From e54cc7c3e4573867c847af219d1a7f092c94cb80 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Dec 16 2009 23:01:00 +0000 Subject: - Fixes for abrt calls --- diff --git a/policy-F13.patch b/policy-F13.patch index 9850836..89081b0 100644 --- a/policy-F13.patch +++ b/policy-F13.patch @@ -2767,7 +2767,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/gnome.te serefpolicy-3.7.4/policy/modules/apps/gnome.te --- nsaserefpolicy/policy/modules/apps/gnome.te 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.7.4/policy/modules/apps/gnome.te 2009-12-15 14:56:49.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/apps/gnome.te 2009-12-16 16:57:25.000000000 -0500 @@ -7,18 +7,30 @@ # @@ -2801,8 +2801,12 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol files_tmp_file(gconf_tmp_t) ubac_constrained(gconf_tmp_t) -@@ -32,8 +44,17 @@ - type gnome_home_t; +@@ -29,11 +41,20 @@ + application_domain(gconfd_t, gconfd_exec_t) + ubac_constrained(gconfd_t) + +-type gnome_home_t; ++type gnome_home_t, gnome_home_type; typealias gnome_home_t alias { user_gnome_home_t staff_gnome_home_t sysadm_gnome_home_t }; typealias gnome_home_t alias { auditadm_gnome_home_t secadm_gnome_home_t }; +typealias gnome_home_t alias unconfined_gnome_home_t; @@ -4969,8 +4973,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +# No types are sandbox_exec_t diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.if serefpolicy-3.7.4/policy/modules/apps/sandbox.if --- nsaserefpolicy/policy/modules/apps/sandbox.if 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/apps/sandbox.if 2009-12-15 14:56:49.000000000 -0500 -@@ -0,0 +1,188 @@ ++++ serefpolicy-3.7.4/policy/modules/apps/sandbox.if 2009-12-16 16:50:01.000000000 -0500 +@@ -0,0 +1,190 @@ + +## policy for sandbox + @@ -5018,9 +5022,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + allow sandbox_x_domain $1:process { sigchld signal }; + allow sandbox_x_domain sandbox_x_domain:process signal; + # Dontaudit leaked file descriptors -+ dontaudit sandbox_x_domain $1:fifo_file rw_fifo_file_perms; ++ dontaudit sandbox_x_domain $1:fifo_file { read write }; + dontaudit sandbox_x_domain $1:tcp_socket rw_socket_perms; + dontaudit sandbox_x_domain $1:udp_socket rw_socket_perms; ++ dontaudit sandbox_x_domain $1:unix_stream_socket { read write }; + + manage_files_pattern($1, sandbox_file_type, sandbox_file_type); + manage_dirs_pattern($1, sandbox_file_type, sandbox_file_type); @@ -5104,6 +5109,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + type $1_client_tmpfs_t; + files_tmpfs_file($1_client_tmpfs_t) + ++ term_search_ptys($1_t) + allow $1_client_t sandbox_devpts_t:chr_file { rw_term_perms setattr }; + term_create_pty($1_client_t,sandbox_devpts_t) + @@ -5161,8 +5167,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/sandbox.te serefpolicy-3.7.4/policy/modules/apps/sandbox.te --- nsaserefpolicy/policy/modules/apps/sandbox.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/apps/sandbox.te 2009-12-15 14:56:49.000000000 -0500 -@@ -0,0 +1,331 @@ ++++ serefpolicy-3.7.4/policy/modules/apps/sandbox.te 2009-12-16 17:45:36.000000000 -0500 +@@ -0,0 +1,336 @@ +policy_module(sandbox,1.0.0) +dbus_stub() +attribute sandbox_domain; @@ -5195,6 +5201,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +# +# sandbox xserver policy +# ++allow sandbox_xserver_t self:process execmem; +allow sandbox_xserver_t self:fifo_file manage_fifo_file_perms; +allow sandbox_xserver_t self:shm create_shm_perms; +allow sandbox_xserver_t self:tcp_socket create_stream_socket_perms; @@ -5222,6 +5229,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +corenet_sendrecv_xserver_server_packets(sandbox_xserver_t) +corenet_sendrecv_all_client_packets(sandbox_xserver_t) + ++dev_rwx_zero(sandbox_xserver_t) ++ +files_read_etc_files(sandbox_xserver_t) +files_read_usr_files(sandbox_xserver_t) +files_search_home(sandbox_xserver_t) @@ -5242,6 +5251,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +logging_send_syslog_msg(sandbox_xserver_t) +logging_send_audit_msgs(sandbox_xserver_t) + ++userdom_read_user_home_content_symlinks(sandbox_xserver_t) +userdom_use_user_terminals(sandbox_xserver_t) + +xserver_entry_type(sandbox_xserver_t) @@ -5322,7 +5332,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + +auth_dontaudit_read_login_records(sandbox_x_domain) +auth_dontaudit_write_login_records(sandbox_x_domain) -+auth_use_nsswitch(sandbox_x_domain) ++#auth_use_nsswitch(sandbox_x_domain) +auth_search_pam_console_data(sandbox_x_domain) + +init_read_utmp(sandbox_x_domain) @@ -5349,6 +5359,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') + +userdom_dontaudit_use_user_terminals(sandbox_x_domain) ++userdom_read_user_home_content_symlinks(sandbox_x_domain) + +#============= sandbox_x_t ============== +files_search_home(sandbox_x_t) @@ -5367,7 +5378,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + +corenet_tcp_connect_ipp_port(sandbox_x_client_t) + -+auth_use_nsswitch(sandbox_x_client_t) ++#auth_use_nsswitch(sandbox_x_client_t) + +dbus_system_bus_client(sandbox_x_client_t) +dbus_read_config(sandbox_x_client_t) @@ -5425,7 +5436,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +corenet_dontaudit_tcp_bind_generic_port(sandbox_web_client_t) +corenet_tcp_connect_speech_port(sandbox_web_client_t) + -+auth_use_nsswitch(sandbox_web_client_t) ++#auth_use_nsswitch(sandbox_web_client_t) + +dbus_system_bus_client(sandbox_web_client_t) +dbus_read_config(sandbox_web_client_t) @@ -5468,7 +5479,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +corenet_tcp_connect_all_ports(sandbox_net_client_t) +corenet_sendrecv_all_client_packets(sandbox_net_client_t) + -+auth_use_nsswitch(sandbox_net_client_t) ++#auth_use_nsswitch(sandbox_net_client_t) + +dbus_system_bus_client(sandbox_net_client_t) +dbus_read_config(sandbox_net_client_t) @@ -6496,7 +6507,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +') diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/domain.te serefpolicy-3.7.4/policy/modules/kernel/domain.te --- nsaserefpolicy/policy/modules/kernel/domain.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.4/policy/modules/kernel/domain.te 2009-12-15 14:56:49.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/kernel/domain.te 2009-12-16 16:43:03.000000000 -0500 @@ -5,6 +5,13 @@ # # Declarations @@ -6567,7 +6578,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # Act upon any other process. allow unconfined_domain_type domain:process ~{ transition dyntransition execmem execstack execheap }; -@@ -153,3 +174,71 @@ +@@ -153,3 +174,73 @@ # receive from all domains over labeled networking domain_all_recvfrom_all_domains(unconfined_domain_type) @@ -6592,8 +6603,10 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +# these seem questionable: + +optional_policy(` -+ abrt_signull(domain) + abrt_domtrans_helper(domain) ++ abrt_read_pid_files(domain) ++ abrt_read_state(domain) ++ abrt_signull(domain) +') + +optional_policy(` @@ -7518,7 +7531,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ######################################## diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/terminal.if serefpolicy-3.7.4/policy/modules/kernel/terminal.if --- nsaserefpolicy/policy/modules/kernel/terminal.if 2009-11-25 11:47:19.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/kernel/terminal.if 2009-12-15 14:56:49.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/kernel/terminal.if 2009-12-16 11:17:07.000000000 -0500 @@ -273,9 +273,11 @@ interface(`term_dontaudit_use_console',` gen_require(` @@ -9530,7 +9543,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol +/var/run/abrt(/.*)? gen_context(system_u:object_r:abrt_var_run_t,s0) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/abrt.if serefpolicy-3.7.4/policy/modules/services/abrt.if --- nsaserefpolicy/policy/modules/services/abrt.if 2009-09-16 09:09:20.000000000 -0400 -+++ serefpolicy-3.7.4/policy/modules/services/abrt.if 2009-12-15 14:56:49.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/services/abrt.if 2009-12-16 16:47:43.000000000 -0500 @@ -19,6 +19,24 @@ domtrans_pattern($1, abrt_exec_t, abrt_t) ') @@ -9589,10 +9602,47 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ###################################### ## ## Read abrt logs. -@@ -75,6 +119,64 @@ +@@ -75,6 +119,101 @@ read_files_pattern($1, abrt_var_log_t, abrt_var_log_t) ') ++###################################### ++## ++## Read abrt PID files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`abrt_read_pid_files',` ++ gen_require(` ++ type abrt_var_run_t; ++ ') ++ ++ files_search_pids($1) ++ read_files_pattern($1, abrt_var_run_t, abrt_var_run_t) ++') ++ ++######################################## ++## ++## Allow the domain to read abrt state files in /proc. ++## ++## ++## ++## Domain to allow access. ++## ++## ++# ++interface(`abrt_read_state',` ++ gen_require(` ++ type abrt_t; ++ ') ++ ++ ps_process_pattern($1, abrt_t) ++') ++ +######################################## +## +## Send and receive messages from @@ -11910,7 +11960,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/avahi.te serefpolicy-3.7.4/policy/modules/services/avahi.te --- nsaserefpolicy/policy/modules/services/avahi.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.4/policy/modules/services/avahi.te 2009-12-15 14:56:49.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/services/avahi.te 2009-12-16 13:33:02.000000000 -0500 @@ -24,7 +24,7 @@ # Local policy # @@ -11928,8 +11978,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol manage_dirs_pattern(avahi_t, avahi_var_lib_t, avahi_var_lib_t) manage_files_pattern(avahi_t, avahi_var_lib_t, avahi_var_lib_t) -@@ -47,6 +48,9 @@ - kernel_read_proc_symlinks(avahi_t) +@@ -42,11 +43,13 @@ + allow avahi_t avahi_var_run_t:dir setattr; + files_pid_filetrans(avahi_t, avahi_var_run_t, file) + ++kernel_read_system_state(avahi_t) + kernel_read_kernel_sysctls(avahi_t) +-kernel_list_proc(avahi_t) +-kernel_read_proc_symlinks(avahi_t) kernel_read_network_state(avahi_t) +corecmd_exec_bin(avahi_t) @@ -11938,7 +11994,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol corenet_all_recvfrom_unlabeled(avahi_t) corenet_all_recvfrom_netlabel(avahi_t) corenet_tcp_sendrecv_generic_if(avahi_t) -@@ -85,6 +89,10 @@ +@@ -85,6 +88,10 @@ miscfiles_read_localization(avahi_t) miscfiles_read_certs(avahi_t) @@ -12058,7 +12114,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## All of the rules required to administrate diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/bluetooth.te serefpolicy-3.7.4/policy/modules/services/bluetooth.te --- nsaserefpolicy/policy/modules/services/bluetooth.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.4/policy/modules/services/bluetooth.te 2009-12-15 14:56:49.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/services/bluetooth.te 2009-12-16 17:05:48.000000000 -0500 @@ -54,9 +54,9 @@ # Bluetooth services local policy # @@ -12079,15 +12135,16 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol read_files_pattern(bluetooth_t, bluetooth_conf_t, bluetooth_conf_t) -@@ -94,6 +95,7 @@ +@@ -94,6 +95,8 @@ kernel_read_kernel_sysctls(bluetooth_t) kernel_read_system_state(bluetooth_t) kernel_read_network_state(bluetooth_t) +kernel_request_load_module(bluetooth_t) ++kernel_search_debugfs(bluetooth_t) corenet_all_recvfrom_unlabeled(bluetooth_t) corenet_all_recvfrom_netlabel(bluetooth_t) -@@ -111,6 +113,7 @@ +@@ -111,6 +114,7 @@ dev_rw_generic_usb_dev(bluetooth_t) dev_read_urand(bluetooth_t) dev_rw_input_dev(bluetooth_t) @@ -12095,7 +12152,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol fs_getattr_all_fs(bluetooth_t) fs_search_auto_mountpoints(bluetooth_t) -@@ -154,6 +157,10 @@ +@@ -154,6 +158,10 @@ ') optional_policy(` @@ -13291,8 +13348,8 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/corosync.te serefpolicy-3.7.4/policy/modules/services/corosync.te --- nsaserefpolicy/policy/modules/services/corosync.te 1969-12-31 19:00:00.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/services/corosync.te 2009-12-15 14:56:49.000000000 -0500 -@@ -0,0 +1,109 @@ ++++ serefpolicy-3.7.4/policy/modules/services/corosync.te 2009-12-16 13:52:21.000000000 -0500 +@@ -0,0 +1,110 @@ + +policy_module(corosync,1.0.0) + @@ -13380,6 +13437,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol + +miscfiles_read_localization(corosync_t) + ++init_read_script_state(corosync_t) +init_rw_script_tmp_files(corosync_t) + +logging_send_syslog_msg(corosync_t) @@ -16444,7 +16502,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/mysql.te serefpolicy-3.7.4/policy/modules/services/mysql.te --- nsaserefpolicy/policy/modules/services/mysql.te 2009-08-14 16:14:31.000000000 -0400 -+++ serefpolicy-3.7.4/policy/modules/services/mysql.te 2009-12-15 16:12:11.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/services/mysql.te 2009-12-16 14:02:23.000000000 -0500 @@ -1,6 +1,13 @@ policy_module(mysql, 1.11.0) @@ -16471,7 +16529,13 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ifdef(`distro_redhat',` # because Fedora has the sock_file in the database directory type_transition mysqld_t mysqld_db_t:sock_file mysqld_var_run_t; -@@ -136,10 +148,17 @@ +@@ -131,15 +143,22 @@ + # Local mysqld_safe policy + # + +-allow mysqld_safe_t self:capability { dac_override fowner chown }; ++allow mysqld_safe_t self:capability { kill dac_override fowner chown }; + allow mysqld_safe_t self:fifo_file rw_fifo_file_perms; domtrans_pattern(mysqld_safe_t, mysqld_exec_t, mysqld_t) @@ -18309,7 +18373,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/openvpn.te serefpolicy-3.7.4/policy/modules/services/openvpn.te --- nsaserefpolicy/policy/modules/services/openvpn.te 2009-11-17 10:54:26.000000000 -0500 -+++ serefpolicy-3.7.4/policy/modules/services/openvpn.te 2009-12-15 14:56:49.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/services/openvpn.te 2009-12-16 14:04:12.000000000 -0500 @@ -41,7 +41,7 @@ # openvpn local policy # @@ -18328,6 +18392,15 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol logging_send_syslog_msg(openvpn_t) miscfiles_read_localization(openvpn_t) +@@ -107,7 +109,7 @@ + + sysnet_dns_name_resolve(openvpn_t) + sysnet_exec_ifconfig(openvpn_t) +-sysnet_write_config(openvpn_t) ++sysnet_manage_config(openvpn_t) + sysnet_etc_filetrans_config(openvpn_t) + + userdom_use_user_terminals(openvpn_t) diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/pcscd.if serefpolicy-3.7.4/policy/modules/services/pcscd.if --- nsaserefpolicy/policy/modules/services/pcscd.if 2009-07-14 14:19:57.000000000 -0400 +++ serefpolicy-3.7.4/policy/modules/services/pcscd.if 2009-12-15 14:56:49.000000000 -0500 @@ -24225,7 +24298,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ## diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/sssd.te serefpolicy-3.7.4/policy/modules/services/sssd.te --- nsaserefpolicy/policy/modules/services/sssd.te 2009-07-14 14:19:57.000000000 -0400 -+++ serefpolicy-3.7.4/policy/modules/services/sssd.te 2009-12-15 14:56:49.000000000 -0500 ++++ serefpolicy-3.7.4/policy/modules/services/sssd.te 2009-12-16 11:14:38.000000000 -0500 @@ -16,6 +16,9 @@ type sssd_var_lib_t; files_type(sssd_var_lib_t) @@ -24236,15 +24309,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol type sssd_var_run_t; files_pid_file(sssd_var_run_t) -@@ -23,7 +26,7 @@ +@@ -23,8 +26,8 @@ # # sssd local policy # -allow sssd_t self:capability { sys_nice setuid }; -+allow sssd_t self:capability { sys_nice setgid setuid }; - allow sssd_t self:process { setsched signal getsched }; +-allow sssd_t self:process { setsched signal getsched }; ++allow sssd_t self:capability { kill sys_nice setgid setuid }; ++allow sssd_t self:process { setsched sigkill signal getsched }; allow sssd_t self:fifo_file rw_file_perms; allow sssd_t self:unix_stream_socket { create_stream_socket_perms connectto }; + @@ -33,16 +36,24 @@ manage_sock_files_pattern(sssd_t, sssd_var_lib_t, sssd_var_lib_t) files_var_lib_filetrans(sssd_t, sssd_var_lib_t, { file dir } ) diff --git a/selinux-policy.spec b/selinux-policy.spec index 88cf8c3..04c0ca9 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -20,7 +20,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.7.4 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -449,6 +449,9 @@ exit 0 %endif %changelog +* Wed Dec 16 2009 Dan Walsh 3.7.4-3 +- Fixes for abrt calls + * Fri Dec 11 2009 Dan Walsh 3.7.4-2 - Add tgtd policy