From f5018f18f8ae75dabf5912a9aed99507b3aab799 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Sep 24 2007 20:26:12 +0000 Subject: - Fix maxima --- diff --git a/policy-20070703.patch b/policy-20070703.patch index 2c89b39..7078d77 100644 --- a/policy-20070703.patch +++ b/policy-20070703.patch @@ -5080,20 +5080,29 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups /var/spool/cups(/.*)? gen_context(system_u:object_r:print_spool_t,mls_systemhigh) +/usr/local/Brother/inf(/.*)? gen_context(system_u:object_r:cupsd_rw_etc_t,s0) +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.if serefpolicy-3.0.8/policy/modules/services/cups.if +--- nsaserefpolicy/policy/modules/services/cups.if 2007-05-29 14:10:57.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/cups.if 2007-09-24 15:01:39.000000000 -0400 +@@ -247,3 +247,4 @@ + files_search_pids($1) + stream_connect_pattern($1,ptal_var_run_t,ptal_var_run_t,ptal_t) + ') ++ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups.te serefpolicy-3.0.8/policy/modules/services/cups.te --- nsaserefpolicy/policy/modules/services/cups.te 2007-09-12 10:34:50.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/cups.te 2007-09-21 09:12:45.000000000 -0400 -@@ -49,9 +49,6 @@ ++++ serefpolicy-3.0.8/policy/modules/services/cups.te 2007-09-24 14:34:13.000000000 -0400 +@@ -48,9 +48,7 @@ + type hplip_t; type hplip_exec_t; init_daemon_domain(hplip_t,hplip_exec_t) - +- -type hplip_etc_t; -files_config_file(hplip_etc_t) -- ++domtrans_pattern(cupsd_t,hplip_exec_t, hplip_t) + type hplip_var_run_t; files_pid_file(hplip_var_run_t) - -@@ -81,12 +78,11 @@ +@@ -81,12 +79,11 @@ # /usr/lib/cups/backend/serial needs sys_admin(?!) allow cupsd_t self:capability { sys_admin dac_override dac_read_search kill setgid setuid fsetid net_bind_service fowner chown dac_override sys_resource sys_tty_config }; dontaudit cupsd_t self:capability { sys_tty_config net_admin }; @@ -5107,7 +5116,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups allow cupsd_t self:tcp_socket create_stream_socket_perms; allow cupsd_t self:udp_socket create_socket_perms; allow cupsd_t self:appletalk_socket create_socket_perms; -@@ -105,7 +101,7 @@ +@@ -105,7 +102,7 @@ # allow cups to execute its backend scripts can_exec(cupsd_t, cupsd_exec_t) @@ -5116,7 +5125,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups allow cupsd_t cupsd_exec_t:lnk_file read; manage_files_pattern(cupsd_t,cupsd_log_t,cupsd_log_t) -@@ -122,13 +118,13 @@ +@@ -122,13 +119,13 @@ manage_sock_files_pattern(cupsd_t,cupsd_var_run_t,cupsd_var_run_t) files_pid_filetrans(cupsd_t,cupsd_var_run_t,file) @@ -5132,7 +5141,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups kernel_read_system_state(cupsd_t) kernel_read_network_state(cupsd_t) kernel_read_all_sysctls(cupsd_t) -@@ -150,21 +146,26 @@ +@@ -150,21 +147,26 @@ corenet_tcp_bind_reserved_port(cupsd_t) corenet_dontaudit_tcp_bind_all_reserved_ports(cupsd_t) corenet_tcp_connect_all_ports(cupsd_t) @@ -5160,7 +5169,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups mls_file_downgrade(cupsd_t) mls_file_write_all_levels(cupsd_t) mls_file_read_all_levels(cupsd_t) -@@ -174,6 +175,7 @@ +@@ -174,6 +176,7 @@ term_search_ptys(cupsd_t) auth_domtrans_chk_passwd(cupsd_t) @@ -5168,7 +5177,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups auth_dontaudit_read_pam_pid(cupsd_t) # Filter scripts may be shell scripts, and may invoke progs like /bin/mktemp -@@ -187,7 +189,7 @@ +@@ -187,7 +190,7 @@ # read python modules files_read_usr_files(cupsd_t) # for /var/lib/defoma @@ -5177,7 +5186,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups files_list_world_readable(cupsd_t) files_read_world_readable_files(cupsd_t) files_read_world_readable_symlinks(cupsd_t) -@@ -202,6 +204,7 @@ +@@ -202,6 +205,7 @@ files_dontaudit_getattr_all_tmp_files(cupsd_t) selinux_compute_access_vector(cupsd_t) @@ -5185,7 +5194,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups init_exec_script_files(cupsd_t) -@@ -221,17 +224,37 @@ +@@ -221,17 +225,37 @@ sysnet_read_config(cupsd_t) @@ -5223,7 +5232,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups apm_domtrans_client(cupsd_t) ') -@@ -263,16 +286,16 @@ +@@ -263,16 +287,16 @@ ') optional_policy(` @@ -5244,7 +5253,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups seutil_sigchld_newrole(cupsd_t) ') -@@ -331,6 +354,7 @@ +@@ -331,6 +355,7 @@ dev_read_sysfs(cupsd_config_t) dev_read_urand(cupsd_config_t) dev_read_rand(cupsd_config_t) @@ -5252,7 +5261,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups fs_getattr_all_fs(cupsd_config_t) fs_search_auto_mountpoints(cupsd_config_t) -@@ -377,6 +401,14 @@ +@@ -377,6 +402,14 @@ ') optional_policy(` @@ -5267,7 +5276,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups cron_system_entry(cupsd_config_t, cupsd_config_exec_t) ') -@@ -526,11 +558,6 @@ +@@ -526,11 +559,6 @@ cups_stream_connect(hplip_t) @@ -5279,7 +5288,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups manage_files_pattern(hplip_t,hplip_var_run_t,hplip_var_run_t) files_pid_filetrans(hplip_t,hplip_var_run_t,file) -@@ -560,7 +587,7 @@ +@@ -560,7 +588,7 @@ dev_read_urand(hplip_t) dev_read_rand(hplip_t) dev_rw_generic_usb_dev(hplip_t) @@ -5288,7 +5297,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/cups fs_getattr_all_fs(hplip_t) fs_search_auto_mountpoints(hplip_t) -@@ -587,8 +614,6 @@ +@@ -587,8 +615,6 @@ userdom_dontaudit_search_sysadm_home_dirs(hplip_t) userdom_dontaudit_search_all_users_home_content(hplip_t) @@ -5338,7 +5347,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/dbus.if serefpolicy-3.0.8/policy/modules/services/dbus.if --- nsaserefpolicy/policy/modules/services/dbus.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/dbus.if 2007-09-21 06:44:48.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/dbus.if 2007-09-24 11:08:39.000000000 -0400 @@ -50,6 +50,12 @@ ## # @@ -6217,9 +6226,31 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/exim + userdom_write_unpriv_users_tmp_files(exim_t) +} + +diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.if serefpolicy-3.0.8/policy/modules/services/ftp.if +--- nsaserefpolicy/policy/modules/services/ftp.if 2007-05-29 14:10:57.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ftp.if 2007-09-24 15:42:55.000000000 -0400 +@@ -28,11 +28,13 @@ + type ftpd_t; + ') + +- userdom_manage_user_home_content_files($1,ftpd_t) +- userdom_manage_user_home_content_symlinks($1,ftpd_t) +- userdom_manage_user_home_content_sockets($1,ftpd_t) +- userdom_manage_user_home_content_pipes($1,ftpd_t) +- userdom_user_home_dir_filetrans_user_home_content($1,ftpd_t,{ dir file lnk_file sock_file fifo_file }) ++ tunable_policy(`ftp_home_dir',` ++ userdom_manage_user_home_content_files($1,ftpd_t) ++ userdom_manage_user_home_content_symlinks($1,ftpd_t) ++ userdom_manage_user_home_content_sockets($1,ftpd_t) ++ userdom_manage_user_home_content_pipes($1,ftpd_t) ++ userdom_user_home_dir_filetrans_user_home_content($1,ftpd_t,{ dir file lnk_file sock_file fifo_file }) ++ ') + ') + + ######################################## diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/ftp.te serefpolicy-3.0.8/policy/modules/services/ftp.te --- nsaserefpolicy/policy/modules/services/ftp.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/ftp.te 2007-09-17 16:39:01.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/ftp.te 2007-09-24 15:47:19.000000000 -0400 @@ -88,6 +88,7 @@ allow ftpd_t self:unix_stream_socket create_stream_socket_perms; allow ftpd_t self:tcp_socket create_stream_socket_perms; @@ -7133,7 +7164,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/networkmanager.te serefpolicy-3.0.8/policy/modules/services/networkmanager.te --- nsaserefpolicy/policy/modules/services/networkmanager.te 2007-09-12 10:34:50.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/networkmanager.te 2007-09-22 07:14:54.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/networkmanager.te 2007-09-24 11:09:11.000000000 -0400 @@ -13,6 +13,9 @@ type NetworkManager_var_run_t; files_pid_file(NetworkManager_var_run_t) @@ -7163,17 +7194,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/netw kernel_read_system_state(NetworkManager_t) kernel_read_network_state(NetworkManager_t) kernel_read_kernel_sysctls(NetworkManager_t) -@@ -138,6 +144,9 @@ +@@ -138,6 +144,10 @@ dbus_system_bus_client_template(NetworkManager,NetworkManager_t) dbus_connect_system_bus(NetworkManager_t) dbus_send_system_bus(NetworkManager_t) ++ dbus_dontaudit_rw_system_selinux_socket(NetworkManager_t) + optional_policy(` + rpm_dbus_chat(NetworkManager_t) + ') ') optional_policy(` -@@ -173,8 +182,10 @@ +@@ -173,8 +183,10 @@ ') optional_policy(` @@ -9795,7 +9827,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser /var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xserver.if serefpolicy-3.0.8/policy/modules/services/xserver.if --- nsaserefpolicy/policy/modules/services/xserver.if 2007-07-03 07:06:27.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/services/xserver.if 2007-09-20 15:27:25.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/services/xserver.if 2007-09-24 16:08:36.000000000 -0400 @@ -126,6 +126,8 @@ # read events - the synaptics touchpad driver reads raw events dev_rw_input_dev($1_xserver_t) @@ -9818,6 +9850,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/xser term_setattr_unallocated_ttys($1_xserver_t) term_use_unallocated_ttys($1_xserver_t) +@@ -251,7 +254,7 @@ + userdom_user_home_content($1,$1_fonts_cache_t) + + type $1_fonts_config_t, fonts_config_type; +- userdom_user_home_content($1,$1_fonts_cache_t) ++ userdom_user_home_content($1,$1_fonts_config_t) + + type $1_iceauth_t; + domain_type($1_iceauth_t) @@ -282,6 +285,7 @@ domtrans_pattern($1_xserver_t, xauth_exec_t, $1_xauth_t) @@ -10387,7 +10428,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo +/var/cache/coolkey(/.*)? gen_context(system_u:object_r:auth_cache_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.if serefpolicy-3.0.8/policy/modules/system/authlogin.if --- nsaserefpolicy/policy/modules/system/authlogin.if 2007-08-22 07:14:13.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/authlogin.if 2007-09-21 19:32:00.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/authlogin.if 2007-09-24 10:44:04.000000000 -0400 @@ -26,7 +26,8 @@ type $1_chkpwd_t, can_read_shadow_passwords; application_domain($1_chkpwd_t,chkpwd_exec_t) @@ -10408,17 +10449,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo dontaudit $2 shadow_t:file { getattr read }; # Transition from the user domain to this domain. -@@ -169,6 +167,9 @@ +@@ -169,6 +167,10 @@ ## # interface(`auth_login_pgm_domain',` + gen_require(` + attribute keyring_type; ++ type auth_cache_t; + ') domain_type($1) domain_subj_id_change_exemption($1) -@@ -176,11 +177,28 @@ +@@ -176,11 +178,28 @@ domain_obj_id_change_exemption($1) role system_r types $1; @@ -10447,7 +10489,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo selinux_get_fs_mount($1) selinux_validate_context($1) selinux_compute_access_vector($1) -@@ -196,22 +214,33 @@ +@@ -196,22 +215,33 @@ mls_fd_share_all_levels($1) auth_domtrans_chk_passwd($1) @@ -10482,7 +10524,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') ') -@@ -309,9 +338,6 @@ +@@ -309,9 +339,6 @@ type system_chkpwd_t, chkpwd_exec_t, shadow_t; ') @@ -10492,7 +10534,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo corecmd_search_bin($1) domtrans_pattern($1,chkpwd_exec_t,system_chkpwd_t) -@@ -329,6 +355,7 @@ +@@ -329,6 +356,7 @@ optional_policy(` kerberos_use($1) @@ -10500,7 +10542,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') optional_policy(` -@@ -347,6 +374,37 @@ +@@ -347,6 +375,37 @@ ######################################## ## @@ -10538,7 +10580,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ## Get the attributes of the shadow passwords file. ## ## -@@ -695,6 +753,24 @@ +@@ -695,6 +754,24 @@ ######################################## ## @@ -10563,7 +10605,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ## Execute pam programs in the PAM domain. ## ## -@@ -1318,14 +1394,9 @@ +@@ -1318,14 +1395,9 @@ ## # interface(`auth_use_nsswitch',` @@ -10578,7 +10620,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo files_list_var_lib($1) miscfiles_read_certs($1) -@@ -1381,3 +1452,163 @@ +@@ -1381,3 +1453,163 @@ typeattribute $1 can_write_shadow_passwords; typeattribute $1 can_relabelto_shadow_passwords; ') @@ -10744,7 +10786,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo + diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlogin.te serefpolicy-3.0.8/policy/modules/system/authlogin.te --- nsaserefpolicy/policy/modules/system/authlogin.te 2007-08-22 07:14:12.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/authlogin.te 2007-09-22 08:12:19.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/authlogin.te 2007-09-24 12:02:34.000000000 -0400 @@ -9,6 +9,13 @@ attribute can_read_shadow_passwords; attribute can_write_shadow_passwords; @@ -10798,7 +10840,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo dev_getattr_scanner_dev(pam_console_t) dev_setattr_scanner_dev(pam_console_t) dev_getattr_sound_dev(pam_console_t) -@@ -236,7 +254,7 @@ +@@ -200,6 +218,7 @@ + + fs_list_auto_mountpoints(pam_console_t) + fs_list_noxattr_fs(pam_console_t) ++fs_getattr_all_fs(pam_console_t) + + init_use_fds(pam_console_t) + init_use_script_ptys(pam_console_t) +@@ -236,7 +255,7 @@ optional_policy(` xserver_read_xdm_pid(pam_console_t) @@ -10807,7 +10857,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/authlo ') ######################################## -@@ -302,3 +320,28 @@ +@@ -302,3 +321,28 @@ xserver_use_xdm_fds(utempter_t) xserver_rw_xdm_pipes(utempter_t) ') @@ -11017,8 +11067,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/hostna +') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.if serefpolicy-3.0.8/policy/modules/system/init.if --- nsaserefpolicy/policy/modules/system/init.if 2007-08-22 07:14:12.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/init.if 2007-09-24 09:49:24.000000000 -0400 -@@ -211,6 +211,20 @@ ++++ serefpolicy-3.0.8/policy/modules/system/init.if 2007-09-24 10:08:01.000000000 -0400 +@@ -211,6 +211,21 @@ kernel_dontaudit_use_fds($1) ') ') @@ -11029,6 +11079,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i + term_dontaudit_use_all_user_ttys($1) + term_dontaudit_use_all_user_ptys($1) + ') ++ + optional_policy(` + tunable_policy(`allow_daemons_use_tty',` + unconfined_use_terminals($1) @@ -11039,7 +11090,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## -@@ -540,18 +554,19 @@ +@@ -540,18 +555,19 @@ # interface(`init_spec_domtrans_script',` gen_require(` @@ -11063,7 +11114,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ') -@@ -567,18 +582,46 @@ +@@ -567,18 +583,46 @@ # interface(`init_domtrans_script',` gen_require(` @@ -11114,7 +11165,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ') -@@ -609,11 +652,11 @@ +@@ -609,11 +653,11 @@ # cjp: added for gentoo integrated run_init interface(`init_script_file_domtrans',` gen_require(` @@ -11128,7 +11179,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## -@@ -684,11 +727,11 @@ +@@ -684,11 +728,11 @@ # interface(`init_getattr_script_files',` gen_require(` @@ -11142,7 +11193,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## -@@ -703,11 +746,11 @@ +@@ -703,11 +747,11 @@ # interface(`init_exec_script_files',` gen_require(` @@ -11156,7 +11207,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## -@@ -931,6 +974,7 @@ +@@ -931,6 +975,7 @@ dontaudit $1 initrc_t:unix_stream_socket connectto; ') @@ -11164,7 +11215,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ######################################## ## ## Send messages to init scripts over dbus. -@@ -1030,11 +1074,11 @@ +@@ -1030,11 +1075,11 @@ # interface(`init_read_script_files',` gen_require(` @@ -11178,7 +11229,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## -@@ -1252,7 +1296,7 @@ +@@ -1252,7 +1297,7 @@ type initrc_var_run_t; ') @@ -11187,7 +11238,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.i ') ######################################## -@@ -1273,3 +1317,64 @@ +@@ -1273,3 +1318,64 @@ files_search_pids($1) allow $1 initrc_var_run_t:file manage_file_perms; ') @@ -11433,8 +11484,47 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/init.t ') diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec.te serefpolicy-3.0.8/policy/modules/system/ipsec.te --- nsaserefpolicy/policy/modules/system/ipsec.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/ipsec.te 2007-09-17 16:20:18.000000000 -0400 -@@ -283,6 +283,7 @@ ++++ serefpolicy-3.0.8/policy/modules/system/ipsec.te 2007-09-24 10:16:55.000000000 -0400 +@@ -56,7 +56,6 @@ + allow ipsec_t self:capability { net_admin dac_override dac_read_search }; + dontaudit ipsec_t self:capability sys_tty_config; + allow ipsec_t self:process signal; +-allow ipsec_t self:netlink_route_socket r_netlink_socket_perms; + allow ipsec_t self:tcp_socket create_stream_socket_perms; + allow ipsec_t self:key_socket { create write read setopt }; + allow ipsec_t self:fifo_file { read getattr }; +@@ -84,6 +83,8 @@ + allow ipsec_mgmt_t ipsec_t:fifo_file rw_file_perms; + allow ipsec_mgmt_t ipsec_t:process sigchld; + ++auth_use_nsswitch(ipsec_t) ++ + kernel_read_kernel_sysctls(ipsec_t) + kernel_list_proc(ipsec_t) + kernel_read_proc_symlinks(ipsec_t) +@@ -134,16 +135,10 @@ + + miscfiles_read_localization(ipsec_t) + +-sysnet_read_config(ipsec_t) +- + userdom_dontaudit_use_unpriv_user_fds(ipsec_t) + userdom_dontaudit_search_sysadm_home_dirs(ipsec_t) + + optional_policy(` +- nis_use_ypbind(ipsec_t) +-') +- +-optional_policy(` + seutil_sigchld_newrole(ipsec_t) + ') + +@@ -278,11 +273,11 @@ + # + + allow racoon_t self:capability { net_admin net_bind_service }; +-allow racoon_t self:netlink_route_socket create_netlink_socket_perms; + allow racoon_t self:unix_dgram_socket { connect create ioctl write }; allow racoon_t self:netlink_selinux_socket { bind create read }; allow racoon_t self:udp_socket create_socket_perms; allow racoon_t self:key_socket { create read setopt write }; @@ -11442,6 +11532,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/ipsec. # manage pid file manage_files_pattern(racoon_t,ipsec_var_run_t,ipsec_var_run_t) +@@ -299,6 +294,8 @@ + + allow racoon_t ipsec_spd_t:association setcontext; + ++auth_use_nsswitch(racoon_t) ++ + kernel_read_network_state(racoon_t) + + corenet_all_recvfrom_unlabeled(racoon_t) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iptables.te serefpolicy-3.0.8/policy/modules/system/iptables.te --- nsaserefpolicy/policy/modules/system/iptables.te 2007-09-12 10:34:51.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/system/iptables.te 2007-09-17 16:20:18.000000000 -0400 @@ -11478,7 +11577,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/iscsi. diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.fc serefpolicy-3.0.8/policy/modules/system/libraries.fc --- nsaserefpolicy/policy/modules/system/libraries.fc 2007-08-02 08:17:28.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/libraries.fc 2007-09-18 10:51:20.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/libraries.fc 2007-09-24 15:26:50.000000000 -0400 @@ -65,11 +65,12 @@ /opt/(.*/)?java/.+\.jar -- gen_context(system_u:object_r:lib_t,s0) /opt/(.*/)?jre.*/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) @@ -11511,7 +11610,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar /usr/lib(64)?/python2.4/site-packages/M2Crypto/__m2crypto.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) # vmware -@@ -284,3 +289,8 @@ +@@ -284,3 +289,9 @@ /var/spool/postfix/lib(64)?(/.*)? gen_context(system_u:object_r:lib_t,s0) /var/spool/postfix/usr(/.*)? gen_context(system_u:object_r:lib_t,s0) /var/spool/postfix/lib(64)?/ld.*\.so.* -- gen_context(system_u:object_r:ld_so_t,s0) @@ -11520,6 +11619,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/librar + +/var/cache/ldconfig(/.*)? gen_context(system_u:object_r:ldconfig_cache_t,s0) +/usr/lib/libFLAC\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0) ++/usr/lib/maxima/[^/]+/binary-gcl/maxima -- gen_context(system_u:object_r:textrel_shlib_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/libraries.te serefpolicy-3.0.8/policy/modules/system/libraries.te --- nsaserefpolicy/policy/modules/system/libraries.te 2007-08-02 08:17:28.000000000 -0400 +++ serefpolicy-3.0.8/policy/modules/system/libraries.te 2007-09-19 13:33:20.000000000 -0400 @@ -12208,7 +12308,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.fc /etc/lvm/lock(/.*)? gen_context(system_u:object_r:lvm_lock_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te serefpolicy-3.0.8/policy/modules/system/lvm.te --- nsaserefpolicy/policy/modules/system/lvm.te 2007-07-25 10:37:42.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/lvm.te 2007-09-21 15:33:57.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/lvm.te 2007-09-24 15:55:39.000000000 -0400 @@ -44,9 +44,9 @@ # Cluster LVM daemon local policy # @@ -12221,7 +12321,23 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te dontaudit clvmd_t self:process ptrace; allow clvmd_t self:socket create_socket_perms; allow clvmd_t self:fifo_file rw_fifo_file_perms; -@@ -85,6 +85,9 @@ +@@ -54,11 +54,15 @@ + allow clvmd_t self:tcp_socket create_stream_socket_perms; + allow clvmd_t self:udp_socket create_socket_perms; + ++init_dontaudit_getattr_initctl(clvmd_t) ++ + manage_files_pattern(clvmd_t,clvmd_var_run_t,clvmd_var_run_t) + files_pid_filetrans(clvmd_t,clvmd_var_run_t,file) + + read_files_pattern(clvmd_t,lvm_metadata_t,lvm_metadata_t) + ++auth_use_nsswitch(clvmd_t) ++ + kernel_read_kernel_sysctls(clvmd_t) + kernel_read_system_state(clvmd_t) + kernel_list_proc(clvmd_t) +@@ -85,10 +89,15 @@ corenet_sendrecv_generic_server_packets(clvmd_t) dev_read_sysfs(clvmd_t) @@ -12231,7 +12347,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te dev_manage_generic_chr_files(clvmd_t) dev_rw_lvm_control(clvmd_t) dev_dontaudit_getattr_all_blk_files(clvmd_t) -@@ -102,6 +105,7 @@ + dev_dontaudit_getattr_all_chr_files(clvmd_t) ++dev_create_generic_dirs(clvmd_t) ++dev_delete_generic_dirs(clvmd_t) + + files_read_etc_files(clvmd_t) + files_list_usr(clvmd_t) +@@ -99,9 +108,12 @@ + fs_dontaudit_read_removable_files(clvmd_t) + + storage_dontaudit_getattr_removable_dev(clvmd_t) ++storage_dev_filetrans_fixed_disk(clvmd_t) ++storage_manage_fixed_disk(clvmd_t) domain_use_interactive_fds(clvmd_t) @@ -12239,17 +12366,30 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te storage_raw_read_fixed_disk(clvmd_t) libs_use_ld_so(clvmd_t) -@@ -113,6 +117,9 @@ +@@ -113,8 +125,9 @@ seutil_dontaudit_search_config(clvmd_t) seutil_sigchld_newrole(clvmd_t) +- +-sysnet_read_config(clvmd_t) +seutil_read_config(clvmd_t) +seutil_read_file_contexts(clvmd_t) +seutil_search_default_contexts(clvmd_t) - sysnet_read_config(clvmd_t) + userdom_dontaudit_use_unpriv_user_fds(clvmd_t) + userdom_dontaudit_search_sysadm_home_dirs(clvmd_t) +@@ -131,10 +144,6 @@ + ') -@@ -150,7 +157,8 @@ + optional_policy(` +- nis_use_ypbind(clvmd_t) +-') +- +-optional_policy(` + ricci_dontaudit_rw_modcluster_pipes(clvmd_t) + ricci_dontaudit_use_modcluster_fds(clvmd_t) + ') +@@ -150,7 +159,8 @@ # DAC overrides and mknod for modifying /dev entries (vgmknodes) # rawio needed for dmraid @@ -12259,7 +12399,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te dontaudit lvm_t self:capability sys_tty_config; allow lvm_t self:process { sigchld sigkill sigstop signull signal }; # LVM will complain a lot if it cannot set its priority. -@@ -208,7 +216,6 @@ +@@ -208,7 +218,6 @@ selinux_compute_user_contexts(lvm_t) dev_create_generic_chr_files(lvm_t) @@ -12267,7 +12407,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te dev_read_rand(lvm_t) dev_read_urand(lvm_t) dev_rw_lvm_control(lvm_t) -@@ -228,6 +235,8 @@ +@@ -228,6 +237,8 @@ dev_dontaudit_getattr_generic_blk_files(lvm_t) dev_dontaudit_getattr_generic_pipes(lvm_t) dev_create_generic_dirs(lvm_t) @@ -12276,7 +12416,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te fs_getattr_xattr_fs(lvm_t) fs_search_auto_mountpoints(lvm_t) -@@ -246,6 +255,7 @@ +@@ -246,6 +257,7 @@ storage_dev_filetrans_fixed_disk(lvm_t) # Access raw devices and old /dev/lvm (c 109,0). Is this needed? storage_manage_fixed_disk(lvm_t) @@ -12284,7 +12424,15 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te term_getattr_all_user_ttys(lvm_t) term_list_ptys(lvm_t) -@@ -275,6 +285,8 @@ +@@ -254,6 +266,7 @@ + + domain_use_interactive_fds(lvm_t) + ++files_read_usr_files(lvm_t) + files_read_etc_files(lvm_t) + files_read_etc_runtime_files(lvm_t) + # for when /usr is not mounted: +@@ -275,6 +288,8 @@ seutil_search_default_contexts(lvm_t) seutil_sigchld_newrole(lvm_t) @@ -12293,7 +12441,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/lvm.te ifdef(`distro_redhat',` # this is from the initrd: files_rw_isid_type_dirs(lvm_t) -@@ -293,5 +305,14 @@ +@@ -293,5 +308,14 @@ ') optional_policy(` @@ -13254,15 +13402,16 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/udev.t diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.fc serefpolicy-3.0.8/policy/modules/system/unconfined.fc --- nsaserefpolicy/policy/modules/system/unconfined.fc 2007-05-29 14:10:58.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/unconfined.fc 2007-09-21 06:46:14.000000000 -0400 -@@ -10,3 +10,4 @@ ++++ serefpolicy-3.0.8/policy/modules/system/unconfined.fc 2007-09-24 15:27:43.000000000 -0400 +@@ -10,3 +10,5 @@ /usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) /usr/local/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) +/usr/bin/rhythmbox -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) ++/usr/bin/sbcl -- gen_context(system_u:object_r:unconfined_execmem_exec_t,s0) diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.if serefpolicy-3.0.8/policy/modules/system/unconfined.if --- nsaserefpolicy/policy/modules/system/unconfined.if 2007-06-15 14:54:34.000000000 -0400 -+++ serefpolicy-3.0.8/policy/modules/system/unconfined.if 2007-09-21 19:31:25.000000000 -0400 ++++ serefpolicy-3.0.8/policy/modules/system/unconfined.if 2007-09-24 15:31:00.000000000 -0400 @@ -12,14 +12,13 @@ # interface(`unconfined_domain_noaudit',` diff --git a/selinux-policy.spec b/selinux-policy.spec index 16fb697..4e27975 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -17,7 +17,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.0.8 -Release: 10%{?dist} +Release: 11%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -362,6 +362,9 @@ exit 0 %endif %changelog +* Mon Sep 24 2007 Dan Walsh 3.0.8-11 +- Fix maxima + * Mon Sep 24 2007 Dan Walsh 3.0.8-10 - Eliminate rpm_t:fifo_file avcs - Fix dbus path for helper app