From 095146a89d274ae080540adbbd1c764b457daded Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Mar 17 2009 19:52:35 +0000 Subject: - Change to svirt to only access svirt_image_t --- diff --git a/policy-20090105.patch b/policy-20090105.patch index c6c1104..f9808ea 100644 --- a/policy-20090105.patch +++ b/policy-20090105.patch @@ -125,9 +125,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/con +system_u:system_r:svirt_t:s0 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/virtual_image_context serefpolicy-3.6.9/config/appconfig-mcs/virtual_image_context --- nsaserefpolicy/config/appconfig-mcs/virtual_image_context 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.6.9/config/appconfig-mcs/virtual_image_context 2009-03-12 13:35:00.000000000 -0400 ++++ serefpolicy-3.6.9/config/appconfig-mcs/virtual_image_context 2009-03-16 14:03:57.000000000 -0400 @@ -0,0 +1 @@ -+system_u:object_r:virt_image_t:s0 ++system_u:object_r:svirt_image_t:s0 diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts serefpolicy-3.6.9/config/appconfig-mcs/xguest_u_default_contexts --- nsaserefpolicy/config/appconfig-mcs/xguest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 +++ serefpolicy-3.6.9/config/appconfig-mcs/xguest_u_default_contexts 2009-03-12 13:35:00.000000000 -0400 @@ -338,18 +338,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mcs serefpolicy-3.6.9/policy/mcs --- nsaserefpolicy/policy/mcs 2009-02-03 22:50:50.000000000 -0500 -+++ serefpolicy-3.6.9/policy/mcs 2009-03-12 13:35:00.000000000 -0400 -@@ -67,7 +67,8 @@ ++++ serefpolicy-3.6.9/policy/mcs 2009-03-17 15:25:30.000000000 -0400 +@@ -67,7 +67,7 @@ # Note that getattr on files is always permitted. # mlsconstrain file { write setattr append unlink link rename ioctl lock execute relabelfrom } - ( h1 dom h2 ); -+ ((( h1 dom h2 ) or ( t1 == mlsfilewrite )) -+ and ((t1 != virtualseparateddomain) or (t2 != virtual_image_type) or (h1 == h2))); ++ (( h1 dom h2 ) or ( t1 == mlsfilewrite )); mlsconstrain dir { create getattr setattr read write link unlink rename search add_name remove_name reparent rmdir lock ioctl } (( h1 dom h2 ) or ( t2 == domain ) or ( t1 == mlsfileread )); -@@ -75,19 +76,22 @@ +@@ -75,7 +75,7 @@ # New filesystem object labels must be dominated by the relabeling subject # clearance, also the objects are single-level. mlsconstrain file { create relabelto } @@ -358,12 +357,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # At this time we do not restrict "ps" type operations via MCS. This # will probably change in future. - mlsconstrain file { read } -- (( h1 dom h2 ) or ( t2 == domain ) or ( t1 == mlsfileread )); -+ ((( h1 dom h2 ) or ( t1 == mlsfileread )) -+ and ((t1 != virtualseparateddomain) or (t2 != virtual_image_type) or (h1 == h2))); -+# ((( h1 dom h2 ) or ( t2 == domain ) or ( t1 == mlsfileread )) -+# and ((t1 != virtualseparateddomain) or (t2 != virtual_image_type) or (h1 == h2))); +@@ -84,10 +84,10 @@ # new file labels must be dominated by the relabeling subject clearance mlsconstrain { dir lnk_file chr_file blk_file sock_file fifo_file } { relabelfrom } @@ -3383,8 +3377,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +/usr/bin/pulseaudio -- gen_context(system_u:object_r:pulseaudio_exec_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.if serefpolicy-3.6.9/policy/modules/apps/pulseaudio.if --- nsaserefpolicy/policy/modules/apps/pulseaudio.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.6.9/policy/modules/apps/pulseaudio.if 2009-03-12 13:35:00.000000000 -0400 -@@ -0,0 +1,86 @@ ++++ serefpolicy-3.6.9/policy/modules/apps/pulseaudio.if 2009-03-17 14:36:39.000000000 -0400 +@@ -0,0 +1,105 @@ + +## policy for pulseaudio + @@ -3435,6 +3429,24 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + +######################################## +## ++## Execute a pulseaudio in the current domain ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`pulseaudio_exec',` ++ gen_require(` ++ type pulseaudio_exec_t; ++ ') ++ ++ can_exec($1,pulseaudio_exec_t) ++') ++ ++######################################## ++## +## Role access for pulseaudio +## +## @@ -3471,10 +3483,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + userdom_manage_tmp_role($1, pulseaudio_t) + userdom_manage_tmpfs_role($1, pulseaudio_t) +') ++ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/pulseaudio.te serefpolicy-3.6.9/policy/modules/apps/pulseaudio.te --- nsaserefpolicy/policy/modules/apps/pulseaudio.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.6.9/policy/modules/apps/pulseaudio.te 2009-03-12 13:35:00.000000000 -0400 -@@ -0,0 +1,88 @@ ++++ serefpolicy-3.6.9/policy/modules/apps/pulseaudio.te 2009-03-17 14:30:29.000000000 -0400 +@@ -0,0 +1,97 @@ +policy_module(pulseaudio,1.0.0) + +######################################## @@ -3514,6 +3527,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +dev_read_sysfs(pulseaudio_t) +dev_read_urand(pulseaudio_t) + ++kernel_read_kernel_sysctls(pulseaudio_t) ++ +files_read_etc_files(pulseaudio_t) +files_read_usr_files(pulseaudio_t) + @@ -3547,6 +3562,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') + +optional_policy(` ++ polkit_domtrans_auth(pulseaudio_t) ++ polkit_read_lib(pulseaudio_t) ++ polkit_read_reload(pulseaudio_t) ++') ++ ++optional_policy(` + udev_read_db(pulseaudio_t) +') + @@ -3554,6 +3575,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + xserver_common_app(pulseaudio_t) + xserver_read_xdm_pid(pulseaudio_t) + xserver_stream_connect(pulseaudio_t) ++ xserver_manage_xdm_tmp_files(pulseaudio_t) +') + +tunable_policy(`pulseaudio_network',` @@ -5199,9 +5221,32 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## +diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/filesystem.te serefpolicy-3.6.9/policy/modules/kernel/filesystem.te +--- nsaserefpolicy/policy/modules/kernel/filesystem.te 2009-03-04 15:43:10.000000000 -0500 ++++ serefpolicy-3.6.9/policy/modules/kernel/filesystem.te 2009-03-17 14:10:23.000000000 -0400 +@@ -206,6 +206,10 @@ + genfscon ntfs-3g / gen_context(system_u:object_r:dosfs_t,s0) + genfscon ntfs / gen_context(system_u:object_r:dosfs_t,s0) + genfscon vfat / gen_context(system_u:object_r:dosfs_t,s0) ++# Labeling dosfs_t since these are removable file systems with the i ++# same security properties as dosfs_t ++genfscon hfs / gen_context(system_u:object_r:dosfs_t,s0) ++genfscon hfsplus / gen_context(system_u:object_r:dosfs_t,s0) + + type fusefs_t; + fs_noxattr_type(fusefs_t) +@@ -244,8 +248,6 @@ + genfscon afs / gen_context(system_u:object_r:nfs_t,s0) + genfscon dazukofs / gen_context(system_u:object_r:nfs_t,s0) + genfscon coda / gen_context(system_u:object_r:nfs_t,s0) +-genfscon hfs / gen_context(system_u:object_r:nfs_t,s0) +-genfscon hfsplus / gen_context(system_u:object_r:nfs_t,s0) + genfscon lustre / gen_context(system_u:object_r:nfs_t,s0) + genfscon ncpfs / gen_context(system_u:object_r:nfs_t,s0) + genfscon reiserfs / gen_context(system_u:object_r:nfs_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.6.9/policy/modules/kernel/kernel.if --- nsaserefpolicy/policy/modules/kernel/kernel.if 2009-01-05 15:39:38.000000000 -0500 -+++ serefpolicy-3.6.9/policy/modules/kernel/kernel.if 2009-03-12 13:35:00.000000000 -0400 ++++ serefpolicy-3.6.9/policy/modules/kernel/kernel.if 2009-03-17 14:28:38.000000000 -0400 @@ -1197,6 +1197,26 @@ ') @@ -10991,8 +11036,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/devicekit.te serefpolicy-3.6.9/policy/modules/services/devicekit.te --- nsaserefpolicy/policy/modules/services/devicekit.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.6.9/policy/modules/services/devicekit.te 2009-03-16 11:44:53.000000000 -0400 -@@ -0,0 +1,202 @@ ++++ serefpolicy-3.6.9/policy/modules/services/devicekit.te 2009-03-17 15:39:17.000000000 -0400 +@@ -0,0 +1,209 @@ +policy_module(devicekit,1.0.0) + +######################################## @@ -11053,7 +11098,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +# +# DeviceKit-Power local policy +# -+allow devicekit_power_t self:capability { sys_tty_config dac_override }; ++allow devicekit_power_t self:capability { dac_override sys_tty_config sys_nice }; +allow devicekit_power_t self:fifo_file rw_fifo_file_perms; +allow devicekit_power_t self:unix_dgram_socket create_socket_perms; + @@ -11163,12 +11208,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + +fs_list_inotifyfs(devicekit_disk_t) + -+storage_getattr_fixed_disk_dev(devicekit_disk_t) ++storage_raw_read_fixed_disk(devicekit_disk_t) +storage_raw_read_removable_device(devicekit_disk_t) +storage_raw_write_removable_device(devicekit_disk_t) + +term_use_all_terms(devicekit_disk_t) + ++auth_use_nsswitch(devicekit_disk_t) ++ ++miscfiles_read_localization(devicekit_disk_t) ++ +userdom_read_all_users_state(devicekit_disk_t) + +optional_policy(` @@ -11176,6 +11225,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') + +optional_policy(` ++ lvm_domtrans(devicekit_disk_t) ++') ++ ++optional_policy(` + polkit_domtrans_auth(devicekit_disk_t) + polkit_read_lib(devicekit_disk_t) + polkit_read_reload(devicekit_disk_t) @@ -11194,7 +11247,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + consolekit_dbus_chat(devicekit_disk_t) + ') +') -+ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.if serefpolicy-3.6.9/policy/modules/services/dhcp.if --- nsaserefpolicy/policy/modules/services/dhcp.if 2008-11-18 18:57:20.000000000 -0500 +++ serefpolicy-3.6.9/policy/modules/services/dhcp.if 2009-03-12 13:35:00.000000000 -0400 @@ -21566,7 +21618,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +/var/run/libvirt/qemu(/.*)? gen_context(system_u:object_r:svirt_var_run_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.6.9/policy/modules/services/virt.if --- nsaserefpolicy/policy/modules/services/virt.if 2009-01-05 15:39:43.000000000 -0500 -+++ serefpolicy-3.6.9/policy/modules/services/virt.if 2009-03-12 13:35:00.000000000 -0400 ++++ serefpolicy-3.6.9/policy/modules/services/virt.if 2009-03-17 10:31:34.000000000 -0400 @@ -2,28 +2,6 @@ ######################################## @@ -21714,7 +21766,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.9/policy/modules/services/virt.te --- nsaserefpolicy/policy/modules/services/virt.te 2009-01-19 11:06:49.000000000 -0500 -+++ serefpolicy-3.6.9/policy/modules/services/virt.te 2009-03-12 14:17:50.000000000 -0400 ++++ serefpolicy-3.6.9/policy/modules/services/virt.te 2009-03-17 10:32:36.000000000 -0400 @@ -8,20 +8,18 @@ ## @@ -21796,19 +21848,20 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol read_files_pattern(virtd_t, virt_etc_t, virt_etc_t) read_lnk_files_pattern(virtd_t, virt_etc_t, virt_etc_t) -@@ -67,7 +92,10 @@ +@@ -67,7 +92,11 @@ manage_lnk_files_pattern(virtd_t, virt_etc_rw_t, virt_etc_rw_t) filetrans_pattern(virtd_t, virt_etc_t, virt_etc_rw_t, dir) -manage_files_pattern(virtd_t, virt_image_type, virt_image_type) +virtual_manage_image(virtd_t) ++virtual_manage_relabel(virtd_t) + +manage_dirs_pattern(virtd_t, virt_content_t, virt_content_t) +manage_files_pattern(virtd_t, virt_content_t, virt_content_t) manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t) manage_files_pattern(virtd_t, virt_log_t, virt_log_t) -@@ -86,6 +114,7 @@ +@@ -86,6 +115,7 @@ kernel_read_network_state(virtd_t) kernel_rw_net_sysctls(virtd_t) kernel_load_module(virtd_t) @@ -21816,7 +21869,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol corecmd_exec_bin(virtd_t) corecmd_exec_shell(virtd_t) -@@ -96,7 +125,7 @@ +@@ -96,7 +126,7 @@ corenet_tcp_sendrecv_generic_node(virtd_t) corenet_tcp_sendrecv_all_ports(virtd_t) corenet_tcp_bind_generic_node(virtd_t) @@ -21825,10 +21878,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol corenet_tcp_bind_vnc_port(virtd_t) corenet_tcp_connect_vnc_port(virtd_t) corenet_tcp_connect_soundd_port(virtd_t) -@@ -104,21 +133,37 @@ +@@ -104,21 +134,38 @@ dev_read_sysfs(virtd_t) dev_read_rand(virtd_t) ++dev_read_kvm(virtd_t) +dev_getattr_all_chr_files(virtd_t) # Init script handling @@ -21864,7 +21918,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol term_getattr_pty_fs(virtd_t) term_use_ptmx(virtd_t) -@@ -129,6 +174,11 @@ +@@ -129,6 +176,11 @@ logging_send_syslog_msg(virtd_t) @@ -21876,7 +21930,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol userdom_read_all_users_state(virtd_t) tunable_policy(`virt_use_nfs',` -@@ -167,22 +217,34 @@ +@@ -167,22 +219,34 @@ dnsmasq_domtrans(virtd_t) dnsmasq_signal(virtd_t) dnsmasq_kill(virtd_t) @@ -21895,9 +21949,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +optional_policy(` + kerberos_keytab_template(virtd, virtd_t) +') - - optional_policy(` -- qemu_domtrans(virtd_t) ++ ++optional_policy(` + lvm_domtrans(virtd_t) +') + @@ -21906,8 +21959,9 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + polkit_domtrans_resolve(virtd_t) + polkit_read_lib(virtd_t) +') -+ -+optional_policy(` + + optional_policy(` +- qemu_domtrans(virtd_t) + qemu_spec_domtrans(virtd_t, svirt_t) qemu_read_state(virtd_t) qemu_signal(virtd_t) @@ -21916,7 +21970,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') optional_policy(` -@@ -198,5 +260,73 @@ +@@ -198,5 +262,73 @@ ') optional_policy(` @@ -21949,6 +22003,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +manage_lnk_files_pattern(svirt_t, svirt_var_run_t, svirt_var_run_t) +files_pid_filetrans(svirt_t, svirt_var_run_t, { dir file }) + ++allow svirt_t svirt_image_t:dir search_dir_perms; ++manage_dirs_pattern(svirt_t, svirt_image_t, svirt_image_t) ++manage_files_pattern(svirt_t, svirt_image_t, svirt_image_t) ++ +storage_raw_write_removable_device(svirt_t) +storage_raw_read_removable_device(svirt_t) + @@ -21981,10 +22039,6 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') + +optional_policy(` -+ virt_manage_images(svirt_t) -+') -+ -+optional_policy(` + xen_rw_image_files(svirt_t) +') + @@ -22085,7 +22139,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol /var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.6.9/policy/modules/services/xserver.if --- nsaserefpolicy/policy/modules/services/xserver.if 2009-01-05 15:39:43.000000000 -0500 -+++ serefpolicy-3.6.9/policy/modules/services/xserver.if 2009-03-12 13:35:00.000000000 -0400 ++++ serefpolicy-3.6.9/policy/modules/services/xserver.if 2009-03-17 14:33:04.000000000 -0400 @@ -90,7 +90,7 @@ allow $2 xauth_home_t:file manage_file_perms; allow $2 xauth_home_t:file { relabelfrom relabelto }; @@ -22095,10 +22149,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ############################## # -@@ -116,6 +116,7 @@ +@@ -115,7 +115,8 @@ + # write: gnome-settings-daemon RANDR:SelectInput # setattr: gnome-settings-daemon X11:GrabKey # manage: metacity X11:ChangeWindowAttributes - allow $2 rootwindow_t:x_drawable { read write manage setattr }; +- allow $2 rootwindow_t:x_drawable { read write manage setattr }; ++ allow $2 rootwindow_t:x_drawable { read write manage get_property getattr setattr }; + allow $2 $2:x_drawable all_x_drawable_perms; # setattr: metacity X11:InstallColormap @@ -22259,10 +22315,29 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -779,6 +799,31 @@ +@@ -779,6 +799,50 @@ ######################################## ## ++## Read XDM var lib files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`xserver_manage_xdm_lib_files',` ++ gen_require(` ++ type xdm_var_lib_t; ++ ') ++ ++ manage_files_pattern($1, xdm_var_lib_t, xdm_var_lib_t) ++ read_lnk_files_pattern($1, xdm_var_lib_t, xdm_var_lib_t) ++') ++ ++######################################## ++## +## Execute xsever in the xserver domain, and +## allow the specified role the xserver domain. +## @@ -22291,7 +22366,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## Make an X session script an entrypoint for the specified domain. ## ## -@@ -872,6 +917,27 @@ +@@ -872,6 +936,27 @@ ######################################## ## @@ -22319,7 +22394,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## Do not audit attempts to write the X server ## log files. ## -@@ -1018,10 +1084,11 @@ +@@ -1018,10 +1103,11 @@ # interface(`xserver_domtrans',` gen_require(` @@ -22332,7 +22407,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol domtrans_pattern($1, xserver_exec_t, xserver_t) ') -@@ -1159,6 +1226,275 @@ +@@ -1159,6 +1245,275 @@ ######################################## ## @@ -22608,7 +22683,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## Interface to provide X object permissions on a given X server to ## an X client domain. Gives the domain complete control over the ## display. -@@ -1172,7 +1508,102 @@ +@@ -1172,7 +1527,102 @@ interface(`xserver_unconfined',` gen_require(` attribute xserver_unconfined_type; @@ -22713,7 +22788,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.6.9/policy/modules/services/xserver.te --- nsaserefpolicy/policy/modules/services/xserver.te 2009-01-19 11:06:49.000000000 -0500 -+++ serefpolicy-3.6.9/policy/modules/services/xserver.te 2009-03-12 13:35:00.000000000 -0400 ++++ serefpolicy-3.6.9/policy/modules/services/xserver.te 2009-03-17 14:38:53.000000000 -0400 @@ -34,6 +34,13 @@ ## @@ -22914,7 +22989,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # Allow gdm to run gdm-binary can_exec(xdm_t, xdm_exec_t) -@@ -329,6 +360,8 @@ +@@ -329,22 +360,38 @@ manage_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t) manage_sock_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t) files_tmp_filetrans(xdm_t, xdm_tmp_t, { file dir sock_file }) @@ -22923,10 +22998,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol manage_dirs_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t) manage_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t) -@@ -336,15 +369,30 @@ + manage_lnk_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t) manage_fifo_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t) manage_sock_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t) - fs_tmpfs_filetrans(xdm_t, xdm_tmpfs_t,{ dir file lnk_file sock_file fifo_file }) +-fs_tmpfs_filetrans(xdm_t, xdm_tmpfs_t,{ dir file lnk_file sock_file fifo_file }) +fs_getattr_all_fs(xdm_t) +fs_search_inotifyfs(xdm_t) +fs_read_noxattr_fs_files(xdm_t) @@ -22956,7 +23031,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol allow xdm_t xserver_t:process signal; allow xdm_t xserver_t:unix_stream_socket connectto; -@@ -358,6 +406,7 @@ +@@ -358,6 +405,7 @@ allow xdm_t xserver_t:process { noatsecure siginh rlimitinh signal sigkill }; allow xdm_t xserver_t:shm rw_shm_perms; @@ -22964,7 +23039,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # connect to xdm xserver over stream socket stream_connect_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t,xserver_t) -@@ -366,10 +415,14 @@ +@@ -366,10 +414,14 @@ delete_files_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t) delete_sock_files_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t) @@ -22980,7 +23055,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol kernel_read_system_state(xdm_t) kernel_read_kernel_sysctls(xdm_t) -@@ -389,11 +442,13 @@ +@@ -389,11 +441,13 @@ corenet_udp_sendrecv_all_ports(xdm_t) corenet_tcp_bind_generic_node(xdm_t) corenet_udp_bind_generic_node(xdm_t) @@ -22994,7 +23069,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol dev_read_rand(xdm_t) dev_read_sysfs(xdm_t) dev_getattr_framebuffer_dev(xdm_t) -@@ -401,6 +456,7 @@ +@@ -401,6 +455,7 @@ dev_getattr_mouse_dev(xdm_t) dev_setattr_mouse_dev(xdm_t) dev_rw_apm_bios(xdm_t) @@ -23002,7 +23077,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol dev_setattr_apm_bios_dev(xdm_t) dev_rw_dri(xdm_t) dev_rw_agp(xdm_t) -@@ -413,14 +469,17 @@ +@@ -413,14 +468,17 @@ dev_setattr_video_dev(xdm_t) dev_getattr_scanner_dev(xdm_t) dev_setattr_scanner_dev(xdm_t) @@ -23022,7 +23097,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol files_read_etc_files(xdm_t) files_read_var_files(xdm_t) -@@ -431,9 +490,13 @@ +@@ -431,9 +489,13 @@ files_read_usr_files(xdm_t) # Poweroff wants to create the /poweroff file when run from xdm files_create_boot_flag(xdm_t) @@ -23036,7 +23111,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol storage_dontaudit_read_fixed_disk(xdm_t) storage_dontaudit_write_fixed_disk(xdm_t) -@@ -442,6 +505,7 @@ +@@ -442,6 +504,7 @@ storage_dontaudit_raw_write_removable_device(xdm_t) storage_dontaudit_setattr_removable_dev(xdm_t) storage_dontaudit_rw_scsi_generic(xdm_t) @@ -23044,7 +23119,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol term_setattr_console(xdm_t) term_use_unallocated_ttys(xdm_t) -@@ -450,6 +514,7 @@ +@@ -450,6 +513,7 @@ auth_domtrans_pam_console(xdm_t) auth_manage_pam_pid(xdm_t) auth_manage_pam_console_data(xdm_t) @@ -23052,7 +23127,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol auth_rw_faillog(xdm_t) auth_write_login_records(xdm_t) -@@ -460,10 +525,10 @@ +@@ -460,10 +524,10 @@ logging_read_generic_logs(xdm_t) @@ -23065,11 +23140,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_create_all_users_keys(xdm_t) -@@ -472,6 +537,7 @@ +@@ -472,6 +536,8 @@ # Search /proc for any user domain processes. userdom_read_all_users_state(xdm_t) userdom_signal_all_users(xdm_t) +userdom_manage_user_tmp_sockets(xdm_t) ++userdom_manage_tmpfs_role(system_r, xdm_t) xserver_rw_session(xdm_t,xdm_tmpfs_t) xserver_unconfined(xdm_t) @@ -23138,7 +23214,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') + +optional_policy(` -+ pulseaudio_role(system_r, xdm_t) ++ pulseaudio_exec(xdm_t) +') + +# On crash gdm execs gdb to dump stack @@ -28022,7 +28098,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +/dev/shm/mono.* gen_context(system_u:object_r:user_tmpfs_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.6.9/policy/modules/system/userdomain.if --- nsaserefpolicy/policy/modules/system/userdomain.if 2009-01-19 11:07:34.000000000 -0500 -+++ serefpolicy-3.6.9/policy/modules/system/userdomain.if 2009-03-12 13:35:00.000000000 -0400 ++++ serefpolicy-3.6.9/policy/modules/system/userdomain.if 2009-03-17 14:38:03.000000000 -0400 @@ -30,8 +30,9 @@ ') @@ -29962,8 +30038,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +# No application file contexts. diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virtual.if serefpolicy-3.6.9/policy/modules/system/virtual.if --- nsaserefpolicy/policy/modules/system/virtual.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.6.9/policy/modules/system/virtual.if 2009-03-12 13:35:00.000000000 -0400 -@@ -0,0 +1,99 @@ ++++ serefpolicy-3.6.9/policy/modules/system/virtual.if 2009-03-17 15:49:05.000000000 -0400 +@@ -0,0 +1,118 @@ +## Virtual machine emulator and virtualizer + +######################################## @@ -30055,7 +30131,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +# +interface(`virtual_manage_image',` + gen_require(` -+ type virtual_image_type; ++ attribute virtual_image_type; + ') + + manage_dirs_pattern($1, virtual_image_type, virtual_image_type) @@ -30063,6 +30139,25 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + manage_lnk_files_pattern($1, virtual_image_type, virtual_image_type) + rw_blk_files_pattern($1, virtual_image_type, virtual_image_type) +') ++ ++######################################## ++## ++## Allow domain to relabel virt image files ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`virtual_manage_relabel',` ++ gen_require(` ++ attribute virtual_image_type; ++ ') ++ ++ allow $1 virtual_image_type:file { relabelfrom relabelto }; ++') ++ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/virtual.te serefpolicy-3.6.9/policy/modules/system/virtual.te --- nsaserefpolicy/policy/modules/system/virtual.te 1969-12-31 19:00:00.000000000 -0500 +++ serefpolicy-3.6.9/policy/modules/system/virtual.te 2009-03-12 13:35:00.000000000 -0400 diff --git a/selinux-policy.spec b/selinux-policy.spec index ee3aa55..4a48be0 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -20,7 +20,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.6.9 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -444,6 +444,9 @@ exit 0 %endif %changelog +* Tue Mar 17 2009 Dan Walsh 3.6.9-3 +- Change to svirt to only access svirt_image_t + * Thu Mar 12 2009 Dan Walsh 3.6.9-2 - Fix libvirt policy