From 939a4287b3f082e1b27cc4fece4e50a34455e3e6 Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Aug 07 2007 17:06:32 +0000 Subject: trunk: 3 patches from dan --- diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc index 108106a..4395563 100644 --- a/policy/modules/kernel/corecommands.fc +++ b/policy/modules/kernel/corecommands.fc @@ -130,8 +130,11 @@ ifdef(`distro_gentoo',` /usr/lib(64)?/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:bin_t,s0) /usr/lib(64)?/apt/methods.+ -- gen_context(system_u:object_r:bin_t,s0) /usr/lib(64)?/courier(/.*)? gen_context(system_u:object_r:bin_t,s0) +/usr/lib(64)?/cups/backend(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib(64)?/cups/cgi-bin/.* -- gen_context(system_u:object_r:bin_t,s0) -/usr/lib(64)?/cups/filter/.* -- gen_context(system_u:object_r:bin_t,s0) +/usr/lib(64)?/cups/daemon(/.*)? gen_context(system_u:object_r:bin_t,s0) +/usr/lib(64)?/cups/filter(/.*)? gen_context(system_u:object_r:bin_t,s0) + /usr/lib(64)?/cyrus-imapd/.* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib(64)?/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0) /usr/lib(64)?/emacsen-common/.* gen_context(system_u:object_r:bin_t,s0) @@ -164,6 +167,7 @@ ifdef(`distro_gentoo',` /usr/libexec/openssh/sftp-server -- gen_context(system_u:object_r:bin_t,s0) /usr/local/lib(64)?/ipsec/.* -- gen_context(system_u:object_r:bin_t,s0) +/usr/local/Brother/lpd(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/sbin/sesh -- gen_context(system_u:object_r:shell_exec_t,s0) @@ -221,6 +225,7 @@ ifdef(`distro_redhat', ` /usr/share/system-config-network/neat-control\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-nfs/nfs-export\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-nfs/system-config-nfs\.py -- gen_context(system_u:object_r:bin_t,s0) +/usr/share/system-config-printer/applet\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-rootpassword/system-config-rootpassword -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-samba/system-config-samba\.py -- gen_context(system_u:object_r:bin_t,s0) /usr/share/system-config-securitylevel/system-config-securitylevel\.py -- gen_context(system_u:object_r:bin_t,s0) diff --git a/policy/modules/kernel/corecommands.te b/policy/modules/kernel/corecommands.te index 6f812d1..46d6da5 100644 --- a/policy/modules/kernel/corecommands.te +++ b/policy/modules/kernel/corecommands.te @@ -1,5 +1,5 @@ -policy_module(corecommands,1.7.0) +policy_module(corecommands,1.7.1) ######################################## # diff --git a/policy/modules/kernel/kernel.if b/policy/modules/kernel/kernel.if index 2b96253..bb31b3d 100644 --- a/policy/modules/kernel/kernel.if +++ b/policy/modules/kernel/kernel.if @@ -108,6 +108,24 @@ interface(`kernel_setpgid',` ######################################## ## +## Set the priority of kernel threads. +## +## +## +## Domain allowed access. +## +## +# +interface(`kernel_setsched',` + gen_require(` + type kernel_t; + ') + + allow $1 kernel_t:process setsched; +') + +######################################## +## ## Send a SIGCHLD signal to kernel threads. ## ## diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te index 3e52215..5312cf0 100644 --- a/policy/modules/kernel/kernel.te +++ b/policy/modules/kernel/kernel.te @@ -1,5 +1,5 @@ -policy_module(kernel,1.7.0) +policy_module(kernel,1.7.1) ######################################## # diff --git a/policy/modules/kernel/storage.fc b/policy/modules/kernel/storage.fc index 8e0d100..d414357 100644 --- a/policy/modules/kernel/storage.fc +++ b/policy/modules/kernel/storage.fc @@ -23,6 +23,7 @@ /dev/loop.* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/lvm -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/mcdx? -b gen_context(system_u:object_r:removable_device_t,s0) +/dev/megadev.* -c gen_context(system_u:object_r:removable_device_t,s0) /dev/mmcblk.* -b gen_context(system_u:object_r:removable_device_t,s0) /dev/nb[^/]+ -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/optcd -b gen_context(system_u:object_r:removable_device_t,s0) diff --git a/policy/modules/kernel/storage.if b/policy/modules/kernel/storage.if index 8781fe6..b8721b2 100644 --- a/policy/modules/kernel/storage.if +++ b/policy/modules/kernel/storage.if @@ -100,6 +100,7 @@ interface(`storage_raw_read_fixed_disk',` dev_list_all_dev_nodes($1) allow $1 fixed_disk_device_t:blk_file read_blk_file_perms; + allow $1 fixed_disk_device_t:chr_file read_chr_file_perms; typeattribute $1 fixed_disk_raw_read; ') @@ -144,6 +145,7 @@ interface(`storage_raw_write_fixed_disk',` dev_list_all_dev_nodes($1) allow $1 fixed_disk_device_t:blk_file write_blk_file_perms; + allow $1 fixed_disk_device_t:chr_file write_chr_file_perms; typeattribute $1 fixed_disk_raw_write; ') diff --git a/policy/modules/kernel/storage.te b/policy/modules/kernel/storage.te index 99e7732..b9a916b 100644 --- a/policy/modules/kernel/storage.te +++ b/policy/modules/kernel/storage.te @@ -1,5 +1,5 @@ -policy_module(storage,1.3.0) +policy_module(storage,1.3.1) ######################################## #