From 8675561212e85b9ab2eaea275d53fc1f7f0a5251 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Jul 19 2007 14:37:59 +0000 Subject: - Allow execution of gconf --- diff --git a/policy-20070703.patch b/policy-20070703.patch index 8f93877..28b6e35 100644 --- a/policy-20070703.patch +++ b/policy-20070703.patch @@ -1,14 +1,14 @@ -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/guest_u_default_contexts serefpolicy-3.0.2/config/appconfig-strict-mls/guest_u_default_contexts +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/guest_u_default_contexts serefpolicy-3.0.3/config/appconfig-strict-mls/guest_u_default_contexts --- nsaserefpolicy/config/appconfig-strict-mls/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/config/appconfig-strict-mls/guest_u_default_contexts 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/config/appconfig-strict-mls/guest_u_default_contexts 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,4 @@ +system_r:local_login_t:s0 guest_r:guest_t:s0 +system_r:remote_login_t:s0 guest_r:guest_t:s0 +system_r:sshd_t:s0 guest_r:guest_t:s0 +system_r:crond_t:s0 guest_r:guest_crond_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/staff_u_default_contexts serefpolicy-3.0.2/config/appconfig-strict-mls/staff_u_default_contexts +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/staff_u_default_contexts serefpolicy-3.0.3/config/appconfig-strict-mls/staff_u_default_contexts --- nsaserefpolicy/config/appconfig-strict-mls/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/config/appconfig-strict-mls/staff_u_default_contexts 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/config/appconfig-strict-mls/staff_u_default_contexts 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,9 @@ +system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +system_r:remote_login_t:s0 staff_r:staff_t:s0 @@ -19,9 +19,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/ +staff_r:staff_sudo_t:s0 staff_r:staff_t:s0 +sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0 +sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/user_u_default_contexts serefpolicy-3.0.2/config/appconfig-strict-mls/user_u_default_contexts +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/user_u_default_contexts serefpolicy-3.0.3/config/appconfig-strict-mls/user_u_default_contexts --- nsaserefpolicy/config/appconfig-strict-mls/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/config/appconfig-strict-mls/user_u_default_contexts 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/config/appconfig-strict-mls/user_u_default_contexts 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,7 @@ +system_r:local_login_t:s0 user_r:user_t:s0 +system_r:remote_login_t:s0 user_r:user_t:s0 @@ -30,31 +30,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-strict-mls/ +system_r:xdm_t:s0 user_r:user_t:s0 +user_r:user_su_t:s0 user_r:user_t:s0 +user_r:user_sudo_t:s0 user_r:user_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/default_type serefpolicy-3.0.2/config/appconfig-targeted-mcs/default_type +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/default_type serefpolicy-3.0.3/config/appconfig-targeted-mcs/default_type --- nsaserefpolicy/config/appconfig-targeted-mcs/default_type 2007-05-25 09:09:09.000000000 -0400 -+++ serefpolicy-3.0.2/config/appconfig-targeted-mcs/default_type 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/default_type 2007-07-17 15:46:25.000000000 -0400 @@ -1 +1,4 @@ system_r:unconfined_t +sysadm_r:sysadm_t +staff_r:staff_t +user_r:user_t -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/guest_u_default_contexts serefpolicy-3.0.2/config/appconfig-targeted-mcs/guest_u_default_contexts +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/guest_u_default_contexts serefpolicy-3.0.3/config/appconfig-targeted-mcs/guest_u_default_contexts --- nsaserefpolicy/config/appconfig-targeted-mcs/guest_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/config/appconfig-targeted-mcs/guest_u_default_contexts 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/guest_u_default_contexts 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,4 @@ +system_r:local_login_t:s0 guest_r:guest_t:s0 +system_r:remote_login_t:s0 guest_r:guest_t:s0 +system_r:sshd_t:s0 guest_r:guest_t:s0 +system_r:crond_t:s0 guest_r:guest_crond_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/initrc_context serefpolicy-3.0.2/config/appconfig-targeted-mcs/initrc_context +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/initrc_context serefpolicy-3.0.3/config/appconfig-targeted-mcs/initrc_context --- nsaserefpolicy/config/appconfig-targeted-mcs/initrc_context 2007-05-25 09:09:09.000000000 -0400 -+++ serefpolicy-3.0.2/config/appconfig-targeted-mcs/initrc_context 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/initrc_context 2007-07-17 15:46:25.000000000 -0400 @@ -1 +1 @@ -user_u:system_r:initrc_t:s0 +system_u:system_r:initrc_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/root_default_contexts serefpolicy-3.0.2/config/appconfig-targeted-mcs/root_default_contexts +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/root_default_contexts serefpolicy-3.0.3/config/appconfig-targeted-mcs/root_default_contexts --- nsaserefpolicy/config/appconfig-targeted-mcs/root_default_contexts 2007-05-25 09:09:09.000000000 -0400 -+++ serefpolicy-3.0.2/config/appconfig-targeted-mcs/root_default_contexts 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/root_default_contexts 2007-07-17 15:46:25.000000000 -0400 @@ -1,2 +1,10 @@ -system_r:unconfined_t:s0 system_r:unconfined_t:s0 -system_r:initrc_t:s0 system_r:unconfined_t:s0 @@ -68,16 +68,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mc +# +#system_r:sshd_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0 + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/seusers serefpolicy-3.0.2/config/appconfig-targeted-mcs/seusers +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/seusers serefpolicy-3.0.3/config/appconfig-targeted-mcs/seusers --- nsaserefpolicy/config/appconfig-targeted-mcs/seusers 2007-05-31 15:35:39.000000000 -0400 -+++ serefpolicy-3.0.2/config/appconfig-targeted-mcs/seusers 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/seusers 2007-07-17 15:46:25.000000000 -0400 @@ -1,2 +1,2 @@ root:root:s0-mcs_systemhigh -__default__:user_u:s0 +__default__:system_u:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/staff_u_default_contexts serefpolicy-3.0.2/config/appconfig-targeted-mcs/staff_u_default_contexts +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/staff_u_default_contexts serefpolicy-3.0.3/config/appconfig-targeted-mcs/staff_u_default_contexts --- nsaserefpolicy/config/appconfig-targeted-mcs/staff_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/config/appconfig-targeted-mcs/staff_u_default_contexts 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/staff_u_default_contexts 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,9 @@ +system_r:local_login_t:s0 staff_r:staff_t:s0 sysadm_r:sysadm_t:s0 +system_r:remote_login_t:s0 staff_r:staff_t:s0 @@ -88,9 +88,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mc +staff_r:staff_sudo_t:s0 staff_r:staff_t:s0 +sysadm_r:sysadm_su_t:s0 sysadm_r:sysadm_t:s0 +sysadm_r:sysadm_sudo_t:s0 sysadm_r:sysadm_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/user_u_default_contexts serefpolicy-3.0.2/config/appconfig-targeted-mcs/user_u_default_contexts +diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mcs/user_u_default_contexts serefpolicy-3.0.3/config/appconfig-targeted-mcs/user_u_default_contexts --- nsaserefpolicy/config/appconfig-targeted-mcs/user_u_default_contexts 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/config/appconfig-targeted-mcs/user_u_default_contexts 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/config/appconfig-targeted-mcs/user_u_default_contexts 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,7 @@ +system_r:local_login_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +system_r:remote_login_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 @@ -99,9 +99,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/config/appconfig-targeted-mc +system_r:xdm_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +user_r:user_su_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 +user_r:user_sudo_t:s0 system_r:unconfined_t:s0 user_r:user_t:s0 -diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.0.2/Makefile +diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.0.3/Makefile --- nsaserefpolicy/Makefile 2007-05-29 13:53:56.000000000 -0400 -+++ serefpolicy-3.0.2/Makefile 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/Makefile 2007-07-17 15:46:25.000000000 -0400 @@ -158,8 +158,18 @@ headerdir = $(modpkgdir)/include docsdir = $(prefix)/share/doc/$(PKGNAME) @@ -131,9 +131,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/Makefile serefpolicy-3.0.2/M M4PARAM += -D enable_mcs CHECKPOLICY += -M CHECKMODULE += -M -diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-3.0.2/man/man8/ftpd_selinux.8 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 serefpolicy-3.0.3/man/man8/ftpd_selinux.8 --- nsaserefpolicy/man/man8/ftpd_selinux.8 2007-05-25 09:09:10.000000000 -0400 -+++ serefpolicy-3.0.2/man/man8/ftpd_selinux.8 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/man/man8/ftpd_selinux.8 2007-07-17 15:46:25.000000000 -0400 @@ -12,7 +12,7 @@ .TP chcon -R -t public_content_t /var/ftp @@ -143,9 +143,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/man/man8/ftpd_selinux.8 sere .TP chcon -t public_content_rw_t /var/ftp/incoming .TP -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.0.2/policy/flask/access_vectors +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors serefpolicy-3.0.3/policy/flask/access_vectors --- nsaserefpolicy/policy/flask/access_vectors 2007-06-19 16:23:34.000000000 -0400 -+++ serefpolicy-3.0.2/policy/flask/access_vectors 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/flask/access_vectors 2007-07-17 15:46:25.000000000 -0400 @@ -598,6 +598,8 @@ shmempwd shmemgrp @@ -164,9 +164,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/flask/access_vectors } class key -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.0.2/policy/global_tunables +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables serefpolicy-3.0.3/policy/global_tunables --- nsaserefpolicy/policy/global_tunables 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/global_tunables 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/global_tunables 2007-07-17 15:46:25.000000000 -0400 @@ -133,3 +133,10 @@ ## gen_tunable(write_untrusted_content,false) @@ -178,9 +178,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/global_tunables seref +## +gen_tunable(allow_console_login,false) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-3.0.2/policy/mls +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-3.0.3/policy/mls --- nsaserefpolicy/policy/mls 2007-07-03 07:06:36.000000000 -0400 -+++ serefpolicy-3.0.2/policy/mls 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/mls 2007-07-17 15:46:25.000000000 -0400 @@ -89,12 +89,14 @@ mlsconstrain { file lnk_file fifo_file dir chr_file blk_file sock_file } { write create setattr relabelfrom append unlink link rename mounton } (( l1 eq l2 ) or @@ -263,9 +263,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/mls serefpolicy-3.0.2 ( t2 == unlabeled_t )); mlsconstrain association { polmatch } -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-3.0.2/policy/modules/admin/acct.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te serefpolicy-3.0.3/policy/modules/admin/acct.te --- nsaserefpolicy/policy/modules/admin/acct.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/acct.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/acct.te 2007-07-17 15:46:25.000000000 -0400 @@ -9,6 +9,7 @@ type acct_t; type acct_exec_t; @@ -274,9 +274,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/acct.te type acct_data_t; logging_log_file(acct_data_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-3.0.2/policy/modules/admin/alsa.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc serefpolicy-3.0.3/policy/modules/admin/alsa.fc --- nsaserefpolicy/policy/modules/admin/alsa.fc 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/alsa.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/alsa.fc 2007-07-17 15:46:25.000000000 -0400 @@ -1,4 +1,7 @@ /etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0) @@ -285,9 +285,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.fc /usr/bin/ainit -- gen_context(system_u:object_r:alsa_exec_t,s0) +/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.0.2/policy/modules/admin/alsa.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te serefpolicy-3.0.3/policy/modules/admin/alsa.te --- nsaserefpolicy/policy/modules/admin/alsa.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/alsa.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/alsa.te 2007-07-17 15:46:25.000000000 -0400 @@ -20,20 +20,24 @@ # Local policy # @@ -331,9 +331,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/alsa.te + hal_write_log(alsa_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.0.2/policy/modules/admin/anaconda.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anaconda.te serefpolicy-3.0.3/policy/modules/admin/anaconda.te --- nsaserefpolicy/policy/modules/admin/anaconda.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/anaconda.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/anaconda.te 2007-07-17 15:46:25.000000000 -0400 @@ -37,10 +37,6 @@ userdom_generic_user_home_dir_filetrans_generic_user_home_content(anaconda_t,{ dir file lnk_file fifo_file sock_file }) @@ -345,9 +345,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/anacond kudzu_domtrans(anaconda_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-3.0.2/policy/modules/admin/bootloader.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloader.te serefpolicy-3.0.3/policy/modules/admin/bootloader.te --- nsaserefpolicy/policy/modules/admin/bootloader.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/bootloader.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/bootloader.te 2007-07-17 15:46:25.000000000 -0400 @@ -182,6 +182,7 @@ optional_policy(` @@ -356,9 +356,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/bootloa ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.0.2/policy/modules/admin/consoletype.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/consoletype.te serefpolicy-3.0.3/policy/modules/admin/consoletype.te --- nsaserefpolicy/policy/modules/admin/consoletype.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/consoletype.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/consoletype.te 2007-07-17 15:46:25.000000000 -0400 @@ -8,12 +8,21 @@ type consoletype_t; @@ -403,9 +403,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/console logrotate_dontaudit_use_fds(consoletype_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-3.0.2/policy/modules/admin/kudzu.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.te serefpolicy-3.0.3/policy/modules/admin/kudzu.te --- nsaserefpolicy/policy/modules/admin/kudzu.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/kudzu.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/kudzu.te 2007-07-17 15:46:25.000000000 -0400 @@ -21,8 +21,8 @@ # Local policy # @@ -442,9 +442,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/kudzu.t ifdef(`TODO',` allow kudzu_t modules_conf_t:file unlink; optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.0.2/policy/modules/admin/logrotate.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrotate.te serefpolicy-3.0.3/policy/modules/admin/logrotate.te --- nsaserefpolicy/policy/modules/admin/logrotate.te 2007-06-19 16:23:35.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/logrotate.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/logrotate.te 2007-07-17 15:46:25.000000000 -0400 @@ -75,11 +75,13 @@ mls_file_read_up(logrotate_t) mls_file_write_down(logrotate_t) @@ -483,9 +483,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logrota slrnpull_manage_spool(logrotate_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.0.2/policy/modules/admin/logwatch.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatch.te serefpolicy-3.0.3/policy/modules/admin/logwatch.te --- nsaserefpolicy/policy/modules/admin/logwatch.te 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/logwatch.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/logwatch.te 2007-07-17 15:46:25.000000000 -0400 @@ -30,7 +30,6 @@ allow logwatch_t self:process signal; allow logwatch_t self:fifo_file rw_file_perms; @@ -536,9 +536,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/logwatc samba_read_log(logwatch_t) + samba_read_share_files(logwatch_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.0.2/policy/modules/admin/netutils.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutils.te serefpolicy-3.0.3/policy/modules/admin/netutils.te --- nsaserefpolicy/policy/modules/admin/netutils.te 2007-07-03 07:06:36.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/netutils.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/netutils.te 2007-07-17 15:46:25.000000000 -0400 @@ -29,6 +29,7 @@ type traceroute_t; type traceroute_exec_t; @@ -547,9 +547,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/netutil role system_r types traceroute_t; ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.0.2/policy/modules/admin/prelink.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink.te serefpolicy-3.0.3/policy/modules/admin/prelink.te --- nsaserefpolicy/policy/modules/admin/prelink.te 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/prelink.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/prelink.te 2007-07-17 15:46:25.000000000 -0400 @@ -26,7 +26,7 @@ # Local policy # @@ -592,17 +592,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/prelink optional_policy(` amanda_manage_lib(prelink_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.fc serefpolicy-3.0.2/policy/modules/admin/readahead.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.fc serefpolicy-3.0.3/policy/modules/admin/readahead.fc --- nsaserefpolicy/policy/modules/admin/readahead.fc 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/readahead.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/readahead.fc 2007-07-17 15:46:25.000000000 -0400 @@ -2,3 +2,4 @@ # /usr # /usr/sbin/readahead -- gen_context(system_u:object_r:readahead_exec_t,s0) +/etc/readahead.d(/.*)? gen_context(system_u:object_r:readahead_etc_rw_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.if serefpolicy-3.0.2/policy/modules/admin/readahead.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.if serefpolicy-3.0.3/policy/modules/admin/readahead.if --- nsaserefpolicy/policy/modules/admin/readahead.if 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/readahead.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/readahead.if 2007-07-17 15:46:25.000000000 -0400 @@ -1 +1,20 @@ ## Readahead, read files into page cache for improved performance + @@ -624,9 +624,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe + corecmd_search_bin($1) + domtrans_pattern($1,readahead_exec_t,readahead_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.0.2/policy/modules/admin/readahead.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahead.te serefpolicy-3.0.3/policy/modules/admin/readahead.te --- nsaserefpolicy/policy/modules/admin/readahead.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/readahead.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/readahead.te 2007-07-17 15:46:25.000000000 -0400 @@ -13,14 +13,20 @@ type readahead_var_run_t; files_pid_file(readahead_var_run_t) @@ -666,9 +666,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/readahe +optional_policy(` + logging_dontaudit_search_audit_config(readahead_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.0.2/policy/modules/admin/rpm.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc serefpolicy-3.0.3/policy/modules/admin/rpm.fc --- nsaserefpolicy/policy/modules/admin/rpm.fc 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/rpm.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/rpm.fc 2007-07-17 15:46:25.000000000 -0400 @@ -21,6 +21,9 @@ /usr/sbin/pup -- gen_context(system_u:object_r:rpm_exec_t,s0) /usr/sbin/rhn_check -- gen_context(system_u:object_r:rpm_exec_t,s0) @@ -679,9 +679,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc ') /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.0.2/policy/modules/admin/rpm.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.0.3/policy/modules/admin/rpm.if --- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/rpm.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/rpm.if 2007-07-17 15:46:25.000000000 -0400 @@ -210,6 +210,24 @@ ######################################## @@ -804,9 +804,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if + + dontaudit $1 rpm_tmp_t:file rw_file_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.0.2/policy/modules/admin/rpm.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te serefpolicy-3.0.3/policy/modules/admin/rpm.te --- nsaserefpolicy/policy/modules/admin/rpm.te 2007-07-03 07:06:36.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/rpm.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/rpm.te 2007-07-17 15:46:25.000000000 -0400 @@ -9,6 +9,8 @@ type rpm_t; type rpm_exec_t; @@ -816,9 +816,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.te domain_obj_id_change_exemption(rpm_t) domain_role_change_exemption(rpm_t) domain_system_change_exemption(rpm_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.0.2/policy/modules/admin/sudo.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if serefpolicy-3.0.3/policy/modules/admin/sudo.if --- nsaserefpolicy/policy/modules/admin/sudo.if 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/sudo.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/sudo.if 2007-07-17 15:46:25.000000000 -0400 @@ -69,7 +69,6 @@ allow $1_sudo_t self:unix_stream_socket create_stream_socket_perms; allow $1_sudo_t self:unix_dgram_socket sendto; @@ -865,9 +865,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/sudo.if nis_use_ypbind($1_sudo_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.0.2/policy/modules/admin/su.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if serefpolicy-3.0.3/policy/modules/admin/su.if --- nsaserefpolicy/policy/modules/admin/su.if 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/su.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/su.if 2007-07-17 15:46:25.000000000 -0400 @@ -41,12 +41,11 @@ allow $2 $1_su_t:process signal; @@ -960,9 +960,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/su.if s ifdef(`TODO',` allow $1_su_t $1_home_t:file manage_file_perms; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.if serefpolicy-3.0.2/policy/modules/admin/tmpreaper.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreaper.if serefpolicy-3.0.3/policy/modules/admin/tmpreaper.if --- nsaserefpolicy/policy/modules/admin/tmpreaper.if 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/tmpreaper.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/tmpreaper.if 2007-07-17 15:46:25.000000000 -0400 @@ -2,6 +2,25 @@ ######################################## @@ -989,9 +989,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/tmpreap ## Execute tmpreaper in the caller domain. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.0.2/policy/modules/admin/usermanage.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.if serefpolicy-3.0.3/policy/modules/admin/usermanage.if --- nsaserefpolicy/policy/modules/admin/usermanage.if 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/usermanage.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/usermanage.if 2007-07-17 15:46:25.000000000 -0400 @@ -278,5 +278,5 @@ type crack_db_t; ') @@ -999,9 +999,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman - allow $1 crack_db_t:file read_file_perms; + read_files_pattern($1,crack_db_t,crack_db_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.0.2/policy/modules/admin/usermanage.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/usermanage.te serefpolicy-3.0.3/policy/modules/admin/usermanage.te --- nsaserefpolicy/policy/modules/admin/usermanage.te 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/usermanage.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/usermanage.te 2007-07-17 15:46:25.000000000 -0400 @@ -99,6 +99,7 @@ dev_read_urand(chfn_t) @@ -1143,18 +1143,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/userman rpm_rw_pipes(useradd_t) + rpm_dontaudit_rw_tmp_files(useradd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.0.2/policy/modules/admin/vbetool.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/vbetool.te serefpolicy-3.0.3/policy/modules/admin/vbetool.te --- nsaserefpolicy/policy/modules/admin/vbetool.te 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/admin/vbetool.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/admin/vbetool.te 2007-07-17 15:46:25.000000000 -0400 @@ -32,4 +32,5 @@ optional_policy(` hal_rw_pid_files(vbetool_t) + hal_write_log(vbetool_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if serefpolicy-3.0.2/policy/modules/apps/ada.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if serefpolicy-3.0.3/policy/modules/apps/ada.if --- nsaserefpolicy/policy/modules/apps/ada.if 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/apps/ada.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/apps/ada.if 2007-07-17 15:46:25.000000000 -0400 @@ -18,3 +18,34 @@ corecmd_search_bin($1) domtrans_pattern($1, ada_exec_t, ada_t) @@ -1190,9 +1190,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/ada.if s + role $2 types ada_t; + allow ada_t $3:chr_file rw_term_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.fc serefpolicy-3.0.2/policy/modules/apps/games.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.fc serefpolicy-3.0.3/policy/modules/apps/games.fc --- nsaserefpolicy/policy/modules/apps/games.fc 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/apps/games.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/apps/games.fc 2007-07-17 15:46:25.000000000 -0400 @@ -1,22 +1,16 @@ # # /usr @@ -1219,10 +1219,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/games.fc /usr/bin/micq -- gen_context(system_u:object_r:games_exec_t,s0) /usr/bin/blackjack -- gen_context(system_u:object_r:games_exec_t,s0) /usr/bin/gataxx -- gen_context(system_u:object_r:games_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.0.2/policy/modules/apps/gnome.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc serefpolicy-3.0.3/policy/modules/apps/gnome.fc --- nsaserefpolicy/policy/modules/apps/gnome.fc 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/apps/gnome.fc 2007-07-13 08:07:53.000000000 -0400 -@@ -1,8 +1,6 @@ ++++ serefpolicy-3.0.3/policy/modules/apps/gnome.fc 2007-07-17 15:46:25.000000000 -0400 +@@ -1,8 +1,7 @@ ++HOME_DIR/.gnome2(/.*)? gen_context(system_u:object_r:ROLE_gnome_home_t,s0) HOME_DIR/\.config/gtk-.* gen_context(system_u:object_r:ROLE_gnome_home_t,s0) HOME_DIR/\.gconf(d)?(/.*)? gen_context(system_u:object_r:ROLE_gconf_home_t,s0) @@ -1231,10 +1232,71 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.fc /tmp/gconfd-USER/.* -- gen_context(system_u:object_r:ROLE_gconf_tmp_t,s0) /usr/libexec/gconfd-2 -- gen_context(system_u:object_r:gconfd_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.0.2/policy/modules/apps/gnome.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if serefpolicy-3.0.3/policy/modules/apps/gnome.if --- nsaserefpolicy/policy/modules/apps/gnome.if 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/apps/gnome.if 2007-07-13 08:07:53.000000000 -0400 -@@ -78,9 +78,6 @@ ++++ serefpolicy-3.0.3/policy/modules/apps/gnome.if 2007-07-17 15:46:25.000000000 -0400 +@@ -33,6 +33,50 @@ + ## + # + template(`gnome_per_role_template',` ++ ++ ############################## ++ # ++ # Declarations ++ # ++ type $1_gnome_home_t; ++ userdom_user_home_content($1, $1_gnome_home_t) ++ manage_dirs_pattern($2,$1_gnome_home_t, $1_gnome_home_t) ++ manage_files_pattern($2,$1_gnome_home_t, $1_gnome_home_t) ++') ++ ++######################################## ++## ++## The per role template for the gnome gconf module. ++## ++## ++##

++## This template creates a derived domain which is used ++## for gconf sessions. ++##

++##

++## This template is invoked automatically for each role, and ++## generally does not need to be invoked directly ++## by policy writers. ++##

++## ++## ++## ++## The prefix of the user domain (e.g., user ++## is the prefix for user_t). ++## ++## ++## ++## ++## The type of the user domain. ++## ++## ++## ++## ++## The role associated with the user domain. ++## ++## ++# ++template(`gnome_gconf_per_role_template',` + gen_require(` + type gconfd_exec_t; + attribute gnomedomain; +@@ -51,9 +95,6 @@ + type $1_gconf_home_t; + userdom_user_home_content($1, $1_gconf_home_t) + +- type $1_gnome_home_t; +- userdom_user_home_content($1, $1_gnome_home_t) +- + type $1_gconf_tmp_t; + files_tmp_file($1_gconf_tmp_t) + +@@ -78,9 +119,6 @@ allow $1_gconfd_t $2:fifo_file write; allow $1_gconfd_t $2:unix_stream_socket connectto; @@ -1244,7 +1306,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if ps_process_pattern($2,$1_gconfd_t) dev_read_urand($1_gconfd_t) -@@ -101,7 +98,16 @@ +@@ -101,9 +139,18 @@ gnome_stream_connect_gconf_template($1,$2) optional_policy(` @@ -1254,14 +1316,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if + optional_policy(` nscd_dontaudit_search_pid($1_gconfd_t) + nscd_socket_use($1_gconfd_t) -+ ') -+ -+ optional_policy(` -+ ssh_dontaudit_use_user_ssh_agent_fds($1,$1_gconfd_t) ') ++# optional_policy(` ++# ssh_dontaudit_use_user_ssh_agent_fds($1,$1_gconfd_t) ++# ') ++ optional_policy(` -@@ -136,13 +142,32 @@ + xserver_use_xdm_fds($1_gconfd_t) + xserver_rw_xdm_pipes($1_gconfd_t) +@@ -136,13 +183,32 @@ allow $2 $1_gconfd_t:unix_stream_socket connectto; ') @@ -1295,9 +1359,76 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.if ##

##

## This is a templated interface, and should only -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.0.2/policy/modules/apps/java.if +@@ -171,6 +237,30 @@ + + ######################################## + ##

++## read gnome homedir content (.config) ++## ++## ++## ++## The prefix of the user domain (e.g., user ++## is the prefix for user_t). ++## ++## ++## ++## ++## The type of the user domain. ++## ++## ++# ++template(`gnome_read_user_gnome_config',` ++ gen_require(` ++ type $1_gnome_home_t; ++ ') ++ ++ read_files_pattern($2, $1_gnome_home_t, $1_gnome_home_t) ++') ++ ++######################################## ++## + ## manage gnome homedir content (.config) + ## + ## +@@ -193,3 +283,23 @@ + allow $2 $1_gnome_home_t:dir manage_dir_perms; + allow $2 $1_gnome_home_t:file manage_file_perms; + ') ++ ++######################################## ++## ++## Execute gconf programs in ++## in the caller domain. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++template(`gnome_exec_gconf',` ++ gen_require(` ++ type gconfd_exec_t; ++ ') ++ ++ can_exec($1, gconfd_exec_t) ++') ++ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.0.3/policy/modules/apps/gnome.te +--- nsaserefpolicy/policy/modules/apps/gnome.te 2007-05-29 14:10:48.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/apps/gnome.te 2007-07-17 15:46:25.000000000 -0400 +@@ -8,8 +8,5 @@ + + attribute gnomedomain; + +-type gconf_etc_t; +-files_type(gconf_etc_t) +- + type gconfd_exec_t; + corecmd_executable_file(gconfd_exec_t) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.0.3/policy/modules/apps/java.if --- nsaserefpolicy/policy/modules/apps/java.if 2007-07-03 07:05:43.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/apps/java.if 2007-07-16 11:47:57.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/apps/java.if 2007-07-17 15:46:25.000000000 -0400 @@ -32,7 +32,7 @@ ## ## @@ -1317,7 +1448,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if allow $1_javaplugin_t $2:fd use; # Unrestricted inheritance from the caller. allow $2 $1_javaplugin_t:process { noatsecure siginh rlimitinh }; -@@ -168,6 +167,51 @@ +@@ -168,6 +167,55 @@ optional_policy(` xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t) ') @@ -1366,10 +1497,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if + allow $1_java_t self:process { execheap execmem }; + + domtrans_pattern($2, java_exec_t, $1_java_t) ++ ++ optional_policy(` ++ xserver_xdm_rw_shm($1_java_t) ++ ') ') ######################################## -@@ -221,3 +265,66 @@ +@@ -221,3 +269,66 @@ corecmd_search_bin($1) domtrans_pattern($1, java_exec_t, java_t) ') @@ -1436,9 +1571,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if + role $2 types java_t; + allow java_t $3:chr_file rw_term_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.te serefpolicy-3.0.2/policy/modules/apps/loadkeys.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.te serefpolicy-3.0.3/policy/modules/apps/java.te +--- nsaserefpolicy/policy/modules/apps/java.te 2007-07-03 07:05:43.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/apps/java.te 2007-07-17 15:46:25.000000000 -0400 +@@ -31,3 +31,7 @@ + unconfined_domain_noaudit(java_t) + unconfined_dbus_chat(java_t) + ') ++ ++optional_policy(` ++ xserver_xdm_rw_shm(java_t) ++') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys.te serefpolicy-3.0.3/policy/modules/apps/loadkeys.te --- nsaserefpolicy/policy/modules/apps/loadkeys.te 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/apps/loadkeys.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/apps/loadkeys.te 2007-07-17 15:46:25.000000000 -0400 @@ -40,3 +40,8 @@ locallogin_use_fds(loadkeys_t) @@ -1448,10 +1594,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/loadkeys + nscd_dontaudit_search_pid(loadkeys_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.0.2/policy/modules/apps/mono.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if serefpolicy-3.0.3/policy/modules/apps/mono.if --- nsaserefpolicy/policy/modules/apps/mono.if 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/apps/mono.if 2007-07-16 11:48:24.000000000 -0400 -@@ -18,3 +18,96 @@ ++++ serefpolicy-3.0.3/policy/modules/apps/mono.if 2007-07-17 15:46:25.000000000 -0400 +@@ -18,3 +18,100 @@ corecmd_search_bin($1) domtrans_pattern($1, mono_exec_t, mono_t) ') @@ -1547,10 +1693,25 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.if + allow $1_mono_t self:process { execheap execmem }; + + domtrans_pattern($2, mono_exec_t, $1_mono_t) ++ ++ optional_policy(` ++ xserver_xdm_rw_shm($1_mono_t) ++ ') +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.0.2/policy/modules/apps/mozilla.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mono.te serefpolicy-3.0.3/policy/modules/apps/mono.te +--- nsaserefpolicy/policy/modules/apps/mono.te 2007-05-29 14:10:48.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/apps/mono.te 2007-07-17 15:46:25.000000000 -0400 +@@ -46,3 +46,7 @@ + unconfined_dbus_chat(mono_t) + unconfined_dbus_connect(mono_t) + ') ++ ++optional_policy(` ++ xserver_xdm_rw_shm(mono_t) ++') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.0.3/policy/modules/apps/mozilla.if --- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-07-03 07:05:43.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/apps/mozilla.if 2007-07-13 10:00:16.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/apps/mozilla.if 2007-07-17 15:46:25.000000000 -0400 @@ -36,6 +36,8 @@ gen_require(` type mozilla_conf_t, mozilla_exec_t; @@ -1575,7 +1736,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ######################################## # # Local policy -@@ -97,15 +107,33 @@ +@@ -97,15 +107,36 @@ relabel_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t) relabel_lnk_files_pattern($2,$1_mozilla_home_t,$1_mozilla_home_t) @@ -1612,11 +1773,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. + userdom_manage_user_home_content_dirs($1,$1_mozilla_t) + userdom_manage_user_home_content_files($1,$1_mozilla_t) + userdom_read_user_home_content_symlinks($1,$1_mozilla_t) ++ ', ` ++ # helper apps will try to create .files ++ userdom_dontaudit_create_user_home_content_files($1,$1_mozilla_t) + ') # Unrestricted inheritance from the caller. allow $2 $1_mozilla_t:process { noatsecure siginh rlimitinh }; -@@ -171,6 +199,8 @@ +@@ -171,6 +202,8 @@ fs_list_inotifyfs($1_mozilla_t) fs_rw_tmpfs_files($1_mozilla_t) @@ -1625,7 +1789,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. term_dontaudit_getattr_pty_dirs($1_mozilla_t) libs_use_ld_so($1_mozilla_t) -@@ -186,12 +216,9 @@ +@@ -186,12 +219,9 @@ sysnet_dns_name_resolve($1_mozilla_t) sysnet_read_config($1_mozilla_t) @@ -1641,7 +1805,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. xserver_user_client_template($1,$1_mozilla_t,$1_mozilla_tmpfs_t) xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t) -@@ -213,133 +240,6 @@ +@@ -213,133 +243,6 @@ fs_manage_cifs_symlinks($1_mozilla_t) ') @@ -1775,7 +1939,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. optional_policy(` apache_read_user_scripts($1,$1_mozilla_t) apache_read_user_content($1,$1_mozilla_t) -@@ -352,21 +252,23 @@ +@@ -352,21 +255,23 @@ optional_policy(` cups_read_rw_config($1_mozilla_t) cups_dbus_chat($1_mozilla_t) @@ -1783,8 +1947,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') optional_policy(` -- dbus_system_bus_client_template($1_mozilla,$1_mozilla_t) -+# dbus_system_bus_client_template($1_mozilla,$1_mozilla_t) + dbus_system_bus_client_template($1_mozilla,$1_mozilla_t) dbus_send_system_bus($1_mozilla_t) - dbus_user_bus_client_template($1,$1_mozilla,$1_mozilla_t) - dbus_send_user_bus($1,$1_mozilla_t) @@ -1803,7 +1966,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') optional_policy(` -@@ -386,25 +288,6 @@ +@@ -386,25 +291,6 @@ thunderbird_domtrans_user_thunderbird($1, $1_mozilla_t) ') @@ -1829,7 +1992,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. ') ######################################## -@@ -577,3 +460,27 @@ +@@ -577,3 +463,27 @@ allow $2 $1_mozilla_t:tcp_socket rw_socket_perms; ') @@ -1857,9 +2020,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. + + allow $2 $1_mozilla_t:unix_stream_socket connectto; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.0.2/policy/modules/apps/mozilla.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.te serefpolicy-3.0.3/policy/modules/apps/mozilla.te --- nsaserefpolicy/policy/modules/apps/mozilla.te 2007-07-03 07:05:43.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/apps/mozilla.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/apps/mozilla.te 2007-07-17 15:46:25.000000000 -0400 @@ -6,13 +6,6 @@ # Declarations # @@ -1874,9 +2037,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla. type mozilla_conf_t; files_config_file(mozilla_conf_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-3.0.2/policy/modules/apps/slocate.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate.te serefpolicy-3.0.3/policy/modules/apps/slocate.te --- nsaserefpolicy/policy/modules/apps/slocate.te 2007-06-15 14:54:31.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/apps/slocate.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/apps/slocate.te 2007-07-17 15:46:25.000000000 -0400 @@ -29,6 +29,8 @@ manage_dirs_pattern(locate_t,locate_var_lib_t,locate_var_lib_t) manage_files_pattern(locate_t,locate_var_lib_t,locate_var_lib_t) @@ -1886,9 +2049,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/slocate. kernel_read_system_state(locate_t) kernel_dontaudit_search_sysctl(locate_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.0.2/policy/modules/apps/userhelper.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelper.if serefpolicy-3.0.3/policy/modules/apps/userhelper.if --- nsaserefpolicy/policy/modules/apps/userhelper.if 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/apps/userhelper.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/apps/userhelper.if 2007-07-17 15:46:25.000000000 -0400 @@ -131,6 +131,7 @@ term_use_all_user_ptys($1_userhelper_t) @@ -1897,9 +2060,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/userhelp auth_manage_pam_pid($1_userhelper_t) auth_manage_var_auth($1_userhelper_t) auth_search_pam_console_data($1_userhelper_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.0.2/policy/modules/apps/vmware.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.fc serefpolicy-3.0.3/policy/modules/apps/vmware.fc --- nsaserefpolicy/policy/modules/apps/vmware.fc 2007-07-03 07:05:43.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/apps/vmware.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/apps/vmware.fc 2007-07-17 15:46:25.000000000 -0400 @@ -23,6 +23,7 @@ /usr/bin/vmware-smbd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) /usr/bin/vmware-smbpasswd -- gen_context(system_u:object_r:vmware_host_exec_t,s0) @@ -1908,9 +2071,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.f /usr/bin/vmware-wizard -- gen_context(system_u:object_r:vmware_exec_t,s0) /usr/bin/vmware -- gen_context(system_u:object_r:vmware_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.0.2/policy/modules/apps/vmware.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.te serefpolicy-3.0.3/policy/modules/apps/vmware.te --- nsaserefpolicy/policy/modules/apps/vmware.te 2007-07-03 07:05:43.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/apps/vmware.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/apps/vmware.te 2007-07-17 15:46:25.000000000 -0400 @@ -29,7 +29,7 @@ allow vmware_host_t self:capability { setuid net_raw }; @@ -1929,9 +2092,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/vmware.t corenet_tcp_connect_all_ports(vmware_host_t) corenet_sendrecv_all_client_packets(vmware_host_t) corenet_sendrecv_all_server_packets(vmware_host_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.0.2/policy/modules/apps/wine.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if serefpolicy-3.0.3/policy/modules/apps/wine.if --- nsaserefpolicy/policy/modules/apps/wine.if 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/apps/wine.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/apps/wine.if 2007-07-17 15:46:25.000000000 -0400 @@ -18,3 +18,34 @@ corecmd_search_bin($1) domtrans_pattern($1, wine_exec_t, wine_t) @@ -1967,9 +2130,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/wine.if + role $2 types wine_t; + allow wine_t $3:chr_file rw_term_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.0.2/policy/modules/kernel/corecommands.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corecommands.fc serefpolicy-3.0.3/policy/modules/kernel/corecommands.fc --- nsaserefpolicy/policy/modules/kernel/corecommands.fc 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/kernel/corecommands.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/kernel/corecommands.fc 2007-07-17 15:46:25.000000000 -0400 @@ -36,6 +36,11 @@ /etc/cipe/ip-up.* -- gen_context(system_u:object_r:bin_t,s0) /etc/cipe/ip-down.* -- gen_context(system_u:object_r:bin_t,s0) @@ -1990,9 +2153,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/coreco /usr/share/system-config-rootpassword/system-config-rootpassword -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-samba/system-config-samba\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-securitylevel/system-config-securitylevel\.py -- gen_context(system_u:object_r:bin_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.0.2/policy/modules/kernel/corenetwork.te.in +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corenetwork.te.in serefpolicy-3.0.3/policy/modules/kernel/corenetwork.te.in --- nsaserefpolicy/policy/modules/kernel/corenetwork.te.in 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/kernel/corenetwork.te.in 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/kernel/corenetwork.te.in 2007-07-17 15:46:25.000000000 -0400 @@ -55,6 +55,11 @@ type reserved_port_t, port_type, reserved_port_type; @@ -2051,9 +2214,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/corene portcon tcp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0) portcon udp 1-1023 gen_context(system_u:object_r:reserved_port_t, s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.0.2/policy/modules/kernel/devices.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.fc serefpolicy-3.0.3/policy/modules/kernel/devices.fc --- nsaserefpolicy/policy/modules/kernel/devices.fc 2007-06-15 14:54:30.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/kernel/devices.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/kernel/devices.fc 2007-07-17 15:46:25.000000000 -0400 @@ -53,7 +53,7 @@ /dev/radio.* -c gen_context(system_u:object_r:v4l_device_t,s0) /dev/random -c gen_context(system_u:object_r:random_device_t,s0) @@ -2079,9 +2242,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device +/etc/udev/devices -d gen_context(system_u:object_r:device_t,s0) +/lib/udev/devices -d gen_context(system_u:object_r:device_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.0.2/policy/modules/kernel/devices.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/devices.if serefpolicy-3.0.3/policy/modules/kernel/devices.if --- nsaserefpolicy/policy/modules/kernel/devices.if 2007-06-15 14:54:30.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/kernel/devices.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/kernel/devices.if 2007-07-17 15:46:25.000000000 -0400 @@ -2803,6 +2803,24 @@ ######################################## @@ -2107,9 +2270,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/device ## Do not audit attempts to get the attributes ## of a directory in the usb filesystem. ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.0.2/policy/modules/kernel/domain.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.if serefpolicy-3.0.3/policy/modules/kernel/domain.if --- nsaserefpolicy/policy/modules/kernel/domain.if 2007-06-19 16:23:34.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/kernel/domain.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/kernel/domain.if 2007-07-17 15:46:25.000000000 -0400 @@ -45,6 +45,11 @@ # start with basic domain domain_base_type($1) @@ -2151,9 +2314,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain + + allow $1 domain:association { sendto recvfrom }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.0.2/policy/modules/kernel/domain.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.0.3/policy/modules/kernel/domain.te --- nsaserefpolicy/policy/modules/kernel/domain.te 2007-06-19 16:23:34.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/kernel/domain.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/kernel/domain.te 2007-07-17 15:46:25.000000000 -0400 @@ -6,6 +6,29 @@ # Declarations # @@ -2210,9 +2373,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain + ipsec_labeled(domain) + ') +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.0.2/policy/modules/kernel/files.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files.if serefpolicy-3.0.3/policy/modules/kernel/files.if --- nsaserefpolicy/policy/modules/kernel/files.if 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/kernel/files.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/kernel/files.if 2007-07-17 15:46:25.000000000 -0400 @@ -343,8 +343,7 @@ ######################################## @@ -2389,9 +2552,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/files. + allow $1 root_t:dir rw_dir_perms; + allow $1 root_t:file { create getattr write }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.2/policy/modules/kernel/kernel.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.if serefpolicy-3.0.3/policy/modules/kernel/kernel.if --- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/kernel/kernel.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/kernel/kernel.if 2007-07-17 15:46:25.000000000 -0400 @@ -1848,6 +1848,27 @@ ######################################## @@ -2420,10 +2583,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ## Do not audit attempts to list unlabeled directories. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.0.2/policy/modules/kernel/kernel.te ---- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/kernel/kernel.te 2007-07-13 08:07:53.000000000 -0400 -@@ -275,6 +275,7 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.0.3/policy/modules/kernel/kernel.te +--- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-07-17 14:52:26.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/kernel/kernel.te 2007-07-17 15:46:25.000000000 -0400 +@@ -26,9 +26,6 @@ + role staff_r; + role user_r; + +-# here until order dependence is fixed: +-role unconfined_r; +- + ifdef(`enable_mls',` + role secadm_r; + role auditadm_r; +@@ -278,6 +275,7 @@ optional_policy(` logging_send_syslog_msg(kernel_t) @@ -2431,9 +2604,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-3.0.2/policy/modules/kernel/mls.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if serefpolicy-3.0.3/policy/modules/kernel/mls.if --- nsaserefpolicy/policy/modules/kernel/mls.if 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/kernel/mls.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/kernel/mls.if 2007-07-17 15:46:25.000000000 -0400 @@ -154,6 +154,26 @@ ######################################## ## @@ -2461,9 +2634,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.if ## for writing to sockets at any level. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-3.0.2/policy/modules/kernel/mls.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te serefpolicy-3.0.3/policy/modules/kernel/mls.te --- nsaserefpolicy/policy/modules/kernel/mls.te 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/kernel/mls.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/kernel/mls.te 2007-07-17 15:46:25.000000000 -0400 @@ -18,6 +18,7 @@ attribute mlsnetreadtoclr; attribute mlsnetwrite; @@ -2481,9 +2654,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/mls.te attribute mlstrustedobject; attribute privrangetrans; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.0.2/policy/modules/kernel/selinux.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.0.3/policy/modules/kernel/selinux.if --- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-07-03 07:05:38.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/kernel/selinux.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/kernel/selinux.if 2007-07-17 15:46:25.000000000 -0400 @@ -32,20 +32,21 @@ ######################################## @@ -2552,9 +2725,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinu allow $1 security_t:dir list_dir_perms; allow $1 security_t:file { getattr read }; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.0.2/policy/modules/kernel/storage.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.fc serefpolicy-3.0.3/policy/modules/kernel/storage.fc --- nsaserefpolicy/policy/modules/kernel/storage.fc 2007-06-15 14:54:30.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/kernel/storage.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/kernel/storage.fc 2007-07-17 15:46:25.000000000 -0400 @@ -23,6 +23,7 @@ /dev/loop.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/lvm -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) @@ -2563,9 +2736,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag /dev/mmcblk.* -b gen_context(system_u:object_r:removable_device_t,s0) /dev/nb[^/]+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/optcd -b gen_context(system_u:object_r:removable_device_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.0.2/policy/modules/kernel/storage.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storage.if serefpolicy-3.0.3/policy/modules/kernel/storage.if --- nsaserefpolicy/policy/modules/kernel/storage.if 2007-06-15 14:54:30.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/kernel/storage.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/kernel/storage.if 2007-07-17 15:46:25.000000000 -0400 @@ -100,6 +100,7 @@ dev_list_all_dev_nodes($1) @@ -2582,9 +2755,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/storag typeattribute $1 fixed_disk_raw_write; ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.0.2/policy/modules/kernel/terminal.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.fc serefpolicy-3.0.3/policy/modules/kernel/terminal.fc --- nsaserefpolicy/policy/modules/kernel/terminal.fc 2007-05-29 14:10:48.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/kernel/terminal.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/kernel/terminal.fc 2007-07-17 15:46:25.000000000 -0400 @@ -8,6 +8,7 @@ /dev/dcbri[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0) /dev/hvc.* -c gen_context(system_u:object_r:tty_device_t,s0) @@ -2593,9 +2766,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin /dev/ircomm[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0) /dev/ip2[^/]* -c gen_context(system_u:object_r:tty_device_t,s0) /dev/isdn.* -c gen_context(system_u:object_r:tty_device_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-3.0.2/policy/modules/kernel/terminal.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.te serefpolicy-3.0.3/policy/modules/kernel/terminal.te --- nsaserefpolicy/policy/modules/kernel/terminal.te 2007-06-15 14:54:30.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/kernel/terminal.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/kernel/terminal.te 2007-07-17 15:46:25.000000000 -0400 @@ -28,9 +28,15 @@ type devpts_t; files_mountpoint(devpts_t) @@ -2623,9 +2796,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/termin # # usbtty_device_t is the type of /dev/usr/tty* # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.0.2/policy/modules/services/amavis.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amavis.te serefpolicy-3.0.3/policy/modules/services/amavis.te --- nsaserefpolicy/policy/modules/services/amavis.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/amavis.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/amavis.te 2007-07-17 15:46:25.000000000 -0400 @@ -166,6 +166,7 @@ optional_policy(` @@ -2634,9 +2807,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/amav ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.0.2/policy/modules/services/apache.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.fc serefpolicy-3.0.3/policy/modules/services/apache.fc --- nsaserefpolicy/policy/modules/services/apache.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/apache.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/apache.fc 2007-07-17 15:46:25.000000000 -0400 @@ -16,7 +16,6 @@ /usr/lib/apache-ssl/.+ -- gen_context(system_u:object_r:httpd_exec_t,s0) @@ -2657,9 +2830,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac +#viewvc file context +/var/spool/viewvc(/.*)? gen_context(system_u:object_r:httpd_sys_script_rw_t, s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.0.2/policy/modules/services/apache.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.if serefpolicy-3.0.3/policy/modules/services/apache.if --- nsaserefpolicy/policy/modules/services/apache.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/apache.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/apache.if 2007-07-17 15:46:25.000000000 -0400 @@ -18,10 +18,6 @@ attribute httpd_script_exec_type; type httpd_t, httpd_suexec_t, httpd_log_t; @@ -2956,10 +3129,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + + dontaudit $1 httpd_bugzilla_script_t:unix_stream_socket { read write }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.0.2/policy/modules/services/apache.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apache.te serefpolicy-3.0.3/policy/modules/services/apache.te --- nsaserefpolicy/policy/modules/services/apache.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/apache.te 2007-07-13 08:07:53.000000000 -0400 -@@ -47,6 +47,13 @@ ++++ serefpolicy-3.0.3/policy/modules/services/apache.te 2007-07-17 15:46:25.000000000 -0400 +@@ -30,6 +30,13 @@ + + ## + ##

++## Allow Apache to communicate with avahi via dbus ++##

++## ++gen_tunable(allow_httpd_dbus_avahi,false) ++ ++## ++##

+ ## Allow Apache to use mod_auth_pam + ##

+ ## +@@ -47,6 +54,13 @@ ## Allow http daemon to tcp connect ##

## @@ -2973,7 +3160,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac gen_tunable(httpd_can_network_connect,false) ## -@@ -106,6 +113,27 @@ +@@ -106,6 +120,27 @@ ## gen_tunable(httpd_unified,false) @@ -3001,7 +3188,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac attribute httpdcontent; # domains that can exec all users scripts -@@ -182,6 +210,14 @@ +@@ -182,6 +217,14 @@ type httpd_tmpfs_t; files_tmpfs_file(httpd_tmpfs_t) @@ -3016,7 +3203,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac # for apache2 memory mapped files type httpd_var_lib_t; files_type(httpd_var_lib_t) -@@ -202,7 +238,7 @@ +@@ -202,7 +245,7 @@ # Apache server local policy # @@ -3025,7 +3212,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac dontaudit httpd_t self:capability { net_admin sys_tty_config }; allow httpd_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow httpd_t self:fd use; -@@ -244,6 +280,7 @@ +@@ -244,6 +287,7 @@ allow httpd_t httpd_modules_t:dir list_dir_perms; mmap_files_pattern(httpd_t,httpd_modules_t,httpd_modules_t) read_files_pattern(httpd_t,httpd_modules_t,httpd_modules_t) @@ -3033,7 +3220,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac apache_domtrans_rotatelogs(httpd_t) # Apache-httpd needs to be able to send signals to the log rotate procs. -@@ -284,6 +321,7 @@ +@@ -284,6 +328,7 @@ kernel_read_kernel_sysctls(httpd_t) # for modules that want to access /proc/meminfo kernel_read_system_state(httpd_t) @@ -3041,7 +3228,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac corenet_all_recvfrom_unlabeled(httpd_t) corenet_all_recvfrom_netlabel(httpd_t) -@@ -330,6 +368,9 @@ +@@ -330,6 +375,9 @@ files_read_var_lib_symlinks(httpd_t) fs_search_auto_mountpoints(httpd_sys_script_t) @@ -3051,7 +3238,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac libs_use_ld_so(httpd_t) libs_use_shared_libs(httpd_t) -@@ -348,7 +389,13 @@ +@@ -348,7 +396,13 @@ userdom_use_unpriv_users_fds(httpd_t) @@ -3066,7 +3253,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`allow_httpd_anon_write',` miscfiles_manage_public_files(httpd_t) -@@ -360,6 +407,7 @@ +@@ -360,6 +414,7 @@ # tunable_policy(`allow_httpd_mod_auth_pam',` auth_domtrans_chk_passwd(httpd_t) @@ -3074,7 +3261,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac ') ') -@@ -367,6 +415,16 @@ +@@ -367,6 +422,16 @@ corenet_tcp_connect_all_ports(httpd_t) ') @@ -3091,7 +3278,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_can_network_connect_db',` # allow httpd to connect to mysql/posgresql corenet_tcp_connect_postgresql_port(httpd_t) -@@ -387,6 +445,17 @@ +@@ -387,6 +452,17 @@ corenet_sendrecv_http_cache_client_packets(httpd_t) ') @@ -3109,7 +3296,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',` domtrans_pattern(httpd_t, httpdcontent, httpd_sys_script_t) -@@ -404,11 +473,21 @@ +@@ -404,11 +480,21 @@ fs_read_nfs_symlinks(httpd_t) ') @@ -3131,7 +3318,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_ssi_exec',` corecmd_shell_domtrans(httpd_t,httpd_sys_script_t) allow httpd_sys_script_t httpd_t:fd use; -@@ -606,6 +685,10 @@ +@@ -606,6 +692,10 @@ miscfiles_read_localization(httpd_suexec_t) @@ -3142,7 +3329,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_can_network_connect',` allow httpd_suexec_t self:tcp_socket create_stream_socket_perms; allow httpd_suexec_t self:udp_socket create_socket_perms; -@@ -620,10 +703,13 @@ +@@ -620,10 +710,13 @@ corenet_udp_sendrecv_all_ports(httpd_suexec_t) corenet_tcp_connect_all_ports(httpd_suexec_t) corenet_sendrecv_all_client_packets(httpd_suexec_t) @@ -3157,7 +3344,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_cgi && httpd_unified',` domtrans_pattern(httpd_suexec_t, httpdcontent, httpd_sys_script_t) ') -@@ -634,6 +720,12 @@ +@@ -634,6 +727,12 @@ fs_exec_nfs_files(httpd_suexec_t) ') @@ -3170,7 +3357,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_suexec_t) fs_read_cifs_symlinks(httpd_suexec_t) -@@ -672,7 +764,8 @@ +@@ -672,7 +771,8 @@ dontaudit httpd_sys_script_t httpd_config_t:dir search; @@ -3180,7 +3367,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac allow httpd_sys_script_t squirrelmail_spool_t:dir list_dir_perms; read_files_pattern(httpd_sys_script_t,squirrelmail_spool_t,squirrelmail_spool_t) -@@ -686,15 +779,66 @@ +@@ -686,15 +786,66 @@ # Should we add a boolean? apache_domtrans_rotatelogs(httpd_sys_script_t) @@ -3248,7 +3435,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac tunable_policy(`httpd_enable_homedirs && use_samba_home_dirs',` fs_read_cifs_files(httpd_sys_script_t) fs_read_cifs_symlinks(httpd_sys_script_t) -@@ -711,6 +855,19 @@ +@@ -711,6 +862,19 @@ ######################################## # @@ -3268,7 +3455,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac # httpd_rotatelogs local policy # -@@ -728,3 +885,19 @@ +@@ -728,3 +892,24 @@ logging_search_logs(httpd_rotatelogs_t) miscfiles_read_localization(httpd_rotatelogs_t) @@ -3288,9 +3475,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apac + postgresql_stream_connect(httpd_bugzilla_script_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-3.0.2/policy/modules/services/apcupsd.fc ++ ++tunable_policy(`allow_httpd_dbus_avahi',` ++ avahi_dbus_chat(httpd_t) ++ dbus_system_bus_client_template(httpd,httpd_t) ++') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.fc serefpolicy-3.0.3/policy/modules/services/apcupsd.fc --- nsaserefpolicy/policy/modules/services/apcupsd.fc 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/apcupsd.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/apcupsd.fc 2007-07-17 15:46:25.000000000 -0400 @@ -3,3 +3,8 @@ /var/log/apcupsd\.events.* -- gen_context(system_u:object_r:apcupsd_log_t,s0) @@ -3300,9 +3492,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu +/var/www/apcupsd/upsfstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) +/var/www/apcupsd/upsimage.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) +/var/www/apcupsd/upsstats.cgi -- gen_context(system_u:object_r:httpd_apcupsd_cgi_script_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-3.0.2/policy/modules/services/apcupsd.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.if serefpolicy-3.0.3/policy/modules/services/apcupsd.if --- nsaserefpolicy/policy/modules/services/apcupsd.if 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/apcupsd.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/apcupsd.if 2007-07-17 15:46:25.000000000 -0400 @@ -79,3 +79,25 @@ allow $1 apcupsd_log_t:dir list_dir_perms; allow $1 apcupsd_log_t:file { getattr append }; @@ -3329,9 +3521,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu + allow httpd_apcupsd_cgi_script_t $1:fifo_file rw_file_perms; + allow httpd_apcupsd_cgi_script_t $1:process sigchld; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.0.2/policy/modules/services/apcupsd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcupsd.te serefpolicy-3.0.3/policy/modules/services/apcupsd.te --- nsaserefpolicy/policy/modules/services/apcupsd.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/apcupsd.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/apcupsd.te 2007-07-18 08:57:22.000000000 -0400 @@ -16,6 +16,9 @@ type apcupsd_log_t; logging_log_file(apcupsd_log_t) @@ -3428,9 +3620,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/apcu +corenet_udp_sendrecv_all_nodes(httpd_apcupsd_cgi_script_t) +corenet_udp_sendrecv_all_ports(httpd_apcupsd_cgi_script_t) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-3.0.2/policy/modules/services/audioentropy.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audioentropy.te serefpolicy-3.0.3/policy/modules/services/audioentropy.te --- nsaserefpolicy/policy/modules/services/audioentropy.te 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/audioentropy.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/audioentropy.te 2007-07-17 15:46:25.000000000 -0400 @@ -18,7 +18,7 @@ # Local policy # @@ -3449,9 +3641,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/audi dev_read_sound(entropyd_t) fs_getattr_all_fs(entropyd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.0.2/policy/modules/services/automount.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/automount.te serefpolicy-3.0.3/policy/modules/services/automount.te --- nsaserefpolicy/policy/modules/services/automount.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/automount.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/automount.te 2007-07-17 15:46:25.000000000 -0400 @@ -69,6 +69,7 @@ files_mounton_all_mountpoints(automount_t) files_mount_all_file_type_fs(automount_t) @@ -3479,9 +3671,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/auto bind_search_cache(automount_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.0.2/policy/modules/services/avahi.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.0.3/policy/modules/services/avahi.te --- nsaserefpolicy/policy/modules/services/avahi.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/avahi.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/avahi.te 2007-07-17 15:46:25.000000000 -0400 @@ -57,6 +57,7 @@ fs_getattr_all_fs(avahi_t) @@ -3490,9 +3682,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avah domain_use_interactive_fds(avahi_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.0.2/policy/modules/services/bind.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.fc serefpolicy-3.0.3/policy/modules/services/bind.fc --- nsaserefpolicy/policy/modules/services/bind.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/bind.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/bind.fc 2007-07-17 15:46:25.000000000 -0400 @@ -45,4 +45,6 @@ /var/named/chroot/var/named/slaves(/.*)? gen_context(system_u:object_r:named_cache_t,s0) /var/named/chroot/var/named/data(/.*)? gen_context(system_u:object_r:named_cache_t,s0) @@ -3500,9 +3692,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind +/var/named/dynamic(/.*)? gen_context(system_u:object_r:named_cache_t,s0) +/var/named/chroot/var/named/dynamic(/.*)? gen_context(system_u:object_r:named_cache_t,s0) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.0.2/policy/modules/services/bind.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind.te serefpolicy-3.0.3/policy/modules/services/bind.te --- nsaserefpolicy/policy/modules/services/bind.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/bind.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/bind.te 2007-07-17 15:46:25.000000000 -0400 @@ -119,6 +119,11 @@ corenet_sendrecv_dns_client_packets(named_t) corenet_sendrecv_rndc_server_packets(named_t) @@ -3523,9 +3715,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bind corenet_sendrecv_rndc_client_packets(ndc_t) fs_getattr_xattr_fs(ndc_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.0.2/policy/modules/services/bluetooth.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.0.3/policy/modules/services/bluetooth.te --- nsaserefpolicy/policy/modules/services/bluetooth.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/bluetooth.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/bluetooth.te 2007-07-17 15:46:25.000000000 -0400 @@ -134,6 +134,7 @@ dbus_system_bus_client_template(bluetooth,bluetooth_t) dbus_connect_system_bus(bluetooth_t) @@ -3585,9 +3777,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/blue +optional_policy(` + xserver_stream_connect_xdm(bluetooth_helper_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.0.2/policy/modules/services/clamav.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clamav.te serefpolicy-3.0.3/policy/modules/services/clamav.te --- nsaserefpolicy/policy/modules/services/clamav.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/clamav.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/clamav.te 2007-07-17 15:46:25.000000000 -0400 @@ -208,9 +208,12 @@ files_tmp_filetrans(clamscan_t,clamscan_tmp_t,{ file dir }) @@ -3610,9 +3802,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/clam +optional_policy(` + mailscanner_manage_spool(clamscan_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.0.2/policy/modules/services/consolekit.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/consolekit.te serefpolicy-3.0.3/policy/modules/services/consolekit.te --- nsaserefpolicy/policy/modules/services/consolekit.te 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/consolekit.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/consolekit.te 2007-07-17 15:46:25.000000000 -0400 @@ -10,7 +10,6 @@ type consolekit_exec_t; init_daemon_domain(consolekit_t, consolekit_exec_t) @@ -3671,9 +3863,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cons + unconfined_ptrace(consolekit_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.0.2/policy/modules/services/courier.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/courier.te serefpolicy-3.0.3/policy/modules/services/courier.te --- nsaserefpolicy/policy/modules/services/courier.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/courier.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/courier.te 2007-07-17 15:46:25.000000000 -0400 @@ -58,6 +58,7 @@ files_getattr_tmp_dirs(courier_authdaemon_t) @@ -3682,9 +3874,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cour libs_read_lib_files(courier_authdaemon_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.0.2/policy/modules/services/cron.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.fc serefpolicy-3.0.3/policy/modules/services/cron.fc --- nsaserefpolicy/policy/modules/services/cron.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/cron.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/cron.fc 2007-07-17 15:46:25.000000000 -0400 @@ -17,6 +17,8 @@ /var/run/fcron\.fifo -s gen_context(system_u:object_r:crond_var_run_t,s0) /var/run/fcron\.pid -- gen_context(system_u:object_r:crond_var_run_t,s0) @@ -3699,9 +3891,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron /var/spool/fcron/systab -- gen_context(system_u:object_r:system_cron_spool_t,s0) /var/spool/fcron/new\.systab -- gen_context(system_u:object_r:system_cron_spool_t,s0) +/var/lib/misc(/.*)? gen_context(system_u:object_r:system_crond_var_lib_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.0.2/policy/modules/services/cron.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.if serefpolicy-3.0.3/policy/modules/services/cron.if --- nsaserefpolicy/policy/modules/services/cron.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/cron.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/cron.if 2007-07-17 15:46:25.000000000 -0400 @@ -35,6 +35,7 @@ # template(`cron_per_role_template',` @@ -3849,9 +4041,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ## Read, and write cron daemon TCP sockets. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.0.2/policy/modules/services/cron.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron.te serefpolicy-3.0.3/policy/modules/services/cron.te --- nsaserefpolicy/policy/modules/services/cron.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/cron.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/cron.te 2007-07-17 15:46:25.000000000 -0400 @@ -50,6 +50,7 @@ type crond_tmp_t; @@ -4077,9 +4269,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cron ') ifdef(`TODO',` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.2/policy/modules/services/cups.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.fc serefpolicy-3.0.3/policy/modules/services/cups.fc --- nsaserefpolicy/policy/modules/services/cups.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/cups.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/cups.fc 2007-07-17 15:46:25.000000000 -0400 @@ -8,6 +8,7 @@ /etc/cups/ppd/.* -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) /etc/cups/ppds\.dat -- gen_context(system_u:object_r:cupsd_rw_etc_t,s0) @@ -4093,9 +4285,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups /var/spool/cups(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh) +/usr/local/Brother/inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,mls_systemhigh) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.2/policy/modules/services/cups.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.3/policy/modules/services/cups.te --- nsaserefpolicy/policy/modules/services/cups.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/cups.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/cups.te 2007-07-19 10:33:00.000000000 -0400 @@ -81,12 +81,11 @@ # /usr/lib/cups/backend/serial needs sys_admin(?!) allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_resource sys_tty_config }; @@ -4136,7 +4328,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups auth_dontaudit_read_pam_pid(cupsd_t) # Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp -@@ -223,6 +225,7 @@ +@@ -223,21 +225,45 @@ sysnet_read_config(cupsd_t) @@ -4144,10 +4336,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups userdom_dontaudit_use_unpriv_user_fds(cupsd_t) userdom_dontaudit_search_all_users_home_content(cupsd_t) -@@ -234,10 +237,28 @@ + # Write to /var/spool/cups. + lpd_manage_spool(cupsd_t) ++lpd_read_config(cupsd_t) + + ifdef(`enable_mls',` + lpd_relabel_spool(cupsd_t) ') optional_policy(` ++ avahi_dbus_chat(cupsd_t) ++') ++ ++optional_policy(` + init_stream_connect_script(cupsd_t) + + unconfined_rw_pipes(cupsd_t) @@ -4173,7 +4374,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups cron_system_entry(cupsd_t, cupsd_exec_t) ') -@@ -250,6 +271,10 @@ +@@ -250,6 +276,10 @@ optional_policy(` hal_dbus_chat(cupsd_t) ') @@ -4184,7 +4385,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups ') optional_policy(` -@@ -265,16 +290,16 @@ +@@ -265,16 +295,16 @@ ') optional_policy(` @@ -4205,7 +4406,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups seutil_sigchld_newrole(cupsd_t) ') -@@ -379,6 +404,14 @@ +@@ -379,6 +409,14 @@ ') optional_policy(` @@ -4220,7 +4421,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups cron_system_entry(cupsd_config_t, cupsd_config_exec_t) ') -@@ -562,7 +595,7 @@ +@@ -562,7 +600,7 @@ dev_read_urand(hplip_t) dev_read_rand(hplip_t) dev_rw_generic_usb_dev(hplip_t) @@ -4229,9 +4430,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups fs_getattr_all_fs(hplip_t) fs_search_auto_mountpoints(hplip_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.0.2/policy/modules/services/cvs.te +@@ -589,8 +627,6 @@ + userdom_dontaudit_search_sysadm_home_dirs(hplip_t) + userdom_dontaudit_search_all_users_home_content(hplip_t) + +-lpd_read_config(cupsd_t) +- + optional_policy(` + seutil_sigchld_newrole(hplip_t) + ') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs.te serefpolicy-3.0.3/policy/modules/services/cvs.te --- nsaserefpolicy/policy/modules/services/cvs.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/cvs.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/cvs.te 2007-07-17 15:46:25.000000000 -0400 @@ -16,6 +16,7 @@ type cvs_t; type cvs_exec_t; @@ -4256,9 +4466,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cvs. miscfiles_read_localization(cvs_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.2/policy/modules/services/dbus.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.3/policy/modules/services/dbus.if --- nsaserefpolicy/policy/modules/services/dbus.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/dbus.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/dbus.if 2007-07-17 15:46:25.000000000 -0400 @@ -50,6 +50,12 @@ ## # @@ -4373,9 +4583,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus +') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.0.2/policy/modules/services/dhcp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp.te serefpolicy-3.0.3/policy/modules/services/dhcp.te --- nsaserefpolicy/policy/modules/services/dhcp.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/dhcp.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/dhcp.te 2007-07-17 15:46:25.000000000 -0400 @@ -114,6 +114,8 @@ dbus_system_bus_client_template(dhcpd,dhcpd_t) dbus_connect_system_bus(dhcpd_t) @@ -4385,9 +4595,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dhcp ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.0.2/policy/modules/services/dovecot.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.fc serefpolicy-3.0.3/policy/modules/services/dovecot.fc --- nsaserefpolicy/policy/modules/services/dovecot.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/dovecot.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/dovecot.fc 2007-07-17 15:46:25.000000000 -0400 @@ -17,10 +17,12 @@ ifdef(`distro_debian', ` @@ -4401,9 +4611,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove ') # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.0.2/policy/modules/services/dovecot.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.if serefpolicy-3.0.3/policy/modules/services/dovecot.if --- nsaserefpolicy/policy/modules/services/dovecot.if 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/dovecot.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/dovecot.if 2007-07-17 15:46:25.000000000 -0400 @@ -18,3 +18,43 @@ manage_files_pattern($1,dovecot_spool_t,dovecot_spool_t) manage_lnk_files_pattern($1,dovecot_spool_t,dovecot_spool_t) @@ -4448,9 +4658,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove + domtrans_pattern($1,dovecot_deliver_exec_t,dovecot_deliver_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.0.2/policy/modules/services/dovecot.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dovecot.te serefpolicy-3.0.3/policy/modules/services/dovecot.te --- nsaserefpolicy/policy/modules/services/dovecot.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/dovecot.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/dovecot.te 2007-07-17 15:46:25.000000000 -0400 @@ -15,6 +15,12 @@ domain_entry_file(dovecot_auth_t,dovecot_auth_exec_t) role system_r types dovecot_auth_t; @@ -4590,9 +4800,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dove +optional_policy(` + mta_manage_spool(dovecot_deliver_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.2/policy/modules/services/ftp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.3/policy/modules/services/ftp.te --- nsaserefpolicy/policy/modules/services/ftp.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/ftp.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/ftp.te 2007-07-17 15:46:25.000000000 -0400 @@ -88,6 +88,7 @@ allow ftpd_t self:unix_stream_socket create_stream_socket_perms; allow ftpd_t self:tcp_socket create_stream_socket_perms; @@ -4634,9 +4844,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp. ') tunable_policy(`ftp_home_dir && use_nfs_home_dirs',` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.2/policy/modules/services/hal.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.fc serefpolicy-3.0.3/policy/modules/services/hal.fc --- nsaserefpolicy/policy/modules/services/hal.fc 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/hal.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/hal.fc 2007-07-17 15:46:25.000000000 -0400 @@ -8,9 +8,14 @@ /usr/libexec/hald-addon-macbookpro-backlight -- gen_context(system_u:object_r:hald_mac_exec_t,s0) @@ -4652,9 +4862,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. + +/var/log/pm-suspend.log gen_context(system_u:object_r:hald_log_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.0.2/policy/modules/services/hal.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.if serefpolicy-3.0.3/policy/modules/services/hal.if --- nsaserefpolicy/policy/modules/services/hal.if 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/hal.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/hal.if 2007-07-17 15:46:25.000000000 -0400 @@ -208,3 +208,98 @@ files_search_pids($1) allow $1 hald_var_run_t:file rw_file_perms; @@ -4754,9 +4964,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. + allow $1 hald_t:process ptrace; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.2/policy/modules/services/hal.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal.te serefpolicy-3.0.3/policy/modules/services/hal.te --- nsaserefpolicy/policy/modules/services/hal.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/hal.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/hal.te 2007-07-17 15:46:25.000000000 -0400 @@ -22,6 +22,12 @@ type hald_log_t; files_type(hald_log_t) @@ -4860,9 +5070,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/hal. +miscfiles_read_localization(hald_keymap_t) + +dev_rw_input_dev(hald_keymap_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.2/policy/modules/services/inetd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inetd.te serefpolicy-3.0.3/policy/modules/services/inetd.te --- nsaserefpolicy/policy/modules/services/inetd.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/inetd.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/inetd.te 2007-07-17 15:46:25.000000000 -0400 @@ -80,16 +80,21 @@ corenet_udp_bind_comsat_port(inetd_t) corenet_tcp_bind_dbskkd_port(inetd_t) @@ -4916,9 +5126,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/inet files_search_home(inetd_child_t) manage_dirs_pattern(inetd_child_t,inetd_child_tmp_t,inetd_child_tmp_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.0.2/policy/modules/services/kerberos.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerberos.te serefpolicy-3.0.3/policy/modules/services/kerberos.te --- nsaserefpolicy/policy/modules/services/kerberos.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/kerberos.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/kerberos.te 2007-07-17 15:46:25.000000000 -0400 @@ -91,6 +91,7 @@ kernel_read_kernel_sysctls(kadmind_t) kernel_list_proc(kadmind_t) @@ -4953,9 +5163,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/kerb userdom_dontaudit_use_unpriv_user_fds(krb5kdc_t) userdom_dontaudit_search_sysadm_home_dirs(krb5kdc_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-3.0.2/policy/modules/services/lpd.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd.if serefpolicy-3.0.3/policy/modules/services/lpd.if --- nsaserefpolicy/policy/modules/services/lpd.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/lpd.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/lpd.if 2007-07-17 15:46:25.000000000 -0400 @@ -395,3 +395,22 @@ domtrans_pattern($2, lpr_exec_t, $1_lpr_t) @@ -4979,9 +5189,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/lpd. + + can_exec($1,lpr_exec_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.0.2/policy/modules/services/mailman.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailman.te serefpolicy-3.0.3/policy/modules/services/mailman.te --- nsaserefpolicy/policy/modules/services/mailman.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/mailman.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/mailman.te 2007-07-17 15:46:25.000000000 -0400 @@ -96,6 +96,7 @@ kernel_read_proc_symlinks(mailman_queue_t) @@ -4990,15 +5200,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail files_dontaudit_search_pids(mailman_queue_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.0.2/policy/modules/services/mailscanner.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.fc serefpolicy-3.0.3/policy/modules/services/mailscanner.fc --- nsaserefpolicy/policy/modules/services/mailscanner.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/services/mailscanner.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/mailscanner.fc 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,2 @@ +/var/spool/MailScanner(/.*)? gen_context(system_u:object_r:mailscanner_spool_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.0.2/policy/modules/services/mailscanner.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.if serefpolicy-3.0.3/policy/modules/services/mailscanner.if --- nsaserefpolicy/policy/modules/services/mailscanner.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/services/mailscanner.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/mailscanner.if 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,59 @@ +## Anti-Virus and Anti-Spam Filter + @@ -5059,18 +5269,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mail + files_search_spool($1) + manage_files_pattern($1,mailscanner_spool_t,mailscanner_spool_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.0.2/policy/modules/services/mailscanner.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mailscanner.te serefpolicy-3.0.3/policy/modules/services/mailscanner.te --- nsaserefpolicy/policy/modules/services/mailscanner.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/services/mailscanner.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/mailscanner.te 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,5 @@ + +policy_module(mailscanner,1.0.0) + +type mailscanner_spool_t; +files_type(mailscanner_spool_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.0.2/policy/modules/services/mta.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.if serefpolicy-3.0.3/policy/modules/services/mta.if --- nsaserefpolicy/policy/modules/services/mta.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/mta.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/mta.if 2007-07-17 15:46:25.000000000 -0400 @@ -393,6 +393,7 @@ allow $1 mail_spool_t:dir list_dir_perms; create_files_pattern($1,mail_spool_t,mail_spool_t) @@ -5079,9 +5289,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. create_lnk_files_pattern($1,mail_spool_t,mail_spool_t) read_lnk_files_pattern($1,mail_spool_t,mail_spool_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.0.2/policy/modules/services/mta.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta.te serefpolicy-3.0.3/policy/modules/services/mta.te --- nsaserefpolicy/policy/modules/services/mta.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/mta.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/mta.te 2007-07-17 15:46:25.000000000 -0400 @@ -27,6 +27,7 @@ type sendmail_exec_t; @@ -5143,9 +5353,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mta. cron_dontaudit_write_pipes(system_mail_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.0.2/policy/modules/services/networkmanager.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.fc serefpolicy-3.0.3/policy/modules/services/networkmanager.fc --- nsaserefpolicy/policy/modules/services/networkmanager.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/networkmanager.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/networkmanager.fc 2007-07-17 15:46:25.000000000 -0400 @@ -1,5 +1,6 @@ /usr/(s)?bin/NetworkManager -- gen_context(system_u:object_r:NetworkManager_exec_t,s0) @@ -5153,9 +5363,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw /var/run/NetworkManager\.pid -- gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/NetworkManager(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) /var/run/wpa_supplicant(/.*)? gen_context(system_u:object_r:NetworkManager_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.2/policy/modules/services/networkmanager.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.3/policy/modules/services/networkmanager.te --- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/networkmanager.te 2007-07-13 11:26:07.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/networkmanager.te 2007-07-17 15:46:25.000000000 -0400 @@ -41,6 +41,8 @@ kernel_read_kernel_sysctls(NetworkManager_t) kernel_load_module(NetworkManager_t) @@ -5193,9 +5403,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw # Read gnome-keyring unconfined_read_home_content_files(NetworkManager_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.0.2/policy/modules/services/nis.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.fc serefpolicy-3.0.3/policy/modules/services/nis.fc --- nsaserefpolicy/policy/modules/services/nis.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/nis.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/nis.fc 2007-07-17 15:46:25.000000000 -0400 @@ -4,6 +4,7 @@ /sbin/ypbind -- gen_context(system_u:object_r:ypbind_exec_t,s0) @@ -5204,9 +5414,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. /usr/sbin/rpc\.yppasswdd -- gen_context(system_u:object_r:yppasswdd_exec_t,s0) /usr/sbin/rpc\.ypxfrd -- gen_context(system_u:object_r:ypxfr_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.0.2/policy/modules/services/nis.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.if serefpolicy-3.0.3/policy/modules/services/nis.if --- nsaserefpolicy/policy/modules/services/nis.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/nis.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/nis.if 2007-07-17 15:46:25.000000000 -0400 @@ -49,8 +49,8 @@ corenet_udp_bind_all_nodes($1) corenet_tcp_bind_generic_port($1) @@ -5218,9 +5428,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_dontaudit_tcp_bind_all_ports($1) corenet_dontaudit_udp_bind_all_ports($1) corenet_tcp_connect_portmap_port($1) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.0.2/policy/modules/services/nis.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis.te serefpolicy-3.0.3/policy/modules/services/nis.te --- nsaserefpolicy/policy/modules/services/nis.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/nis.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/nis.te 2007-07-17 15:46:25.000000000 -0400 @@ -113,6 +113,14 @@ userdom_dontaudit_use_unpriv_user_fds(ypbind_t) userdom_dontaudit_search_sysadm_home_dirs(ypbind_t) @@ -5273,9 +5483,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nis. corenet_dontaudit_tcp_bind_all_reserved_ports(ypxfr_t) corenet_dontaudit_udp_bind_all_reserved_ports(ypxfr_t) corenet_tcp_connect_all_ports(ypxfr_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.0.2/policy/modules/services/nscd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd.te serefpolicy-3.0.3/policy/modules/services/nscd.te --- nsaserefpolicy/policy/modules/services/nscd.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/nscd.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/nscd.te 2007-07-17 15:46:25.000000000 -0400 @@ -28,14 +28,14 @@ # Local policy # @@ -5324,10 +5534,27 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/nscd + samba_read_config(nscd_t) + samba_read_var_files(nscd_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.0.2/policy/modules/services/ntp.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp.te serefpolicy-3.0.3/policy/modules/services/ntp.te --- nsaserefpolicy/policy/modules/services/ntp.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/ntp.te 2007-07-13 08:07:53.000000000 -0400 -@@ -126,6 +126,10 @@ ++++ serefpolicy-3.0.3/policy/modules/services/ntp.te 2007-07-19 09:24:25.000000000 -0400 +@@ -40,6 +40,7 @@ + allow ntpd_t self:unix_stream_socket create_socket_perms; + allow ntpd_t self:tcp_socket create_stream_socket_perms; + allow ntpd_t self:udp_socket create_socket_perms; ++allow ntpd_t self:shm create_shm_perms; + + manage_files_pattern(ntpd_t,ntp_drift_t,ntp_drift_t) + +@@ -107,6 +108,8 @@ + + sysnet_read_config(ntpd_t) + ++term_use_ptmx(ntpd_t) ++ + userdom_dontaudit_use_unpriv_user_fds(ntpd_t) + userdom_list_sysadm_home_dirs(ntpd_t) + userdom_dontaudit_list_sysadm_home_dirs(ntpd_t) +@@ -126,6 +129,10 @@ ') optional_policy(` @@ -5338,9 +5565,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ntp. seutil_sigchld_newrole(ntpd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.if serefpolicy-3.0.2/policy/modules/services/openvpn.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.if serefpolicy-3.0.3/policy/modules/services/openvpn.if --- nsaserefpolicy/policy/modules/services/openvpn.if 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/openvpn.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/openvpn.if 2007-07-17 15:46:25.000000000 -0400 @@ -22,3 +22,71 @@ read_files_pattern($1,openvpn_etc_t,openvpn_etc_t) read_lnk_files_pattern($1,openvpn_etc_t,openvpn_etc_t) @@ -5413,9 +5640,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open + + allow $1 openvpn_t:process signal; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.0.2/policy/modules/services/openvpn.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.0.3/policy/modules/services/openvpn.te --- nsaserefpolicy/policy/modules/services/openvpn.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/openvpn.te 2007-07-13 11:27:21.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/openvpn.te 2007-07-17 15:46:25.000000000 -0400 @@ -6,6 +6,13 @@ # Declarations # @@ -5492,9 +5719,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/open + unconfined_use_terminals(openvpn_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-3.0.2/policy/modules/services/pegasus.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.if serefpolicy-3.0.3/policy/modules/services/pegasus.if --- nsaserefpolicy/policy/modules/services/pegasus.if 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/pegasus.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/pegasus.if 2007-07-17 15:46:25.000000000 -0400 @@ -1 +1,19 @@ ## The Open Group Pegasus CIM/WBEM Server. + @@ -5515,9 +5742,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega + + domtrans_pattern($1,pegasus_exec_t,pegasus_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.0.2/policy/modules/services/pegasus.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pegasus.te serefpolicy-3.0.3/policy/modules/services/pegasus.te --- nsaserefpolicy/policy/modules/services/pegasus.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/pegasus.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/pegasus.te 2007-07-17 15:46:25.000000000 -0400 @@ -95,13 +95,13 @@ auth_use_nsswitch(pegasus_t) @@ -5557,9 +5784,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pega rpm_exec(pegasus_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-3.0.2/policy/modules/services/portslave.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/portslave.te serefpolicy-3.0.3/policy/modules/services/portslave.te --- nsaserefpolicy/policy/modules/services/portslave.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/portslave.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/portslave.te 2007-07-17 15:46:25.000000000 -0400 @@ -85,6 +85,7 @@ auth_rw_login_records(portslave_t) @@ -5568,9 +5795,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/port init_rw_utmp(portslave_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.0.2/policy/modules/services/postfix.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.fc serefpolicy-3.0.3/policy/modules/services/postfix.fc --- nsaserefpolicy/policy/modules/services/postfix.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/postfix.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/postfix.fc 2007-07-17 15:46:25.000000000 -0400 @@ -14,6 +14,7 @@ /usr/libexec/postfix/smtpd -- gen_context(system_u:object_r:postfix_smtpd_exec_t,s0) /usr/libexec/postfix/bounce -- gen_context(system_u:object_r:postfix_bounce_exec_t,s0) @@ -5579,9 +5806,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post ', ` /usr/lib/postfix/.* -- gen_context(system_u:object_r:postfix_exec_t,s0) /usr/lib/postfix/cleanup -- gen_context(system_u:object_r:postfix_cleanup_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.0.2/policy/modules/services/postfix.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.if serefpolicy-3.0.3/policy/modules/services/postfix.if --- nsaserefpolicy/policy/modules/services/postfix.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/postfix.if 2007-07-16 09:34:02.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/postfix.if 2007-07-17 15:46:25.000000000 -0400 @@ -41,6 +41,8 @@ allow postfix_$1_t self:unix_stream_socket connectto; @@ -5695,9 +5922,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post + allow $1 postfix_private_t:dir list_dir_perms; + create_sock_files_pattern($1,postfix_private_t,postfix_private_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.0.2/policy/modules/services/postfix.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/postfix.te serefpolicy-3.0.3/policy/modules/services/postfix.te --- nsaserefpolicy/policy/modules/services/postfix.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/postfix.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/postfix.te 2007-07-17 15:46:25.000000000 -0400 @@ -84,6 +84,12 @@ type postfix_var_run_t; files_pid_file(postfix_var_run_t) @@ -5837,9 +6064,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/post +# For reading spamassasin +mta_read_config(postfix_virtual_t) +mta_manage_spool(postfix_virtual_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.0.2/policy/modules/services/procmail.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/procmail.te serefpolicy-3.0.3/policy/modules/services/procmail.te --- nsaserefpolicy/policy/modules/services/procmail.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/procmail.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/procmail.te 2007-07-17 15:46:25.000000000 -0400 @@ -10,6 +10,7 @@ type procmail_exec_t; domain_type(procmail_t) @@ -5875,9 +6102,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/proc +optional_policy(` + mailscanner_read_spool(procmail_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.0.2/policy/modules/services/pyzor.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.if serefpolicy-3.0.3/policy/modules/services/pyzor.if --- nsaserefpolicy/policy/modules/services/pyzor.if 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/pyzor.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/pyzor.if 2007-07-17 15:46:25.000000000 -0400 @@ -25,16 +25,16 @@ # template(`pyzor_per_role_template',` @@ -5900,9 +6127,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.0.2/policy/modules/services/pyzor.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzor.te serefpolicy-3.0.3/policy/modules/services/pyzor.te --- nsaserefpolicy/policy/modules/services/pyzor.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/pyzor.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/pyzor.te 2007-07-17 15:46:25.000000000 -0400 @@ -71,6 +71,11 @@ userdom_dontaudit_search_sysadm_home_dirs(pyzor_t) @@ -5926,9 +6153,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pyzo optional_policy(` logging_send_syslog_msg(pyzord_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.0.2/policy/modules/services/radius.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radius.te serefpolicy-3.0.3/policy/modules/services/radius.te --- nsaserefpolicy/policy/modules/services/radius.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/radius.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/radius.te 2007-07-17 15:46:25.000000000 -0400 @@ -82,6 +82,7 @@ auth_read_shadow(radiusd_t) @@ -5937,9 +6164,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/radi corecmd_exec_bin(radiusd_t) corecmd_exec_shell(radiusd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-3.0.2/policy/modules/services/rhgb.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb.te serefpolicy-3.0.3/policy/modules/services/rhgb.te --- nsaserefpolicy/policy/modules/services/rhgb.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/rhgb.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/rhgb.te 2007-07-17 15:46:25.000000000 -0400 @@ -109,6 +109,7 @@ userdom_dontaudit_use_unpriv_user_fds(rhgb_t) @@ -5948,9 +6175,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rhgb xserver_read_xdm_xserver_tmp_files(rhgb_t) xserver_kill_xdm_xserver(rhgb_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.0.2/policy/modules/services/ricci.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricci.te serefpolicy-3.0.3/policy/modules/services/ricci.te --- nsaserefpolicy/policy/modules/services/ricci.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/ricci.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/ricci.te 2007-07-17 15:46:25.000000000 -0400 @@ -138,6 +138,7 @@ files_create_boot_flag(ricci_t) @@ -5978,9 +6205,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ricc optional_policy(` nscd_dontaudit_search_pid(ricci_modlog_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.0.2/policy/modules/services/rlogin.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlogin.te serefpolicy-3.0.3/policy/modules/services/rlogin.te --- nsaserefpolicy/policy/modules/services/rlogin.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/rlogin.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/rlogin.te 2007-07-17 15:46:25.000000000 -0400 @@ -65,6 +65,7 @@ fs_search_auto_mountpoints(rlogind_t) @@ -5989,9 +6216,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rlog auth_rw_login_records(rlogind_t) auth_use_nsswitch(rlogind_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.0.2/policy/modules/services/rpc.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.if serefpolicy-3.0.3/policy/modules/services/rpc.if --- nsaserefpolicy/policy/modules/services/rpc.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/rpc.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/rpc.if 2007-07-17 15:46:25.000000000 -0400 @@ -81,6 +81,7 @@ corenet_tcp_bind_all_nodes($1_t) corenet_udp_bind_all_nodes($1_t) @@ -6013,9 +6240,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. fs_rw_rpc_named_pipes($1_t) fs_search_auto_mountpoints($1_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.2/policy/modules/services/rpc.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc.te serefpolicy-3.0.3/policy/modules/services/rpc.te --- nsaserefpolicy/policy/modules/services/rpc.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/rpc.te 2007-07-16 11:49:47.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/rpc.te 2007-07-17 15:46:25.000000000 -0400 @@ -59,6 +59,8 @@ manage_files_pattern(rpcd_t,rpcd_var_run_t,rpcd_var_run_t) files_pid_filetrans(rpcd_t,rpcd_var_run_t,file) @@ -6080,9 +6307,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rpc. tunable_policy(`allow_gssd_read_tmp',` userdom_list_unpriv_users_tmp(gssd_t) userdom_read_unpriv_users_tmp_files(gssd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.0.2/policy/modules/services/rshd.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd.te serefpolicy-3.0.3/policy/modules/services/rshd.te --- nsaserefpolicy/policy/modules/services/rshd.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/rshd.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/rshd.te 2007-07-17 15:46:25.000000000 -0400 @@ -45,6 +45,7 @@ selinux_compute_user_contexts(rshd_t) @@ -6098,9 +6325,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rshd - unconfined_domain(rshd_t) unconfined_shell_domtrans(rshd_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.0.2/policy/modules/services/rsync.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsync.te serefpolicy-3.0.3/policy/modules/services/rsync.te --- nsaserefpolicy/policy/modules/services/rsync.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/rsync.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/rsync.te 2007-07-17 15:46:25.000000000 -0400 @@ -17,6 +17,7 @@ type rsync_t; type rsync_exec_t; @@ -6109,17 +6336,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rsyn role system_r types rsync_t; type rsync_data_t; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.fc serefpolicy-3.0.2/policy/modules/services/rwho.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.fc serefpolicy-3.0.3/policy/modules/services/rwho.fc --- nsaserefpolicy/policy/modules/services/rwho.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/rwho.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/rwho.fc 2007-07-17 15:46:25.000000000 -0400 @@ -1,3 +1,4 @@ /usr/sbin/rwhod -- gen_context(system_u:object_r:rwho_exec_t,s0) /var/spool/rwho(/.*)? gen_context(system_u:object_r:rwho_spool_t,s0) +/var/log/rwhod(/.*)? gen_context(system_u:object_r:rwho_log_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-3.0.2/policy/modules/services/rwho.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.if serefpolicy-3.0.3/policy/modules/services/rwho.if --- nsaserefpolicy/policy/modules/services/rwho.if 2007-06-15 14:54:33.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/rwho.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/rwho.if 2007-07-17 15:46:25.000000000 -0400 @@ -72,6 +72,47 @@ type rwho_spool_t; ') @@ -6169,9 +6396,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho + logging_search_logs($1) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.te serefpolicy-3.0.2/policy/modules/services/rwho.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho.te serefpolicy-3.0.3/policy/modules/services/rwho.te --- nsaserefpolicy/policy/modules/services/rwho.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/rwho.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/rwho.te 2007-07-17 15:46:25.000000000 -0400 @@ -10,10 +10,12 @@ type rwho_exec_t; init_daemon_domain(rwho_t, rwho_exec_t) @@ -6197,9 +6424,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/rwho kernel_read_system_state(rwho_t) corenet_all_recvfrom_unlabeled(rwho_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.0.2/policy/modules/services/samba.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.fc serefpolicy-3.0.3/policy/modules/services/samba.fc --- nsaserefpolicy/policy/modules/services/samba.fc 2007-06-19 16:23:34.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/samba.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/samba.fc 2007-07-17 15:46:25.000000000 -0400 @@ -30,6 +30,8 @@ /var/lib/samba(/.*)? gen_context(system_u:object_r:samba_var_t,s0) /var/lib/samba/winbindd_privileged(/.*)? gen_context(system_u:object_r:winbind_var_run_t,s0) @@ -6209,9 +6436,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb /var/log/samba(/.*)? gen_context(system_u:object_r:samba_log_t,s0) /var/run/samba/brlock\.tdb -- gen_context(system_u:object_r:smbd_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.0.2/policy/modules/services/samba.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.if serefpolicy-3.0.3/policy/modules/services/samba.if --- nsaserefpolicy/policy/modules/services/samba.if 2007-06-19 16:23:35.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/samba.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/samba.if 2007-07-17 15:46:25.000000000 -0400 @@ -349,6 +349,7 @@ files_search_var($1) files_search_var_lib($1) @@ -6273,9 +6500,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb + read_files_pattern($1, samba_share_t, samba_share_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.0.2/policy/modules/services/samba.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samba.te serefpolicy-3.0.3/policy/modules/services/samba.te --- nsaserefpolicy/policy/modules/services/samba.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/samba.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/samba.te 2007-07-17 15:46:25.000000000 -0400 @@ -190,6 +190,8 @@ miscfiles_read_localization(samba_net_t) @@ -6404,9 +6631,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/samb seutil_sigchld_newrole(winbind_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.0.2/policy/modules/services/sasl.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl.te serefpolicy-3.0.3/policy/modules/services/sasl.te --- nsaserefpolicy/policy/modules/services/sasl.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/sasl.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/sasl.te 2007-07-17 15:46:25.000000000 -0400 @@ -64,6 +64,7 @@ selinux_compute_access_vector(saslauthd_t) @@ -6415,9 +6642,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sasl auth_use_nsswitch(saslauthd_t) domain_use_interactive_fds(saslauthd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.0.2/policy/modules/services/sendmail.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sendmail.if serefpolicy-3.0.3/policy/modules/services/sendmail.if --- nsaserefpolicy/policy/modules/services/sendmail.if 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/sendmail.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/sendmail.if 2007-07-17 15:46:25.000000000 -0400 @@ -131,3 +131,21 @@ logging_log_filetrans($1,sendmail_log_t,file) @@ -6440,9 +6667,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/send + allow $1 sendmail_t:process signal; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.0.2/policy/modules/services/setroubleshoot.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.if serefpolicy-3.0.3/policy/modules/services/setroubleshoot.if --- nsaserefpolicy/policy/modules/services/setroubleshoot.if 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/setroubleshoot.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/setroubleshoot.if 2007-07-17 15:46:25.000000000 -0400 @@ -19,3 +19,22 @@ allow $1 setroubleshoot_var_run_t:sock_file write; allow $1 setroubleshootd_t:unix_stream_socket connectto; @@ -6466,9 +6693,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr + dontaudit $1 setroubleshoot_var_run_t:sock_file write; + dontaudit $1 setroubleshootd_t:unix_stream_socket connectto; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.2/policy/modules/services/setroubleshoot.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setroubleshoot.te serefpolicy-3.0.3/policy/modules/services/setroubleshoot.te --- nsaserefpolicy/policy/modules/services/setroubleshoot.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/setroubleshoot.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/setroubleshoot.te 2007-07-17 15:46:25.000000000 -0400 @@ -76,6 +76,9 @@ files_getattr_all_dirs(setroubleshootd_t) files_getattr_all_files(setroubleshootd_t) @@ -6479,9 +6706,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/setr selinux_get_enforce_mode(setroubleshootd_t) selinux_validate_context(setroubleshootd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.0.2/policy/modules/services/smartmon.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smartmon.te serefpolicy-3.0.3/policy/modules/services/smartmon.te --- nsaserefpolicy/policy/modules/services/smartmon.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/smartmon.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/smartmon.te 2007-07-17 15:46:25.000000000 -0400 @@ -61,6 +61,7 @@ fs_search_auto_mountpoints(fsdaemon_t) @@ -6490,9 +6717,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/smar storage_raw_read_fixed_disk(fsdaemon_t) storage_raw_write_fixed_disk(fsdaemon_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-3.0.2/policy/modules/services/snmp.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp.fc serefpolicy-3.0.3/policy/modules/services/snmp.fc --- nsaserefpolicy/policy/modules/services/snmp.fc 2007-06-19 16:23:35.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/snmp.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/snmp.fc 2007-07-17 15:46:25.000000000 -0400 @@ -1,3 +1,10 @@ + +# @@ -6504,9 +6731,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/snmp # # /usr # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.0.2/policy/modules/services/spamassassin.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.fc serefpolicy-3.0.3/policy/modules/services/spamassassin.fc --- nsaserefpolicy/policy/modules/services/spamassassin.fc 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/spamassassin.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/spamassassin.fc 2007-07-17 15:46:25.000000000 -0400 @@ -10,3 +10,9 @@ /var/lib/spamassassin(/.*)? gen_context(system_u:object_r:spamd_var_lib_t,s0) @@ -6517,9 +6744,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam +/var/run/spamass-milter(/.*)? gen_context(system_u:object_r:spamd_var_run_t,s0) + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.0.2/policy/modules/services/spamassassin.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spamassassin.te serefpolicy-3.0.3/policy/modules/services/spamassassin.te --- nsaserefpolicy/policy/modules/services/spamassassin.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/spamassassin.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/spamassassin.te 2007-07-17 15:46:25.000000000 -0400 @@ -22,7 +22,7 @@ # spamassassin client executable @@ -6549,18 +6776,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/spam kernel_read_all_sysctls(spamd_t) kernel_read_system_state(spamd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.0.2/policy/modules/services/squid.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.fc serefpolicy-3.0.3/policy/modules/services/squid.fc --- nsaserefpolicy/policy/modules/services/squid.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/squid.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/squid.fc 2007-07-17 15:46:25.000000000 -0400 @@ -12,3 +12,5 @@ /var/run/squid\.pid -- gen_context(system_u:object_r:squid_var_run_t,s0) /var/spool/squid(/.*)? gen_context(system_u:object_r:squid_cache_t,s0) +/usr/lib/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) +/usr/lib64/squid/cachemgr\.cgi -- gen_context(system_u:object_r:httpd_squid_script_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.0.2/policy/modules/services/squid.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squid.te serefpolicy-3.0.3/policy/modules/services/squid.te --- nsaserefpolicy/policy/modules/services/squid.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/squid.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/squid.te 2007-07-17 15:46:25.000000000 -0400 @@ -109,6 +109,8 @@ fs_getattr_all_fs(squid_t) @@ -6587,9 +6814,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/squi + corenet_all_recvfrom_unlabeled(httpd_squid_script_t) + corenet_all_recvfrom_netlabel(httpd_squid_script_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.0.2/policy/modules/services/ssh.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.if serefpolicy-3.0.3/policy/modules/services/ssh.if --- nsaserefpolicy/policy/modules/services/ssh.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/ssh.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/ssh.if 2007-07-17 15:46:25.000000000 -0400 @@ -203,6 +203,7 @@ # template(`ssh_per_role_template',` @@ -6641,9 +6868,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. + dontaudit $2 $1_ssh_agent_t:fd use; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.0.2/policy/modules/services/ssh.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh.te serefpolicy-3.0.3/policy/modules/services/ssh.te --- nsaserefpolicy/policy/modules/services/ssh.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/ssh.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/ssh.te 2007-07-17 15:46:25.000000000 -0400 @@ -24,11 +24,11 @@ # Type for the ssh-agent executable. @@ -6684,9 +6911,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ssh. ') ifdef(`TODO',` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.0.2/policy/modules/services/uwimap.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwimap.te serefpolicy-3.0.3/policy/modules/services/uwimap.te --- nsaserefpolicy/policy/modules/services/uwimap.te 2007-07-03 07:06:26.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/uwimap.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/uwimap.te 2007-07-17 15:46:25.000000000 -0400 @@ -64,6 +64,7 @@ fs_search_auto_mountpoints(imapd_t) @@ -6695,20 +6922,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/uwim libs_use_ld_so(imapd_t) libs_use_shared_libs(imapd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.0.2/policy/modules/services/w3c.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.fc serefpolicy-3.0.3/policy/modules/services/w3c.fc --- nsaserefpolicy/policy/modules/services/w3c.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/services/w3c.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/w3c.fc 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,2 @@ +/usr/share/w3c-markup-validator(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_content_t,s0) +/usr/share/w3c-markup-validator/cgi-bin(/.*)? gen_context(system_u:object_r:httpd_w3c_validator_script_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.0.2/policy/modules/services/w3c.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.if serefpolicy-3.0.3/policy/modules/services/w3c.if --- nsaserefpolicy/policy/modules/services/w3c.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/services/w3c.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/w3c.if 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1 @@ +## W3C -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.0.2/policy/modules/services/w3c.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c.te serefpolicy-3.0.3/policy/modules/services/w3c.te --- nsaserefpolicy/policy/modules/services/w3c.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/services/w3c.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/w3c.te 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,14 @@ +policy_module(w3c,1.2.1) + @@ -6724,9 +6951,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/w3c. +corenet_tcp_sendrecv_http_cache_port(httpd_w3c_validator_script_t) + +miscfiles_read_certs(httpd_w3c_validator_script_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.0.2/policy/modules/services/xserver.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.fc serefpolicy-3.0.3/policy/modules/services/xserver.fc --- nsaserefpolicy/policy/modules/services/xserver.fc 2007-05-29 14:10:57.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/xserver.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/xserver.fc 2007-07-17 15:46:25.000000000 -0400 @@ -92,6 +92,7 @@ /var/log/XFree86.* -- gen_context(system_u:object_r:xserver_log_t,s0) /var/log/Xorg.* -- gen_context(system_u:object_r:xserver_log_t,s0) @@ -6735,9 +6962,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser /var/run/[gx]dm\.pid -- gen_context(system_u:object_r:xdm_var_run_t,s0) /var/run/xdmctl(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.2/policy/modules/services/xserver.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.3/policy/modules/services/xserver.if --- nsaserefpolicy/policy/modules/services/xserver.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/xserver.if 2007-07-14 07:51:19.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/xserver.if 2007-07-17 15:46:25.000000000 -0400 @@ -353,12 +353,6 @@ # allow ps to show xauth ps_process_pattern($2,$1_xauth_t) @@ -6785,7 +7012,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser # for when /tmp/.X11-unix is created by the system allow $2 xdm_t:fd use; -@@ -555,25 +555,40 @@ +@@ -555,25 +555,47 @@ allow $2 xdm_tmp_t:sock_file { read write }; dontaudit $2 xdm_t:tcp_socket { read write }; @@ -6815,6 +7042,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser - allow $2 $1_xserver_tmpfs_t:file rw_file_perms; + xserver_xdm_stream_connect($2) + ++ optional_policy(` ++ userdom_read_all_users_home_content_files(xdm_t) ++ userdom_read_all_users_home_content_files(xdm_xserver_t) ++#Compiler is broken so these wont work ++# gnome_read_user_gnome_config($1, xdm_t) ++# gnome_read_user_gnome_config($1, xdm_xserver_t) ++ ') + + # Read .Xauthority file + optional_policy(` @@ -6834,7 +7068,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') ') -@@ -626,6 +641,24 @@ +@@ -626,6 +648,24 @@ ######################################## ## @@ -6859,7 +7093,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ## Transition to a user Xauthority domain. ## ## -@@ -659,6 +692,73 @@ +@@ -659,6 +699,73 @@ ######################################## ## @@ -6933,7 +7167,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ## Transition to a user Xauthority domain. ## ## -@@ -1136,7 +1236,7 @@ +@@ -1136,7 +1243,7 @@ type xdm_xserver_tmp_t; ') @@ -6942,7 +7176,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser ') ######################################## -@@ -1325,3 +1425,23 @@ +@@ -1325,3 +1432,44 @@ files_search_tmp($1) stream_connect_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t,xdm_xserver_t) ') @@ -6966,9 +7200,30 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser + allow $1 xdm_var_run_t:sock_file write; + allow $1 xdm_t:unix_stream_socket connectto; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.0.2/policy/modules/services/xserver.te ++ ++######################################## ++## ++## xdm xserver RW shared memory socket. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`xserver_xdm_rw_shm',` ++ gen_require(` ++ type xdm_xserver_t; ++ ') ++ ++ allow $1 xdm_xserver_t:shm rw_shm_perms; ++ allow xdm_xserver_t $1:shm rw_shm_perms; ++ ++') ++ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.te serefpolicy-3.0.3/policy/modules/services/xserver.te --- nsaserefpolicy/policy/modules/services/xserver.te 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/services/xserver.te 2007-07-14 07:51:04.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/services/xserver.te 2007-07-17 15:46:25.000000000 -0400 @@ -16,6 +16,13 @@ ## @@ -7120,14 +7375,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser -# -allow pam_t xdm_t:fifo_file { getattr ioctl write }; -') dnl end TODO -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.fc serefpolicy-3.0.2/policy/modules/system/application.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.fc serefpolicy-3.0.3/policy/modules/system/application.fc --- nsaserefpolicy/policy/modules/system/application.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/system/application.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/application.fc 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1 @@ +# No application file contexts. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.0.2/policy/modules/system/application.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.if serefpolicy-3.0.3/policy/modules/system/application.if --- nsaserefpolicy/policy/modules/system/application.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/system/application.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/application.if 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,104 @@ +## Policy for application domains + @@ -7233,9 +7488,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic + application_executable_file($2) + domain_entry_file($1,$2) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.0.2/policy/modules/system/application.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/application.te serefpolicy-3.0.3/policy/modules/system/application.te --- nsaserefpolicy/policy/modules/system/application.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/system/application.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/application.te 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,14 @@ + +policy_module(application,1.0.0) @@ -7251,9 +7506,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/applic + ssh_rw_stream_sockets(application_domain_type) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.0.2/policy/modules/system/authlogin.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.fc serefpolicy-3.0.3/policy/modules/system/authlogin.fc --- nsaserefpolicy/policy/modules/system/authlogin.fc 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/authlogin.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/authlogin.fc 2007-07-17 15:46:25.000000000 -0400 @@ -14,6 +14,7 @@ /sbin/pam_timestamp_check -- gen_context(system_u:object_r:pam_exec_t,s0) /sbin/unix_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) @@ -7262,9 +7517,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ifdef(`distro_suse', ` /sbin/unix2_chkpwd -- gen_context(system_u:object_r:chkpwd_exec_t,s0) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.2/policy/modules/system/authlogin.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.3/policy/modules/system/authlogin.if --- nsaserefpolicy/policy/modules/system/authlogin.if 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/authlogin.if 2007-07-13 09:03:56.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/authlogin.if 2007-07-19 10:36:40.000000000 -0400 @@ -27,7 +27,8 @@ domain_type($1_chkpwd_t) domain_entry_file($1_chkpwd_t,chkpwd_exec_t) @@ -7294,17 +7549,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo domain_type($1) domain_subj_id_change_exemption($1) -@@ -177,6 +181,9 @@ +@@ -177,6 +181,12 @@ domain_obj_id_change_exemption($1) role system_r types $1; + auth_keyring_domain($1) + allow $1 keyring_type:key { search link }; + ++ files_list_var_lib($1) ++ manage_files_pattern($1, var_auth_t, var_auth_t) ++ # for SSP/ProPolice dev_read_urand($1) -@@ -197,22 +204,26 @@ +@@ -197,22 +207,26 @@ mls_fd_share_all_levels($1) auth_domtrans_chk_passwd($1) @@ -7332,7 +7590,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') ') -@@ -310,9 +321,6 @@ +@@ -310,9 +324,6 @@ type system_chkpwd_t, chkpwd_exec_t, shadow_t; ') @@ -7342,7 +7600,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo corecmd_search_bin($1) domtrans_pattern($1,chkpwd_exec_t,system_chkpwd_t) -@@ -348,6 +356,37 @@ +@@ -348,6 +359,37 @@ ######################################## ## @@ -7380,7 +7638,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ## Get the attributes of the shadow passwords file. ## ## -@@ -696,6 +735,24 @@ +@@ -696,6 +738,24 @@ ######################################## ## @@ -7405,7 +7663,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ## Execute pam programs in the PAM domain. ## ## -@@ -1382,3 +1439,114 @@ +@@ -1319,14 +1379,9 @@ + ## + # + interface(`auth_use_nsswitch',` +- gen_require(` +- type var_auth_t; +- ') + + allow $1 self:netlink_route_socket r_netlink_socket_perms; + +- allow $1 var_auth_t:dir list_dir_perms; +- allow $1 var_auth_t:file manage_file_perms; + files_list_var_lib($1) + + miscfiles_read_certs($1) +@@ -1382,3 +1437,114 @@ typeattribute $1 can_write_shadow_passwords; typeattribute $1 can_relabelto_shadow_passwords; ') @@ -7520,9 +7793,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + auth_dontaudit_read_shadow($1) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.0.2/policy/modules/system/authlogin.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.0.3/policy/modules/system/authlogin.te --- nsaserefpolicy/policy/modules/system/authlogin.te 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/authlogin.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/authlogin.te 2007-07-17 15:46:25.000000000 -0400 @@ -9,6 +9,13 @@ attribute can_read_shadow_passwords; attribute can_write_shadow_passwords; @@ -7586,15 +7859,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +optional_policy(` + nscd_socket_use(updpwd_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.fc serefpolicy-3.0.2/policy/modules/system/brctl.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.fc serefpolicy-3.0.3/policy/modules/system/brctl.fc --- nsaserefpolicy/policy/modules/system/brctl.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/system/brctl.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/brctl.fc 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,2 @@ + +/usr/sbin/brctl -- gen_context(system_u:object_r:brctl_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.if serefpolicy-3.0.2/policy/modules/system/brctl.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.if serefpolicy-3.0.3/policy/modules/system/brctl.if --- nsaserefpolicy/policy/modules/system/brctl.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/system/brctl.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/brctl.if 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,25 @@ + +## Utilities for configuring the linux ethernet bridge @@ -7621,10 +7894,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl. + allow brctl_t $1:fifo_file rw_file_perms; + allow brctl_t $1:process sigchld; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.te serefpolicy-3.0.2/policy/modules/system/brctl.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl.te serefpolicy-3.0.3/policy/modules/system/brctl.te --- nsaserefpolicy/policy/modules/system/brctl.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/system/brctl.te 2007-07-13 13:03:10.000000000 -0400 -@@ -0,0 +1,44 @@ ++++ serefpolicy-3.0.3/policy/modules/system/brctl.te 2007-07-19 09:01:33.000000000 -0400 +@@ -0,0 +1,50 @@ +policy_module(brctl,1.0.0) + +######################################## @@ -7647,6 +7920,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl. +allow brctl_t self:tcp_socket create_socket_perms; +allow brctl_t self:unix_dgram_socket create_socket_perms; + ++dev_search_sysfs(brctl_t) ++ +# Init script handling +domain_use_interactive_fds(brctl_t) + @@ -7669,9 +7944,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/brctl. + term_dontaudit_use_unallocated_ttys(brctl_t) + term_dontaudit_use_generic_ptys(brctl_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.0.2/policy/modules/system/fstools.fc ++ ++optional_policy(` ++ xen_append_log(brctl_t) ++') +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.fc serefpolicy-3.0.3/policy/modules/system/fstools.fc --- nsaserefpolicy/policy/modules/system/fstools.fc 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/fstools.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/fstools.fc 2007-07-17 15:46:25.000000000 -0400 @@ -20,7 +20,6 @@ /sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0) @@ -7680,9 +7959,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool /sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-3.0.2/policy/modules/system/fstools.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.if serefpolicy-3.0.3/policy/modules/system/fstools.if --- nsaserefpolicy/policy/modules/system/fstools.if 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/fstools.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/fstools.if 2007-07-17 15:46:25.000000000 -0400 @@ -124,3 +124,22 @@ allow $1 swapfile_t:file getattr; @@ -7706,9 +7985,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool + allow $1 fsdaemon_t:fifo_file read_fifo_file_perms; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.0.2/policy/modules/system/fstools.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstools.te serefpolicy-3.0.3/policy/modules/system/fstools.te --- nsaserefpolicy/policy/modules/system/fstools.te 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/fstools.te 2007-07-14 08:55:21.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/fstools.te 2007-07-17 15:46:25.000000000 -0400 @@ -9,6 +9,7 @@ type fsadm_t; type fsadm_exec_t; @@ -7726,9 +8005,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fstool + xen_append_log(fsadm_t) + xen_rw_image_files(udev_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-3.0.2/policy/modules/system/fusermount.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.fc serefpolicy-3.0.3/policy/modules/system/fusermount.fc --- nsaserefpolicy/policy/modules/system/fusermount.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/system/fusermount.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/fusermount.fc 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,6 @@ +# fusermount executable will have: +# label: system_u:object_r:fusermount_exec_t @@ -7736,9 +8015,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm +# MCS categories: + +/usr/bin/fusermount -- gen_context(system_u:object_r:fusermount_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-3.0.2/policy/modules/system/fusermount.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.if serefpolicy-3.0.3/policy/modules/system/fusermount.if --- nsaserefpolicy/policy/modules/system/fusermount.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/system/fusermount.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/fusermount.if 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,41 @@ +## policy for fusermount + @@ -7782,9 +8061,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm + allow $1 fusermount_t:fd use; +') \ No newline at end of file -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-3.0.2/policy/modules/system/fusermount.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fusermount.te serefpolicy-3.0.3/policy/modules/system/fusermount.te --- nsaserefpolicy/policy/modules/system/fusermount.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/system/fusermount.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/fusermount.te 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,46 @@ +policy_module(fusermount,1.0.0) + @@ -7832,9 +8111,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/fuserm + mount_ntfs_rw_stream_sockets(fusermount_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.0.2/policy/modules/system/getty.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty.te serefpolicy-3.0.3/policy/modules/system/getty.te --- nsaserefpolicy/policy/modules/system/getty.te 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/getty.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/getty.te 2007-07-17 15:46:25.000000000 -0400 @@ -33,7 +33,8 @@ # @@ -7845,9 +8124,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/getty. dontaudit getty_t self:capability sys_tty_config; allow getty_t self:process { getpgid setpgid getsession signal_perms }; allow getty_t self:fifo_file rw_fifo_file_perms; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.0.2/policy/modules/system/hostname.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostname.te serefpolicy-3.0.3/policy/modules/system/hostname.te --- nsaserefpolicy/policy/modules/system/hostname.te 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/hostname.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/hostname.te 2007-07-17 15:46:25.000000000 -0400 @@ -8,8 +8,12 @@ type hostname_t; @@ -7874,9 +8153,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna +optional_policy(` + unconfined_dontaudit_rw_pipes(hostname_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.2/policy/modules/system/init.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.3/policy/modules/system/init.if --- nsaserefpolicy/policy/modules/system/init.if 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/init.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/init.if 2007-07-17 15:46:25.000000000 -0400 @@ -194,11 +194,14 @@ gen_require(` type initrc_t; @@ -7944,9 +8223,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i + + allow $1 init_t:process ptrace; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.2/policy/modules/system/init.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.te serefpolicy-3.0.3/policy/modules/system/init.te --- nsaserefpolicy/policy/modules/system/init.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/init.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/init.te 2007-07-17 15:46:25.000000000 -0400 @@ -10,6 +10,20 @@ # Declarations # @@ -8059,9 +8338,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.0.2/policy/modules/system/ipsec.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.if serefpolicy-3.0.3/policy/modules/system/ipsec.if --- nsaserefpolicy/policy/modules/system/ipsec.if 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/ipsec.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/ipsec.if 2007-07-17 15:46:25.000000000 -0400 @@ -114,6 +114,26 @@ ######################################## @@ -8089,9 +8368,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. ## Execute racoon in the racoon domain. ## ## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.2/policy/modules/system/ipsec.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.3/policy/modules/system/ipsec.te --- nsaserefpolicy/policy/modules/system/ipsec.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/ipsec.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/ipsec.te 2007-07-17 15:46:25.000000000 -0400 @@ -283,6 +283,7 @@ allow racoon_t self:netlink_selinux_socket { bind create read }; allow racoon_t self:udp_socket create_socket_perms; @@ -8100,10 +8379,19 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. # manage pid file manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.2/policy/modules/system/iptables.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.3/policy/modules/system/iptables.te --- nsaserefpolicy/policy/modules/system/iptables.te 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/iptables.te 2007-07-13 08:07:53.000000000 -0400 -@@ -62,6 +62,7 @@ ++++ serefpolicy-3.0.3/policy/modules/system/iptables.te 2007-07-19 09:15:48.000000000 -0400 +@@ -44,6 +44,8 @@ + + corenet_relabelto_all_packets(iptables_t) + ++auth_use_nsswitch(iptables_t) ++ + dev_read_sysfs(iptables_t) + + fs_getattr_xattr_fs(iptables_t) +@@ -62,6 +64,7 @@ init_use_script_ptys(iptables_t) # to allow rules to be saved on reboot: init_rw_script_tmp_files(iptables_t) @@ -8111,9 +8399,20 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptabl libs_use_ld_so(iptables_t) libs_use_shared_libs(iptables_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.2/policy/modules/system/libraries.fc +@@ -96,10 +99,6 @@ + ') + + optional_policy(` +- nscd_socket_use(iptables_t) +-') +- +-optional_policy(` + ppp_dontaudit_use_fds(iptables_t) + ') + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.3/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/libraries.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/libraries.fc 2007-07-17 15:46:25.000000000 -0400 @@ -158,8 +158,11 @@ /usr/(local/)?.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:shlib_t,s0) /usr/(local/)?lib(64)?/wine/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -8143,9 +8442,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar +/usr/lib/mozilla/plugins/libvlcplugin.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) +/usr/lib64/mozilla/plugins/libvlcplugin.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.0.2/policy/modules/system/libraries.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.0.3/policy/modules/system/libraries.te --- nsaserefpolicy/policy/modules/system/libraries.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/libraries.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/libraries.te 2007-07-17 15:46:25.000000000 -0400 @@ -97,6 +97,11 @@ ') ') @@ -8170,9 +8469,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar + # run mkinitrd as unconfined user + unconfined_manage_tmp_files(ldconfig_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.0.2/policy/modules/system/locallogin.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locallogin.te serefpolicy-3.0.3/policy/modules/system/locallogin.te --- nsaserefpolicy/policy/modules/system/locallogin.te 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/locallogin.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/locallogin.te 2007-07-17 15:46:25.000000000 -0400 @@ -56,6 +56,10 @@ allow local_login_t local_login_tmp_t:file manage_file_perms; files_tmp_filetrans(local_login_t, local_login_tmp_t, { file dir }) @@ -8232,9 +8531,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/locall ################################# # # Sulogin local policy -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.0.2/policy/modules/system/logging.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.fc serefpolicy-3.0.3/policy/modules/system/logging.fc --- nsaserefpolicy/policy/modules/system/logging.fc 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/logging.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/logging.fc 2007-07-17 15:46:25.000000000 -0400 @@ -1,6 +1,6 @@ - /dev/log -s gen_context(system_u:object_r:devlog_t,s0) @@ -8249,9 +8548,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin /var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0) + +/var/log/syslog-ng(/.*)? -- gen_context(system_u:object_r:syslogd_var_run_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.0.2/policy/modules/system/logging.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.if serefpolicy-3.0.3/policy/modules/system/logging.if --- nsaserefpolicy/policy/modules/system/logging.if 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/logging.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/logging.if 2007-07-17 15:46:25.000000000 -0400 @@ -33,8 +33,13 @@ ## # @@ -8477,9 +8776,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin + typeattribute $1 can_send_audit_msgs; +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.0.2/policy/modules/system/logging.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/logging.te serefpolicy-3.0.3/policy/modules/system/logging.te --- nsaserefpolicy/policy/modules/system/logging.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/logging.te 2007-07-13 10:11:19.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/logging.te 2007-07-17 15:46:25.000000000 -0400 @@ -7,10 +7,15 @@ # @@ -8615,9 +8914,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/loggin files_read_etc_runtime_files(syslogd_t) # /initrd is not umounted before minilog starts files_dontaudit_search_isid_type_dirs(syslogd_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.0.2/policy/modules/system/lvm.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc serefpolicy-3.0.3/policy/modules/system/lvm.fc --- nsaserefpolicy/policy/modules/system/lvm.fc 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/lvm.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/lvm.fc 2007-07-17 15:46:25.000000000 -0400 @@ -15,6 +15,7 @@ # /etc/lvm(/.*)? gen_context(system_u:object_r:lvm_etc_t,s0) @@ -8626,9 +8925,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc /etc/lvm/archive(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0) /etc/lvm/backup(/.*)? gen_context(system_u:object_r:lvm_metadata_t,s0) /etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.2/policy/modules/system/lvm.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.3/policy/modules/system/lvm.te --- nsaserefpolicy/policy/modules/system/lvm.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/lvm.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/lvm.te 2007-07-17 15:46:25.000000000 -0400 @@ -16,6 +16,7 @@ type lvm_t; type lvm_exec_t; @@ -8681,9 +8980,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te + xen_dontaudit_rw_unix_stream_sockets(lvm_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.0.2/policy/modules/system/miscfiles.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfiles.fc serefpolicy-3.0.3/policy/modules/system/miscfiles.fc --- nsaserefpolicy/policy/modules/system/miscfiles.fc 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/miscfiles.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/miscfiles.fc 2007-07-17 15:46:25.000000000 -0400 @@ -66,6 +66,7 @@ /var/lib/texmf(/.*)? gen_context(system_u:object_r:tetex_data_t,s0) @@ -8692,9 +8991,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/miscfi /var/cache/man(/.*)? gen_context(system_u:object_r:man_t,s0) /var/spool/texmf(/.*)? gen_context(system_u:object_r:tetex_data_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.0.2/policy/modules/system/modutils.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/modutils.te serefpolicy-3.0.3/policy/modules/system/modutils.te --- nsaserefpolicy/policy/modules/system/modutils.te 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/modutils.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/modutils.te 2007-07-17 15:46:25.000000000 -0400 @@ -43,7 +43,7 @@ # insmod local policy # @@ -8778,18 +9077,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/moduti ') optional_policy(` -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.0.2/policy/modules/system/mount.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.fc serefpolicy-3.0.3/policy/modules/system/mount.fc --- nsaserefpolicy/policy/modules/system/mount.fc 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/mount.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/mount.fc 2007-07-17 15:46:25.000000000 -0400 @@ -1,4 +1,3 @@ /bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) /bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) - -/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) +/sbin/mount.ntfs-3g -- gen_context(system_u:object_r:mount_ntfs_exec_t,s0) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-3.0.2/policy/modules/system/mount.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.if serefpolicy-3.0.3/policy/modules/system/mount.if --- nsaserefpolicy/policy/modules/system/mount.if 2007-06-11 16:05:30.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/mount.if 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/mount.if 2007-07-17 15:46:25.000000000 -0400 @@ -171,3 +171,40 @@ role $2 types unconfined_mount_t; allow unconfined_mount_t $3:chr_file rw_file_perms; @@ -8831,9 +9130,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. + + allow $1 mount_ntfs_t:unix_stream_socket { read write }; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.0.2/policy/modules/system/mount.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount.te serefpolicy-3.0.3/policy/modules/system/mount.te --- nsaserefpolicy/policy/modules/system/mount.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/mount.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/mount.te 2007-07-17 15:46:25.000000000 -0400 @@ -8,6 +8,13 @@ ## @@ -8972,9 +9271,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/mount. + hal_rw_pipes(mount_ntfs_t) +') + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-3.0.2/policy/modules/system/netlabel.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlabel.te serefpolicy-3.0.3/policy/modules/system/netlabel.te --- nsaserefpolicy/policy/modules/system/netlabel.te 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/netlabel.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/netlabel.te 2007-07-17 15:46:25.000000000 -0400 @@ -20,6 +20,8 @@ allow netlabel_mgmt_t self:capability net_admin; allow netlabel_mgmt_t self:netlink_socket create_socket_perms; @@ -8984,9 +9283,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/netlab kernel_read_network_state(netlabel_mgmt_t) libs_use_ld_so(netlabel_mgmt_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.0.2/policy/modules/system/raid.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.te serefpolicy-3.0.3/policy/modules/system/raid.te --- nsaserefpolicy/policy/modules/system/raid.te 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/raid.te 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/raid.te 2007-07-17 15:46:25.000000000 -0400 @@ -19,7 +19,7 @@ # Local policy # @@ -8996,9 +9295,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/raid.t dontaudit mdadm_t self:capability sys_tty_config; allow mdadm_t self:process { sigchld sigkill sigstop signull signal }; allow mdadm_t self:fifo_file rw_fifo_file_perms; -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.0.2/policy/modules/system/selinuxutil.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.fc serefpolicy-3.0.3/policy/modules/system/selinuxutil.fc --- nsaserefpolicy/policy/modules/system/selinuxutil.fc 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/selinuxutil.fc 2007-07-13 08:07:53.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/selinuxutil.fc 2007-07-17 15:46:25.000000000 -0400 @@ -38,8 +38,9 @@ /usr/sbin/restorecond -- gen_context(system_u:object_r:restorecond_exec_t,s0) /usr/sbin/run_init -- gen_context(system_u:object_r:run_init_exec_t,s0) @@ -9010,9 +9309,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu /usr/sbin/semodule -- gen_context(system_u:object_r:semanage_exec_t,s0) # -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.0.2/policy/modules/system/selinuxutil.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.if serefpolicy-3.0.3/policy/modules/system/selinuxutil.if --- nsaserefpolicy/policy/modules/system/selinuxutil.if 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/selinuxutil.if 2007-07-13 14:03:26.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/selinuxutil.if 2007-07-17 15:46:25.000000000 -0400 @@ -432,6 +432,7 @@ role $2 types run_init_t; allow run_init_t $3:chr_file rw_term_perms; @@ -9219,9 +9518,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu +seutil_manage_default_contexts($1) + +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.0.2/policy/modules/system/selinuxutil.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinuxutil.te serefpolicy-3.0.3/policy/modules/system/selinuxutil.te --- nsaserefpolicy/policy/modules/system/selinuxutil.te 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/selinuxutil.te 2007-07-13 13:59:17.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/selinuxutil.te 2007-07-17 15:46:25.000000000 -0400 @@ -24,11 +24,9 @@ files_type(selinux_config_t) @@ -9426,9 +9725,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu udev_dontaudit_rw_dgram_sockets(setfiles_t) ') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.0.2/policy/modules/system/sysnetwork.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.0.3/policy/modules/system/sysnetwork.if --- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/sysnetwork.if 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/sysnetwork.if 2007-07-17 15:46:25.000000000 -0400 @@ -522,6 +522,8 @@ files_search_etc($1) @@ -9438,9 +9737,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet ') ######################################## -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.2/policy/modules/system/sysnetwork.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.0.3/policy/modules/system/sysnetwork.te --- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/sysnetwork.te 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/sysnetwork.te 2007-07-17 15:46:25.000000000 -0400 @@ -159,6 +159,10 @@ dbus_connect_system_bus(dhcpc_t) dbus_send_system_bus(dhcpc_t) @@ -9477,9 +9776,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet term_dontaudit_use_all_user_ttys(ifconfig_t) term_dontaudit_use_all_user_ptys(ifconfig_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.0.2/policy/modules/system/udev.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.te serefpolicy-3.0.3/policy/modules/system/udev.te --- nsaserefpolicy/policy/modules/system/udev.te 2007-05-30 11:47:29.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/udev.te 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/udev.te 2007-07-17 15:46:25.000000000 -0400 @@ -68,8 +68,9 @@ allow udev_t udev_tbl_t:file manage_file_perms; dev_filetrans(udev_t,udev_tbl_t,file) @@ -9579,9 +9878,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t ') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.2/policy/modules/system/unconfined.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.3/policy/modules/system/unconfined.if --- nsaserefpolicy/policy/modules/system/unconfined.if 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/unconfined.if 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/unconfined.if 2007-07-17 15:46:25.000000000 -0400 @@ -12,14 +12,13 @@ # interface(`unconfined_domain_noaudit',` @@ -9765,10 +10064,10 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf + + allow $1 unconfined_terminal:chr_file rw_term_perms; +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.2/policy/modules/system/unconfined.te ---- nsaserefpolicy/policy/modules/system/unconfined.te 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/unconfined.te 2007-07-16 11:53:43.000000000 -0400 -@@ -5,30 +5,36 @@ +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.0.3/policy/modules/system/unconfined.te +--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-07-17 14:52:27.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/unconfined.te 2007-07-17 15:46:25.000000000 -0400 +@@ -5,28 +5,36 @@ # # Declarations # @@ -9799,9 +10098,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf init_system_domain(unconfined_execmem_t,unconfined_execmem_exec_t) role unconfined_r types unconfined_execmem_t; --gen_user(unconfined_u, unconfined, unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats) +unconfined_domain(unconfined_t) - ++ ######################################## # # Local policy @@ -9813,7 +10111,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf domtrans_pattern(unconfined_t,unconfined_execmem_exec_t,unconfined_execmem_t) files_create_boot_flag(unconfined_t) -@@ -37,6 +43,7 @@ +@@ -35,6 +43,7 @@ mcs_ptrace_all(unconfined_t) init_run_daemon(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) @@ -9821,7 +10119,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf libs_run_ldconfig(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) -@@ -44,23 +51,22 @@ +@@ -42,23 +51,22 @@ logging_run_auditctl(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) mount_run_unconfined(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) @@ -9850,7 +10148,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` -@@ -68,16 +74,6 @@ +@@ -66,16 +74,6 @@ ') optional_policy(` @@ -9867,7 +10165,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf init_dbus_chat_script(unconfined_t) dbus_stub(unconfined_t) -@@ -120,11 +116,7 @@ +@@ -118,11 +116,7 @@ ') optional_policy(` @@ -9880,7 +10178,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` -@@ -136,11 +128,7 @@ +@@ -134,11 +128,7 @@ ') optional_policy(` @@ -9893,7 +10191,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` -@@ -157,22 +145,12 @@ +@@ -155,22 +145,12 @@ optional_policy(` postfix_run_map(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) @@ -9918,7 +10216,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` -@@ -182,10 +160,6 @@ +@@ -180,10 +160,6 @@ ') optional_policy(` @@ -9929,7 +10227,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf sysnet_run_dhcpc(unconfined_t,unconfined_r,{ unconfined_devpts_t unconfined_tty_device_t }) sysnet_dbus_chat_dhcpc(unconfined_t) ') -@@ -207,7 +181,7 @@ +@@ -205,11 +181,12 @@ ') optional_policy(` @@ -9938,7 +10236,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf ') optional_policy(` -@@ -229,6 +203,12 @@ + xserver_domtrans_xdm_xserver(unconfined_t) ++ xserver_xdm_rw_shm(unconfined_t) + ') + + ######################################## +@@ -227,6 +204,17 @@ unconfined_dbus_chat(unconfined_execmem_t) optional_policy(` @@ -9948,12 +10251,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf + optional_policy(` hal_dbus_chat(unconfined_execmem_t) ') ++ ++ optional_policy(` ++ xserver_xdm_rw_shm(unconfined_execmem_t) ++ ++ ') ') + +corecmd_exec_all_executables(unconfined_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.2/policy/modules/system/userdomain.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.if serefpolicy-3.0.3/policy/modules/system/userdomain.if --- nsaserefpolicy/policy/modules/system/userdomain.if 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/userdomain.if 2007-07-13 13:30:47.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/userdomain.if 2007-07-17 15:46:25.000000000 -0400 @@ -29,90 +29,99 @@ ') @@ -10358,6 +10666,17 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo - allow $1_t self:udp_socket create_socket_perms; + allow $1_usertype self:tcp_socket create_stream_socket_perms; + allow $1_usertype self:udp_socket create_socket_perms; ++ ++ corenet_all_recvfrom_unlabeled($1_usertype) ++ corenet_all_recvfrom_netlabel($1_usertype) ++ corenet_tcp_sendrecv_all_if($1_usertype) ++ corenet_udp_sendrecv_all_if($1_usertype) ++ corenet_tcp_sendrecv_all_nodes($1_usertype) ++ corenet_udp_sendrecv_all_nodes($1_usertype) ++ corenet_tcp_sendrecv_all_ports($1_usertype) ++ corenet_udp_sendrecv_all_ports($1_usertype) ++ corenet_tcp_connect_all_ports($1_usertype) ++ corenet_sendrecv_all_client_packets($1_usertype) - corenet_all_recvfrom_unlabeled($1_t) - corenet_all_recvfrom_netlabel($1_t) @@ -10369,17 +10688,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo - corenet_udp_sendrecv_all_ports($1_t) - corenet_tcp_connect_all_ports($1_t) - corenet_sendrecv_all_client_packets($1_t) -+ corenet_all_recvfrom_unlabeled($1_usertype) -+ corenet_all_recvfrom_netlabel($1_usertype) -+ corenet_tcp_sendrecv_all_if($1_usertype) -+ corenet_udp_sendrecv_all_if($1_usertype) -+ corenet_tcp_sendrecv_all_nodes($1_usertype) -+ corenet_udp_sendrecv_all_nodes($1_usertype) -+ corenet_tcp_sendrecv_all_ports($1_usertype) -+ corenet_udp_sendrecv_all_ports($1_usertype) -+ corenet_tcp_connect_all_ports($1_usertype) -+ corenet_sendrecv_all_client_packets($1_usertype) -+ + ifdef(`enable_mls',` + # netlabel/CIPSO labeled networking + corenet_tcp_recv_netlabel($1_usertype) @@ -10511,16 +10819,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo - dev_read_sound($1_t) - dev_read_sound_mixer($1_t) - dev_write_sound_mixer($1_t) +- +- domain_use_interactive_fds($1_t) +- # Command completion can fire hundreds of denials +- domain_dontaudit_exec_all_entry_files($1_t) + dev_read_rand($1_usertype) + dev_write_sound($1_usertype) + dev_read_sound($1_usertype) + dev_read_sound_mixer($1_usertype) + dev_write_sound_mixer($1_usertype) -- domain_use_interactive_fds($1_t) -- # Command completion can fire hundreds of denials -- domain_dontaudit_exec_all_entry_files($1_t) -- - files_exec_etc_files($1_t) - files_search_locks($1_t) + files_exec_etc_files($1_usertype) @@ -10577,12 +10885,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo - # Stop warnings about access to /dev/console - init_dontaudit_use_fds($1_t) - init_dontaudit_use_script_fds($1_t) -- ++ storage_getattr_fixed_disk_dev($1_usertype) + - libs_exec_lib_files($1_t) - - logging_dontaudit_getattr_all_logs($1_t) -+ storage_getattr_fixed_disk_dev($1_usertype) - +- - miscfiles_read_man_pages($1_t) - # for running TeX programs - miscfiles_read_tetex_data($1_t) @@ -10647,41 +10955,41 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo optional_policy(` # Allow graphical boot to check battery lifespan - apm_stream_connect($1_t) -- ') -- -- optional_policy(` -- canna_stream_connect($1_t) + apm_stream_connect($1_usertype) ') optional_policy(` -- cups_stream_connect($1_t) -- cups_stream_connect_ptal($1_t) +- canna_stream_connect($1_t) + canna_stream_connect($1_usertype) ') optional_policy(` +- cups_stream_connect($1_t) +- cups_stream_connect_ptal($1_t) +- ') +- +- optional_policy(` - allow $1_t self:dbus send_msg; - dbus_system_bus_client_template($1,$1_t) -- -- optional_policy(` -- bluetooth_dbus_chat($1_t) -- ') -- -- optional_policy(` -- evolution_dbus_chat($1,$1_t) -- evolution_alarm_dbus_chat($1,$1_t) -- ') + allow $1_usertype self:dbus send_msg; + dbus_system_bus_client_template($1,$1_usertype) optional_policy(` -- cups_dbus_chat_config($1_t) +- bluetooth_dbus_chat($1_t) + evolution_dbus_chat($1,$1_usertype) + evolution_alarm_dbus_chat($1,$1_usertype) ') - optional_policy(` +- evolution_dbus_chat($1,$1_t) +- evolution_alarm_dbus_chat($1,$1_t) +- ') +- +- optional_policy(` +- cups_dbus_chat_config($1_t) +- ') +- +- optional_policy(` - hal_dbus_chat($1_t) - ') - @@ -10714,14 +11022,14 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo # for running depmod as part of the kernel packaging process optional_policy(` - modutils_read_module_config($1_t) -- ') -- -- optional_policy(` -- mta_rw_spool($1_t) + modutils_read_module_config($1_usertype) ') optional_policy(` +- mta_rw_spool($1_t) +- ') +- +- optional_policy(` - nis_use_ypbind($1_t) + mta_rw_spool($1_usertype) ') @@ -10780,11 +11088,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo - rpc_dontaudit_getattr_exports($1_t) - rpc_manage_nfs_rw_content($1_t) + slrnpull_search_spool($1_usertype) - ') - - optional_policy(` -- rpm_read_db($1_t) -- rpm_dontaudit_manage_db($1_t) ++ ') ++ ++ optional_policy(` + usernetctl_run($1_usertype,$1_r,{ $1_devpts_t $1_tty_device_t }) + ') +') @@ -10913,22 +11219,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + userdom_poly_tmp_template($1) + optional_policy(` -- samba_stream_connect_winbind($1_t) +- rpm_read_db($1_t) +- rpm_dontaudit_manage_db($1_t) + cups_stream_connect($1_usertype) + cups_stream_connect_ptal($1_usertype) ') optional_policy(` -- slrnpull_search_spool($1_t) +- samba_stream_connect_winbind($1_t) + kerberos_use($1_usertype) ') optional_policy(` -- usernetctl_run($1_t,$1_r,{ $1_devpts_t $1_tty_device_t }) +- slrnpull_search_spool($1_t) + quota_dontaudit_getattr_db($1_usertype) -+ ') -+ -+ optional_policy(` + ') + + optional_policy(` +- usernetctl_run($1_t,$1_r,{ $1_devpts_t $1_tty_device_t }) + rpm_read_db($1_usertype) + rpm_dontaudit_manage_db($1_usertype) ') @@ -10969,7 +11277,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo domain_interactive_fd($1_t) typeattribute $1_devpts_t user_ptynode; -@@ -985,86 +1038,97 @@ +@@ -985,36 +1038,66 @@ typeattribute $1_tmp_t user_tmpfile; typeattribute $1_tty_device_t user_ttynode; @@ -11050,15 +11358,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ') - tunable_policy(`user_dmesg',` -- kernel_read_ring_buffer($1_t) -+ kernel_read_ring_buffer($1_usertype) - ',` -- kernel_dontaudit_read_ring_buffer($1_t) -+ kernel_dontaudit_read_ring_buffer($1_usertype) - ') - - # Allow users to run TCP servers (bind to ports and accept connection from +@@ -1028,16 +1111,8 @@ # the same domain and outside users) disabling this forces FTP passive mode # and may change other protocols tunable_policy(`user_tcp_server',` @@ -11077,21 +11377,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') optional_policy(` -- netutils_run_ping_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) -- netutils_run_traceroute_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) -+ netutils_run_ping_cond($1_usertype,$1_r,{ $1_tty_device_t $1_devpts_t }) -+ netutils_run_traceroute_cond($1_usertype,$1_r,{ $1_tty_device_t $1_devpts_t }) - ') - - # Run pppd in pppd_t by default for user - optional_policy(` -- ppp_run_cond($1_t,$1_r,{ $1_tty_device_t $1_devpts_t }) -+ ppp_run_cond($1_usertype,$1_r,{ $1_tty_device_t $1_devpts_t }) - ') - - optional_policy(` -- setroubleshoot_stream_connect($1_t) -+ setroubleshoot_stream_connect($1_usertype) +@@ -1054,17 +1129,6 @@ + setroubleshoot_stream_connect($1_t) ') - ifdef(`TODO',` @@ -11135,7 +11422,49 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo kernel_read_software_raid_state($1_t) kernel_getattr_core_if($1_t) kernel_getattr_message_if($1_t) -@@ -3078,7 +3142,7 @@ +@@ -1902,6 +1966,41 @@ + + ######################################## + ## ++## dontaudit attemps to Create files ++## in a user home subdirectory. ++## ++## ++##

++## Create, read, write, and delete directories ++## in a user home subdirectory. ++##

++##

++## This is a templated interface, and should only ++## be called from a per-userdomain template. ++##

++## ++## ++## ++## The prefix of the user domain (e.g., user ++## is the prefix for user_t). ++## ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++template(`userdom_dontaudit_create_user_home_content_files',` ++ gen_require(` ++ type $1_home_dir_t; ++ ') ++ ++ dontaudit $2 $1_home_dir_t:file create; ++') ++ ++######################################## ++## + ## Do not audit attempts to set the + ## attributes of user home files. + ## +@@ -3078,7 +3177,7 @@ # template(`userdom_tmp_filetrans_user_tmp',` gen_require(` @@ -11144,7 +11473,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') files_tmp_filetrans($2,$1_tmp_t,$3) -@@ -5323,7 +5387,7 @@ +@@ -5323,7 +5422,7 @@ attribute user_tmpfile; ') @@ -11153,7 +11482,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ') ######################################## -@@ -5548,6 +5612,26 @@ +@@ -5548,6 +5647,26 @@ ######################################## ## @@ -11180,7 +11509,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo ## Unconfined access to user domains. (Deprecated) ## ## -@@ -5559,3 +5643,183 @@ +@@ -5559,3 +5678,191 @@ interface(`userdom_unconfined',` refpolicywarn(`$0($*) has been deprecated.') ') @@ -11338,6 +11667,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo + +authlogin_per_role_template($1, $1_t, $1_r) + ++dev_read_sound($1_usertype) ++dev_write_sound($1_usertype) ++ +optional_policy(` + dbus_per_role_template($1, $1_usertype, $1_r) + dbus_system_bus_client_template($1, $1_usertype) @@ -11345,6 +11677,11 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo +') + +optional_policy(` ++ gnome_per_role_template($1, $1_usertype, $1_r) ++ gnome_exec_gconf($1_t) ++') ++ ++optional_policy(` + java_per_role_template($1, $1_t, $1_r) +') + @@ -11364,9 +11701,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo +dev_dontaudit_read_rand($1_usertype) + +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.2/policy/modules/system/userdomain.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdomain.te serefpolicy-3.0.3/policy/modules/system/userdomain.te --- nsaserefpolicy/policy/modules/system/userdomain.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/userdomain.te 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/userdomain.te 2007-07-17 15:46:25.000000000 -0400 @@ -74,6 +74,9 @@ # users home directory contents attribute home_type; @@ -11464,9 +11801,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo +tunable_policy(`allow_console_login', ` + term_use_console(userdomain) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.0.2/policy/modules/system/xen.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if serefpolicy-3.0.3/policy/modules/system/xen.if --- nsaserefpolicy/policy/modules/system/xen.if 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/xen.if 2007-07-14 08:55:44.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/xen.if 2007-07-19 08:59:44.000000000 -0400 @@ -191,3 +191,24 @@ domtrans_pattern($1,xm_exec_t,xm_t) @@ -11492,9 +11829,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.if + allow $1 xend_var_lib_t:dir search_dir_perms; + rw_files_pattern($1,xen_image_t,xen_image_t) +') -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.0.2/policy/modules/system/xen.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te serefpolicy-3.0.3/policy/modules/system/xen.te --- nsaserefpolicy/policy/modules/system/xen.te 2007-07-03 07:06:32.000000000 -0400 -+++ serefpolicy-3.0.2/policy/modules/system/xen.te 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/system/xen.te 2007-07-18 16:21:11.000000000 -0400 @@ -176,6 +176,7 @@ files_manage_etc_runtime_files(xend_t) files_etc_filetrans_etc_runtime(xend_t,file) @@ -11512,7 +11849,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te xen_stream_connect_xenstore(xenconsoled_t) ######################################## -@@ -366,3 +367,13 @@ +@@ -336,6 +337,7 @@ + kernel_write_xen_state(xm_t) + + corecmd_exec_bin(xm_t) ++corecmd_exec_shell(xm_t) + + corenet_tcp_sendrecv_generic_if(xm_t) + corenet_tcp_sendrecv_all_nodes(xm_t) +@@ -366,3 +368,13 @@ xen_append_log(xm_t) xen_stream_connect(xm_t) xen_stream_connect_xenstore(xm_t) @@ -11526,38 +11871,38 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/xen.te +fs_write_nfs_files(xend_t) +fs_read_nfs_files(xend_t) +fs_read_nfs_symlinks(xend_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.0.2/policy/modules/users/guest.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.fc serefpolicy-3.0.3/policy/modules/users/guest.fc --- nsaserefpolicy/policy/modules/users/guest.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/users/guest.fc 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/users/guest.fc 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1 @@ +# No guest file contexts. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.0.2/policy/modules/users/guest.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.if serefpolicy-3.0.3/policy/modules/users/guest.if --- nsaserefpolicy/policy/modules/users/guest.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/users/guest.if 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/users/guest.if 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1 @@ +## Policy for guest user -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.0.2/policy/modules/users/guest.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/guest.te serefpolicy-3.0.3/policy/modules/users/guest.te --- nsaserefpolicy/policy/modules/users/guest.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/users/guest.te 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/users/guest.te 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,5 @@ +policy_module(guest,1.0.0) +userdom_unpriv_login_user(guest) +userdom_unpriv_login_user(gadmin) +userdom_unpriv_xwindows_login_user(xguest) +mozilla_per_role_template(xguest, xguest_t, xguest_r) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.0.2/policy/modules/users/logadm.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.fc serefpolicy-3.0.3/policy/modules/users/logadm.fc --- nsaserefpolicy/policy/modules/users/logadm.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/users/logadm.fc 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/users/logadm.fc 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1 @@ +# No logadm file contexts. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.0.2/policy/modules/users/logadm.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.if serefpolicy-3.0.3/policy/modules/users/logadm.if --- nsaserefpolicy/policy/modules/users/logadm.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/users/logadm.if 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/users/logadm.if 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1 @@ +## Policy for logadm user -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.0.2/policy/modules/users/logadm.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm.te serefpolicy-3.0.3/policy/modules/users/logadm.te --- nsaserefpolicy/policy/modules/users/logadm.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/users/logadm.te 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/users/logadm.te 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,33 @@ +policy_module(logadm,1.0.0) + @@ -11592,24 +11937,24 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/logadm. + +files_dontaudit_search_all_dirs(logadm_t) +files_dontaudit_getattr_all_files(logadm_t) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.0.2/policy/modules/users/metadata.xml +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/metadata.xml serefpolicy-3.0.3/policy/modules/users/metadata.xml --- nsaserefpolicy/policy/modules/users/metadata.xml 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/users/metadata.xml 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/users/metadata.xml 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1 @@ +Policy modules for users -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.0.2/policy/modules/users/webadm.fc +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.fc serefpolicy-3.0.3/policy/modules/users/webadm.fc --- nsaserefpolicy/policy/modules/users/webadm.fc 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/users/webadm.fc 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/users/webadm.fc 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1 @@ +# No webadm file contexts. -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.0.2/policy/modules/users/webadm.if +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.if serefpolicy-3.0.3/policy/modules/users/webadm.if --- nsaserefpolicy/policy/modules/users/webadm.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/users/webadm.if 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/users/webadm.if 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1 @@ +## Policy for webadm user -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.2/policy/modules/users/webadm.te +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm.te serefpolicy-3.0.3/policy/modules/users/webadm.te --- nsaserefpolicy/policy/modules/users/webadm.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.0.2/policy/modules/users/webadm.te 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/modules/users/webadm.te 2007-07-17 15:46:25.000000000 -0400 @@ -0,0 +1,70 @@ +policy_module(webadm,1.0.0) + @@ -11681,9 +12026,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/webadm. +allow webadm_t gadmin_t:dir getattr; + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.0.2/policy/support/obj_perm_sets.spt +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets.spt serefpolicy-3.0.3/policy/support/obj_perm_sets.spt --- nsaserefpolicy/policy/support/obj_perm_sets.spt 2007-05-29 14:10:59.000000000 -0400 -+++ serefpolicy-3.0.2/policy/support/obj_perm_sets.spt 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/policy/support/obj_perm_sets.spt 2007-07-17 15:46:25.000000000 -0400 @@ -201,7 +201,7 @@ define(`search_dir_perms',`{ getattr search }') define(`list_dir_perms',`{ getattr search read lock ioctl }') @@ -11716,9 +12061,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/support/obj_perm_sets +define(`all_association', `{ sendto recvfrom setcontext polmatch } ') + + -diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0.2/policy/users ---- nsaserefpolicy/policy/users 2007-05-31 15:36:08.000000000 -0400 -+++ serefpolicy-3.0.2/policy/users 2007-07-13 08:07:54.000000000 -0400 +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0.3/policy/users +--- nsaserefpolicy/policy/users 2007-07-17 14:52:27.000000000 -0400 ++++ serefpolicy-3.0.3/policy/users 2007-07-17 15:46:25.000000000 -0400 @@ -16,7 +16,7 @@ # and a user process should never be assigned the system user # identity. @@ -11728,7 +12073,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0 # # user_u is a generic user identity for Linux users who have no -@@ -25,7 +25,7 @@ +@@ -25,13 +25,10 @@ # SELinux user identity for a Linux user. If you do not want to # permit any access to such users, then remove this entry. # @@ -11737,7 +12082,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0 gen_user(staff_u, staff, staff_r sysadm_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats) gen_user(sysadm_u, sysadm, sysadm_r, s0, s0 - mls_systemhigh, mcs_allcats) -@@ -36,8 +36,4 @@ +-# Until order dependence is fixed for users: +-gen_user(unconfined_u, unconfined, unconfined_r, s0, s0 - mls_systemhigh, mcs_allcats) +- + # + # The following users correspond to Unix identities. + # These identities are typically assigned as the user attribute +@@ -39,8 +36,4 @@ # role should use the staff_r role instead of the user_r role when # not in the sysadm_r. # @@ -11747,9 +12098,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/users serefpolicy-3.0 - gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r'), s0, s0 - mls_systemhigh, mcs_allcats) -') +gen_user(root, sysadm, sysadm_r staff_r ifdef(`enable_mls',`secadm_r auditadm_r') system_r, s0, s0 - mls_systemhigh, mcs_allcats) -diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.2/Rules.modular +diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3.0.3/Rules.modular --- nsaserefpolicy/Rules.modular 2007-05-25 09:09:10.000000000 -0400 -+++ serefpolicy-3.0.2/Rules.modular 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/Rules.modular 2007-07-17 15:46:25.000000000 -0400 @@ -167,7 +167,7 @@ # these have to run individually because order matters: $(verbose) $(GREP) '^sid ' $(tmpdir)/all_te_files.conf >> $(tmpdir)/all_post.conf || true @@ -11776,9 +12127,9 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/Rules.modular serefpolicy-3. # Clean the sources # clean: -diff --exclude-from=exclude -N -u -r nsaserefpolicy/support/Makefile.devel serefpolicy-3.0.2/support/Makefile.devel +diff --exclude-from=exclude -N -u -r nsaserefpolicy/support/Makefile.devel serefpolicy-3.0.3/support/Makefile.devel --- nsaserefpolicy/support/Makefile.devel 2007-05-29 13:53:56.000000000 -0400 -+++ serefpolicy-3.0.2/support/Makefile.devel 2007-07-13 08:07:54.000000000 -0400 ++++ serefpolicy-3.0.3/support/Makefile.devel 2007-07-17 15:46:25.000000000 -0400 @@ -24,7 +24,7 @@ XMLLINT := $(BINDIR)/xmllint