## The prefix of the user domain (e.g., user
## is the prefix for user_t).
-@@ -699,188 +672,202 @@
+@@ -699,188 +672,206 @@
dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
@@ -30065,34 +30260,37 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
- inn_read_news_lib($1_t)
- inn_read_news_spool($1_t)
+ hal_dbus_chat($1_usertype)
-+ ')
')
optional_policy(`
- locate_read_lib_files($1_t)
-+ inetd_use_fds($1_usertype)
-+ inetd_rw_tcp_sockets($1_usertype)
++ nsplugin_per_role_template($1, $1_usertype, $1_r)
++ ')
')
- # for running depmod as part of the kernel packaging process
optional_policy(`
- modutils_read_module_config($1_t)
-+ inn_read_config($1_usertype)
-+ inn_read_news_lib($1_usertype)
-+ inn_read_news_spool($1_usertype)
++ inetd_use_fds($1_usertype)
++ inetd_rw_tcp_sockets($1_usertype)
')
optional_policy(`
- mta_rw_spool($1_t)
-+ locate_read_lib_files($1_usertype)
++ inn_read_config($1_usertype)
++ inn_read_news_lib($1_usertype)
++ inn_read_news_spool($1_usertype)
')
-
-+ # for running depmod as part of the kernel packaging process
optional_policy(`
- tunable_policy(`allow_user_mysql_connect',`
- mysql_stream_connect($1_t)
-- ')
++ locate_read_lib_files($1_usertype)
+ ')
++
++ # for running depmod as part of the kernel packaging process
++ optional_policy(`
+ modutils_read_module_config($1_usertype)
')
@@ -30156,7 +30354,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
#######################################
-@@ -902,9 +889,7 @@
+@@ -902,9 +893,7 @@
##
#
template(`userdom_login_user_template', `
@@ -30167,7 +30365,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
userdom_base_user_template($1)
-@@ -930,74 +915,77 @@
+@@ -930,74 +919,77 @@
allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
dontaudit $1_t self:process setrlimit;
@@ -30278,7 +30476,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
')
-@@ -1031,9 +1019,6 @@
+@@ -1031,9 +1023,6 @@
domain_interactive_fd($1_t)
typeattribute $1_devpts_t user_ptynode;
@@ -30288,7 +30486,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
typeattribute $1_tty_device_t user_ttynode;
##############################
-@@ -1042,12 +1027,25 @@
+@@ -1042,12 +1031,25 @@
#
# privileged home directory writers
@@ -30320,7 +30518,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
loadkeys_run($1_t,$1_r,$1_tty_device_t)
-@@ -1087,14 +1085,16 @@
+@@ -1087,14 +1089,16 @@
#
authlogin_per_role_template($1, $1_t, $1_r)
@@ -30342,7 +30540,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
logging_dontaudit_send_audit_msgs($1_t)
# Need to to this just so screensaver will work. Should be moved to screensaver domain
-@@ -1102,28 +1102,23 @@
+@@ -1102,28 +1106,19 @@
selinux_get_enforce_mode($1_t)
optional_policy(`
@@ -30356,13 +30554,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
-
- optional_policy(`
- consolekit_dbus_chat($1_t)
-+ apache_per_role_template($1, $1_usertype, $1_r)
- ')
-
- optional_policy(`
+- ')
+-
+- optional_policy(`
- cups_dbus_chat($1_t)
- ')
-+ nsplugin_per_role_template($1, $1_usertype, $1_r)
++ apache_per_role_template($1, $1_usertype, $1_r)
')
optional_policy(`
@@ -30399,7 +30596,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# cjp: why?
files_read_kernel_symbol_table($1_t)
-@@ -1189,36 +1182,49 @@
+@@ -1189,36 +1182,45 @@
')
')
@@ -30416,36 +30613,32 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_tcp_bind_all_nodes($1_t)
- corenet_tcp_bind_generic_port($1_t)
+ corenet_tcp_bind_all_unreserved_ports($1_t)
++ ')
++
++ # Run pppd in pppd_t by default for user
++ optional_policy(`
++ ppp_run_cond($1_t, $1_r, { $1_tty_device_t $1_devpts_t })
')
-+ # Run pppd in pppd_t by default for user
optional_policy(`
- netutils_run_ping_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
- netutils_run_traceroute_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
-+ ppp_run_cond($1_t, $1_r, { $1_tty_device_t $1_devpts_t })
++ games_rw_data($1_usertype)
')
optional_policy(`
- postgresql_userdom_template($1,$1_t,$1_r)
-+ games_rw_data($1_usertype)
++ mount_run($1_t, $1_r, { $1_tty_device_t $1_devpts_t })
')
- # Run pppd in pppd_t by default for user
optional_policy(`
- ppp_run_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t })
-+ mount_run($1_t, $1_r, { $1_tty_device_t $1_devpts_t })
++ cron_per_role_template($1, $1_t, $1_r)
')
optional_policy(`
- setroubleshoot_stream_connect($1_t)
-+ cron_per_role_template($1, $1_t, $1_r)
-+ ')
-+
-+ optional_policy(`
-+ nsplugin_per_role_template($1, $1_usertype, $1_r)
-+ ')
-+
-+ optional_policy(`
+ polkit_per_role_template($1, $1_usertype, $1_r)
+ ')
+
@@ -30462,7 +30655,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
')
-@@ -1295,8 +1301,6 @@
+@@ -1295,8 +1297,6 @@
# Manipulate other users crontab.
allow $1_t self:passwd crontab;
@@ -30471,7 +30664,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_software_raid_state($1_t)
kernel_getattr_core_if($1_t)
kernel_getattr_message_if($1_t)
-@@ -1318,8 +1322,6 @@
+@@ -1318,8 +1318,6 @@
dev_getattr_generic_blk_files($1_t)
dev_getattr_generic_chr_files($1_t)
@@ -30480,7 +30673,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Allow MAKEDEV to work
dev_create_all_blk_files($1_t)
dev_create_all_chr_files($1_t)
-@@ -1374,13 +1376,6 @@
+@@ -1374,13 +1372,6 @@
# But presently necessary for installing the file_contexts file.
seutil_manage_bin_policy($1_t)
@@ -30494,7 +30687,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
postgresql_unconfined($1_t)
')
-@@ -1432,6 +1427,7 @@
+@@ -1432,6 +1423,7 @@
dev_relabel_all_dev_nodes($1)
files_create_boot_flag($1)
@@ -30502,7 +30695,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# Necessary for managing /boot/efi
fs_manage_dos_files($1)
-@@ -1461,10 +1457,6 @@
+@@ -1461,10 +1453,6 @@
seutil_run_semanage($1,$2,$3)
seutil_run_setfiles($1, $2, $3)
@@ -30513,7 +30706,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
aide_run($1,$2, $3)
')
-@@ -1484,6 +1476,14 @@
+@@ -1484,6 +1472,14 @@
optional_policy(`
netlabel_run_mgmt($1,$2, $3)
')
@@ -30528,7 +30721,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1741,11 +1741,15 @@
+@@ -1741,11 +1737,15 @@
#
template(`userdom_user_home_content',`
gen_require(`
@@ -30547,7 +30740,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1841,11 +1845,11 @@
+@@ -1841,11 +1841,11 @@
#
template(`userdom_search_user_home_dirs',`
gen_require(`
@@ -30561,7 +30754,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1875,11 +1879,11 @@
+@@ -1875,11 +1875,11 @@
#
template(`userdom_list_user_home_dirs',`
gen_require(`
@@ -30575,7 +30768,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1923,12 +1927,12 @@
+@@ -1923,12 +1923,12 @@
#
template(`userdom_user_home_domtrans',`
gen_require(`
@@ -30591,7 +30784,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1958,10 +1962,11 @@
+@@ -1958,10 +1958,11 @@
#
template(`userdom_dontaudit_list_user_home_dirs',`
gen_require(`
@@ -30605,7 +30798,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -1993,11 +1998,47 @@
+@@ -1993,11 +1994,47 @@
#
template(`userdom_manage_user_home_content_dirs',`
gen_require(`
@@ -30655,7 +30848,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2029,10 +2070,10 @@
+@@ -2029,10 +2066,10 @@
#
template(`userdom_dontaudit_setattr_user_home_content_files',`
gen_require(`
@@ -30668,7 +30861,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2062,11 +2103,11 @@
+@@ -2062,11 +2099,11 @@
#
template(`userdom_read_user_home_content_files',`
gen_require(`
@@ -30682,7 +30875,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2096,11 +2137,11 @@
+@@ -2096,11 +2133,11 @@
#
template(`userdom_dontaudit_read_user_home_content_files',`
gen_require(`
@@ -30697,7 +30890,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2130,10 +2171,14 @@
+@@ -2130,10 +2167,14 @@
#
template(`userdom_dontaudit_write_user_home_content_files',`
gen_require(`
@@ -30714,7 +30907,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2163,11 +2208,11 @@
+@@ -2163,11 +2204,11 @@
#
template(`userdom_read_user_home_content_symlinks',`
gen_require(`
@@ -30728,7 +30921,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2197,11 +2242,11 @@
+@@ -2197,11 +2238,11 @@
#
template(`userdom_exec_user_home_content_files',`
gen_require(`
@@ -30742,7 +30935,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2231,10 +2276,10 @@
+@@ -2231,10 +2272,10 @@
#
template(`userdom_dontaudit_exec_user_home_content_files',`
gen_require(`
@@ -30755,7 +30948,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2266,12 +2311,12 @@
+@@ -2266,12 +2307,12 @@
#
template(`userdom_manage_user_home_content_files',`
gen_require(`
@@ -30771,7 +30964,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2303,10 +2348,10 @@
+@@ -2303,10 +2344,10 @@
#
template(`userdom_dontaudit_manage_user_home_content_dirs',`
gen_require(`
@@ -30784,7 +30977,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2338,12 +2383,12 @@
+@@ -2338,12 +2379,12 @@
#
template(`userdom_manage_user_home_content_symlinks',`
gen_require(`
@@ -30800,7 +30993,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2375,12 +2420,12 @@
+@@ -2375,12 +2416,12 @@
#
template(`userdom_manage_user_home_content_pipes',`
gen_require(`
@@ -30816,7 +31009,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2412,12 +2457,12 @@
+@@ -2412,12 +2453,12 @@
#
template(`userdom_manage_user_home_content_sockets',`
gen_require(`
@@ -30832,7 +31025,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2462,11 +2507,11 @@
+@@ -2462,11 +2503,11 @@
#
template(`userdom_user_home_dir_filetrans',`
gen_require(`
@@ -30846,7 +31039,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2511,11 +2556,11 @@
+@@ -2511,11 +2552,11 @@
#
template(`userdom_user_home_content_filetrans',`
gen_require(`
@@ -30860,7 +31053,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2555,11 +2600,11 @@
+@@ -2555,11 +2596,11 @@
#
template(`userdom_user_home_dir_filetrans_user_home_content',`
gen_require(`
@@ -30874,7 +31067,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2589,11 +2634,11 @@
+@@ -2589,11 +2630,11 @@
#
template(`userdom_write_user_tmp_sockets',`
gen_require(`
@@ -30888,7 +31081,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2623,11 +2668,11 @@
+@@ -2623,11 +2664,11 @@
#
template(`userdom_list_user_tmp',`
gen_require(`
@@ -30902,7 +31095,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2659,10 +2704,10 @@
+@@ -2659,10 +2700,10 @@
#
template(`userdom_dontaudit_list_user_tmp',`
gen_require(`
@@ -30915,7 +31108,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2694,10 +2739,10 @@
+@@ -2694,10 +2735,10 @@
#
template(`userdom_dontaudit_manage_user_tmp_dirs',`
gen_require(`
@@ -30928,7 +31121,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2727,12 +2772,12 @@
+@@ -2727,12 +2768,12 @@
#
template(`userdom_read_user_tmp_files',`
gen_require(`
@@ -30944,7 +31137,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2764,10 +2809,10 @@
+@@ -2764,10 +2805,10 @@
#
template(`userdom_dontaudit_read_user_tmp_files',`
gen_require(`
@@ -30957,7 +31150,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2799,10 +2844,10 @@
+@@ -2799,10 +2840,10 @@
#
template(`userdom_dontaudit_append_user_tmp_files',`
gen_require(`
@@ -30970,7 +31163,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2832,12 +2877,12 @@
+@@ -2832,12 +2873,12 @@
#
template(`userdom_rw_user_tmp_files',`
gen_require(`
@@ -30986,7 +31179,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2869,10 +2914,10 @@
+@@ -2869,10 +2910,10 @@
#
template(`userdom_dontaudit_manage_user_tmp_files',`
gen_require(`
@@ -30999,7 +31192,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2904,12 +2949,12 @@
+@@ -2904,12 +2945,12 @@
#
template(`userdom_read_user_tmp_symlinks',`
gen_require(`
@@ -31015,7 +31208,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2941,11 +2986,11 @@
+@@ -2941,11 +2982,11 @@
#
template(`userdom_manage_user_tmp_dirs',`
gen_require(`
@@ -31029,7 +31222,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -2977,11 +3022,11 @@
+@@ -2977,11 +3018,11 @@
#
template(`userdom_manage_user_tmp_files',`
gen_require(`
@@ -31043,7 +31236,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -3013,11 +3058,11 @@
+@@ -3013,11 +3054,11 @@
#
template(`userdom_manage_user_tmp_symlinks',`
gen_require(`
@@ -31057,7 +31250,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -3049,11 +3094,11 @@
+@@ -3049,11 +3090,11 @@
#
template(`userdom_manage_user_tmp_pipes',`
gen_require(`
@@ -31071,7 +31264,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -3085,11 +3130,11 @@
+@@ -3085,11 +3126,11 @@
#
template(`userdom_manage_user_tmp_sockets',`
gen_require(`
@@ -31085,7 +31278,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -3134,10 +3179,10 @@
+@@ -3134,10 +3175,10 @@
#
template(`userdom_user_tmp_filetrans',`
gen_require(`
@@ -31098,7 +31291,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_search_tmp($2)
')
-@@ -3178,19 +3223,19 @@
+@@ -3178,19 +3219,19 @@
#
template(`userdom_tmp_filetrans_user_tmp',`
gen_require(`
@@ -31122,7 +31315,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##
##
## This is a templated interface, and should only
-@@ -3211,13 +3256,13 @@
+@@ -3211,13 +3252,13 @@
#
template(`userdom_rw_user_tmpfs_files',`
gen_require(`
@@ -31140,7 +31333,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -4616,11 +4661,11 @@
+@@ -4616,11 +4657,11 @@
#
interface(`userdom_search_all_users_home_dirs',`
gen_require(`
@@ -31154,7 +31347,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -4640,6 +4685,14 @@
+@@ -4640,6 +4681,14 @@
files_list_home($1)
allow $1 home_dir_type:dir list_dir_perms;
@@ -31169,7 +31362,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -4677,6 +4730,8 @@
+@@ -4677,6 +4726,8 @@
')
dontaudit $1 { home_dir_type home_type }:dir search_dir_perms;
@@ -31178,7 +31371,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -4721,6 +4776,25 @@
+@@ -4721,6 +4772,25 @@
########################################
##
@@ -31204,7 +31397,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Create, read, write, and delete all files
## in all users home directories.
##
-@@ -4946,7 +5020,7 @@
+@@ -4946,7 +5016,7 @@
########################################
##
@@ -31213,11 +31406,103 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
##
##
##
-@@ -5318,6 +5392,42 @@
+@@ -5318,7 +5388,7 @@
########################################
##
+-## Read and write unprivileged user ttys.
+## Write all unprivileged users files in /tmp
+ ##
+ ##
+ ##
+@@ -5326,18 +5396,17 @@
+ ##
+ ##
+ #
+-interface(`userdom_use_unpriv_users_ttys',`
++interface(`userdom_manage_unpriv_users_tmp_files',`
+ gen_require(`
+- attribute user_ttynode;
++ type user_tmp_t;
+ ')
+
+- allow $1 user_ttynode:chr_file rw_term_perms;
++ manage_files_pattern($1, user_tmp_t, user_tmp_t)
+ ')
+
+ ########################################
+ ##
+-## Do not audit attempts to use unprivileged
+-## user ttys.
++## Write all unprivileged users lnk_files in /tmp
+ ##
+ ##
+ ##
+@@ -5345,17 +5414,17 @@
+ ##
+ ##
+ #
+-interface(`userdom_dontaudit_use_unpriv_users_ttys',`
++interface(`userdom_manage_unpriv_users_tmp_symlinks',`
+ gen_require(`
+- attribute user_ttynode;
++ type user_tmp_t;
+ ')
+
+- dontaudit $1 user_ttynode:chr_file rw_file_perms;
++ manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
+ ')
+
+ ########################################
+ ##
+-## Read the process state of all user domains.
++## Read and write unprivileged user ttys.
+ ##
+ ##
+ ##
+@@ -5363,18 +5432,18 @@
+ ##
+ ##
+ #
+-interface(`userdom_read_all_users_state',`
++interface(`userdom_use_unpriv_users_ttys',`
+ gen_require(`
+- attribute userdomain;
++ attribute user_ttynode;
+ ')
+
+- read_files_pattern($1,userdomain,userdomain)
+- kernel_search_proc($1)
++ allow $1 user_ttynode:chr_file rw_term_perms;
+ ')
+
+ ########################################
+ ##
+-## Get the attributes of all user domains.
++## Do not audit attempts to use unprivileged
++## user ttys.
+ ##
+ ##
+ ##
+@@ -5382,17 +5451,54 @@
+ ##
+ ##
+ #
+-interface(`userdom_getattr_all_users',`
++interface(`userdom_dontaudit_use_unpriv_users_ttys',`
+ gen_require(`
+- attribute userdomain;
++ attribute user_ttynode;
+ ')
+
+- allow $1 userdomain:process getattr;
++ dontaudit $1 user_ttynode:chr_file rw_file_perms;
+ ')
+
+ ########################################
+ ##
+-## Inherit the file descriptors from all user domains
++## Read the process state of all user domains.
+##
+##
+##
@@ -31225,17 +31510,18 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+##
+##
+#
-+interface(`userdom_manage_unpriv_users_tmp_files',`
++interface(`userdom_read_all_users_state',`
+ gen_require(`
-+ type user_tmp_t;
++ attribute userdomain;
+ ')
+
-+ manage_files_pattern($1, user_tmp_t, user_tmp_t)
++ ps_process_pattern($1, userdomain)
++ kernel_search_proc($1)
+')
+
+########################################
+##
-+## Write all unprivileged users lnk_files in /tmp
++## Get the attributes of all user domains.
+##
+##
+##
@@ -31243,29 +31529,21 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+##
+##
+#
-+interface(`userdom_manage_unpriv_users_tmp_symlinks',`
++interface(`userdom_getattr_all_users',`
+ gen_require(`
-+ type user_tmp_t;
++ attribute userdomain;
+ ')
+
-+ manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
++ allow $1 userdomain:process getattr;
+')
+
+########################################
+##
- ## Read and write unprivileged user ttys.
++## Inherit the file descriptors from all user domains
##
##
-@@ -5368,7 +5478,7 @@
- attribute userdomain;
- ')
-
-- read_files_pattern($1,userdomain,userdomain)
-+ ps_process_pattern($1, userdomain)
- kernel_search_proc($1)
- ')
-
-@@ -5483,6 +5593,42 @@
+ ##
+@@ -5483,6 +5589,42 @@
########################################
##
@@ -31308,7 +31586,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## Send a dbus message to all user domains.
##
##
-@@ -5513,3 +5659,548 @@
+@@ -5513,3 +5655,548 @@
interface(`userdom_unconfined',`
refpolicywarn(`$0($*) has been deprecated.')
')
@@ -31857,9 +32135,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ manage_fifo_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+ fs_tmpfs_filetrans($1, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.5.12/policy/modules/system/userdomain.te
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.5.13/policy/modules/system/userdomain.te
--- nsaserefpolicy/policy/modules/system/userdomain.te 2008-10-14 11:58:09.000000000 -0400
-+++ serefpolicy-3.5.12/policy/modules/system/userdomain.te 2008-10-14 15:00:15.000000000 -0400
++++ serefpolicy-3.5.13/policy/modules/system/userdomain.te 2008-10-17 10:31:27.000000000 -0400
@@ -8,13 +8,6 @@
##
@@ -31978,9 +32256,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ manage_fifo_files_pattern(privhome, cifs_t, cifs_t)
+')
+
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.fc serefpolicy-3.5.12/policy/modules/system/xen.fc
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.fc serefpolicy-3.5.13/policy/modules/system/xen.fc
--- nsaserefpolicy/policy/modules/system/xen.fc 2008-08-07 11:15:12.000000000 -0400
-+++ serefpolicy-3.5.12/policy/modules/system/xen.fc 2008-10-14 15:00:15.000000000 -0400
++++ serefpolicy-3.5.13/policy/modules/system/xen.fc 2008-10-17 10:31:27.000000000 -0400
@@ -20,6 +20,7 @@
/var/run/xenconsoled\.pid -- gen_context(system_u:object_r:xenconsoled_var_run_t,s0)
/var/run/xend(/.*)? gen_context(system_u:object_r:xend_var_run_t,s0)
@@ -31989,9 +32267,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
/var/run/xenstore\.pid -- gen_context(system_u:object_r:xenstored_var_run_t,s0)
/var/run/xenstored(/.*)? gen_context(system_u:object_r:xenstored_var_run_t,s0)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.5.12/policy/modules/system/xen.if
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.5.13/policy/modules/system/xen.if
--- nsaserefpolicy/policy/modules/system/xen.if 2008-08-07 11:15:12.000000000 -0400
-+++ serefpolicy-3.5.12/policy/modules/system/xen.if 2008-10-14 15:00:15.000000000 -0400
++++ serefpolicy-3.5.13/policy/modules/system/xen.if 2008-10-17 10:31:27.000000000 -0400
@@ -167,11 +167,14 @@
#
interface(`xen_stream_connect',`
@@ -32033,9 +32311,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+ allow $1 xend_var_lib_t:dir search_dir_perms;
+ rw_files_pattern($1, xen_image_t, xen_image_t)
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.5.12/policy/modules/system/xen.te
---- nsaserefpolicy/policy/modules/system/xen.te 2008-08-07 11:15:12.000000000 -0400
-+++ serefpolicy-3.5.12/policy/modules/system/xen.te 2008-10-14 15:00:15.000000000 -0400
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.5.13/policy/modules/system/xen.te
+--- nsaserefpolicy/policy/modules/system/xen.te 2008-10-16 17:21:16.000000000 -0400
++++ serefpolicy-3.5.13/policy/modules/system/xen.te 2008-10-17 10:31:27.000000000 -0400
@@ -6,6 +6,13 @@
# Declarations
#
@@ -32114,18 +32392,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
manage_files_pattern(xend_t,xend_var_log_t,xend_var_log_t)
manage_sock_files_pattern(xend_t,xend_var_log_t,xend_var_log_t)
logging_log_filetrans(xend_t,xend_var_log_t,{ sock_file file dir })
-@@ -122,15 +135,13 @@
+@@ -122,12 +135,13 @@
manage_fifo_files_pattern(xend_t,xend_var_lib_t,xend_var_lib_t)
files_var_lib_filetrans(xend_t,xend_var_lib_t,{ file dir })
+init_stream_connect_script(xend_t)
+
# transition to store
--domain_auto_trans(xend_t, xenstored_exec_t, xenstored_t)
--allow xenstored_t xend_t:fd use;
--allow xenstored_t xend_t:process sigchld;
--allow xenstored_t xend_t:fifo_file write;
-+domtrans_pattern(xend_t, xenstored_exec_t, xenstored_t)
+ domtrans_pattern(xend_t, xenstored_exec_t, xenstored_t)
# transition to console
-domain_auto_trans(xend_t, xenconsoled_exec_t, xenconsoled_t)
@@ -32134,7 +32408,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
kernel_read_kernel_sysctls(xend_t)
kernel_read_system_state(xend_t)
-@@ -176,6 +187,7 @@
+@@ -173,6 +187,7 @@
files_manage_etc_runtime_files(xend_t)
files_etc_filetrans_etc_runtime(xend_t,file)
files_read_usr_files(xend_t)
@@ -32142,7 +32416,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
storage_raw_read_fixed_disk(xend_t)
storage_raw_write_fixed_disk(xend_t)
-@@ -207,11 +219,15 @@
+@@ -204,11 +219,15 @@
sysnet_read_dhcpc_pid(xend_t)
sysnet_rw_dhcp_config(xend_t)
@@ -32159,16 +32433,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
consoletype_exec(xend_t)
-@@ -224,7 +240,7 @@
-
- allow xenconsoled_t self:capability { dac_override fsetid ipc_lock };
- allow xenconsoled_t self:unix_stream_socket create_stream_socket_perms;
--allow xenconsoled_t self:fifo_file { read write };
-+allow xenconsoled_t self:fifo_file rw_fifo_file_perms;
-
- allow xenconsoled_t xen_devpts_t:chr_file rw_term_perms;
-
-@@ -245,6 +261,8 @@
+@@ -242,6 +261,8 @@
files_read_usr_files(xenconsoled_t)
@@ -32177,7 +32442,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
term_create_pty(xenconsoled_t,xen_devpts_t);
term_use_generic_ptys(xenconsoled_t)
term_use_console(xenconsoled_t)
-@@ -257,7 +275,7 @@
+@@ -254,7 +275,7 @@
miscfiles_read_localization(xenconsoled_t)
@@ -32186,7 +32451,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
xen_stream_connect_xenstore(xenconsoled_t)
########################################
-@@ -265,15 +283,25 @@
+@@ -262,15 +283,25 @@
# Xen store local policy
#
@@ -32213,14 +32478,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
# var/lib files for xenstored
manage_dirs_pattern(xenstored_t,xenstored_var_lib_t,xenstored_var_lib_t)
manage_files_pattern(xenstored_t,xenstored_var_lib_t,xenstored_var_lib_t)
-@@ -318,12 +346,13 @@
- allow xm_t self:capability { dac_override ipc_lock sys_tty_config };
-
- # internal communication is often done using fifo and unix sockets.
--allow xm_t self:fifo_file { read write };
-+allow xm_t self:fifo_file rw_fifo_file_perms;
- allow xm_t self:unix_stream_socket { create_stream_socket_perms connectto };
- allow xm_t self:tcp_socket create_stream_socket_perms;
+@@ -321,6 +352,7 @@
manage_files_pattern(xm_t,xend_var_lib_t,xend_var_lib_t)
manage_fifo_files_pattern(xm_t,xend_var_lib_t,xend_var_lib_t)
@@ -32228,7 +32486,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
files_search_var_lib(xm_t)
allow xm_t xen_image_t:dir rw_dir_perms;
-@@ -336,6 +365,7 @@
+@@ -333,6 +365,7 @@
kernel_write_xen_state(xm_t)
corecmd_exec_bin(xm_t)
@@ -32236,7 +32494,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_tcp_sendrecv_generic_if(xm_t)
corenet_tcp_sendrecv_all_nodes(xm_t)
-@@ -351,8 +381,11 @@
+@@ -348,8 +381,11 @@
storage_raw_read_fixed_disk(xm_t)
@@ -32248,7 +32506,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
init_rw_script_stream_sockets(xm_t)
init_use_fds(xm_t)
-@@ -363,6 +396,23 @@
+@@ -360,6 +396,23 @@
sysnet_read_config(xm_t)
@@ -32272,10 +32530,152 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+optional_policy(`
+ unconfined_domain(xend_t)
+')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.5.12/policy/support/obj_perm_sets.spt
---- nsaserefpolicy/policy/support/obj_perm_sets.spt 2008-08-07 11:15:13.000000000 -0400
-+++ serefpolicy-3.5.12/policy/support/obj_perm_sets.spt 2008-10-14 15:00:15.000000000 -0400
-@@ -316,3 +316,13 @@
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/policy_capabilities serefpolicy-3.5.13/policy/policy_capabilities
+--- nsaserefpolicy/policy/policy_capabilities 2008-10-16 17:21:16.000000000 -0400
++++ serefpolicy-3.5.13/policy/policy_capabilities 2008-10-17 10:31:27.000000000 -0400
+@@ -29,4 +29,4 @@
+ # chr_file: open
+ # blk_file: open
+ #
+-policycap open_perms;
++#policycap open_perms;
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.5.13/policy/support/obj_perm_sets.spt
+--- nsaserefpolicy/policy/support/obj_perm_sets.spt 2008-10-16 17:21:16.000000000 -0400
++++ serefpolicy-3.5.13/policy/support/obj_perm_sets.spt 2008-10-17 10:31:27.000000000 -0400
+@@ -59,22 +59,22 @@
+ #
+ # Permissions for executing files.
+ #
+-define(`x_file_perms', `{ getattr open execute } refpolicywarn(`$0 is deprecated please use { getattr execute } instead.')')
++define(`x_file_perms', `{ getattr execute } refpolicywarn(`$0 is deprecated please use { getattr execute } instead.')')
+
+ #
+ # Permissions for reading files and their attributes.
+ #
+-define(`r_file_perms', `{ open read getattr lock ioctl } refpolicywarn(`$0 is deprecated please use read_file_perms instead.')')
++define(`r_file_perms', `{ read getattr lock ioctl } refpolicywarn(`$0 is deprecated please use read_file_perms instead.')')
+
+ #
+ # Permissions for reading and executing files.
+ #
+-define(`rx_file_perms', `{ open read getattr lock execute ioctl } refpolicywarn(`$0 is deprecated please use { mmap_file_perms ioctl lock } instead.')')
++define(`rx_file_perms', `{ read getattr lock execute ioctl } refpolicywarn(`$0 is deprecated please use { mmap_file_perms ioctl lock } instead.')')
+
+ #
+ # Permissions for reading and appending to files.
+ #
+-define(`ra_file_perms', `{ open ioctl read getattr lock append } refpolicywarn(`$0 is deprecated please use { read_file_perms append_file_perms } instead.')')
++define(`ra_file_perms', `{ ioctl read getattr lock append } refpolicywarn(`$0 is deprecated please use { read_file_perms append_file_perms } instead.')')
+
+ #
+ # Permissions for linking, unlinking and renaming files.
+@@ -89,12 +89,17 @@
+ #
+ # Permissions for reading directories and their attributes.
+ #
+-define(`r_dir_perms', `{ open read getattr lock search ioctl } refpolicywarn(`$0 is deprecated please use list_dir_perms instead.')')
++define(`r_dir_perms', `{ read getattr lock search ioctl } refpolicywarn(`$0 is deprecated please use list_dir_perms instead.')')
++
++#
++# Permissions for reading and writing directories and their attributes.
++#
++define(`rw_dir_perms', `{ read getattr lock search ioctl add_name remove_name write }')
+
+ #
+ # Permissions for reading and adding names to directories.
+ #
+-define(`ra_dir_perms', `{ open read getattr lock search ioctl add_name write } refpolicywarn(`$0 is deprecated please use { list_dir_perms add_entry_dir_perms } instead.')')
++define(`ra_dir_perms', `{ read getattr lock search ioctl add_name write } refpolicywarn(`$0 is deprecated please use { list_dir_perms add_entry_dir_perms } instead.')')
+
+
+ #
+@@ -182,10 +187,9 @@
+ define(`getattr_dir_perms',`{ getattr }')
+ define(`setattr_dir_perms',`{ setattr }')
+ define(`search_dir_perms',`{ getattr search }')
+-define(`list_dir_perms',`{ getattr search open read lock ioctl }')
+-define(`add_entry_dir_perms',`{ getattr search open lock ioctl write add_name }')
+-define(`del_entry_dir_perms',`{ getattr search open lock ioctl write remove_name }')
+-define(`rw_dir_perms', `{ open read getattr lock search ioctl add_name remove_name write }')
++define(`list_dir_perms',`{ getattr search read lock ioctl }')
++define(`add_entry_dir_perms',`{ getattr search lock ioctl write add_name }')
++define(`del_entry_dir_perms',`{ getattr search lock ioctl write remove_name }')
+ define(`create_dir_perms',`{ getattr create }')
+ define(`rename_dir_perms',`{ getattr rename }')
+ define(`delete_dir_perms',`{ getattr rmdir }')
+@@ -199,12 +203,12 @@
+ #
+ define(`getattr_file_perms',`{ getattr }')
+ define(`setattr_file_perms',`{ setattr }')
+-define(`read_file_perms',`{ getattr open read lock ioctl }')
+-define(`mmap_file_perms',`{ getattr open read execute ioctl }')
+-define(`exec_file_perms',`{ getattr open read execute execute_no_trans }')
+-define(`append_file_perms',`{ getattr open append lock ioctl }')
+-define(`write_file_perms',`{ getattr open write append lock ioctl }')
+-define(`rw_file_perms',`{ getattr open read write append ioctl lock }')
++define(`read_file_perms',`{ getattr read lock ioctl }')
++define(`mmap_file_perms',`{ getattr read execute ioctl }')
++define(`exec_file_perms',`{ getattr read execute execute_no_trans }')
++define(`append_file_perms',`{ getattr append lock ioctl }')
++define(`write_file_perms',`{ getattr write append lock ioctl }')
++define(`rw_file_perms',`{ getattr read write append ioctl lock }')
+ define(`create_file_perms',`{ getattr create open }')
+ define(`rename_file_perms',`{ getattr rename }')
+ define(`delete_file_perms',`{ getattr unlink }')
+@@ -235,10 +239,10 @@
+ #
+ define(`getattr_fifo_file_perms',`{ getattr }')
+ define(`setattr_fifo_file_perms',`{ setattr }')
+-define(`read_fifo_file_perms',`{ getattr open read lock ioctl }')
+-define(`append_fifo_file_perms',`{ getattr open append lock ioctl }')
+-define(`write_fifo_file_perms',`{ getattr open write append lock ioctl }')
+-define(`rw_fifo_file_perms',`{ getattr open read write append ioctl lock }')
++define(`read_fifo_file_perms',`{ getattr read lock ioctl }')
++define(`append_fifo_file_perms',`{ getattr append lock ioctl }')
++define(`write_fifo_file_perms',`{ getattr write append lock ioctl }')
++define(`rw_fifo_file_perms',`{ getattr read write append ioctl lock }')
+ define(`create_fifo_file_perms',`{ getattr create open }')
+ define(`rename_fifo_file_perms',`{ getattr rename }')
+ define(`delete_fifo_file_perms',`{ getattr unlink }')
+@@ -268,10 +272,10 @@
+ #
+ define(`getattr_blk_file_perms',`{ getattr }')
+ define(`setattr_blk_file_perms',`{ setattr }')
+-define(`read_blk_file_perms',`{ getattr open read lock ioctl }')
+-define(`append_blk_file_perms',`{ getattr open append lock ioctl }')
+-define(`write_blk_file_perms',`{ getattr open write append lock ioctl }')
+-define(`rw_blk_file_perms',`{ getattr open read write append ioctl lock }')
++define(`read_blk_file_perms',`{ getattr read lock ioctl }')
++define(`append_blk_file_perms',`{ getattr append lock ioctl }')
++define(`write_blk_file_perms',`{ getattr write append lock ioctl }')
++define(`rw_blk_file_perms',`{ getattr read write append ioctl lock }')
+ define(`create_blk_file_perms',`{ getattr create }')
+ define(`rename_blk_file_perms',`{ getattr rename }')
+ define(`delete_blk_file_perms',`{ getattr unlink }')
+@@ -285,10 +289,10 @@
+ #
+ define(`getattr_chr_file_perms',`{ getattr }')
+ define(`setattr_chr_file_perms',`{ setattr }')
+-define(`read_chr_file_perms',`{ getattr open read lock ioctl }')
+-define(`append_chr_file_perms',`{ getattr open append lock ioctl }')
+-define(`write_chr_file_perms',`{ getattr open write append lock ioctl }')
+-define(`rw_chr_file_perms',`{ getattr open read write append ioctl lock }')
++define(`read_chr_file_perms',`{ getattr read lock ioctl }')
++define(`append_chr_file_perms',`{ getattr append lock ioctl }')
++define(`write_chr_file_perms',`{ getattr write append lock ioctl }')
++define(`rw_chr_file_perms',`{ getattr read write append ioctl lock }')
+ define(`create_chr_file_perms',`{ getattr create }')
+ define(`rename_chr_file_perms',`{ getattr rename }')
+ define(`delete_chr_file_perms',`{ getattr unlink }')
+@@ -305,10 +309,20 @@
+ #
+ # Use (read and write) terminals
+ #
+-define(`rw_term_perms', `{ getattr open read write ioctl }')
++define(`rw_term_perms', `{ getattr read write ioctl }')
+
+ #
+ # Sockets
#
define(`client_stream_socket_perms', `{ create ioctl read getattr write setattr append bind getopt setopt shutdown }')
define(`server_stream_socket_perms', `{ client_stream_socket_perms listen accept }')
@@ -32289,9 +32689,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+define(`all_association_perms', `{ sendto recvfrom setcontext polmatch } ')
+
+define(`manage_key_perms', `{ create link read search setattr view write } ')
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.5.12/policy/users
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.5.13/policy/users
--- nsaserefpolicy/policy/users 2008-08-07 11:15:13.000000000 -0400
-+++ serefpolicy-3.5.12/policy/users 2008-10-14 15:00:15.000000000 -0400
++++ serefpolicy-3.5.13/policy/users 2008-10-17 10:31:27.000000000 -0400
@@ -25,11 +25,8 @@
# permit any access to such users, then remove this entry.
#
@@ -32316,9 +32716,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
- gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats)
-')
+gen_user(root, user, unconfined_r sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats)
-diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/support/Makefile.devel serefpolicy-3.5.12/support/Makefile.devel
+diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/support/Makefile.devel serefpolicy-3.5.13/support/Makefile.devel
--- nsaserefpolicy/support/Makefile.devel 2008-08-07 11:15:14.000000000 -0400
-+++ serefpolicy-3.5.12/support/Makefile.devel 2008-10-16 10:33:22.000000000 -0400
++++ serefpolicy-3.5.13/support/Makefile.devel 2008-10-17 10:31:27.000000000 -0400
@@ -181,7 +181,7 @@
tmp/%.mod: $(m4support) tmp/all_interfaces.conf %.te
@$(EINFO) "Compiling $(NAME) $(basename $(@F)) module"
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 060595d..a4f62a1 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,8 +19,8 @@
%define CHECKPOLICYVER 2.0.16-1
Summary: SELinux policy configuration
Name: selinux-policy
-Version: 3.5.12
-Release: 3%{?dist}
+Version: 3.5.13
+Release: 1%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -461,6 +461,9 @@ exit 0
%endif
%changelog
+* Fri Oct 17 2008 Dan Walsh 3.5.13-1
+- Policy cleanup
+
* Thu Oct 16 2008 Dan Walsh 3.5.12-3
- Remove Multiple spec
- Add include
diff --git a/sources b/sources
index 7aebee6..c102fa1 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-d8844e366ff99f65df95d145a5c2c1fe serefpolicy-3.5.12.tgz
+7220cccf7e77363dbceb48dc3a7fa2ef serefpolicy-3.5.13.tgz