mountpoints(ifconfig_t) @@ -15647,14 +15721,21 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet domain_use_interactive_fds(ifconfig_t) -@@ -332,3 +341,7 @@ - xen_append_log(ifconfig_t) - xen_dontaudit_rw_unix_stream_sockets(ifconfig_t) +@@ -327,6 +340,14 @@ ') + + optional_policy(` ++ unconfined_dontaudit_rw_pipes(ifconfig_t) ++') + +optional_policy(` -+ unconfined_dontaudit_rw_pipes(ifconfig_t) ++ vmware_append_log(ifconfig_t) +') ++ ++optional_policy(` + kernel_read_xen_state(ifconfig_t) + kernel_write_xen_state(ifconfig_t) + xen_append_log(ifconfig_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.0.8/policy/modules/system/udev.te --- nsaserefpolicy/policy/modules/system/udev.te 2007-10-22 13:21:40.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/system/udev.te 2007-10-22 13:22:31.000000000 -0400 diff --git a/selinux-policy.spec b/selinux-policy.spec index 5c484ab..2b426f8 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -17,7 +17,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.0.8 -Release: 30%{?dist} +Release: 31%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -373,6 +373,10 @@ exit 0 %endif %changelog +* Tue Oct 23 2007 Dan Walsh 3.0.8-31 +- Fixes for vmware +- Additional textrel_shlib_t for codecs + * Mon Oct 22 2007 Dan Walsh 3.0.8-30 - Allow XServer to read /proc/self/cmdline - Fix unconfined cron jobs