diff --git a/policy-20100106.patch b/policy-20100106.patch index e6ae829..b264244 100644 --- a/policy-20100106.patch +++ b/policy-20100106.patch @@ -6132,7 +6132,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol corenet_all_recvfrom_netlabel(xguest_usertype) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.fc serefpolicy-3.6.32/policy/modules/services/abrt.fc --- nsaserefpolicy/policy/modules/services/abrt.fc 2010-01-18 18:24:22.725543271 +0100 -+++ serefpolicy-3.6.32/policy/modules/services/abrt.fc 2010-05-31 18:07:17.167111902 +0200 ++++ serefpolicy-3.6.32/policy/modules/services/abrt.fc 2010-06-04 12:24:49.891425944 +0200 @@ -13,5 +13,7 @@ /var/log/abrt-logger -- gen_context(system_u:object_r:abrt_var_log_t,s0) @@ -6141,7 +6141,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +/var/run/abrtd?\.lock -- gen_context(system_u:object_r:abrt_var_run_t,s0) /var/run/abrt(/.*)? gen_context(system_u:object_r:abrt_var_run_t,s0) + -+var/spool/abrt(/.*)? gen_context(system_u:object_r:abrt_var_cache_t,s0) ++/var/spool/abrt(/.*)? gen_context(system_u:object_r:abrt_var_cache_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.if serefpolicy-3.6.32/policy/modules/services/abrt.if --- nsaserefpolicy/policy/modules/services/abrt.if 2010-01-18 18:24:22.726539977 +0100 +++ serefpolicy-3.6.32/policy/modules/services/abrt.if 2010-02-01 21:01:00.945160840 +0100 @@ -6159,8 +6159,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ###################################### diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.te serefpolicy-3.6.32/policy/modules/services/abrt.te --- nsaserefpolicy/policy/modules/services/abrt.te 2010-01-18 18:24:22.727540243 +0100 -+++ serefpolicy-3.6.32/policy/modules/services/abrt.te 2010-05-31 17:54:25.188362074 +0200 -@@ -96,16 +96,19 @@ ++++ serefpolicy-3.6.32/policy/modules/services/abrt.te 2010-06-04 12:25:03.267409676 +0200 +@@ -77,6 +77,7 @@ + manage_files_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t) + manage_lnk_files_pattern(abrt_t, abrt_var_cache_t, abrt_var_cache_t) + files_var_filetrans(abrt_t, abrt_var_cache_t, { file dir }) ++files_spool_filetrans(abrt_t, abrt_var_cache_t, dir) + + # abrt pid files + manage_dirs_pattern(abrt_t, abrt_var_run_t, abrt_var_run_t) +@@ -96,16 +97,19 @@ corenet_tcp_connect_ftp_port(abrt_t) corenet_tcp_connect_all_ports(abrt_t) @@ -6181,7 +6189,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol files_read_usr_files(abrt_t) files_read_generic_tmp_files(abrt_t) files_read_kernel_modules(abrt_t) -@@ -119,6 +122,7 @@ +@@ -119,6 +123,7 @@ fs_read_fusefs_files(abrt_t) fs_read_noxattr_fs_files(abrt_t) fs_read_nfs_files(abrt_t) @@ -6189,7 +6197,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol fs_search_all(abrt_t) sysnet_read_config(abrt_t) -@@ -173,9 +177,23 @@ +@@ -173,9 +178,23 @@ ') optional_policy(` @@ -6213,7 +6221,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol permissive abrt_t; ######################################## -@@ -183,12 +201,13 @@ +@@ -183,12 +202,13 @@ # abrt--helper local policy # @@ -6228,7 +6236,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol manage_dirs_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t) manage_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t) manage_lnk_files_pattern(abrt_helper_t, abrt_var_cache_t, abrt_var_cache_t) -@@ -200,10 +219,16 @@ +@@ -200,10 +220,16 @@ files_read_etc_files(abrt_helper_t) files_dontaudit_all_non_security_leaks(abrt_helper_t) @@ -11098,7 +11106,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nagios.te serefpolicy-3.6.32/policy/modules/services/nagios.te --- nsaserefpolicy/policy/modules/services/nagios.te 2010-01-18 18:24:22.823530245 +0100 -+++ serefpolicy-3.6.32/policy/modules/services/nagios.te 2010-05-31 17:44:49.383361808 +0200 ++++ serefpolicy-3.6.32/policy/modules/services/nagios.te 2010-06-04 12:26:22.209409594 +0200 @@ -45,10 +45,18 @@ type nrpe_var_run_t; files_pid_file(nrpe_var_run_t) @@ -11168,20 +11176,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol auth_use_nsswitch(nagios_t) logging_send_syslog_msg(nagios_t) -@@ -148,12 +156,6 @@ +@@ -148,8 +156,6 @@ mta_send_mail(nagios_t) optional_policy(` - netutils_domtrans_ping(nagios_t) - netutils_signal_ping(nagios_t) -- netutils_kill_ping(nagios_t) --') -- --optional_policy(` - seutil_sigchld_newrole(nagios_t) + netutils_kill_ping(nagios_t) ') -@@ -253,6 +255,11 @@ +@@ -253,6 +259,11 @@ ') optional_policy(` @@ -11193,7 +11197,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol seutil_sigchld_newrole(nrpe_t) ') -@@ -264,6 +271,66 @@ +@@ -264,6 +275,66 @@ udev_read_db(nrpe_t) ') @@ -11260,7 +11264,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ###################################### # -@@ -290,6 +357,8 @@ +@@ -290,6 +361,8 @@ allow nagios_services_plugin_t self:tcp_socket create_stream_socket_perms; allow nagios_services_plugin_t self:udp_socket create_socket_perms; @@ -11269,7 +11273,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol corecmd_exec_bin(nagios_services_plugin_t) corenet_tcp_connect_all_ports(nagios_services_plugin_t) -@@ -309,12 +378,18 @@ +@@ -309,12 +382,18 @@ optional_policy(` netutils_domtrans_ping(nagios_services_plugin_t) @@ -17826,7 +17830,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol domain_read_all_domains_state(iscsid_t) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.6.32/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2010-01-18 18:24:22.945540594 +0100 -+++ serefpolicy-3.6.32/policy/modules/system/libraries.fc 2010-05-21 14:17:19.115390020 +0200 ++++ serefpolicy-3.6.32/policy/modules/system/libraries.fc 2010-06-04 12:30:12.835158677 +0200 @@ -69,6 +69,8 @@ /opt/Acrobat[5-9]/Reader/intellinux/plugins/.*\.api -- gen_context(system_u:object_r:lib_t,s0) @@ -17897,7 +17901,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol /usr/lib(64)?/libSDL-.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/xulrunner-[^/]*/libgtkembedmoz\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib(64)?/xulrunner-[^/]*/libxul\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) -@@ -432,9 +437,26 @@ +@@ -411,7 +416,7 @@ + /usr/lib(64)?/php/modules/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) + /usr/lib(64)?/xorg/modules/dri/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) + /usr/X11R6/lib/modules/dri/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) +-/usr/lib(64)?/dri/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) ++#/usr/lib(64)?/dri/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) + /usr/lib(64)?/httpd/modules/libphp5\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) + ') + /opt/Komodo-Edit-5/lib/python/lib/python2.6/lib-dynload/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +@@ -432,9 +437,28 @@ /usr/lib(64)?/octagaplayer/libapplication\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -17915,9 +17928,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol /usr/lib(64)?/libGLcore\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib(64)?/libGTL.*\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) + -+/usr/lib(64)?/libkmplayercommon\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) ++/usr/lib(64)?/dri/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) ++/usr/lib(64)?/libkmplayercommon\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib(64)?/libgpac\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib(64)?/transcode/filter_yuvdenoise\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) ++/usr/lib(64)?/sane/libsane-epkowa.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib(64)?/vdpau/libvdpau_nvidia\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) + +/usr/local/lexmark/lxk08/lib(/.*)? -- gen_context(system_u:object_r:textrel_shlib_t,s0) diff --git a/selinux-policy.spec b/selinux-policy.spec index b739ff3..977e9ba 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -20,7 +20,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.6.32 -Release: 117%{?dist} +Release: 118%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -469,6 +469,9 @@ exit 0 %endif %changelog +* Fri Jun 4 2010 Miroslav Grepl 3.6.32-118 +- Fixes for abrt + * Mon May 31 2010 Miroslav Grepl 3.6.32-117 - Fixes for nagios